Edit tour

Windows Analysis Report
tgBNtoWqIp.exe

Overview

General Information

Sample name:	tgBNtoWqIp.exe renamed because original name is a hash value
Original sample name:	934284591d9e31d5c4868a6608b88c2dd2124fdd45b0248db35f4741d4634bc7.exe
Analysis ID:	1466952
MD5:	f78535a3f5e84f626e1018e587b5b588
SHA1:	8200afc4d351323230fcc4b0a76b529b5d052134
SHA256:	934284591d9e31d5c4868a6608b88c2dd2124fdd45b0248db35f4741d4634bc7
Tags:	exeFormbook
Infos:

Detection

AgentTesla, PureLog Stealer

Score:	100
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

Found malware configuration

Malicious sample detected (through community Yara rule)

Multi AV Scanner detection for submitted file

Yara detected AgentTesla

Yara detected PureLog Stealer

.NET source code contains method to dynamically call methods (often used by packers)

AI detected suspicious sample

Binary is likely a compiled AutoIt script file

Check if machine is in data center or colocation facility

Contains functionality to check if a debugger is running (CheckRemoteDebuggerPresent)

Contains functionality to log keystrokes (.Net Source)

Machine Learning detection for sample

Maps a DLL or memory area into another process

Queries sensitive network adapter information (via WMI, Win32_NetworkAdapter, often done to detect virtual machines)

Queries sensitive video device information (via WMI, Win32_VideoController, often done to detect virtual machines)

Switches to a custom stack to bypass stack traces

Tries to detect sandboxes and other dynamic analysis tools (process name or module or function)

Tries to harvest and steal Putty / WinSCP information (sessions, passwords, etc)

Tries to harvest and steal browser information (history, passwords, etc)

Tries to harvest and steal ftp login credentials

Tries to steal Mail credentials (via file / registry access)

Writes to foreign memory regions

Yara detected Generic Downloader

Checks if the current process is being debugged

Contains functionality for read data from the clipboard

Contains functionality to block mouse and keyboard input (often used to hinder debugging)

Contains functionality to check if a debugger is running (IsDebuggerPresent)

Contains functionality to check if a debugger is running (OutputDebugString,GetLastError)

Contains functionality to check if a window is minimized (may be used to check if an application is visible)

Contains functionality to check the parent process ID (often done to detect debuggers and analysis systems)

Contains functionality to communicate with device drivers

Contains functionality to dynamically determine API calls

Contains functionality to execute programs as a different user

Contains functionality to launch a process as a different user

Contains functionality to launch a program with higher privileges

Contains functionality to modify clipboard data

Contains functionality to open a port and listen for incoming connection (possibly a backdoor)

Contains functionality to query CPU information (cpuid)

Contains functionality to query locales information (e.g. system language)

Contains functionality to read the PEB

Contains functionality to read the clipboard data

Contains functionality to retrieve information about pressed keystrokes

Contains functionality to shutdown / reboot the system

Contains functionality to simulate keystroke presses

Contains functionality to simulate mouse events

Contains functionality which may be used to detect a debugger (GetProcessHeap)

Contains long sleeps (>= 3 min)

Creates a process in suspended mode (likely to inject code)

Detected TCP or UDP traffic on non-standard ports

Detected potential crypto function

Extensive use of GetProcAddress (often used to hide API calls)

Found a high number of Window / User specific system calls (may be a loop to detect user behavior)

Found evasive API chain (date check)

Found large amount of non-executed APIs

Found potential string decryption / allocating functions

HTTP GET or POST without a user agent

IP address seen in connection with other malware

Internet Provider seen in connection with other malware

JA3 SSL client fingerprint seen in connection with other malware

May check the online IP address of the machine

OS version to string mapping found (often used in BOTs)

Potential key logger detected (key state polling based)

Queries sensitive BIOS Information (via WMI, Win32_Bios & Win32_BaseBoard, often done to detect virtual machines)

Queries sensitive processor information (via WMI, Win32_Processor, often done to detect virtual machines)

Queries the volume information (name, serial number etc) of a device

Sample file is different than original file name gathered from version info

Sigma detected: Suspicious Outbound SMTP Connections

Uses 32bit PE files

Uses SMTP (mail sending)

Uses a known web browser user agent for HTTP communication

Uses code obfuscation techniques (call, push, ret)

Yara detected Credential Stealer

Yara signature match

Classification

Process Tree

System is w10x64

tgBNtoWqIp.exe (PID: 7436 cmdline: "C:\Users\user\Desktop\tgBNtoWqIp.exe" MD5: F78535A3F5E84F626E1018E587B5B588)

RegSvcs.exe (PID: 7452 cmdline: "C:\Users\user\Desktop\tgBNtoWqIp.exe" MD5: 9D352BC46709F0CB5EC974633A0C3C94)

cleanup

Malware Threat Intel

Provided by

Name	Description	Attribution	Blogpost URLs	Link
Agent Tesla, AgentTesla	A .NET based information stealer readily available to actors due to leaked builders. The malware is able to log keystrokes, can access the host's clipboard and crawls the disk for credentials or other valuable information. It has the capability to send information back to its C&C via HTTP(S), SMTP, FTP, or towards a Telegram channel.	SWEED	http://blog.nsfocus.net/sweed-611/ http://l1v1ngc0d3.wordpress.com/2021/11/12/agenttesla-dropped-via-nsis-installer/ http://ropgadget.com/posts/originlogger.html http://www.secureworks.com/research/threat-profiles/gold-galleon https://0xmrmagnezi.github.io/malware%20analysis/AgentTesla/	https://malpedia.caad.fkie.fraunhofer.de/details/win.agent_tesla

Malware Configuration

Threatname: Agenttesla

{"Exfil Mode": "SMTP", "Port": "587", "Host": "mail.divanrestoran.com", "Username": "info@divanrestoran.com", "Password": "Div987654-_"}

Yara Signatures

Memory Dumps

Source	Rule	Description	Author	Strings
00000000.00000002.1669136903.00000000040B0000.00000004.00001000.00020000.00000000.sdmp	MALWARE_Win_RedLine	Detects RedLine infostealer	ditekSHen	0x1d0b0:$s1: 23 00 2B 00 33 00 3B 00 43 00 53 00 63 00 73 00 0x80:$s2: 68 10 84 2D 2C 71 EA 7E 2C 71 EA 7E 2C 71 EA 7E 32 23 7F 7E 3F 71 EA 7E 0B B7 91 7E 2B 71 EA 7E 2C 71 EB 7E 5C 71 EA 7E 32 23 6E 7E 1C 71 EA 7E 32 23 69 7E A2 71 EA 7E 32 23 7B 7E 2D 71 EA 7E 0x700:$s3: 83 EC 38 53 B0 26 88 44 24 2B 88 44 24 2F B0 88 88 44 24 30 88 44 24 31 88 44 24 33 55 56 8B F1 B8 0C 00 FE FF 2B C6 89 44 24 14 B8 0D 00 FE FF 2B C6 89 44 24 1C B8 02 00 FE FF 2B C6 89 44 24 ... 0x1ed8a:$s4: B\|BxBtBpBlBhBdB`B\BXBTBPBLBHBDB@B<B8B4B0B,B(B$B B 0x1e9d0:$s5: delete[] 0x1de88:$s6: constructor or from DllMain.
00000001.00000002.4122661159.0000000002BB9000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
00000001.00000002.4122661159.0000000002BB1000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
00000001.00000002.4122661159.0000000002BC4000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
00000001.00000002.4122420156.00000000027D0000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
00000001.00000002.4122420156.00000000027D0000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
00000001.00000002.4122420156.00000000027D0000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_PureLogStealer	Yara detected PureLog Stealer	Joe Security
00000001.00000002.4120171532.0000000000400000.00000040.80000000.00040000.00000000.sdmp	MALWARE_Win_RedLine	Detects RedLine infostealer	ditekSHen	0x1e4b0:$s1: 23 00 2B 00 33 00 3B 00 43 00 53 00 63 00 73 00 0x80:$s2: 68 10 84 2D 2C 71 EA 7E 2C 71 EA 7E 2C 71 EA 7E 32 23 7F 7E 3F 71 EA 7E 0B B7 91 7E 2B 71 EA 7E 2C 71 EB 7E 5C 71 EA 7E 32 23 6E 7E 1C 71 EA 7E 32 23 69 7E A2 71 EA 7E 32 23 7B 7E 2D 71 EA 7E 0x1300:$s3: 83 EC 38 53 B0 26 88 44 24 2B 88 44 24 2F B0 88 88 44 24 30 88 44 24 31 88 44 24 33 55 56 8B F1 B8 0C 00 FE FF 2B C6 89 44 24 14 B8 0D 00 FE FF 2B C6 89 44 24 1C B8 02 00 FE FF 2B C6 89 44 24 ... 0x2018a:$s4: B\|BxBtBpBlBhBdB`B\BXBTBPBLBHBDB@B<B8B4B0B,B(B$B B 0x1fdd0:$s5: delete[] 0x1f288:$s6: constructor or from DllMain.
00000001.00000002.4125198203.0000000005220000.00000004.08000000.00040000.00000000.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
00000001.00000002.4125198203.0000000005220000.00000004.08000000.00040000.00000000.sdmp	JoeSecurity_GenericDownloader_1	Yara detected Generic Downloader	Joe Security
00000001.00000002.4125198203.0000000005220000.00000004.08000000.00040000.00000000.sdmp	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
00000001.00000002.4125198203.0000000005220000.00000004.08000000.00040000.00000000.sdmp	JoeSecurity_PureLogStealer	Yara detected PureLog Stealer	Joe Security
00000001.00000002.4125198203.0000000005220000.00000004.08000000.00040000.00000000.sdmp	INDICATOR_SUSPICIOUS_EXE_VaultSchemaGUID	Detects executables referencing Windows vault credential objects. Observed in infostealers	ditekSHen	0x42535:$s1: 2F1A6504-0641-44CF-8BB5-3612D865F2E5 0x425a7:$s2: 3CCD5499-87A8-4B10-A215-608888DD3B55 0x42631:$s3: 154E23D0-C644-4E6F-8CE6-5069272F999F 0x426c3:$s4: 4BF4C442-9B8A-41A0-B380-DD4A704DDB28 0x4272d:$s5: 77BC582B-F0A6-4E15-4E80-61736B6F3B29 0x4279f:$s6: E69D7838-91B5-4FC9-89D5-230D4D4CC2BC 0x42835:$s7: 3E0E35BE-1B77-43E7-B873-AED901B6275B 0x428c5:$s8: 3C886FF3-2669-4AA2-A8FB-3F6759A77548
00000001.00000002.4122661159.0000000002B88000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
00000001.00000002.4122661159.0000000002B88000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
00000001.00000002.4124791586.0000000005160000.00000004.08000000.00040000.00000000.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
00000001.00000002.4124791586.0000000005160000.00000004.08000000.00040000.00000000.sdmp	JoeSecurity_GenericDownloader_1	Yara detected Generic Downloader	Joe Security
00000001.00000002.4124791586.0000000005160000.00000004.08000000.00040000.00000000.sdmp	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
00000001.00000002.4124791586.0000000005160000.00000004.08000000.00040000.00000000.sdmp	JoeSecurity_PureLogStealer	Yara detected PureLog Stealer	Joe Security
00000001.00000002.4124791586.0000000005160000.00000004.08000000.00040000.00000000.sdmp	INDICATOR_SUSPICIOUS_EXE_VaultSchemaGUID	Detects executables referencing Windows vault credential objects. Observed in infostealers	ditekSHen	0x4341d:$s1: 2F1A6504-0641-44CF-8BB5-3612D865F2E5 0x4348f:$s2: 3CCD5499-87A8-4B10-A215-608888DD3B55 0x43519:$s3: 154E23D0-C644-4E6F-8CE6-5069272F999F 0x435ab:$s4: 4BF4C442-9B8A-41A0-B380-DD4A704DDB28 0x43615:$s5: 77BC582B-F0A6-4E15-4E80-61736B6F3B29 0x43687:$s6: E69D7838-91B5-4FC9-89D5-230D4D4CC2BC 0x4371d:$s7: 3E0E35BE-1B77-43E7-B873-AED901B6275B 0x437ad:$s8: 3C886FF3-2669-4AA2-A8FB-3F6759A77548
00000001.00000002.4124115737.0000000003B21000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
00000001.00000002.4124115737.0000000003B21000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
00000001.00000002.4124115737.0000000003B21000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_PureLogStealer	Yara detected PureLog Stealer	Joe Security
Process Memory Space: RegSvcs.exe PID: 7452	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
Process Memory Space: RegSvcs.exe PID: 7452	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
Click to see the 20 entries

Unpacked PEs

Source	Rule	Description	Author	Strings
1.2.RegSvcs.exe.400000.0.raw.unpack	MALWARE_Win_RedLine	Detects RedLine infostealer	ditekSHen	0x1e4b0:$s1: 23 00 2B 00 33 00 3B 00 43 00 53 00 63 00 73 00 0x80:$s2: 68 10 84 2D 2C 71 EA 7E 2C 71 EA 7E 2C 71 EA 7E 32 23 7F 7E 3F 71 EA 7E 0B B7 91 7E 2B 71 EA 7E 2C 71 EB 7E 5C 71 EA 7E 32 23 6E 7E 1C 71 EA 7E 32 23 69 7E A2 71 EA 7E 32 23 7B 7E 2D 71 EA 7E 0x1300:$s3: 83 EC 38 53 B0 26 88 44 24 2B 88 44 24 2F B0 88 88 44 24 30 88 44 24 31 88 44 24 33 55 56 8B F1 B8 0C 00 FE FF 2B C6 89 44 24 14 B8 0D 00 FE FF 2B C6 89 44 24 1C B8 02 00 FE FF 2B C6 89 44 24 ... 0x2018a:$s4: B\|BxBtBpBlBhBdB`B\BXBTBPBLBHBDB@B<B8B4B0B,B(B$B B 0x1fdd0:$s5: delete[] 0x1f288:$s6: constructor or from DllMain.
0.2.tgBNtoWqIp.exe.40b0000.1.raw.unpack	MALWARE_Win_RedLine	Detects RedLine infostealer	ditekSHen	0x1d0b0:$s1: 23 00 2B 00 33 00 3B 00 43 00 53 00 63 00 73 00 0x80:$s2: 68 10 84 2D 2C 71 EA 7E 2C 71 EA 7E 2C 71 EA 7E 32 23 7F 7E 3F 71 EA 7E 0B B7 91 7E 2B 71 EA 7E 2C 71 EB 7E 5C 71 EA 7E 32 23 6E 7E 1C 71 EA 7E 32 23 69 7E A2 71 EA 7E 32 23 7B 7E 2D 71 EA 7E 0x700:$s3: 83 EC 38 53 B0 26 88 44 24 2B 88 44 24 2F B0 88 88 44 24 30 88 44 24 31 88 44 24 33 55 56 8B F1 B8 0C 00 FE FF 2B C6 89 44 24 14 B8 0D 00 FE FF 2B C6 89 44 24 1C B8 02 00 FE FF 2B C6 89 44 24 ... 0x1ed8a:$s4: B\|BxBtBpBlBhBdB`B\BXBTBPBLBHBDB@B<B8B4B0B,B(B$B B 0x1e9d0:$s5: delete[] 0x1de88:$s6: constructor or from DllMain.
1.2.RegSvcs.exe.5220000.6.raw.unpack	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
1.2.RegSvcs.exe.5220000.6.raw.unpack	JoeSecurity_GenericDownloader_1	Yara detected Generic Downloader	Joe Security
1.2.RegSvcs.exe.5220000.6.raw.unpack	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
1.2.RegSvcs.exe.5220000.6.raw.unpack	JoeSecurity_PureLogStealer	Yara detected PureLog Stealer	Joe Security
1.2.RegSvcs.exe.5220000.6.raw.unpack	INDICATOR_SUSPICIOUS_EXE_VaultSchemaGUID	Detects executables referencing Windows vault credential objects. Observed in infostealers	ditekSHen	0x42535:$s1: 2F1A6504-0641-44CF-8BB5-3612D865F2E5 0x425a7:$s2: 3CCD5499-87A8-4B10-A215-608888DD3B55 0x42631:$s3: 154E23D0-C644-4E6F-8CE6-5069272F999F 0x426c3:$s4: 4BF4C442-9B8A-41A0-B380-DD4A704DDB28 0x4272d:$s5: 77BC582B-F0A6-4E15-4E80-61736B6F3B29 0x4279f:$s6: E69D7838-91B5-4FC9-89D5-230D4D4CC2BC 0x42835:$s7: 3E0E35BE-1B77-43E7-B873-AED901B6275B 0x428c5:$s8: 3C886FF3-2669-4AA2-A8FB-3F6759A77548
1.2.RegSvcs.exe.28105b6.2.unpack	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
1.2.RegSvcs.exe.28105b6.2.unpack	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
1.2.RegSvcs.exe.28105b6.2.unpack	JoeSecurity_PureLogStealer	Yara detected PureLog Stealer	Joe Security
1.2.RegSvcs.exe.28105b6.2.unpack	INDICATOR_SUSPICIOUS_EXE_VaultSchemaGUID	Detects executables referencing Windows vault credential objects. Observed in infostealers	ditekSHen	0x4161d:$s1: 2F1A6504-0641-44CF-8BB5-3612D865F2E5 0x4168f:$s2: 3CCD5499-87A8-4B10-A215-608888DD3B55 0x41719:$s3: 154E23D0-C644-4E6F-8CE6-5069272F999F 0x417ab:$s4: 4BF4C442-9B8A-41A0-B380-DD4A704DDB28 0x41815:$s5: 77BC582B-F0A6-4E15-4E80-61736B6F3B29 0x41887:$s6: E69D7838-91B5-4FC9-89D5-230D4D4CC2BC 0x4191d:$s7: 3E0E35BE-1B77-43E7-B873-AED901B6275B 0x419ad:$s8: 3C886FF3-2669-4AA2-A8FB-3F6759A77548
1.2.RegSvcs.exe.5160ee8.4.unpack	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
1.2.RegSvcs.exe.5160ee8.4.unpack	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
1.2.RegSvcs.exe.5160ee8.4.unpack	JoeSecurity_PureLogStealer	Yara detected PureLog Stealer	Joe Security
1.2.RegSvcs.exe.5160ee8.4.unpack	INDICATOR_SUSPICIOUS_EXE_VaultSchemaGUID	Detects executables referencing Windows vault credential objects. Observed in infostealers	ditekSHen	0x40735:$s1: 2F1A6504-0641-44CF-8BB5-3612D865F2E5 0x407a7:$s2: 3CCD5499-87A8-4B10-A215-608888DD3B55 0x40831:$s3: 154E23D0-C644-4E6F-8CE6-5069272F999F 0x408c3:$s4: 4BF4C442-9B8A-41A0-B380-DD4A704DDB28 0x4092d:$s5: 77BC582B-F0A6-4E15-4E80-61736B6F3B29 0x4099f:$s6: E69D7838-91B5-4FC9-89D5-230D4D4CC2BC 0x40a35:$s7: 3E0E35BE-1B77-43E7-B873-AED901B6275B 0x40ac5:$s8: 3C886FF3-2669-4AA2-A8FB-3F6759A77548
1.2.RegSvcs.exe.5160ee8.4.raw.unpack	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
1.2.RegSvcs.exe.5160ee8.4.raw.unpack	JoeSecurity_GenericDownloader_1	Yara detected Generic Downloader	Joe Security
1.2.RegSvcs.exe.5160ee8.4.raw.unpack	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
1.2.RegSvcs.exe.5160ee8.4.raw.unpack	JoeSecurity_PureLogStealer	Yara detected PureLog Stealer	Joe Security
1.2.RegSvcs.exe.5160ee8.4.raw.unpack	INDICATOR_SUSPICIOUS_EXE_VaultSchemaGUID	Detects executables referencing Windows vault credential objects. Observed in infostealers	ditekSHen	0x42535:$s1: 2F1A6504-0641-44CF-8BB5-3612D865F2E5 0x425a7:$s2: 3CCD5499-87A8-4B10-A215-608888DD3B55 0x42631:$s3: 154E23D0-C644-4E6F-8CE6-5069272F999F 0x426c3:$s4: 4BF4C442-9B8A-41A0-B380-DD4A704DDB28 0x4272d:$s5: 77BC582B-F0A6-4E15-4E80-61736B6F3B29 0x4279f:$s6: E69D7838-91B5-4FC9-89D5-230D4D4CC2BC 0x42835:$s7: 3E0E35BE-1B77-43E7-B873-AED901B6275B 0x428c5:$s8: 3C886FF3-2669-4AA2-A8FB-3F6759A77548
1.2.RegSvcs.exe.400000.0.unpack	MALWARE_Win_RedLine	Detects RedLine infostealer	ditekSHen	0x1d0b0:$s1: 23 00 2B 00 33 00 3B 00 43 00 53 00 63 00 73 00 0x80:$s2: 68 10 84 2D 2C 71 EA 7E 2C 71 EA 7E 2C 71 EA 7E 32 23 7F 7E 3F 71 EA 7E 0B B7 91 7E 2B 71 EA 7E 2C 71 EB 7E 5C 71 EA 7E 32 23 6E 7E 1C 71 EA 7E 32 23 69 7E A2 71 EA 7E 32 23 7B 7E 2D 71 EA 7E 0x700:$s3: 83 EC 38 53 B0 26 88 44 24 2B 88 44 24 2F B0 88 88 44 24 30 88 44 24 31 88 44 24 33 55 56 8B F1 B8 0C 00 FE FF 2B C6 89 44 24 14 B8 0D 00 FE FF 2B C6 89 44 24 1C B8 02 00 FE FF 2B C6 89 44 24 ... 0x1ed8a:$s4: B\|BxBtBpBlBhBdB`B\BXBTBPBLBHBDB@B<B8B4B0B,B(B$B B 0x1e9d0:$s5: delete[] 0x1de88:$s6: constructor or from DllMain.
1.2.RegSvcs.exe.281149e.1.unpack	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
1.2.RegSvcs.exe.281149e.1.unpack	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
1.2.RegSvcs.exe.281149e.1.unpack	JoeSecurity_PureLogStealer	Yara detected PureLog Stealer	Joe Security
1.2.RegSvcs.exe.281149e.1.unpack	INDICATOR_SUSPICIOUS_EXE_VaultSchemaGUID	Detects executables referencing Windows vault credential objects. Observed in infostealers	ditekSHen	0x40735:$s1: 2F1A6504-0641-44CF-8BB5-3612D865F2E5 0x407a7:$s2: 3CCD5499-87A8-4B10-A215-608888DD3B55 0x40831:$s3: 154E23D0-C644-4E6F-8CE6-5069272F999F 0x408c3:$s4: 4BF4C442-9B8A-41A0-B380-DD4A704DDB28 0x4092d:$s5: 77BC582B-F0A6-4E15-4E80-61736B6F3B29 0x4099f:$s6: E69D7838-91B5-4FC9-89D5-230D4D4CC2BC 0x40a35:$s7: 3E0E35BE-1B77-43E7-B873-AED901B6275B 0x40ac5:$s8: 3C886FF3-2669-4AA2-A8FB-3F6759A77548
1.2.RegSvcs.exe.5220000.6.unpack	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
1.2.RegSvcs.exe.5220000.6.unpack	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
1.2.RegSvcs.exe.5220000.6.unpack	JoeSecurity_PureLogStealer	Yara detected PureLog Stealer	Joe Security
1.2.RegSvcs.exe.5220000.6.unpack	INDICATOR_SUSPICIOUS_EXE_VaultSchemaGUID	Detects executables referencing Windows vault credential objects. Observed in infostealers	ditekSHen	0x40735:$s1: 2F1A6504-0641-44CF-8BB5-3612D865F2E5 0x407a7:$s2: 3CCD5499-87A8-4B10-A215-608888DD3B55 0x40831:$s3: 154E23D0-C644-4E6F-8CE6-5069272F999F 0x408c3:$s4: 4BF4C442-9B8A-41A0-B380-DD4A704DDB28 0x4092d:$s5: 77BC582B-F0A6-4E15-4E80-61736B6F3B29 0x4099f:$s6: E69D7838-91B5-4FC9-89D5-230D4D4CC2BC 0x40a35:$s7: 3E0E35BE-1B77-43E7-B873-AED901B6275B 0x40ac5:$s8: 3C886FF3-2669-4AA2-A8FB-3F6759A77548
1.2.RegSvcs.exe.281149e.1.raw.unpack	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
1.2.RegSvcs.exe.281149e.1.raw.unpack	JoeSecurity_GenericDownloader_1	Yara detected Generic Downloader	Joe Security
1.2.RegSvcs.exe.281149e.1.raw.unpack	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
1.2.RegSvcs.exe.281149e.1.raw.unpack	JoeSecurity_PureLogStealer	Yara detected PureLog Stealer	Joe Security
1.2.RegSvcs.exe.281149e.1.raw.unpack	INDICATOR_SUSPICIOUS_EXE_VaultSchemaGUID	Detects executables referencing Windows vault credential objects. Observed in infostealers	ditekSHen	0x42535:$s1: 2F1A6504-0641-44CF-8BB5-3612D865F2E5 0x425a7:$s2: 3CCD5499-87A8-4B10-A215-608888DD3B55 0x42631:$s3: 154E23D0-C644-4E6F-8CE6-5069272F999F 0x426c3:$s4: 4BF4C442-9B8A-41A0-B380-DD4A704DDB28 0x4272d:$s5: 77BC582B-F0A6-4E15-4E80-61736B6F3B29 0x4279f:$s6: E69D7838-91B5-4FC9-89D5-230D4D4CC2BC 0x42835:$s7: 3E0E35BE-1B77-43E7-B873-AED901B6275B 0x428c5:$s8: 3C886FF3-2669-4AA2-A8FB-3F6759A77548
1.2.RegSvcs.exe.28105b6.2.raw.unpack	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
1.2.RegSvcs.exe.28105b6.2.raw.unpack	JoeSecurity_GenericDownloader_1	Yara detected Generic Downloader	Joe Security
1.2.RegSvcs.exe.28105b6.2.raw.unpack	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
1.2.RegSvcs.exe.28105b6.2.raw.unpack	JoeSecurity_PureLogStealer	Yara detected PureLog Stealer	Joe Security
1.2.RegSvcs.exe.28105b6.2.raw.unpack	INDICATOR_SUSPICIOUS_EXE_VaultSchemaGUID	Detects executables referencing Windows vault credential objects. Observed in infostealers	ditekSHen	0x4341d:$s1: 2F1A6504-0641-44CF-8BB5-3612D865F2E5 0x4348f:$s2: 3CCD5499-87A8-4B10-A215-608888DD3B55 0x43519:$s3: 154E23D0-C644-4E6F-8CE6-5069272F999F 0x435ab:$s4: 4BF4C442-9B8A-41A0-B380-DD4A704DDB28 0x43615:$s5: 77BC582B-F0A6-4E15-4E80-61736B6F3B29 0x43687:$s6: E69D7838-91B5-4FC9-89D5-230D4D4CC2BC 0x4371d:$s7: 3E0E35BE-1B77-43E7-B873-AED901B6275B 0x437ad:$s8: 3C886FF3-2669-4AA2-A8FB-3F6759A77548
1.2.RegSvcs.exe.5160000.5.raw.unpack	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
1.2.RegSvcs.exe.5160000.5.raw.unpack	JoeSecurity_GenericDownloader_1	Yara detected Generic Downloader	Joe Security
1.2.RegSvcs.exe.5160000.5.raw.unpack	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
1.2.RegSvcs.exe.5160000.5.raw.unpack	JoeSecurity_PureLogStealer	Yara detected PureLog Stealer	Joe Security
1.2.RegSvcs.exe.5160000.5.raw.unpack	INDICATOR_SUSPICIOUS_EXE_VaultSchemaGUID	Detects executables referencing Windows vault credential objects. Observed in infostealers	ditekSHen	0x4341d:$s1: 2F1A6504-0641-44CF-8BB5-3612D865F2E5 0x4348f:$s2: 3CCD5499-87A8-4B10-A215-608888DD3B55 0x43519:$s3: 154E23D0-C644-4E6F-8CE6-5069272F999F 0x435ab:$s4: 4BF4C442-9B8A-41A0-B380-DD4A704DDB28 0x43615:$s5: 77BC582B-F0A6-4E15-4E80-61736B6F3B29 0x43687:$s6: E69D7838-91B5-4FC9-89D5-230D4D4CC2BC 0x4371d:$s7: 3E0E35BE-1B77-43E7-B873-AED901B6275B 0x437ad:$s8: 3C886FF3-2669-4AA2-A8FB-3F6759A77548
1.2.RegSvcs.exe.3b76790.3.raw.unpack	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
1.2.RegSvcs.exe.3b76790.3.raw.unpack	JoeSecurity_GenericDownloader_1	Yara detected Generic Downloader	Joe Security
1.2.RegSvcs.exe.3b76790.3.raw.unpack	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
1.2.RegSvcs.exe.3b76790.3.raw.unpack	JoeSecurity_PureLogStealer	Yara detected PureLog Stealer	Joe Security
1.2.RegSvcs.exe.3b76790.3.raw.unpack	INDICATOR_SUSPICIOUS_EXE_VaultSchemaGUID	Detects executables referencing Windows vault credential objects. Observed in infostealers	ditekSHen	0x42535:$s1: 2F1A6504-0641-44CF-8BB5-3612D865F2E5 0x425a7:$s2: 3CCD5499-87A8-4B10-A215-608888DD3B55 0x42631:$s3: 154E23D0-C644-4E6F-8CE6-5069272F999F 0x426c3:$s4: 4BF4C442-9B8A-41A0-B380-DD4A704DDB28 0x4272d:$s5: 77BC582B-F0A6-4E15-4E80-61736B6F3B29 0x4279f:$s6: E69D7838-91B5-4FC9-89D5-230D4D4CC2BC 0x42835:$s7: 3E0E35BE-1B77-43E7-B873-AED901B6275B 0x428c5:$s8: 3C886FF3-2669-4AA2-A8FB-3F6759A77548
1.2.RegSvcs.exe.5160000.5.unpack	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
1.2.RegSvcs.exe.5160000.5.unpack	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
1.2.RegSvcs.exe.5160000.5.unpack	JoeSecurity_PureLogStealer	Yara detected PureLog Stealer	Joe Security
1.2.RegSvcs.exe.5160000.5.unpack	INDICATOR_SUSPICIOUS_EXE_VaultSchemaGUID	Detects executables referencing Windows vault credential objects. Observed in infostealers	ditekSHen	0x4161d:$s1: 2F1A6504-0641-44CF-8BB5-3612D865F2E5 0x4168f:$s2: 3CCD5499-87A8-4B10-A215-608888DD3B55 0x41719:$s3: 154E23D0-C644-4E6F-8CE6-5069272F999F 0x417ab:$s4: 4BF4C442-9B8A-41A0-B380-DD4A704DDB28 0x41815:$s5: 77BC582B-F0A6-4E15-4E80-61736B6F3B29 0x41887:$s6: E69D7838-91B5-4FC9-89D5-230D4D4CC2BC 0x4191d:$s7: 3E0E35BE-1B77-43E7-B873-AED901B6275B 0x419ad:$s8: 3C886FF3-2669-4AA2-A8FB-3F6759A77548
1.2.RegSvcs.exe.3b76790.3.unpack	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
1.2.RegSvcs.exe.3b76790.3.unpack	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
1.2.RegSvcs.exe.3b76790.3.unpack	JoeSecurity_PureLogStealer	Yara detected PureLog Stealer	Joe Security
1.2.RegSvcs.exe.3b76790.3.unpack	INDICATOR_SUSPICIOUS_EXE_VaultSchemaGUID	Detects executables referencing Windows vault credential objects. Observed in infostealers	ditekSHen	0x40735:$s1: 2F1A6504-0641-44CF-8BB5-3612D865F2E5 0x407a7:$s2: 3CCD5499-87A8-4B10-A215-608888DD3B55 0x40831:$s3: 154E23D0-C644-4E6F-8CE6-5069272F999F 0x408c3:$s4: 4BF4C442-9B8A-41A0-B380-DD4A704DDB28 0x4092d:$s5: 77BC582B-F0A6-4E15-4E80-61736B6F3B29 0x4099f:$s6: E69D7838-91B5-4FC9-89D5-230D4D4CC2BC 0x40a35:$s7: 3E0E35BE-1B77-43E7-B873-AED901B6275B 0x40ac5:$s8: 3C886FF3-2669-4AA2-A8FB-3F6759A77548
Click to see the 52 entries

Sigma Signatures

System Summary

Sigma detected: Suspicious Outbound SMTP Connections

Source: Network Connection

Author: frack113: Data: DestinationIp: 185.149.100.122, DestinationIsIpv6: false, DestinationPort: 587, EventID: 3, Image: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe, Initiated: true, ProcessId: 7452, Protocol: tcp, SourceIp: 192.168.2.4, SourceIsIpv6: false, SourcePort: 49732

Snort Signatures

⊘No Snort rule has matched

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

AV Detection

Found malware configuration

Source: 1.2.RegSvcs.exe.5160ee8.4.raw.unpack

Malware Configuration Extractor: Agenttesla {"Exfil Mode": "SMTP", "Port": "587", "Host": "mail.divanrestoran.com", "Username": "info@divanrestoran.com", "Password": "Div987654-_"}

Multi AV Scanner detection for submitted file

Source: tgBNtoWqIp.exe

ReversingLabs: Detection: 87%

AI detected suspicious sample

Source: Submited Sample

Integrated Neural Analysis Model: Matched 100.0% probability

Machine Learning detection for sample

Source: tgBNtoWqIp.exe

Joe Sandbox ML: detected

Source: tgBNtoWqIp.exe

Static PE information: EXECUTABLE_IMAGE, LARGE_ADDRESS_AWARE, 32BIT_MACHINE

Source: unknown

HTTPS traffic detected: 104.26.13.205:443 -> 192.168.2.4:49730 version: TLS 1.2

Source:	Binary string: _.pdb source: RegSvcs.exe, 00000001.00000002.4122420156.00000000027D0000.00000004.00000020.00020000.00000000.sdmp, RegSvcs.exe, 00000001.00000002.4124115737.0000000003B21000.00000004.00000800.00020000.00000000.sdmp, RegSvcs.exe, 00000001.00000002.4124791586.0000000005160000.00000004.08000000.00040000.00000000.sdmp
Source:	Binary string: wntdll.pdbUGP source: tgBNtoWqIp.exe, 00000000.00000003.1665581285.00000000042A0000.00000004.00001000.00020000.00000000.sdmp, tgBNtoWqIp.exe, 00000000.00000003.1666211791.0000000004100000.00000004.00001000.00020000.00000000.sdmp
Source:	Binary string: wntdll.pdb source: tgBNtoWqIp.exe, 00000000.00000003.1665581285.00000000042A0000.00000004.00001000.00020000.00000000.sdmp, tgBNtoWqIp.exe, 00000000.00000003.1666211791.0000000004100000.00000004.00001000.00020000.00000000.sdmp

Source: C:\Users\user\Desktop\tgBNtoWqIp.exe	Code function: 0_2_00FC4696 GetFileAttributesW,FindFirstFileW,FindClose,	0_2_00FC4696
Source: C:\Users\user\Desktop\tgBNtoWqIp.exe	Code function: 0_2_00FCC9C7 FindFirstFileW,FindClose,FileTimeToLocalFileTime,FileTimeToLocalFileTime,FileTimeToLocalFileTime,FileTimeToSystemTime,__swprintf,__swprintf,__swprintf,__swprintf,__swprintf,__swprintf,__swprintf,	0_2_00FCC9C7
Source: C:\Users\user\Desktop\tgBNtoWqIp.exe	Code function: 0_2_00FCC93C FindFirstFileW,FindClose,	0_2_00FCC93C
Source: C:\Users\user\Desktop\tgBNtoWqIp.exe	Code function: 0_2_00FCF200 SetCurrentDirectoryW,FindFirstFileW,FindFirstFileW,_wcscmp,_wcscmp,GetFileAttributesW,SetFileAttributesW,FindNextFileW,FindClose,FindFirstFileW,SetCurrentDirectoryW,_wcscmp,_wcscmp,SetCurrentDirectoryW,SetCurrentDirectoryW,FindNextFileW,FindClose,FindClose,	0_2_00FCF200
Source: C:\Users\user\Desktop\tgBNtoWqIp.exe	Code function: 0_2_00FCF35D SetCurrentDirectoryW,FindFirstFileW,FindFirstFileW,_wcscmp,_wcscmp,FindNextFileW,FindClose,FindFirstFileW,SetCurrentDirectoryW,_wcscmp,_wcscmp,SetCurrentDirectoryW,SetCurrentDirectoryW,FindNextFileW,FindClose,FindClose,	0_2_00FCF35D
Source: C:\Users\user\Desktop\tgBNtoWqIp.exe	Code function: 0_2_00FCF65E FindFirstFileW,Sleep,_wcscmp,_wcscmp,FindNextFileW,FindClose,	0_2_00FCF65E
Source: C:\Users\user\Desktop\tgBNtoWqIp.exe	Code function: 0_2_00FC3A2B FindFirstFileW,DeleteFileW,DeleteFileW,MoveFileW,DeleteFileW,FindNextFileW,FindClose,FindClose,	0_2_00FC3A2B
Source: C:\Users\user\Desktop\tgBNtoWqIp.exe	Code function: 0_2_00FC3D4E FindFirstFileW,DeleteFileW,FindNextFileW,FindClose,FindClose,	0_2_00FC3D4E
Source: C:\Users\user\Desktop\tgBNtoWqIp.exe	Code function: 0_2_00FCBF27 FindFirstFileW,_wcscmp,_wcscmp,FindNextFileW,FindClose,	0_2_00FCBF27

Networking

Yara detected Generic Downloader

Source: Yara match	File source: 1.2.RegSvcs.exe.5220000.6.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 1.2.RegSvcs.exe.5160ee8.4.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 1.2.RegSvcs.exe.281149e.1.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 1.2.RegSvcs.exe.28105b6.2.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 1.2.RegSvcs.exe.5160000.5.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 1.2.RegSvcs.exe.3b76790.3.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000001.00000002.4125198203.0000000005220000.00000004.08000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000001.00000002.4124791586.0000000005160000.00000004.08000000.00040000.00000000.sdmp, type: MEMORY

Source: global traffic

TCP traffic: 192.168.2.4:49732 -> 185.149.100.122:587

Source: global traffic

HTTP traffic detected: GET /line/?fields=hosting HTTP/1.1Host: ip-api.comConnection: Keep-Alive

Source: Joe Sandbox View	IP Address: 208.95.112.1 208.95.112.1
Source: Joe Sandbox View	IP Address: 104.26.13.205 104.26.13.205
Source: Joe Sandbox View	IP Address: 104.26.13.205 104.26.13.205

Source: Joe Sandbox View	ASN Name: TUT-ASUS TUT-ASUS
Source: Joe Sandbox View	ASN Name: VERIDYENVeridyenBilisimTeknolojileriSanayiveTicaretLi VERIDYENVeridyenBilisimTeknolojileriSanayiveTicaretLi

Source: Joe Sandbox View

JA3 fingerprint: 3b5074b1b5d032e5620f69f9f700ff0e

Source: unknown	DNS query: name: api.ipify.org
Source: unknown	DNS query: name: api.ipify.org
Source: unknown	DNS query: name: api.ipify.org
Source: unknown	DNS query: name: ip-api.com

Source: global traffic

TCP traffic: 192.168.2.4:49732 -> 185.149.100.122:587

Source: global traffic

HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:99.0) Gecko/20100101 Firefox/99.0Host: api.ipify.orgConnection: Keep-Alive

Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1

Source: C:\Users\user\Desktop\tgBNtoWqIp.exe

Code function: 0_2_00FD25E2 InternetReadFile,InternetQueryDataAvailable,InternetReadFile,

0_2_00FD25E2

Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:99.0) Gecko/20100101 Firefox/99.0Host: api.ipify.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /line/?fields=hosting HTTP/1.1Host: ip-api.comConnection: Keep-Alive

Source: global traffic	DNS traffic detected: DNS query: api.ipify.org
Source: global traffic	DNS traffic detected: DNS query: ip-api.com
Source: global traffic	DNS traffic detected: DNS query: mail.divanrestoran.com

Source: RegSvcs.exe, 00000001.00000002.4122661159.0000000002BB1000.00000004.00000800.00020000.00000000.sdmp, RegSvcs.exe, 00000001.00000002.4122661159.0000000002C67000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://divanrestoran.com
Source: RegSvcs.exe, 00000001.00000002.4122661159.0000000002B74000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://ip-api.com
Source: RegSvcs.exe, 00000001.00000002.4122661159.0000000002B74000.00000004.00000800.00020000.00000000.sdmp, RegSvcs.exe, 00000001.00000002.4122420156.00000000027D0000.00000004.00000020.00020000.00000000.sdmp, RegSvcs.exe, 00000001.00000002.4124115737.0000000003B21000.00000004.00000800.00020000.00000000.sdmp, RegSvcs.exe, 00000001.00000002.4125198203.0000000005220000.00000004.08000000.00040000.00000000.sdmp, RegSvcs.exe, 00000001.00000002.4124791586.0000000005160000.00000004.08000000.00040000.00000000.sdmp	String found in binary or memory: http://ip-api.com/line/?fields=hosting
Source: RegSvcs.exe, 00000001.00000002.4122661159.0000000002BB1000.00000004.00000800.00020000.00000000.sdmp, RegSvcs.exe, 00000001.00000002.4122661159.0000000002C67000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://mail.divanrestoran.com
Source: RegSvcs.exe, 00000001.00000002.4122661159.0000000002BB9000.00000004.00000800.00020000.00000000.sdmp, RegSvcs.exe, 00000001.00000002.4125419915.0000000005486000.00000004.00000020.00020000.00000000.sdmp, RegSvcs.exe, 00000001.00000002.4126404975.0000000006A8D000.00000004.00000020.00020000.00000000.sdmp, RegSvcs.exe, 00000001.00000002.4122661159.0000000002C67000.00000004.00000800.00020000.00000000.sdmp, RegSvcs.exe, 00000001.00000002.4121211017.0000000000C69000.00000004.00000020.00020000.00000000.sdmp, RegSvcs.exe, 00000001.00000002.4125419915.0000000005452000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://r3.i.lencr.org/01
Source: RegSvcs.exe, 00000001.00000002.4122661159.0000000002BB9000.00000004.00000800.00020000.00000000.sdmp, RegSvcs.exe, 00000001.00000002.4125419915.0000000005486000.00000004.00000020.00020000.00000000.sdmp, RegSvcs.exe, 00000001.00000002.4126404975.0000000006A8D000.00000004.00000020.00020000.00000000.sdmp, RegSvcs.exe, 00000001.00000002.4122661159.0000000002C67000.00000004.00000800.00020000.00000000.sdmp, RegSvcs.exe, 00000001.00000002.4121211017.0000000000C69000.00000004.00000020.00020000.00000000.sdmp, RegSvcs.exe, 00000001.00000002.4125419915.0000000005452000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://r3.o.lencr.org0
Source: RegSvcs.exe, 00000001.00000002.4122661159.0000000002B21000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name
Source: RegSvcs.exe, 00000001.00000002.4122661159.0000000002BB9000.00000004.00000800.00020000.00000000.sdmp, RegSvcs.exe, 00000001.00000002.4125419915.00000000054EE000.00000004.00000020.00020000.00000000.sdmp, RegSvcs.exe, 00000001.00000002.4121211017.0000000000CF5000.00000004.00000020.00020000.00000000.sdmp, RegSvcs.exe, 00000001.00000002.4122661159.0000000002C67000.00000004.00000800.00020000.00000000.sdmp, RegSvcs.exe, 00000001.00000002.4121211017.0000000000C69000.00000004.00000020.00020000.00000000.sdmp, RegSvcs.exe, 00000001.00000002.4125419915.0000000005452000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://x1.c.lencr.org/0
Source: RegSvcs.exe, 00000001.00000002.4122661159.0000000002BB9000.00000004.00000800.00020000.00000000.sdmp, RegSvcs.exe, 00000001.00000002.4125419915.00000000054EE000.00000004.00000020.00020000.00000000.sdmp, RegSvcs.exe, 00000001.00000002.4121211017.0000000000CF5000.00000004.00000020.00020000.00000000.sdmp, RegSvcs.exe, 00000001.00000002.4122661159.0000000002C67000.00000004.00000800.00020000.00000000.sdmp, RegSvcs.exe, 00000001.00000002.4121211017.0000000000C69000.00000004.00000020.00020000.00000000.sdmp, RegSvcs.exe, 00000001.00000002.4125419915.0000000005452000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://x1.i.lencr.org/0
Source: RegSvcs.exe, 00000001.00000002.4122420156.00000000027D0000.00000004.00000020.00020000.00000000.sdmp, RegSvcs.exe, 00000001.00000002.4124115737.0000000003B21000.00000004.00000800.00020000.00000000.sdmp, RegSvcs.exe, 00000001.00000002.4125198203.0000000005220000.00000004.08000000.00040000.00000000.sdmp, RegSvcs.exe, 00000001.00000002.4124791586.0000000005160000.00000004.08000000.00040000.00000000.sdmp	String found in binary or memory: https://account.dyn.com/
Source: RegSvcs.exe, 00000001.00000002.4122661159.0000000002B21000.00000004.00000800.00020000.00000000.sdmp, RegSvcs.exe, 00000001.00000002.4122420156.00000000027D0000.00000004.00000020.00020000.00000000.sdmp, RegSvcs.exe, 00000001.00000002.4124115737.0000000003B21000.00000004.00000800.00020000.00000000.sdmp, RegSvcs.exe, 00000001.00000002.4125198203.0000000005220000.00000004.08000000.00040000.00000000.sdmp, RegSvcs.exe, 00000001.00000002.4124791586.0000000005160000.00000004.08000000.00040000.00000000.sdmp	String found in binary or memory: https://api.ipify.org
Source: RegSvcs.exe, 00000001.00000002.4122661159.0000000002B21000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://api.ipify.org/
Source: RegSvcs.exe, 00000001.00000002.4122661159.0000000002B21000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://api.ipify.org/t

Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49730
Source: unknown	Network traffic detected: HTTP traffic on port 49730 -> 443

Source: unknown

HTTPS traffic detected: 104.26.13.205:443 -> 192.168.2.4:49730 version: TLS 1.2

Key, Mouse, Clipboard, Microphone and Screen Capturing

Contains functionality to log keystrokes (.Net Source)

Source: 1.2.RegSvcs.exe.5220000.6.raw.unpack, SKTzxzsJw.cs

.Net Code: _9cfUR2CFuxe

Source: C:\Users\user\Desktop\tgBNtoWqIp.exe

Code function: 0_2_00FD425A OpenClipboard,IsClipboardFormatAvailable,IsClipboardFormatAvailable,GetClipboardData,CloseClipboard,GlobalLock,CloseClipboard,GlobalUnlock,IsClipboardFormatAvailable,GetClipboardData,GlobalLock,GlobalUnlock,IsClipboardFormatAvailable,GetClipboardData,GlobalLock,DragQueryFileW,DragQueryFileW,DragQueryFileW,GlobalUnlock,CountClipboardFormats,CloseClipboard,

0_2_00FD425A

Source: C:\Users\user\Desktop\tgBNtoWqIp.exe

Code function: 0_2_00FD4458 OpenClipboard,EmptyClipboard,GlobalAlloc,GlobalLock,_wcscpy,GlobalUnlock,OpenClipboard,EmptyClipboard,SetClipboardData,CloseClipboard,

0_2_00FD4458

Source: C:\Users\user\Desktop\tgBNtoWqIp.exe

0_2_00FD425A

Source: C:\Users\user\Desktop\tgBNtoWqIp.exe

Code function: 0_2_00FC0219 GetKeyboardState,GetAsyncKeyState,GetKeyState,GetKeyState,GetAsyncKeyState,GetKeyState,GetAsyncKeyState,GetKeyState,GetAsyncKeyState,GetKeyState,GetAsyncKeyState,GetKeyState,

0_2_00FC0219

Source: C:\Users\user\Desktop\tgBNtoWqIp.exe

Code function: 0_2_00FECDAC DefDlgProcW,SendMessageW,GetWindowLongW,SendMessageW,SendMessageW,_wcsncpy,GetKeyState,GetKeyState,GetKeyState,SendMessageW,GetKeyState,SendMessageW,SendMessageW,SendMessageW,ImageList_SetDragCursorImage,ImageList_BeginDrag,SetCapture,ClientToScreen,ImageList_DragEnter,InvalidateRect,ReleaseCapture,GetCursorPos,ScreenToClient,SendMessageW,SendMessageW,SendMessageW,SendMessageW,SendMessageW,SendMessageW,SendMessageW,GetCursorPos,ScreenToClient,GetParent,SendMessageW,SendMessageW,ClientToScreen,TrackPopupMenuEx,SendMessageW,SendMessageW,ClientToScreen,TrackPopupMenuEx,GetWindowLongW,

0_2_00FECDAC

System Summary

Malicious sample detected (through community Yara rule)

Source: 1.2.RegSvcs.exe.400000.0.raw.unpack, type: UNPACKEDPE	Matched rule: Detects RedLine infostealer Author: ditekSHen
Source: 0.2.tgBNtoWqIp.exe.40b0000.1.raw.unpack, type: UNPACKEDPE	Matched rule: Detects RedLine infostealer Author: ditekSHen
Source: 1.2.RegSvcs.exe.5220000.6.raw.unpack, type: UNPACKEDPE	Matched rule: Detects executables referencing Windows vault credential objects. Observed in infostealers Author: ditekSHen
Source: 1.2.RegSvcs.exe.28105b6.2.unpack, type: UNPACKEDPE	Matched rule: Detects executables referencing Windows vault credential objects. Observed in infostealers Author: ditekSHen
Source: 1.2.RegSvcs.exe.5160ee8.4.unpack, type: UNPACKEDPE	Matched rule: Detects executables referencing Windows vault credential objects. Observed in infostealers Author: ditekSHen
Source: 1.2.RegSvcs.exe.5160ee8.4.raw.unpack, type: UNPACKEDPE	Matched rule: Detects executables referencing Windows vault credential objects. Observed in infostealers Author: ditekSHen
Source: 1.2.RegSvcs.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: Detects RedLine infostealer Author: ditekSHen
Source: 1.2.RegSvcs.exe.281149e.1.unpack, type: UNPACKEDPE	Matched rule: Detects executables referencing Windows vault credential objects. Observed in infostealers Author: ditekSHen
Source: 1.2.RegSvcs.exe.5220000.6.unpack, type: UNPACKEDPE	Matched rule: Detects executables referencing Windows vault credential objects. Observed in infostealers Author: ditekSHen
Source: 1.2.RegSvcs.exe.281149e.1.raw.unpack, type: UNPACKEDPE	Matched rule: Detects executables referencing Windows vault credential objects. Observed in infostealers Author: ditekSHen
Source: 1.2.RegSvcs.exe.28105b6.2.raw.unpack, type: UNPACKEDPE	Matched rule: Detects executables referencing Windows vault credential objects. Observed in infostealers Author: ditekSHen
Source: 1.2.RegSvcs.exe.5160000.5.raw.unpack, type: UNPACKEDPE	Matched rule: Detects executables referencing Windows vault credential objects. Observed in infostealers Author: ditekSHen
Source: 1.2.RegSvcs.exe.3b76790.3.raw.unpack, type: UNPACKEDPE	Matched rule: Detects executables referencing Windows vault credential objects. Observed in infostealers Author: ditekSHen
Source: 1.2.RegSvcs.exe.5160000.5.unpack, type: UNPACKEDPE	Matched rule: Detects executables referencing Windows vault credential objects. Observed in infostealers Author: ditekSHen
Source: 1.2.RegSvcs.exe.3b76790.3.unpack, type: UNPACKEDPE	Matched rule: Detects executables referencing Windows vault credential objects. Observed in infostealers Author: ditekSHen
Source: 00000000.00000002.1669136903.00000000040B0000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: Detects RedLine infostealer Author: ditekSHen
Source: 00000001.00000002.4120171532.0000000000400000.00000040.80000000.00040000.00000000.sdmp, type: MEMORY	Matched rule: Detects RedLine infostealer Author: ditekSHen
Source: 00000001.00000002.4125198203.0000000005220000.00000004.08000000.00040000.00000000.sdmp, type: MEMORY	Matched rule: Detects executables referencing Windows vault credential objects. Observed in infostealers Author: ditekSHen
Source: 00000001.00000002.4124791586.0000000005160000.00000004.08000000.00040000.00000000.sdmp, type: MEMORY	Matched rule: Detects executables referencing Windows vault credential objects. Observed in infostealers Author: ditekSHen

Binary is likely a compiled AutoIt script file

Source: C:\Users\user\Desktop\tgBNtoWqIp.exe	Code function: This is a third-party compiled AutoIt script.	0_2_00F63B4C
Source: tgBNtoWqIp.exe	String found in binary or memory: This is a third-party compiled AutoIt script.
Source: tgBNtoWqIp.exe, 00000000.00000002.1667966851.0000000001015000.00000002.00000001.01000000.00000003.sdmp	String found in binary or memory: This is a third-party compiled AutoIt script.	memstr_a5f78d23-0
Source: tgBNtoWqIp.exe, 00000000.00000002.1667966851.0000000001015000.00000002.00000001.01000000.00000003.sdmp	String found in binary or memory: SDSOFTWARE\Classes\\CLSID\\\IPC$This is a third-party compiled AutoIt script."runasError allocating memory.SeAssignPrimaryTokenPrivilegeSeIncreaseQuotaPrivilegeSeBackupPrivilegeSeRestorePrivilegewinsta0defaultwinsta0\defaultComboBoxListBox\|SHELLDLL_DefViewlargeiconsdetailssmalliconslistCLASSCLASSNNREGEXPCLASSIDNAMEXYWHINSTANCETEXT%s%u%s%dLAST[LASTACTIVE[ACTIVEHANDLE=[HANDLE:REGEXP=[REGEXPTITLE:CLASSNAME=[CLASS:ALL[ALL]HANDLEREGEXPTITLETITLEThumbnailClassAutoIt3GUIContainer	memstr_15a4ada4-1
Source: tgBNtoWqIp.exe	String found in binary or memory: This is a third-party compiled AutoIt script.	memstr_c0fc8129-f
Source: tgBNtoWqIp.exe	String found in binary or memory: SDSOFTWARE\Classes\\CLSID\\\IPC$This is a third-party compiled AutoIt script."runasError allocating memory.SeAssignPrimaryTokenPrivilegeSeIncreaseQuotaPrivilegeSeBackupPrivilegeSeRestorePrivilegewinsta0defaultwinsta0\defaultComboBoxListBox\|SHELLDLL_DefViewlargeiconsdetailssmalliconslistCLASSCLASSNNREGEXPCLASSIDNAMEXYWHINSTANCETEXT%s%u%s%dLAST[LASTACTIVE[ACTIVEHANDLE=[HANDLE:REGEXP=[REGEXPTITLE:CLASSNAME=[CLASS:ALL[ALL]HANDLEREGEXPTITLETITLEThumbnailClassAutoIt3GUIContainer	memstr_1634c994-5

Source: C:\Users\user\Desktop\tgBNtoWqIp.exe

Code function: 0_2_00FC40B1: CreateFileW,_memset,DeviceIoControl,CloseHandle,

0_2_00FC40B1

Source: C:\Users\user\Desktop\tgBNtoWqIp.exe

Code function: 0_2_00FB8858 _memset,DuplicateTokenEx,CloseHandle,OpenWindowStationW,GetProcessWindowStation,SetProcessWindowStation,OpenDesktopW,_wcscpy,LoadUserProfileW,CreateEnvironmentBlock,CreateProcessAsUserW,UnloadUserProfile,CloseWindowStation,CloseDesktop,SetProcessWindowStation,CloseHandle,DestroyEnvironmentBlock,

0_2_00FB8858

Source: C:\Users\user\Desktop\tgBNtoWqIp.exe

Code function: 0_2_00FC545F ExitWindowsEx,InitiateSystemShutdownExW,SetSystemPowerState,

0_2_00FC545F

Source: C:\Users\user\Desktop\tgBNtoWqIp.exe	Code function: 0_2_00F6E800	0_2_00F6E800
Source: C:\Users\user\Desktop\tgBNtoWqIp.exe	Code function: 0_2_00F8DBB5	0_2_00F8DBB5
Source: C:\Users\user\Desktop\tgBNtoWqIp.exe	Code function: 0_2_00F6E060	0_2_00F6E060
Source: C:\Users\user\Desktop\tgBNtoWqIp.exe	Code function: 0_2_00FE804A	0_2_00FE804A
Source: C:\Users\user\Desktop\tgBNtoWqIp.exe	Code function: 0_2_00F74140	0_2_00F74140
Source: C:\Users\user\Desktop\tgBNtoWqIp.exe	Code function: 0_2_00F82405	0_2_00F82405
Source: C:\Users\user\Desktop\tgBNtoWqIp.exe	Code function: 0_2_00F96522	0_2_00F96522
Source: C:\Users\user\Desktop\tgBNtoWqIp.exe	Code function: 0_2_00F9267E	0_2_00F9267E
Source: C:\Users\user\Desktop\tgBNtoWqIp.exe	Code function: 0_2_00FE0665	0_2_00FE0665
Source: C:\Users\user\Desktop\tgBNtoWqIp.exe	Code function: 0_2_00F76843	0_2_00F76843
Source: C:\Users\user\Desktop\tgBNtoWqIp.exe	Code function: 0_2_00F8283A	0_2_00F8283A
Source: C:\Users\user\Desktop\tgBNtoWqIp.exe	Code function: 0_2_00F989DF	0_2_00F989DF
Source: C:\Users\user\Desktop\tgBNtoWqIp.exe	Code function: 0_2_00FE0AE2	0_2_00FE0AE2
Source: C:\Users\user\Desktop\tgBNtoWqIp.exe	Code function: 0_2_00F96A94	0_2_00F96A94
Source: C:\Users\user\Desktop\tgBNtoWqIp.exe	Code function: 0_2_00F78A0E	0_2_00F78A0E
Source: C:\Users\user\Desktop\tgBNtoWqIp.exe	Code function: 0_2_00FC8B13	0_2_00FC8B13
Source: C:\Users\user\Desktop\tgBNtoWqIp.exe	Code function: 0_2_00FBEB07	0_2_00FBEB07
Source: C:\Users\user\Desktop\tgBNtoWqIp.exe	Code function: 0_2_00F8CD61	0_2_00F8CD61
Source: C:\Users\user\Desktop\tgBNtoWqIp.exe	Code function: 0_2_00F97006	0_2_00F97006
Source: C:\Users\user\Desktop\tgBNtoWqIp.exe	Code function: 0_2_00F73190	0_2_00F73190
Source: C:\Users\user\Desktop\tgBNtoWqIp.exe	Code function: 0_2_00F7710E	0_2_00F7710E
Source: C:\Users\user\Desktop\tgBNtoWqIp.exe	Code function: 0_2_00F61287	0_2_00F61287
Source: C:\Users\user\Desktop\tgBNtoWqIp.exe	Code function: 0_2_00F833C7	0_2_00F833C7
Source: C:\Users\user\Desktop\tgBNtoWqIp.exe	Code function: 0_2_00F8F419	0_2_00F8F419
Source: C:\Users\user\Desktop\tgBNtoWqIp.exe	Code function: 0_2_00F816C4	0_2_00F816C4
Source: C:\Users\user\Desktop\tgBNtoWqIp.exe	Code function: 0_2_00F75680	0_2_00F75680
Source: C:\Users\user\Desktop\tgBNtoWqIp.exe	Code function: 0_2_00F878D3	0_2_00F878D3
Source: C:\Users\user\Desktop\tgBNtoWqIp.exe	Code function: 0_2_00F758C0	0_2_00F758C0
Source: C:\Users\user\Desktop\tgBNtoWqIp.exe	Code function: 0_2_00F81BB8	0_2_00F81BB8
Source: C:\Users\user\Desktop\tgBNtoWqIp.exe	Code function: 0_2_00F99D05	0_2_00F99D05
Source: C:\Users\user\Desktop\tgBNtoWqIp.exe	Code function: 0_2_00F6FE40	0_2_00F6FE40
Source: C:\Users\user\Desktop\tgBNtoWqIp.exe	Code function: 0_2_00F8BFE6	0_2_00F8BFE6
Source: C:\Users\user\Desktop\tgBNtoWqIp.exe	Code function: 0_2_00F81FD0	0_2_00F81FD0
Source: C:\Users\user\Desktop\tgBNtoWqIp.exe	Code function: 0_2_011B3600	0_2_011B3600
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 1_2_00408C60	1_2_00408C60
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 1_2_0040DC11	1_2_0040DC11
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 1_2_00407C3F	1_2_00407C3F
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 1_2_00418CCC	1_2_00418CCC
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 1_2_00406CA0	1_2_00406CA0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 1_2_004028B0	1_2_004028B0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 1_2_0041A4BE	1_2_0041A4BE
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 1_2_00408C60	1_2_00408C60
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 1_2_00418244	1_2_00418244
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 1_2_00401650	1_2_00401650
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 1_2_00402F20	1_2_00402F20
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 1_2_004193C4	1_2_004193C4
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 1_2_00418788	1_2_00418788
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 1_2_00402F89	1_2_00402F89
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 1_2_00402B90	1_2_00402B90
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 1_2_004073A0	1_2_004073A0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 1_2_0272D8C0	1_2_0272D8C0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 1_2_0272CCA8	1_2_0272CCA8
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 1_2_0272CFF0	1_2_0272CFF0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 1_2_02721030	1_2_02721030
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 1_2_02721024	1_2_02721024
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 1_2_0612D748	1_2_0612D748
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 1_2_0612A520	1_2_0612A520
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 1_2_06129D58	1_2_06129D58
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 1_2_0612FA00	1_2_0612FA00
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 1_2_06126AC8	1_2_06126AC8
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 1_2_06120006	1_2_06120006
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 1_2_06120040	1_2_06120040
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 1_2_06770F10	1_2_06770F10
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 1_2_0677AFF8	1_2_0677AFF8
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 1_2_06775D20	1_2_06775D20
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 1_2_0677E780	1_2_0677E780
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 1_2_067792D0	1_2_067792D0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 1_2_06772010	1_2_06772010

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: String function: 0040E1D8 appears 43 times
Source: C:\Users\user\Desktop\tgBNtoWqIp.exe	Code function: String function: 00F80D27 appears 70 times
Source: C:\Users\user\Desktop\tgBNtoWqIp.exe	Code function: String function: 00F67F41 appears 35 times
Source: C:\Users\user\Desktop\tgBNtoWqIp.exe	Code function: String function: 00F88B40 appears 42 times

Source: tgBNtoWqIp.exe, 00000000.00000002.1669136903.00000000040B0000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamed0b1801c-1d03-4fd0-905a-5544521e9822.exe4 vs tgBNtoWqIp.exe
Source: tgBNtoWqIp.exe, 00000000.00000003.1665450604.0000000004223000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamentdll.dllj% vs tgBNtoWqIp.exe
Source: tgBNtoWqIp.exe, 00000000.00000003.1665958954.00000000043CD000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamentdll.dllj% vs tgBNtoWqIp.exe

Source: tgBNtoWqIp.exe

Static PE information: EXECUTABLE_IMAGE, LARGE_ADDRESS_AWARE, 32BIT_MACHINE

Source: 1.2.RegSvcs.exe.400000.0.raw.unpack, type: UNPACKEDPE	Matched rule: MALWARE_Win_RedLine snort2_sid = 920072-920073, author = ditekSHen, description = Detects RedLine infostealer, clamav_sig = MALWARE.Win.Trojan.RedLine-1, MALWARE.Win.Trojan.RedLine-2, snort3_sid = 920072-920073
Source: 0.2.tgBNtoWqIp.exe.40b0000.1.raw.unpack, type: UNPACKEDPE	Matched rule: MALWARE_Win_RedLine snort2_sid = 920072-920073, author = ditekSHen, description = Detects RedLine infostealer, clamav_sig = MALWARE.Win.Trojan.RedLine-1, MALWARE.Win.Trojan.RedLine-2, snort3_sid = 920072-920073
Source: 1.2.RegSvcs.exe.5220000.6.raw.unpack, type: UNPACKEDPE	Matched rule: INDICATOR_SUSPICIOUS_EXE_VaultSchemaGUID author = ditekSHen, description = Detects executables referencing Windows vault credential objects. Observed in infostealers
Source: 1.2.RegSvcs.exe.28105b6.2.unpack, type: UNPACKEDPE	Matched rule: INDICATOR_SUSPICIOUS_EXE_VaultSchemaGUID author = ditekSHen, description = Detects executables referencing Windows vault credential objects. Observed in infostealers
Source: 1.2.RegSvcs.exe.5160ee8.4.unpack, type: UNPACKEDPE	Matched rule: INDICATOR_SUSPICIOUS_EXE_VaultSchemaGUID author = ditekSHen, description = Detects executables referencing Windows vault credential objects. Observed in infostealers
Source: 1.2.RegSvcs.exe.5160ee8.4.raw.unpack, type: UNPACKEDPE	Matched rule: INDICATOR_SUSPICIOUS_EXE_VaultSchemaGUID author = ditekSHen, description = Detects executables referencing Windows vault credential objects. Observed in infostealers
Source: 1.2.RegSvcs.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: MALWARE_Win_RedLine snort2_sid = 920072-920073, author = ditekSHen, description = Detects RedLine infostealer, clamav_sig = MALWARE.Win.Trojan.RedLine-1, MALWARE.Win.Trojan.RedLine-2, snort3_sid = 920072-920073
Source: 1.2.RegSvcs.exe.281149e.1.unpack, type: UNPACKEDPE	Matched rule: INDICATOR_SUSPICIOUS_EXE_VaultSchemaGUID author = ditekSHen, description = Detects executables referencing Windows vault credential objects. Observed in infostealers
Source: 1.2.RegSvcs.exe.5220000.6.unpack, type: UNPACKEDPE	Matched rule: INDICATOR_SUSPICIOUS_EXE_VaultSchemaGUID author = ditekSHen, description = Detects executables referencing Windows vault credential objects. Observed in infostealers
Source: 1.2.RegSvcs.exe.281149e.1.raw.unpack, type: UNPACKEDPE	Matched rule: INDICATOR_SUSPICIOUS_EXE_VaultSchemaGUID author = ditekSHen, description = Detects executables referencing Windows vault credential objects. Observed in infostealers
Source: 1.2.RegSvcs.exe.28105b6.2.raw.unpack, type: UNPACKEDPE	Matched rule: INDICATOR_SUSPICIOUS_EXE_VaultSchemaGUID author = ditekSHen, description = Detects executables referencing Windows vault credential objects. Observed in infostealers
Source: 1.2.RegSvcs.exe.5160000.5.raw.unpack, type: UNPACKEDPE	Matched rule: INDICATOR_SUSPICIOUS_EXE_VaultSchemaGUID author = ditekSHen, description = Detects executables referencing Windows vault credential objects. Observed in infostealers
Source: 1.2.RegSvcs.exe.3b76790.3.raw.unpack, type: UNPACKEDPE	Matched rule: INDICATOR_SUSPICIOUS_EXE_VaultSchemaGUID author = ditekSHen, description = Detects executables referencing Windows vault credential objects. Observed in infostealers
Source: 1.2.RegSvcs.exe.5160000.5.unpack, type: UNPACKEDPE	Matched rule: INDICATOR_SUSPICIOUS_EXE_VaultSchemaGUID author = ditekSHen, description = Detects executables referencing Windows vault credential objects. Observed in infostealers
Source: 1.2.RegSvcs.exe.3b76790.3.unpack, type: UNPACKEDPE	Matched rule: INDICATOR_SUSPICIOUS_EXE_VaultSchemaGUID author = ditekSHen, description = Detects executables referencing Windows vault credential objects. Observed in infostealers
Source: 00000000.00000002.1669136903.00000000040B0000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: MALWARE_Win_RedLine snort2_sid = 920072-920073, author = ditekSHen, description = Detects RedLine infostealer, clamav_sig = MALWARE.Win.Trojan.RedLine-1, MALWARE.Win.Trojan.RedLine-2, snort3_sid = 920072-920073
Source: 00000001.00000002.4120171532.0000000000400000.00000040.80000000.00040000.00000000.sdmp, type: MEMORY	Matched rule: MALWARE_Win_RedLine snort2_sid = 920072-920073, author = ditekSHen, description = Detects RedLine infostealer, clamav_sig = MALWARE.Win.Trojan.RedLine-1, MALWARE.Win.Trojan.RedLine-2, snort3_sid = 920072-920073
Source: 00000001.00000002.4125198203.0000000005220000.00000004.08000000.00040000.00000000.sdmp, type: MEMORY	Matched rule: INDICATOR_SUSPICIOUS_EXE_VaultSchemaGUID author = ditekSHen, description = Detects executables referencing Windows vault credential objects. Observed in infostealers
Source: 00000001.00000002.4124791586.0000000005160000.00000004.08000000.00040000.00000000.sdmp, type: MEMORY	Matched rule: INDICATOR_SUSPICIOUS_EXE_VaultSchemaGUID author = ditekSHen, description = Detects executables referencing Windows vault credential objects. Observed in infostealers

Source: 1.2.RegSvcs.exe.5160ee8.4.raw.unpack, WP6RZJql8gZrNhVA9v.cs	Cryptographic APIs: 'CreateDecryptor'
Source: 1.2.RegSvcs.exe.5160ee8.4.raw.unpack, WP6RZJql8gZrNhVA9v.cs	Cryptographic APIs: 'CreateDecryptor'
Source: 1.2.RegSvcs.exe.3b76790.3.raw.unpack, WP6RZJql8gZrNhVA9v.cs	Cryptographic APIs: 'CreateDecryptor'
Source: 1.2.RegSvcs.exe.3b76790.3.raw.unpack, WP6RZJql8gZrNhVA9v.cs	Cryptographic APIs: 'CreateDecryptor'
Source: 1.2.RegSvcs.exe.281149e.1.raw.unpack, WP6RZJql8gZrNhVA9v.cs	Cryptographic APIs: 'CreateDecryptor'
Source: 1.2.RegSvcs.exe.281149e.1.raw.unpack, WP6RZJql8gZrNhVA9v.cs	Cryptographic APIs: 'CreateDecryptor'
Source: 1.2.RegSvcs.exe.5220000.6.raw.unpack, WP6RZJql8gZrNhVA9v.cs	Cryptographic APIs: 'CreateDecryptor'
Source: 1.2.RegSvcs.exe.5220000.6.raw.unpack, WP6RZJql8gZrNhVA9v.cs	Cryptographic APIs: 'CreateDecryptor'
Source: 1.2.RegSvcs.exe.5220000.6.raw.unpack, 4JJG6X.cs	Cryptographic APIs: 'TransformFinalBlock'
Source: 1.2.RegSvcs.exe.5220000.6.raw.unpack, 4JJG6X.cs	Cryptographic APIs: 'TransformFinalBlock'

Source: classification engine

Classification label: mal100.troj.spyw.evad.winEXE@3/4@3/3

Source: C:\Users\user\Desktop\tgBNtoWqIp.exe

Code function: 0_2_00FCA2D5 GetLastError,FormatMessageW,

0_2_00FCA2D5

Source: C:\Users\user\Desktop\tgBNtoWqIp.exe	Code function: 0_2_00FB8713 AdjustTokenPrivileges,CloseHandle,		0_2_00FB8713
Source: C:\Users\user\Desktop\tgBNtoWqIp.exe	Code function: 0_2_00FB8CC3 LookupPrivilegeValueW,AdjustTokenPrivileges,GetLastError,		0_2_00FB8CC3

Source: C:\Users\user\Desktop\tgBNtoWqIp.exe

Code function: 0_2_00FCB59E SetErrorMode,GetDiskFreeSpaceExW,SetErrorMode,

0_2_00FCB59E

Source: C:\Users\user\Desktop\tgBNtoWqIp.exe

Code function: 0_2_00FDF121 CreateToolhelp32Snapshot,Process32FirstW,Process32NextW,CloseHandle,

0_2_00FDF121

Source: C:\Users\user\Desktop\tgBNtoWqIp.exe

Code function: 0_2_00FD86D0 CoInitialize,CoUninitialize,CoCreateInstance,IIDFromString,VariantInit,VariantClear,

0_2_00FD86D0

Source: C:\Users\user\Desktop\tgBNtoWqIp.exe

Code function: 0_2_00F64FE9 CreateStreamOnHGlobal,FindResourceExW,LoadResource,SizeofResource,LockResource,

0_2_00F64FE9

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe

Mutant created: NULL

Source: C:\Users\user\Desktop\tgBNtoWqIp.exe

File created: C:\Users\user\AppData\Local\Temp\aut8E4A.tmp

Jump to behavior

Source: tgBNtoWqIp.exe

Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_Processor
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe

File read: C:\Users\user\AppData\Roaming\Mozilla\Firefox\profiles.ini

Jump to behavior

Source: C:\Users\user\Desktop\tgBNtoWqIp.exe

Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: tgBNtoWqIp.exe

ReversingLabs: Detection: 87%

Source: unknown	Process created: C:\Users\user\Desktop\tgBNtoWqIp.exe "C:\Users\user\Desktop\tgBNtoWqIp.exe"
Source: C:\Users\user\Desktop\tgBNtoWqIp.exe	Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe "C:\Users\user\Desktop\tgBNtoWqIp.exe"
Source: C:\Users\user\Desktop\tgBNtoWqIp.exe	Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe "C:\Users\user\Desktop\tgBNtoWqIp.exe"	Jump to behavior

Source: C:\Users\user\Desktop\tgBNtoWqIp.exe	Section loaded: wsock32.dll	Jump to behavior
Source: C:\Users\user\Desktop\tgBNtoWqIp.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Users\user\Desktop\tgBNtoWqIp.exe	Section loaded: winmm.dll	Jump to behavior
Source: C:\Users\user\Desktop\tgBNtoWqIp.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Users\user\Desktop\tgBNtoWqIp.exe	Section loaded: wininet.dll	Jump to behavior
Source: C:\Users\user\Desktop\tgBNtoWqIp.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\tgBNtoWqIp.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Users\user\Desktop\tgBNtoWqIp.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Users\user\Desktop\tgBNtoWqIp.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\Desktop\tgBNtoWqIp.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Users\user\Desktop\tgBNtoWqIp.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Users\user\Desktop\tgBNtoWqIp.exe	Section loaded: ntmarta.dll	Jump to behavior

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{0EE7644B-1BAD-48B1-9889-0281C206EB85}\InprocServer32

Jump to behavior

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe

Key opened: HKEY_CURRENT_USER\Software\Microsoft\Office\11.0\Outlook\Profiles

Jump to behavior

Source: tgBNtoWqIp.exe

Static file information: File size 1237504 > 1048576

Source: tgBNtoWqIp.exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_IMPORT
Source: tgBNtoWqIp.exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_RESOURCE
Source: tgBNtoWqIp.exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_BASERELOC
Source: tgBNtoWqIp.exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_DEBUG
Source: tgBNtoWqIp.exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG
Source: tgBNtoWqIp.exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_IAT

Source: tgBNtoWqIp.exe

Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_DEBUG

Source:	Binary string: _.pdb source: RegSvcs.exe, 00000001.00000002.4122420156.00000000027D0000.00000004.00000020.00020000.00000000.sdmp, RegSvcs.exe, 00000001.00000002.4124115737.0000000003B21000.00000004.00000800.00020000.00000000.sdmp, RegSvcs.exe, 00000001.00000002.4124791586.0000000005160000.00000004.08000000.00040000.00000000.sdmp
Source:	Binary string: wntdll.pdbUGP source: tgBNtoWqIp.exe, 00000000.00000003.1665581285.00000000042A0000.00000004.00001000.00020000.00000000.sdmp, tgBNtoWqIp.exe, 00000000.00000003.1666211791.0000000004100000.00000004.00001000.00020000.00000000.sdmp
Source:	Binary string: wntdll.pdb source: tgBNtoWqIp.exe, 00000000.00000003.1665581285.00000000042A0000.00000004.00001000.00020000.00000000.sdmp, tgBNtoWqIp.exe, 00000000.00000003.1666211791.0000000004100000.00000004.00001000.00020000.00000000.sdmp

Source: tgBNtoWqIp.exe	Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_IMPORT is in: .rdata
Source: tgBNtoWqIp.exe	Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_RESOURCE is in: .rsrc
Source: tgBNtoWqIp.exe	Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_BASERELOC is in: .reloc
Source: tgBNtoWqIp.exe	Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG is in: .rdata
Source: tgBNtoWqIp.exe	Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_IAT is in: .rdata

Data Obfuscation

.NET source code contains method to dynamically call methods (often used by packers)

Source: 1.2.RegSvcs.exe.5160ee8.4.raw.unpack, WP6RZJql8gZrNhVA9v.cs	.Net Code: typeof(Marshal).GetMethod("GetDelegateForFunctionPointer", new Type[2]{typeof(IntPtr),typeof(Type)})
Source: 1.2.RegSvcs.exe.3b76790.3.raw.unpack, WP6RZJql8gZrNhVA9v.cs	.Net Code: typeof(Marshal).GetMethod("GetDelegateForFunctionPointer", new Type[2]{typeof(IntPtr),typeof(Type)})
Source: 1.2.RegSvcs.exe.281149e.1.raw.unpack, WP6RZJql8gZrNhVA9v.cs	.Net Code: typeof(Marshal).GetMethod("GetDelegateForFunctionPointer", new Type[2]{typeof(IntPtr),typeof(Type)})
Source: 1.2.RegSvcs.exe.5220000.6.raw.unpack, WP6RZJql8gZrNhVA9v.cs	.Net Code: typeof(Marshal).GetMethod("GetDelegateForFunctionPointer", new Type[2]{typeof(IntPtr),typeof(Type)})

Source: C:\Users\user\Desktop\tgBNtoWqIp.exe

Code function: 0_2_00FDC304 LoadLibraryA,GetProcAddress,

0_2_00FDC304

Source: C:\Users\user\Desktop\tgBNtoWqIp.exe	Code function: 0_2_00FC8719 push FFFFFF8Bh; iretd	0_2_00FC871B
Source: C:\Users\user\Desktop\tgBNtoWqIp.exe	Code function: 0_2_00F8E94F push edi; ret	0_2_00F8E951
Source: C:\Users\user\Desktop\tgBNtoWqIp.exe	Code function: 0_2_00F8EA68 push esi; ret	0_2_00F8EA6A
Source: C:\Users\user\Desktop\tgBNtoWqIp.exe	Code function: 0_2_00F88B85 push ecx; ret	0_2_00F88B98
Source: C:\Users\user\Desktop\tgBNtoWqIp.exe	Code function: 0_2_00F8EC43 push esi; ret	0_2_00F8EC45
Source: C:\Users\user\Desktop\tgBNtoWqIp.exe	Code function: 0_2_00F8ED2C push edi; ret	0_2_00F8ED2E
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 1_2_0041C40C push cs; iretd	1_2_0041C4E2
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 1_2_00423149 push eax; ret	1_2_00423179
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 1_2_0041C50E push cs; iretd	1_2_0041C4E2
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 1_2_004231C8 push eax; ret	1_2_00423179
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 1_2_0040E21D push ecx; ret	1_2_0040E230
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 1_2_0041C6BE push ebx; ret	1_2_0041C6BF
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 1_2_0040BB97 push dword ptr [ecx-75h]; iretd	1_2_0040BBA3
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 1_2_0272435F push eax; iretd	1_2_02724365
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 1_2_02724F5D push ebp; ret	1_2_02724F60
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 1_2_0677ACAD push esp; retf	1_2_0677ACB7

Source: 1.2.RegSvcs.exe.5160ee8.4.raw.unpack, WP6RZJql8gZrNhVA9v.cs	High entropy of concatenated method names: 'G9skPDgcXb', 'KDikMXewCI', 'B2XkaLi4dH', 'hx5kqNgSj4', 'TVtkAMaqpL', 'VDqkQKyKML', 'QpWZ6dRwNDxCN', 'ab9oDe4UH3', 'TAOohhiP7R', 'zDKosecjaB'
Source: 1.2.RegSvcs.exe.3b76790.3.raw.unpack, WP6RZJql8gZrNhVA9v.cs	High entropy of concatenated method names: 'G9skPDgcXb', 'KDikMXewCI', 'B2XkaLi4dH', 'hx5kqNgSj4', 'TVtkAMaqpL', 'VDqkQKyKML', 'QpWZ6dRwNDxCN', 'ab9oDe4UH3', 'TAOohhiP7R', 'zDKosecjaB'
Source: 1.2.RegSvcs.exe.281149e.1.raw.unpack, WP6RZJql8gZrNhVA9v.cs	High entropy of concatenated method names: 'G9skPDgcXb', 'KDikMXewCI', 'B2XkaLi4dH', 'hx5kqNgSj4', 'TVtkAMaqpL', 'VDqkQKyKML', 'QpWZ6dRwNDxCN', 'ab9oDe4UH3', 'TAOohhiP7R', 'zDKosecjaB'
Source: 1.2.RegSvcs.exe.5220000.6.raw.unpack, WP6RZJql8gZrNhVA9v.cs	High entropy of concatenated method names: 'G9skPDgcXb', 'KDikMXewCI', 'B2XkaLi4dH', 'hx5kqNgSj4', 'TVtkAMaqpL', 'VDqkQKyKML', 'QpWZ6dRwNDxCN', 'ab9oDe4UH3', 'TAOohhiP7R', 'zDKosecjaB'

Source: C:\Users\user\Desktop\tgBNtoWqIp.exe	Code function: 0_2_00F64A35 GetForegroundWindow,FindWindowW,IsIconic,ShowWindow,SetForegroundWindow,GetWindowThreadProcessId,GetWindowThreadProcessId,GetCurrentThreadId,GetWindowThreadProcessId,AttachThreadInput,AttachThreadInput,AttachThreadInput,AttachThreadInput,SetForegroundWindow,MapVirtualKeyW,MapVirtualKeyW,keybd_event,keybd_event,MapVirtualKeyW,keybd_event,MapVirtualKeyW,keybd_event,MapVirtualKeyW,keybd_event,SetForegroundWindow,AttachThreadInput,AttachThreadInput,AttachThreadInput,AttachThreadInput,		0_2_00F64A35
Source: C:\Users\user\Desktop\tgBNtoWqIp.exe	Code function: 0_2_00FE55FD IsWindowVisible,IsWindowEnabled,GetForegroundWindow,IsIconic,IsZoomed,		0_2_00FE55FD

Source: C:\Users\user\Desktop\tgBNtoWqIp.exe

Code function: 0_2_00F833C7 EncodePointer,__initp_misc_winsig,GetModuleHandleW,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,

0_2_00F833C7

Source: C:\Users\user\Desktop\tgBNtoWqIp.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\tgBNtoWqIp.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior

Malware Analysis System Evasion

Check if machine is in data center or colocation facility

Source: global traffic

HTTP traffic detected: GET /line/?fields=hosting HTTP/1.1Host: ip-api.comConnection: Keep-Alive

Queries sensitive network adapter information (via WMI, Win32_NetworkAdapter, often done to detect virtual machines)

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe

WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_NetworkAdapterConfiguration

Queries sensitive video device information (via WMI, Win32_VideoController, often done to detect virtual machines)

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe

WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_VideoController

Switches to a custom stack to bypass stack traces

Source: C:\Users\user\Desktop\tgBNtoWqIp.exe

API/Special instruction interceptor: Address: 11B3224

Tries to detect sandboxes and other dynamic analysis tools (process name or module or function)

Source: RegSvcs.exe, 00000001.00000002.4122420156.00000000027D0000.00000004.00000020.00020000.00000000.sdmp, RegSvcs.exe, 00000001.00000002.4124115737.0000000003B21000.00000004.00000800.00020000.00000000.sdmp, RegSvcs.exe, 00000001.00000002.4125198203.0000000005220000.00000004.08000000.00040000.00000000.sdmp, RegSvcs.exe, 00000001.00000002.4124791586.0000000005160000.00000004.08000000.00040000.00000000.sdmp, RegSvcs.exe, 00000001.00000002.4122661159.0000000002B88000.00000004.00000800.00020000.00000000.sdmp

Binary or memory string: SBIEDLL.DLL

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe

Code function: 1_2_004019F0 OleInitialize,_getenv,GetCurrentProcessId,CreateToolhelp32Snapshot,Module32First,CloseHandle,Module32Next,Module32Next,FindCloseChangeNotification,GetModuleHandleA,FindResourceA,LoadResource,LockResource,SizeofResource,_malloc,_memset,SizeofResource,_memset,FreeResource,_malloc,SizeofResource,_memset,LoadLibraryA,GetProcAddress,VariantInit,VariantInit,VariantInit,SafeArrayCreate,SafeArrayAccessData,SafeArrayUnaccessData,SafeArrayDestroy,SafeArrayCreateVector,VariantClear,VariantClear,VariantClear,

1_2_004019F0

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 600000	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 599875	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 599766	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 599656	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 599547	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 599438	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 599313	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 599203	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 599094	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 598969	Jump to behavior

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Window / User API: threadDelayed 1421			Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Window / User API: threadDelayed 8430			Jump to behavior

Source: C:\Users\user\Desktop\tgBNtoWqIp.exe

Evasive API call chain: GetSystemTimeAsFileTime,DecisionNodes

graph_0-99126

Source: C:\Users\user\Desktop\tgBNtoWqIp.exe

API coverage: 4.7 %

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe

WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_BaseBoard

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_Processor
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor

Source: C:\Users\user\Desktop\tgBNtoWqIp.exe	Code function: 0_2_00FC4696 GetFileAttributesW,FindFirstFileW,FindClose,	0_2_00FC4696
Source: C:\Users\user\Desktop\tgBNtoWqIp.exe	Code function: 0_2_00FCC9C7 FindFirstFileW,FindClose,FileTimeToLocalFileTime,FileTimeToLocalFileTime,FileTimeToLocalFileTime,FileTimeToSystemTime,__swprintf,__swprintf,__swprintf,__swprintf,__swprintf,__swprintf,__swprintf,	0_2_00FCC9C7
Source: C:\Users\user\Desktop\tgBNtoWqIp.exe	Code function: 0_2_00FCC93C FindFirstFileW,FindClose,	0_2_00FCC93C
Source: C:\Users\user\Desktop\tgBNtoWqIp.exe	Code function: 0_2_00FCF200 SetCurrentDirectoryW,FindFirstFileW,FindFirstFileW,_wcscmp,_wcscmp,GetFileAttributesW,SetFileAttributesW,FindNextFileW,FindClose,FindFirstFileW,SetCurrentDirectoryW,_wcscmp,_wcscmp,SetCurrentDirectoryW,SetCurrentDirectoryW,FindNextFileW,FindClose,FindClose,	0_2_00FCF200
Source: C:\Users\user\Desktop\tgBNtoWqIp.exe	Code function: 0_2_00FCF35D SetCurrentDirectoryW,FindFirstFileW,FindFirstFileW,_wcscmp,_wcscmp,FindNextFileW,FindClose,FindFirstFileW,SetCurrentDirectoryW,_wcscmp,_wcscmp,SetCurrentDirectoryW,SetCurrentDirectoryW,FindNextFileW,FindClose,FindClose,	0_2_00FCF35D
Source: C:\Users\user\Desktop\tgBNtoWqIp.exe	Code function: 0_2_00FCF65E FindFirstFileW,Sleep,_wcscmp,_wcscmp,FindNextFileW,FindClose,	0_2_00FCF65E
Source: C:\Users\user\Desktop\tgBNtoWqIp.exe	Code function: 0_2_00FC3A2B FindFirstFileW,DeleteFileW,DeleteFileW,MoveFileW,DeleteFileW,FindNextFileW,FindClose,FindClose,	0_2_00FC3A2B
Source: C:\Users\user\Desktop\tgBNtoWqIp.exe	Code function: 0_2_00FC3D4E FindFirstFileW,DeleteFileW,FindNextFileW,FindClose,FindClose,	0_2_00FC3D4E
Source: C:\Users\user\Desktop\tgBNtoWqIp.exe	Code function: 0_2_00FCBF27 FindFirstFileW,_wcscmp,_wcscmp,FindNextFileW,FindClose,	0_2_00FCBF27

Source: C:\Users\user\Desktop\tgBNtoWqIp.exe

Code function: 0_2_00F64AFE GetVersionExW,GetCurrentProcess,IsWow64Process,GetNativeSystemInfo,FreeLibrary,GetSystemInfo,GetSystemInfo,

0_2_00F64AFE

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 600000	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 599875	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 599766	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 599656	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 599547	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 599438	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 599313	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 599203	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 599094	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 598969	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 100000	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 99875	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 99765	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 99656	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 99547	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 99437	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 99328	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 99143	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 99016	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 98891	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 98781	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 98672	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 98562	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 98453	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 98344	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 98234	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 98125	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 98015	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 97906	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 97797	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 97687	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 97578	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 97469	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 97359	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 97249	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 97140	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 97027	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 96922	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 96810	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 96700	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 96594	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 96484	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 96375	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 96265	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 96156	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 96046	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 95937	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 95828	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 95719	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 95609	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 95500	Jump to behavior

Source: RegSvcs.exe, 00000001.00000002.4122661159.0000000002B88000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: VMware
Source: RegSvcs.exe, 00000001.00000002.4122661159.0000000002B88000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: vmware
Source: RegSvcs.exe, 00000001.00000002.4124791586.0000000005160000.00000004.08000000.00040000.00000000.sdmp	Binary or memory string: VMwareVBoxESelect * from Win32_ComputerSystem
Source: RegSvcs.exe, 00000001.00000002.4121211017.0000000000C3D000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW%SystemRoot%\system32\mswsock.dll

Source: C:\Users\user\Desktop\tgBNtoWqIp.exe	API call chain: ExitProcess graph end node	graph_0-97740
Source: C:\Users\user\Desktop\tgBNtoWqIp.exe	API call chain: ExitProcess graph end node	graph_0-97814
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	API call chain: ExitProcess graph end node

Anti Debugging

Contains functionality to check if a debugger is running (CheckRemoteDebuggerPresent)

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe

Code function: 1_2_06121BF4 CheckRemoteDebuggerPresent,

1_2_06121BF4

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe

Process queried: DebugPort

Jump to behavior

Source: C:\Users\user\Desktop\tgBNtoWqIp.exe

Code function: 0_2_00FD41FD BlockInput,

0_2_00FD41FD

Source: C:\Users\user\Desktop\tgBNtoWqIp.exe

Code function: 0_2_00F63B4C GetCurrentDirectoryW,IsDebuggerPresent,GetFullPathNameW,SetCurrentDirectoryW,MessageBoxA,SetCurrentDirectoryW,GetForegroundWindow,ShellExecuteW,

0_2_00F63B4C

Source: C:\Users\user\Desktop\tgBNtoWqIp.exe

Code function: 0_2_00F95CCC EncodePointer,EncodePointer,___crtIsPackagedApp,LoadLibraryExW,GetLastError,LoadLibraryExW,GetProcAddress,EncodePointer,GetProcAddress,EncodePointer,GetProcAddress,EncodePointer,GetProcAddress,EncodePointer,GetProcAddress,EncodePointer,IsDebuggerPresent,OutputDebugStringW,DecodePointer,DecodePointer,DecodePointer,DecodePointer,DecodePointer,DecodePointer,DecodePointer,

0_2_00F95CCC

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe

1_2_004019F0

Source: C:\Users\user\Desktop\tgBNtoWqIp.exe

Code function: 0_2_00FDC304 LoadLibraryA,GetProcAddress,

0_2_00FDC304

Source: C:\Users\user\Desktop\tgBNtoWqIp.exe	Code function: 0_2_011B3490 mov eax, dword ptr fs:[00000030h]	0_2_011B3490
Source: C:\Users\user\Desktop\tgBNtoWqIp.exe	Code function: 0_2_011B34F0 mov eax, dword ptr fs:[00000030h]	0_2_011B34F0
Source: C:\Users\user\Desktop\tgBNtoWqIp.exe	Code function: 0_2_011B1E70 mov eax, dword ptr fs:[00000030h]	0_2_011B1E70

Source: C:\Users\user\Desktop\tgBNtoWqIp.exe

Code function: 0_2_00FB81F7 GetSecurityDescriptorDacl,_memset,GetAclInformation,GetLengthSid,GetAce,AddAce,GetLengthSid,GetProcessHeap,HeapAlloc,GetLengthSid,CopySid,AddAce,SetSecurityDescriptorDacl,SetUserObjectSecurity,

0_2_00FB81F7

Source: C:\Users\user\Desktop\tgBNtoWqIp.exe	Code function: 0_2_00F8A395 SetUnhandledExceptionFilter,UnhandledExceptionFilter,	0_2_00F8A395
Source: C:\Users\user\Desktop\tgBNtoWqIp.exe	Code function: 0_2_00F8A364 SetUnhandledExceptionFilter,	0_2_00F8A364
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 1_2_0040CE09 IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,	1_2_0040CE09
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 1_2_0040E61C _memset,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,	1_2_0040E61C
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 1_2_00416F6A __NMSG_WRITE,_raise,_memset,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	1_2_00416F6A
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 1_2_004123F1 SetUnhandledExceptionFilter,	1_2_004123F1

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe

Memory allocated: page read and write | page guard

Jump to behavior

HIPS / PFW / Operating System Protection Evasion

Maps a DLL or memory area into another process

Source: C:\Users\user\Desktop\tgBNtoWqIp.exe

Section loaded: NULL target: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe protection: execute and read and write

Jump to behavior

Writes to foreign memory regions

Source: C:\Users\user\Desktop\tgBNtoWqIp.exe

Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe base: 9E6008

Jump to behavior

Source: C:\Users\user\Desktop\tgBNtoWqIp.exe

Code function: 0_2_00FB8C93 LogonUserW,

0_2_00FB8C93

Source: C:\Users\user\Desktop\tgBNtoWqIp.exe

Code function: 0_2_00F63B4C GetCurrentDirectoryW,IsDebuggerPresent,GetFullPathNameW,SetCurrentDirectoryW,MessageBoxA,SetCurrentDirectoryW,GetForegroundWindow,ShellExecuteW,

0_2_00F63B4C

Source: C:\Users\user\Desktop\tgBNtoWqIp.exe

Code function: 0_2_00F64A35 GetForegroundWindow,FindWindowW,IsIconic,ShowWindow,SetForegroundWindow,GetWindowThreadProcessId,GetWindowThreadProcessId,GetCurrentThreadId,GetWindowThreadProcessId,AttachThreadInput,AttachThreadInput,AttachThreadInput,AttachThreadInput,SetForegroundWindow,MapVirtualKeyW,MapVirtualKeyW,keybd_event,keybd_event,MapVirtualKeyW,keybd_event,MapVirtualKeyW,keybd_event,MapVirtualKeyW,keybd_event,SetForegroundWindow,AttachThreadInput,AttachThreadInput,AttachThreadInput,AttachThreadInput,

0_2_00F64A35

Source: C:\Users\user\Desktop\tgBNtoWqIp.exe

Code function: 0_2_00FC4EF5 mouse_event,

0_2_00FC4EF5

Source: C:\Users\user\Desktop\tgBNtoWqIp.exe

Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe "C:\Users\user\Desktop\tgBNtoWqIp.exe"

Jump to behavior

Source: C:\Users\user\Desktop\tgBNtoWqIp.exe

0_2_00FB81F7

Source: C:\Users\user\Desktop\tgBNtoWqIp.exe

Code function: 0_2_00FC4C03 AllocateAndInitializeSid,CheckTokenMembership,FreeSid,

0_2_00FC4C03

Source: tgBNtoWqIp.exe	Binary or memory string: Run Script:AutoIt script files (.au3, .a3x).au3;.a3xAll files (.).au3#include depth exceeded. Make sure there are no recursive includesError opening the file>>>AUTOIT SCRIPT<<<Bad directive syntax errorUnterminated stringCannot parse #includeUnterminated group of commentsONOFF0%d%dShell_TrayWndREMOVEKEYSEXISTSAPPENDblankinfoquestionstopwarning
Source: tgBNtoWqIp.exe	Binary or memory string: Shell_TrayWnd

Source: C:\Users\user\Desktop\tgBNtoWqIp.exe

Code function: 0_2_00F8886B cpuid

0_2_00F8886B

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe

Code function: GetLocaleInfoA,

1_2_00417A20

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Windows.Forms\v4.0_4.0.0.0__b77a5c561934e089\System.Windows.Forms.dll VolumeInformation	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Security\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Security.dll VolumeInformation	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.VisualBasic\v4.0_10.0.0.0__b03f5f7f11d50a3a\Microsoft.VisualBasic.dll VolumeInformation	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Drawing\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Drawing.dll VolumeInformation	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Accessibility\v4.0_4.0.0.0__b03f5f7f11d50a3a\Accessibility.dll VolumeInformation	Jump to behavior

Source: C:\Users\user\Desktop\tgBNtoWqIp.exe

Code function: 0_2_00F950D7 GetSystemTimeAsFileTime,GetCurrentThreadId,GetCurrentProcessId,QueryPerformanceCounter,

0_2_00F950D7

Source: C:\Users\user\Desktop\tgBNtoWqIp.exe

Code function: 0_2_00FA2230 GetUserNameW,

0_2_00FA2230

Source: C:\Users\user\Desktop\tgBNtoWqIp.exe

Code function: 0_2_00F9418A __lock,____lc_codepage_func,__getenv_helper_nolock,_free,_strlen,__malloc_crt,_strlen,__invoke_watson,_free,GetTimeZoneInformation,WideCharToMultiByte,WideCharToMultiByte,

0_2_00F9418A

Source: C:\Users\user\Desktop\tgBNtoWqIp.exe

Code function: 0_2_00F64AFE GetVersionExW,GetCurrentProcess,IsWow64Process,GetNativeSystemInfo,FreeLibrary,GetSystemInfo,GetSystemInfo,

0_2_00F64AFE

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid

Jump to behavior

Stealing of Sensitive Information

Yara detected AgentTesla

Source: Yara match	File source: 1.2.RegSvcs.exe.5220000.6.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 1.2.RegSvcs.exe.28105b6.2.unpack, type: UNPACKEDPE
Source: Yara match	File source: 1.2.RegSvcs.exe.5160ee8.4.unpack, type: UNPACKEDPE
Source: Yara match	File source: 1.2.RegSvcs.exe.5160ee8.4.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 1.2.RegSvcs.exe.281149e.1.unpack, type: UNPACKEDPE
Source: Yara match	File source: 1.2.RegSvcs.exe.5220000.6.unpack, type: UNPACKEDPE
Source: Yara match	File source: 1.2.RegSvcs.exe.281149e.1.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 1.2.RegSvcs.exe.28105b6.2.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 1.2.RegSvcs.exe.5160000.5.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 1.2.RegSvcs.exe.3b76790.3.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 1.2.RegSvcs.exe.5160000.5.unpack, type: UNPACKEDPE
Source: Yara match	File source: 1.2.RegSvcs.exe.3b76790.3.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000001.00000002.4122661159.0000000002BB9000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000001.00000002.4122661159.0000000002BB1000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000001.00000002.4122661159.0000000002BC4000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000001.00000002.4122420156.00000000027D0000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000001.00000002.4125198203.0000000005220000.00000004.08000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000001.00000002.4122661159.0000000002B88000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000001.00000002.4124791586.0000000005160000.00000004.08000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000001.00000002.4124115737.0000000003B21000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: RegSvcs.exe PID: 7452, type: MEMORYSTR

Yara detected PureLog Stealer

Source: Yara match	File source: 1.2.RegSvcs.exe.5220000.6.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 1.2.RegSvcs.exe.28105b6.2.unpack, type: UNPACKEDPE
Source: Yara match	File source: 1.2.RegSvcs.exe.5160ee8.4.unpack, type: UNPACKEDPE
Source: Yara match	File source: 1.2.RegSvcs.exe.5160ee8.4.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 1.2.RegSvcs.exe.281149e.1.unpack, type: UNPACKEDPE
Source: Yara match	File source: 1.2.RegSvcs.exe.5220000.6.unpack, type: UNPACKEDPE
Source: Yara match	File source: 1.2.RegSvcs.exe.281149e.1.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 1.2.RegSvcs.exe.28105b6.2.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 1.2.RegSvcs.exe.5160000.5.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 1.2.RegSvcs.exe.3b76790.3.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 1.2.RegSvcs.exe.5160000.5.unpack, type: UNPACKEDPE
Source: Yara match	File source: 1.2.RegSvcs.exe.3b76790.3.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000001.00000002.4122420156.00000000027D0000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000001.00000002.4125198203.0000000005220000.00000004.08000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000001.00000002.4124791586.0000000005160000.00000004.08000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000001.00000002.4124115737.0000000003B21000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY

Tries to harvest and steal Putty / WinSCP information (sessions, passwords, etc)

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe

Key opened: HKEY_CURRENT_USER\SOFTWARE\Martin Prikryl\WinSCP 2\Sessions

Jump to behavior

Tries to harvest and steal browser information (history, passwords, etc)

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Network\Cookies	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Login Data	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Login Data	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\profiles.ini	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\cookies.sqlite	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	File opened: C:\Users\user\AppData\Roaming\8pecxstudios\Cyberfox\profiles.ini	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	File opened: C:\Users\user\AppData\Roaming\NETGATE Technologies\BlackHawk\profiles.ini	Jump to behavior

Tries to harvest and steal ftp login credentials

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe

File opened: C:\FTP Navigator\Ftplist.txt

Jump to behavior

Tries to steal Mail credentials (via file / registry access)

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	File opened: C:\Users\user\AppData\Roaming\Thunderbird\profiles.ini	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	File opened: C:\Users\user\AppData\Roaming\Thunderbird\profiles.ini	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	File opened: C:\Users\user\AppData\Roaming\Thunderbird\profiles.ini	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Key opened: HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Key opened: HKEY_CURRENT_USER\Software\IncrediMail\Identities	Jump to behavior

Source: tgBNtoWqIp.exe	Binary or memory string: WIN_81
Source: tgBNtoWqIp.exe	Binary or memory string: WIN_XP
Source: tgBNtoWqIp.exe	Binary or memory string: WIN_XPe
Source: tgBNtoWqIp.exe	Binary or memory string: WIN_VISTA
Source: tgBNtoWqIp.exe	Binary or memory string: WIN_7
Source: tgBNtoWqIp.exe	Binary or memory string: WIN_8
Source: tgBNtoWqIp.exe	Binary or memory string: %.3d%S%M%H%m%Y%jX86IA64X64WIN32_NTWIN_10WIN_2016WIN_81WIN_2012R2WIN_2012WIN_8WIN_2008R2WIN_7WIN_2008WIN_VISTAWIN_2003WIN_XPeWIN_XPInstallLanguageSYSTEM\CurrentControlSet\Control\Nls\LanguageSchemeLangIDControl Panel\Appearance3, 3, 14, 5USERPROFILEUSERDOMAINUSERDNSDOMAINGetSystemWow64DirectoryWSeDebugPrivilege:winapistdcallubyte

Source: Yara match	File source: 1.2.RegSvcs.exe.5220000.6.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 1.2.RegSvcs.exe.28105b6.2.unpack, type: UNPACKEDPE
Source: Yara match	File source: 1.2.RegSvcs.exe.5160ee8.4.unpack, type: UNPACKEDPE
Source: Yara match	File source: 1.2.RegSvcs.exe.5160ee8.4.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 1.2.RegSvcs.exe.281149e.1.unpack, type: UNPACKEDPE
Source: Yara match	File source: 1.2.RegSvcs.exe.5220000.6.unpack, type: UNPACKEDPE
Source: Yara match	File source: 1.2.RegSvcs.exe.281149e.1.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 1.2.RegSvcs.exe.28105b6.2.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 1.2.RegSvcs.exe.5160000.5.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 1.2.RegSvcs.exe.3b76790.3.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 1.2.RegSvcs.exe.5160000.5.unpack, type: UNPACKEDPE
Source: Yara match	File source: 1.2.RegSvcs.exe.3b76790.3.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000001.00000002.4122420156.00000000027D0000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000001.00000002.4125198203.0000000005220000.00000004.08000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000001.00000002.4122661159.0000000002B88000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000001.00000002.4124791586.0000000005160000.00000004.08000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000001.00000002.4124115737.0000000003B21000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: RegSvcs.exe PID: 7452, type: MEMORYSTR

Remote Access Functionality

Yara detected AgentTesla

Source: Yara match	File source: 1.2.RegSvcs.exe.5220000.6.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 1.2.RegSvcs.exe.28105b6.2.unpack, type: UNPACKEDPE
Source: Yara match	File source: 1.2.RegSvcs.exe.5160ee8.4.unpack, type: UNPACKEDPE
Source: Yara match	File source: 1.2.RegSvcs.exe.5160ee8.4.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 1.2.RegSvcs.exe.281149e.1.unpack, type: UNPACKEDPE
Source: Yara match	File source: 1.2.RegSvcs.exe.5220000.6.unpack, type: UNPACKEDPE
Source: Yara match	File source: 1.2.RegSvcs.exe.281149e.1.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 1.2.RegSvcs.exe.28105b6.2.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 1.2.RegSvcs.exe.5160000.5.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 1.2.RegSvcs.exe.3b76790.3.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 1.2.RegSvcs.exe.5160000.5.unpack, type: UNPACKEDPE
Source: Yara match	File source: 1.2.RegSvcs.exe.3b76790.3.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000001.00000002.4122661159.0000000002BB9000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000001.00000002.4122661159.0000000002BB1000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000001.00000002.4122661159.0000000002BC4000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000001.00000002.4122420156.00000000027D0000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000001.00000002.4125198203.0000000005220000.00000004.08000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000001.00000002.4122661159.0000000002B88000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000001.00000002.4124791586.0000000005160000.00000004.08000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000001.00000002.4124115737.0000000003B21000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: RegSvcs.exe PID: 7452, type: MEMORYSTR

Yara detected PureLog Stealer

Source: Yara match	File source: 1.2.RegSvcs.exe.5220000.6.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 1.2.RegSvcs.exe.28105b6.2.unpack, type: UNPACKEDPE
Source: Yara match	File source: 1.2.RegSvcs.exe.5160ee8.4.unpack, type: UNPACKEDPE
Source: Yara match	File source: 1.2.RegSvcs.exe.5160ee8.4.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 1.2.RegSvcs.exe.281149e.1.unpack, type: UNPACKEDPE
Source: Yara match	File source: 1.2.RegSvcs.exe.5220000.6.unpack, type: UNPACKEDPE
Source: Yara match	File source: 1.2.RegSvcs.exe.281149e.1.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 1.2.RegSvcs.exe.28105b6.2.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 1.2.RegSvcs.exe.5160000.5.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 1.2.RegSvcs.exe.3b76790.3.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 1.2.RegSvcs.exe.5160000.5.unpack, type: UNPACKEDPE
Source: Yara match	File source: 1.2.RegSvcs.exe.3b76790.3.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000001.00000002.4122420156.00000000027D0000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000001.00000002.4125198203.0000000005220000.00000004.08000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000001.00000002.4124791586.0000000005160000.00000004.08000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000001.00000002.4124115737.0000000003B21000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY

Source: C:\Users\user\Desktop\tgBNtoWqIp.exe	Code function: 0_2_00FD6596 socket,WSAGetLastError,bind,listen,WSAGetLastError,closesocket,		0_2_00FD6596
Source: C:\Users\user\Desktop\tgBNtoWqIp.exe	Code function: 0_2_00FD6A5A socket,WSAGetLastError,bind,WSAGetLastError,closesocket,		0_2_00FD6A5A

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	Acquire Infrastructure	2 Valid Accounts	221 Windows Management Instrumentation	1 DLL Side-Loading	1 Exploitation for Privilege Escalation	11 Disable or Modify Tools	2 OS Credential Dumping	2 System Time Discovery	Remote Services	11 Archive Collected Data	2 Ingress Tool Transfer	Exfiltration Over Other Network Medium	1 System Shutdown/Reboot
Credentials	Domains	Default Accounts	2 Native API	2 Valid Accounts	1 DLL Side-Loading	11 Deobfuscate/Decode Files or Information	121 Input Capture	1 Account Discovery	Remote Desktop Protocol	2 Data from Local System	11 Encrypted Channel	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	At	Logon Script (Windows)	2 Valid Accounts	2 Obfuscated Files or Information	1 Credentials in Registry	2 File and Directory Discovery	SMB/Windows Admin Shares	1 Email Collection	1 Non-Standard Port	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	Cron	Login Hook	21 Access Token Manipulation	1 Software Packing	NTDS	148 System Information Discovery	Distributed Component Object Model	121 Input Capture	2 Non-Application Layer Protocol	Traffic Duplication	Data Destruction
Gather Victim Network Information	Server	Cloud Accounts	Launchd	Network Logon Script	212 Process Injection	1 DLL Side-Loading	LSA Secrets	661 Security Software Discovery	SSH	3 Clipboard Data	23 Application Layer Protocol	Scheduled Transfer	Data Encrypted for Impact
Domain Properties	Botnet	Replication Through Removable Media	Scheduled Task	RC Scripts	RC Scripts	2 Valid Accounts	Cached Domain Credentials	231 Virtualization/Sandbox Evasion	VNC	GUI Input Capture	Multiband Communication	Data Transfer Size Limits	Service Stop
DNS	Web Services	External Remote Services	Systemd Timers	Startup Items	Startup Items	231 Virtualization/Sandbox Evasion	DCSync	2 Process Discovery	Windows Remote Management	Web Portal Capture	Commonly Used Port	Exfiltration Over C2 Channel	Inhibit System Recovery
Network Trust Dependencies	Serverless	Drive-by Compromise	Container Orchestration Job	Scheduled Task/Job	Scheduled Task/Job	21 Access Token Manipulation	Proc Filesystem	11 Application Window Discovery	Cloud Services	Credential API Hooking	Application Layer Protocol	Exfiltration Over Alternative Protocol	Defacement
Network Topology	Malvertising	Exploit Public-Facing Application	Command and Scripting Interpreter	At	At	212 Process Injection	/etc/passwd and /etc/shadow	1 System Owner/User Discovery	Direct Cloud VM Connections	Data Staged	Web Protocols	Exfiltration Over Symmetric Encrypted Non-C2 Protocol	Internal Defacement
IP Addresses	Compromise Infrastructure	Supply Chain Compromise	PowerShell	Cron	Cron	Dynamic API Resolution	Network Sniffing	1 System Network Configuration Discovery	Shared Webroot	Local Data Staging	File Transfer Protocols	Exfiltration Over Asymmetric Encrypted Non-C2 Protocol	External Defacement

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Source	Detection	Scanner	Label	Link
tgBNtoWqIp.exe	88%	ReversingLabs	Win32.Spyware.RedLine
tgBNtoWqIp.exe	100%	Joe Sandbox ML

Source	Detection	Scanner	Label
https://api.ipify.org/	0%	URL Reputation	safe
https://api.ipify.org	0%	URL Reputation	safe
https://account.dyn.com/	0%	URL Reputation	safe
http://x1.c.lencr.org/0	0%	URL Reputation	safe
http://x1.i.lencr.org/0	0%	URL Reputation	safe
http://ip-api.com	0%	URL Reputation	safe
http://r3.o.lencr.org0	0%	URL Reputation	safe
https://api.ipify.org/t	0%	URL Reputation	safe
http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name	0%	URL Reputation	safe
http://ip-api.com/line/?fields=hosting	0%	URL Reputation	safe
http://r3.i.lencr.org/01	0%	Avira URL Cloud	safe
http://mail.divanrestoran.com	0%	Avira URL Cloud	safe
http://divanrestoran.com	0%	Avira URL Cloud	safe

Domains and IPs

Contacted Domains

Name	IP	Active	Malicious	Reputation
divanrestoran.com	185.149.100.122	true	true	unknown
api.ipify.org	104.26.13.205	true	false	unknown
ip-api.com	208.95.112.1	true	true	unknown
mail.divanrestoran.com	unknown	unknown	true	unknown

Contacted URLs

Name	Malicious	Antivirus Detection	Reputation
https://api.ipify.org/	false	URL Reputation: safe	unknown
http://ip-api.com/line/?fields=hosting	false	URL Reputation: safe	unknown

URLs from Memory and Binaries

Name	Source	Malicious	Antivirus Detection	Reputation
http://r3.i.lencr.org/01	RegSvcs.exe, 00000001.00000002.4122661159.0000000002BB9000.00000004.00000800.00020000.00000000.sdmp, RegSvcs.exe, 00000001.00000002.4125419915.0000000005486000.00000004.00000020.00020000.00000000.sdmp, RegSvcs.exe, 00000001.00000002.4126404975.0000000006A8D000.00000004.00000020.00020000.00000000.sdmp, RegSvcs.exe, 00000001.00000002.4122661159.0000000002C67000.00000004.00000800.00020000.00000000.sdmp, RegSvcs.exe, 00000001.00000002.4121211017.0000000000C69000.00000004.00000020.00020000.00000000.sdmp, RegSvcs.exe, 00000001.00000002.4125419915.0000000005452000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://api.ipify.org	RegSvcs.exe, 00000001.00000002.4122661159.0000000002B21000.00000004.00000800.00020000.00000000.sdmp, RegSvcs.exe, 00000001.00000002.4122420156.00000000027D0000.00000004.00000020.00020000.00000000.sdmp, RegSvcs.exe, 00000001.00000002.4124115737.0000000003B21000.00000004.00000800.00020000.00000000.sdmp, RegSvcs.exe, 00000001.00000002.4125198203.0000000005220000.00000004.08000000.00040000.00000000.sdmp, RegSvcs.exe, 00000001.00000002.4124791586.0000000005160000.00000004.08000000.00040000.00000000.sdmp	false	URL Reputation: safe	unknown
https://account.dyn.com/	RegSvcs.exe, 00000001.00000002.4122420156.00000000027D0000.00000004.00000020.00020000.00000000.sdmp, RegSvcs.exe, 00000001.00000002.4124115737.0000000003B21000.00000004.00000800.00020000.00000000.sdmp, RegSvcs.exe, 00000001.00000002.4125198203.0000000005220000.00000004.08000000.00040000.00000000.sdmp, RegSvcs.exe, 00000001.00000002.4124791586.0000000005160000.00000004.08000000.00040000.00000000.sdmp	false	URL Reputation: safe	unknown
http://x1.c.lencr.org/0	RegSvcs.exe, 00000001.00000002.4122661159.0000000002BB9000.00000004.00000800.00020000.00000000.sdmp, RegSvcs.exe, 00000001.00000002.4125419915.00000000054EE000.00000004.00000020.00020000.00000000.sdmp, RegSvcs.exe, 00000001.00000002.4121211017.0000000000CF5000.00000004.00000020.00020000.00000000.sdmp, RegSvcs.exe, 00000001.00000002.4122661159.0000000002C67000.00000004.00000800.00020000.00000000.sdmp, RegSvcs.exe, 00000001.00000002.4121211017.0000000000C69000.00000004.00000020.00020000.00000000.sdmp, RegSvcs.exe, 00000001.00000002.4125419915.0000000005452000.00000004.00000020.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://x1.i.lencr.org/0	RegSvcs.exe, 00000001.00000002.4122661159.0000000002BB9000.00000004.00000800.00020000.00000000.sdmp, RegSvcs.exe, 00000001.00000002.4125419915.00000000054EE000.00000004.00000020.00020000.00000000.sdmp, RegSvcs.exe, 00000001.00000002.4121211017.0000000000CF5000.00000004.00000020.00020000.00000000.sdmp, RegSvcs.exe, 00000001.00000002.4122661159.0000000002C67000.00000004.00000800.00020000.00000000.sdmp, RegSvcs.exe, 00000001.00000002.4121211017.0000000000C69000.00000004.00000020.00020000.00000000.sdmp, RegSvcs.exe, 00000001.00000002.4125419915.0000000005452000.00000004.00000020.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://divanrestoran.com	RegSvcs.exe, 00000001.00000002.4122661159.0000000002BB1000.00000004.00000800.00020000.00000000.sdmp, RegSvcs.exe, 00000001.00000002.4122661159.0000000002C67000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://ip-api.com	RegSvcs.exe, 00000001.00000002.4122661159.0000000002B74000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://r3.o.lencr.org0	RegSvcs.exe, 00000001.00000002.4122661159.0000000002BB9000.00000004.00000800.00020000.00000000.sdmp, RegSvcs.exe, 00000001.00000002.4125419915.0000000005486000.00000004.00000020.00020000.00000000.sdmp, RegSvcs.exe, 00000001.00000002.4126404975.0000000006A8D000.00000004.00000020.00020000.00000000.sdmp, RegSvcs.exe, 00000001.00000002.4122661159.0000000002C67000.00000004.00000800.00020000.00000000.sdmp, RegSvcs.exe, 00000001.00000002.4121211017.0000000000C69000.00000004.00000020.00020000.00000000.sdmp, RegSvcs.exe, 00000001.00000002.4125419915.0000000005452000.00000004.00000020.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://mail.divanrestoran.com	RegSvcs.exe, 00000001.00000002.4122661159.0000000002BB1000.00000004.00000800.00020000.00000000.sdmp, RegSvcs.exe, 00000001.00000002.4122661159.0000000002C67000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://api.ipify.org/t	RegSvcs.exe, 00000001.00000002.4122661159.0000000002B21000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name	RegSvcs.exe, 00000001.00000002.4122661159.0000000002B21000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	ASN	ASN Name	Malicious
208.95.112.1	ip-api.com	United States	53334	TUT-ASUS	true
104.26.13.205	api.ipify.org	United States	13335	CLOUDFLARENETUS	false
185.149.100.122	divanrestoran.com	Turkey	209853	VERIDYENVeridyenBilisimTeknolojileriSanayiveTicaretLi	true

General Information

Joe Sandbox version:	40.0.0 Tourmaline
Analysis ID:	1466952
Start date and time:	2024-07-03 15:41:06 +02:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 9m 7s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	6
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Sample name:	tgBNtoWqIp.exe renamed because original name is a hash value
Original Sample Name:	934284591d9e31d5c4868a6608b88c2dd2124fdd45b0248db35f4741d4634bc7.exe
Detection:	MAL
Classification:	mal100.troj.spyw.evad.winEXE@3/4@3/3
EGA Information:	Successful, ratio: 100%
HCA Information:	Successful, ratio: 99% Number of executed functions: 57 Number of non-executed functions: 271
Cookbook Comments:	Found application associated with file extension: .exe Override analysis time to 240000 for current running targets taking high CPU consumption

Warnings

Exclude process from analysis (whitelisted): MpCmdRun.exe, WMIADAP.exe, SIHClient.exe, conhost.exe
Excluded domains from analysis (whitelisted): ocsp.digicert.com, slscr.update.microsoft.com, ctldl.windowsupdate.com, fe3cr.delivery.mp.microsoft.com
Not all processes where analyzed, report is missing behavior information
Report size exceeded maximum capacity and may have missing disassembly code.
Report size getting too big, too many NtOpenKeyEx calls found.
Report size getting too big, too many NtProtectVirtualMemory calls found.
Report size getting too big, too many NtQueryValueKey calls found.
VT rate limit hit for: tgBNtoWqIp.exe

Simulations

Behavior and APIs

Time	Type	Description
09:41:58	API Interceptor	11858725x Sleep call for process: RegSvcs.exe modified

Joe Sandbox View / Context

IPs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
208.95.112.1	fiDe44VTwh.exe	Get hash	malicious	AgentTesla	Browse	ip-api.com/line/?fields=hosting
	9691e6dc404680cc6648726c8d124a6d4fc637bb6b4a092661308012438623b2_dump.exe	Get hash	malicious	AgentTesla, PureLog Stealer	Browse	ip-api.com/line/?fields=hosting
	BomqT2a55e.exe	Get hash	malicious	AgentTesla	Browse	ip-api.com/line/?fields=hosting
	E48ALuMJ3m.exe	Get hash	malicious	AgentTesla, PureLog Stealer	Browse	ip-api.com/line/?fields=hosting
	H1sut2Xo3r.exe	Get hash	malicious	AgentTesla	Browse	ip-api.com/line/?fields=hosting
	q7r87KTHbc.exe	Get hash	malicious	AgentTesla	Browse	ip-api.com/line/?fields=hosting
	1ppvR5VRT6.exe	Get hash	malicious	GuLoader	Browse	ip-api.com/line/?fields=hosting
	BUBIJ0OwLP.exe	Get hash	malicious	AgentTesla	Browse	ip-api.com/line/?fields=hosting
	7Pqym5wyq5.exe	Get hash	malicious	GuLoader	Browse	ip-api.com/line/?fields=hosting
	_Account Receipt.PDF.exe	Get hash	malicious	AgentTesla	Browse	ip-api.com/line/?fields=hosting
104.26.13.205	242764.exe	Get hash	malicious	Ficker Stealer, Rusty Stealer	Browse	api.ipify.org/?format=wef
	Ransom.exe	Get hash	malicious	Targeted Ransomware, TrojanRansom	Browse	api.ipify.org/
	ld.exe	Get hash	malicious	Targeted Ransomware, TrojanRansom	Browse	api.ipify.org/
	ReturnLegend.exe	Get hash	malicious	Stealit	Browse	api.ipify.org/?format=json
	SecuriteInfo.com.Trojan.DownLoaderNET.960.9931.28151.exe	Get hash	malicious	PureLog Stealer, Targeted Ransomware	Browse	api.ipify.org/
	Sky-Beta-Setup.exe	Get hash	malicious	Stealit	Browse	api.ipify.org/?format=json
	ArenaWarSetup.exe	Get hash	malicious	Stealit	Browse	api.ipify.org/?format=json
	Sky-Beta Setup 1.0.0.exe	Get hash	malicious	Unknown	Browse	api.ipify.org/?format=json
	E4sbo4F6Sz.exe	Get hash	malicious	Unknown	Browse	api.ipify.org/
	E4sbo4F6Sz.exe	Get hash	malicious	Unknown	Browse	api.ipify.org/

Domains

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
ip-api.com	fiDe44VTwh.exe	Get hash	malicious	AgentTesla	Browse	208.95.112.1
	9691e6dc404680cc6648726c8d124a6d4fc637bb6b4a092661308012438623b2_dump.exe	Get hash	malicious	AgentTesla, PureLog Stealer	Browse	208.95.112.1
	BomqT2a55e.exe	Get hash	malicious	AgentTesla	Browse	208.95.112.1
	E48ALuMJ3m.exe	Get hash	malicious	AgentTesla, PureLog Stealer	Browse	208.95.112.1
	H1sut2Xo3r.exe	Get hash	malicious	AgentTesla	Browse	208.95.112.1
	q7r87KTHbc.exe	Get hash	malicious	AgentTesla	Browse	208.95.112.1
	1ppvR5VRT6.exe	Get hash	malicious	GuLoader	Browse	208.95.112.1
	BUBIJ0OwLP.exe	Get hash	malicious	AgentTesla	Browse	208.95.112.1
	7Pqym5wyq5.exe	Get hash	malicious	GuLoader	Browse	208.95.112.1
	_Account Receipt.PDF.exe	Get hash	malicious	AgentTesla	Browse	208.95.112.1
api.ipify.org	19808bS58f.exe	Get hash	malicious	AgentTesla	Browse	172.67.74.152
	SecuriteInfo.com.TrojanLoader.MSIL.DaVinci.Heur.6737.3783.exe	Get hash	malicious	AgentTesla	Browse	104.26.13.205
	9691e6dc404680cc6648726c8d124a6d4fc637bb6b4a092661308012438623b2_dump.exe	Get hash	malicious	AgentTesla, PureLog Stealer	Browse	172.67.74.152
	0VcrCVxnMP.exe	Get hash	malicious	AgentTesla, PureLog Stealer	Browse	172.67.74.152
	E48ALuMJ3m.exe	Get hash	malicious	AgentTesla, PureLog Stealer	Browse	104.26.13.205
	MzjwuZnJF0.exe	Get hash	malicious	GuLoader	Browse	104.26.12.205
	VG0x1LZCFb.exe	Get hash	malicious	AgentTesla	Browse	104.26.13.205
	q7r87KTHbc.exe	Get hash	malicious	AgentTesla	Browse	104.26.13.205
	New Orders 116403.exe	Get hash	malicious	AgentTesla, PureLog Stealer	Browse	172.67.74.152
	TRANEXAMIC ACID & CAMPHANEDIOL SPECIFICATIONS.exe	Get hash	malicious	AgentTesla	Browse	104.26.12.205

ASNs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
CLOUDFLARENETUS	https://hr.economictimes.indiatimes.com/etl.php?url=https://hr.economictimes.indiatimes.com/etl.php?url=//maansaa.com/new/auth//xp8tpwsulfhjn/%2F/YW5keS5ncmVmcmF0aEBrcHMuY29t	Get hash	malicious	HTMLPhisher	Browse	104.17.2.184
	19808bS58f.exe	Get hash	malicious	AgentTesla	Browse	172.67.74.152
	SecuriteInfo.com.TrojanLoader.MSIL.DaVinci.Heur.6737.3783.exe	Get hash	malicious	AgentTesla	Browse	104.26.13.205
	https://url7304.disco-mailer.net/ls/click?upn=u001.DWLeRfOXStcSaUNphm6ZnGquuezyvOF0FIuLMCSCrIQ9t3e8n3fjexKHJjVTV-2BQUFT1dnxR3BcyXaxz-2BblhjX71zswvTIlAGm31luuFhJgeOGXb3dn9Itq74-2Fe-2BlKg-2Bs0-2F4odRns7kSdvfqBhyqSbrYsnPmx4SeDwlRdlhHbM3UucitnipcwJ1gR7h8DzOIUWsvEslHUA8FsNTNWtsq3Q-2FU-2FPeBtGbo-2Fx3kgcXxAZuE-3DPmkq_5KlZmZKASPtIpYbHU6HHQmxS-2FHe3g010GX01BBBmlalJnMdBClXoEYQADKPWInqgHw-2B5921oa-2Fum9DxIHV8wgOarlsOnYJwzp6I2lNDfeCQdFcL55956QetBM0U9iihLLCXzc7MWVFcQDUwnaU8PUgQFrTwK63nQhJu8ngVllYSJR-2BUamfX7Ej8Gpp4vMWsL8t65JTtpjdFVQ36IgP-2B2LxLYSj9SfdmLAt97TCVXHWn7xANKqYpl-2BYx09SetkszDOjJuUV9L9bqZ-2FbmClOsUrPLylG74RJ8zQAREr7-2BUktmlWKoc8C7oqqTOKv340mZnTc-2FztCVjFgPMm1Bz5lR5AptUVEvvSBboXVGluKKoNkkMFkS-2BmNybyD3Aa-2BX8UZ5s	Get hash	malicious	HTMLPhisher	Browse	188.114.96.3
	https://www.evernote.com/shard/s371/sh/f041cc04-2eb8-11e1-1279-c0c24914207a/LWhD3rgdQ5xR5t--iDOJ7P-MUkYVUhgRq62dC8LVzLZOnctWRKJm5hEzqg	Get hash	malicious	HTMLPhisher	Browse	1.1.1.1
	GA4vpVYBVP.exe	Get hash	malicious	DBatLoader, FormBook	Browse	172.67.145.203
	RR1h1iO6W2.exe	Get hash	malicious	FormBook	Browse	188.114.97.3
	9691e6dc404680cc6648726c8d124a6d4fc637bb6b4a092661308012438623b2_dump.exe	Get hash	malicious	AgentTesla, PureLog Stealer	Browse	172.67.74.152
	0VcrCVxnMP.exe	Get hash	malicious	AgentTesla, PureLog Stealer	Browse	172.67.74.152
	E48ALuMJ3m.exe	Get hash	malicious	AgentTesla, PureLog Stealer	Browse	104.26.13.205
VERIDYENVeridyenBilisimTeknolojileriSanayiveTicaretLi	4TH HIRE SOA REMITTANCE_USD280,000.exe	Get hash	malicious	FormBook	Browse	78.142.211.199
	https://url2.mailanyone.net/scanner?m=1s7YGL-000Bzg-3S&d=4%7Cmail%2F90%2F1715854800%2F1s7YGL-000Bzg-3S%7Cin2h%7C57e1b682%7C17902772%7C12174482%7C6645DE857241AA8FBDCD2D87AE8933B9&o=%2Fphtz%3A%2Fotsmkbakntase..inromtac%2F-%2F&s=6JTyJcNMmJZPCxyEKCjyH6d3l9Y	Get hash	malicious	HTMLPhisher	Browse	78.142.209.32
	https://za.zalo.me/v3/verifyv2/pc?token=OcNsmjfpL0XY2F3BtHzNRs4A-hhQ5q5sPXtbk3O&continue=liderlerokulu%E3%80%82com/smc/wzu/dmFsZXJpZS5wZWNyZXNzZUBpbGVkZWZyYW5jZS5mcg==$	Get hash	malicious	Fake Captcha	Browse	45.151.250.130
	https://za.zalo.me/v3/verifyv2/pc?token=OcNsmjfpL0XY2F3BtHzNRs4A-hhQ5q5sPXtbk3O&continue=liderlerokulu%E3%80%82com/smc/wzu/dmFsZXJpZS5wZWNyZXNzZUBpbGVkZWZyYW5jZS5mcg==$	Get hash	malicious	Fake Captcha	Browse	45.151.250.130
	hesaphareketi-01.pdf.exe	Get hash	malicious	AgentTesla	Browse	78.142.208.142
	Hesap hareketleriniz.exe	Get hash	malicious	AgentTesla	Browse	78.142.208.142
	https://api.mixpanel.com/track?data=eyJldmVudCI6ICIkY2FtcGFpZ25fbGlua19jbGljayIsICJwcm9wZXJ0aWVzIjogeyJjYW1wYWlnbl9pZCI6IDYwMTM3OTIsICJkaXN0aW5jdF9pZCI6ICJlNTQ5MGY5ZS05YWIyLTRkZWQtOGFkMi1mODMyNjdlOTNmMzEiLCAibWVzc2FnZV9pZCI6IDEzNTIyMjQsICJ0b2tlbiI6ICJiYTllYzc3MzBhMzJjMTczOTJiYjM1NjM1MGQzYTY4ZSIsICJ0eXBlIjogImVtYWlsIiwgInVybCI6ICJodHRwczovL2IueXNoLmlvLyJ9fQ==&redirect=https://seninotoaksesuar%E3%80%82com/cgi/#499840294Ymx1a2VAb3AtZi5vcmc=??4122633601028961989=Ymx1a2VAb3AtZi5vcmc=/%2e%2e=1125214171&u=276b8dda4ef94158348d5b6b8&id=6b7205781d	Get hash	malicious	HTMLPhisher	Browse	78.142.210.95
	7LHfPeAEbb.exe	Get hash	malicious	FormBook	Browse	78.142.210.35
	PLI2qlm3to.exe	Get hash	malicious	FormBook	Browse	78.142.210.35
	hesaphareketi-01.exe	Get hash	malicious	AgentTesla, PureLog Stealer	Browse	78.142.211.222
TUT-ASUS	fiDe44VTwh.exe	Get hash	malicious	AgentTesla	Browse	208.95.112.1
	9691e6dc404680cc6648726c8d124a6d4fc637bb6b4a092661308012438623b2_dump.exe	Get hash	malicious	AgentTesla, PureLog Stealer	Browse	208.95.112.1
	BomqT2a55e.exe	Get hash	malicious	AgentTesla	Browse	208.95.112.1
	E48ALuMJ3m.exe	Get hash	malicious	AgentTesla, PureLog Stealer	Browse	208.95.112.1
	H1sut2Xo3r.exe	Get hash	malicious	AgentTesla	Browse	208.95.112.1
	q7r87KTHbc.exe	Get hash	malicious	AgentTesla	Browse	208.95.112.1
	1ppvR5VRT6.exe	Get hash	malicious	GuLoader	Browse	208.95.112.1
	BUBIJ0OwLP.exe	Get hash	malicious	AgentTesla	Browse	208.95.112.1
	7Pqym5wyq5.exe	Get hash	malicious	GuLoader	Browse	208.95.112.1
	_Account Receipt.PDF.exe	Get hash	malicious	AgentTesla	Browse	208.95.112.1

JA3 Fingerprints

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
3b5074b1b5d032e5620f69f9f700ff0e	19808bS58f.exe	Get hash	malicious	AgentTesla	Browse	104.26.13.205
	SecuriteInfo.com.TrojanLoader.MSIL.DaVinci.Heur.6737.3783.exe	Get hash	malicious	AgentTesla	Browse	104.26.13.205
	dhl_awb_shipping_doc_03072024224782020031808174CN18030724000000324(991KB).vbs	Get hash	malicious	Unknown	Browse	104.26.13.205
	http://beonlineboo.com	Get hash	malicious	Unknown	Browse	104.26.13.205
	9691e6dc404680cc6648726c8d124a6d4fc637bb6b4a092661308012438623b2_dump.exe	Get hash	malicious	AgentTesla, PureLog Stealer	Browse	104.26.13.205
	0VcrCVxnMP.exe	Get hash	malicious	AgentTesla, PureLog Stealer	Browse	104.26.13.205
	E48ALuMJ3m.exe	Get hash	malicious	AgentTesla, PureLog Stealer	Browse	104.26.13.205
	MzjwuZnJF0.exe	Get hash	malicious	GuLoader	Browse	104.26.13.205
	VG0x1LZCFb.exe	Get hash	malicious	AgentTesla	Browse	104.26.13.205
	1C769A32-2CBF-4738-9013-480E0434BAEF_06182024030338389.exe	Get hash	malicious	ScreenConnect Tool	Browse	104.26.13.205

Process:	C:\Users\user\Desktop\tgBNtoWqIp.exe
File Type:	data
Category:	dropped
Size (bytes):	273408
Entropy (8bit):	7.901527707668303
Encrypted:	false
SSDEEP:	6144:0+q1+sKghUK4KARlIA3K/jRYxzpdJkPiiq5PPAfVp3u:0ZXK+FAR2A3K/sFdJkPivP0p3u
MD5:	D688190635E5DEAA37C8CB29376C382B
SHA1:	C70E95F30798DAC23C420646756B02EC75A8166A
SHA-256:	637C26647510BB7AF7102A8FE14F77E0E41061DE33559AD10CD8CF0CADC8AD01
SHA-512:	8CA3D37640B1DC1026C6609A8BC7259768F9EAACE70108A4C3A31775A81C84A2B609A2DA2325AEAD93B6202B5E73D830C30F4D438B86CF1B05B7052FF1C6E6AD
Malicious:	false
Reputation:	low
Preview:	...W;K62@GP5..IT.KLIAZCW.W8K62DGP5PKITVKLIAZCWXW8K62DGP5PKIT.KLIOE.YX.1...E....# 'v;>&&(":x4Y%X]0g2Pp9<:v""i...w58\..?IMt5PKITVK$Y.wo&.).:.Lh6.Kbh6i:.7J..)s&.5.C.9.D.5{w85P8.$qt1).:.Lvd+K}:.."/!m+.)XW8K62DGP5PKITVK.<.<CWXWh.62.FT5$.I.VKLIAZCW.W.J=3MGP.QKI.TKLIAZl.XW8[62D.Q5PK.TV[LIAXCW]W8K62DGU5PKITVKL9EZCSXW.p42FGP.PKYTV[LIAZSWXG8K62DG@5PKITVKLIAZ.BZWhK62D'R5@@KTVKLIAZCWXW8K62DGP5PKITVK..@Z_WXW8K62DGP5PKITVKLIAZCWXW8K.?FG.5PKITVKLIAZC.YW.J62DGP5PKITVKLIAZCWXW8K62DG~A53=TVKT.@ZCGXW8.72DCP5PKITVKLIAZCWxW8+.@ &$TPK.9VKL.@ZC9XW8.72DGP5PKITVKLI.ZC.v3Y?W2DG..PKItTKL_AZC]ZW8K62DGP5PKIT.KL.o(0%;W8K&9FGPURKIXTKLiCZCWXW8K62DGP5.KI.VKLIAZCWXW8K62DGP5PKITVKLIAZCWXW8K62DGP5PKITVKLIAZCWXW8K62DGP5PKITVKLIAZCWXW8K62DGP5PKITVKLIAZCWXW8K62DGP5PKITVKLIAZCWXW8K62DGP5PKITVKLIAZCWXW8K62DGP5PKITVKLIAZCWXW8K62DGP5PKITVKLIAZCWXW8K62DGP5PKITVKLIAZCWXW8K62DGP5PKITVKLIAZCWXW8K62DGP5PKITVKLIAZCWXW8K62DGP5PKITVKLIAZCWXW8K62DGP5PKITVKLIAZCWXW8K62DGP5PKITVKLIAZCWXW8K62DGP5PKITVKLIAZCWXW8K62DGP5PKITVKLIAZCWXW8K62DG

C:\Users\user\AppData\Local\Temp\aut8E7A.tmp

Download File

Process:	C:\Users\user\Desktop\tgBNtoWqIp.exe
File Type:	data
Category:	dropped
Size (bytes):	9844
Entropy (8bit):	7.6053992767011875
Encrypted:	false
SSDEEP:	192:6ZxWQa8nm1Wh8fpWAsdzNasmdge/rEfVThv5Umwg1BDOa+x7kCzUMbZJ:6Zx3a8nmYhzd0smr/rEfZhvumwg+Bh1r
MD5:	CEF6A7A2654179845017200F232F7430
SHA1:	07EBC32F891D320BA67684473E6B6040DD475BC2
SHA-256:	3479F0CFA3E6430F2B5396614DC07EB9C9E54F5F15E6A670FE695BF33FC975EE
SHA-512:	7103ED6528598D3BDF42271DFE5097F8386F1C4587937705FDF0AD01830A1B6D2B2806EDAB727C84A0B1333A0556961CFDA0E2D7D4CB6C41D67E51D61DC43A75
Malicious:	false
Reputation:	low
Preview:	EA06..pT..h.I..D.P..)..q1..htZ..g6.M.SY..mD.Mf.y..e2..&3y..9.M.....9..4i...4...9..8.P.T:4.1.L/.Y...e..&6[...0.L..I..k7.N&. ..a0.M.....q4.Nf.P.....K..d.%...p.lY@.......c.Xf.0.o..b.L.`...,S....f.I...a..-vk5.........6.l,`........fs;....`....g.I......l..]..f.`...9\|....p.1..... ..$h.c.....#@...H,....`..k0.H.f. ...<zk5....!9.B...3p.n.f.I..q7.t.,. ....4....`....8.........c....P....0.... ..Y@....../Z..-zs5...jq7...zl........V....#.p..N&...M.^.9.....7.:..w.......7...}3p#..oc...f.P./....J.v.5..@{...........a..f.....`.Y..`...&.......x...u\| .....Y,@=.%.d....&.)...,S`./..8....@..%....Y@..;...#.Y,s ./.k5...4.;...K.4\|.;..g.c....c..&.i....x.&.k...c.Y'3Y...@}.4..3.....33...se.M'.@C`..s....e.,..h........Y.......Y.$.p.Y...f.e...8.....2...@.;1.X.`..L' ..........@.37.Ll.K.......9d..,vd.....i2........#. ....3a..g.`j.....Bvf.....@R.r"p.h.s.....,vf......t.L@...40.....f....N&3....4..@.6.-..p..S.-..2...S0.N.@.;5.`..9.M,`...k8.....c.P..Yf3.wx.....vl......@.E....N.y6....p.c3.%..4..b

C:\Users\user\AppData\Local\Temp\hepatoduodenostomy

Download File

Process:	C:\Users\user\Desktop\tgBNtoWqIp.exe
File Type:	ASCII text, with very long lines (28756), with no line terminators
Category:	dropped
Size (bytes):	28756
Entropy (8bit):	3.5911478877536767
Encrypted:	false
SSDEEP:	768:AiTZ+2QoioGRk6ZklputwjpjBkCiw2RuJ3nXKUrvzjsNbA+IL26cz24vfF3if6gg:AiTZ+2QoioGRk6ZklputwjpjBkCiw2Rl
MD5:	95461AB4ADEC596EB5CC95C71A808E83
SHA1:	2CAFADFC9E81E7644BCEBC8F11D2CA6DA6D30805
SHA-256:	AF7593795ABAF3B59194051C9825FBBFF1CBE9BB4BBA0C41D793594CE3303A94
SHA-512:	F54F11B1883D6642A6DF081615C3B5681DD017D280FCB1CB597CE9C08AA31947E6E4A6CEBF451D87FEA97805660C229A8F21573AE64FA7DC3425908099F71857
Malicious:	false
Reputation:	low
Preview:	A9E499CD8C02898115CEA73647257D6D456782227821727D946E9B8E916AF2AC47BE395D80BBCF6E100x558bec81eccc0200005657b86b00000066894584b96500000066894d86ba7200000066895588b86e0000006689458ab96500000066894d8cba6c0000006689558eb83300000066894590b93200000066894d92ba2e00000066895594b86400000066894596b96c00000066894d98ba6c0000006689559a33c06689459cb96e00000066898d44ffffffba7400000066899546ffffffb86400000066898548ffffffb96c00000066898d4affffffba6c0000006689954cffffffb82e0000006689854effffffb96400000066898d50ffffffba6c00000066899552ffffffb86c00000066898554ffffff33c966898d56ffffffba75000000668955d0b873000000668945d2b96500000066894dd4ba72000000668955d6b833000000668945d8b93200000066894ddaba2e000000668955dcb864000000668945deb96c00000066894de0ba6c000000668955e233c0668945e4b96100000066898d68ffffffba640000006689956affffffb8760000006689856cffffffb96100000066898d6effffffba7000000066899570ffffffb86900000066898572ffffffb93300000066898d74ffffffba3200000066899576ffffffb82e00000066898578ffffffb96400000066898d7affffff

C:\Users\user\AppData\Local\Temp\totten

Download File

Process:	C:\Users\user\Desktop\tgBNtoWqIp.exe
File Type:	data
Category:	dropped
Size (bytes):	273408
Entropy (8bit):	7.901527707668303
Encrypted:	false
SSDEEP:	6144:0+q1+sKghUK4KARlIA3K/jRYxzpdJkPiiq5PPAfVp3u:0ZXK+FAR2A3K/sFdJkPivP0p3u
MD5:	D688190635E5DEAA37C8CB29376C382B
SHA1:	C70E95F30798DAC23C420646756B02EC75A8166A
SHA-256:	637C26647510BB7AF7102A8FE14F77E0E41061DE33559AD10CD8CF0CADC8AD01
SHA-512:	8CA3D37640B1DC1026C6609A8BC7259768F9EAACE70108A4C3A31775A81C84A2B609A2DA2325AEAD93B6202B5E73D830C30F4D438B86CF1B05B7052FF1C6E6AD
Malicious:	false
Reputation:	low
Preview:	...W;K62@GP5..IT.KLIAZCW.W8K62DGP5PKITVKLIAZCWXW8K62DGP5PKIT.KLIOE.YX.1...E....# 'v;>&&(":x4Y%X]0g2Pp9<:v""i...w58\..?IMt5PKITVK$Y.wo&.).:.Lh6.Kbh6i:.7J..)s&.5.C.9.D.5{w85P8.$qt1).:.Lvd+K}:.."/!m+.)XW8K62DGP5PKITVK.<.<CWXWh.62.FT5$.I.VKLIAZCW.W.J=3MGP.QKI.TKLIAZl.XW8[62D.Q5PK.TV[LIAXCW]W8K62DGU5PKITVKL9EZCSXW.p42FGP.PKYTV[LIAZSWXG8K62DG@5PKITVKLIAZ.BZWhK62D'R5@@KTVKLIAZCWXW8K62DGP5PKITVK..@Z_WXW8K62DGP5PKITVKLIAZCWXW8K.?FG.5PKITVKLIAZC.YW.J62DGP5PKITVKLIAZCWXW8K62DG~A53=TVKT.@ZCGXW8.72DCP5PKITVKLIAZCWxW8+.@ &$TPK.9VKL.@ZC9XW8.72DGP5PKITVKLI.ZC.v3Y?W2DG..PKItTKL_AZC]ZW8K62DGP5PKIT.KL.o(0%;W8K&9FGPURKIXTKLiCZCWXW8K62DGP5.KI.VKLIAZCWXW8K62DGP5PKITVKLIAZCWXW8K62DGP5PKITVKLIAZCWXW8K62DGP5PKITVKLIAZCWXW8K62DGP5PKITVKLIAZCWXW8K62DGP5PKITVKLIAZCWXW8K62DGP5PKITVKLIAZCWXW8K62DGP5PKITVKLIAZCWXW8K62DGP5PKITVKLIAZCWXW8K62DGP5PKITVKLIAZCWXW8K62DGP5PKITVKLIAZCWXW8K62DGP5PKITVKLIAZCWXW8K62DGP5PKITVKLIAZCWXW8K62DGP5PKITVKLIAZCWXW8K62DGP5PKITVKLIAZCWXW8K62DGP5PKITVKLIAZCWXW8K62DGP5PKITVKLIAZCWXW8K62DG

Static File Info

General

File type:	PE32 executable (GUI) Intel 80386, for MS Windows
Entropy (8bit):	7.193285747534876
TrID:	Win32 Executable (generic) a (10002005/4) 99.96% Generic Win/DOS Executable (2004/3) 0.02% DOS Executable Generic (2002/1) 0.02% Autodesk FLIC Image File (extensions: flc, fli, cel) (7/3) 0.00%
File name:	tgBNtoWqIp.exe
File size:	1'237'504 bytes
MD5:	f78535a3f5e84f626e1018e587b5b588
SHA1:	8200afc4d351323230fcc4b0a76b529b5d052134
SHA256:	934284591d9e31d5c4868a6608b88c2dd2124fdd45b0248db35f4741d4634bc7
SHA512:	7538b16da90041b285721ec6d626ffa8ed7fd83c39d8f03fca6657cc7474ca1cffff48b92f48871a409d9fdf48620d09e455de4f0914a4883d2435521767a455
SSDEEP:	24576:+AHnh+eWsN3skA4RV1Hom2KXMmHaHFUc7+2b1Vck0VwCRla4CTwUUF5:ph+ZkldoPK8YaHFU2pbBgwilarM
TLSH:	0545BE0273D2C036FFAB92739B6AF64156BD7D254123852F13981DB9BC701B2227E663
File Content Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........s..R...R...R....C..P.....;.S..._@#.a..._@......_@..g...[j..[...[jo.w...R...r.............#.S..._@'.S...R.k.S.....".S...RichR..

File Icon


Icon Hash:	aaf3e3e3938382a0

Static PE Info

General

Entrypoint:	0x42800a
Entrypoint Section:	.text
Digitally signed:	false
Imagebase:	0x400000
Subsystem:	windows gui
Image File Characteristics:	EXECUTABLE_IMAGE, LARGE_ADDRESS_AWARE, 32BIT_MACHINE
DLL Characteristics:	DYNAMIC_BASE, TERMINAL_SERVER_AWARE
Time Stamp:	0x6678B03B [Sun Jun 23 23:31:07 2024 UTC]
TLS Callbacks:
CLR (.Net) Version:
OS Version Major:	5
OS Version Minor:	1
File Version Major:	5
File Version Minor:	1
Subsystem Version Major:	5
Subsystem Version Minor:	1
Import Hash:	afcdf79be1557326c854b6e20cb900a7

Entrypoint Preview

Instruction
call 00007FBDAD0CC2BDh
jmp 00007FBDAD0BF074h
int3
int3
int3
int3
int3
int3
int3
int3
int3
int3
int3
int3
push edi
push esi
mov esi, dword ptr [esp+10h]
mov ecx, dword ptr [esp+14h]
mov edi, dword ptr [esp+0Ch]
mov eax, ecx
mov edx, ecx
add eax, esi
cmp edi, esi
jbe 00007FBDAD0BF1FAh
cmp edi, eax
jc 00007FBDAD0BF55Eh
bt dword ptr [004C41FCh], 01h
jnc 00007FBDAD0BF1F9h
rep movsb
jmp 00007FBDAD0BF50Ch
cmp ecx, 00000080h
jc 00007FBDAD0BF3C4h
mov eax, edi
xor eax, esi
test eax, 0000000Fh
jne 00007FBDAD0BF200h
bt dword ptr [004BF324h], 01h
jc 00007FBDAD0BF6D0h
bt dword ptr [004C41FCh], 00000000h
jnc 00007FBDAD0BF39Dh
test edi, 00000003h
jne 00007FBDAD0BF3AEh
test esi, 00000003h
jne 00007FBDAD0BF38Dh
bt edi, 02h
jnc 00007FBDAD0BF1FFh
mov eax, dword ptr [esi]
sub ecx, 04h
lea esi, dword ptr [esi+04h]
mov dword ptr [edi], eax
lea edi, dword ptr [edi+04h]
bt edi, 03h
jnc 00007FBDAD0BF203h
movq xmm1, qword ptr [esi]
sub ecx, 08h
lea esi, dword ptr [esi+08h]
movq qword ptr [edi], xmm1
lea edi, dword ptr [edi+08h]
test esi, 00000007h
je 00007FBDAD0BF255h
bt esi, 03h

Rich Headers

Programming Language:

[ASM] VS2013 build 21005
[ C ] VS2013 build 21005
[C++] VS2013 build 21005
[ C ] VS2008 SP1 build 30729
[IMP] VS2008 SP1 build 30729
[ASM] VS2013 UPD5 build 40629
[RES] VS2013 build 21005
[LNK] VS2013 UPD5 build 40629

Data Directories

Name	Virtual Address	Virtual Size	Is in Section
IMAGE_DIRECTORY_ENTRY_EXPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IMPORT	0xbc0cc	0x17c	.rdata
IMAGE_DIRECTORY_ENTRY_RESOURCE	0xc8000	0x63a14	.rsrc
IMAGE_DIRECTORY_ENTRY_EXCEPTION	0x0	0x0
IMAGE_DIRECTORY_ENTRY_SECURITY	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BASERELOC	0x12c000	0x7134	.reloc
IMAGE_DIRECTORY_ENTRY_DEBUG	0x92bc0	0x1c	.rdata
IMAGE_DIRECTORY_ENTRY_COPYRIGHT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_GLOBALPTR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_TLS	0x0	0x0
IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG	0xa4b50	0x40	.rdata
IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IAT	0x8f000	0x884	.rdata
IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_RESERVED	0x0	0x0

Sections

Name	Virtual Address	Virtual Size	Raw Size	MD5	Xored PE	ZLIB Complexity	File Type	Entropy	Characteristics
.text	0x1000	0x8dfdd	0x8e000	310e36668512d53489c005622bb1b4a9	False	0.5735602580325704	data	6.675248351711057	IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
.rdata	0x8f000	0x2fd8e	0x2fe00	748cf1ab2605ce1fd72d53d912abb68f	False	0.32828818537859006	data	5.763244005758284	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.data	0xbf000	0x8f74	0x5200	aae9601d920f07080bdfadf43dfeff12	False	0.1017530487804878	data	1.1963819235530628	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.rsrc	0xc8000	0x63a14	0x63c00	846900e3ca7eb883cd78067f0a114c56	False	0.9333171796679198	data	7.907899821641048	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.reloc	0x12c000	0x7134	0x7200	f04128ad0f87f42830e4a6cdbc38c719	False	0.7617530153508771	data	6.783955557128661	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_READ

Resources

Name	RVA	Size	Type	Language	Country	ZLIB Complexity
RT_ICON	0xc85a8	0x128	Device independent bitmap graphic, 16 x 32 x 4, image size 192	English	Great Britain	0.7466216216216216
RT_ICON	0xc86d0	0x128	Device independent bitmap graphic, 16 x 32 x 4, image size 128, 16 important colors	English	Great Britain	0.3277027027027027
RT_ICON	0xc87f8	0x128	Device independent bitmap graphic, 16 x 32 x 4, image size 192	English	Great Britain	0.3885135135135135
RT_ICON	0xc8920	0x2e8	Device independent bitmap graphic, 32 x 64 x 4, image size 0	English	Great Britain	0.3333333333333333
RT_ICON	0xc8c08	0x128	Device independent bitmap graphic, 16 x 32 x 4, image size 0	English	Great Britain	0.5
RT_ICON	0xc8d30	0xea8	Device independent bitmap graphic, 48 x 96 x 8, image size 0	English	Great Britain	0.2835820895522388
RT_ICON	0xc9bd8	0x8a8	Device independent bitmap graphic, 32 x 64 x 8, image size 0	English	Great Britain	0.37906137184115524
RT_ICON	0xca480	0x568	Device independent bitmap graphic, 16 x 32 x 8, image size 0	English	Great Britain	0.23699421965317918
RT_ICON	0xca9e8	0x25a8	Device independent bitmap graphic, 48 x 96 x 32, image size 0	English	Great Britain	0.13858921161825727
RT_ICON	0xccf90	0x10a8	Device independent bitmap graphic, 32 x 64 x 32, image size 0	English	Great Britain	0.25070356472795496
RT_ICON	0xce038	0x468	Device independent bitmap graphic, 16 x 32 x 32, image size 0	English	Great Britain	0.3173758865248227
RT_MENU	0xce4a0	0x50	data	English	Great Britain	0.9
RT_STRING	0xce4f0	0x594	data	English	Great Britain	0.3333333333333333
RT_STRING	0xcea84	0x68a	data	English	Great Britain	0.2747909199522103
RT_STRING	0xcf110	0x490	data	English	Great Britain	0.3715753424657534
RT_STRING	0xcf5a0	0x5fc	data	English	Great Britain	0.3087467362924282
RT_STRING	0xcfb9c	0x65c	data	English	Great Britain	0.34336609336609336
RT_STRING	0xd01f8	0x466	data	English	Great Britain	0.3605683836589698
RT_STRING	0xd0660	0x158	Matlab v4 mat-file (little endian) n, numeric, rows 0, columns 0	English	Great Britain	0.502906976744186
RT_RCDATA	0xd07b8	0x5acdc	data			1.0003253282858158
RT_GROUP_ICON	0x12b494	0x76	data	English	Great Britain	0.6610169491525424
RT_GROUP_ICON	0x12b50c	0x14	data	English	Great Britain	1.25
RT_GROUP_ICON	0x12b520	0x14	data	English	Great Britain	1.15
RT_GROUP_ICON	0x12b534	0x14	data	English	Great Britain	1.25
RT_VERSION	0x12b548	0xdc	data	English	Great Britain	0.6181818181818182
RT_MANIFEST	0x12b624	0x3ef	ASCII text, with CRLF line terminators	English	Great Britain	0.5074478649453823

Imports

DLL	Import
WSOCK32.dll	WSACleanup, socket, inet_ntoa, setsockopt, ntohs, recvfrom, ioctlsocket, htons, WSAStartup, __WSAFDIsSet, select, accept, listen, bind, closesocket, WSAGetLastError, recv, sendto, send, inet_addr, gethostbyname, gethostname, connect
VERSION.dll	GetFileVersionInfoW, GetFileVersionInfoSizeW, VerQueryValueW
WINMM.dll	timeGetTime, waveOutSetVolume, mciSendStringW
COMCTL32.dll	ImageList_ReplaceIcon, ImageList_Destroy, ImageList_Remove, ImageList_SetDragCursorImage, ImageList_BeginDrag, ImageList_DragEnter, ImageList_DragLeave, ImageList_EndDrag, ImageList_DragMove, InitCommonControlsEx, ImageList_Create
MPR.dll	WNetUseConnectionW, WNetCancelConnection2W, WNetGetConnectionW, WNetAddConnection2W
WININET.dll	InternetQueryDataAvailable, InternetCloseHandle, InternetOpenW, InternetSetOptionW, InternetCrackUrlW, HttpQueryInfoW, InternetQueryOptionW, HttpOpenRequestW, HttpSendRequestW, FtpOpenFileW, FtpGetFileSize, InternetOpenUrlW, InternetReadFile, InternetConnectW
PSAPI.DLL	GetProcessMemoryInfo
IPHLPAPI.DLL	IcmpCreateFile, IcmpCloseHandle, IcmpSendEcho
USERENV.dll	DestroyEnvironmentBlock, UnloadUserProfile, CreateEnvironmentBlock, LoadUserProfileW
UxTheme.dll	IsThemeActive
KERNEL32.dll	DuplicateHandle, CreateThread, WaitForSingleObject, HeapAlloc, GetProcessHeap, HeapFree, Sleep, GetCurrentThreadId, MultiByteToWideChar, MulDiv, GetVersionExW, IsWow64Process, GetSystemInfo, FreeLibrary, LoadLibraryA, GetProcAddress, SetErrorMode, GetModuleFileNameW, WideCharToMultiByte, lstrcpyW, lstrlenW, GetModuleHandleW, QueryPerformanceCounter, VirtualFreeEx, OpenProcess, VirtualAllocEx, WriteProcessMemory, ReadProcessMemory, CreateFileW, SetFilePointerEx, SetEndOfFile, ReadFile, WriteFile, FlushFileBuffers, TerminateProcess, CreateToolhelp32Snapshot, Process32FirstW, Process32NextW, SetFileTime, GetFileAttributesW, FindFirstFileW, SetCurrentDirectoryW, GetLongPathNameW, GetShortPathNameW, DeleteFileW, FindNextFileW, CopyFileExW, MoveFileW, CreateDirectoryW, RemoveDirectoryW, SetSystemPowerState, QueryPerformanceFrequency, FindResourceW, LoadResource, LockResource, SizeofResource, EnumResourceNamesW, OutputDebugStringW, GetTempPathW, GetTempFileNameW, DeviceIoControl, GetLocalTime, CompareStringW, GetCurrentProcess, EnterCriticalSection, LeaveCriticalSection, GetStdHandle, CreatePipe, InterlockedExchange, TerminateThread, LoadLibraryExW, FindResourceExW, CopyFileW, VirtualFree, FormatMessageW, GetExitCodeProcess, GetPrivateProfileStringW, WritePrivateProfileStringW, GetPrivateProfileSectionW, WritePrivateProfileSectionW, GetPrivateProfileSectionNamesW, FileTimeToLocalFileTime, FileTimeToSystemTime, SystemTimeToFileTime, LocalFileTimeToFileTime, GetDriveTypeW, GetDiskFreeSpaceExW, GetDiskFreeSpaceW, GetVolumeInformationW, SetVolumeLabelW, CreateHardLinkW, SetFileAttributesW, CreateEventW, SetEvent, GetEnvironmentVariableW, SetEnvironmentVariableW, GlobalLock, GlobalUnlock, GlobalAlloc, GetFileSize, GlobalFree, GlobalMemoryStatusEx, Beep, GetSystemDirectoryW, HeapReAlloc, HeapSize, GetComputerNameW, GetWindowsDirectoryW, GetCurrentProcessId, GetProcessIoCounters, CreateProcessW, GetProcessId, SetPriorityClass, LoadLibraryW, VirtualAlloc, IsDebuggerPresent, GetCurrentDirectoryW, lstrcmpiW, DecodePointer, GetLastError, RaiseException, InitializeCriticalSectionAndSpinCount, DeleteCriticalSection, InterlockedDecrement, InterlockedIncrement, GetCurrentThread, CloseHandle, GetFullPathNameW, EncodePointer, ExitProcess, GetModuleHandleExW, ExitThread, GetSystemTimeAsFileTime, ResumeThread, GetCommandLineW, IsProcessorFeaturePresent, IsValidCodePage, GetACP, GetOEMCP, GetCPInfo, SetLastError, UnhandledExceptionFilter, SetUnhandledExceptionFilter, TlsAlloc, TlsGetValue, TlsSetValue, TlsFree, GetStartupInfoW, GetStringTypeW, SetStdHandle, GetFileType, GetConsoleCP, GetConsoleMode, RtlUnwind, ReadConsoleW, GetTimeZoneInformation, GetDateFormatW, GetTimeFormatW, LCMapStringW, GetEnvironmentStringsW, FreeEnvironmentStringsW, WriteConsoleW, FindClose, SetEnvironmentVariableA
USER32.dll	AdjustWindowRectEx, CopyImage, SetWindowPos, GetCursorInfo, RegisterHotKey, ClientToScreen, GetKeyboardLayoutNameW, IsCharAlphaW, IsCharAlphaNumericW, IsCharLowerW, IsCharUpperW, GetMenuStringW, GetSubMenu, GetCaretPos, IsZoomed, MonitorFromPoint, GetMonitorInfoW, SetWindowLongW, SetLayeredWindowAttributes, FlashWindow, GetClassLongW, TranslateAcceleratorW, IsDialogMessageW, GetSysColor, InflateRect, DrawFocusRect, DrawTextW, FrameRect, DrawFrameControl, FillRect, PtInRect, DestroyAcceleratorTable, CreateAcceleratorTableW, SetCursor, GetWindowDC, GetSystemMetrics, GetActiveWindow, CharNextW, wsprintfW, RedrawWindow, DrawMenuBar, DestroyMenu, SetMenu, GetWindowTextLengthW, CreateMenu, IsDlgButtonChecked, DefDlgProcW, CallWindowProcW, ReleaseCapture, SetCapture, CreateIconFromResourceEx, mouse_event, ExitWindowsEx, SetActiveWindow, FindWindowExW, EnumThreadWindows, SetMenuDefaultItem, InsertMenuItemW, IsMenu, TrackPopupMenuEx, GetCursorPos, DeleteMenu, SetRect, GetMenuItemID, GetMenuItemCount, SetMenuItemInfoW, GetMenuItemInfoW, SetForegroundWindow, IsIconic, FindWindowW, MonitorFromRect, keybd_event, SendInput, GetAsyncKeyState, SetKeyboardState, GetKeyboardState, GetKeyState, VkKeyScanW, LoadStringW, DialogBoxParamW, MessageBeep, EndDialog, SendDlgItemMessageW, GetDlgItem, SetWindowTextW, CopyRect, ReleaseDC, GetDC, EndPaint, BeginPaint, GetClientRect, GetMenu, DestroyWindow, EnumWindows, GetDesktopWindow, IsWindow, IsWindowEnabled, IsWindowVisible, EnableWindow, InvalidateRect, GetWindowLongW, GetWindowThreadProcessId, AttachThreadInput, GetFocus, GetWindowTextW, ScreenToClient, SendMessageTimeoutW, EnumChildWindows, CharUpperBuffW, GetParent, GetDlgCtrlID, SendMessageW, MapVirtualKeyW, PostMessageW, GetWindowRect, SetUserObjectSecurity, CloseDesktop, CloseWindowStation, OpenDesktopW, SetProcessWindowStation, GetProcessWindowStation, OpenWindowStationW, GetUserObjectSecurity, MessageBoxW, DefWindowProcW, SetClipboardData, EmptyClipboard, CountClipboardFormats, CloseClipboard, GetClipboardData, IsClipboardFormatAvailable, OpenClipboard, BlockInput, GetMessageW, LockWindowUpdate, DispatchMessageW, TranslateMessage, PeekMessageW, UnregisterHotKey, CheckMenuRadioItem, CharLowerBuffW, MoveWindow, SetFocus, PostQuitMessage, KillTimer, CreatePopupMenu, RegisterWindowMessageW, SetTimer, ShowWindow, CreateWindowExW, RegisterClassExW, LoadIconW, LoadCursorW, GetSysColorBrush, GetForegroundWindow, MessageBoxA, DestroyIcon, SystemParametersInfoW, LoadImageW, GetClassNameW
GDI32.dll	StrokePath, DeleteObject, GetTextExtentPoint32W, ExtCreatePen, GetDeviceCaps, EndPath, SetPixel, CloseFigure, CreateCompatibleBitmap, CreateCompatibleDC, SelectObject, StretchBlt, GetDIBits, LineTo, AngleArc, MoveToEx, Ellipse, DeleteDC, GetPixel, CreateDCW, GetStockObject, GetTextFaceW, CreateFontW, SetTextColor, PolyDraw, BeginPath, Rectangle, SetViewportOrgEx, GetObjectW, SetBkMode, RoundRect, SetBkColor, CreatePen, CreateSolidBrush, StrokeAndFillPath
COMDLG32.dll	GetOpenFileNameW, GetSaveFileNameW
ADVAPI32.dll	GetAce, RegEnumValueW, RegDeleteValueW, RegDeleteKeyW, RegEnumKeyExW, RegSetValueExW, RegOpenKeyExW, RegCloseKey, RegQueryValueExW, RegConnectRegistryW, InitializeSecurityDescriptor, InitializeAcl, AdjustTokenPrivileges, OpenThreadToken, OpenProcessToken, LookupPrivilegeValueW, DuplicateTokenEx, CreateProcessAsUserW, CreateProcessWithLogonW, GetLengthSid, CopySid, LogonUserW, AllocateAndInitializeSid, CheckTokenMembership, RegCreateKeyExW, FreeSid, GetTokenInformation, GetSecurityDescriptorDacl, GetAclInformation, AddAce, SetSecurityDescriptorDacl, GetUserNameW, InitiateSystemShutdownExW
SHELL32.dll	DragQueryPoint, ShellExecuteExW, DragQueryFileW, SHEmptyRecycleBinW, SHGetPathFromIDListW, SHBrowseForFolderW, SHCreateShellItem, SHGetDesktopFolder, SHGetSpecialFolderLocation, SHGetFolderPathW, SHFileOperationW, ExtractIconExW, Shell_NotifyIconW, ShellExecuteW, DragFinish
ole32.dll	CoTaskMemAlloc, CoTaskMemFree, CLSIDFromString, ProgIDFromCLSID, CLSIDFromProgID, OleSetMenuDescriptor, MkParseDisplayName, OleSetContainedObject, CoCreateInstance, IIDFromString, StringFromGUID2, CreateStreamOnHGlobal, OleInitialize, OleUninitialize, CoInitialize, CoUninitialize, GetRunningObjectTable, CoGetInstanceFromFile, CoGetObject, CoSetProxyBlanket, CoCreateInstanceEx, CoInitializeSecurity
OLEAUT32.dll	LoadTypeLibEx, VariantCopyInd, SysReAllocString, SysFreeString, SafeArrayDestroyDescriptor, SafeArrayDestroyData, SafeArrayUnaccessData, SafeArrayAccessData, SafeArrayAllocData, SafeArrayAllocDescriptorEx, SafeArrayCreateVector, RegisterTypeLib, CreateStdDispatch, DispCallFunc, VariantChangeType, SysStringLen, VariantTimeToSystemTime, VarR8FromDec, SafeArrayGetVartype, VariantCopy, VariantClear, OleLoadPicture, QueryPathOfRegTypeLib, RegisterTypeLibForUser, UnRegisterTypeLibForUser, UnRegisterTypeLib, CreateDispTypeInfo, SysAllocString, VariantInit

Possible Origin

Language of compilation system	Country where language is spoken	Map
English	Great Britain

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Jul 3, 2024 15:41:57.903577089 CEST	49730	443	192.168.2.4	104.26.13.205
Jul 3, 2024 15:41:57.903624058 CEST	443	49730	104.26.13.205	192.168.2.4
Jul 3, 2024 15:41:57.903740883 CEST	49730	443	192.168.2.4	104.26.13.205
Jul 3, 2024 15:41:57.944159985 CEST	49730	443	192.168.2.4	104.26.13.205
Jul 3, 2024 15:41:57.944188118 CEST	443	49730	104.26.13.205	192.168.2.4
Jul 3, 2024 15:41:58.418356895 CEST	443	49730	104.26.13.205	192.168.2.4
Jul 3, 2024 15:41:58.418468952 CEST	49730	443	192.168.2.4	104.26.13.205
Jul 3, 2024 15:41:58.422472000 CEST	49730	443	192.168.2.4	104.26.13.205
Jul 3, 2024 15:41:58.422487020 CEST	443	49730	104.26.13.205	192.168.2.4
Jul 3, 2024 15:41:58.422780991 CEST	443	49730	104.26.13.205	192.168.2.4
Jul 3, 2024 15:41:58.472636938 CEST	49730	443	192.168.2.4	104.26.13.205
Jul 3, 2024 15:41:58.475774050 CEST	49730	443	192.168.2.4	104.26.13.205
Jul 3, 2024 15:41:58.516501904 CEST	443	49730	104.26.13.205	192.168.2.4
Jul 3, 2024 15:41:58.582717896 CEST	443	49730	104.26.13.205	192.168.2.4
Jul 3, 2024 15:41:58.582784891 CEST	443	49730	104.26.13.205	192.168.2.4
Jul 3, 2024 15:41:58.582828045 CEST	49730	443	192.168.2.4	104.26.13.205
Jul 3, 2024 15:41:58.592498064 CEST	49730	443	192.168.2.4	104.26.13.205
Jul 3, 2024 15:41:58.606018066 CEST	49731	80	192.168.2.4	208.95.112.1
Jul 3, 2024 15:41:58.611259937 CEST	80	49731	208.95.112.1	192.168.2.4
Jul 3, 2024 15:41:58.611377954 CEST	49731	80	192.168.2.4	208.95.112.1
Jul 3, 2024 15:41:58.611532927 CEST	49731	80	192.168.2.4	208.95.112.1
Jul 3, 2024 15:41:58.616312981 CEST	80	49731	208.95.112.1	192.168.2.4
Jul 3, 2024 15:41:59.084893942 CEST	80	49731	208.95.112.1	192.168.2.4
Jul 3, 2024 15:41:59.128928900 CEST	49731	80	192.168.2.4	208.95.112.1
Jul 3, 2024 15:41:59.624568939 CEST	49731	80	192.168.2.4	208.95.112.1
Jul 3, 2024 15:41:59.635926962 CEST	80	49731	208.95.112.1	192.168.2.4
Jul 3, 2024 15:41:59.636042118 CEST	49731	80	192.168.2.4	208.95.112.1
Jul 3, 2024 15:41:59.708853960 CEST	49732	587	192.168.2.4	185.149.100.122
Jul 3, 2024 15:41:59.722313881 CEST	587	49732	185.149.100.122	192.168.2.4
Jul 3, 2024 15:41:59.722387075 CEST	49732	587	192.168.2.4	185.149.100.122
Jul 3, 2024 15:42:01.026453018 CEST	587	49732	185.149.100.122	192.168.2.4
Jul 3, 2024 15:42:01.026885033 CEST	49732	587	192.168.2.4	185.149.100.122
Jul 3, 2024 15:42:01.031685114 CEST	587	49732	185.149.100.122	192.168.2.4
Jul 3, 2024 15:42:01.316344023 CEST	587	49732	185.149.100.122	192.168.2.4
Jul 3, 2024 15:42:01.316904068 CEST	49732	587	192.168.2.4	185.149.100.122
Jul 3, 2024 15:42:01.322115898 CEST	587	49732	185.149.100.122	192.168.2.4
Jul 3, 2024 15:42:01.595746994 CEST	587	49732	185.149.100.122	192.168.2.4
Jul 3, 2024 15:42:01.596421957 CEST	49732	587	192.168.2.4	185.149.100.122
Jul 3, 2024 15:42:01.613063097 CEST	587	49732	185.149.100.122	192.168.2.4
Jul 3, 2024 15:42:01.956140041 CEST	587	49732	185.149.100.122	192.168.2.4
Jul 3, 2024 15:42:01.956175089 CEST	587	49732	185.149.100.122	192.168.2.4
Jul 3, 2024 15:42:01.956188917 CEST	587	49732	185.149.100.122	192.168.2.4
Jul 3, 2024 15:42:01.956274986 CEST	49732	587	192.168.2.4	185.149.100.122
Jul 3, 2024 15:42:01.984234095 CEST	49732	587	192.168.2.4	185.149.100.122
Jul 3, 2024 15:42:01.990566015 CEST	587	49732	185.149.100.122	192.168.2.4
Jul 3, 2024 15:42:02.262160063 CEST	587	49732	185.149.100.122	192.168.2.4
Jul 3, 2024 15:42:02.264874935 CEST	49732	587	192.168.2.4	185.149.100.122
Jul 3, 2024 15:42:02.276073933 CEST	587	49732	185.149.100.122	192.168.2.4
Jul 3, 2024 15:42:02.554359913 CEST	587	49732	185.149.100.122	192.168.2.4
Jul 3, 2024 15:42:02.555479050 CEST	49732	587	192.168.2.4	185.149.100.122
Jul 3, 2024 15:42:02.570308924 CEST	587	49732	185.149.100.122	192.168.2.4
Jul 3, 2024 15:42:02.841550112 CEST	587	49732	185.149.100.122	192.168.2.4
Jul 3, 2024 15:42:02.841991901 CEST	49732	587	192.168.2.4	185.149.100.122
Jul 3, 2024 15:42:02.846838951 CEST	587	49732	185.149.100.122	192.168.2.4
Jul 3, 2024 15:42:03.251391888 CEST	587	49732	185.149.100.122	192.168.2.4
Jul 3, 2024 15:42:03.251739025 CEST	49732	587	192.168.2.4	185.149.100.122
Jul 3, 2024 15:42:03.256623983 CEST	587	49732	185.149.100.122	192.168.2.4
Jul 3, 2024 15:42:03.527324915 CEST	587	49732	185.149.100.122	192.168.2.4
Jul 3, 2024 15:42:03.527559996 CEST	49732	587	192.168.2.4	185.149.100.122
Jul 3, 2024 15:42:03.532421112 CEST	587	49732	185.149.100.122	192.168.2.4
Jul 3, 2024 15:42:03.839095116 CEST	587	49732	185.149.100.122	192.168.2.4
Jul 3, 2024 15:42:03.839411020 CEST	49732	587	192.168.2.4	185.149.100.122
Jul 3, 2024 15:42:03.844373941 CEST	587	49732	185.149.100.122	192.168.2.4
Jul 3, 2024 15:42:04.114902973 CEST	587	49732	185.149.100.122	192.168.2.4
Jul 3, 2024 15:42:04.115427971 CEST	49732	587	192.168.2.4	185.149.100.122
Jul 3, 2024 15:42:04.115473986 CEST	49732	587	192.168.2.4	185.149.100.122
Jul 3, 2024 15:42:04.115502119 CEST	49732	587	192.168.2.4	185.149.100.122
Jul 3, 2024 15:42:04.115510941 CEST	49732	587	192.168.2.4	185.149.100.122
Jul 3, 2024 15:42:04.120409966 CEST	587	49732	185.149.100.122	192.168.2.4
Jul 3, 2024 15:42:04.120421886 CEST	587	49732	185.149.100.122	192.168.2.4
Jul 3, 2024 15:42:04.120433092 CEST	587	49732	185.149.100.122	192.168.2.4
Jul 3, 2024 15:42:04.121041059 CEST	587	49732	185.149.100.122	192.168.2.4
Jul 3, 2024 15:42:04.582545996 CEST	587	49732	185.149.100.122	192.168.2.4
Jul 3, 2024 15:42:04.628880978 CEST	49732	587	192.168.2.4	185.149.100.122
Jul 3, 2024 15:42:04.633296967 CEST	49732	587	192.168.2.4	185.149.100.122
Jul 3, 2024 15:42:04.638225079 CEST	587	49732	185.149.100.122	192.168.2.4
Jul 3, 2024 15:42:04.911258936 CEST	587	49732	185.149.100.122	192.168.2.4
Jul 3, 2024 15:42:04.911919117 CEST	49732	587	192.168.2.4	185.149.100.122
Jul 3, 2024 15:42:04.913486958 CEST	49733	587	192.168.2.4	185.149.100.122
Jul 3, 2024 15:42:04.918998957 CEST	587	49733	185.149.100.122	192.168.2.4
Jul 3, 2024 15:42:04.919102907 CEST	49733	587	192.168.2.4	185.149.100.122
Jul 3, 2024 15:42:06.144145012 CEST	587	49733	185.149.100.122	192.168.2.4
Jul 3, 2024 15:42:06.144407034 CEST	49733	587	192.168.2.4	185.149.100.122
Jul 3, 2024 15:42:06.149337053 CEST	587	49733	185.149.100.122	192.168.2.4
Jul 3, 2024 15:42:06.430387020 CEST	587	49733	185.149.100.122	192.168.2.4
Jul 3, 2024 15:42:06.430567026 CEST	49733	587	192.168.2.4	185.149.100.122
Jul 3, 2024 15:42:06.435400963 CEST	587	49733	185.149.100.122	192.168.2.4
Jul 3, 2024 15:42:06.783358097 CEST	587	49733	185.149.100.122	192.168.2.4
Jul 3, 2024 15:42:06.784080982 CEST	49733	587	192.168.2.4	185.149.100.122
Jul 3, 2024 15:42:06.788837910 CEST	587	49733	185.149.100.122	192.168.2.4
Jul 3, 2024 15:42:07.150317907 CEST	587	49733	185.149.100.122	192.168.2.4
Jul 3, 2024 15:42:07.150332928 CEST	587	49733	185.149.100.122	192.168.2.4
Jul 3, 2024 15:42:07.150343895 CEST	587	49733	185.149.100.122	192.168.2.4
Jul 3, 2024 15:42:07.150440931 CEST	49733	587	192.168.2.4	185.149.100.122
Jul 3, 2024 15:42:07.151968956 CEST	49733	587	192.168.2.4	185.149.100.122
Jul 3, 2024 15:42:07.156749964 CEST	587	49733	185.149.100.122	192.168.2.4
Jul 3, 2024 15:42:07.438640118 CEST	587	49733	185.149.100.122	192.168.2.4
Jul 3, 2024 15:42:07.439644098 CEST	49733	587	192.168.2.4	185.149.100.122
Jul 3, 2024 15:42:07.444582939 CEST	587	49733	185.149.100.122	192.168.2.4
Jul 3, 2024 15:42:07.725658894 CEST	587	49733	185.149.100.122	192.168.2.4
Jul 3, 2024 15:42:07.725975990 CEST	49733	587	192.168.2.4	185.149.100.122
Jul 3, 2024 15:42:07.730844021 CEST	587	49733	185.149.100.122	192.168.2.4
Jul 3, 2024 15:42:08.012609005 CEST	587	49733	185.149.100.122	192.168.2.4
Jul 3, 2024 15:42:08.012938023 CEST	49733	587	192.168.2.4	185.149.100.122
Jul 3, 2024 15:42:08.017703056 CEST	587	49733	185.149.100.122	192.168.2.4
Jul 3, 2024 15:42:08.388463020 CEST	587	49733	185.149.100.122	192.168.2.4
Jul 3, 2024 15:42:08.388788939 CEST	49733	587	192.168.2.4	185.149.100.122
Jul 3, 2024 15:42:08.653810978 CEST	587	49733	185.149.100.122	192.168.2.4
Jul 3, 2024 15:42:08.653915882 CEST	49733	587	192.168.2.4	185.149.100.122
Jul 3, 2024 15:42:08.655102968 CEST	587	49733	185.149.100.122	192.168.2.4
Jul 3, 2024 15:42:08.936711073 CEST	587	49733	185.149.100.122	192.168.2.4
Jul 3, 2024 15:42:08.937005043 CEST	49733	587	192.168.2.4	185.149.100.122
Jul 3, 2024 15:42:08.941838026 CEST	587	49733	185.149.100.122	192.168.2.4
Jul 3, 2024 15:42:09.264983892 CEST	587	49733	185.149.100.122	192.168.2.4
Jul 3, 2024 15:42:09.265230894 CEST	49733	587	192.168.2.4	185.149.100.122
Jul 3, 2024 15:42:09.270512104 CEST	587	49733	185.149.100.122	192.168.2.4
Jul 3, 2024 15:42:09.553014994 CEST	587	49733	185.149.100.122	192.168.2.4
Jul 3, 2024 15:42:09.554876089 CEST	49733	587	192.168.2.4	185.149.100.122
Jul 3, 2024 15:42:09.555013895 CEST	49733	587	192.168.2.4	185.149.100.122
Jul 3, 2024 15:42:09.555066109 CEST	49733	587	192.168.2.4	185.149.100.122
Jul 3, 2024 15:42:09.555213928 CEST	49733	587	192.168.2.4	185.149.100.122
Jul 3, 2024 15:42:09.555392027 CEST	49733	587	192.168.2.4	185.149.100.122
Jul 3, 2024 15:42:09.555476904 CEST	49733	587	192.168.2.4	185.149.100.122
Jul 3, 2024 15:42:09.555531025 CEST	49733	587	192.168.2.4	185.149.100.122
Jul 3, 2024 15:42:09.555548906 CEST	49733	587	192.168.2.4	185.149.100.122
Jul 3, 2024 15:42:09.555573940 CEST	49733	587	192.168.2.4	185.149.100.122
Jul 3, 2024 15:42:09.559756994 CEST	587	49733	185.149.100.122	192.168.2.4
Jul 3, 2024 15:42:09.559905052 CEST	587	49733	185.149.100.122	192.168.2.4
Jul 3, 2024 15:42:09.559914112 CEST	587	49733	185.149.100.122	192.168.2.4
Jul 3, 2024 15:42:09.560026884 CEST	587	49733	185.149.100.122	192.168.2.4
Jul 3, 2024 15:42:09.560488939 CEST	587	49733	185.149.100.122	192.168.2.4
Jul 3, 2024 15:42:09.560497999 CEST	587	49733	185.149.100.122	192.168.2.4
Jul 3, 2024 15:42:09.560507059 CEST	587	49733	185.149.100.122	192.168.2.4
Jul 3, 2024 15:42:09.560514927 CEST	587	49733	185.149.100.122	192.168.2.4
Jul 3, 2024 15:42:09.560606956 CEST	587	49733	185.149.100.122	192.168.2.4
Jul 3, 2024 15:42:09.560616016 CEST	587	49733	185.149.100.122	192.168.2.4
Jul 3, 2024 15:42:09.560622931 CEST	587	49733	185.149.100.122	192.168.2.4
Jul 3, 2024 15:42:09.560631037 CEST	587	49733	185.149.100.122	192.168.2.4
Jul 3, 2024 15:42:10.039655924 CEST	587	49733	185.149.100.122	192.168.2.4
Jul 3, 2024 15:42:10.082079887 CEST	49733	587	192.168.2.4	185.149.100.122
Jul 3, 2024 15:42:10.318591118 CEST	587	49733	185.149.100.122	192.168.2.4
Jul 3, 2024 15:42:10.318705082 CEST	49733	587	192.168.2.4	185.149.100.122
Jul 3, 2024 15:43:44.661151886 CEST	49733	587	192.168.2.4	185.149.100.122
Jul 3, 2024 15:43:44.666001081 CEST	587	49733	185.149.100.122	192.168.2.4
Jul 3, 2024 15:43:44.949302912 CEST	587	49733	185.149.100.122	192.168.2.4
Jul 3, 2024 15:43:44.949841022 CEST	49733	587	192.168.2.4	185.149.100.122

UDP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Jul 3, 2024 15:41:57.775882006 CEST	50240	53	192.168.2.4	1.1.1.1
Jul 3, 2024 15:41:57.783243895 CEST	53	50240	1.1.1.1	192.168.2.4
Jul 3, 2024 15:41:58.597548962 CEST	51796	53	192.168.2.4	1.1.1.1
Jul 3, 2024 15:41:58.605283976 CEST	53	51796	1.1.1.1	192.168.2.4
Jul 3, 2024 15:41:59.625339985 CEST	60216	53	192.168.2.4	1.1.1.1
Jul 3, 2024 15:41:59.706988096 CEST	53	60216	1.1.1.1	192.168.2.4

DNS Queries

Timestamp	Source IP	Dest IP	Trans ID	OP Code	Name	Type	Class	DNS over HTTPS
Jul 3, 2024 15:41:57.775882006 CEST	192.168.2.4	1.1.1.1	0xfe04	Standard query (0)	api.ipify.org	A (IP address)	IN (0x0001)	false
Jul 3, 2024 15:41:58.597548962 CEST	192.168.2.4	1.1.1.1	0x8f19	Standard query (0)	ip-api.com	A (IP address)	IN (0x0001)	false
Jul 3, 2024 15:41:59.625339985 CEST	192.168.2.4	1.1.1.1	0xd15c	Standard query (0)	mail.divanrestoran.com	A (IP address)	IN (0x0001)	false

DNS Answers

Timestamp	Source IP	Dest IP	Trans ID	Reply Code	Name	CName	Address	Type	Class	DNS over HTTPS
Jul 3, 2024 15:41:57.783243895 CEST	1.1.1.1	192.168.2.4	0xfe04	No error (0)	api.ipify.org		104.26.13.205	A (IP address)	IN (0x0001)	false
Jul 3, 2024 15:41:57.783243895 CEST	1.1.1.1	192.168.2.4	0xfe04	No error (0)	api.ipify.org		172.67.74.152	A (IP address)	IN (0x0001)	false
Jul 3, 2024 15:41:57.783243895 CEST	1.1.1.1	192.168.2.4	0xfe04	No error (0)	api.ipify.org		104.26.12.205	A (IP address)	IN (0x0001)	false
Jul 3, 2024 15:41:58.605283976 CEST	1.1.1.1	192.168.2.4	0x8f19	No error (0)	ip-api.com		208.95.112.1	A (IP address)	IN (0x0001)	false
Jul 3, 2024 15:41:59.706988096 CEST	1.1.1.1	192.168.2.4	0xd15c	No error (0)	mail.divanrestoran.com	divanrestoran.com		CNAME (Canonical name)	IN (0x0001)	false
Jul 3, 2024 15:41:59.706988096 CEST	1.1.1.1	192.168.2.4	0xd15c	No error (0)	divanrestoran.com		185.149.100.122	A (IP address)	IN (0x0001)	false

HTTP Request Dependency Graph

api.ipify.org

ip-api.com

HTTP Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
0	192.168.2.4	49731	208.95.112.1	80	7452	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe

Timestamp	Bytes transferred	Direction	Data
Jul 3, 2024 15:41:58.611532927 CEST	80	OUT	GET /line/?fields=hosting HTTP/1.1 Host: ip-api.com Connection: Keep-Alive
Jul 3, 2024 15:41:59.084893942 CEST	175	IN	HTTP/1.1 200 OK Date: Wed, 03 Jul 2024 13:41:58 GMT Content-Type: text/plain; charset=utf-8 Content-Length: 6 Access-Control-Allow-Origin: * X-Ttl: 60 X-Rl: 44 Data Raw: 66 61 6c 73 65 0a Data Ascii: false

HTTPS Proxied Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
0	192.168.2.4	49730	104.26.13.205	443	7452	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe

Timestamp	Bytes transferred	Direction	Data
2024-07-03 13:41:58 UTC	155	OUT	GET / HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:99.0) Gecko/20100101 Firefox/99.0 Host: api.ipify.org Connection: Keep-Alive
2024-07-03 13:41:58 UTC	211	IN	HTTP/1.1 200 OK Date: Wed, 03 Jul 2024 13:41:58 GMT Content-Type: text/plain Content-Length: 11 Connection: close Vary: Origin CF-Cache-Status: DYNAMIC Server: cloudflare CF-RAY: 89d74bd0ce4b0c76-EWR
2024-07-03 13:41:58 UTC	11	IN	Data Raw: 38 2e 34 36 2e 31 32 33 2e 33 33 Data Ascii: 8.46.123.33

SMTP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP	Commands
Jul 3, 2024 15:42:01.026453018 CEST	587	49732	185.149.100.122	192.168.2.4	220-ronin.veridyen.com ESMTP Exim 4.96 #2 Wed, 03 Jul 2024 16:42:00 +0300 220-We do not authorize the use of this system to transport unsolicited, 220 and/or bulk e-mail.
Jul 3, 2024 15:42:01.026885033 CEST	49732	587	192.168.2.4	185.149.100.122	EHLO 642294
Jul 3, 2024 15:42:01.316344023 CEST	587	49732	185.149.100.122	192.168.2.4	250-ronin.veridyen.com Hello 642294 [8.46.123.33] 250-SIZE 52428800 250-8BITMIME 250-PIPELINING 250-PIPECONNECT 250-AUTH PLAIN LOGIN 250-STARTTLS 250 HELP
Jul 3, 2024 15:42:01.316904068 CEST	49732	587	192.168.2.4	185.149.100.122	STARTTLS
Jul 3, 2024 15:42:01.595746994 CEST	587	49732	185.149.100.122	192.168.2.4	220 TLS go ahead
Jul 3, 2024 15:42:06.144145012 CEST	587	49733	185.149.100.122	192.168.2.4	220-ronin.veridyen.com ESMTP Exim 4.96 #2 Wed, 03 Jul 2024 16:42:05 +0300 220-We do not authorize the use of this system to transport unsolicited, 220 and/or bulk e-mail.
Jul 3, 2024 15:42:06.144407034 CEST	49733	587	192.168.2.4	185.149.100.122	EHLO 642294
Jul 3, 2024 15:42:06.430387020 CEST	587	49733	185.149.100.122	192.168.2.4	250-ronin.veridyen.com Hello 642294 [8.46.123.33] 250-SIZE 52428800 250-8BITMIME 250-PIPELINING 250-PIPECONNECT 250-AUTH PLAIN LOGIN 250-STARTTLS 250 HELP
Jul 3, 2024 15:42:06.430567026 CEST	49733	587	192.168.2.4	185.149.100.122	STARTTLS
Jul 3, 2024 15:42:06.783358097 CEST	587	49733	185.149.100.122	192.168.2.4	220 TLS go ahead

Target ID:	0
Start time:	09:41:55
Start date:	03/07/2024
Path:	C:\Users\user\Desktop\tgBNtoWqIp.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\Desktop\tgBNtoWqIp.exe"
Imagebase:	0xf60000
File size:	1'237'504 bytes
MD5 hash:	F78535A3F5E84F626E1018E587B5B588
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: MALWARE_Win_RedLine, Description: Detects RedLine infostealer, Source: 00000000.00000002.1669136903.00000000040B0000.00000004.00001000.00020000.00000000.sdmp, Author: ditekSHen
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	1
Start time:	09:41:56
Start date:	03/07/2024
Path:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\Desktop\tgBNtoWqIp.exe"
Imagebase:	0x630000
File size:	45'984 bytes
MD5 hash:	9D352BC46709F0CB5EC974633A0C3C94
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_AgentTesla_1, Description: Yara detected AgentTesla, Source: 00000001.00000002.4122661159.0000000002BB9000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_AgentTesla_1, Description: Yara detected AgentTesla, Source: 00000001.00000002.4122661159.0000000002BB1000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_AgentTesla_1, Description: Yara detected AgentTesla, Source: 00000001.00000002.4122661159.0000000002BC4000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 00000001.00000002.4122420156.00000000027D0000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_AgentTesla_1, Description: Yara detected AgentTesla, Source: 00000001.00000002.4122420156.00000000027D0000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_PureLogStealer, Description: Yara detected PureLog Stealer, Source: 00000001.00000002.4122420156.00000000027D0000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: MALWARE_Win_RedLine, Description: Detects RedLine infostealer, Source: 00000001.00000002.4120171532.0000000000400000.00000040.80000000.00040000.00000000.sdmp, Author: ditekSHen Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 00000001.00000002.4125198203.0000000005220000.00000004.08000000.00040000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_GenericDownloader_1, Description: Yara detected Generic Downloader, Source: 00000001.00000002.4125198203.0000000005220000.00000004.08000000.00040000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_AgentTesla_1, Description: Yara detected AgentTesla, Source: 00000001.00000002.4125198203.0000000005220000.00000004.08000000.00040000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_PureLogStealer, Description: Yara detected PureLog Stealer, Source: 00000001.00000002.4125198203.0000000005220000.00000004.08000000.00040000.00000000.sdmp, Author: Joe Security Rule: INDICATOR_SUSPICIOUS_EXE_VaultSchemaGUID, Description: Detects executables referencing Windows vault credential objects. Observed in infostealers, Source: 00000001.00000002.4125198203.0000000005220000.00000004.08000000.00040000.00000000.sdmp, Author: ditekSHen Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 00000001.00000002.4122661159.0000000002B88000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_AgentTesla_1, Description: Yara detected AgentTesla, Source: 00000001.00000002.4122661159.0000000002B88000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 00000001.00000002.4124791586.0000000005160000.00000004.08000000.00040000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_GenericDownloader_1, Description: Yara detected Generic Downloader, Source: 00000001.00000002.4124791586.0000000005160000.00000004.08000000.00040000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_AgentTesla_1, Description: Yara detected AgentTesla, Source: 00000001.00000002.4124791586.0000000005160000.00000004.08000000.00040000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_PureLogStealer, Description: Yara detected PureLog Stealer, Source: 00000001.00000002.4124791586.0000000005160000.00000004.08000000.00040000.00000000.sdmp, Author: Joe Security Rule: INDICATOR_SUSPICIOUS_EXE_VaultSchemaGUID, Description: Detects executables referencing Windows vault credential objects. Observed in infostealers, Source: 00000001.00000002.4124791586.0000000005160000.00000004.08000000.00040000.00000000.sdmp, Author: ditekSHen Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 00000001.00000002.4124115737.0000000003B21000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_AgentTesla_1, Description: Yara detected AgentTesla, Source: 00000001.00000002.4124115737.0000000003B21000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_PureLogStealer, Description: Yara detected PureLog Stealer, Source: 00000001.00000002.4124115737.0000000003B21000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security
Reputation:	high
Has exited:	false

Show Windows behavior

Execution Graph

Execution Coverage:	4.1%
Dynamic/Decrypted Code Coverage:	0.4%
Signature Coverage:	2.6%
Total number of Nodes:	2000
Total number of Limit Nodes:	159

Executed Functions

Function 00F63B4C Relevance: 17.7, APIs: 8, Strings: 2, Instructions: 153
windowCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetCurrentDirectoryW.KERNEL32(00007FFF,?), ref: 00F63B7A
IsDebuggerPresent.KERNEL32 ref: 00F63B8C
GetFullPathNameW.KERNEL32(00007FFF,?,?,010262F8,010262E0,?,?), ref: 00F63BFD

Part of subcall function 00F67D2C: _memmove.LIBCMT ref: 00F67D66

Part of subcall function 00F70A8D: GetFullPathNameW.KERNEL32(?,00007FFF,?,?,?,00F63C26,010262F8,?,?,?), ref: 00F70ACE

SetCurrentDirectoryW.KERNEL32(?), ref: 00F63C81
MessageBoxA.USER32(00000000,This is a third-party compiled AutoIt script.,010193F0,00000010), ref: 00F9D4BC
SetCurrentDirectoryW.KERNEL32(?,010262F8,?,?,?), ref: 00F9D4F4
GetForegroundWindow.USER32(runas,?,?,?,00000001,?,01015D40,010262F8,?,?,?), ref: 00F9D57A
ShellExecuteW.SHELL32(00000000,?,?), ref: 00F9D581

Part of subcall function 00F63A58: GetSysColorBrush.USER32(0000000F), ref: 00F63A62
Part of subcall function 00F63A58: LoadCursorW.USER32(00000000,00007F00), ref: 00F63A71
Part of subcall function 00F63A58: LoadIconW.USER32(00000063), ref: 00F63A88
Part of subcall function 00F63A58: LoadIconW.USER32(000000A4), ref: 00F63A9A
Part of subcall function 00F63A58: LoadIconW.USER32(000000A2), ref: 00F63AAC
Part of subcall function 00F63A58: LoadImageW.USER32(00000063,00000001,00000010,00000010,00000000), ref: 00F63AD2
Part of subcall function 00F63A58: RegisterClassExW.USER32(?), ref: 00F63B28

Part of subcall function 00F639E7: CreateWindowExW.USER32(00000000,AutoIt v3,AutoIt v3,00CF0000,80000000,80000000,0000012C,00000064,00000000,00000000,00000000,00000001), ref: 00F63A15
Part of subcall function 00F639E7: CreateWindowExW.USER32(00000000,edit,00000000,50B008C4,00000000,00000000,00000000,00000000,00000000,00000001,00000000), ref: 00F63A36
Part of subcall function 00F639E7: ShowWindow.USER32(00000000,?,?), ref: 00F63A4A
Part of subcall function 00F639E7: ShowWindow.USER32(00000000,?,?), ref: 00F63A53

Part of subcall function 00F643DB: _memset.LIBCMT ref: 00F64401
Part of subcall function 00F643DB: Shell_NotifyIconW.SHELL32(00000000,?), ref: 00F644A6

Strings

This is a third-party compiled AutoIt script., xrefs: 00F9D4B4
runas, xrefs: 00F9D575

Memory Dump Source

Source File: 00000000.00000002.1667912702.0000000000F61000.00000020.00000001.01000000.00000003.sdmp, Offset: 00F60000, based on PE: true

Associated: 00000000.00000002.1667891216.0000000000F60000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667966851.0000000000FEF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667966851.0000000001015000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1668035777.000000000101F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1668053678.0000000001028000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f60000_tgBNtoWqIp.jbxd

Similarity

API ID: LoadWindow$Icon$CurrentDirectory$CreateFullNamePathShow$BrushClassColorCursorDebuggerExecuteForegroundImageMessageNotifyPresentRegisterShellShell__memmove_memset
String ID: This is a third-party compiled AutoIt script.$runas
API String ID: 529118366-3287110873
Opcode ID: 970b15d1a879ac33f09d8f50be2bae9f12258635672ef743d5576b6197e59d00
Instruction ID: 256a5ef7e8391722fa74fc660a4bb43124b78dd702dfef3492b3e67b7e88af4c
Opcode Fuzzy Hash: 970b15d1a879ac33f09d8f50be2bae9f12258635672ef743d5576b6197e59d00
Instruction Fuzzy Hash: 6A513531D04288AEDF21EFB4DC46EED7B74AF45314F204069F891A6151CA7E5609FB21

Function 00F64AFE Relevance: 10.7, APIs: 7, Instructions: 223
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetVersionExW.KERNEL32(?), ref: 00F64B2B

Part of subcall function 00F67D2C: _memmove.LIBCMT ref: 00F67D66

GetCurrentProcess.KERNEL32(?,00FEFAEC,00000000,00000000,?), ref: 00F64BF8
IsWow64Process.KERNEL32(00000000), ref: 00F64BFF
GetNativeSystemInfo.KERNELBASE(00000000), ref: 00F64C45
FreeLibrary.KERNEL32(00000000), ref: 00F64C50
GetSystemInfo.KERNEL32(00000000), ref: 00F64C81
GetSystemInfo.KERNEL32(00000000), ref: 00F64C8D

Memory Dump Source

Source File: 00000000.00000002.1667912702.0000000000F61000.00000020.00000001.01000000.00000003.sdmp, Offset: 00F60000, based on PE: true

Associated: 00000000.00000002.1667891216.0000000000F60000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667966851.0000000000FEF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667966851.0000000001015000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1668035777.000000000101F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1668053678.0000000001028000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f60000_tgBNtoWqIp.jbxd

Similarity

API ID: InfoSystem$Process$CurrentFreeLibraryNativeVersionWow64_memmove
String ID:
API String ID: 1986165174-0
Opcode ID: e0171fd95448f3f43a1e9507eef590135808254d54ae0a85644da9a5098c032e
Instruction ID: 5a1bf1054a8b737d33436e59c58c468893894c1a2026257ff15c24a3ff6159f8
Opcode Fuzzy Hash: e0171fd95448f3f43a1e9507eef590135808254d54ae0a85644da9a5098c032e
Instruction Fuzzy Hash: 7291063194A7C4DECB31EB7884512AAFFE4AF65310B584E9DD0CB97B41D224F908E719

Function 00F64FE9 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 62
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateStreamOnHGlobal.OLE32(00000000,00000001,?,?,?,?,?,00F64EEE,?,?,00000000,00000000), ref: 00F64FF9
FindResourceExW.KERNEL32(?,0000000A,SCRIPT,00000000,?,?,00F64EEE,?,?,00000000,00000000), ref: 00F65010
LoadResource.KERNEL32(?,00000000,?,?,00F64EEE,?,?,00000000,00000000,?,?,?,?,?,?,00F64F8F), ref: 00F9DD60
SizeofResource.KERNEL32(?,00000000,?,?,00F64EEE,?,?,00000000,00000000,?,?,?,?,?,?,00F64F8F), ref: 00F9DD75
LockResource.KERNEL32(00F64EEE,?,?,00F64EEE,?,?,00000000,00000000,?,?,?,?,?,?,00F64F8F,00000000), ref: 00F9DD88

Strings

SCRIPT, xrefs: 00F65006

Memory Dump Source

Source File: 00000000.00000002.1667912702.0000000000F61000.00000020.00000001.01000000.00000003.sdmp, Offset: 00F60000, based on PE: true

Associated: 00000000.00000002.1667891216.0000000000F60000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667966851.0000000000FEF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667966851.0000000001015000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1668035777.000000000101F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1668053678.0000000001028000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f60000_tgBNtoWqIp.jbxd

Similarity

API ID: Resource$CreateFindGlobalLoadLockSizeofStream
String ID: SCRIPT
API String ID: 3051347437-3967369404
Opcode ID: 0543134fade5652729b543439aea67849f7cd49bf35f6e0af946e06571f63d22
Instruction ID: ae4c6c4c3faeb5c908f9a9efb5a00046a57505578905185ef2066cc81fc7a1b5
Opcode Fuzzy Hash: 0543134fade5652729b543439aea67849f7cd49bf35f6e0af946e06571f63d22
Instruction Fuzzy Hash: 8E11AC71600746BFE7208B25DC98F277BB9EBC9B21F20816CF506DA260DB71EC04A660

Function 00FC4696 Relevance: 4.5, APIs: 3, Instructions: 25fileCOMMON

Download Yara Rule

APIs

GetFileAttributesW.KERNELBASE(?,00F9E7C1), ref: 00FC46A6
FindFirstFileW.KERNELBASE(?,?), ref: 00FC46B7
FindClose.KERNEL32(00000000), ref: 00FC46C7

Memory Dump Source

Source File: 00000000.00000002.1667912702.0000000000F61000.00000020.00000001.01000000.00000003.sdmp, Offset: 00F60000, based on PE: true

Associated: 00000000.00000002.1667891216.0000000000F60000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667966851.0000000000FEF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667966851.0000000001015000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1668035777.000000000101F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1668053678.0000000001028000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f60000_tgBNtoWqIp.jbxd

Similarity

API ID: FileFind$AttributesCloseFirst
String ID:
API String ID: 48322524-0
Opcode ID: 4c65dd9d1b6f59c706a7f7add8228fb7d8d65f2a3dd13594d3499af2a697c193
Instruction ID: f4f5e30344ff2af3aaf1d13ebf3df4fe5124912068e5c9692e45639aec708010
Opcode Fuzzy Hash: 4c65dd9d1b6f59c706a7f7add8228fb7d8d65f2a3dd13594d3499af2a697c193
Instruction Fuzzy Hash: 31E02032C105055B4210A738EC9ECEAB75DDE06335F100729F935C10E0E7B07D54B5D5

Function 00F6E800 Relevance: 2.4, Strings: 1, Instructions: 1102COMMON

Download Yara Rule

Strings

Variable must be of type 'Object'., xrefs: 00FA428C

Memory Dump Source

Source File: 00000000.00000002.1667912702.0000000000F61000.00000020.00000001.01000000.00000003.sdmp, Offset: 00F60000, based on PE: true

Associated: 00000000.00000002.1667891216.0000000000F60000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667966851.0000000000FEF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667966851.0000000001015000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1668035777.000000000101F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1668053678.0000000001028000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f60000_tgBNtoWqIp.jbxd

Similarity

API ID:
String ID: Variable must be of type 'Object'.
API String ID: 0-109567571
Opcode ID: 4d68668ccb88791bf69f573bb163b79f6b11f3242b5d6347df68358455bb90fb
Instruction ID: 98e891a7337267fe30edb774b99b97b2331094b32c08bc36d1d5e6ddc0bd89ef
Opcode Fuzzy Hash: 4d68668ccb88791bf69f573bb163b79f6b11f3242b5d6347df68358455bb90fb
Instruction Fuzzy Hash: 38A29C7AE00205CFCB24CF58C880BAAB7B1FF59310F248069E916AB355D775ED46EB91

Function 00F70B30 Relevance: 57.3, APIs: 27, Strings: 5, Instructions: 1300windowsleeptimeCOMMON

Download Yara Rule

APIs

PeekMessageW.USER32(?,00000000,00000000,00000000,00000001), ref: 00F70BBB
timeGetTime.WINMM ref: 00F70E76
PeekMessageW.USER32(?,00000000,00000000,00000000,00000001), ref: 00F70FB3
TranslateMessage.USER32(?), ref: 00F70FC7
DispatchMessageW.USER32(?), ref: 00F70FD5
Sleep.KERNEL32(0000000A), ref: 00F70FDF
LockWindowUpdate.USER32(00000000,?,?), ref: 00F7105A
DestroyWindow.USER32 ref: 00F71066
GetMessageW.USER32(?,00000000,00000000,00000000), ref: 00F71080
Sleep.KERNEL32(0000000A,?,?), ref: 00FA52AD
TranslateMessage.USER32(?), ref: 00FA608A
DispatchMessageW.USER32(?), ref: 00FA6098
GetMessageW.USER32(?,00000000,00000000,00000000), ref: 00FA60AC

Strings

@GUI_CTRLID, xrefs: 00FA5364
@TRAY_ID, xrefs: 00FA5BB9
@GUI_CTRLHANDLE, xrefs: 00FA540E
@COM_EVENTOBJ, xrefs: 00FA591A
@GUI_WINHANDLE, xrefs: 00FA53B9

Memory Dump Source

Source File: 00000000.00000002.1667912702.0000000000F61000.00000020.00000001.01000000.00000003.sdmp, Offset: 00F60000, based on PE: true

Associated: 00000000.00000002.1667891216.0000000000F60000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667966851.0000000000FEF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667966851.0000000001015000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1668035777.000000000101F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1668053678.0000000001028000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f60000_tgBNtoWqIp.jbxd

Similarity

API ID: Message$DispatchPeekSleepTranslateWindow$DestroyLockTimeUpdatetime
String ID: @COM_EVENTOBJ$@GUI_CTRLHANDLE$@GUI_CTRLID$@GUI_WINHANDLE$@TRAY_ID
API String ID: 4003667617-3242690629
Opcode ID: bf4f17d7e034a380b738e303a68a3627d3d850d897fea3dce0613251b743cf1b
Instruction ID: 098eed5c3b9826061cb6636e7e48178813a9b9688378f907fce87a35694af6c6
Opcode Fuzzy Hash: bf4f17d7e034a380b738e303a68a3627d3d850d897fea3dce0613251b743cf1b
Instruction Fuzzy Hash: 8FB2E3B0A08741DFD724DF24C884BAAB7E5FF85714F14891EF48A87291DB79E844EB42

Function 00FC93DF Relevance: 19.8, APIs: 13, Instructions: 322
fileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 00FC91E9: __time64.LIBCMT ref: 00FC91F3

Part of subcall function 00F65045: _fseek.LIBCMT ref: 00F6505D

__wsplitpath.LIBCMT ref: 00FC94BE

Part of subcall function 00F8432E: __wsplitpath_helper.LIBCMT ref: 00F8436E

_wcscpy.LIBCMT ref: 00FC94D1
_wcscat.LIBCMT ref: 00FC94E4
__wsplitpath.LIBCMT ref: 00FC9509
_wcscat.LIBCMT ref: 00FC951F
_wcscat.LIBCMT ref: 00FC9532

Part of subcall function 00FC922F: _memmove.LIBCMT ref: 00FC9268
Part of subcall function 00FC922F: _memmove.LIBCMT ref: 00FC9277

_wcscmp.LIBCMT ref: 00FC9479

Part of subcall function 00FC99BE: _wcscmp.LIBCMT ref: 00FC9AAE
Part of subcall function 00FC99BE: _wcscmp.LIBCMT ref: 00FC9AC1

DeleteFileW.KERNEL32(?,?,?,?,00000004,00000001,?,?,00000004,00000001,?,?,00000004,00000001,?,?), ref: 00FC96DC
_wcsncpy.LIBCMT ref: 00FC974F
DeleteFileW.KERNEL32(?,?), ref: 00FC9785
CopyFileW.KERNELBASE(?,?,00000000,?,?,?,00000004,00000001,?,?,00000004,00000001,?,?,00000004,00000001), ref: 00FC979B
DeleteFileW.KERNEL32(?,?,?,00000004,00000001,?,?,00000004,00000001,?,?,00000004,00000001,?,?,00000004), ref: 00FC97AC
DeleteFileW.KERNELBASE(?,?,?,00000004,00000001,?,?,00000004,00000001,?,?,00000004,00000001,?,?,00000004), ref: 00FC97BE

Memory Dump Source

Source File: 00000000.00000002.1667912702.0000000000F61000.00000020.00000001.01000000.00000003.sdmp, Offset: 00F60000, based on PE: true

Associated: 00000000.00000002.1667891216.0000000000F60000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667966851.0000000000FEF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667966851.0000000001015000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1668035777.000000000101F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1668053678.0000000001028000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f60000_tgBNtoWqIp.jbxd

Similarity

API ID: File$Delete$_wcscat_wcscmp$__wsplitpath_memmove$Copy__time64__wsplitpath_helper_fseek_wcscpy_wcsncpy
String ID:
API String ID: 1500180987-0
Opcode ID: 6a7d88ccbb6c1773a9b84915c64dc5bc6716753dc134c5f240fbe70a51f5deed
Instruction ID: 8cef28eaf1e9e1bdda0d9c03abbe33f82aa5791feaf225d4fdce16f4f96568b0
Opcode Fuzzy Hash: 6a7d88ccbb6c1773a9b84915c64dc5bc6716753dc134c5f240fbe70a51f5deed
Instruction Fuzzy Hash: 53C13BB1D0022AABDF21DF94CD86EDEB7BDEF44310F0040AAF609E6151DB749A44AF65

Function 00F63015 Relevance: 19.3, APIs: 7, Strings: 4, Instructions: 72
windowregistryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetSysColorBrush.USER32(0000000F), ref: 00F63074
RegisterClassExW.USER32(00000030), ref: 00F6309E
RegisterWindowMessageW.USER32(TaskbarCreated), ref: 00F630AF
InitCommonControlsEx.COMCTL32(?), ref: 00F630CC
ImageList_Create.COMCTL32(00000010,00000010,00000021,00000001,00000001), ref: 00F630DC
LoadIconW.USER32(000000A9), ref: 00F630F2
ImageList_ReplaceIcon.COMCTL32(000000FF,00000000), ref: 00F63101

Strings

TaskbarCreated, xrefs: 00F630A4
AutoIt v3 GUI, xrefs: 00F63090
+, xrefs: 00F6305D
0, xrefs: 00F63056

Memory Dump Source

Source File: 00000000.00000002.1667912702.0000000000F61000.00000020.00000001.01000000.00000003.sdmp, Offset: 00F60000, based on PE: true

Associated: 00000000.00000002.1667891216.0000000000F60000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667966851.0000000000FEF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667966851.0000000001015000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1668035777.000000000101F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1668053678.0000000001028000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f60000_tgBNtoWqIp.jbxd

Similarity

API ID: IconImageList_Register$BrushClassColorCommonControlsCreateInitLoadMessageReplaceWindow
String ID: +$0$AutoIt v3 GUI$TaskbarCreated
API String ID: 2914291525-1005189915
Opcode ID: 9d6feed5c62c95b7e5748c08322f50ec938e51a12490e42306719abb19f20677
Instruction ID: ec31c1d36fad447bb27bd367d5b681b7810938f9dc0424812632e7d48bafbfe1
Opcode Fuzzy Hash: 9d6feed5c62c95b7e5748c08322f50ec938e51a12490e42306719abb19f20677
Instruction Fuzzy Hash: 06314CB1941349EFDB60CFA4D885BCDBBF0FB09310F24412AE991EA290D7BA0589DF51

Function 00F63041 Relevance: 19.3, APIs: 7, Strings: 4, Instructions: 54
windowregistryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetSysColorBrush.USER32(0000000F), ref: 00F63074
RegisterClassExW.USER32(00000030), ref: 00F6309E
RegisterWindowMessageW.USER32(TaskbarCreated), ref: 00F630AF
InitCommonControlsEx.COMCTL32(?), ref: 00F630CC
ImageList_Create.COMCTL32(00000010,00000010,00000021,00000001,00000001), ref: 00F630DC
LoadIconW.USER32(000000A9), ref: 00F630F2
ImageList_ReplaceIcon.COMCTL32(000000FF,00000000), ref: 00F63101

Strings

TaskbarCreated, xrefs: 00F630A4
AutoIt v3 GUI, xrefs: 00F63090
+, xrefs: 00F6305D
0, xrefs: 00F63056

Memory Dump Source

Source File: 00000000.00000002.1667912702.0000000000F61000.00000020.00000001.01000000.00000003.sdmp, Offset: 00F60000, based on PE: true

Associated: 00000000.00000002.1667891216.0000000000F60000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667966851.0000000000FEF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667966851.0000000001015000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1668035777.000000000101F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1668053678.0000000001028000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f60000_tgBNtoWqIp.jbxd

Similarity

API ID: IconImageList_Register$BrushClassColorCommonControlsCreateInitLoadMessageReplaceWindow
String ID: +$0$AutoIt v3 GUI$TaskbarCreated
API String ID: 2914291525-1005189915
Opcode ID: 3102da31a75bfa24f532e3fa0a39c7e7b39aa1979b10984024c070174da004a0
Instruction ID: d1bc59ac9d359e446408d1ef59d7bc563f0dfad378bd476f8845e782c8bf08a6
Opcode Fuzzy Hash: 3102da31a75bfa24f532e3fa0a39c7e7b39aa1979b10984024c070174da004a0
Instruction Fuzzy Hash: 5E21C9B1D11258EFDB20DF94E889B9DBBF4FB08700F10412AFA51AA294D7B645489F91

Function 00F671EB Relevance: 17.7, APIs: 6, Strings: 4, Instructions: 201
registryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 00F64864: GetModuleFileNameW.KERNEL32(00000000,?,00007FFF,010262F8,?,00F637C0,?), ref: 00F64882

Part of subcall function 00F8074F: GetFullPathNameW.KERNEL32(?,00007FFF,?,?,?,?,00F672C5), ref: 00F80771

RegOpenKeyExW.KERNELBASE(80000001,Software\AutoIt v3\AutoIt,00000000,00000001,?,?,\Include\), ref: 00F67308
RegQueryValueExW.ADVAPI32(?,Include,00000000,00000000,00000000,?), ref: 00F9ECF1
RegQueryValueExW.ADVAPI32(?,Include,00000000,00000000,?,?,00000000), ref: 00F9ED32
RegCloseKey.ADVAPI32(?), ref: 00F9ED70
_wcscat.LIBCMT ref: 00F9EDC9

Strings

Software\AutoIt v3\AutoIt, xrefs: 00F672FE
Include, xrefs: 00F9ECE8, 00F9ED29
\Include\, xrefs: 00F672C5
\, xrefs: 00F9EDEC

Memory Dump Source

Source File: 00000000.00000002.1667912702.0000000000F61000.00000020.00000001.01000000.00000003.sdmp, Offset: 00F60000, based on PE: true

Associated: 00000000.00000002.1667891216.0000000000F60000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667966851.0000000000FEF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667966851.0000000001015000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1668035777.000000000101F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1668053678.0000000001028000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f60000_tgBNtoWqIp.jbxd

Similarity

API ID: NameQueryValue$CloseFileFullModuleOpenPath_wcscat
String ID: Include$Software\AutoIt v3\AutoIt$\$\Include\
API String ID: 2673923337-2727554177
Opcode ID: 34c991c90a10d24dbe8197c59979b6f855aba3dc70db938fda1ce078711d94ed
Instruction ID: 8f531f38e5361cdc781225e535a58bbd655a2c8ffe44c539836d56d9c2e461b6
Opcode Fuzzy Hash: 34c991c90a10d24dbe8197c59979b6f855aba3dc70db938fda1ce078711d94ed
Instruction Fuzzy Hash: BC71AD714083019ED724EF25EC8189BBBE8FFA9710F50052EF585871A1EB39994CEB62

Function 00F63A58 Relevance: 17.6, APIs: 7, Strings: 3, Instructions: 71
windowregistryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetSysColorBrush.USER32(0000000F), ref: 00F63A62
LoadCursorW.USER32(00000000,00007F00), ref: 00F63A71
LoadIconW.USER32(00000063), ref: 00F63A88
LoadIconW.USER32(000000A4), ref: 00F63A9A
LoadIconW.USER32(000000A2), ref: 00F63AAC
LoadImageW.USER32(00000063,00000001,00000010,00000010,00000000), ref: 00F63AD2
RegisterClassExW.USER32(?), ref: 00F63B28

Part of subcall function 00F63041: GetSysColorBrush.USER32(0000000F), ref: 00F63074
Part of subcall function 00F63041: RegisterClassExW.USER32(00000030), ref: 00F6309E
Part of subcall function 00F63041: RegisterWindowMessageW.USER32(TaskbarCreated), ref: 00F630AF
Part of subcall function 00F63041: InitCommonControlsEx.COMCTL32(?), ref: 00F630CC
Part of subcall function 00F63041: ImageList_Create.COMCTL32(00000010,00000010,00000021,00000001,00000001), ref: 00F630DC
Part of subcall function 00F63041: LoadIconW.USER32(000000A9), ref: 00F630F2
Part of subcall function 00F63041: ImageList_ReplaceIcon.COMCTL32(000000FF,00000000), ref: 00F63101

Strings

0, xrefs: 00F63B06
#, xrefs: 00F63B0D
AutoIt v3, xrefs: 00F63B17

Memory Dump Source

Source File: 00000000.00000002.1667912702.0000000000F61000.00000020.00000001.01000000.00000003.sdmp, Offset: 00F60000, based on PE: true

Associated: 00000000.00000002.1667891216.0000000000F60000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667966851.0000000000FEF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667966851.0000000001015000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1668035777.000000000101F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1668053678.0000000001028000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f60000_tgBNtoWqIp.jbxd

Similarity

API ID: Load$Icon$ImageRegister$BrushClassColorList_$CommonControlsCreateCursorInitMessageReplaceWindow
String ID: #$0$AutoIt v3
API String ID: 423443420-4155596026
Opcode ID: 88dee5da6137aae6554882e6026ba7c339c98bdd56baee7b83273b52574ed737
Instruction ID: e82d1f341e75e1c92ed867c29055ebb2324c03fe8271703e8406d70146662e96
Opcode Fuzzy Hash: 88dee5da6137aae6554882e6026ba7c339c98bdd56baee7b83273b52574ed737
Instruction Fuzzy Hash: 56215E71D00308AFEB319FA4EC49B9D7BB4FB09710F20412AF944A6295D3BB56589F44

Function 00F63633 Relevance: 15.9, APIs: 8, Strings: 1, Instructions: 151
windowtimeregistryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

DefWindowProcW.USER32(?,?,?,?), ref: 00F636D2
KillTimer.USER32(?,00000001), ref: 00F636FC
SetTimer.USER32(?,00000001,000002EE,00000000), ref: 00F6371F
RegisterWindowMessageW.USER32(TaskbarCreated), ref: 00F6372A
CreatePopupMenu.USER32 ref: 00F6373E
PostQuitMessage.USER32(00000000), ref: 00F6375F

Strings

TaskbarCreated, xrefs: 00F63725

Memory Dump Source

Source File: 00000000.00000002.1667912702.0000000000F61000.00000020.00000001.01000000.00000003.sdmp, Offset: 00F60000, based on PE: true

Associated: 00000000.00000002.1667891216.0000000000F60000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667966851.0000000000FEF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667966851.0000000001015000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1668035777.000000000101F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1668053678.0000000001028000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f60000_tgBNtoWqIp.jbxd

Similarity

API ID: MessageTimerWindow$CreateKillMenuPopupPostProcQuitRegister
String ID: TaskbarCreated
API String ID: 129472671-2362178303
Opcode ID: d2d3d073078ce2397b66431831cd691c61cfffae4d8c8447b9fdee2a2579b62a
Instruction ID: 136535c4a0b8a44e4a531cbd196b761a81ec61fc2c413c2a0a17b720319c1601
Opcode Fuzzy Hash: d2d3d073078ce2397b66431831cd691c61cfffae4d8c8447b9fdee2a2579b62a
Instruction Fuzzy Hash: 7E4129B2604149BBDF346F68DC49F793769FB11310F240229FD42D6291CABBAE04B762

Function 00F63778 Relevance: 14.3, APIs: 1, Strings: 7, Instructions: 267
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

CMDLINE, xrefs: 00F63834
/AutoIt3ExecuteScript, xrefs: 00F638CE
CMDLINERAW, xrefs: 00F6380D
/ErrorStdOut, xrefs: 00F6388F
/AutoIt3OutputDebug, xrefs: 00F638A4
>>>AUTOIT NO CMDEXECUTE<<<, xrefs: 00F637C0
/AutoIt3ExecuteLine, xrefs: 00F638B9

Memory Dump Source

Source File: 00000000.00000002.1667912702.0000000000F61000.00000020.00000001.01000000.00000003.sdmp, Offset: 00F60000, based on PE: true

Associated: 00000000.00000002.1667891216.0000000000F60000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667966851.0000000000FEF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667966851.0000000001015000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1668035777.000000000101F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1668053678.0000000001028000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f60000_tgBNtoWqIp.jbxd

Similarity

API ID: FileLibraryLoadModuleName__wcsicmp_l_memmove
String ID: /AutoIt3ExecuteLine$/AutoIt3ExecuteScript$/AutoIt3OutputDebug$/ErrorStdOut$>>>AUTOIT NO CMDEXECUTE<<<$CMDLINE$CMDLINERAW
API String ID: 1825951767-3513169116
Opcode ID: 650bbbe2eab8d895e6a11310bc7f4cd1b6ebccedd796e6c6d1708e5491c9de91
Instruction ID: 6755d5c6dc1e20be292957b16c5eefaf90f72e3909593c5442e79d57afb8df39
Opcode Fuzzy Hash: 650bbbe2eab8d895e6a11310bc7f4cd1b6ebccedd796e6c6d1708e5491c9de91
Instruction Fuzzy Hash: 2AA15D72C142299ADF14EFA0CC95EEEB778BF15700F14012AE452B7191DF79AA09EB60

Function 011B25E0 Relevance: 10.7, APIs: 7, Instructions: 239
fileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateFileW.KERNELBASE(00000000,?,80000000,00000007,00000000,00000003,00000080,00000000,?,00000000), ref: 011B26B1
VirtualFree.KERNELBASE(00000000,00000000,00008000,00000000,00000000,00000000,00000000,?,?,00000000), ref: 011B28D7

Memory Dump Source

Source File: 00000000.00000002.1668313329.00000000011B0000.00000040.00001000.00020000.00000000.sdmp, Offset: 011B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_11b0000_tgBNtoWqIp.jbxd

Similarity

API ID: CreateFileFreeVirtual
String ID:
API String ID: 204039940-0
Opcode ID: 014c9b5c74d83c0a726ef6016946af978a068631e2f3efa1e9065a42f07dad7c
Instruction ID: b6d3110406d12c43668a5d5407198fe400c3fecd496da87b91d5b6f90b27c5a7
Opcode Fuzzy Hash: 014c9b5c74d83c0a726ef6016946af978a068631e2f3efa1e9065a42f07dad7c
Instruction Fuzzy Hash: B8A12B74E00209EBDB18CFA4C994BEEBBB5FF48304F208159E511BB280D779AA45CF95

Function 00F639E7 Relevance: 10.5, APIs: 4, Strings: 2, Instructions: 44
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateWindowExW.USER32(00000000,AutoIt v3,AutoIt v3,00CF0000,80000000,80000000,0000012C,00000064,00000000,00000000,00000000,00000001), ref: 00F63A15
CreateWindowExW.USER32(00000000,edit,00000000,50B008C4,00000000,00000000,00000000,00000000,00000000,00000001,00000000), ref: 00F63A36
ShowWindow.USER32(00000000,?,?), ref: 00F63A4A
ShowWindow.USER32(00000000,?,?), ref: 00F63A53

Strings

edit, xrefs: 00F63A30
AutoIt v3, xrefs: 00F63A0D, 00F63A12, 00F63A13

Memory Dump Source

Source File: 00000000.00000002.1667912702.0000000000F61000.00000020.00000001.01000000.00000003.sdmp, Offset: 00F60000, based on PE: true

Associated: 00000000.00000002.1667891216.0000000000F60000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667966851.0000000000FEF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667966851.0000000001015000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1668035777.000000000101F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1668053678.0000000001028000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f60000_tgBNtoWqIp.jbxd

Similarity

API ID: Window$CreateShow
String ID: AutoIt v3$edit
API String ID: 1584632944-3779509399
Opcode ID: b0412efbef331e01fb749853094dee6c43756cf64cecb2a347f0cba077435561
Instruction ID: 7136dab4b4a45c0f2c799e108a5fddad8306ba7cb2a85fc1569cc2d186424ef4
Opcode Fuzzy Hash: b0412efbef331e01fb749853094dee6c43756cf64cecb2a347f0cba077435561
Instruction Fuzzy Hash: 6DF03A70600294BEEA311A636C48E373E7DD7C7F50B20002AFD40A6164C2BB0C48DBB0

Function 011B23B0 Relevance: 8.9, APIs: 4, Strings: 1, Instructions: 144
fileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 011B22A0: Sleep.KERNELBASE(000001F4), ref: 011B22B1

CreateFileW.KERNELBASE(?,80000000,00000007,00000000,00000003,00000080,00000000), ref: 011B24CE

Strings

CWXW8K62DGP5PKITVKLIAZ, xrefs: 011B2531, 011B2534

Memory Dump Source

Source File: 00000000.00000002.1668313329.00000000011B0000.00000040.00001000.00020000.00000000.sdmp, Offset: 011B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_11b0000_tgBNtoWqIp.jbxd

Similarity

API ID: CreateFileSleep
String ID: CWXW8K62DGP5PKITVKLIAZ
API String ID: 2694422964-1529554986
Opcode ID: 4e0c4d56c4b0d2a7ab64719093539fd2992c7ff83176a5564fe1569b574c85ba
Instruction ID: 32e3d43e99c8e7eeded4b885c03125ff08688f9222c0c77b161882056946b1c1
Opcode Fuzzy Hash: 4e0c4d56c4b0d2a7ab64719093539fd2992c7ff83176a5564fe1569b574c85ba
Instruction Fuzzy Hash: AB519470D04289DAEF15DBE4C858BEFBBB4AF19304F004199E6097B2C1D7B91B48CB65

Function 00F6410D Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 88
windowCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

LoadStringW.USER32(00000065,?,0000007F,00000104), ref: 00F9D5EC

Part of subcall function 00F67D2C: _memmove.LIBCMT ref: 00F67D66

_memset.LIBCMT ref: 00F6418D
_wcscpy.LIBCMT ref: 00F641E1
Shell_NotifyIconW.SHELL32(00000001,000003A8), ref: 00F641F1

Strings

Line: , xrefs: 00F9D615

Memory Dump Source

Source File: 00000000.00000002.1667912702.0000000000F61000.00000020.00000001.01000000.00000003.sdmp, Offset: 00F60000, based on PE: true

Associated: 00000000.00000002.1667891216.0000000000F60000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667966851.0000000000FEF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667966851.0000000001015000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1668035777.000000000101F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1668053678.0000000001028000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f60000_tgBNtoWqIp.jbxd

Similarity

API ID: IconLoadNotifyShell_String_memmove_memset_wcscpy
String ID: Line:
API String ID: 3942752672-1585850449
Opcode ID: 305a85b10957c513fa703f0c770ec7daa101c77d994e12a0823cf8bab2f31117
Instruction ID: 1eb729f06914bcc5468fe32255eca2238e1549b5f7744b0bf738d3216eccd3e7
Opcode Fuzzy Hash: 305a85b10957c513fa703f0c770ec7daa101c77d994e12a0823cf8bab2f31117
Instruction Fuzzy Hash: F131CF71408354AAD732FB60DC46BDB77E8AF45314F20451EF5C492092EB79AA48E792

Function 00F8564D Relevance: 7.7, APIs: 5, Instructions: 163
COMMONLIBRARYCODE

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

_memset.LIBCMT ref: 00F856AB
_memcpy_s.LIBCMT ref: 00F8571D
__read_nolock.LIBCMT ref: 00F8577B
__filbuf.LIBCMT ref: 00F8579E
_memset.LIBCMT ref: 00F857E2

Part of subcall function 00F88D68: __getptd_noexit.LIBCMT ref: 00F88D68

Memory Dump Source

Source File: 00000000.00000002.1667912702.0000000000F61000.00000020.00000001.01000000.00000003.sdmp, Offset: 00F60000, based on PE: true

Associated: 00000000.00000002.1667891216.0000000000F60000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667966851.0000000000FEF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667966851.0000000001015000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1668035777.000000000101F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1668053678.0000000001028000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f60000_tgBNtoWqIp.jbxd

Similarity

API ID: _memset$__filbuf__getptd_noexit__read_nolock_memcpy_s
String ID:
API String ID: 1559183368-0
Opcode ID: cbc132a2d90f1fa170c901e77712e707e3c45fd9b9f6dd10e42efcbbdaed9f46
Instruction ID: 546561413e4359083bcc11fa46549fc3cb3d8da675e9653dab22521e80d1b962
Opcode Fuzzy Hash: cbc132a2d90f1fa170c901e77712e707e3c45fd9b9f6dd10e42efcbbdaed9f46
Instruction Fuzzy Hash: 83519435E00B0ADBDF24AF69C8846EE77A5AF40B30F64C729F825962D0E7749D51AB40

Function 00F669CA Relevance: 7.3, APIs: 2, Strings: 2, Instructions: 260COMMON

Download Yara Rule

APIs

Part of subcall function 00F64F3D: LoadLibraryExW.KERNELBASE(?,00000000,00000002,?,010262F8,00000001,>>>AUTOIT NO CMDEXECUTE<<<,?), ref: 00F64F6F

_free.LIBCMT ref: 00F9E68C
_free.LIBCMT ref: 00F9E6D3

Part of subcall function 00F66BEC: SetCurrentDirectoryW.KERNEL32(?,?,?,?,00000000), ref: 00F66D0D

Strings

Bad directive syntax error, xrefs: 00F9E6BB
>>>AUTOIT SCRIPT<<<, xrefs: 00F9E462

Memory Dump Source

Source File: 00000000.00000002.1667912702.0000000000F61000.00000020.00000001.01000000.00000003.sdmp, Offset: 00F60000, based on PE: true

Associated: 00000000.00000002.1667891216.0000000000F60000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667966851.0000000000FEF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667966851.0000000001015000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1668035777.000000000101F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1668053678.0000000001028000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f60000_tgBNtoWqIp.jbxd

Similarity

API ID: _free$CurrentDirectoryLibraryLoad
String ID: >>>AUTOIT SCRIPT<<<$Bad directive syntax error
API String ID: 2861923089-1757145024
Opcode ID: 51ab2db18a7a5d9d6d66e558d6ea21dea616a5cf67e247f6509f6fc25fc4adde
Instruction ID: f7c0502de2ad202db02486f9c4c8d9c0b2a1b05d3d82db59e8a91b53f2bb2477
Opcode Fuzzy Hash: 51ab2db18a7a5d9d6d66e558d6ea21dea616a5cf67e247f6509f6fc25fc4adde
Instruction Fuzzy Hash: AB918D71910219EFDF04EFA4CC919EDB7B4FF15314F14442AF815AB2A1EB39A905EB60

Function 00F635B0 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 59registryCOMMON

Download Yara Rule

APIs

RegOpenKeyExW.KERNELBASE(80000001,Control Panel\Mouse,00000000,00000001,00000000,00000003,00000000,80000001,80000001,?,00F635A1,SwapMouseButtons,00000004,?), ref: 00F635D4
RegQueryValueExW.KERNELBASE(00000000,00000000,00000000,00000000,?,?,?,?,00F635A1,SwapMouseButtons,00000004,?,?,?,?,00F62754), ref: 00F635F5
RegCloseKey.KERNELBASE(00000000,?,?,00F635A1,SwapMouseButtons,00000004,?,?,?,?,00F62754), ref: 00F63617

Strings

Control Panel\Mouse, xrefs: 00F635D2

Memory Dump Source

Source File: 00000000.00000002.1667912702.0000000000F61000.00000020.00000001.01000000.00000003.sdmp, Offset: 00F60000, based on PE: true

Associated: 00000000.00000002.1667891216.0000000000F60000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667966851.0000000000FEF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667966851.0000000001015000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1668035777.000000000101F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1668053678.0000000001028000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f60000_tgBNtoWqIp.jbxd

Similarity

API ID: CloseOpenQueryValue
String ID: Control Panel\Mouse
API String ID: 3677997916-824357125
Opcode ID: 20d6fa1d37e4c79284203e80a55ab1c0912927aaa92b4e1ef5582aecda95b440
Instruction ID: 0dbd506240f202d7fbdd1caf4e7cce948743a394de1605321bb7ca42b8acf614
Opcode Fuzzy Hash: 20d6fa1d37e4c79284203e80a55ab1c0912927aaa92b4e1ef5582aecda95b440
Instruction Fuzzy Hash: 70115A71910218BFDB20CF64DC80EAEBBB8EF44750F004469F905DB210D2729F44A760

Function 011B12A0 Relevance: 6.7, APIs: 4, Instructions: 720processthreadCOMMON

Download Yara Rule

APIs

CreateProcessW.KERNELBASE(?,00000000), ref: 011B1ACD
Wow64GetThreadContext.KERNEL32(?,00010007), ref: 011B1AF1
ReadProcessMemory.KERNELBASE(?,?,?,00000004,00000000), ref: 011B1B13

Memory Dump Source

Source File: 00000000.00000002.1668313329.00000000011B0000.00000040.00001000.00020000.00000000.sdmp, Offset: 011B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_11b0000_tgBNtoWqIp.jbxd

Similarity

API ID: Process$ContextCreateMemoryReadThreadWow64
String ID:
API String ID: 2438371351-0
Opcode ID: cc658a0e6010fd3573e63fe9dffc1f366d2843c5c23e1a249a06af30add5367b
Instruction ID: 29fb69de18263be73526e7e61c789f70f9a37bef5a9c11c6c74fff40fc424ceb
Opcode Fuzzy Hash: cc658a0e6010fd3573e63fe9dffc1f366d2843c5c23e1a249a06af30add5367b
Instruction Fuzzy Hash: 1D621D30A14258DBEB28DFA4D894BDEB372EF58300F1091A9D10DEB394E7759E81CB59

Function 00FC97E5 Relevance: 6.2, APIs: 4, Instructions: 155COMMON

Download Yara Rule

APIs

Part of subcall function 00F65045: _fseek.LIBCMT ref: 00F6505D

Part of subcall function 00FC99BE: _wcscmp.LIBCMT ref: 00FC9AAE
Part of subcall function 00FC99BE: _wcscmp.LIBCMT ref: 00FC9AC1

_free.LIBCMT ref: 00FC992C
_free.LIBCMT ref: 00FC9933
_free.LIBCMT ref: 00FC999E

Part of subcall function 00F82F95: RtlFreeHeap.NTDLL(00000000,00000000,?,00F89C64), ref: 00F82FA9
Part of subcall function 00F82F95: GetLastError.KERNEL32(00000000,?,00F89C64), ref: 00F82FBB

_free.LIBCMT ref: 00FC99A6

Memory Dump Source

Source File: 00000000.00000002.1667912702.0000000000F61000.00000020.00000001.01000000.00000003.sdmp, Offset: 00F60000, based on PE: true

Associated: 00000000.00000002.1667891216.0000000000F60000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667966851.0000000000FEF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667966851.0000000001015000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1668035777.000000000101F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1668053678.0000000001028000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f60000_tgBNtoWqIp.jbxd

Similarity

API ID: _free$_wcscmp$ErrorFreeHeapLast_fseek
String ID:
API String ID: 1552873950-0
Opcode ID: c040f5d591410a8d3afab51092a26b6f5939c84b98243336257d617f1f09bfd3
Instruction ID: 04acb539f9ac9adda67311cf288d2fd4e3f890015b5c99cd78745bfe5b45cf60
Opcode Fuzzy Hash: c040f5d591410a8d3afab51092a26b6f5939c84b98243336257d617f1f09bfd3
Instruction Fuzzy Hash: D2514AB1E04259AFDF249F64CC85B9EBBB9EF48310F1004AEB609A7241DB755A80DF58

Function 00F8493A Relevance: 6.1, APIs: 4, Instructions: 136COMMON

Download Yara Rule

APIs

_memmove.LIBCMT ref: 00F849D0
__flush.LIBCMT ref: 00F849F0
__write.LIBCMT ref: 00F84A23
__flsbuf.LIBCMT ref: 00F84A51

Part of subcall function 00F88D68: __getptd_noexit.LIBCMT ref: 00F88D68

Memory Dump Source

Source File: 00000000.00000002.1667912702.0000000000F61000.00000020.00000001.01000000.00000003.sdmp, Offset: 00F60000, based on PE: true

Associated: 00000000.00000002.1667891216.0000000000F60000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667966851.0000000000FEF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667966851.0000000001015000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1668035777.000000000101F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1668053678.0000000001028000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f60000_tgBNtoWqIp.jbxd

Similarity

API ID: __flsbuf__flush__getptd_noexit__write_memmove
String ID:
API String ID: 2782032738-0
Opcode ID: 14470a6213cb86a88b8286372661136e60ed3d9327b1e96cf2061ba74b92ecb7
Instruction ID: 806bf42af948244a281b58bfc7dea027ed9c7ee010176caef240f148377271f6
Opcode Fuzzy Hash: 14470a6213cb86a88b8286372661136e60ed3d9327b1e96cf2061ba74b92ecb7
Instruction Fuzzy Hash: B041C571B006079BDF2CEE69C8809EF77A9EF80360B24816DE855CB640D778AD41AB44

Function 00F673E5 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 65COMMON

Download Yara Rule

APIs

_memset.LIBCMT ref: 00F9EE62
GetOpenFileNameW.COMDLG32(?), ref: 00F9EEAC

Part of subcall function 00F648AE: GetFullPathNameW.KERNEL32(?,00007FFF,?,00000000,?,?,00F648A1,?,?,00F637C0,?), ref: 00F648CE

Part of subcall function 00F809D5: GetLongPathNameW.KERNELBASE(?,?,00007FFF), ref: 00F809F4

Strings

X, xrefs: 00F9EE7A

Memory Dump Source

Source File: 00000000.00000002.1667912702.0000000000F61000.00000020.00000001.01000000.00000003.sdmp, Offset: 00F60000, based on PE: true

Associated: 00000000.00000002.1667891216.0000000000F60000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667966851.0000000000FEF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667966851.0000000001015000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1668035777.000000000101F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1668053678.0000000001028000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f60000_tgBNtoWqIp.jbxd

Similarity

API ID: Name$Path$FileFullLongOpen_memset
String ID: X
API String ID: 3777226403-3081909835
Opcode ID: 7c33793ac23e20373fd839102bd14160c22790032c1c39f818d4ed73960043a2
Instruction ID: 3a8986cad5592f76ba29e678342756a8049d086ba88eabc6fde84b3762841027
Opcode Fuzzy Hash: 7c33793ac23e20373fd839102bd14160c22790032c1c39f818d4ed73960043a2
Instruction Fuzzy Hash: 0721D531A002589BDF15EF94CC45BEE7BF8AF49314F00401AE908A7241DBB85A8DAFA1

Function 00FC901B Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 51COMMON

Download Yara Rule

APIs

_memmove.LIBCMT ref: 00FC9036
__fread_nolock.LIBCMT ref: 00FC904B

Strings

EA06, xrefs: 00FC907D

Memory Dump Source

Source File: 00000000.00000002.1667912702.0000000000F61000.00000020.00000001.01000000.00000003.sdmp, Offset: 00F60000, based on PE: true

Associated: 00000000.00000002.1667891216.0000000000F60000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667966851.0000000000FEF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667966851.0000000001015000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1668035777.000000000101F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1668053678.0000000001028000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f60000_tgBNtoWqIp.jbxd

Similarity

API ID: __fread_nolock_memmove
String ID: EA06
API String ID: 1988441806-3962188686
Opcode ID: 11b269ff0950ab5ac043a06c60b47b4b2f5efbd688b2f307f651cfbe7341cbf6
Instruction ID: 83a39b2583e4d06ab22d145f6862a044c79e97e3e1e8f0305218fb3bd0654070
Opcode Fuzzy Hash: 11b269ff0950ab5ac043a06c60b47b4b2f5efbd688b2f307f651cfbe7341cbf6
Instruction Fuzzy Hash: 1201D672944258AEDB28D6A8CC1AFEE7BF89B01301F00419EE552D2181E5B9A6049760

Function 00FC9B6D Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 16COMMON

Download Yara Rule

APIs

GetTempPathW.KERNEL32(00000104,?), ref: 00FC9B82
GetTempFileNameW.KERNELBASE(?,aut,00000000,?), ref: 00FC9B99

Strings

aut, xrefs: 00FC9B93

Memory Dump Source

Source File: 00000000.00000002.1667912702.0000000000F61000.00000020.00000001.01000000.00000003.sdmp, Offset: 00F60000, based on PE: true

Associated: 00000000.00000002.1667891216.0000000000F60000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667966851.0000000000FEF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667966851.0000000001015000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1668035777.000000000101F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1668053678.0000000001028000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f60000_tgBNtoWqIp.jbxd

Similarity

API ID: Temp$FileNamePath
String ID: aut
API String ID: 3285503233-3010740371
Opcode ID: 796307124f4e7a248dcf3fc5f1d90acd854824f52cf1428033b1f4b1693a16c9
Instruction ID: 1fbb31ee1ed7a8e3add00ef86651afd18be6444a5403ec7fae1b3fcab5ec9767
Opcode Fuzzy Hash: 796307124f4e7a248dcf3fc5f1d90acd854824f52cf1428033b1f4b1693a16c9
Instruction Fuzzy Hash: 57D05E7958030DABDB109B94DC4EF9A772CE744700F0042A1BF949A0A2DEB455989B91

Function 00FDCDF1 Relevance: 4.9, APIs: 3, Instructions: 392COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1667912702.0000000000F61000.00000020.00000001.01000000.00000003.sdmp, Offset: 00F60000, based on PE: true

Associated: 00000000.00000002.1667891216.0000000000F60000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667966851.0000000000FEF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667966851.0000000001015000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1668035777.000000000101F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1668053678.0000000001028000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f60000_tgBNtoWqIp.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: af722ba9cb9dfe0552636e9ef73a709459d9c8963562188aa1a99ba8e25d2f8c
Instruction ID: 3e4c84887de05b0a473d6f6bdeb4305956b4a005fff3d527ce027f0d6d7b731b
Opcode Fuzzy Hash: af722ba9cb9dfe0552636e9ef73a709459d9c8963562188aa1a99ba8e25d2f8c
Instruction Fuzzy Hash: 84F17C719083019FC714DF28C884A6ABBE6FF88314F18892EF8999B351D775E945DF82

Function 00F6F8CF Relevance: 4.7, APIs: 3, Instructions: 168comCOMMON

Download Yara Rule

APIs

Part of subcall function 00F803A2: MapVirtualKeyW.USER32(0000005B,00000000), ref: 00F803D3
Part of subcall function 00F803A2: MapVirtualKeyW.USER32(00000010,00000000), ref: 00F803DB
Part of subcall function 00F803A2: MapVirtualKeyW.USER32(000000A0,00000000), ref: 00F803E6
Part of subcall function 00F803A2: MapVirtualKeyW.USER32(000000A1,00000000), ref: 00F803F1
Part of subcall function 00F803A2: MapVirtualKeyW.USER32(00000011,00000000), ref: 00F803F9
Part of subcall function 00F803A2: MapVirtualKeyW.USER32(00000012,00000000), ref: 00F80401

Part of subcall function 00F76259: RegisterWindowMessageW.USER32(WM_GETCONTROLNAME,?,00F6FA90), ref: 00F762B4

GetStdHandle.KERNEL32(000000F6,00000000,00000000), ref: 00F6FB2D
OleInitialize.OLE32(00000000), ref: 00F6FBAA
CloseHandle.KERNEL32(00000000), ref: 00FA49F2

Memory Dump Source

Source File: 00000000.00000002.1667912702.0000000000F61000.00000020.00000001.01000000.00000003.sdmp, Offset: 00F60000, based on PE: true

Associated: 00000000.00000002.1667891216.0000000000F60000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667966851.0000000000FEF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667966851.0000000001015000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1668035777.000000000101F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1668053678.0000000001028000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f60000_tgBNtoWqIp.jbxd

Similarity

API ID: Virtual$Handle$CloseInitializeMessageRegisterWindow
String ID:
API String ID: 1986988660-0
Opcode ID: d0b2d8b77b0226dfb9082d19e113e5471a3733a320b3e901aae80a3613044b55
Instruction ID: 7eb523e098d4b1079cec0e0368caee11bcd04abdd9da11a12959c75b6564a710
Opcode Fuzzy Hash: d0b2d8b77b0226dfb9082d19e113e5471a3733a320b3e901aae80a3613044b55
Instruction Fuzzy Hash: 6181B7B0901290CFC3B4EF29E9546257AE6FB99308760816ADCD9C725AEF3F9508DF11

Function 00F643DB Relevance: 4.6, APIs: 3, Instructions: 77windowCOMMON

Download Yara Rule

APIs

_memset.LIBCMT ref: 00F64401
Shell_NotifyIconW.SHELL32(00000000,?), ref: 00F644A6
Shell_NotifyIconW.SHELL32(00000001,?), ref: 00F644C3

Memory Dump Source

Source File: 00000000.00000002.1667912702.0000000000F61000.00000020.00000001.01000000.00000003.sdmp, Offset: 00F60000, based on PE: true

Associated: 00000000.00000002.1667891216.0000000000F60000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667966851.0000000000FEF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667966851.0000000001015000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1668035777.000000000101F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1668053678.0000000001028000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f60000_tgBNtoWqIp.jbxd

Similarity

API ID: IconNotifyShell_$_memset
String ID:
API String ID: 1505330794-0
Opcode ID: 0b1bb006fecd8ebce2926d5b68d3a0a33ae0411cb575f09318f6046708b7456e
Instruction ID: 88fb8620882ccca82304a7e824e1aefff9241027018145a2ae008d133d8854c0
Opcode Fuzzy Hash: 0b1bb006fecd8ebce2926d5b68d3a0a33ae0411cb575f09318f6046708b7456e
Instruction Fuzzy Hash: E53161719047018FD731EF24D885B9BBBF8FB49314F10092EE99A87241DB76A948DB92

Function 00F8594C Relevance: 4.6, APIs: 3, Instructions: 59memoryCOMMONLIBRARYCODE

Download Yara Rule

APIs

__FF_MSGBANNER.LIBCMT ref: 00F85963

Part of subcall function 00F8A3AB: __NMSG_WRITE.LIBCMT ref: 00F8A3D2
Part of subcall function 00F8A3AB: __NMSG_WRITE.LIBCMT ref: 00F8A3DC

__NMSG_WRITE.LIBCMT ref: 00F8596A

Part of subcall function 00F8A408: GetModuleFileNameW.KERNEL32(00000000,010243BA,00000104,?,00000001,00000000), ref: 00F8A49A
Part of subcall function 00F8A408: ___crtMessageBoxW.LIBCMT ref: 00F8A548

Part of subcall function 00F832DF: ___crtCorExitProcess.LIBCMT ref: 00F832E5
Part of subcall function 00F832DF: ExitProcess.KERNEL32 ref: 00F832EE

Part of subcall function 00F88D68: __getptd_noexit.LIBCMT ref: 00F88D68

RtlAllocateHeap.NTDLL(01A70000,00000000,00000001,00000000,?,?,?,00F81013,?), ref: 00F8598F

Memory Dump Source

Source File: 00000000.00000002.1667912702.0000000000F61000.00000020.00000001.01000000.00000003.sdmp, Offset: 00F60000, based on PE: true

Associated: 00000000.00000002.1667891216.0000000000F60000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667966851.0000000000FEF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667966851.0000000001015000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1668035777.000000000101F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1668053678.0000000001028000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f60000_tgBNtoWqIp.jbxd

Similarity

API ID: ExitProcess___crt$AllocateFileHeapMessageModuleName__getptd_noexit
String ID:
API String ID: 1372826849-0
Opcode ID: 5dcc358f3f60b661fb047c8f09e37305af9ecc37510e5ab49195a92439a5425a
Instruction ID: 9ca854912bd613e883af7ac763beea84a0541a51f0e3bd6885398821f797ce35
Opcode Fuzzy Hash: 5dcc358f3f60b661fb047c8f09e37305af9ecc37510e5ab49195a92439a5425a
Instruction Fuzzy Hash: C5019232701A1ADFE6317B65DC42BED72989F52F70F50002AF4059A1D1EA799D01B7A1

Function 00FC9B2C Relevance: 4.5, APIs: 3, Instructions: 24filetimeCOMMON

Download Yara Rule

APIs

CreateFileW.KERNELBASE(?,40000000,00000001,00000000,00000003,00000080,00000000,?,?,00FC97D2,?,?,?,?,?,00000004), ref: 00FC9B45
SetFileTime.KERNELBASE(00000000,?,00000000,?,?,00FC97D2,?,?,?,?,?,00000004,00000001,?,?,00000004), ref: 00FC9B5B
CloseHandle.KERNEL32(00000000,?,00FC97D2,?,?,?,?,?,00000004,00000001,?,?,00000004,00000001,?,?), ref: 00FC9B62

Memory Dump Source

Source File: 00000000.00000002.1667912702.0000000000F61000.00000020.00000001.01000000.00000003.sdmp, Offset: 00F60000, based on PE: true

Associated: 00000000.00000002.1667891216.0000000000F60000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667966851.0000000000FEF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667966851.0000000001015000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1668035777.000000000101F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1668053678.0000000001028000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f60000_tgBNtoWqIp.jbxd

Similarity

API ID: File$CloseCreateHandleTime
String ID:
API String ID: 3397143404-0
Opcode ID: 2007830b81814273105d2aee5706d60a6a22e515b078f7416ffcdd024b28a242
Instruction ID: 78ecac86bcf6d689a87ae61c9da993a2443f2331e5e221b3df0baf20f6c8aa13
Opcode Fuzzy Hash: 2007830b81814273105d2aee5706d60a6a22e515b078f7416ffcdd024b28a242
Instruction Fuzzy Hash: BAE0863258021CBBD7211B54EC4AFCA7B28AB05771F108120FB246D0E087B22A15A798

Function 00FC8F97 Relevance: 4.5, APIs: 3, Instructions: 22COMMON

Download Yara Rule

APIs

_free.LIBCMT ref: 00FC8FA5

Part of subcall function 00F82F95: RtlFreeHeap.NTDLL(00000000,00000000,?,00F89C64), ref: 00F82FA9
Part of subcall function 00F82F95: GetLastError.KERNEL32(00000000,?,00F89C64), ref: 00F82FBB

_free.LIBCMT ref: 00FC8FB6
_free.LIBCMT ref: 00FC8FC8

Memory Dump Source

Source File: 00000000.00000002.1667912702.0000000000F61000.00000020.00000001.01000000.00000003.sdmp, Offset: 00F60000, based on PE: true

Associated: 00000000.00000002.1667891216.0000000000F60000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667966851.0000000000FEF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667966851.0000000001015000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1668035777.000000000101F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1668053678.0000000001028000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f60000_tgBNtoWqIp.jbxd

Similarity

API ID: _free$ErrorFreeHeapLast
String ID:
API String ID: 776569668-0
Opcode ID: 358057a8cee776a4634d1da6a11f7167cf7af4a4bc472a0de26b354d0d310ced
Instruction ID: 634a04de83f63d42e8923359a641e4bd70f5d8c0a2cca2f49003c5e05ff32335
Opcode Fuzzy Hash: 358057a8cee776a4634d1da6a11f7167cf7af4a4bc472a0de26b354d0d310ced
Instruction Fuzzy Hash: 59E012B1B097025ACA64B578AE45FD367EE5F483A0B18081DB509DB146DE28F842E264

Function 00F6AB23 Relevance: 4.0, APIs: 1, Strings: 1, Instructions: 534COMMON

Download Yara Rule

Strings

CALL, xrefs: 00FA002B

Memory Dump Source

Source File: 00000000.00000002.1667912702.0000000000F61000.00000020.00000001.01000000.00000003.sdmp, Offset: 00F60000, based on PE: true

Associated: 00000000.00000002.1667891216.0000000000F60000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667966851.0000000000FEF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667966851.0000000001015000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1668035777.000000000101F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1668053678.0000000001028000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f60000_tgBNtoWqIp.jbxd

Similarity

API ID:
String ID: CALL
API String ID: 0-4196123274
Opcode ID: ca8d59f1486bfb829086e8e5386abda19db6c0cf7219f3dcf7cf5188e47cab01
Instruction ID: edaa44fd205d21e6c790815026d08f7e7cdf8efd5acd89b3cd51945a30516c20
Opcode Fuzzy Hash: ca8d59f1486bfb829086e8e5386abda19db6c0cf7219f3dcf7cf5188e47cab01
Instruction Fuzzy Hash: AC223771908341DFC724DF14C890B6ABBE1BF85314F14895DE89A9B262DB35EC85EF82

Function 00F64DD0 Relevance: 3.6, APIs: 1, Strings: 1, Instructions: 141COMMON

Download Yara Rule

APIs

_memmove.LIBCMT ref: 00F64E1A

Strings

EA06, xrefs: 00F9DCF5

Memory Dump Source

Source File: 00000000.00000002.1667912702.0000000000F61000.00000020.00000001.01000000.00000003.sdmp, Offset: 00F60000, based on PE: true

Associated: 00000000.00000002.1667891216.0000000000F60000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667966851.0000000000FEF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667966851.0000000001015000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1668035777.000000000101F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1668053678.0000000001028000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f60000_tgBNtoWqIp.jbxd

Similarity

API ID: _memmove
String ID: EA06
API String ID: 4104443479-3962188686
Opcode ID: fc29e762804e69cd500a786a9d5e925f6fe634c8f25cd4de372239f17203847e
Instruction ID: cf03b7efe680a80735e2ea83078a2da9db54ee0b3032e114aceb065c3ffdda7a
Opcode Fuzzy Hash: fc29e762804e69cd500a786a9d5e925f6fe634c8f25cd4de372239f17203847e
Instruction Fuzzy Hash: A4417D32E04154ABDF11BB64CD517BF7F66AB15310F284065F882AB282C526AD44B7E1

Function 00F6492E Relevance: 3.1, APIs: 2, Instructions: 59COMMON

Download Yara Rule

APIs

IsThemeActive.UXTHEME ref: 00F64992

Part of subcall function 00F835AC: __lock.LIBCMT ref: 00F835B2
Part of subcall function 00F835AC: DecodePointer.KERNEL32(00000001,?,00F649A7,00FB81BC), ref: 00F835BE
Part of subcall function 00F835AC: EncodePointer.KERNEL32(?,?,00F649A7,00FB81BC), ref: 00F835C9

Part of subcall function 00F64A5B: SystemParametersInfoW.USER32(00002000,00000000,?,00000000), ref: 00F64A73
Part of subcall function 00F64A5B: SystemParametersInfoW.USER32(00002001,00000000,00000000,00000002), ref: 00F64A88

Part of subcall function 00F63B4C: GetCurrentDirectoryW.KERNEL32(00007FFF,?), ref: 00F63B7A
Part of subcall function 00F63B4C: IsDebuggerPresent.KERNEL32 ref: 00F63B8C
Part of subcall function 00F63B4C: GetFullPathNameW.KERNEL32(00007FFF,?,?,010262F8,010262E0,?,?), ref: 00F63BFD
Part of subcall function 00F63B4C: SetCurrentDirectoryW.KERNEL32(?), ref: 00F63C81

SystemParametersInfoW.USER32(00002001,00000000,00000000,00000002), ref: 00F649D2

Memory Dump Source

Source File: 00000000.00000002.1667912702.0000000000F61000.00000020.00000001.01000000.00000003.sdmp, Offset: 00F60000, based on PE: true

Associated: 00000000.00000002.1667891216.0000000000F60000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667966851.0000000000FEF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667966851.0000000001015000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1668035777.000000000101F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1668053678.0000000001028000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f60000_tgBNtoWqIp.jbxd

Similarity

API ID: InfoParametersSystem$CurrentDirectoryPointer$ActiveDebuggerDecodeEncodeFullNamePathPresentTheme__lock
String ID:
API String ID: 1438897964-0
Opcode ID: e3e29321bb4f94f764bb48601672fdbd72a50e05e903dfc20aee7aea8eee7d2f
Instruction ID: 24c6cf3ddb28876dba3093327a37f23b22dcd6f95ef4e2854c642a1cf0a4754f
Opcode Fuzzy Hash: e3e29321bb4f94f764bb48601672fdbd72a50e05e903dfc20aee7aea8eee7d2f
Instruction Fuzzy Hash: 7111DF719083019FC320EF68DC4590AFFF8EF95710F10451EF880872A2DBBA9648EB92

Function 00F65DF9 Relevance: 3.1, APIs: 2, Instructions: 57fileCOMMON

Download Yara Rule

APIs

CreateFileW.KERNELBASE(?,80000000,00000007,00000000,00000003,00000080,00000000,?,00000000,?,00F65981,?,?,?,?), ref: 00F65E27
CreateFileW.KERNEL32(?,C0000000,00000007,00000000,00000004,00000080,00000000,?,00000000,?,00F65981,?,?,?,?), ref: 00F9E19C

Memory Dump Source

Source File: 00000000.00000002.1667912702.0000000000F61000.00000020.00000001.01000000.00000003.sdmp, Offset: 00F60000, based on PE: true

Associated: 00000000.00000002.1667891216.0000000000F60000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667966851.0000000000FEF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667966851.0000000001015000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1668035777.000000000101F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1668053678.0000000001028000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f60000_tgBNtoWqIp.jbxd

Similarity

API ID: CreateFile
String ID:
API String ID: 823142352-0
Opcode ID: 538bc749be24a84df7a697041d2f0c52fd666313b5c21890b8e661040a9e7212
Instruction ID: 16b18db40eef45cbe483279ace0b24f9f01ecff64635436c44133061611fa6df
Opcode Fuzzy Hash: 538bc749be24a84df7a697041d2f0c52fd666313b5c21890b8e661040a9e7212
Instruction Fuzzy Hash: 7301B971644708BEF7244E24CC86F66379CEB11B78F10C314BAE56A1D0C6B51D459B50

Function 00F80FF6 Relevance: 3.0, APIs: 2, Instructions: 44COMMONLIBRARYCODE

Download Yara Rule

APIs

Part of subcall function 00F8594C: __FF_MSGBANNER.LIBCMT ref: 00F85963
Part of subcall function 00F8594C: __NMSG_WRITE.LIBCMT ref: 00F8596A
Part of subcall function 00F8594C: RtlAllocateHeap.NTDLL(01A70000,00000000,00000001,00000000,?,?,?,00F81013,?), ref: 00F8598F

std::exception::exception.LIBCMT ref: 00F8102C
__CxxThrowException@8.LIBCMT ref: 00F81041

Part of subcall function 00F887DB: RaiseException.KERNEL32(?,?,?,0101BAF8,00000000,?,?,?,?,00F81046,?,0101BAF8,?,00000001), ref: 00F88830

Memory Dump Source

Source File: 00000000.00000002.1667912702.0000000000F61000.00000020.00000001.01000000.00000003.sdmp, Offset: 00F60000, based on PE: true

Associated: 00000000.00000002.1667891216.0000000000F60000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667966851.0000000000FEF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667966851.0000000001015000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1668035777.000000000101F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1668053678.0000000001028000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f60000_tgBNtoWqIp.jbxd

Similarity

API ID: AllocateExceptionException@8HeapRaiseThrowstd::exception::exception
String ID:
API String ID: 3902256705-0
Opcode ID: 272f805b5845306bf7599048bb34c984dcbe052a77da00bafac1df2e35a4a693
Instruction ID: 73c402eb4091755eccf9f560a21e24ea4352a63a14eeb9aff9ff36a78aa24a3f
Opcode Fuzzy Hash: 272f805b5845306bf7599048bb34c984dcbe052a77da00bafac1df2e35a4a693
Instruction Fuzzy Hash: 3DF0C83550031DA7CB20BE58EC059EF7BACAF01761F500525F90496552EFB5CA82B7D5

Function 00F8582D Relevance: 3.0, APIs: 2, Instructions: 42COMMONLIBRARYCODE

Download Yara Rule

APIs

_memset.LIBCMT ref: 00F8585C
__lock_file.LIBCMT ref: 00F8587D

Memory Dump Source

Source File: 00000000.00000002.1667912702.0000000000F61000.00000020.00000001.01000000.00000003.sdmp, Offset: 00F60000, based on PE: true

Associated: 00000000.00000002.1667891216.0000000000F60000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667966851.0000000000FEF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667966851.0000000001015000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1668035777.000000000101F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1668053678.0000000001028000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f60000_tgBNtoWqIp.jbxd

Similarity

API ID: __lock_file_memset
String ID:
API String ID: 26237723-0
Opcode ID: 09006ee1ade4ab37f10f057cf5d92c0c312237deec762fca381d2914cfd3fdb2
Instruction ID: ed6684998855023a0878fee3e07ed90d47f684b7f8228eb1c52c78351751c7ac
Opcode Fuzzy Hash: 09006ee1ade4ab37f10f057cf5d92c0c312237deec762fca381d2914cfd3fdb2
Instruction Fuzzy Hash: 6A016771C40609EBCF22BF698C065DF7F71AF80BA0F548256F8245B161DB398A52FB91

Function 00F855D6 Relevance: 3.0, APIs: 2, Instructions: 33COMMONLIBRARYCODE

Download Yara Rule

APIs

Part of subcall function 00F88D68: __getptd_noexit.LIBCMT ref: 00F88D68

__lock_file.LIBCMT ref: 00F8561B

Part of subcall function 00F86E4E: __lock.LIBCMT ref: 00F86E71

__fclose_nolock.LIBCMT ref: 00F85626

Memory Dump Source

Source File: 00000000.00000002.1667912702.0000000000F61000.00000020.00000001.01000000.00000003.sdmp, Offset: 00F60000, based on PE: true

Associated: 00000000.00000002.1667891216.0000000000F60000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667966851.0000000000FEF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667966851.0000000001015000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1668035777.000000000101F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1668053678.0000000001028000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f60000_tgBNtoWqIp.jbxd

Similarity

API ID: __fclose_nolock__getptd_noexit__lock__lock_file
String ID:
API String ID: 2800547568-0
Opcode ID: 461b9d67b73e06a6e4df0e015d091b442f177fc53597cc38a560c439180effba
Instruction ID: c97a5f1aad0e89151e19bd246f60776d9f1cb8a3b1dca885d83250d5036d71e4
Opcode Fuzzy Hash: 461b9d67b73e06a6e4df0e015d091b442f177fc53597cc38a560c439180effba
Instruction Fuzzy Hash: 8DF0B472D00A059BDB20BF758C027EE77E16F80B74F958209E424AB1C1DF7C8902BB55

Function 011B129D Relevance: 1.9, APIs: 1, Instructions: 400processthreadCOMMON

Download Yara Rule

APIs

CreateProcessW.KERNELBASE(?,00000000), ref: 011B1ACD
Wow64GetThreadContext.KERNEL32(?,00010007), ref: 011B1AF1
ReadProcessMemory.KERNELBASE(?,?,?,00000004,00000000), ref: 011B1B13

Memory Dump Source

Source File: 00000000.00000002.1668313329.00000000011B0000.00000040.00001000.00020000.00000000.sdmp, Offset: 011B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_11b0000_tgBNtoWqIp.jbxd

Similarity

API ID: Process$ContextCreateMemoryReadThreadWow64
String ID:
API String ID: 2438371351-0
Opcode ID: d88754d343c0358fec48bb39518f6d050a5efe1528146ba10a354079ac39ca1d
Instruction ID: 9a7c3e6ab84e47ae20fd0e6c44b87f9f35d1c6ebf1758e909ce18fdfec85f03c
Opcode Fuzzy Hash: d88754d343c0358fec48bb39518f6d050a5efe1528146ba10a354079ac39ca1d
Instruction Fuzzy Hash: AD12CE24E24658C6EB24DF64D8507DEB232EF68300F1090E9D10DEB7A5E77A4F81CB5A

Function 00F72123 Relevance: 1.7, APIs: 1, Instructions: 171COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1667912702.0000000000F61000.00000020.00000001.01000000.00000003.sdmp, Offset: 00F60000, based on PE: true

Associated: 00000000.00000002.1667891216.0000000000F60000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667966851.0000000000FEF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667966851.0000000001015000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1668035777.000000000101F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1668053678.0000000001028000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f60000_tgBNtoWqIp.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 93d1e336fa0ea888ad52ae5f4bcde813d50d1d9407c2b93e348033ef9228a7d2
Instruction ID: 975203c8467b7f75e6d368adcddc4aca9a796f7a8fabbfe23067d04736389094
Opcode Fuzzy Hash: 93d1e336fa0ea888ad52ae5f4bcde813d50d1d9407c2b93e348033ef9228a7d2
Instruction Fuzzy Hash: 57518335600604AFCF14EB54CD91FAE77A6AF45720F188169F90AAB392CF38ED05EB51

Function 00F6766F Relevance: 1.6, APIs: 1, Instructions: 103COMMON

Download Yara Rule

APIs

_memmove.LIBCMT ref: 00F6774A

Memory Dump Source

Source File: 00000000.00000002.1667912702.0000000000F61000.00000020.00000001.01000000.00000003.sdmp, Offset: 00F60000, based on PE: true

Associated: 00000000.00000002.1667891216.0000000000F60000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667966851.0000000000FEF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667966851.0000000001015000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1668035777.000000000101F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1668053678.0000000001028000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f60000_tgBNtoWqIp.jbxd

Similarity

API ID: _memmove
String ID:
API String ID: 4104443479-0
Opcode ID: 2548961d131164ccd24838d8a9b11557f428afeebf0c8d981de7b88311caff12
Instruction ID: f07d78d28efbda203a570d7625821c938ed127ad90895cce3080aa9065aea717
Opcode Fuzzy Hash: 2548961d131164ccd24838d8a9b11557f428afeebf0c8d981de7b88311caff12
Instruction Fuzzy Hash: C2319679608B02DFD724EF18C490A62F7A0FF09320714C569E959CB765EB30E891EB54

Function 00F65C4E Relevance: 1.6, APIs: 1, Instructions: 97COMMON

Download Yara Rule

APIs

SetFilePointerEx.KERNELBASE(?,?,00000001,00000000,00000000,?,?,00000000), ref: 00F65CF6

Memory Dump Source

Source File: 00000000.00000002.1667912702.0000000000F61000.00000020.00000001.01000000.00000003.sdmp, Offset: 00F60000, based on PE: true

Associated: 00000000.00000002.1667891216.0000000000F60000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667966851.0000000000FEF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667966851.0000000001015000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1668035777.000000000101F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1668053678.0000000001028000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f60000_tgBNtoWqIp.jbxd

Similarity

API ID: FilePointer
String ID:
API String ID: 973152223-0
Opcode ID: cc2dc086fc6fc20bfb590a2eabc2e03770d58b8e24e496b8f5c71fabd74943ff
Instruction ID: add746f4b1faa439e169648d67854aa6a68e00aa6bc1c7bf0aff26245189f7cd
Opcode Fuzzy Hash: cc2dc086fc6fc20bfb590a2eabc2e03770d58b8e24e496b8f5c71fabd74943ff
Instruction Fuzzy Hash: 57315071A00B1AAFCB18DF6DC88465DB7B5FF48720F148629D819A3750D771BD50EB90

Function 00FA00D6 Relevance: 1.6, APIs: 1, Instructions: 88COMMON

Download Yara Rule

APIs

VariantClear.OLEAUT32 ref: 00FA00E1

Memory Dump Source

Source File: 00000000.00000002.1667912702.0000000000F61000.00000020.00000001.01000000.00000003.sdmp, Offset: 00F60000, based on PE: true

Associated: 00000000.00000002.1667891216.0000000000F60000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667966851.0000000000FEF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667966851.0000000001015000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1668035777.000000000101F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1668053678.0000000001028000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f60000_tgBNtoWqIp.jbxd

Similarity

API ID: ClearVariant
String ID:
API String ID: 1473721057-0
Opcode ID: 8e64d6ee15f627713c99a849e6e7b2249e0cadb4d641632c27719812f757aba6
Instruction ID: c9136f3fed8f2b23e4ed964e3cf45c04d53056eb0d017c0928772d39dd86961d
Opcode Fuzzy Hash: 8e64d6ee15f627713c99a849e6e7b2249e0cadb4d641632c27719812f757aba6
Instruction Fuzzy Hash: 4E410974908351CFDB14DF14C884B1ABBE0BF45318F1989ACE8999B362C776E885DF52

Function 00F64F3D Relevance: 1.6, APIs: 1, Instructions: 64libraryCOMMON

Download Yara Rule

APIs

Part of subcall function 00F64D13: FreeLibrary.KERNEL32(00000000,?), ref: 00F64D4D

Part of subcall function 00F8548B: __wfsopen.LIBCMT ref: 00F85496

LoadLibraryExW.KERNELBASE(?,00000000,00000002,?,010262F8,00000001,>>>AUTOIT NO CMDEXECUTE<<<,?), ref: 00F64F6F

Part of subcall function 00F64CC8: FreeLibrary.KERNEL32(00000000), ref: 00F64D02

Part of subcall function 00F64DD0: _memmove.LIBCMT ref: 00F64E1A

Memory Dump Source

Source File: 00000000.00000002.1667912702.0000000000F61000.00000020.00000001.01000000.00000003.sdmp, Offset: 00F60000, based on PE: true

Associated: 00000000.00000002.1667891216.0000000000F60000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667966851.0000000000FEF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667966851.0000000001015000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1668035777.000000000101F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1668053678.0000000001028000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f60000_tgBNtoWqIp.jbxd

Similarity

API ID: Library$Free$Load__wfsopen_memmove
String ID:
API String ID: 1396898556-0
Opcode ID: 61ad8b510f8278c09845b971f6dfb02f94b2100170bfc3b15d0783e0ba595d9b
Instruction ID: 864ae6a472e5eeca4e229ee2f82d99cf574320bd4a28e595d56e98af19860722
Opcode Fuzzy Hash: 61ad8b510f8278c09845b971f6dfb02f94b2100170bfc3b15d0783e0ba595d9b
Instruction Fuzzy Hash: F311EB31A0020AABDF10FF70CC12F9D77A49F40710F108429F541AB1C1DA79AA05BB60

Function 00FA01AF Relevance: 1.6, APIs: 1, Instructions: 63COMMON

Download Yara Rule

APIs

VariantClear.OLEAUT32(?), ref: 00FA01BB

Memory Dump Source

Source File: 00000000.00000002.1667912702.0000000000F61000.00000020.00000001.01000000.00000003.sdmp, Offset: 00F60000, based on PE: true

Associated: 00000000.00000002.1667891216.0000000000F60000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667966851.0000000000FEF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667966851.0000000001015000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1668035777.000000000101F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1668053678.0000000001028000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f60000_tgBNtoWqIp.jbxd

Similarity

API ID: ClearVariant
String ID:
API String ID: 1473721057-0
Opcode ID: 0bf4de0d2faba94f2c623f32b10c7df16044911b42a841ce33952fc15d695be1
Instruction ID: ab5a338c1d49e48aa3a4e1c20f1c44dbb0ac0e4ba1e40648514b2beba925ba35
Opcode Fuzzy Hash: 0bf4de0d2faba94f2c623f32b10c7df16044911b42a841ce33952fc15d695be1
Instruction Fuzzy Hash: F42113B4908341CFCB14DF24C844B5ABBE4BF85314F048968E88A57761D736E849EF53

Function 00F65D20 Relevance: 1.6, APIs: 1, Instructions: 53fileCOMMON

Download Yara Rule

APIs

ReadFile.KERNELBASE(?,?,00010000,?,00000000,00000000,?,00010000,?,00F65807,00000000,00010000,00000000,00000000,00000000,00000000), ref: 00F65D76

Memory Dump Source

Source File: 00000000.00000002.1667912702.0000000000F61000.00000020.00000001.01000000.00000003.sdmp, Offset: 00F60000, based on PE: true

Associated: 00000000.00000002.1667891216.0000000000F60000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667966851.0000000000FEF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667966851.0000000001015000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1668035777.000000000101F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1668053678.0000000001028000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f60000_tgBNtoWqIp.jbxd

Similarity

API ID: FileRead
String ID:
API String ID: 2738559852-0
Opcode ID: 1e316d16e04a26e66aab5c1edf72433f7e3e72a479091e5213b9fa4a82089845
Instruction ID: 64b794178f5d53e726da43595e7687720e5ebca737ba42f609ee976b8c2c0029
Opcode Fuzzy Hash: 1e316d16e04a26e66aab5c1edf72433f7e3e72a479091e5213b9fa4a82089845
Instruction Fuzzy Hash: 06113A31608B059FD3308F15C884B66B7E5EF45B60F10C92EE9AA96A90D770E945EB60

Function 00F67F41 Relevance: 1.5, APIs: 1, Instructions: 47COMMON

Download Yara Rule

APIs

_memmove.LIBCMT ref: 00F67F82

Memory Dump Source

Source File: 00000000.00000002.1667912702.0000000000F61000.00000020.00000001.01000000.00000003.sdmp, Offset: 00F60000, based on PE: true

Associated: 00000000.00000002.1667891216.0000000000F60000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667966851.0000000000FEF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667966851.0000000001015000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1668035777.000000000101F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1668053678.0000000001028000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f60000_tgBNtoWqIp.jbxd

Similarity

API ID: _memmove
String ID:
API String ID: 4104443479-0
Opcode ID: 81493697be757b975a0c6ed5652a7c4d93deff9418cd33d5771e7bc70a58f4b3
Instruction ID: b06c87434ee52778bcbba69eefb7896edbc446abed33a869021a588891c80fb2
Opcode Fuzzy Hash: 81493697be757b975a0c6ed5652a7c4d93deff9418cd33d5771e7bc70a58f4b3
Instruction Fuzzy Hash: D901F973204701BED3206F38CC06FA7BB98EB44760F10862EFA5ACA1D1EE35E400A790

Function 00F84A93 Relevance: 1.5, APIs: 1, Instructions: 36COMMON

Download Yara Rule

APIs

__lock_file.LIBCMT ref: 00F84AD6

Part of subcall function 00F88D68: __getptd_noexit.LIBCMT ref: 00F88D68

Memory Dump Source

Source File: 00000000.00000002.1667912702.0000000000F61000.00000020.00000001.01000000.00000003.sdmp, Offset: 00F60000, based on PE: true

Associated: 00000000.00000002.1667891216.0000000000F60000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667966851.0000000000FEF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667966851.0000000001015000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1668035777.000000000101F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1668053678.0000000001028000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f60000_tgBNtoWqIp.jbxd

Similarity

API ID: __getptd_noexit__lock_file
String ID:
API String ID: 2597487223-0
Opcode ID: e1dd6e8c36610ed905c7ced706bcfac3b147c49565d4da327dc471961637ebd1
Instruction ID: 2def77366175cf232db8cb6a51acd18948c370c3a4a37b495e947319e4bc9456
Opcode Fuzzy Hash: e1dd6e8c36610ed905c7ced706bcfac3b147c49565d4da327dc471961637ebd1
Instruction Fuzzy Hash: A2F0AF3294020AABDF61BF648C063EE76A1AF40375F448518F424AA1D1DB7C9A51FF55

Function 00F64FAA Relevance: 1.5, APIs: 1, Instructions: 28COMMON

Download Yara Rule

APIs

FreeLibrary.KERNEL32(?,?,010262F8,00000001,>>>AUTOIT NO CMDEXECUTE<<<,?), ref: 00F64FDE

Memory Dump Source

Source File: 00000000.00000002.1667912702.0000000000F61000.00000020.00000001.01000000.00000003.sdmp, Offset: 00F60000, based on PE: true

Associated: 00000000.00000002.1667891216.0000000000F60000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667966851.0000000000FEF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667966851.0000000001015000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1668035777.000000000101F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1668053678.0000000001028000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f60000_tgBNtoWqIp.jbxd

Similarity

API ID: FreeLibrary
String ID:
API String ID: 3664257935-0
Opcode ID: 491600b8ce834edfcd96894069ae5afc564de12fdfc00686c06ab9bbff58a3f5
Instruction ID: b1c729a45433f2c95b868ac136221c144b22c1b9e906be250bcd9ed657b4faa4
Opcode Fuzzy Hash: 491600b8ce834edfcd96894069ae5afc564de12fdfc00686c06ab9bbff58a3f5
Instruction Fuzzy Hash: D9F03972505712CFCB34AF64E894812BBF1BF053293248A7EE1D687A20C771A844EF40

Function 00F809D5 Relevance: 1.5, APIs: 1, Instructions: 24COMMON

Download Yara Rule

APIs

GetLongPathNameW.KERNELBASE(?,?,00007FFF), ref: 00F809F4

Part of subcall function 00F67D2C: _memmove.LIBCMT ref: 00F67D66

Memory Dump Source

Source File: 00000000.00000002.1667912702.0000000000F61000.00000020.00000001.01000000.00000003.sdmp, Offset: 00F60000, based on PE: true

Associated: 00000000.00000002.1667891216.0000000000F60000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667966851.0000000000FEF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667966851.0000000001015000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1668035777.000000000101F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1668053678.0000000001028000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f60000_tgBNtoWqIp.jbxd

Similarity

API ID: LongNamePath_memmove
String ID:
API String ID: 2514874351-0
Opcode ID: 2500cadd7fdc10b5ccb2942823118a421f15035ebf85f3831f37a448b739bfc8
Instruction ID: 4b7df26cfa81e1835d1d19dd4f49b037cf6f24421f734eace866660816f17328
Opcode Fuzzy Hash: 2500cadd7fdc10b5ccb2942823118a421f15035ebf85f3831f37a448b739bfc8
Instruction Fuzzy Hash: C8E0CD3690422C57D720E6589C05FFA77EDDFC8790F0401B5FD0CD7204D9649C819690

Function 00FC9129 Relevance: 1.5, APIs: 1, Instructions: 22COMMON

Download Yara Rule

APIs

__fread_nolock.LIBCMT ref: 00FC914B

Memory Dump Source

Source File: 00000000.00000002.1667912702.0000000000F61000.00000020.00000001.01000000.00000003.sdmp, Offset: 00F60000, based on PE: true

Associated: 00000000.00000002.1667891216.0000000000F60000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667966851.0000000000FEF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667966851.0000000001015000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1668035777.000000000101F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1668053678.0000000001028000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f60000_tgBNtoWqIp.jbxd

Similarity

API ID: __fread_nolock
String ID:
API String ID: 2638373210-0
Opcode ID: 7603a7e23398706fbe611478ecf9e3358d47b441acc83f726054c373298f7434
Instruction ID: 7059298ab7b34b590fc086f13eb5a16e1c9342c5c4c9c10c972e3c1f2a6d1706
Opcode Fuzzy Hash: 7603a7e23398706fbe611478ecf9e3358d47b441acc83f726054c373298f7434
Instruction Fuzzy Hash: BFE092B0508B015FDB348A24D816BE373E0BB06315F04081DF29A83341EBA27841D759

Function 00F65DAE Relevance: 1.5, APIs: 1, Instructions: 16COMMON

Download Yara Rule

APIs

SetFilePointerEx.KERNELBASE(?,00000000,00000000,?,00000001,?,?,?,00F9E16B,?,?,00000000), ref: 00F65DBF

Memory Dump Source

Source File: 00000000.00000002.1667912702.0000000000F61000.00000020.00000001.01000000.00000003.sdmp, Offset: 00F60000, based on PE: true

Associated: 00000000.00000002.1667891216.0000000000F60000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667966851.0000000000FEF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667966851.0000000001015000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1668035777.000000000101F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1668053678.0000000001028000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f60000_tgBNtoWqIp.jbxd

Similarity

API ID: FilePointer
String ID:
API String ID: 973152223-0
Opcode ID: 4d48d8168d0a8a311f67702bbc9e70d019fd069ca16a1823523911295c2d5deb
Instruction ID: ac5018976054fcc171034a149300ee8ed3cb629a4c99d5aa64d2705332ec5b7f
Opcode Fuzzy Hash: 4d48d8168d0a8a311f67702bbc9e70d019fd069ca16a1823523911295c2d5deb
Instruction Fuzzy Hash: 9AD0C77464020CBFE710DB80DC46FA9777CD745711F100194FD0456290D6B27E549795

Function 00F8548B Relevance: 1.5, APIs: 1, Instructions: 9COMMON

Download Yara Rule

APIs

__wfsopen.LIBCMT ref: 00F85496

Memory Dump Source

Source File: 00000000.00000002.1667912702.0000000000F61000.00000020.00000001.01000000.00000003.sdmp, Offset: 00F60000, based on PE: true

Associated: 00000000.00000002.1667891216.0000000000F60000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667966851.0000000000FEF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667966851.0000000001015000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1668035777.000000000101F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1668053678.0000000001028000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f60000_tgBNtoWqIp.jbxd

Similarity

API ID: __wfsopen
String ID:
API String ID: 197181222-0
Opcode ID: 6ddf6e1ab81d7b85eaff3423c11cf18e9f26fa56f97d638f5b10e7f164e3c6f3
Instruction ID: 792fa0be3dbd2d1b3d7aca8e182dd421fef2fedd459f6e8dc61666bb40d32cd1
Opcode Fuzzy Hash: 6ddf6e1ab81d7b85eaff3423c11cf18e9f26fa56f97d638f5b10e7f164e3c6f3
Instruction Fuzzy Hash: CFB0927684020C77DF022E82EC03A993B199B40A78F808020FB0C18162A677A6A0A689

Function 00FCD2E6 Relevance: 1.4, APIs: 1, Instructions: 198COMMON

Download Yara Rule

APIs

GetLastError.KERNEL32(00000002,00000000), ref: 00FCD46A

Memory Dump Source

Source File: 00000000.00000002.1667912702.0000000000F61000.00000020.00000001.01000000.00000003.sdmp, Offset: 00F60000, based on PE: true

Associated: 00000000.00000002.1667891216.0000000000F60000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667966851.0000000000FEF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667966851.0000000001015000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1668035777.000000000101F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1668053678.0000000001028000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f60000_tgBNtoWqIp.jbxd

Similarity

API ID: ErrorLast
String ID:
API String ID: 1452528299-0
Opcode ID: 9c92a5d0690daa8c9511935aed2ca89c510cd1ab3d5f798687f26105c778538f
Instruction ID: 72f6ada8197a25d336fc3311317c0a1c1790ebef7d0b881ee237320217a37881
Opcode Fuzzy Hash: 9c92a5d0690daa8c9511935aed2ca89c510cd1ab3d5f798687f26105c778538f
Instruction Fuzzy Hash: FA7183306083028FC714EF64C992F6EB7E4AF84714F04492DF5969B2A2DB34ED09EB52

Function 00F80E48 Relevance: 1.3, APIs: 1, Instructions: 94memoryCOMMON

Download Yara Rule

APIs

VirtualAlloc.KERNELBASE ref: 00F80EF7

Memory Dump Source

Source File: 00000000.00000002.1667912702.0000000000F61000.00000020.00000001.01000000.00000003.sdmp, Offset: 00F60000, based on PE: true

Associated: 00000000.00000002.1667891216.0000000000F60000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667966851.0000000000FEF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667966851.0000000001015000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1668035777.000000000101F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1668053678.0000000001028000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f60000_tgBNtoWqIp.jbxd

Similarity

API ID: AllocVirtual
String ID:
API String ID: 4275171209-0
Opcode ID: 160be14eaa7db79452b6aeb530136e2f2731e3e0b6e758b09a27e7bca35b483d
Instruction ID: ce765f197264fef2f05f51adc8baca5792271c3eefb161db68786ea255bcf65a
Opcode Fuzzy Hash: 160be14eaa7db79452b6aeb530136e2f2731e3e0b6e758b09a27e7bca35b483d
Instruction Fuzzy Hash: 9B31E771A00106DFC758EF58C480AAAF7A6FF59310BA48AA5E409CB751DB31EDC5EBC0

Function 011B22A0 Relevance: 1.3, APIs: 1, Instructions: 18sleepCOMMON

Download Yara Rule

APIs

Sleep.KERNELBASE(000001F4), ref: 011B22B1

Memory Dump Source

Source File: 00000000.00000002.1668313329.00000000011B0000.00000040.00001000.00020000.00000000.sdmp, Offset: 011B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_11b0000_tgBNtoWqIp.jbxd

Similarity

API ID: Sleep
String ID:
API String ID: 3472027048-0
Opcode ID: 368835ae2f5fba710e6c01549c2017e46dd928bc4d187f44ede00cceab054826
Instruction ID: c77a0622b4156d595a14ced82fa8be8b1035c3534f5c12c72e161484366246ba
Opcode Fuzzy Hash: 368835ae2f5fba710e6c01549c2017e46dd928bc4d187f44ede00cceab054826
Instruction Fuzzy Hash: 83E0BF7494010E9FDB00EFA4D54969E7BB4EF04301F1002A1FD01D2281D73099508A62

Non-executed Functions

Function 00FECDAC Relevance: 74.1, APIs: 40, Strings: 2, Instructions: 637windowkeyboardCOMMON

Download Yara Rule

APIs

Part of subcall function 00F62612: GetWindowLongW.USER32(?,000000EB), ref: 00F62623

DefDlgProcW.USER32(?,0000004E,?,?,?,?,?,?), ref: 00FECE50
SendMessageW.USER32(?,0000130B,00000000,00000000), ref: 00FECE91
GetWindowLongW.USER32(FFFFFDD9,000000F0), ref: 00FECED6
SendMessageW.USER32(?,0000110A,00000009,00000000), ref: 00FECF00
SendMessageW.USER32 ref: 00FECF29
_wcsncpy.LIBCMT ref: 00FECFA1
GetKeyState.USER32(00000011), ref: 00FECFC2
GetKeyState.USER32(00000009), ref: 00FECFCF
SendMessageW.USER32(?,0000130B,00000000,00000000), ref: 00FECFE5
GetKeyState.USER32(00000010), ref: 00FECFEF
SendMessageW.USER32(?,0000110A,00000009,00000000), ref: 00FED018
SendMessageW.USER32 ref: 00FED03F
SendMessageW.USER32(?,00001030,?,00FEB602), ref: 00FED145
ImageList_SetDragCursorImage.COMCTL32(00000000,00000000,00000000,?,?,?), ref: 00FED15B
ImageList_BeginDrag.COMCTL32(00000000,000000F8,000000F0), ref: 00FED16E
SetCapture.USER32(?), ref: 00FED177
ClientToScreen.USER32(?,?), ref: 00FED1DC
ImageList_DragEnter.COMCTL32(00000000,?,?), ref: 00FED1E9
InvalidateRect.USER32(?,00000000,00000001,?,?,?), ref: 00FED203
ReleaseCapture.USER32 ref: 00FED20E
GetCursorPos.USER32(?), ref: 00FED248
ScreenToClient.USER32(?,?), ref: 00FED255
SendMessageW.USER32(?,00001012,00000000,?), ref: 00FED2B1
SendMessageW.USER32 ref: 00FED2DF
SendMessageW.USER32(?,00001111,00000000,?), ref: 00FED31C
SendMessageW.USER32 ref: 00FED34B
SendMessageW.USER32(?,0000110B,00000009,00000000), ref: 00FED36C
SendMessageW.USER32(?,0000110B,00000009,?), ref: 00FED37B
GetCursorPos.USER32(?), ref: 00FED39B
ScreenToClient.USER32(?,?), ref: 00FED3A8
GetParent.USER32(?), ref: 00FED3C8
SendMessageW.USER32(?,00001012,00000000,?), ref: 00FED431
SendMessageW.USER32 ref: 00FED462
ClientToScreen.USER32(?,?), ref: 00FED4C0
TrackPopupMenuEx.USER32(?,00000000,?,?,?,00000000), ref: 00FED4F0
SendMessageW.USER32(?,00001111,00000000,?), ref: 00FED51A
SendMessageW.USER32 ref: 00FED53D
ClientToScreen.USER32(?,?), ref: 00FED58F
TrackPopupMenuEx.USER32(?,00000080,?,?,?,00000000), ref: 00FED5C3

Part of subcall function 00F625DB: GetWindowLongW.USER32(?,000000EB), ref: 00F625EC

GetWindowLongW.USER32(?,000000F0), ref: 00FED65F

Strings

F, xrefs: 00FED543
@GUI_DRAGID, xrefs: 00FED1AA

Memory Dump Source

Source File: 00000000.00000002.1667912702.0000000000F61000.00000020.00000001.01000000.00000003.sdmp, Offset: 00F60000, based on PE: true

Associated: 00000000.00000002.1667891216.0000000000F60000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667966851.0000000000FEF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667966851.0000000001015000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1668035777.000000000101F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1668053678.0000000001028000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f60000_tgBNtoWqIp.jbxd

Similarity

API ID: MessageSend$ClientScreen$ImageLongWindow$CursorDragList_State$CaptureMenuPopupTrack$BeginEnterInvalidateParentProcRectRelease_wcsncpy
String ID: @GUI_DRAGID$F
API String ID: 3977979337-4164748364
Opcode ID: 5dc80e1d6f24f241951d62c15223362c16e02a1218da1274bc2fd4d18c5507f4
Instruction ID: 3f067c6e06697eb07e251b74fc8939496a01480a04abd84c8c94a4504537e5eb
Opcode Fuzzy Hash: 5dc80e1d6f24f241951d62c15223362c16e02a1218da1274bc2fd4d18c5507f4
Instruction Fuzzy Hash: 2C42BE706043C1AFD721CF29C884FAABBE5FF48324F14061DF695876A0C7729945EB92

Function 00FE804A Relevance: 60.1, APIs: 33, Strings: 1, Instructions: 571windowCOMMON

Download Yara Rule

APIs

SendMessageW.USER32(?,00000400,00000000,00000000), ref: 00FE873F

Strings

%d/%02d/%02d, xrefs: 00FE8478

Memory Dump Source

Source File: 00000000.00000002.1667912702.0000000000F61000.00000020.00000001.01000000.00000003.sdmp, Offset: 00F60000, based on PE: true

Associated: 00000000.00000002.1667891216.0000000000F60000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667966851.0000000000FEF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667966851.0000000001015000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1668035777.000000000101F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1668053678.0000000001028000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f60000_tgBNtoWqIp.jbxd

Similarity

API ID: MessageSend
String ID: %d/%02d/%02d
API String ID: 3850602802-328681919
Opcode ID: c3b5e67c60dccdbdbd3c895d177198704428e484f689462c283054cb6c5ae08b
Instruction ID: 26df281ce5890c07e9a29d52f51e073ad20d3c42241595afdfa5d233e0d0845c
Opcode Fuzzy Hash: c3b5e67c60dccdbdbd3c895d177198704428e484f689462c283054cb6c5ae08b
Instruction Fuzzy Hash: BD12E571500288AFEB25AF25CC89FAE7BB4EF453A0F244129F519DB1E1DF748946EB10

Function 00F7710E Relevance: 48.8, APIs: 19, Strings: 6, Instructions: 5093COMMON

Download Yara Rule

APIs

_memmove.LIBCMT ref: 00F775C2
_memset.LIBCMT ref: 00F776B1
_memmove.LIBCMT ref: 00F77C4B
_memmove.LIBCMT ref: 00F77E4F

Strings

Q\E, xrefs: 00F781C1
[:>:]], xrefs: 00F7760A
\b(?<=\w), xrefs: 00FB3C41
[:<:]], xrefs: 00F775F1
DEFINE, xrefs: 00FB25AF
\b(?=\w), xrefs: 00FB3C34

Memory Dump Source

Source File: 00000000.00000002.1667912702.0000000000F61000.00000020.00000001.01000000.00000003.sdmp, Offset: 00F60000, based on PE: true

Associated: 00000000.00000002.1667891216.0000000000F60000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667966851.0000000000FEF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667966851.0000000001015000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1668035777.000000000101F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1668053678.0000000001028000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f60000_tgBNtoWqIp.jbxd

Similarity

API ID: _memmove$_memset
String ID: DEFINE$Q\E$[:<:]]$[:>:]]$\b(?<=\w)$\b(?=\w)
API String ID: 1357608183-1798697756
Opcode ID: 591911b5d96b7f87a2d7fc871a47f717c2a72a1dff8751f8aeb732d82a7f633d
Instruction ID: 312015917eee5b87180c3dfaf32768fb6283a06a8ffd21a5efe2ab4c259184c3
Opcode Fuzzy Hash: 591911b5d96b7f87a2d7fc871a47f717c2a72a1dff8751f8aeb732d82a7f633d
Instruction Fuzzy Hash: 3393A171E40215DBDB24DF59C881BEDB7B1FF48320F24816AE949AB281E7749E81EF41

Function 00F64A35 Relevance: 43.9, APIs: 24, Strings: 1, Instructions: 131keyboardthreadwindowCOMMON

Download Yara Rule

APIs

GetForegroundWindow.USER32(00000000,?), ref: 00F64A3D
FindWindowW.USER32(Shell_TrayWnd,00000000), ref: 00F9DA8E
IsIconic.USER32(?), ref: 00F9DA97
ShowWindow.USER32(?,00000009), ref: 00F9DAA4
SetForegroundWindow.USER32(?), ref: 00F9DAAE
GetWindowThreadProcessId.USER32(00000000,00000000), ref: 00F9DAC4
GetCurrentThreadId.KERNEL32 ref: 00F9DACB
GetWindowThreadProcessId.USER32(?,00000000), ref: 00F9DAD7
AttachThreadInput.USER32(?,00000000,00000001), ref: 00F9DAE8
AttachThreadInput.USER32(?,00000000,00000001), ref: 00F9DAF0
AttachThreadInput.USER32(00000000,?,00000001), ref: 00F9DAF8
SetForegroundWindow.USER32(?), ref: 00F9DAFB
MapVirtualKeyW.USER32(00000012,00000000), ref: 00F9DB10
keybd_event.USER32(00000012,00000000), ref: 00F9DB1B
MapVirtualKeyW.USER32(00000012,00000000), ref: 00F9DB25
keybd_event.USER32(00000012,00000000), ref: 00F9DB2A
MapVirtualKeyW.USER32(00000012,00000000), ref: 00F9DB33
keybd_event.USER32(00000012,00000000), ref: 00F9DB38
MapVirtualKeyW.USER32(00000012,00000000), ref: 00F9DB42
keybd_event.USER32(00000012,00000000), ref: 00F9DB47
SetForegroundWindow.USER32(?), ref: 00F9DB4A
AttachThreadInput.USER32(?,?,00000000), ref: 00F9DB71

Strings

Shell_TrayWnd, xrefs: 00F9DA89

Memory Dump Source

Source File: 00000000.00000002.1667912702.0000000000F61000.00000020.00000001.01000000.00000003.sdmp, Offset: 00F60000, based on PE: true

Associated: 00000000.00000002.1667891216.0000000000F60000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667966851.0000000000FEF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667966851.0000000001015000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1668035777.000000000101F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1668053678.0000000001028000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f60000_tgBNtoWqIp.jbxd

Similarity

API ID: Window$Thread$AttachForegroundInputVirtualkeybd_event$Process$CurrentFindIconicShow
String ID: Shell_TrayWnd
API String ID: 4125248594-2988720461
Opcode ID: 8e6a0e3086b15ccda45aa8b863ba127ec641a27d9e7e4036c311ccf6e2875662
Instruction ID: ccbf501b368477b7472ac0a020167e0be4d9db9bd470ed7b3f7640d46260ce93
Opcode Fuzzy Hash: 8e6a0e3086b15ccda45aa8b863ba127ec641a27d9e7e4036c311ccf6e2875662
Instruction Fuzzy Hash: 24314171A4035CBBEF216FA19C89F7F3E6CEB94B60F154025FA05AA191C6B15910BAA0

Function 00FB8858 Relevance: 35.2, APIs: 17, Strings: 3, Instructions: 224COMMON

Download Yara Rule

APIs

Part of subcall function 00FB8CC3: LookupPrivilegeValueW.ADVAPI32(00000000,00000000,00000004), ref: 00FB8D0D
Part of subcall function 00FB8CC3: AdjustTokenPrivileges.ADVAPI32(?,00000000,00000000,?,00000000,?), ref: 00FB8D3A
Part of subcall function 00FB8CC3: GetLastError.KERNEL32 ref: 00FB8D47

_memset.LIBCMT ref: 00FB889B
DuplicateTokenEx.ADVAPI32(?,00000000,00000000,00000002,00000001,?,?,?,?,00000001,?,?), ref: 00FB88ED
CloseHandle.KERNEL32(?), ref: 00FB88FE
OpenWindowStationW.USER32(winsta0,00000000,00060000), ref: 00FB8915
GetProcessWindowStation.USER32 ref: 00FB892E
SetProcessWindowStation.USER32(00000000), ref: 00FB8938
OpenDesktopW.USER32(default,00000000,00000000,00060081), ref: 00FB8952

Part of subcall function 00FB8713: AdjustTokenPrivileges.ADVAPI32(?,00000000,?,00000000,00000000,00000000,?,00FB8851), ref: 00FB8728
Part of subcall function 00FB8713: CloseHandle.KERNEL32(?,?,00FB8851), ref: 00FB873A

Strings

default, xrefs: 00FB894D
winsta0, xrefs: 00FB8910
, xrefs: 00FB88AA

Memory Dump Source

Source File: 00000000.00000002.1667912702.0000000000F61000.00000020.00000001.01000000.00000003.sdmp, Offset: 00F60000, based on PE: true

Associated: 00000000.00000002.1667891216.0000000000F60000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667966851.0000000000FEF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667966851.0000000001015000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1668035777.000000000101F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1668053678.0000000001028000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f60000_tgBNtoWqIp.jbxd

Similarity

API ID: StationTokenWindow$AdjustCloseHandleOpenPrivilegesProcess$DesktopDuplicateErrorLastLookupPrivilegeValue_memset
String ID: $default$winsta0
API String ID: 2063423040-1027155976
Opcode ID: 6a50c6f5c525da1a9ea3b8296beda7ce8440bf61512611af44f8d4f192dc6758
Instruction ID: e66e901991b907a8f3f196b1bd8bdb00fc2b5ffd4c2fe956ce3f01cf2e9a4af2
Opcode Fuzzy Hash: 6a50c6f5c525da1a9ea3b8296beda7ce8440bf61512611af44f8d4f192dc6758
Instruction Fuzzy Hash: E4815A71D00249BFDF11DFA5CC45AEEBBBCAF44394F18412AF910A6161DB398A16EF60

Function 00FD425A Relevance: 30.2, APIs: 20, Instructions: 167clipboardCOMMON

Download Yara Rule

APIs

OpenClipboard.USER32(00FEF910), ref: 00FD4284
IsClipboardFormatAvailable.USER32(0000000D), ref: 00FD4292
GetClipboardData.USER32(0000000D), ref: 00FD429A
CloseClipboard.USER32 ref: 00FD42A6
GlobalLock.KERNEL32(00000000), ref: 00FD42C2
CloseClipboard.USER32 ref: 00FD42CC
GlobalUnlock.KERNEL32(00000000,00000000), ref: 00FD42E1
IsClipboardFormatAvailable.USER32(00000001), ref: 00FD42EE
GetClipboardData.USER32(00000001), ref: 00FD42F6
GlobalLock.KERNEL32(00000000), ref: 00FD4303
GlobalUnlock.KERNEL32(00000000,00000000,?), ref: 00FD4337
CloseClipboard.USER32 ref: 00FD4447

Memory Dump Source

Source File: 00000000.00000002.1667912702.0000000000F61000.00000020.00000001.01000000.00000003.sdmp, Offset: 00F60000, based on PE: true

Associated: 00000000.00000002.1667891216.0000000000F60000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667966851.0000000000FEF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667966851.0000000001015000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1668035777.000000000101F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1668053678.0000000001028000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f60000_tgBNtoWqIp.jbxd

Similarity

API ID: Clipboard$Global$Close$AvailableDataFormatLockUnlock$Open
String ID:
API String ID: 3222323430-0
Opcode ID: f9bedc932eda8587f7a8daf2a6c8b8cd8612cf0166fba5827ef487cbeb57547a
Instruction ID: cca9cfb7eb70eb97413df6bdf373c3b9c6072ac75e54ae0faec255049df4e9ec
Opcode Fuzzy Hash: f9bedc932eda8587f7a8daf2a6c8b8cd8612cf0166fba5827ef487cbeb57547a
Instruction Fuzzy Hash: 2C51D231204346ABD701FF60DC86F6E77A9AF84B10F04452AF586D62A1DF74E908AB62

Function 00FCC9C7 Relevance: 28.3, APIs: 13, Strings: 3, Instructions: 280timefileCOMMON

Download Yara Rule

APIs

FindFirstFileW.KERNEL32(?,?), ref: 00FCC9F8
FindClose.KERNEL32(00000000), ref: 00FCCA4C
FileTimeToLocalFileTime.KERNEL32(?,?), ref: 00FCCA71
FileTimeToLocalFileTime.KERNEL32(?,?), ref: 00FCCA88
FileTimeToSystemTime.KERNEL32(?,?), ref: 00FCCAAF
__swprintf.LIBCMT ref: 00FCCAFB
__swprintf.LIBCMT ref: 00FCCB3E

Part of subcall function 00F67F41: _memmove.LIBCMT ref: 00F67F82

__swprintf.LIBCMT ref: 00FCCB92

Part of subcall function 00F838D8: __woutput_l.LIBCMT ref: 00F83931

__swprintf.LIBCMT ref: 00FCCBE0

Part of subcall function 00F838D8: __flsbuf.LIBCMT ref: 00F83953
Part of subcall function 00F838D8: __flsbuf.LIBCMT ref: 00F8396B

__swprintf.LIBCMT ref: 00FCCC2F
__swprintf.LIBCMT ref: 00FCCC7E
__swprintf.LIBCMT ref: 00FCCCCD

Strings

%4d%02d%02d%02d%02d%02d, xrefs: 00FCCAF5
%4d, xrefs: 00FCCB38
%02d, xrefs: 00FCCB86, 00FCCB90, 00FCCBDE, 00FCCC2D, 00FCCC7C, 00FCCCCB

Memory Dump Source

Source File: 00000000.00000002.1667912702.0000000000F61000.00000020.00000001.01000000.00000003.sdmp, Offset: 00F60000, based on PE: true

Associated: 00000000.00000002.1667891216.0000000000F60000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667966851.0000000000FEF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667966851.0000000001015000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1668035777.000000000101F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1668053678.0000000001028000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f60000_tgBNtoWqIp.jbxd

Similarity

API ID: __swprintf$FileTime$FindLocal__flsbuf$CloseFirstSystem__woutput_l_memmove
String ID: %02d$%4d$%4d%02d%02d%02d%02d%02d
API String ID: 3953360268-2428617273
Opcode ID: 8f35dc720a005c00a729e090229794acb1a47b1d57ae943d3b1002773bde78f1
Instruction ID: 220535f28c7998a12fa3153358b571fe14409bac3227fbeba5b90db7f2f5ec95
Opcode Fuzzy Hash: 8f35dc720a005c00a729e090229794acb1a47b1d57ae943d3b1002773bde78f1
Instruction Fuzzy Hash: 5FA13EB2508345ABC700EBA4CD96DAFB7ECEF94704F404919F58687191EB78DA08DB62

Function 00FCF200 Relevance: 28.1, APIs: 15, Strings: 1, Instructions: 119fileCOMMON

Download Yara Rule

APIs

FindFirstFileW.KERNEL32(?,?,74DE8FB0,?,00000000), ref: 00FCF221
_wcscmp.LIBCMT ref: 00FCF236
_wcscmp.LIBCMT ref: 00FCF24D
GetFileAttributesW.KERNEL32(?), ref: 00FCF25F
SetFileAttributesW.KERNEL32(?,?), ref: 00FCF279
FindNextFileW.KERNEL32(00000000,?), ref: 00FCF291
FindClose.KERNEL32(00000000), ref: 00FCF29C
FindFirstFileW.KERNEL32(*.*,?), ref: 00FCF2B8
_wcscmp.LIBCMT ref: 00FCF2DF
_wcscmp.LIBCMT ref: 00FCF2F6
SetCurrentDirectoryW.KERNEL32(?), ref: 00FCF308
SetCurrentDirectoryW.KERNEL32(0101A5A0), ref: 00FCF326
FindNextFileW.KERNEL32(00000000,00000010), ref: 00FCF330
FindClose.KERNEL32(00000000), ref: 00FCF33D
FindClose.KERNEL32(00000000), ref: 00FCF34F

Strings

*.*, xrefs: 00FCF2B3

Memory Dump Source

Source File: 00000000.00000002.1667912702.0000000000F61000.00000020.00000001.01000000.00000003.sdmp, Offset: 00F60000, based on PE: true

Associated: 00000000.00000002.1667891216.0000000000F60000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667966851.0000000000FEF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667966851.0000000001015000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1668035777.000000000101F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1668053678.0000000001028000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f60000_tgBNtoWqIp.jbxd

Similarity

API ID: Find$File$_wcscmp$Close$AttributesCurrentDirectoryFirstNext
String ID: *.*
API String ID: 1803514871-438819550
Opcode ID: f87088ccef8d59d79abd0e7df5a7d3a4c8b54f5539e585270af7d904796acb29
Instruction ID: d573b73e728d8e5569411bdd2ee54ccb0090dda6138d7a8a163bd47eb29407fc
Opcode Fuzzy Hash: f87088ccef8d59d79abd0e7df5a7d3a4c8b54f5539e585270af7d904796acb29
Instruction Fuzzy Hash: 7231D676A0128A7ADB10DBB0DC89FDEB7AD9F48370F104179E904D70A0DB34DA49AA54

Function 00FE0AE2 Relevance: 26.7, APIs: 9, Strings: 6, Instructions: 477registryCOMMON

Download Yara Rule

APIs

RegConnectRegistryW.ADVAPI32(?,?,?), ref: 00FE0BDE
RegCreateKeyExW.ADVAPI32(?,?,00000000,00FEF910,00000000,?,00000000,?,?), ref: 00FE0C4C
RegCloseKey.ADVAPI32(00000000,00000001,00000000,00000000,00000000), ref: 00FE0C94
RegSetValueExW.ADVAPI32(00000001,?,00000000,00000002,?), ref: 00FE0D1D
RegCloseKey.ADVAPI32(?), ref: 00FE103D
RegCloseKey.ADVAPI32(00000000), ref: 00FE104A

Strings

REG_BINARY, xrefs: 00FE0FD8
REG_SZ, xrefs: 00FE0D5B
REG_MULTI_SZ, xrefs: 00FE0E05
REG_EXPAND_SZ, xrefs: 00FE0CBA
REG_QWORD, xrefs: 00FE0F8B
REG_DWORD, xrefs: 00FE0F0E

Memory Dump Source

Source File: 00000000.00000002.1667912702.0000000000F61000.00000020.00000001.01000000.00000003.sdmp, Offset: 00F60000, based on PE: true

Associated: 00000000.00000002.1667891216.0000000000F60000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667966851.0000000000FEF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667966851.0000000001015000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1668035777.000000000101F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1668053678.0000000001028000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f60000_tgBNtoWqIp.jbxd

Similarity

API ID: Close$ConnectCreateRegistryValue
String ID: REG_BINARY$REG_DWORD$REG_EXPAND_SZ$REG_MULTI_SZ$REG_QWORD$REG_SZ
API String ID: 536824911-966354055
Opcode ID: 8ef8bd010b72a4558d2bb78a6d95a954e1d21b2c293e8a1b3d27e556d1a39053
Instruction ID: 2f7e4f647d637b1ead07db9976ae4fcf898ff33a1e7041c6f01098357ea910c4
Opcode Fuzzy Hash: 8ef8bd010b72a4558d2bb78a6d95a954e1d21b2c293e8a1b3d27e556d1a39053
Instruction Fuzzy Hash: EF029F756046419FCB14EF15C891E2AB7E5FF88720F04885DF98A9B362CB78EC45EB81

Function 00FCF35D Relevance: 24.6, APIs: 13, Strings: 1, Instructions: 112fileCOMMON

Download Yara Rule

APIs

FindFirstFileW.KERNEL32(?,?,74DE8FB0,?,00000000), ref: 00FCF37E
_wcscmp.LIBCMT ref: 00FCF393
_wcscmp.LIBCMT ref: 00FCF3AA

Part of subcall function 00FC45C1: CreateFileW.KERNEL32(?,40000000,00000001,00000000,00000003,02000080,00000000), ref: 00FC45DC

FindNextFileW.KERNEL32(00000000,?), ref: 00FCF3D9
FindClose.KERNEL32(00000000), ref: 00FCF3E4
FindFirstFileW.KERNEL32(*.*,?), ref: 00FCF400
_wcscmp.LIBCMT ref: 00FCF427
_wcscmp.LIBCMT ref: 00FCF43E
SetCurrentDirectoryW.KERNEL32(?), ref: 00FCF450
SetCurrentDirectoryW.KERNEL32(0101A5A0), ref: 00FCF46E
FindNextFileW.KERNEL32(00000000,00000010), ref: 00FCF478
FindClose.KERNEL32(00000000), ref: 00FCF485
FindClose.KERNEL32(00000000), ref: 00FCF497

Strings

*.*, xrefs: 00FCF3FB

Memory Dump Source

Source File: 00000000.00000002.1667912702.0000000000F61000.00000020.00000001.01000000.00000003.sdmp, Offset: 00F60000, based on PE: true

Associated: 00000000.00000002.1667891216.0000000000F60000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667966851.0000000000FEF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667966851.0000000001015000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1668035777.000000000101F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1668053678.0000000001028000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f60000_tgBNtoWqIp.jbxd

Similarity

API ID: Find$File$_wcscmp$Close$CurrentDirectoryFirstNext$Create
String ID: *.*
API String ID: 1824444939-438819550
Opcode ID: d2e1645fde737d2476aa2718a411678155cf42e3babfe7d624215160363e1d23
Instruction ID: eadcaf03d7c992fc5464632b7ab17cde58198b2512c56115f2292afb2f0106c4
Opcode Fuzzy Hash: d2e1645fde737d2476aa2718a411678155cf42e3babfe7d624215160363e1d23
Instruction Fuzzy Hash: 0031C672A0125AAFCB14EB64DC89FDEB7AD9F49330F100179E840D70A0D734DA4CEA54

Function 00FB81F7 Relevance: 21.2, APIs: 14, Instructions: 179memoryCOMMON

Download Yara Rule

APIs

Part of subcall function 00FB874A: GetUserObjectSecurity.USER32(?,00000004,?,00000000,?), ref: 00FB8766
Part of subcall function 00FB874A: GetLastError.KERNEL32(?,00FB822A,?,?,?), ref: 00FB8770
Part of subcall function 00FB874A: GetProcessHeap.KERNEL32(00000008,?,?,00FB822A,?,?,?), ref: 00FB877F
Part of subcall function 00FB874A: HeapAlloc.KERNEL32(00000000,?,00FB822A,?,?,?), ref: 00FB8786
Part of subcall function 00FB874A: GetUserObjectSecurity.USER32(?,00000004,00000000,?,?), ref: 00FB879D

Part of subcall function 00FB87E7: GetProcessHeap.KERNEL32(00000008,00FB8240,00000000,00000000,?,00FB8240,?), ref: 00FB87F3
Part of subcall function 00FB87E7: HeapAlloc.KERNEL32(00000000,?,00FB8240,?), ref: 00FB87FA
Part of subcall function 00FB87E7: InitializeSecurityDescriptor.ADVAPI32(00000000,00000001,?,00FB8240,?), ref: 00FB880B

GetSecurityDescriptorDacl.ADVAPI32(?,?,?,?), ref: 00FB825B
_memset.LIBCMT ref: 00FB8270
GetAclInformation.ADVAPI32(?,?,0000000C,00000002), ref: 00FB828F
GetLengthSid.ADVAPI32(?), ref: 00FB82A0
GetAce.ADVAPI32(?,00000000,?), ref: 00FB82DD
AddAce.ADVAPI32(?,00000002,000000FF,?,?), ref: 00FB82F9
GetLengthSid.ADVAPI32(?), ref: 00FB8316
GetProcessHeap.KERNEL32(00000008,-00000008), ref: 00FB8325
HeapAlloc.KERNEL32(00000000), ref: 00FB832C
GetLengthSid.ADVAPI32(?,00000008,?), ref: 00FB834D
CopySid.ADVAPI32(00000000), ref: 00FB8354
AddAce.ADVAPI32(?,00000002,000000FF,00000000,?), ref: 00FB8385
SetSecurityDescriptorDacl.ADVAPI32(?,00000001,?,00000000), ref: 00FB83AB
SetUserObjectSecurity.USER32(?,00000004,?), ref: 00FB83BF

Memory Dump Source

Source File: 00000000.00000002.1667912702.0000000000F61000.00000020.00000001.01000000.00000003.sdmp, Offset: 00F60000, based on PE: true

Associated: 00000000.00000002.1667891216.0000000000F60000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667966851.0000000000FEF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667966851.0000000001015000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1668035777.000000000101F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1668053678.0000000001028000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f60000_tgBNtoWqIp.jbxd

Similarity

API ID: HeapSecurity$AllocDescriptorLengthObjectProcessUser$Dacl$CopyErrorInformationInitializeLast_memset
String ID:
API String ID: 3996160137-0
Opcode ID: 38abed0559d2b6879fa04c12376764018a6cdddd1cf7f711671313c8b1acea95
Instruction ID: 527b96c60d610cb524fbd5cd476c9f2ef9c711e9bbd376c26c75b1b47b97f7e7
Opcode Fuzzy Hash: 38abed0559d2b6879fa04c12376764018a6cdddd1cf7f711671313c8b1acea95
Instruction Fuzzy Hash: 6A616971900209ABDF00DFA1DC85AEEBBB9FF44750F148129E915AB291DB349A06EF60

Function 00F76843 Relevance: 19.6, Strings: 15, Instructions: 883COMMON

Download Yara Rule

Strings

CR), xrefs: 00FB16C0
BSR_ANYCRLF), xrefs: 00FB1757
UCP), xrefs: 00FB1546
NO_AUTO_POSSESS), xrefs: 00FB1567
ANYCRLF), xrefs: 00FB1734
UTF16), xrefs: 00FB1508
NO_START_OPT), xrefs: 00FB1588
BSR_UNICODE), xrefs: 00FB1771
-es, xrefs: 00FB1782
LF), xrefs: 00FB16DD
CRLF), xrefs: 00FB16FA
LIMIT_MATCH=, xrefs: 00FB15A9
ANY), xrefs: 00FB1717
UTF), xrefs: 00FB1533
LIMIT_RECURSION=, xrefs: 00FB1635

Memory Dump Source

Source File: 00000000.00000002.1667912702.0000000000F61000.00000020.00000001.01000000.00000003.sdmp, Offset: 00F60000, based on PE: true

Associated: 00000000.00000002.1667891216.0000000000F60000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667966851.0000000000FEF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667966851.0000000001015000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1668035777.000000000101F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1668053678.0000000001028000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f60000_tgBNtoWqIp.jbxd

Similarity

API ID:
String ID: -es$ANY)$ANYCRLF)$BSR_ANYCRLF)$BSR_UNICODE)$CR)$CRLF)$LF)$LIMIT_MATCH=$LIMIT_RECURSION=$NO_AUTO_POSSESS)$NO_START_OPT)$UCP)$UTF)$UTF16)
API String ID: 0-1236126243
Opcode ID: 7fa05d50b8bd2b7f9ac78cc88280567d5b7839acecde7155d9737eb7c84167bc
Instruction ID: 13a0d5d93c0cf7234c335e1ae5f3d2dcaf89e38abbcb8bdb8290396a52dcac3f
Opcode Fuzzy Hash: 7fa05d50b8bd2b7f9ac78cc88280567d5b7839acecde7155d9737eb7c84167bc
Instruction Fuzzy Hash: 7B727171E006199BDB24CF59C8907EEB7B5FF48320F54816AE849EB280DB349D81EF91

Function 00FE0665 Relevance: 16.9, APIs: 11, Instructions: 397registryCOMMON

Download Yara Rule

APIs

Part of subcall function 00FE10A5: CharUpperBuffW.USER32(?,?,?,?,?,?,?,00FE0038,?,?), ref: 00FE10BC

RegConnectRegistryW.ADVAPI32(?,?,?), ref: 00FE0737

Part of subcall function 00F69997: __itow.LIBCMT ref: 00F699C2
Part of subcall function 00F69997: __swprintf.LIBCMT ref: 00F69A0C

RegQueryValueExW.ADVAPI32(?,?,00000000,?,00000000,?), ref: 00FE07D6
RegQueryValueExW.ADVAPI32(?,?,00000000,00000000,?,00000008), ref: 00FE086E
RegCloseKey.ADVAPI32(000000FE,000000FE,00000000,?,00000000), ref: 00FE0AAD
RegCloseKey.ADVAPI32(00000000), ref: 00FE0ABA

Memory Dump Source

Source File: 00000000.00000002.1667912702.0000000000F61000.00000020.00000001.01000000.00000003.sdmp, Offset: 00F60000, based on PE: true

Associated: 00000000.00000002.1667891216.0000000000F60000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667966851.0000000000FEF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667966851.0000000001015000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1668035777.000000000101F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1668053678.0000000001028000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f60000_tgBNtoWqIp.jbxd

Similarity

API ID: CloseQueryValue$BuffCharConnectRegistryUpper__itow__swprintf
String ID:
API String ID: 1240663315-0
Opcode ID: 3e3eda12561aa827c9860a754539dcfccaa61d0c9693c3769877f8cc4e1927ba
Instruction ID: cba4552c319a32bdac786840b5d0b6227d0dbe0849031b93a1f6bd0d0d15ae34
Opcode Fuzzy Hash: 3e3eda12561aa827c9860a754539dcfccaa61d0c9693c3769877f8cc4e1927ba
Instruction Fuzzy Hash: AEE17B31604344AFCB14DF29C880E6ABBE9EF88714F04896DF44ADB262DA74ED45EB51

Function 00FC0219 Relevance: 16.6, APIs: 11, Instructions: 120keyboardCOMMON

Download Yara Rule

APIs

GetKeyboardState.USER32(?), ref: 00FC0241
GetAsyncKeyState.USER32(000000A0), ref: 00FC02C2
GetKeyState.USER32(000000A0), ref: 00FC02DD
GetAsyncKeyState.USER32(000000A1), ref: 00FC02F7
GetKeyState.USER32(000000A1), ref: 00FC030C
GetAsyncKeyState.USER32(00000011), ref: 00FC0324
GetKeyState.USER32(00000011), ref: 00FC0336
GetAsyncKeyState.USER32(00000012), ref: 00FC034E
GetKeyState.USER32(00000012), ref: 00FC0360
GetAsyncKeyState.USER32(0000005B), ref: 00FC0378
GetKeyState.USER32(0000005B), ref: 00FC038A

Memory Dump Source

Source File: 00000000.00000002.1667912702.0000000000F61000.00000020.00000001.01000000.00000003.sdmp, Offset: 00F60000, based on PE: true

Associated: 00000000.00000002.1667891216.0000000000F60000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667966851.0000000000FEF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667966851.0000000001015000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1668035777.000000000101F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1668053678.0000000001028000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f60000_tgBNtoWqIp.jbxd

Similarity

API ID: State$Async$Keyboard
String ID:
API String ID: 541375521-0
Opcode ID: 99a2ad71076665782001bb0f4e9f3b85c0316981df4c1e192b98b8ff35ddf962
Instruction ID: 8e9aecd37b1efd8dc5b90fa5807c5465d5645fd3e352c7d40f2b30be6caf264e
Opcode Fuzzy Hash: 99a2ad71076665782001bb0f4e9f3b85c0316981df4c1e192b98b8ff35ddf962
Instruction Fuzzy Hash: 8A41DC24D047CBEEFF314BA48A4ABF5BEA06F12360F08406DD5C6461C2DF9459C9E792

Function 00FD86D0 Relevance: 15.9, APIs: 6, Strings: 3, Instructions: 197comCOMMON

Download Yara Rule

APIs

Part of subcall function 00F69997: __itow.LIBCMT ref: 00F699C2
Part of subcall function 00F69997: __swprintf.LIBCMT ref: 00F69A0C

CoInitialize.OLE32 ref: 00FD8718
CoUninitialize.OLE32 ref: 00FD8723
CoCreateInstance.OLE32(?,00000000,00000017,00FF2BEC,?), ref: 00FD8783
IIDFromString.OLE32(?,?), ref: 00FD87F6
VariantInit.OLEAUT32(?), ref: 00FD8890
VariantClear.OLEAUT32(?), ref: 00FD88F1

Strings

Invalid parameter, xrefs: 00FD880F
NULL Pointer assignment, xrefs: 00FD87C8
Failed to create object, xrefs: 00FD878E, 00FD8844

Memory Dump Source

Source File: 00000000.00000002.1667912702.0000000000F61000.00000020.00000001.01000000.00000003.sdmp, Offset: 00F60000, based on PE: true

Associated: 00000000.00000002.1667891216.0000000000F60000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667966851.0000000000FEF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667966851.0000000001015000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1668035777.000000000101F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1668053678.0000000001028000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f60000_tgBNtoWqIp.jbxd

Similarity

API ID: Variant$ClearCreateFromInitInitializeInstanceStringUninitialize__itow__swprintf
String ID: Failed to create object$Invalid parameter$NULL Pointer assignment
API String ID: 834269672-1287834457
Opcode ID: 16b333def317106f0854d29a8764e0435b6ae7ff13067bca4d9bc932d267b6ab
Instruction ID: 931d1dc574fac0ed1de42059ff5392bc27e03b11bcbbc19da3d1b86e03d9655f
Opcode Fuzzy Hash: 16b333def317106f0854d29a8764e0435b6ae7ff13067bca4d9bc932d267b6ab
Instruction Fuzzy Hash: 2061BD716083019FC710DF24C888B6ABBE9EF44794F18481EF9859B391CB74ED49EB92

Function 00FD4458 Relevance: 15.1, APIs: 10, Instructions: 83clipboardmemoryCOMMON

Download Yara Rule

APIs

OpenClipboard.USER32 ref: 00FD447F
EmptyClipboard.USER32 ref: 00FD4485
GlobalAlloc.KERNEL32(00000002,?), ref: 00FD449A
CloseClipboard.USER32 ref: 00FD4539

Memory Dump Source

Source File: 00000000.00000002.1667912702.0000000000F61000.00000020.00000001.01000000.00000003.sdmp, Offset: 00F60000, based on PE: true

Associated: 00000000.00000002.1667891216.0000000000F60000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667966851.0000000000FEF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667966851.0000000001015000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1668035777.000000000101F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1668053678.0000000001028000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f60000_tgBNtoWqIp.jbxd

Similarity

API ID: Clipboard$AllocCloseEmptyGlobalOpen
String ID:
API String ID: 1737998785-0
Opcode ID: ef47af96d94e118543ab6a7985ca4f7948980fd9e64a9795c86f23c7d8b32512
Instruction ID: 1f69faab1a4442e1e597676b947cb115bcf24c5fd3d847970071e0c011f4d330
Opcode Fuzzy Hash: ef47af96d94e118543ab6a7985ca4f7948980fd9e64a9795c86f23c7d8b32512
Instruction Fuzzy Hash: 9921B0357002149FDB11AF60EC49B6D77A9EF44720F18802AF946DB3A1CB79BD01EB55

Function 00FC3A2B Relevance: 14.2, APIs: 7, Strings: 1, Instructions: 167fileCOMMON

Download Yara Rule

APIs

Part of subcall function 00F648AE: GetFullPathNameW.KERNEL32(?,00007FFF,?,00000000,?,?,00F648A1,?,?,00F637C0,?), ref: 00F648CE

Part of subcall function 00FC4CD3: GetFileAttributesW.KERNEL32(?,00FC3947), ref: 00FC4CD4

FindFirstFileW.KERNEL32(?,?), ref: 00FC3ADF
DeleteFileW.KERNEL32(?,?,00000000,?,?,?,?), ref: 00FC3B87
MoveFileW.KERNEL32(?,?), ref: 00FC3B9A
DeleteFileW.KERNEL32(?,?,?,?,?), ref: 00FC3BB7
FindNextFileW.KERNEL32(00000000,00000010), ref: 00FC3BD9
FindClose.KERNEL32(00000000,?,?,?,?), ref: 00FC3BF5

Strings

\*.*, xrefs: 00FC3A8A, 00FC3A93, 00FC3AA8

Memory Dump Source

Source File: 00000000.00000002.1667912702.0000000000F61000.00000020.00000001.01000000.00000003.sdmp, Offset: 00F60000, based on PE: true

Associated: 00000000.00000002.1667891216.0000000000F60000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667966851.0000000000FEF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667966851.0000000001015000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1668035777.000000000101F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1668053678.0000000001028000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f60000_tgBNtoWqIp.jbxd

Similarity

API ID: File$Find$Delete$AttributesCloseFirstFullMoveNameNextPath
String ID: \*.*
API String ID: 4002782344-1173974218
Opcode ID: 597e9bc992409f323bf5181d4becd66e3bc4f39b62da8777d773b43ca83a90ed
Instruction ID: 9f82107de199e738cc3839653e2c1866df850459b52bdaadf040451edcff09c7
Opcode Fuzzy Hash: 597e9bc992409f323bf5181d4becd66e3bc4f39b62da8777d773b43ca83a90ed
Instruction Fuzzy Hash: 07515F31C0124D9ACB15EBA0CE93EEDB779AF54344F648169E44277091DF296F0DEBA0

Function 00F74140 Relevance: 13.4, APIs: 1, Strings: 6, Instructions: 1132COMMON

Download Yara Rule

Strings

VUUU, xrefs: 00FA7B0C
-es, xrefs: 00FA7A34
VUUU, xrefs: 00F74520
ERCP, xrefs: 00F7421F
VUUU, xrefs: 00F744ED
VUUU, xrefs: 00F744DB

Memory Dump Source

Source File: 00000000.00000002.1667912702.0000000000F61000.00000020.00000001.01000000.00000003.sdmp, Offset: 00F60000, based on PE: true

Associated: 00000000.00000002.1667891216.0000000000F60000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667966851.0000000000FEF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667966851.0000000001015000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1668035777.000000000101F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1668053678.0000000001028000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f60000_tgBNtoWqIp.jbxd

Similarity

API ID:
String ID: -es$ERCP$VUUU$VUUU$VUUU$VUUU
API String ID: 0-184249834
Opcode ID: 6ff850327d0e504afb80339bc52eab9f6a12b083d4c807dc3f744d5d3ab1bb49
Instruction ID: 56a7890def5b0d0b1e6f6a1dd072fa8874253bf9f4fe283afa14fe20b27aa6c6
Opcode Fuzzy Hash: 6ff850327d0e504afb80339bc52eab9f6a12b083d4c807dc3f744d5d3ab1bb49
Instruction Fuzzy Hash: 00A2C5B1E04219CBDF24DF58C980BADB7B1BF45324F14C1AAD859A7280D734AE81EF42

Function 00FCF65E Relevance: 12.4, APIs: 6, Strings: 1, Instructions: 120filesleepCOMMON

Download Yara Rule

APIs

Part of subcall function 00F67F41: _memmove.LIBCMT ref: 00F67F82

FindFirstFileW.KERNEL32(?,?,*.*,?,?,00000000,00000000), ref: 00FCF6AB
Sleep.KERNEL32(0000000A), ref: 00FCF6DB
_wcscmp.LIBCMT ref: 00FCF6EF
_wcscmp.LIBCMT ref: 00FCF70A
FindNextFileW.KERNEL32(?,?), ref: 00FCF7A8
FindClose.KERNEL32(00000000), ref: 00FCF7BE

Strings

*.*, xrefs: 00FCF690

Memory Dump Source

Source File: 00000000.00000002.1667912702.0000000000F61000.00000020.00000001.01000000.00000003.sdmp, Offset: 00F60000, based on PE: true

Associated: 00000000.00000002.1667891216.0000000000F60000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667966851.0000000000FEF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667966851.0000000001015000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1668035777.000000000101F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1668053678.0000000001028000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f60000_tgBNtoWqIp.jbxd

Similarity

API ID: Find$File_wcscmp$CloseFirstNextSleep_memmove
String ID: *.*
API String ID: 713712311-438819550
Opcode ID: b782ba04d2ca4edd53ba1afc9aab7f8c50c8e2600f8ad14e80155557cbd4e17d
Instruction ID: 0b939d9d598740cf1587ca916b536dbbbaf5c0e38e9d66eccf3ccd4dfee6be88
Opcode Fuzzy Hash: b782ba04d2ca4edd53ba1afc9aab7f8c50c8e2600f8ad14e80155557cbd4e17d
Instruction Fuzzy Hash: A6417C71D0020A9BCF15EF64CD86FEEBBB5BF05320F14456AE815A71A0DB349E48EB90

Function 00F758C0 Relevance: 11.0, APIs: 7, Instructions: 532COMMON

Download Yara Rule

APIs

_memmove.LIBCMT ref: 00F75A05
_memmove.LIBCMT ref: 00F75A55
_memmove.LIBCMT ref: 00F75ABB

Memory Dump Source

Source File: 00000000.00000002.1667912702.0000000000F61000.00000020.00000001.01000000.00000003.sdmp, Offset: 00F60000, based on PE: true

Associated: 00000000.00000002.1667891216.0000000000F60000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667966851.0000000000FEF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667966851.0000000001015000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1668035777.000000000101F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1668053678.0000000001028000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f60000_tgBNtoWqIp.jbxd

Similarity

API ID: _memmove
String ID:
API String ID: 4104443479-0
Opcode ID: 62e3c0edfd9a8cc41bee0e92a9f979d5d18e477d6f69eb7774e5374b41894e76
Instruction ID: a0630420f393227aa3bbcd7a6e34a04a4e01435cace6d47fbebce803932549f3
Opcode Fuzzy Hash: 62e3c0edfd9a8cc41bee0e92a9f979d5d18e477d6f69eb7774e5374b41894e76
Instruction Fuzzy Hash: 3C129B70A00609DFDF14DFA5D981AEEB7B5FF48700F10862AE406E7251EB3AAD11EB51

Function 00FC545F Relevance: 10.6, APIs: 3, Strings: 3, Instructions: 59shutdownCOMMON

Download Yara Rule

APIs

Part of subcall function 00FB8CC3: LookupPrivilegeValueW.ADVAPI32(00000000,00000000,00000004), ref: 00FB8D0D
Part of subcall function 00FB8CC3: AdjustTokenPrivileges.ADVAPI32(?,00000000,00000000,?,00000000,?), ref: 00FB8D3A
Part of subcall function 00FB8CC3: GetLastError.KERNEL32 ref: 00FB8D47

ExitWindowsEx.USER32(?,00000000), ref: 00FC549B

Strings

@, xrefs: 00FC548E
, xrefs: 00FC5489
SeShutdownPrivilege, xrefs: 00FC546B

Memory Dump Source

Source File: 00000000.00000002.1667912702.0000000000F61000.00000020.00000001.01000000.00000003.sdmp, Offset: 00F60000, based on PE: true

Associated: 00000000.00000002.1667891216.0000000000F60000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667966851.0000000000FEF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667966851.0000000001015000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1668035777.000000000101F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1668053678.0000000001028000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f60000_tgBNtoWqIp.jbxd

Similarity

API ID: AdjustErrorExitLastLookupPrivilegePrivilegesTokenValueWindows
String ID: $@$SeShutdownPrivilege
API String ID: 2234035333-194228
Opcode ID: 5f994c5f2ae1206590d9c13d7f662cda71583ed058b9db05a3a7ef1e3886e5f2
Instruction ID: edc2dda6d6d14bb64a328304fb987df8358957c7e8f0c7d005b08377a5389dce
Opcode Fuzzy Hash: 5f994c5f2ae1206590d9c13d7f662cda71583ed058b9db05a3a7ef1e3886e5f2
Instruction Fuzzy Hash: CB012872A55A075AE72C9274DD5BFB67258EB00B62F240029FD06D60D2DA543CC0A590

Function 00FD6596 Relevance: 9.1, APIs: 6, Instructions: 84networkCOMMON

Download Yara Rule

APIs

socket.WSOCK32(00000002,00000001,00000006,?,00000002,00000000), ref: 00FD65EF
WSAGetLastError.WSOCK32(00000000), ref: 00FD65FE
bind.WSOCK32(00000000,?,00000010), ref: 00FD661A
listen.WSOCK32(00000000,00000005), ref: 00FD6629
WSAGetLastError.WSOCK32(00000000), ref: 00FD6643
closesocket.WSOCK32(00000000,00000000), ref: 00FD6657

Memory Dump Source

Source File: 00000000.00000002.1667912702.0000000000F61000.00000020.00000001.01000000.00000003.sdmp, Offset: 00F60000, based on PE: true

Associated: 00000000.00000002.1667891216.0000000000F60000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667966851.0000000000FEF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667966851.0000000001015000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1668035777.000000000101F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1668053678.0000000001028000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f60000_tgBNtoWqIp.jbxd

Similarity

API ID: ErrorLast$bindclosesocketlistensocket
String ID:
API String ID: 1279440585-0
Opcode ID: 91a16167f2dc4ea4a6633d69583cfc14a7091d6b4f29cd9b8710b22b0ee22005
Instruction ID: 2acd44d5ca0ff020e0eaef73a14c7c414f40f7bc10f5b1e62c16cb432f7c8c86
Opcode Fuzzy Hash: 91a16167f2dc4ea4a6633d69583cfc14a7091d6b4f29cd9b8710b22b0ee22005
Instruction Fuzzy Hash: A42191316002049FDB10AF64CC85B6EB7AAEF48720F18816AE956EB3D1CB74AD05AB51

Function 00F75680 Relevance: 8.0, APIs: 5, Instructions: 516COMMON

Download Yara Rule

APIs

Part of subcall function 00F80FF6: std::exception::exception.LIBCMT ref: 00F8102C
Part of subcall function 00F80FF6: __CxxThrowException@8.LIBCMT ref: 00F81041

_memmove.LIBCMT ref: 00FB062F
_memmove.LIBCMT ref: 00FB0744
_memmove.LIBCMT ref: 00FB07EB

Memory Dump Source

Source File: 00000000.00000002.1667912702.0000000000F61000.00000020.00000001.01000000.00000003.sdmp, Offset: 00F60000, based on PE: true

Associated: 00000000.00000002.1667891216.0000000000F60000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667966851.0000000000FEF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667966851.0000000001015000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1668035777.000000000101F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1668053678.0000000001028000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f60000_tgBNtoWqIp.jbxd

Similarity

API ID: _memmove$Exception@8Throwstd::exception::exception
String ID:
API String ID: 1300846289-0
Opcode ID: 4ec00d7f1e0a5b91d99df83fe61f3d71c756aa91d1211cbd96cd53833451ee2a
Instruction ID: 670d23c35fa0124133f739c8d69a9f9c27fc03f75fb5b489be10958a32e4ec59
Opcode Fuzzy Hash: 4ec00d7f1e0a5b91d99df83fe61f3d71c756aa91d1211cbd96cd53833451ee2a
Instruction Fuzzy Hash: 9A02C171E00209DBCF14DF65D981AAEBBB5FF44300F248069E80ADB255EF39DA51EB91

Function 00F61287 Relevance: 7.9, APIs: 5, Instructions: 379COMMON

Download Yara Rule

APIs

Part of subcall function 00F62612: GetWindowLongW.USER32(?,000000EB), ref: 00F62623

DefDlgProcW.USER32(?,?,?,?,?), ref: 00F619FA
GetSysColor.USER32(0000000F), ref: 00F61A4E
SetBkColor.GDI32(?,00000000), ref: 00F61A61

Part of subcall function 00F61290: DefDlgProcW.USER32(?,00000020,?), ref: 00F612D8

Memory Dump Source

Source File: 00000000.00000002.1667912702.0000000000F61000.00000020.00000001.01000000.00000003.sdmp, Offset: 00F60000, based on PE: true

Associated: 00000000.00000002.1667891216.0000000000F60000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667966851.0000000000FEF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667966851.0000000001015000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1668035777.000000000101F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1668053678.0000000001028000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f60000_tgBNtoWqIp.jbxd

Similarity

API ID: ColorProc$LongWindow
String ID:
API String ID: 3744519093-0
Opcode ID: e96d192f94bcbfe5268b5fa378c3d920335c22ae8a1fa61dfd552231529a8cbd
Instruction ID: f6da61935b5d2559d7a3d4fc4bc5a038b64e345601b330bdbd54c272bd7cb35f
Opcode Fuzzy Hash: e96d192f94bcbfe5268b5fa378c3d920335c22ae8a1fa61dfd552231529a8cbd
Instruction Fuzzy Hash: A2A16C72505585BEFA38AE69AD54E7F355DFB82366B2C0219F402D61C2CE2E8D01F2B1

Function 00FD6A5A Relevance: 7.6, APIs: 5, Instructions: 141networkCOMMON

Download Yara Rule

APIs

Part of subcall function 00FD80A0: inet_addr.WSOCK32(00000000,?,00000000,?,?,?,00000000), ref: 00FD80CB

socket.WSOCK32(00000002,00000002,00000011,?,?,00000000), ref: 00FD6AB1
WSAGetLastError.WSOCK32(00000000), ref: 00FD6ADA
bind.WSOCK32(00000000,?,00000010), ref: 00FD6B13
WSAGetLastError.WSOCK32(00000000), ref: 00FD6B20
closesocket.WSOCK32(00000000,00000000), ref: 00FD6B34

Memory Dump Source

Source File: 00000000.00000002.1667912702.0000000000F61000.00000020.00000001.01000000.00000003.sdmp, Offset: 00F60000, based on PE: true

Associated: 00000000.00000002.1667891216.0000000000F60000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667966851.0000000000FEF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667966851.0000000001015000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1668035777.000000000101F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1668053678.0000000001028000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f60000_tgBNtoWqIp.jbxd

Similarity

API ID: ErrorLast$bindclosesocketinet_addrsocket
String ID:
API String ID: 99427753-0
Opcode ID: abb259daf0882f422f230537eb8b6d9c18d5a14b84e581605cc1d9b529bca52e
Instruction ID: c58cc765ed8f92931098fd7ee68fb622df084390e439f627c8b0b36eec246603
Opcode Fuzzy Hash: abb259daf0882f422f230537eb8b6d9c18d5a14b84e581605cc1d9b529bca52e
Instruction Fuzzy Hash: 6341B275B00214AFEB10AF64DC86F6E77A9DB44720F08815DF95AAB3C2CA789D01A791

Function 00FE55FD Relevance: 7.6, APIs: 5, Instructions: 69windowCOMMON

Download Yara Rule

APIs

IsWindowVisible.USER32 ref: 00FE564C
IsWindowEnabled.USER32 ref: 00FE565A
GetForegroundWindow.USER32(?,?,00000001), ref: 00FE5667
IsIconic.USER32 ref: 00FE5675
IsZoomed.USER32 ref: 00FE5683

Memory Dump Source

Source File: 00000000.00000002.1667912702.0000000000F61000.00000020.00000001.01000000.00000003.sdmp, Offset: 00F60000, based on PE: true

Associated: 00000000.00000002.1667891216.0000000000F60000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667966851.0000000000FEF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667966851.0000000001015000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1668035777.000000000101F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1668053678.0000000001028000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f60000_tgBNtoWqIp.jbxd

Similarity

API ID: Window$EnabledForegroundIconicVisibleZoomed
String ID:
API String ID: 292994002-0
Opcode ID: f4acda0766ffa029a54939e7572205617da855b98dc50fd7bcb196ad30c1fbbb
Instruction ID: a49345d59646e80633de699c4c814ee1fcf33b14bbc3e6deec6aa4a890526a54
Opcode Fuzzy Hash: f4acda0766ffa029a54939e7572205617da855b98dc50fd7bcb196ad30c1fbbb
Instruction Fuzzy Hash: 9311C432700A946FEB211F27DC44B2F779DFF94B25B444429F806DB251CB749901AAA4

Function 00FDC304 Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 19libraryloaderCOMMON

Download Yara Rule

APIs

LoadLibraryA.KERNEL32(kernel32.dll,?,00FA1D88,?), ref: 00FDC312
GetProcAddress.KERNEL32(00000000,GetSystemWow64DirectoryW), ref: 00FDC324

Strings

GetSystemWow64DirectoryW, xrefs: 00FDC31E
kernel32.dll, xrefs: 00FDC30D

Memory Dump Source

Source File: 00000000.00000002.1667912702.0000000000F61000.00000020.00000001.01000000.00000003.sdmp, Offset: 00F60000, based on PE: true

Associated: 00000000.00000002.1667891216.0000000000F60000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667966851.0000000000FEF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667966851.0000000001015000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1668035777.000000000101F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1668053678.0000000001028000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f60000_tgBNtoWqIp.jbxd

Similarity

API ID: AddressLibraryLoadProc
String ID: GetSystemWow64DirectoryW$kernel32.dll
API String ID: 2574300362-1816364905
Opcode ID: c2c0a78722c43bd29956d6e68efaa5351ee83d71dbb76494982db80511d1693a
Instruction ID: de8e93c82b2718650317b6995bc4880dc23bc567a44b73dd7c9bdf9ebfb00565
Opcode Fuzzy Hash: c2c0a78722c43bd29956d6e68efaa5351ee83d71dbb76494982db80511d1693a
Instruction Fuzzy Hash: C1E0C270A00707CFDB205F2AD844A46B6E4EF08328B84C43FE885CA320E774D840EBA0

Function 00F73190 Relevance: 6.6, APIs: 4, Instructions: 587COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1667912702.0000000000F61000.00000020.00000001.01000000.00000003.sdmp, Offset: 00F60000, based on PE: true

Associated: 00000000.00000002.1667891216.0000000000F60000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667966851.0000000000FEF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667966851.0000000001015000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1668035777.000000000101F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1668053678.0000000001028000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f60000_tgBNtoWqIp.jbxd

Similarity

API ID: __itow__swprintf
String ID:
API String ID: 674341424-0
Opcode ID: b25e8b27ff2a81f4a511ba25c88c7e3f7c3f755e7b78a472a8785699bb093822
Instruction ID: 8f60d053178059bad42e6a7a2f6cb381901347853d1f9a93080f78e1e67144cb
Opcode Fuzzy Hash: b25e8b27ff2a81f4a511ba25c88c7e3f7c3f755e7b78a472a8785699bb093822
Instruction Fuzzy Hash: 9D228D71508301AFC724EF24CC91BAAB7E4EF85710F14891EF49A97291DB75EA04EB93

Function 00FDF121 Relevance: 6.2, APIs: 4, Instructions: 164processCOMMON

Download Yara Rule

APIs

CreateToolhelp32Snapshot.KERNEL32 ref: 00FDF151
Process32FirstW.KERNEL32(00000000,?), ref: 00FDF15F

Part of subcall function 00F67F41: _memmove.LIBCMT ref: 00F67F82

Process32NextW.KERNEL32(00000000,?), ref: 00FDF21F
CloseHandle.KERNEL32(00000000,?,?,?), ref: 00FDF22E

Memory Dump Source

Source File: 00000000.00000002.1667912702.0000000000F61000.00000020.00000001.01000000.00000003.sdmp, Offset: 00F60000, based on PE: true

Associated: 00000000.00000002.1667891216.0000000000F60000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667966851.0000000000FEF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667966851.0000000001015000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1668035777.000000000101F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1668053678.0000000001028000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f60000_tgBNtoWqIp.jbxd

Similarity

API ID: Process32$CloseCreateFirstHandleNextSnapshotToolhelp32_memmove
String ID:
API String ID: 2576544623-0
Opcode ID: c93dd022864d543757bb3d3c5edbbf5f84b91886a1b61e6d39649a4cee9f545a
Instruction ID: 4d141bb2d0ab19e4d36aae0e59a4a14f781ff1984b5509a20cced32ba0e31809
Opcode Fuzzy Hash: c93dd022864d543757bb3d3c5edbbf5f84b91886a1b61e6d39649a4cee9f545a
Instruction Fuzzy Hash: A6518F715083019FD310EF20DC85E6BBBE9FF94710F14492DF49697291EB74A908EB92

Function 00FC40B1 Relevance: 6.1, APIs: 4, Instructions: 65fileCOMMON

Download Yara Rule

APIs

CreateFileW.KERNEL32(?,C0000000,00000003,00000000,00000003,00000080,00000000), ref: 00FC40D1
_memset.LIBCMT ref: 00FC40F2
DeviceIoControl.KERNEL32(00000000,0004D02C,?,00000200,?,00000200,?,00000000), ref: 00FC4144
CloseHandle.KERNEL32(00000000), ref: 00FC414D

Memory Dump Source

Source File: 00000000.00000002.1667912702.0000000000F61000.00000020.00000001.01000000.00000003.sdmp, Offset: 00F60000, based on PE: true

Associated: 00000000.00000002.1667891216.0000000000F60000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667966851.0000000000FEF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667966851.0000000001015000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1668035777.000000000101F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1668053678.0000000001028000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f60000_tgBNtoWqIp.jbxd

Similarity

API ID: CloseControlCreateDeviceFileHandle_memset
String ID:
API String ID: 1157408455-0
Opcode ID: 59cd3e133a3366a3c7e6cd0583291d56863ef23009da45d8b2ef4c333035d9aa
Instruction ID: 36fd56769aec625dfbd988fba776685d93115feb63908305dc2cc8b72cb8b943
Opcode Fuzzy Hash: 59cd3e133a3366a3c7e6cd0583291d56863ef23009da45d8b2ef4c333035d9aa
Instruction Fuzzy Hash: A911C475D4122C7AD7309AA5AC4DFABBB7CEB44760F1041AAF908D7180D6744E849BA4

Function 00FBEB07 Relevance: 5.1, APIs: 1, Strings: 2, Instructions: 561stringCOMMON

Download Yara Rule

APIs

lstrlenW.KERNEL32(?,?,?,00000000), ref: 00FBEB19

Strings

(, xrefs: 00FBEB5F
|, xrefs: 00FBEB49

Memory Dump Source

Source File: 00000000.00000002.1667912702.0000000000F61000.00000020.00000001.01000000.00000003.sdmp, Offset: 00F60000, based on PE: true

Associated: 00000000.00000002.1667891216.0000000000F60000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667966851.0000000000FEF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667966851.0000000001015000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1668035777.000000000101F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1668053678.0000000001028000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f60000_tgBNtoWqIp.jbxd

Similarity

API ID: lstrlen
String ID: ($|
API String ID: 1659193697-1631851259
Opcode ID: 2fecab57276784ed7a9f072601017bd07c66761ef6d191368bab3ce5dd7fff29
Instruction ID: 25caaf00d451e19976588d3ffcbb3bd6beef984fe5889ba6e9b2b3d0461ef51c
Opcode Fuzzy Hash: 2fecab57276784ed7a9f072601017bd07c66761ef6d191368bab3ce5dd7fff29
Instruction Fuzzy Hash: DE322675A006059FD728DF1AC481AAAB7F1FF48320B15C56EE89ADB3A1DB70E941DF40

Function 00FD25E2 Relevance: 4.7, APIs: 3, Instructions: 164networkfileCOMMON

Download Yara Rule

APIs

InternetQueryDataAvailable.WININET(00000001,?,00000000,00000000), ref: 00FD26D5
InternetReadFile.WININET(00000001,00000000,00000001,00000001), ref: 00FD270C

Memory Dump Source

Source File: 00000000.00000002.1667912702.0000000000F61000.00000020.00000001.01000000.00000003.sdmp, Offset: 00F60000, based on PE: true

Associated: 00000000.00000002.1667891216.0000000000F60000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667966851.0000000000FEF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667966851.0000000001015000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1668035777.000000000101F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1668053678.0000000001028000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f60000_tgBNtoWqIp.jbxd

Similarity

API ID: Internet$AvailableDataFileQueryRead
String ID:
API String ID: 599397726-0
Opcode ID: 5880070fb855b6312045e631cc53fe42e87458ec4dce3d5936f060f2f5b29b3f
Instruction ID: 8c159064a911f586502bc663a528b6e3b177c23333b3fbcc4103634a0c73896d
Opcode Fuzzy Hash: 5880070fb855b6312045e631cc53fe42e87458ec4dce3d5936f060f2f5b29b3f
Instruction Fuzzy Hash: 1741B372900309BFEB609A54DC85FBBB7BEEB50724F18406BF601A6240EA75DE41B694

Function 00FCB59E Relevance: 4.6, APIs: 3, Instructions: 73COMMON

Download Yara Rule

APIs

SetErrorMode.KERNEL32(00000001), ref: 00FCB5AE
GetDiskFreeSpaceExW.KERNEL32(?,?,?,?), ref: 00FCB608
SetErrorMode.KERNEL32(00000000,00000001,00000000), ref: 00FCB655

Memory Dump Source

Source File: 00000000.00000002.1667912702.0000000000F61000.00000020.00000001.01000000.00000003.sdmp, Offset: 00F60000, based on PE: true

Associated: 00000000.00000002.1667891216.0000000000F60000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667966851.0000000000FEF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667966851.0000000001015000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1668035777.000000000101F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1668053678.0000000001028000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f60000_tgBNtoWqIp.jbxd

Similarity

API ID: ErrorMode$DiskFreeSpace
String ID:
API String ID: 1682464887-0
Opcode ID: c2ba9e41de486f7839db725871340770a781a16ea601953b4eb4151038acfc36
Instruction ID: e29990f412ec787b2bb4ddad9ce3fee6ad11f671780da738fcd277e4b169062c
Opcode Fuzzy Hash: c2ba9e41de486f7839db725871340770a781a16ea601953b4eb4151038acfc36
Instruction Fuzzy Hash: 7E215E35A00518EFCB00EFA5DC91EADBBB8FF48310F1480A9E945AB351DB35A915EB51

Function 00FB8CC3 Relevance: 4.6, APIs: 3, Instructions: 67COMMON

Download Yara Rule

APIs

Part of subcall function 00F80FF6: std::exception::exception.LIBCMT ref: 00F8102C
Part of subcall function 00F80FF6: __CxxThrowException@8.LIBCMT ref: 00F81041

LookupPrivilegeValueW.ADVAPI32(00000000,00000000,00000004), ref: 00FB8D0D
AdjustTokenPrivileges.ADVAPI32(?,00000000,00000000,?,00000000,?), ref: 00FB8D3A
GetLastError.KERNEL32 ref: 00FB8D47

Memory Dump Source

Source File: 00000000.00000002.1667912702.0000000000F61000.00000020.00000001.01000000.00000003.sdmp, Offset: 00F60000, based on PE: true

Associated: 00000000.00000002.1667891216.0000000000F60000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667966851.0000000000FEF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667966851.0000000001015000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1668035777.000000000101F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1668053678.0000000001028000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f60000_tgBNtoWqIp.jbxd

Similarity

API ID: AdjustErrorException@8LastLookupPrivilegePrivilegesThrowTokenValuestd::exception::exception
String ID:
API String ID: 1922334811-0
Opcode ID: 312e9a15b90f7a6fbaaf0b6aa5fb6c6b63ccc807a32a22c827c3367d7ca47445
Instruction ID: 584b49c93888439b5a3795a5cf53e6627bfa57b40bd9433ab7c20528ddaa56d7
Opcode Fuzzy Hash: 312e9a15b90f7a6fbaaf0b6aa5fb6c6b63ccc807a32a22c827c3367d7ca47445
Instruction Fuzzy Hash: BC118FB1814209AFD728AF54DC85DABB7BCFB44750B20852EF45697251EF30AC45DB60

Function 00FC4C03 Relevance: 4.5, APIs: 3, Instructions: 43memoryCOMMON

Download Yara Rule

APIs

AllocateAndInitializeSid.ADVAPI32(?,00000002,00000020,00000220,00000000,00000000,00000000,00000000,00000000,00000000,?), ref: 00FC4C2C
CheckTokenMembership.ADVAPI32(00000000,?,?), ref: 00FC4C43
FreeSid.ADVAPI32(?), ref: 00FC4C53

Memory Dump Source

Source File: 00000000.00000002.1667912702.0000000000F61000.00000020.00000001.01000000.00000003.sdmp, Offset: 00F60000, based on PE: true

Associated: 00000000.00000002.1667891216.0000000000F60000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667966851.0000000000FEF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667966851.0000000001015000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1668035777.000000000101F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1668053678.0000000001028000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f60000_tgBNtoWqIp.jbxd

Similarity

API ID: AllocateCheckFreeInitializeMembershipToken
String ID:
API String ID: 3429775523-0
Opcode ID: 265d16e9b530394c5b0c397475a62fcd810e36aedf87e1a4e203c86aa5fbd386
Instruction ID: 0cefd135a1efe03607bdd64c346c831c961e9c05ba1cdb98f3e8a68a42601e2b
Opcode Fuzzy Hash: 265d16e9b530394c5b0c397475a62fcd810e36aedf87e1a4e203c86aa5fbd386
Instruction Fuzzy Hash: 28F04975E1130DBFDF04DFF0DD89AAEBBBCEF08311F0044A9AA01E6181E6706A089B50

Function 00F6E060 Relevance: 3.5, APIs: 2, Instructions: 539COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1667912702.0000000000F61000.00000020.00000001.01000000.00000003.sdmp, Offset: 00F60000, based on PE: true

Associated: 00000000.00000002.1667891216.0000000000F60000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667966851.0000000000FEF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667966851.0000000001015000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1668035777.000000000101F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1668053678.0000000001028000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f60000_tgBNtoWqIp.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 11a1fd53ad76101abc13ec3cf17304e6daadb9839c13b740c93ec69e2512bc30
Instruction ID: bd94ab114497b91c4cf3079fe1d87fd4926e80b35f3409d2c9cca5e05e488275
Opcode Fuzzy Hash: 11a1fd53ad76101abc13ec3cf17304e6daadb9839c13b740c93ec69e2512bc30
Instruction Fuzzy Hash: 2B22BE7AE00216CFCB24DF58C891BAEBBF1FF05310F148169E8569B351E734A985EB91

Function 00FCC93C Relevance: 3.1, APIs: 2, Instructions: 52fileCOMMON

Download Yara Rule

APIs

FindFirstFileW.KERNEL32(?,?), ref: 00FCC966
FindClose.KERNEL32(00000000), ref: 00FCC996

Memory Dump Source

Source File: 00000000.00000002.1667912702.0000000000F61000.00000020.00000001.01000000.00000003.sdmp, Offset: 00F60000, based on PE: true

Associated: 00000000.00000002.1667891216.0000000000F60000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667966851.0000000000FEF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667966851.0000000001015000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1668035777.000000000101F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1668053678.0000000001028000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f60000_tgBNtoWqIp.jbxd

Similarity

API ID: Find$CloseFileFirst
String ID:
API String ID: 2295610775-0
Opcode ID: 39dfa84ea3408639a36d6cbdd7ec858913b0e97fb671bd631f0606366d04cd88
Instruction ID: d2b2e1e2b185c78422fce1ff22d89a09b8a8bc1f8ea208b040b62cbc6e8751b3
Opcode Fuzzy Hash: 39dfa84ea3408639a36d6cbdd7ec858913b0e97fb671bd631f0606366d04cd88
Instruction Fuzzy Hash: 6B11A5326042049FD710EF29CC45A2AF7E9FF44320F04851EF8A9DB291DB74AC04DB81

Function 00FCA2D5 Relevance: 3.0, APIs: 2, Instructions: 31windowCOMMON

Download Yara Rule

APIs

GetLastError.KERNEL32(00000000,?,00000FFF,00000000,00000016,?,00FD977D,?,00FEFB84,?), ref: 00FCA302
FormatMessageW.KERNEL32(00001000,00000000,000000FF,00000000,?,00000FFF,00000000,00000016,?,00FD977D,?,00FEFB84,?), ref: 00FCA314

Memory Dump Source

Source File: 00000000.00000002.1667912702.0000000000F61000.00000020.00000001.01000000.00000003.sdmp, Offset: 00F60000, based on PE: true

Associated: 00000000.00000002.1667891216.0000000000F60000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667966851.0000000000FEF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667966851.0000000001015000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1668035777.000000000101F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1668053678.0000000001028000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f60000_tgBNtoWqIp.jbxd

Similarity

API ID: ErrorFormatLastMessage
String ID:
API String ID: 3479602957-0
Opcode ID: acb74abb6f54b68bd88235c475ac09719693d5beed2200dbb7d4b4c347fe3dc9
Instruction ID: 864913c1f0ed48c7b3095032e2b2708a66d23e2ae60c9a386666b871602920de
Opcode Fuzzy Hash: acb74abb6f54b68bd88235c475ac09719693d5beed2200dbb7d4b4c347fe3dc9
Instruction Fuzzy Hash: 61F0823554426EABEB10AFA4CC49FEA776DBF08761F004169B908D6181D6309954DBE1

Function 00FB8713 Relevance: 3.0, APIs: 2, Instructions: 22COMMON

Download Yara Rule

APIs

AdjustTokenPrivileges.ADVAPI32(?,00000000,?,00000000,00000000,00000000,?,00FB8851), ref: 00FB8728
CloseHandle.KERNEL32(?,?,00FB8851), ref: 00FB873A

Memory Dump Source

Source File: 00000000.00000002.1667912702.0000000000F61000.00000020.00000001.01000000.00000003.sdmp, Offset: 00F60000, based on PE: true

Associated: 00000000.00000002.1667891216.0000000000F60000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667966851.0000000000FEF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667966851.0000000001015000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1668035777.000000000101F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1668053678.0000000001028000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f60000_tgBNtoWqIp.jbxd

Similarity

API ID: AdjustCloseHandlePrivilegesToken
String ID:
API String ID: 81990902-0
Opcode ID: cedf4c25f83a93c3efdd46e36f68280d31cea01f58d5645f77ae2699939a5a6b
Instruction ID: 0fca2ee08734719a4834dd1881693efd8b1f3ce290adfdfab097bd7bfd74befd
Opcode Fuzzy Hash: cedf4c25f83a93c3efdd46e36f68280d31cea01f58d5645f77ae2699939a5a6b
Instruction Fuzzy Hash: 1CE0EC76010650EFE7252B61EC09DB77BEDFF44364B24893DF59684470DB62AC92EB10

Function 00F8A395 Relevance: 3.0, APIs: 2, Instructions: 8COMMONLIBRARYCODE

Download Yara Rule

APIs

SetUnhandledExceptionFilter.KERNEL32(00000000,?,00F88F97,?,?,?,00000001), ref: 00F8A39A
UnhandledExceptionFilter.KERNEL32(?,?,?,00000001), ref: 00F8A3A3

Memory Dump Source

Source File: 00000000.00000002.1667912702.0000000000F61000.00000020.00000001.01000000.00000003.sdmp, Offset: 00F60000, based on PE: true

Associated: 00000000.00000002.1667891216.0000000000F60000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667966851.0000000000FEF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667966851.0000000001015000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1668035777.000000000101F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1668053678.0000000001028000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f60000_tgBNtoWqIp.jbxd

Similarity

API ID: ExceptionFilterUnhandled
String ID:
API String ID: 3192549508-0
Opcode ID: e1e424527fe294bf58993d0f3adb69629a8b5108bba17c53306d9f08c63e0131
Instruction ID: ea93c70c0d5995f0cad53e68cceeb9a7bbc6a47ad8b29831b838b4327625bd66
Opcode Fuzzy Hash: e1e424527fe294bf58993d0f3adb69629a8b5108bba17c53306d9f08c63e0131
Instruction Fuzzy Hash: 41B0923105424CAFCA002B91EC49B883F68EB44AA2F404020F60D88474CB625554AA91

Function 00F8F419 Relevance: 2.1, APIs: 1, Instructions: 645COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1667912702.0000000000F61000.00000020.00000001.01000000.00000003.sdmp, Offset: 00F60000, based on PE: true

Associated: 00000000.00000002.1667891216.0000000000F60000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667966851.0000000000FEF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667966851.0000000001015000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1668035777.000000000101F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1668053678.0000000001028000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f60000_tgBNtoWqIp.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1c2ad69c5bb21c585423ab2a96f66e229a9fd5772d8362836de2907ec5519710
Instruction ID: 3ea0c00bf50853b98fa1a6103b64625a229a9f78e2e996d868192463d31d5825
Opcode Fuzzy Hash: 1c2ad69c5bb21c585423ab2a96f66e229a9fd5772d8362836de2907ec5519710
Instruction Fuzzy Hash: 1E321722D69F054DD7236634DC32336A24DAFB73D4F15D737E819B5AAAEB28C5836200

Function 00F9267E Relevance: 1.8, APIs: 1, Instructions: 294COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1667912702.0000000000F61000.00000020.00000001.01000000.00000003.sdmp, Offset: 00F60000, based on PE: true

Associated: 00000000.00000002.1667891216.0000000000F60000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667966851.0000000000FEF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667966851.0000000001015000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1668035777.000000000101F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1668053678.0000000001028000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f60000_tgBNtoWqIp.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ecdedd649629bccec2d3448b39a2bf2558d3ec9074e7a9ace37925d20803e522
Instruction ID: b6233c4dcdec18ef99b9271e9b4b0a76bf7040bb340f46912571120cb914f301
Opcode Fuzzy Hash: ecdedd649629bccec2d3448b39a2bf2558d3ec9074e7a9ace37925d20803e522
Instruction Fuzzy Hash: DBB1F161D2AF454DD72397398871336B64CAFBB2C5F51D71BFC2A70D22EB228583A141

Function 00FC8B13 Relevance: 1.6, APIs: 1, Instructions: 68COMMON

Download Yara Rule

APIs

__time64.LIBCMT ref: 00FC8B25

Part of subcall function 00F8543A: GetSystemTimeAsFileTime.KERNEL32(00000000,?,?,?,00FC91F8,00000000,?,?,?,?,00FC93A9,00000000,?), ref: 00F85443
Part of subcall function 00F8543A: __aulldiv.LIBCMT ref: 00F85463

Memory Dump Source

Source File: 00000000.00000002.1667912702.0000000000F61000.00000020.00000001.01000000.00000003.sdmp, Offset: 00F60000, based on PE: true

Associated: 00000000.00000002.1667891216.0000000000F60000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667966851.0000000000FEF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667966851.0000000001015000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1668035777.000000000101F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1668053678.0000000001028000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f60000_tgBNtoWqIp.jbxd

Similarity

API ID: Time$FileSystem__aulldiv__time64
String ID:
API String ID: 2893107130-0
Opcode ID: 9f3016457561ebdd5acb614e45ee841cda0ad95b68b4646735232db8f5948043
Instruction ID: d4097edd3751799f03bafa35784ea8aa646f519a74347c33b4dc760f1205c231
Opcode Fuzzy Hash: 9f3016457561ebdd5acb614e45ee841cda0ad95b68b4646735232db8f5948043
Instruction Fuzzy Hash: 5E21B4726355118BC729CF25D441B52B3E1EFB5321B288E6CD0E5CB2D0CA79BD05DB94

Function 00FD41FD Relevance: 1.5, APIs: 1, Instructions: 25keyboardCOMMON

Download Yara Rule

APIs

BlockInput.USER32(00000001), ref: 00FD4218

Memory Dump Source

Source File: 00000000.00000002.1667912702.0000000000F61000.00000020.00000001.01000000.00000003.sdmp, Offset: 00F60000, based on PE: true

Associated: 00000000.00000002.1667891216.0000000000F60000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667966851.0000000000FEF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667966851.0000000001015000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1668035777.000000000101F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1668053678.0000000001028000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f60000_tgBNtoWqIp.jbxd

Similarity

API ID: BlockInput
String ID:
API String ID: 3456056419-0
Opcode ID: 2bdc3f46fc790583e7b1be84476974355a988070d261d4c86e3c1de4779dcd29
Instruction ID: 93cce0d2e35d1b45545872b1edcb5dada21505bbe8566c2f2d184c5c15a5c240
Opcode Fuzzy Hash: 2bdc3f46fc790583e7b1be84476974355a988070d261d4c86e3c1de4779dcd29
Instruction Fuzzy Hash: B1E04F322442149FC710EF59D844A9AF7EDEF94761F048026FC49CB352DAB4F840ABA0

Function 00FC4EF5 Relevance: 1.5, APIs: 1, Instructions: 24COMMON

Download Yara Rule

APIs

mouse_event.USER32(00000004,00000000,00000000,00000000,00000000), ref: 00FC4F18

Memory Dump Source

Source File: 00000000.00000002.1667912702.0000000000F61000.00000020.00000001.01000000.00000003.sdmp, Offset: 00F60000, based on PE: true

Associated: 00000000.00000002.1667891216.0000000000F60000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667966851.0000000000FEF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667966851.0000000001015000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1668035777.000000000101F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1668053678.0000000001028000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f60000_tgBNtoWqIp.jbxd

Similarity

API ID: mouse_event
String ID:
API String ID: 2434400541-0
Opcode ID: 45f7070ce655521303f6cbbaf76b537d4fe2e82b5443d44d53cef4e389dedf79
Instruction ID: c8da8ff1a71dbce1cb10c31bcbda0025dc235b400535bf63b1ed8234e77f6311
Opcode Fuzzy Hash: 45f7070ce655521303f6cbbaf76b537d4fe2e82b5443d44d53cef4e389dedf79
Instruction Fuzzy Hash: 3CD05EB156420B38FC184B20AE3FF761118E3407A1F84498D32018B4C2D9E57800F434

Function 00FB8C93 Relevance: 1.5, APIs: 1, Instructions: 19COMMON

Download Yara Rule

APIs

LogonUserW.ADVAPI32(?,00000001,?,?,00000000,00FB88D1), ref: 00FB8CB3

Memory Dump Source

Source File: 00000000.00000002.1667912702.0000000000F61000.00000020.00000001.01000000.00000003.sdmp, Offset: 00F60000, based on PE: true

Associated: 00000000.00000002.1667891216.0000000000F60000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667966851.0000000000FEF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667966851.0000000001015000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1668035777.000000000101F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1668053678.0000000001028000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f60000_tgBNtoWqIp.jbxd

Similarity

API ID: LogonUser
String ID:
API String ID: 1244722697-0
Opcode ID: 9c85d6578cd1bdd33f1b67365867ae4bc1656697d7764954665494b697128e72
Instruction ID: 7391776a51f09323181cb5a69d38d24164bd75897e0a2f4c04b1841ffc5cca8d
Opcode Fuzzy Hash: 9c85d6578cd1bdd33f1b67365867ae4bc1656697d7764954665494b697128e72
Instruction Fuzzy Hash: FAD05E3226050EABEF018EA4DC01EAE3B69EB04B01F408111FE15C50A1C775D835AB60

Function 00FA2230 Relevance: 1.5, APIs: 1, Instructions: 7COMMON

Download Yara Rule

APIs

GetUserNameW.ADVAPI32(?,?), ref: 00FA2242

Memory Dump Source

Source File: 00000000.00000002.1667912702.0000000000F61000.00000020.00000001.01000000.00000003.sdmp, Offset: 00F60000, based on PE: true

Associated: 00000000.00000002.1667891216.0000000000F60000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667966851.0000000000FEF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667966851.0000000001015000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1668035777.000000000101F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1668053678.0000000001028000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f60000_tgBNtoWqIp.jbxd

Similarity

API ID: NameUser
String ID:
API String ID: 2645101109-0
Opcode ID: 59208a557cd77200d67f885fb632c530e1a0d75c0b7295ec98bfdfca294d3204
Instruction ID: c0f4c17f90c21e195346bd680c4502e82d4c31ee810003203e302e3e7952ae11
Opcode Fuzzy Hash: 59208a557cd77200d67f885fb632c530e1a0d75c0b7295ec98bfdfca294d3204
Instruction Fuzzy Hash: CFC04CF181110DDBDB05DB90D988DEE77BCBB04304F104155A101F2140D7749B449A71

Function 00F8A364 Relevance: 1.5, APIs: 1, Instructions: 6COMMON

Download Yara Rule

APIs

SetUnhandledExceptionFilter.KERNEL32(?), ref: 00F8A36A

Memory Dump Source

Source File: 00000000.00000002.1667912702.0000000000F61000.00000020.00000001.01000000.00000003.sdmp, Offset: 00F60000, based on PE: true

Associated: 00000000.00000002.1667891216.0000000000F60000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667966851.0000000000FEF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667966851.0000000001015000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1668035777.000000000101F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1668053678.0000000001028000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f60000_tgBNtoWqIp.jbxd

Similarity

API ID: ExceptionFilterUnhandled
String ID:
API String ID: 3192549508-0
Opcode ID: 8ad0afc299c20166fef98dabd9a19f45a63aeedf8aa78721750f758c07e9a43e
Instruction ID: 99a35fbfdbbbc54432f9fc16fc11a5b48b001e8d42552d7defeff3dc5d13647f
Opcode Fuzzy Hash: 8ad0afc299c20166fef98dabd9a19f45a63aeedf8aa78721750f758c07e9a43e
Instruction Fuzzy Hash: 4CA0223000020CFFCF002F82FC08888BFACEB002E0B008030F80C88032CB33A820AAC0

Function 00F78A0E Relevance: .6, Instructions: 608COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1667912702.0000000000F61000.00000020.00000001.01000000.00000003.sdmp, Offset: 00F60000, based on PE: true

Associated: 00000000.00000002.1667891216.0000000000F60000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667966851.0000000000FEF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667966851.0000000001015000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1668035777.000000000101F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1668053678.0000000001028000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f60000_tgBNtoWqIp.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 51ab680d3289156b40464f3cf48abe736e11268238c43bb475687902efa0c06e
Instruction ID: 3b8c44229139b15929caac5b0f031c52203e93ebd74157acb640b58bb2c1378b
Opcode Fuzzy Hash: 51ab680d3289156b40464f3cf48abe736e11268238c43bb475687902efa0c06e
Instruction Fuzzy Hash: C3224B31E41515CBDF298A19C4987BD77A1EB41790F28C42BD84A8B291DB38DD82FF62

Function 00F82405 Relevance: .3, Instructions: 345COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1667912702.0000000000F61000.00000020.00000001.01000000.00000003.sdmp, Offset: 00F60000, based on PE: true

Associated: 00000000.00000002.1667891216.0000000000F60000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667966851.0000000000FEF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667966851.0000000001015000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1668035777.000000000101F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1668053678.0000000001028000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f60000_tgBNtoWqIp.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: bf6ffcbe3773841c348058a39a16573d3b2338b254e5945c46ce03dce2746f28
Instruction ID: e7311f7bcffe4ae14097957925744019cbc8c7cc0f148708a8248f6c9c2d2d98
Opcode Fuzzy Hash: bf6ffcbe3773841c348058a39a16573d3b2338b254e5945c46ce03dce2746f28
Instruction Fuzzy Hash: 5DC1A4326050630ADF5D9639D4341BEBAE16AA27B131A075DE4B3CB4C5EF24E525F720

Function 00F8283A Relevance: .3, Instructions: 341COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1667912702.0000000000F61000.00000020.00000001.01000000.00000003.sdmp, Offset: 00F60000, based on PE: true

Associated: 00000000.00000002.1667891216.0000000000F60000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667966851.0000000000FEF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667966851.0000000001015000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1668035777.000000000101F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1668053678.0000000001028000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f60000_tgBNtoWqIp.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a635e2a33a60bcf8d734eac2a911e111534612f0cd64c6a362f1e57f4f360174
Instruction ID: c4905431b6554f1d873e28b105487c8bb68a6dc902beb4fb52935ca983582503
Opcode Fuzzy Hash: a635e2a33a60bcf8d734eac2a911e111534612f0cd64c6a362f1e57f4f360174
Instruction Fuzzy Hash: 6DC1A4326051A309DFAD563994341BEBBE16FA27B131A076DE4B2DB4C4EF24E524F720

Function 00F81BB8 Relevance: .3, Instructions: 323COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1667912702.0000000000F61000.00000020.00000001.01000000.00000003.sdmp, Offset: 00F60000, based on PE: true

Associated: 00000000.00000002.1667891216.0000000000F60000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667966851.0000000000FEF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667966851.0000000001015000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1668035777.000000000101F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1668053678.0000000001028000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f60000_tgBNtoWqIp.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b18fb967447e529c76739499a87999de3f08bdf72590393fa5476362680146d7
Instruction ID: d6ea504919765838f28c8e6d6f974d0303f2b1592c072edb63462a3278485d7d
Opcode Fuzzy Hash: b18fb967447e529c76739499a87999de3f08bdf72590393fa5476362680146d7
Instruction Fuzzy Hash: 17C1C4326051A309DF2D563994341BEBBE97AA27B131A076DE4B3CB4C4EF24D526F710

Function 011B3600 Relevance: .1, Instructions: 92COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1668313329.00000000011B0000.00000040.00001000.00020000.00000000.sdmp, Offset: 011B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_11b0000_tgBNtoWqIp.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 424b499c86482d5e2cad33d2eb2b77d7085f14ac4781241b47b3debc7e1ef18c
Instruction ID: cde16b19ef9c3ab9b57aa2fc1a60cd09292959aa76d176036e15cf3c50dc8561
Opcode Fuzzy Hash: 424b499c86482d5e2cad33d2eb2b77d7085f14ac4781241b47b3debc7e1ef18c
Instruction Fuzzy Hash: 1F41C271D1051CEBCF48CFADC991AEEBBF2AF88201F548299D516AB345D730AB41DB40

Function 011B3490 Relevance: .0, Instructions: 35COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1668313329.00000000011B0000.00000040.00001000.00020000.00000000.sdmp, Offset: 011B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_11b0000_tgBNtoWqIp.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6091d3ab8c142cd01bdaf95ad615aaddba634de501579065cef803e1d5150a63
Instruction ID: 0d3688bdb30a53f1a724ed2098bb074fbb0d70aff2dc7defbf47aa6fcd792565
Opcode Fuzzy Hash: 6091d3ab8c142cd01bdaf95ad615aaddba634de501579065cef803e1d5150a63
Instruction Fuzzy Hash: D801EF78A14209EFCB49DF98C5809AEF7F6FF48310F208599E819A7301E734AE51DB80

Function 011B34F0 Relevance: .0, Instructions: 35COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1668313329.00000000011B0000.00000040.00001000.00020000.00000000.sdmp, Offset: 011B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_11b0000_tgBNtoWqIp.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2824983519b781728331ca74e43d8f1b114060d413125894b627f2317d3cf6f3
Instruction ID: 1634daedf4b85adbe23fdbbd6ba50fa956526df7848a96f7ba3fc93d7b50d0c6
Opcode Fuzzy Hash: 2824983519b781728331ca74e43d8f1b114060d413125894b627f2317d3cf6f3
Instruction Fuzzy Hash: 89019278A15109EFCB49DF98C5909AEF7B5FF48310F208599D819A7701D730AE51DB80

Function 011B1E70 Relevance: .0, Instructions: 6COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1668313329.00000000011B0000.00000040.00001000.00020000.00000000.sdmp, Offset: 011B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_11b0000_tgBNtoWqIp.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e1f80ac41b4fc2d45690e214ca5193b9bf4f67450f61a2a701b7f1fb86cd8f4e
Instruction ID: 2052e7d0eb43af8a57a5c2d707c06396f1b84aee57587abda472ed480d51124b
Opcode Fuzzy Hash: e1f80ac41b4fc2d45690e214ca5193b9bf4f67450f61a2a701b7f1fb86cd8f4e
Instruction Fuzzy Hash: 1AB012310527488BC2118B89E008B1073ECA308E04F1000B0D40C07B01827874008D48

Function 00FD7B1B Relevance: 77.5, APIs: 40, Strings: 4, Instructions: 491filecommemoryCOMMON

Download Yara Rule

APIs

DeleteObject.GDI32(00000000), ref: 00FD7B70
DeleteObject.GDI32(00000000), ref: 00FD7B82
DestroyWindow.USER32 ref: 00FD7B90
GetDesktopWindow.USER32 ref: 00FD7BAA
GetWindowRect.USER32(00000000), ref: 00FD7BB1
SetRect.USER32(?,00000000,00000000,000001F4,00000190), ref: 00FD7CF2
AdjustWindowRectEx.USER32(?,88C00000,00000000,00000002), ref: 00FD7D02
CreateWindowExW.USER32(00000002,AutoIt v3,?,88C00000,000000FF,000000FF,?,?,00000000,00000000,00000000), ref: 00FD7D4A
GetClientRect.USER32(00000000,?), ref: 00FD7D56
CreateWindowExW.USER32(00000000,static,00000000,5000000E,00000000,00000000,?,?,00000000,00000000,00000000), ref: 00FD7D90
CreateFileW.KERNEL32(?,80000000,00000000,00000000,00000003,00000000,00000000,?,88C00000,000000FF,000000FF,?,?,00000000,00000000,00000000), ref: 00FD7DB2
GetFileSize.KERNEL32(00000000,00000000,?,88C00000,000000FF,000000FF,?,?,00000000,00000000,00000000), ref: 00FD7DC5
GlobalAlloc.KERNEL32(00000002,00000000,?,88C00000,000000FF,000000FF,?,?,00000000,00000000,00000000), ref: 00FD7DD0
GlobalLock.KERNEL32(00000000,?,88C00000,000000FF,000000FF,?,?,00000000,00000000,00000000), ref: 00FD7DD9
ReadFile.KERNEL32(00000000,00000000,00000000,00000190,00000000,?,88C00000,000000FF,000000FF,?,?,00000000,00000000,00000000), ref: 00FD7DE8
GlobalUnlock.KERNEL32(00000000,?,88C00000,000000FF,000000FF,?,?,00000000,00000000,00000000), ref: 00FD7DF1
CloseHandle.KERNEL32(00000000,?,88C00000,000000FF,000000FF,?,?,00000000,00000000,00000000), ref: 00FD7DF8
GlobalFree.KERNEL32(00000000), ref: 00FD7E03
CreateStreamOnHGlobal.OLE32(00000000,00000001,88C00000,?,88C00000,000000FF,000000FF,?,?,00000000,00000000,00000000), ref: 00FD7E15
OleLoadPicture.OLEAUT32(88C00000,00000000,00000000,00FF2CAC,00000000), ref: 00FD7E2B
GlobalFree.KERNEL32(00000000), ref: 00FD7E3B
CopyImage.USER32(000001F4,00000000,00000000,00000000,00002000), ref: 00FD7E61
SendMessageW.USER32(?,00000172,00000000,000001F4), ref: 00FD7E80
SetWindowPos.USER32(?,00000000,00000000,00000000,?,?,00000020,?,88C00000,000000FF,000000FF,?,?,00000000,00000000,00000000), ref: 00FD7EA2
ShowWindow.USER32(00000004,?,88C00000,000000FF,000000FF,?,?,00000000,00000000,00000000), ref: 00FD808F

Strings

DISPLAY, xrefs: 00FD7EF2
static, xrefs: 00FD7D8A, 00FD7EE1
AutoIt v3, xrefs: 00FD7D42
, xrefs: 00FD8015

Memory Dump Source

Source File: 00000000.00000002.1667912702.0000000000F61000.00000020.00000001.01000000.00000003.sdmp, Offset: 00F60000, based on PE: true

Associated: 00000000.00000002.1667891216.0000000000F60000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667966851.0000000000FEF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667966851.0000000001015000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1668035777.000000000101F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1668053678.0000000001028000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f60000_tgBNtoWqIp.jbxd

Similarity

API ID: Window$Global$CreateRect$File$DeleteFreeObject$AdjustAllocClientCloseCopyDesktopDestroyHandleImageLoadLockMessagePictureReadSendShowSizeStreamUnlock
String ID: $AutoIt v3$DISPLAY$static
API String ID: 2211948467-2373415609
Opcode ID: 5dae93d93f40ead4e0e8c53532bec5082ec2cad0a99f5fde35f17d036643f399
Instruction ID: d1d732f0fc7f9a5b4a1a0f3741cf132d299aa3ab744eff35af0907b649cc712a
Opcode Fuzzy Hash: 5dae93d93f40ead4e0e8c53532bec5082ec2cad0a99f5fde35f17d036643f399
Instruction Fuzzy Hash: 0C029C71900219EFDF14DFA4CC89EAE7BB9EB48310F148159F905AB2A1DB75AD04EB60

Function 00FE37F3 Relevance: 51.1, APIs: 6, Strings: 23, Instructions: 365windowCOMMON

Download Yara Rule

APIs

CharUpperBuffW.USER32(?,?,00FEF910), ref: 00FE38AF
IsWindowVisible.USER32(?), ref: 00FE38D3

Strings

TABRIGHT, xrefs: 00FE3925
DELSTRING, xrefs: 00FE39D1
ISENABLED, xrefs: 00FE38F3
SELECTSTRING, xrefs: 00FE3A8E
SENDCOMMANDID, xrefs: 00FE3C62
UNCHECK, xrefs: 00FE3B0B
GETCURRENTSELECTION, xrefs: 00FE3A6B
HIDEDROPDOWN, xrefs: 00FE3988
GETCURRENTCOL, xrefs: 00FE3BB0
GETLINECOUNT, xrefs: 00FE3B4E
ISVISIBLE, xrefs: 00FE38BF
GETLINE, xrefs: 00FE3C23
SETCURRENTSELECTION, xrefs: 00FE3A3E
GETCURRENTLINE, xrefs: 00FE3B75
EDITPASTE, xrefs: 00FE3BE7
FINDSTRING, xrefs: 00FE39FE
CURRENTTAB, xrefs: 00FE3945
ISCHECKED, xrefs: 00FE3AC1
SHOWDROPDOWN, xrefs: 00FE3968
GETSELECTED, xrefs: 00FE3B2B
CHECK, xrefs: 00FE3AF5
ADDSTRING, xrefs: 00FE399E
TABLEFT, xrefs: 00FE390F

Memory Dump Source

Source File: 00000000.00000002.1667912702.0000000000F61000.00000020.00000001.01000000.00000003.sdmp, Offset: 00F60000, based on PE: true

Associated: 00000000.00000002.1667891216.0000000000F60000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667966851.0000000000FEF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667966851.0000000001015000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1668035777.000000000101F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1668053678.0000000001028000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f60000_tgBNtoWqIp.jbxd

Similarity

API ID: BuffCharUpperVisibleWindow
String ID: ADDSTRING$CHECK$CURRENTTAB$DELSTRING$EDITPASTE$FINDSTRING$GETCURRENTCOL$GETCURRENTLINE$GETCURRENTSELECTION$GETLINE$GETLINECOUNT$GETSELECTED$HIDEDROPDOWN$ISCHECKED$ISENABLED$ISVISIBLE$SELECTSTRING$SENDCOMMANDID$SETCURRENTSELECTION$SHOWDROPDOWN$TABLEFT$TABRIGHT$UNCHECK
API String ID: 4105515805-45149045
Opcode ID: 726aedfb3fc5ebca107be2b39978a1517add4bbdad4da9265211ba3fa1c7df54
Instruction ID: ae5d3856587a48ef08fafa4804af31b9d13f87b64acb421c719260e7c6f8e55e
Opcode Fuzzy Hash: 726aedfb3fc5ebca107be2b39978a1517add4bbdad4da9265211ba3fa1c7df54
Instruction Fuzzy Hash: 05D1B5312043459BCB10FF15C859AAE77E6EF94354F148458B8865B3A3CF79EE0AEB41

Function 00FEA849 Relevance: 49.8, APIs: 33, Instructions: 274COMMON

Download Yara Rule

APIs

SetTextColor.GDI32(?,00000000), ref: 00FEA89F
GetSysColorBrush.USER32(0000000F), ref: 00FEA8D0
GetSysColor.USER32(0000000F), ref: 00FEA8DC
SetBkColor.GDI32(?,000000FF), ref: 00FEA8F6
SelectObject.GDI32(?,?), ref: 00FEA905
InflateRect.USER32(?,000000FF,000000FF), ref: 00FEA930
GetSysColor.USER32(00000010), ref: 00FEA938
CreateSolidBrush.GDI32(00000000), ref: 00FEA93F
FrameRect.USER32(?,?,00000000), ref: 00FEA94E
DeleteObject.GDI32(00000000), ref: 00FEA955
InflateRect.USER32(?,000000FE,000000FE), ref: 00FEA9A0
FillRect.USER32(?,?,?), ref: 00FEA9D2
GetWindowLongW.USER32(?,000000F0), ref: 00FEA9FD

Part of subcall function 00FEAB60: GetSysColor.USER32(00000012), ref: 00FEAB99
Part of subcall function 00FEAB60: SetTextColor.GDI32(?,?), ref: 00FEAB9D
Part of subcall function 00FEAB60: GetSysColorBrush.USER32(0000000F), ref: 00FEABB3
Part of subcall function 00FEAB60: GetSysColor.USER32(0000000F), ref: 00FEABBE
Part of subcall function 00FEAB60: GetSysColor.USER32(00000011), ref: 00FEABDB
Part of subcall function 00FEAB60: CreatePen.GDI32(00000000,00000001,00743C00), ref: 00FEABE9
Part of subcall function 00FEAB60: SelectObject.GDI32(?,00000000), ref: 00FEABFA
Part of subcall function 00FEAB60: SetBkColor.GDI32(?,00000000), ref: 00FEAC03
Part of subcall function 00FEAB60: SelectObject.GDI32(?,?), ref: 00FEAC10
Part of subcall function 00FEAB60: InflateRect.USER32(?,000000FF,000000FF), ref: 00FEAC2F
Part of subcall function 00FEAB60: RoundRect.GDI32(?,?,?,?,?,00000005,00000005), ref: 00FEAC46
Part of subcall function 00FEAB60: GetWindowLongW.USER32(00000000,000000F0), ref: 00FEAC5B

Memory Dump Source

Source File: 00000000.00000002.1667912702.0000000000F61000.00000020.00000001.01000000.00000003.sdmp, Offset: 00F60000, based on PE: true

Associated: 00000000.00000002.1667891216.0000000000F60000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667966851.0000000000FEF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667966851.0000000001015000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1668035777.000000000101F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1668053678.0000000001028000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f60000_tgBNtoWqIp.jbxd

Similarity

API ID: Color$Rect$Object$BrushInflateSelect$CreateLongTextWindow$DeleteFillFrameRoundSolid
String ID:
API String ID: 4124339563-0
Opcode ID: 3e94f51cc9b684e3e3c14944921a87241174a130593c760befaf9b4c9d72f538
Instruction ID: ffd7511238a5904276bc5e054b1243ca273f2e386390f3c28a8e96f8bdbf82a3
Opcode Fuzzy Hash: 3e94f51cc9b684e3e3c14944921a87241174a130593c760befaf9b4c9d72f538
Instruction Fuzzy Hash: ACA1C372408385EFD7109F64DC48A5B7BA9FF88330F144A29F962DA1E1D734D948EB52

Function 00F62C18 Relevance: 49.5, APIs: 27, Strings: 1, Instructions: 486windowCOMMON

Download Yara Rule

APIs

DestroyWindow.USER32(?,?,?), ref: 00F62CA2
DeleteObject.GDI32(00000000), ref: 00F62CE8
DeleteObject.GDI32(00000000), ref: 00F62CF3
DestroyIcon.USER32(00000000,?,?,?), ref: 00F62CFE
DestroyWindow.USER32(00000000,?,?,?), ref: 00F62D09
SendMessageW.USER32(?,00001308,?,00000000), ref: 00F9C68B
ImageList_Remove.COMCTL32(?,000000FF,?), ref: 00F9C6C4
MoveWindow.USER32(?,?,?,?,?,00000000), ref: 00F9CAED

Part of subcall function 00F61B41: InvalidateRect.USER32(?,00000000,00000001,?,?,?,00F62036,?,00000000,?,?,?,?,00F616CB,00000000,?), ref: 00F61B9A

SendMessageW.USER32(?,00001053), ref: 00F9CB2A
SendMessageW.USER32(?,00001008,000000FF,00000000), ref: 00F9CB41
ImageList_Destroy.COMCTL32(00000000,?,?), ref: 00F9CB57
ImageList_Destroy.COMCTL32(00000000,?,?), ref: 00F9CB62

Strings

0, xrefs: 00F9C981

Memory Dump Source

Source File: 00000000.00000002.1667912702.0000000000F61000.00000020.00000001.01000000.00000003.sdmp, Offset: 00F60000, based on PE: true

Associated: 00000000.00000002.1667891216.0000000000F60000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667966851.0000000000FEF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667966851.0000000001015000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1668035777.000000000101F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1668053678.0000000001028000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f60000_tgBNtoWqIp.jbxd

Similarity

API ID: Destroy$ImageList_MessageSendWindow$DeleteObject$IconInvalidateMoveRectRemove
String ID: 0
API String ID: 464785882-4108050209
Opcode ID: fd482c49c82ae69dc45ca3c7ca388f11896c196454db87ac7f7a31b9bfc29ff8
Instruction ID: 8cfd33e96d19ecdcc63372cdb15b6e50e3c740ec83323ec76532b25e359ceba9
Opcode Fuzzy Hash: fd482c49c82ae69dc45ca3c7ca388f11896c196454db87ac7f7a31b9bfc29ff8
Instruction Fuzzy Hash: 8712AD30A00641EFEF61CF24C888BA9BBE5BF45320F544569F995DB262C731EC46EB91

Function 00FD77BE Relevance: 45.8, APIs: 22, Strings: 4, Instructions: 284windowCOMMON

Download Yara Rule

APIs

DestroyWindow.USER32(00000000), ref: 00FD77F1
SystemParametersInfoW.USER32(00000030,00000000,?,00000000), ref: 00FD78B0
SetRect.USER32(?,00000000,00000000,0000012C,00000064), ref: 00FD78EE
AdjustWindowRectEx.USER32(?,88C00000,00000000,00000006), ref: 00FD7900
CreateWindowExW.USER32(00000006,AutoIt v3,?,88C00000,?,?,?,?,00000000,00000000,00000000), ref: 00FD7946
GetClientRect.USER32(00000000,?), ref: 00FD7952
CreateWindowExW.USER32(00000000,static,?,50000000,?,00000004,00000500,00000018,00000000,00000000,00000000), ref: 00FD7996
CreateDCW.GDI32(DISPLAY,00000000,00000000,00000000), ref: 00FD79A5
GetStockObject.GDI32(00000011), ref: 00FD79B5
SelectObject.GDI32(00000000,00000000), ref: 00FD79B9
GetTextFaceW.GDI32(00000000,00000040,?,?,50000000,?,00000004,00000500,00000018,00000000,00000000,00000000,?,88C00000,?), ref: 00FD79C9
GetDeviceCaps.GDI32(00000000,0000005A), ref: 00FD79D2
DeleteDC.GDI32(00000000), ref: 00FD79DB
CreateFontW.GDI32(00000000,00000000,00000000,00000000,00000258,00000000,00000000,00000000,00000001,00000004,00000000,00000002,00000000,?), ref: 00FD7A07
SendMessageW.USER32(00000030,00000000,00000001), ref: 00FD7A1E
CreateWindowExW.USER32(00000200,msctls_progress32,00000000,50000001,?,0000001E,00000104,00000014,00000000,00000000,00000000), ref: 00FD7A59
SendMessageW.USER32(00000000,00000401,00000000,00640000), ref: 00FD7A6D
SendMessageW.USER32(00000404,00000001,00000000), ref: 00FD7A7E
CreateWindowExW.USER32(00000000,static,?,50000000,?,00000037,00000500,00000032,00000000,00000000,00000000), ref: 00FD7AAE
GetStockObject.GDI32(00000011), ref: 00FD7AB9
SendMessageW.USER32(00000030,00000000,?,50000000), ref: 00FD7AC4
ShowWindow.USER32(00000004,?,50000000,?,00000004,00000500,00000018,00000000,00000000,00000000,?,88C00000,?,?,?,?), ref: 00FD7ACE

Strings

DISPLAY, xrefs: 00FD799B
static, xrefs: 00FD7990, 00FD7AA8
msctls_progress32, xrefs: 00FD7A4F
AutoIt v3, xrefs: 00FD793E

Memory Dump Source

Source File: 00000000.00000002.1667912702.0000000000F61000.00000020.00000001.01000000.00000003.sdmp, Offset: 00F60000, based on PE: true

Associated: 00000000.00000002.1667891216.0000000000F60000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667966851.0000000000FEF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667966851.0000000001015000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1668035777.000000000101F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1668053678.0000000001028000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f60000_tgBNtoWqIp.jbxd

Similarity

API ID: Window$Create$MessageSend$ObjectRect$Stock$AdjustCapsClientDeleteDestroyDeviceFaceFontInfoParametersSelectShowSystemText
String ID: AutoIt v3$DISPLAY$msctls_progress32$static
API String ID: 2910397461-517079104
Opcode ID: ce27108499a0071370c0cc75302b03a3ec70a9f47c863fdd2e30b46e76984e95
Instruction ID: fbd692c8a5a54e900c1d45dea411033822826aef6efa3287f65adde5670a9ce0
Opcode Fuzzy Hash: ce27108499a0071370c0cc75302b03a3ec70a9f47c863fdd2e30b46e76984e95
Instruction Fuzzy Hash: 98A1B471A00209BFEB20DFA4DC8AFAE7BB9EB44710F144115FA15AB2D0D775AD04DB60

Function 00FCAF7B Relevance: 45.7, APIs: 3, Strings: 23, Instructions: 186COMMON

Download Yara Rule

APIs

SetErrorMode.KERNEL32(00000001), ref: 00FCAF89
GetDriveTypeW.KERNEL32(?,00FEFAC0,?,\\.\,00FEF910), ref: 00FCB066
SetErrorMode.KERNEL32(00000000,00FEFAC0,?,\\.\,00FEF910), ref: 00FCB1C4

Strings

Fibre, xrefs: 00FCB154
RAMDisk, xrefs: 00FCB090
SAS, xrefs: 00FCB170
MMC, xrefs: 00FCB185
SCSI, xrefs: 00FCB131
CDROM, xrefs: 00FCB09A
Fixed, xrefs: 00FCB0AE
SSA, xrefs: 00FCB14D
RAID, xrefs: 00FCB162
\\.\, xrefs: 00FCAFDB
ATA, xrefs: 00FCB13F
SSD, xrefs: 00FCB0F1
Virtual, xrefs: 00FCB18C
SATA, xrefs: 00FCB177
PhysicalDrive, xrefs: 00FCB012
Network, xrefs: 00FCB0A4
USB, xrefs: 00FCB15B
FileBackedVirtual, xrefs: 00FCB193
Removable, xrefs: 00FCB0B8
Unknown, xrefs: 00FCB086, 00FCB12A
ATAPI, xrefs: 00FCB138
1394, xrefs: 00FCB146
iSCSI, xrefs: 00FCB169

Memory Dump Source

Source File: 00000000.00000002.1667912702.0000000000F61000.00000020.00000001.01000000.00000003.sdmp, Offset: 00F60000, based on PE: true

Associated: 00000000.00000002.1667891216.0000000000F60000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667966851.0000000000FEF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667966851.0000000001015000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1668035777.000000000101F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1668053678.0000000001028000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f60000_tgBNtoWqIp.jbxd

Similarity

API ID: ErrorMode$DriveType
String ID: 1394$ATA$ATAPI$CDROM$Fibre$FileBackedVirtual$Fixed$MMC$Network$PhysicalDrive$RAID$RAMDisk$Removable$SAS$SATA$SCSI$SSA$SSD$USB$Unknown$Virtual$\\.\$iSCSI
API String ID: 2907320926-4222207086
Opcode ID: 70071a236dce2c4d5617e27b6eb934c369d7fab9fc0bbda28f869c8b38804af2
Instruction ID: 70eef30ae5e4bda498abcc5de52718cb48f732b599275789f4976b43306d566a
Opcode Fuzzy Hash: 70071a236dce2c4d5617e27b6eb934c369d7fab9fc0bbda28f869c8b38804af2
Instruction Fuzzy Hash: 60519039B85287EA8B00EA11CFA3F7973B0BB54756B28401DE446AB251C7799E01BB41

Function 00F66A3C Relevance: 44.0, APIs: 12, Strings: 13, Instructions: 275COMMON

Download Yara Rule

APIs

__wcsnicmp.LIBCMT ref: 00F66A91
__wcsnicmp.LIBCMT ref: 00F66AA9
__wcsnicmp.LIBCMT ref: 00F66AC1
__wcsnicmp.LIBCMT ref: 00F66AD9
__wcsnicmp.LIBCMT ref: 00F66AF1
__wcsnicmp.LIBCMT ref: 00F66B09
__wcsnicmp.LIBCMT ref: 00F66B21
__wcsnicmp.LIBCMT ref: 00F66B35
__wcsnicmp.LIBCMT ref: 00F66B76
__wcsnicmp.LIBCMT ref: 00F66B8A
__wcsnicmp.LIBCMT ref: 00F66B9E
__wcsnicmp.LIBCMT ref: 00F66BB2

Strings

#cs, xrefs: 00F66B2F, 00F66B84
Unterminated group of comments, xrefs: 00F9E82C
#OnAutoItStartRegister, xrefs: 00F66AD3
#ce, xrefs: 00F66BAC
#comments-end, xrefs: 00F66B98
#comments-start, xrefs: 00F66B1B, 00F66B70
Bad directive syntax error, xrefs: 00F9E743
Cannot parse #include, xrefs: 00F9E819
#pragma compile, xrefs: 00F66A8B
#include-once, xrefs: 00F66AEB
#requireadmin, xrefs: 00F66ABB
#include, xrefs: 00F66B03
#notrayicon, xrefs: 00F66AA3

Memory Dump Source

Source File: 00000000.00000002.1667912702.0000000000F61000.00000020.00000001.01000000.00000003.sdmp, Offset: 00F60000, based on PE: true

Associated: 00000000.00000002.1667891216.0000000000F60000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667966851.0000000000FEF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667966851.0000000001015000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1668035777.000000000101F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1668053678.0000000001028000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f60000_tgBNtoWqIp.jbxd

Similarity

API ID: __wcsnicmp
String ID: #OnAutoItStartRegister$#ce$#comments-end$#comments-start$#cs$#include$#include-once$#notrayicon$#pragma compile$#requireadmin$Bad directive syntax error$Cannot parse #include$Unterminated group of comments
API String ID: 1038674560-86951937
Opcode ID: 49cb62aafb1464da6e9eea63c00ccd050cd7cbcdec7030e3b69202838e74d062
Instruction ID: 51436f78eb3e990cf787b9a2c7ec6ce7672c95048f175035c36b602a26d6b4f3
Opcode Fuzzy Hash: 49cb62aafb1464da6e9eea63c00ccd050cd7cbcdec7030e3b69202838e74d062
Instruction Fuzzy Hash: E7812A71A00346FBDF24FB60CC92FAE7758AF51B10F044025F941EA192EB68EA55F752

Function 00FEAB60 Relevance: 39.2, APIs: 26, Instructions: 201windowCOMMON

Download Yara Rule

APIs

GetSysColor.USER32(00000012), ref: 00FEAB99
SetTextColor.GDI32(?,?), ref: 00FEAB9D
GetSysColorBrush.USER32(0000000F), ref: 00FEABB3
GetSysColor.USER32(0000000F), ref: 00FEABBE
CreateSolidBrush.GDI32(?), ref: 00FEABC3
GetSysColor.USER32(00000011), ref: 00FEABDB
CreatePen.GDI32(00000000,00000001,00743C00), ref: 00FEABE9
SelectObject.GDI32(?,00000000), ref: 00FEABFA
SetBkColor.GDI32(?,00000000), ref: 00FEAC03
SelectObject.GDI32(?,?), ref: 00FEAC10
InflateRect.USER32(?,000000FF,000000FF), ref: 00FEAC2F
RoundRect.GDI32(?,?,?,?,?,00000005,00000005), ref: 00FEAC46
GetWindowLongW.USER32(00000000,000000F0), ref: 00FEAC5B
SendMessageW.USER32(00000000,0000000E,00000000,00000000), ref: 00FEACA7
GetWindowTextW.USER32(00000000,00000000,00000001), ref: 00FEACCE
InflateRect.USER32(?,000000FD,000000FD), ref: 00FEACEC
DrawFocusRect.USER32(?,?), ref: 00FEACF7
GetSysColor.USER32(00000011), ref: 00FEAD05
SetTextColor.GDI32(?,00000000), ref: 00FEAD0D
DrawTextW.USER32(?,00000000,000000FF,?,?), ref: 00FEAD21
SelectObject.GDI32(?,00FEA869), ref: 00FEAD38
DeleteObject.GDI32(?), ref: 00FEAD43
SelectObject.GDI32(?,?), ref: 00FEAD49
DeleteObject.GDI32(?), ref: 00FEAD4E
SetTextColor.GDI32(?,?), ref: 00FEAD54
SetBkColor.GDI32(?,?), ref: 00FEAD5E

Memory Dump Source

Source File: 00000000.00000002.1667912702.0000000000F61000.00000020.00000001.01000000.00000003.sdmp, Offset: 00F60000, based on PE: true

Associated: 00000000.00000002.1667891216.0000000000F60000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667966851.0000000000FEF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667966851.0000000001015000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1668035777.000000000101F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1668053678.0000000001028000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f60000_tgBNtoWqIp.jbxd

Similarity

API ID: Color$Object$Text$RectSelect$BrushCreateDeleteDrawInflateWindow$FocusLongMessageRoundSendSolid
String ID:
API String ID: 1996641542-0
Opcode ID: 9d7a0d7ebc09d3060ec8eb3ebdf02b9c7840ae176cf2fb53cbc49f34fa04e1ab
Instruction ID: 3192471f4b5d0d9e5fad358a52285b11e45e13b44bfc92c6c6346fd82876f2bc
Opcode Fuzzy Hash: 9d7a0d7ebc09d3060ec8eb3ebdf02b9c7840ae176cf2fb53cbc49f34fa04e1ab
Instruction Fuzzy Hash: 84617E7190025CEFDF119FA9DC88EAE7B79EB48320F208125F911AB2A1D6759D40EB90

Function 00FE8C44 Relevance: 38.9, APIs: 21, Strings: 1, Instructions: 401windowCOMMON

Download Yara Rule

APIs

SendMessageW.USER32(?,00000158,000000FF,0000014E), ref: 00FE8D34
SendMessageW.USER32(?,0000014E,00000000,00000000), ref: 00FE8D45
CharNextW.USER32(0000014E), ref: 00FE8D74
SendMessageW.USER32(?,0000014B,00000000,00000000), ref: 00FE8DB5
SendMessageW.USER32(?,00000158,000000FF,00000158), ref: 00FE8DCB
SendMessageW.USER32(?,0000014E,00000000,00000000), ref: 00FE8DDC
SendMessageW.USER32(?,000000C2,00000001,0000014E), ref: 00FE8DF9
SetWindowTextW.USER32(?,0000014E), ref: 00FE8E45
SendMessageW.USER32(?,000000B1,000F4240,000F423F), ref: 00FE8E5B
SendMessageW.USER32(?,00001002,00000000,?), ref: 00FE8E8C
_memset.LIBCMT ref: 00FE8EB1
SendMessageW.USER32(00000000,00001060,00000001,00000004), ref: 00FE8EFA
_memset.LIBCMT ref: 00FE8F59
SendMessageW.USER32(?,00001053,000000FF,?), ref: 00FE8F83
SendMessageW.USER32(?,00001074,?,00000001), ref: 00FE8FDB
SendMessageW.USER32(?,0000133D,?,?), ref: 00FE9088
InvalidateRect.USER32(?,00000000,00000001), ref: 00FE90AA
GetMenuItemInfoW.USER32(?,?,00000000,00000030), ref: 00FE90F4
SetMenuItemInfoW.USER32(?,?,00000000,00000030), ref: 00FE9121
DrawMenuBar.USER32(?), ref: 00FE9130
SetWindowTextW.USER32(?,0000014E), ref: 00FE9158

Strings

0, xrefs: 00FE90C2

Memory Dump Source

Source File: 00000000.00000002.1667912702.0000000000F61000.00000020.00000001.01000000.00000003.sdmp, Offset: 00F60000, based on PE: true

Associated: 00000000.00000002.1667891216.0000000000F60000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667966851.0000000000FEF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667966851.0000000001015000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1668035777.000000000101F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1668053678.0000000001028000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f60000_tgBNtoWqIp.jbxd

Similarity

API ID: MessageSend$Menu$InfoItemTextWindow_memset$CharDrawInvalidateNextRect
String ID: 0
API String ID: 1073566785-4108050209
Opcode ID: 5d1094c9b91f59f83e5d54a90b6bcd407a4250e33c676ee5c5eaff02dfc807cc
Instruction ID: d3bfd508c9ae38efb187a75d07e9730e80988b979134053f61e03e1ab23b9583
Opcode Fuzzy Hash: 5d1094c9b91f59f83e5d54a90b6bcd407a4250e33c676ee5c5eaff02dfc807cc
Instruction Fuzzy Hash: 58E1F771901289AFDF20EF61CC84EEE7B79FF05760F108155F919AA190DB748A86EF60

Function 00FE4B16 Relevance: 37.0, APIs: 18, Strings: 3, Instructions: 290windowCOMMON

Download Yara Rule

APIs

GetCursorPos.USER32(?), ref: 00FE4C51
GetDesktopWindow.USER32 ref: 00FE4C66
GetWindowRect.USER32(00000000), ref: 00FE4C6D
GetWindowLongW.USER32(?,000000F0), ref: 00FE4CCF
DestroyWindow.USER32(?), ref: 00FE4CFB
CreateWindowExW.USER32(00000008,tooltips_class32,00000000,00000003,80000000,80000000,80000000,80000000,00000000,00000000,00000000,00000000), ref: 00FE4D24
SendMessageW.USER32(00000000,00000432,00000000,00000030), ref: 00FE4D42
SendMessageW.USER32(?,00000439,00000000,00000030), ref: 00FE4D68
SendMessageW.USER32(?,00000421,?,?), ref: 00FE4D7D
SendMessageW.USER32(?,0000041D,00000000,00000000), ref: 00FE4D90
IsWindowVisible.USER32(?), ref: 00FE4DB0
SendMessageW.USER32(?,00000412,00000000,D8F0D8F0), ref: 00FE4DCB
SendMessageW.USER32(?,00000411,00000001,00000030), ref: 00FE4DDF
GetWindowRect.USER32(?,?), ref: 00FE4DF7
MonitorFromPoint.USER32(?,?,00000002), ref: 00FE4E1D
GetMonitorInfoW.USER32(00000000,?), ref: 00FE4E37
CopyRect.USER32(?,?), ref: 00FE4E4E
SendMessageW.USER32(?,00000412,00000000), ref: 00FE4EB9

Strings

tooltips_class32, xrefs: 00FE4D1D
(, xrefs: 00FE4E2A
0, xrefs: 00FE4BFC

Memory Dump Source

Source File: 00000000.00000002.1667912702.0000000000F61000.00000020.00000001.01000000.00000003.sdmp, Offset: 00F60000, based on PE: true

Associated: 00000000.00000002.1667891216.0000000000F60000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667966851.0000000000FEF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667966851.0000000001015000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1668035777.000000000101F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1668053678.0000000001028000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f60000_tgBNtoWqIp.jbxd

Similarity

API ID: MessageSendWindow$Rect$Monitor$CopyCreateCursorDesktopDestroyFromInfoLongPointVisible
String ID: ($0$tooltips_class32
API String ID: 698492251-4156429822
Opcode ID: e4d92b285334bb7563e2d951e64112cb7c45077cbd7b0b31e43990b64b5fb83f
Instruction ID: 8d5e9bd9fea0b42bb7abfff74f75e706a2fdec9d97d5e1b487cdaf782e4243d6
Opcode Fuzzy Hash: e4d92b285334bb7563e2d951e64112cb7c45077cbd7b0b31e43990b64b5fb83f
Instruction Fuzzy Hash: 61B18E71608381AFDB04DF65C888B6ABBE5FF88310F00891CF5999B2A1D775EC05EB91

Function 00F627D9 Relevance: 33.5, APIs: 18, Strings: 1, Instructions: 286windowtimeCOMMON

Download Yara Rule

APIs

SystemParametersInfoW.USER32(00000030,00000000,000000FF,00000000), ref: 00F628BC
GetSystemMetrics.USER32(00000007), ref: 00F628C4
SystemParametersInfoW.USER32(00000030,00000000,000000FF,00000000), ref: 00F628EF
GetSystemMetrics.USER32(00000008), ref: 00F628F7
GetSystemMetrics.USER32(00000004), ref: 00F6291C
SetRect.USER32(000000FF,00000000,00000000,000000FF,000000FF), ref: 00F62939
AdjustWindowRectEx.USER32(000000FF,?,00000000,?), ref: 00F62949
CreateWindowExW.USER32(?,AutoIt v3 GUI,?,?,?,000000FF,000000FF,000000FF,?,00000000,00000000), ref: 00F6297C
SetWindowLongW.USER32(00000000,000000EB,00000000), ref: 00F62990
GetClientRect.USER32(00000000,000000FF), ref: 00F629AE
GetStockObject.GDI32(00000011), ref: 00F629CA
SendMessageW.USER32(00000000,00000030,00000000), ref: 00F629D5

Part of subcall function 00F62344: GetCursorPos.USER32(?), ref: 00F62357
Part of subcall function 00F62344: ScreenToClient.USER32(010267B0,?), ref: 00F62374
Part of subcall function 00F62344: GetAsyncKeyState.USER32(00000001), ref: 00F62399
Part of subcall function 00F62344: GetAsyncKeyState.USER32(00000002), ref: 00F623A7

SetTimer.USER32(00000000,00000000,00000028,00F61256), ref: 00F629FC

Strings

AutoIt v3 GUI, xrefs: 00F62974

Memory Dump Source

Source File: 00000000.00000002.1667912702.0000000000F61000.00000020.00000001.01000000.00000003.sdmp, Offset: 00F60000, based on PE: true

Associated: 00000000.00000002.1667891216.0000000000F60000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667966851.0000000000FEF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667966851.0000000001015000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1668035777.000000000101F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1668053678.0000000001028000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f60000_tgBNtoWqIp.jbxd

Similarity

API ID: System$MetricsRectWindow$AsyncClientInfoParametersState$AdjustCreateCursorLongMessageObjectScreenSendStockTimer
String ID: AutoIt v3 GUI
API String ID: 1458621304-248962490
Opcode ID: b672cbb4d1d311f4ebbb7e8d5bebb526e07fe4e49f5dce893759cdcd3e9d29b6
Instruction ID: 05882fb5e9b0fe46c764bf3ebbb11f4a9ef52f3875ea693388be7103bb6f2ce6
Opcode Fuzzy Hash: b672cbb4d1d311f4ebbb7e8d5bebb526e07fe4e49f5dce893759cdcd3e9d29b6
Instruction Fuzzy Hash: 86B16071A0024ADFDF24DFA8DD85BAE7BB4FB48310F108229FA15E7290DB759941EB50

Function 00FE4069 Relevance: 28.3, APIs: 3, Strings: 13, Instructions: 283windowCOMMON

Download Yara Rule

APIs

CharUpperBuffW.USER32(?,?), ref: 00FE40F6
SendMessageW.USER32(?,00001032,00000000,00000000), ref: 00FE41B6

Strings

GETITEMCOUNT, xrefs: 00FE4128
SELECTINVERT, xrefs: 00FE4286
SELECTCLEAR, xrefs: 00FE4235
GETSUBITEMCOUNT, xrefs: 00FE4141
GETTEXT, xrefs: 00FE415F
DESELECT, xrefs: 00FE42A4
ISSELECTED, xrefs: 00FE41C1
FINDITEM, xrefs: 00FE4329
GETSELECTEDCOUNT, xrefs: 00FE4199
SELECTALL, xrefs: 00FE421D
SELECT, xrefs: 00FE4250
VIEWCHANGE, xrefs: 00FE4375
GETSELECTED, xrefs: 00FE42E4

Memory Dump Source

Source File: 00000000.00000002.1667912702.0000000000F61000.00000020.00000001.01000000.00000003.sdmp, Offset: 00F60000, based on PE: true

Associated: 00000000.00000002.1667891216.0000000000F60000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667966851.0000000000FEF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667966851.0000000001015000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1668035777.000000000101F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1668053678.0000000001028000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f60000_tgBNtoWqIp.jbxd

Similarity

API ID: BuffCharMessageSendUpper
String ID: DESELECT$FINDITEM$GETITEMCOUNT$GETSELECTED$GETSELECTEDCOUNT$GETSUBITEMCOUNT$GETTEXT$ISSELECTED$SELECT$SELECTALL$SELECTCLEAR$SELECTINVERT$VIEWCHANGE
API String ID: 3974292440-719923060
Opcode ID: 2c3f49c46f3f9cd0222471050c06541a6e51f9e57ec2076d8820dd8d76b8f11e
Instruction ID: 270ea5ae82b2845755e0904baf66619013bc60646c28e52ca1233735c104b5df
Opcode Fuzzy Hash: 2c3f49c46f3f9cd0222471050c06541a6e51f9e57ec2076d8820dd8d76b8f11e
Instruction Fuzzy Hash: 2DA17D312183429FCB14EF21CD51A6AB3AAFF84314F14495DB8969B392DB78FC09EB51

Function 00FD52F0 Relevance: 27.1, APIs: 18, Instructions: 124COMMON

Download Yara Rule

APIs

LoadCursorW.USER32(00000000,00007F89), ref: 00FD5309
LoadCursorW.USER32(00000000,00007F8A), ref: 00FD5314
LoadCursorW.USER32(00000000,00007F00), ref: 00FD531F
LoadCursorW.USER32(00000000,00007F03), ref: 00FD532A
LoadCursorW.USER32(00000000,00007F8B), ref: 00FD5335
LoadCursorW.USER32(00000000,00007F01), ref: 00FD5340
LoadCursorW.USER32(00000000,00007F81), ref: 00FD534B
LoadCursorW.USER32(00000000,00007F88), ref: 00FD5356
LoadCursorW.USER32(00000000,00007F80), ref: 00FD5361
LoadCursorW.USER32(00000000,00007F86), ref: 00FD536C
LoadCursorW.USER32(00000000,00007F83), ref: 00FD5377
LoadCursorW.USER32(00000000,00007F85), ref: 00FD5382
LoadCursorW.USER32(00000000,00007F82), ref: 00FD538D
LoadCursorW.USER32(00000000,00007F84), ref: 00FD5398
LoadCursorW.USER32(00000000,00007F04), ref: 00FD53A3
LoadCursorW.USER32(00000000,00007F02), ref: 00FD53AE
GetCursorInfo.USER32(?), ref: 00FD53BE
GetLastError.KERNEL32(00000001,00000000), ref: 00FD53E9

Memory Dump Source

Source File: 00000000.00000002.1667912702.0000000000F61000.00000020.00000001.01000000.00000003.sdmp, Offset: 00F60000, based on PE: true

Associated: 00000000.00000002.1667891216.0000000000F60000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667966851.0000000000FEF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667966851.0000000001015000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1668035777.000000000101F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1668053678.0000000001028000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f60000_tgBNtoWqIp.jbxd

Similarity

API ID: Cursor$Load$ErrorInfoLast
String ID:
API String ID: 3215588206-0
Opcode ID: 8da01cd2ae99b85f0a7ff13719a9e180fd5bb621d41b43a3e2705b95bef48fdd
Instruction ID: f15fc4ee0fc7e2265a11f7126279f3fd3a750fc4908f8ef9fd5304444bc8aa24
Opcode Fuzzy Hash: 8da01cd2ae99b85f0a7ff13719a9e180fd5bb621d41b43a3e2705b95bef48fdd
Instruction Fuzzy Hash: BE418570E083196ADB109FBA8C49D6FFFF8EF51B20B10452FE509E7290DAB89401DE51

Function 00FBAA64 Relevance: 26.5, APIs: 14, Strings: 1, Instructions: 273windowtimeCOMMON

Download Yara Rule

APIs

GetClassNameW.USER32(?,?,00000100), ref: 00FBAAA5
__swprintf.LIBCMT ref: 00FBAB46
_wcscmp.LIBCMT ref: 00FBAB59
SendMessageTimeoutW.USER32(?,?,00000101,00000000,00000002,00001388,?), ref: 00FBABAE
_wcscmp.LIBCMT ref: 00FBABEA
GetClassNameW.USER32(?,?,00000400), ref: 00FBAC21
GetDlgCtrlID.USER32(?), ref: 00FBAC73
GetWindowRect.USER32(?,?), ref: 00FBACA9
GetParent.USER32(?), ref: 00FBACC7
ScreenToClient.USER32(00000000), ref: 00FBACCE
GetClassNameW.USER32(?,?,00000100), ref: 00FBAD48
_wcscmp.LIBCMT ref: 00FBAD5C
GetWindowTextW.USER32(?,?,00000400), ref: 00FBAD82
_wcscmp.LIBCMT ref: 00FBAD96

Part of subcall function 00F8386C: _iswctype.LIBCMT ref: 00F83874

Strings

%s%u, xrefs: 00FBAB40

Memory Dump Source

Source File: 00000000.00000002.1667912702.0000000000F61000.00000020.00000001.01000000.00000003.sdmp, Offset: 00F60000, based on PE: true

Associated: 00000000.00000002.1667891216.0000000000F60000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667966851.0000000000FEF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667966851.0000000001015000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1668035777.000000000101F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1668053678.0000000001028000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f60000_tgBNtoWqIp.jbxd

Similarity

API ID: _wcscmp$ClassName$Window$ClientCtrlMessageParentRectScreenSendTextTimeout__swprintf_iswctype
String ID: %s%u
API String ID: 3744389584-679674701
Opcode ID: 103707e425635130154caf3b70fba413d4221406869244483bf59534863f5aa9
Instruction ID: a5c059086262704009323f253c6da0c5b95293961e5acb2f4e87ad82720df662
Opcode Fuzzy Hash: 103707e425635130154caf3b70fba413d4221406869244483bf59534863f5aa9
Instruction Fuzzy Hash: 82A1E171604306AFD714DF21C884BEABBE8FF08325F008629F9A9C2190D734E955EF92

Function 00FBB397 Relevance: 26.5, APIs: 13, Strings: 2, Instructions: 249COMMON

Download Yara Rule

APIs

GetClassNameW.USER32(00000008,?,00000400), ref: 00FBB3DB
_wcscmp.LIBCMT ref: 00FBB3EC
GetWindowTextW.USER32(00000001,?,00000400), ref: 00FBB414
CharUpperBuffW.USER32(?,00000000), ref: 00FBB431
_wcscmp.LIBCMT ref: 00FBB44F
_wcsstr.LIBCMT ref: 00FBB460
GetClassNameW.USER32(00000018,?,00000400), ref: 00FBB498
_wcscmp.LIBCMT ref: 00FBB4A8
GetWindowTextW.USER32(00000002,?,00000400), ref: 00FBB4CF
GetClassNameW.USER32(00000018,?,00000400), ref: 00FBB518
_wcscmp.LIBCMT ref: 00FBB528
GetClassNameW.USER32(00000010,?,00000400), ref: 00FBB550
GetWindowRect.USER32(00000004,?), ref: 00FBB5B9

Strings

ThumbnailClass, xrefs: 00FBB4A3, 00FBB523
@, xrefs: 00FBB3BC

Memory Dump Source

Source File: 00000000.00000002.1667912702.0000000000F61000.00000020.00000001.01000000.00000003.sdmp, Offset: 00F60000, based on PE: true

Associated: 00000000.00000002.1667891216.0000000000F60000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667966851.0000000000FEF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667966851.0000000001015000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1668035777.000000000101F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1668053678.0000000001028000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f60000_tgBNtoWqIp.jbxd

Similarity

API ID: ClassName_wcscmp$Window$Text$BuffCharRectUpper_wcsstr
String ID: @$ThumbnailClass
API String ID: 1788623398-1539354611
Opcode ID: cd0082caa3ba67fcdc7530a82a825d7f72e2c3588bb3b233103d1606872a5993
Instruction ID: cf050df4923109f81d9074cd19f3ed06d75f486dc41878820bbd17e6be281d96
Opcode Fuzzy Hash: cd0082caa3ba67fcdc7530a82a825d7f72e2c3588bb3b233103d1606872a5993
Instruction Fuzzy Hash: 2781A0714082059BDB10DF12C885FEA7BE8FF44724F088569FD858A0A6DBB4DD49EF61

Function 00FBB1E0 Relevance: 26.4, APIs: 3, Strings: 12, Instructions: 105COMMON

Download Yara Rule

APIs

__wcsnicmp.LIBCMT ref: 00FBB23F

Strings

[LAST, xrefs: 00FBB2EC
[ALL, xrefs: 00FBB2E5
ACTIVE, xrefs: 00FBB21A
[ACTIVE, xrefs: 00FBB22C
CLASSNAME=, xrefs: 00FBB27C
LAST, xrefs: 00FBB204
[REGEXPTITLE:, xrefs: 00FBB267
[HANDLE:, xrefs: 00FBB24B
REGEXP=, xrefs: 00FBB254
ALL, xrefs: 00FBB2D3
HANDLE=, xrefs: 00FBB238
[CLASS:, xrefs: 00FBB28F

Memory Dump Source

Source File: 00000000.00000002.1667912702.0000000000F61000.00000020.00000001.01000000.00000003.sdmp, Offset: 00F60000, based on PE: true

Associated: 00000000.00000002.1667891216.0000000000F60000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667966851.0000000000FEF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667966851.0000000001015000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1668035777.000000000101F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1668053678.0000000001028000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f60000_tgBNtoWqIp.jbxd

Similarity

API ID: __wcsnicmp
String ID: ACTIVE$ALL$CLASSNAME=$HANDLE=$LAST$REGEXP=$[ACTIVE$[ALL$[CLASS:$[HANDLE:$[LAST$[REGEXPTITLE:
API String ID: 1038674560-1810252412
Opcode ID: b9306b89fd013af673c3c9a0cdba25c16b989629691ef7fee19f11ab699b1b95
Instruction ID: 6d870f7bf3f0180a853266177175924b2567a4dd3eb771e2813bd80ecb4673c8
Opcode Fuzzy Hash: b9306b89fd013af673c3c9a0cdba25c16b989629691ef7fee19f11ab699b1b95
Instruction Fuzzy Hash: 70312431A04305A6DB05FA62CD63EEE77B4AF14B54F20051DF481750E5EFADAE04FA61

Function 00FBC4C1 Relevance: 25.7, APIs: 17, Instructions: 169windowtimeCOMMON

Download Yara Rule

APIs

LoadIconW.USER32(00000063), ref: 00FBC4D4
SendMessageW.USER32(?,00000080,00000000,00000000), ref: 00FBC4E6
SetWindowTextW.USER32(?,?), ref: 00FBC4FD
GetDlgItem.USER32(?,000003EA), ref: 00FBC512
SetWindowTextW.USER32(00000000,?), ref: 00FBC518
GetDlgItem.USER32(?,000003E9), ref: 00FBC528
SetWindowTextW.USER32(00000000,?), ref: 00FBC52E
SendDlgItemMessageW.USER32(?,000003E9,000000CC,?,00000000), ref: 00FBC54F
SendDlgItemMessageW.USER32(?,000003E9,000000C5,00000000,00000000), ref: 00FBC569
GetWindowRect.USER32(?,?), ref: 00FBC572
SetWindowTextW.USER32(?,?), ref: 00FBC5DD
GetDesktopWindow.USER32 ref: 00FBC5E3
GetWindowRect.USER32(00000000), ref: 00FBC5EA
MoveWindow.USER32(?,?,?,?,00000000,00000000), ref: 00FBC636
GetClientRect.USER32(?,?), ref: 00FBC643
PostMessageW.USER32(?,00000005,00000000,00000000), ref: 00FBC668
SetTimer.USER32(?,0000040A,00000000,00000000), ref: 00FBC693

Memory Dump Source

Source File: 00000000.00000002.1667912702.0000000000F61000.00000020.00000001.01000000.00000003.sdmp, Offset: 00F60000, based on PE: true

Associated: 00000000.00000002.1667891216.0000000000F60000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667966851.0000000000FEF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667966851.0000000001015000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1668035777.000000000101F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1668053678.0000000001028000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f60000_tgBNtoWqIp.jbxd

Similarity

API ID: Window$ItemMessageText$RectSend$ClientDesktopIconLoadMovePostTimer
String ID:
API String ID: 3869813825-0
Opcode ID: aa8ee3694a146ca785c7ccbf1a2971d5b62c6e19134654aa169de9084fca960e
Instruction ID: e78f586c9c14a0c91923ac60f6f290e266d7cbbe2f2abc0b7e75099248c308ff
Opcode Fuzzy Hash: aa8ee3694a146ca785c7ccbf1a2971d5b62c6e19134654aa169de9084fca960e
Instruction Fuzzy Hash: DE516C71900709EFDB20DFA9DD85BAFBBB5FF04704F004929E686A65A0C774A904EF50

Function 00FEA428 Relevance: 24.7, APIs: 12, Strings: 2, Instructions: 205windowCOMMON

Download Yara Rule

APIs

_memset.LIBCMT ref: 00FEA4C8
DestroyWindow.USER32(?,?), ref: 00FEA542

Part of subcall function 00F67D2C: _memmove.LIBCMT ref: 00F67D66

CreateWindowExW.USER32(00000008,tooltips_class32,00000000,?,80000000,80000000,80000000,80000000,?,00000000,00000000,?), ref: 00FEA5BC
SendMessageW.USER32(00000000,00000433,00000000,00000030), ref: 00FEA5DE
SendMessageW.USER32(00000000,00000432,00000000,00000030), ref: 00FEA5F1
DestroyWindow.USER32(00000000), ref: 00FEA613
CreateWindowExW.USER32(00000008,tooltips_class32,00000000,?,80000000,80000000,80000000,80000000,?,00000000,00F60000,00000000), ref: 00FEA64A
SendMessageW.USER32(00000000,00000432,00000000,00000030), ref: 00FEA663
GetDesktopWindow.USER32 ref: 00FEA67C
GetWindowRect.USER32(00000000), ref: 00FEA683
SendMessageW.USER32(00000000,00000418,00000000,?), ref: 00FEA69B
SendMessageW.USER32(00000000,00000421,?,00000000), ref: 00FEA6B3

Part of subcall function 00F625DB: GetWindowLongW.USER32(?,000000EB), ref: 00F625EC

Strings

tooltips_class32, xrefs: 00FEA5B5, 00FEA643
0, xrefs: 00FEA4DE

Memory Dump Source

Source File: 00000000.00000002.1667912702.0000000000F61000.00000020.00000001.01000000.00000003.sdmp, Offset: 00F60000, based on PE: true

Associated: 00000000.00000002.1667891216.0000000000F60000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667966851.0000000000FEF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667966851.0000000001015000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1668035777.000000000101F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1668053678.0000000001028000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f60000_tgBNtoWqIp.jbxd

Similarity

API ID: Window$MessageSend$CreateDestroy$DesktopLongRect_memmove_memset
String ID: 0$tooltips_class32
API String ID: 1297703922-3619404913
Opcode ID: fe079077be509778e4231fccf7004ba925d1a0ffa4fb16f2c19ec651c5777da7
Instruction ID: ae94cc54349fc412240fccd5d7053f6aa1503ea14851fff0e6417e2e073747ad
Opcode Fuzzy Hash: fe079077be509778e4231fccf7004ba925d1a0ffa4fb16f2c19ec651c5777da7
Instruction Fuzzy Hash: FB71D171540385AFD720DF28CC49F667BE6FB89314F08492DF9858B2A0D775E906EB12

Function 00FEC8EE Relevance: 24.7, APIs: 11, Strings: 3, Instructions: 181windowfileCOMMON

Download Yara Rule

APIs

Part of subcall function 00F62612: GetWindowLongW.USER32(?,000000EB), ref: 00F62623

DragQueryPoint.SHELL32(?,?), ref: 00FEC917

Part of subcall function 00FEADF1: ClientToScreen.USER32(?,?), ref: 00FEAE1A
Part of subcall function 00FEADF1: GetWindowRect.USER32(?,?), ref: 00FEAE90
Part of subcall function 00FEADF1: PtInRect.USER32(?,?,00FEC304), ref: 00FEAEA0

SendMessageW.USER32(?,000000B0,?,?), ref: 00FEC980
DragQueryFileW.SHELL32(?,000000FF,00000000,00000000), ref: 00FEC98B
DragQueryFileW.SHELL32(?,00000000,?,00000104), ref: 00FEC9AE
_wcscat.LIBCMT ref: 00FEC9DE
SendMessageW.USER32(?,000000C2,00000001,?), ref: 00FEC9F5
SendMessageW.USER32(?,000000B0,?,?), ref: 00FECA0E
SendMessageW.USER32(?,000000B1,?,?), ref: 00FECA25
SendMessageW.USER32(?,000000B1,?,?), ref: 00FECA47
DragFinish.SHELL32(?), ref: 00FECA4E
DefDlgProcW.USER32(?,00000233,?,00000000,?,?,?), ref: 00FECB41

Strings

@GUI_DRAGID, xrefs: 00FECAB9
@GUI_DROPID, xrefs: 00FECA6E
@GUI_DRAGFILE, xrefs: 00FECAF0

Memory Dump Source

Source File: 00000000.00000002.1667912702.0000000000F61000.00000020.00000001.01000000.00000003.sdmp, Offset: 00F60000, based on PE: true

Associated: 00000000.00000002.1667891216.0000000000F60000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667966851.0000000000FEF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667966851.0000000001015000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1668035777.000000000101F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1668053678.0000000001028000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f60000_tgBNtoWqIp.jbxd

Similarity

API ID: MessageSend$Drag$Query$FileRectWindow$ClientFinishLongPointProcScreen_wcscat
String ID: @GUI_DRAGFILE$@GUI_DRAGID$@GUI_DROPID
API String ID: 169749273-3440237614
Opcode ID: 9cff7a79240b5c04cf389c0c69ee4a2b84b0f47ab34601e1e30fbdbb45d492cb
Instruction ID: 5df58fcaaca902025881290272eb041e8162decd807786297d7819e337d215d3
Opcode Fuzzy Hash: 9cff7a79240b5c04cf389c0c69ee4a2b84b0f47ab34601e1e30fbdbb45d492cb
Instruction Fuzzy Hash: 00616771108384AFC710EF65DC85D9FBBE8FF88710F000A2EF591961A1DB759A09EB92

Function 00FE4619 Relevance: 23.0, APIs: 2, Strings: 11, Instructions: 251windowCOMMON

Download Yara Rule

APIs

CharUpperBuffW.USER32(?,?), ref: 00FE46AB
SendMessageW.USER32(?,00001105,00000000,00000000), ref: 00FE46F6

Strings

GETITEMCOUNT, xrefs: 00FE47D8
ISCHECKED, xrefs: 00FE4879
EXISTS, xrefs: 00FE475F
SELECT, xrefs: 00FE48A7
COLLAPSE, xrefs: 00FE473C
UNCHECK, xrefs: 00FE48D2
GETSELECTED, xrefs: 00FE4806
GETTEXT, xrefs: 00FE4849
CHECK, xrefs: 00FE4716
EXPAND, xrefs: 00FE47A8
GETTOTALCOUNT, xrefs: 00FE46DD

Memory Dump Source

Source File: 00000000.00000002.1667912702.0000000000F61000.00000020.00000001.01000000.00000003.sdmp, Offset: 00F60000, based on PE: true

Associated: 00000000.00000002.1667891216.0000000000F60000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667966851.0000000000FEF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667966851.0000000001015000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1668035777.000000000101F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1668053678.0000000001028000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f60000_tgBNtoWqIp.jbxd

Similarity

API ID: BuffCharMessageSendUpper
String ID: CHECK$COLLAPSE$EXISTS$EXPAND$GETITEMCOUNT$GETSELECTED$GETTEXT$GETTOTALCOUNT$ISCHECKED$SELECT$UNCHECK
API String ID: 3974292440-4258414348
Opcode ID: 5c3d573234f00fde5725b877601ef4ddd3ed79a72434170bd901acfc7b116830
Instruction ID: f59940332eaed8905ab96b2a98043ba1fef8bac63af0ad70505686f3171d0422
Opcode Fuzzy Hash: 5c3d573234f00fde5725b877601ef4ddd3ed79a72434170bd901acfc7b116830
Instruction Fuzzy Hash: 82917F356083419BCB14EF11C851A6EB7A6EF94314F04885DB8965B3A3CB79FD0AEB81

Function 00FEBAB8 Relevance: 22.9, APIs: 10, Strings: 3, Instructions: 197windowlibraryCOMMON

Download Yara Rule

APIs

LoadImageW.USER32(00000000,?,00000001,?,?,00002010), ref: 00FEBB6E
LoadLibraryExW.KERNEL32(?,00000000,00000032,?,?,00000001,?,?,?,00FE6D80,?), ref: 00FEBBCA
LoadImageW.USER32(?,?,00000001,?,?,00000000), ref: 00FEBC03
LoadImageW.USER32(00000000,?,00000001,?,?,00000000), ref: 00FEBC46
LoadImageW.USER32(?,?,00000001,?,?,00000000), ref: 00FEBC7D
FreeLibrary.KERNEL32(?), ref: 00FEBC89
ExtractIconExW.SHELL32(?,00000000,00000000,00000000,00000001), ref: 00FEBC99
DestroyIcon.USER32(?), ref: 00FEBCA8
SendMessageW.USER32(?,00000170,00000000,00000000), ref: 00FEBCC5
SendMessageW.USER32(?,00000064,00000172,00000001), ref: 00FEBCD1

Part of subcall function 00F8313D: __wcsicmp_l.LIBCMT ref: 00F831C6

Strings

.icl, xrefs: 00FEBAE4
.dll, xrefs: 00FEBB27
.exe, xrefs: 00FEBB04

Memory Dump Source

Source File: 00000000.00000002.1667912702.0000000000F61000.00000020.00000001.01000000.00000003.sdmp, Offset: 00F60000, based on PE: true

Associated: 00000000.00000002.1667891216.0000000000F60000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667966851.0000000000FEF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667966851.0000000001015000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1668035777.000000000101F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1668053678.0000000001028000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f60000_tgBNtoWqIp.jbxd

Similarity

API ID: Load$Image$IconLibraryMessageSend$DestroyExtractFree__wcsicmp_l
String ID: .dll$.exe$.icl
API String ID: 1212759294-1154884017
Opcode ID: ef30253222d30421c0c6fa4942084c254d008fc891fbeb6b9d786acb92a75800
Instruction ID: e4f167cf7daa3495ccf71b7d379b77ea7572fca3e99cf58f8cc783b861893703
Opcode Fuzzy Hash: ef30253222d30421c0c6fa4942084c254d008fc891fbeb6b9d786acb92a75800
Instruction Fuzzy Hash: BC61E371904259BAEB14DF65CC85FBF77A8FB08720F104119F915DA1D0DB78A984EBA0

Function 00FCA5BD Relevance: 22.9, APIs: 5, Strings: 8, Instructions: 138COMMON

Download Yara Rule

APIs

Part of subcall function 00F69997: __itow.LIBCMT ref: 00F699C2
Part of subcall function 00F69997: __swprintf.LIBCMT ref: 00F69A0C

CharLowerBuffW.USER32(?,?), ref: 00FCA636
GetDriveTypeW.KERNEL32 ref: 00FCA683
mciSendStringW.WINMM(?,00000000,00000000,00000000), ref: 00FCA6CB
mciSendStringW.WINMM(?,00000000,00000000,00000000), ref: 00FCA702
mciSendStringW.WINMM(?,00000000,00000000,00000000), ref: 00FCA730

Part of subcall function 00F67D2C: _memmove.LIBCMT ref: 00F67D66

Strings

close, xrefs: 00FCA63C
close cd wait, xrefs: 00FCA71B
type cdaudio alias cd wait, xrefs: 00FCA6AE
closed, xrefs: 00FCA64A, 00FCA653
set cd door , xrefs: 00FCA6D1
open , xrefs: 00FCA692
open, xrefs: 00FCA65D
wait, xrefs: 00FCA6ED

Memory Dump Source

Source File: 00000000.00000002.1667912702.0000000000F61000.00000020.00000001.01000000.00000003.sdmp, Offset: 00F60000, based on PE: true

Associated: 00000000.00000002.1667891216.0000000000F60000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667966851.0000000000FEF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667966851.0000000001015000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1668035777.000000000101F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1668053678.0000000001028000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f60000_tgBNtoWqIp.jbxd

Similarity

API ID: SendString$BuffCharDriveLowerType__itow__swprintf_memmove
String ID: type cdaudio alias cd wait$ wait$close$close cd wait$closed$open$open $set cd door
API String ID: 2698844021-4113822522
Opcode ID: 8d6c326eb2c8ad9543db0434200e616f5c8ca3da4845c3757e7838374bc928a5
Instruction ID: 1e2330f97bbdbd8a6f6ba904db1951948be6828912ae5c16edc820efd874f515
Opcode Fuzzy Hash: 8d6c326eb2c8ad9543db0434200e616f5c8ca3da4845c3757e7838374bc928a5
Instruction Fuzzy Hash: C5514B716043499FC700EF20CD9196AB7F8FF98718F04495CF8955B261DB39AE09DB52

Function 00FCA45A Relevance: 22.9, APIs: 10, Strings: 3, Instructions: 102fileCOMMON

Download Yara Rule

APIs

GetFullPathNameW.KERNEL32(?,00007FFF,?,?), ref: 00FCA47A
__swprintf.LIBCMT ref: 00FCA49C
CreateDirectoryW.KERNEL32(?,00000000), ref: 00FCA4D9
CreateFileW.KERNEL32(?,40000000,00000000,00000000,00000003,02200000,00000000), ref: 00FCA4FE
_memset.LIBCMT ref: 00FCA51D
_wcsncpy.LIBCMT ref: 00FCA559
DeviceIoControl.KERNEL32(00000000,000900A4,?,?,00000000,00000000,?,00000000), ref: 00FCA58E
CloseHandle.KERNEL32(00000000), ref: 00FCA599
RemoveDirectoryW.KERNEL32(?), ref: 00FCA5A2
CloseHandle.KERNEL32(00000000), ref: 00FCA5AC

Strings

\, xrefs: 00FCA4B2
:, xrefs: 00FCA4BD
\??\%s, xrefs: 00FCA496

Memory Dump Source

Source File: 00000000.00000002.1667912702.0000000000F61000.00000020.00000001.01000000.00000003.sdmp, Offset: 00F60000, based on PE: true

Associated: 00000000.00000002.1667891216.0000000000F60000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667966851.0000000000FEF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667966851.0000000001015000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1668035777.000000000101F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1668053678.0000000001028000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f60000_tgBNtoWqIp.jbxd

Similarity

API ID: CloseCreateDirectoryHandle$ControlDeviceFileFullNamePathRemove__swprintf_memset_wcsncpy
String ID: :$\$\??\%s
API String ID: 2733774712-3457252023
Opcode ID: a98ba3e44147e05ae66c37b2eabba1b059f8bcafa0f969410e70b65fcaf44f59
Instruction ID: 3b5a2d44390b39a6194cafea4bc108a6fdba253d8698fe0a2eed2ba1e272b782
Opcode Fuzzy Hash: a98ba3e44147e05ae66c37b2eabba1b059f8bcafa0f969410e70b65fcaf44f59
Instruction Fuzzy Hash: 8F31A27190014EABDB21DFA0DC89FEB73BCEF88715F1040BAFA08D6160E77496459B25

Function 00F9AB1B Relevance: 22.7, APIs: 15, Instructions: 211COMMONLIBRARYCODE

Download Yara Rule

APIs

_copy_environ.LIBCMT ref: 00F9AB7B
___wtomb_environ.LIBCMT ref: 00F9AB9D

Part of subcall function 00F88D68: __getptd_noexit.LIBCMT ref: 00F88D68

__malloc_crt.LIBCMT ref: 00F9ABC5
__malloc_crt.LIBCMT ref: 00F9ABE2
_free.LIBCMT ref: 00F9AC19
__recalloc_crt.LIBCMT ref: 00F9AC52
__recalloc_crt.LIBCMT ref: 00F9AC97
_strlen.LIBCMT ref: 00F9ACC3
__calloc_crt.LIBCMT ref: 00F9ACCD
_strlen.LIBCMT ref: 00F9ACDC
SetEnvironmentVariableA.KERNEL32(00000000,00000000,?,?,?,?,00000000,00000000), ref: 00F9AD0A
_free.LIBCMT ref: 00F9AD24
_free.LIBCMT ref: 00F9AD31
_free.LIBCMT ref: 00F9AD43
__invoke_watson.LIBCMT ref: 00F9AD5D

Memory Dump Source

Source File: 00000000.00000002.1667912702.0000000000F61000.00000020.00000001.01000000.00000003.sdmp, Offset: 00F60000, based on PE: true

Associated: 00000000.00000002.1667891216.0000000000F60000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667966851.0000000000FEF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667966851.0000000001015000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1668035777.000000000101F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1668053678.0000000001028000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f60000_tgBNtoWqIp.jbxd

Similarity

API ID: _free$__malloc_crt__recalloc_crt_strlen$EnvironmentVariable___wtomb_environ__calloc_crt__getptd_noexit__invoke_watson_copy_environ
String ID:
API String ID: 884005220-0
Opcode ID: 4c3ae5f75f2a2db57d0bd726d14d3bba0da5ccc51430f3371d43952441906f96
Instruction ID: 8e01be3ff200ea80206e0d821d049bc01cd6f33a72bd4d9a3c5680c8faa8fb19
Opcode Fuzzy Hash: 4c3ae5f75f2a2db57d0bd726d14d3bba0da5ccc51430f3371d43952441906f96
Instruction Fuzzy Hash: E461DF72E00205AFFF20AF24DC42BA977A5FF51775F20412AE8019A185EB39D941EBD2

Function 00FEC49C Relevance: 21.2, APIs: 11, Strings: 1, Instructions: 229windowCOMMON

Download Yara Rule

APIs

Part of subcall function 00F62612: GetWindowLongW.USER32(?,000000EB), ref: 00F62623

PostMessageW.USER32(?,00000111,00000000,00000000), ref: 00FEC4EC
GetFocus.USER32 ref: 00FEC4FC
GetDlgCtrlID.USER32(00000000), ref: 00FEC507
_memset.LIBCMT ref: 00FEC632
GetMenuItemInfoW.USER32(?,00000000,00000000,?), ref: 00FEC65D
GetMenuItemCount.USER32(?), ref: 00FEC67D
GetMenuItemID.USER32(?,00000000), ref: 00FEC690
GetMenuItemInfoW.USER32(?,-00000001,00000001,?), ref: 00FEC6C4
GetMenuItemInfoW.USER32(?,?,00000001,?), ref: 00FEC70C
CheckMenuRadioItem.USER32(?,00000000,?,00000000,00000400), ref: 00FEC744
DefDlgProcW.USER32(?,00000111,?,?,?,?,?,?,?), ref: 00FEC779

Strings

0, xrefs: 00FEC62A

Memory Dump Source

Source File: 00000000.00000002.1667912702.0000000000F61000.00000020.00000001.01000000.00000003.sdmp, Offset: 00F60000, based on PE: true

Associated: 00000000.00000002.1667891216.0000000000F60000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667966851.0000000000FEF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667966851.0000000001015000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1668035777.000000000101F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1668053678.0000000001028000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f60000_tgBNtoWqIp.jbxd

Similarity

API ID: ItemMenu$Info$CheckCountCtrlFocusLongMessagePostProcRadioWindow_memset
String ID: 0
API String ID: 1296962147-4108050209
Opcode ID: 592371ee0ec6d794a7d5eda6c21c9a98f95c0e61f216f219b521487bd44da1b1
Instruction ID: 41efb5597bd4afc048c2bf9e39b8ba816a6dcb2cd9843e1431ac99cf9627a9ef
Opcode Fuzzy Hash: 592371ee0ec6d794a7d5eda6c21c9a98f95c0e61f216f219b521487bd44da1b1
Instruction Fuzzy Hash: 3381B0715083859FD720DF16C884A6BBBE8FF88324F04452DF99597291D731D906EF92

Function 00FB83F4 Relevance: 21.2, APIs: 14, Instructions: 179memoryCOMMON

Download Yara Rule

APIs

Part of subcall function 00FB874A: GetUserObjectSecurity.USER32(?,00000004,?,00000000,?), ref: 00FB8766
Part of subcall function 00FB874A: GetLastError.KERNEL32(?,00FB822A,?,?,?), ref: 00FB8770
Part of subcall function 00FB874A: GetProcessHeap.KERNEL32(00000008,?,?,00FB822A,?,?,?), ref: 00FB877F
Part of subcall function 00FB874A: HeapAlloc.KERNEL32(00000000,?,00FB822A,?,?,?), ref: 00FB8786
Part of subcall function 00FB874A: GetUserObjectSecurity.USER32(?,00000004,00000000,?,?), ref: 00FB879D

Part of subcall function 00FB87E7: GetProcessHeap.KERNEL32(00000008,00FB8240,00000000,00000000,?,00FB8240,?), ref: 00FB87F3
Part of subcall function 00FB87E7: HeapAlloc.KERNEL32(00000000,?,00FB8240,?), ref: 00FB87FA
Part of subcall function 00FB87E7: InitializeSecurityDescriptor.ADVAPI32(00000000,00000001,?,00FB8240,?), ref: 00FB880B

GetSecurityDescriptorDacl.ADVAPI32(?,?,?,?), ref: 00FB8458
_memset.LIBCMT ref: 00FB846D
GetAclInformation.ADVAPI32(?,?,0000000C,00000002), ref: 00FB848C
GetLengthSid.ADVAPI32(?), ref: 00FB849D
GetAce.ADVAPI32(?,00000000,?), ref: 00FB84DA
AddAce.ADVAPI32(?,00000002,000000FF,?,?), ref: 00FB84F6
GetLengthSid.ADVAPI32(?), ref: 00FB8513
GetProcessHeap.KERNEL32(00000008,-00000008), ref: 00FB8522
HeapAlloc.KERNEL32(00000000), ref: 00FB8529
GetLengthSid.ADVAPI32(?,00000008,?), ref: 00FB854A
CopySid.ADVAPI32(00000000), ref: 00FB8551
AddAce.ADVAPI32(?,00000002,000000FF,00000000,?), ref: 00FB8582
SetSecurityDescriptorDacl.ADVAPI32(?,00000001,?,00000000), ref: 00FB85A8
SetUserObjectSecurity.USER32(?,00000004,?), ref: 00FB85BC

Memory Dump Source

Source File: 00000000.00000002.1667912702.0000000000F61000.00000020.00000001.01000000.00000003.sdmp, Offset: 00F60000, based on PE: true

Associated: 00000000.00000002.1667891216.0000000000F60000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667966851.0000000000FEF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667966851.0000000001015000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1668035777.000000000101F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1668053678.0000000001028000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f60000_tgBNtoWqIp.jbxd

Similarity

API ID: HeapSecurity$AllocDescriptorLengthObjectProcessUser$Dacl$CopyErrorInformationInitializeLast_memset
String ID:
API String ID: 3996160137-0
Opcode ID: 01fa044c6278012967e0c32adb0ed0dd669fe2da3aa67afe80facbac45ece28d
Instruction ID: 9d5dabac2ff7613aafd92d46e5a1c2004429f109843283aa046326b59dee8cfe
Opcode Fuzzy Hash: 01fa044c6278012967e0c32adb0ed0dd669fe2da3aa67afe80facbac45ece28d
Instruction Fuzzy Hash: A8615B71900209EBDF10DF91DC85AEEBBB9FF44360F148129E915AA291DB349A06EF60

Function 00FD762D Relevance: 21.2, APIs: 11, Strings: 1, Instructions: 160windowCOMMON

Download Yara Rule

APIs

GetDC.USER32(00000000), ref: 00FD76A2
CreateCompatibleBitmap.GDI32(00000000,00000007,?), ref: 00FD76AE
CreateCompatibleDC.GDI32(?), ref: 00FD76BA
SelectObject.GDI32(00000000,?), ref: 00FD76C7
StretchBlt.GDI32(00000006,00000000,00000000,00000007,?,?,?,?,00000007,?,00CC0020), ref: 00FD771B
GetDIBits.GDI32(00000006,?,00000000,00000000,00000000,00000028,00000000), ref: 00FD7757
GetDIBits.GDI32(00000006,?,00000000,?,00000000,00000028,00000000), ref: 00FD777B
SelectObject.GDI32(00000006,?), ref: 00FD7783
DeleteObject.GDI32(?), ref: 00FD778C
DeleteDC.GDI32(00000006), ref: 00FD7793
ReleaseDC.USER32(00000000,?), ref: 00FD779E

Strings

(, xrefs: 00FD7723

Memory Dump Source

Source File: 00000000.00000002.1667912702.0000000000F61000.00000020.00000001.01000000.00000003.sdmp, Offset: 00F60000, based on PE: true

Associated: 00000000.00000002.1667891216.0000000000F60000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667966851.0000000000FEF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667966851.0000000001015000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1668035777.000000000101F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1668053678.0000000001028000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f60000_tgBNtoWqIp.jbxd

Similarity

API ID: Object$BitsCompatibleCreateDeleteSelect$BitmapReleaseStretch
String ID: (
API String ID: 2598888154-3887548279
Opcode ID: b72d58786259348fcda53d08e4195491ac2e70e07fccd42ead50fad8aa51d649
Instruction ID: ba32a1ce8884b9ea208c521c36c19703dd950234be2c6026a84e78743fa28396
Opcode Fuzzy Hash: b72d58786259348fcda53d08e4195491ac2e70e07fccd42ead50fad8aa51d649
Instruction Fuzzy Hash: 5A514C75904349EFCB15DFA8CC85EAEBBB9EF48310F14852EF94A9B310D731A9449B50

Function 00FCA0B5 Relevance: 21.2, APIs: 7, Strings: 5, Instructions: 156COMMON

Download Yara Rule

APIs

LoadStringW.USER32(00000066,?,00000FFF,00FEFB78), ref: 00FCA0FC

Part of subcall function 00F67F41: _memmove.LIBCMT ref: 00F67F82

LoadStringW.USER32(?,?,00000FFF,?), ref: 00FCA11E
__swprintf.LIBCMT ref: 00FCA177
__swprintf.LIBCMT ref: 00FCA190
_wprintf.LIBCMT ref: 00FCA246
_wprintf.LIBCMT ref: 00FCA264

Strings

^ ERROR, xrefs: 00FCA1E8
"%s" (%d) : ==> %s:, xrefs: 00FCA25F
"%s" (%d) : ==> %s:%s%s, xrefs: 00FCA241
Error: , xrefs: 00FCA20E
Line %d (File "%s"):, xrefs: 00FCA171, 00FCA18A

Memory Dump Source

Source File: 00000000.00000002.1667912702.0000000000F61000.00000020.00000001.01000000.00000003.sdmp, Offset: 00F60000, based on PE: true

Associated: 00000000.00000002.1667891216.0000000000F60000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667966851.0000000000FEF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667966851.0000000001015000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1668035777.000000000101F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1668053678.0000000001028000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f60000_tgBNtoWqIp.jbxd

Similarity

API ID: LoadString__swprintf_wprintf$_memmove
String ID: Error: $"%s" (%d) : ==> %s:$"%s" (%d) : ==> %s:%s%s$Line %d (File "%s"):$^ ERROR
API String ID: 311963372-2391861430
Opcode ID: 394e736b0708e6d26cd0416144445ef130e2981ebb4fdbfcdc14b77fcdca3963
Instruction ID: b0193f864632a3e67b5456ec0cc042b4090b2fb8523640cb3c958f5bf5dd76c1
Opcode Fuzzy Hash: 394e736b0708e6d26cd0416144445ef130e2981ebb4fdbfcdc14b77fcdca3963
Instruction Fuzzy Hash: 3F51723290021AABCF25FBE0CD86EEEB779AF14708F100165F50572061EB3A6F58EB51

Function 00F66BEC Relevance: 19.7, APIs: 4, Strings: 7, Instructions: 478COMMON

Download Yara Rule

APIs

Part of subcall function 00F80B9B: GetCurrentDirectoryW.KERNEL32(00007FFF,?,?,?,00F66C6C,?,00008000), ref: 00F80BB7

Part of subcall function 00F648AE: GetFullPathNameW.KERNEL32(?,00007FFF,?,00000000,?,?,00F648A1,?,?,00F637C0,?), ref: 00F648CE

SetCurrentDirectoryW.KERNEL32(?,?,?,?,00000000), ref: 00F66D0D
SetCurrentDirectoryW.KERNEL32(?), ref: 00F66E5A

Part of subcall function 00F659CD: _wcscpy.LIBCMT ref: 00F65A05

Part of subcall function 00F8387D: _iswctype.LIBCMT ref: 00F83885

Strings

Unterminated string, xrefs: 00F9EC0D
#include depth exceeded. Make sure there are no recursive includes, xrefs: 00F9E84A
Bad directive syntax error, xrefs: 00F9EBC6
EA06, xrefs: 00F9E87B
AU3!, xrefs: 00F66CC1
Error opening the file, xrefs: 00F9E866, 00F9E8E1
>>>AUTOIT SCRIPT<<<, xrefs: 00F9E8BF

Memory Dump Source

Source File: 00000000.00000002.1667912702.0000000000F61000.00000020.00000001.01000000.00000003.sdmp, Offset: 00F60000, based on PE: true

Associated: 00000000.00000002.1667891216.0000000000F60000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667966851.0000000000FEF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667966851.0000000001015000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1668035777.000000000101F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1668053678.0000000001028000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f60000_tgBNtoWqIp.jbxd

Similarity

API ID: CurrentDirectory$FullNamePath_iswctype_wcscpy
String ID: #include depth exceeded. Make sure there are no recursive includes$>>>AUTOIT SCRIPT<<<$AU3!$Bad directive syntax error$EA06$Error opening the file$Unterminated string
API String ID: 537147316-1018226102
Opcode ID: f23a9c805c29b57b34e3380a0d553a0263a4234b65f3767074881cc389ff1007
Instruction ID: 1f76bb104d75837e306f15b4eb914308f24b8a7a759810f387cb99c5fa97cc8e
Opcode Fuzzy Hash: f23a9c805c29b57b34e3380a0d553a0263a4234b65f3767074881cc389ff1007
Instruction Fuzzy Hash: 9B02AC315083419FCB24EF24CC91AAFBBE5BF99714F04091DF486972A2DB39D949EB42

Function 00F645DF Relevance: 19.7, APIs: 13, Instructions: 215windowCOMMON

Download Yara Rule

APIs

_memset.LIBCMT ref: 00F645F9
GetMenuItemCount.USER32(01026890), ref: 00F9D7CD
GetMenuItemCount.USER32(01026890), ref: 00F9D87D
GetCursorPos.USER32(?), ref: 00F9D8C1
SetForegroundWindow.USER32(00000000), ref: 00F9D8CA
TrackPopupMenuEx.USER32(01026890,00000000,?,00000000,00000000,00000000), ref: 00F9D8DD
PostMessageW.USER32(00000000,00000000,00000000,00000000), ref: 00F9D8E9

Memory Dump Source

Source File: 00000000.00000002.1667912702.0000000000F61000.00000020.00000001.01000000.00000003.sdmp, Offset: 00F60000, based on PE: true

Associated: 00000000.00000002.1667891216.0000000000F60000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667966851.0000000000FEF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667966851.0000000001015000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1668035777.000000000101F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1668053678.0000000001028000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f60000_tgBNtoWqIp.jbxd

Similarity

API ID: Menu$CountItem$CursorForegroundMessagePopupPostTrackWindow_memset
String ID:
API String ID: 2751501086-0
Opcode ID: d2d585f41ea8b279ba191d5b2c0821bbfdc4622e63e0c4cfe497ca79216b2dc1
Instruction ID: 70b6e1c68a0d5307f9c0f48424a35fbfaf3969b149f12453a946254b53dd55a0
Opcode Fuzzy Hash: d2d585f41ea8b279ba191d5b2c0821bbfdc4622e63e0c4cfe497ca79216b2dc1
Instruction Fuzzy Hash: 0871F471A00249BAFF219F64DC89FAABF64FF05364F240216F515AA1E1C7B66810FB91

Function 00FE10A5 Relevance: 19.4, APIs: 1, Strings: 10, Instructions: 120COMMON

Download Yara Rule

APIs

CharUpperBuffW.USER32(?,?,?,?,?,?,?,00FE0038,?,?), ref: 00FE10BC

Strings

HKCR, xrefs: 00FE1164
HKCC, xrefs: 00FE118A
HKEY_CLASSES_ROOT, xrefs: 00FE114F
HKCU, xrefs: 00FE11AC
HKLM, xrefs: 00FE113A
HKEY_CURRENT_CONFIG, xrefs: 00FE1179
HKEY_LOCAL_MACHINE, xrefs: 00FE1125
HKU, xrefs: 00FE11CE
HKEY_CURRENT_USER, xrefs: 00FE119B
HKEY_USERS, xrefs: 00FE11BD

Memory Dump Source

Source File: 00000000.00000002.1667912702.0000000000F61000.00000020.00000001.01000000.00000003.sdmp, Offset: 00F60000, based on PE: true

Associated: 00000000.00000002.1667891216.0000000000F60000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667966851.0000000000FEF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667966851.0000000001015000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1668035777.000000000101F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1668053678.0000000001028000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f60000_tgBNtoWqIp.jbxd

Similarity

API ID: BuffCharUpper
String ID: HKCC$HKCR$HKCU$HKEY_CLASSES_ROOT$HKEY_CURRENT_CONFIG$HKEY_CURRENT_USER$HKEY_LOCAL_MACHINE$HKEY_USERS$HKLM$HKU
API String ID: 3964851224-909552448
Opcode ID: 4c4f9caf2679da150b6e0005776663375c4dc25daf46b696a1e7045c62858658
Instruction ID: 66e6a262ddc0cfd2efec8f17469926e911c0675f64ff9850d4cecbb9d8f26000
Opcode Fuzzy Hash: 4c4f9caf2679da150b6e0005776663375c4dc25daf46b696a1e7045c62858658
Instruction Fuzzy Hash: F8418B3164028E8BDF10FF92DC91AEA3726BF15310F904455FD915B296DF38AD1AEBA0

Function 00FC5569 Relevance: 19.3, APIs: 5, Strings: 6, Instructions: 74COMMON

Download Yara Rule

APIs

Part of subcall function 00F67D2C: _memmove.LIBCMT ref: 00F67D66

Part of subcall function 00F67A84: _memmove.LIBCMT ref: 00F67B0D

mciSendStringW.WINMM(status PlayMe mode,?,00000100,00000000), ref: 00FC55D2
mciSendStringW.WINMM(close PlayMe,00000000,00000000,00000000), ref: 00FC55E8
mciSendStringW.WINMM(?,00000000,00000000,00000000), ref: 00FC55F9
mciSendStringW.WINMM(play PlayMe wait,00000000,00000000,00000000), ref: 00FC560B
mciSendStringW.WINMM(play PlayMe,00000000,00000000,00000000), ref: 00FC561C

Strings

alias PlayMe, xrefs: 00FC55AB
status PlayMe mode, xrefs: 00FC55CD
close PlayMe, xrefs: 00FC55E3, 00FC5610
play PlayMe, xrefs: 00FC5617
open , xrefs: 00FC5581
play PlayMe wait, xrefs: 00FC5606

Memory Dump Source

Source File: 00000000.00000002.1667912702.0000000000F61000.00000020.00000001.01000000.00000003.sdmp, Offset: 00F60000, based on PE: true

Associated: 00000000.00000002.1667891216.0000000000F60000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667966851.0000000000FEF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667966851.0000000001015000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1668035777.000000000101F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1668053678.0000000001028000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f60000_tgBNtoWqIp.jbxd

Similarity

API ID: SendString$_memmove
String ID: alias PlayMe$close PlayMe$open $play PlayMe$play PlayMe wait$status PlayMe mode
API String ID: 2279737902-1007645807
Opcode ID: 1ef74323d5e5563689be6b1bfb996e7b3dc88041b64241e1f10cc03e020b5ba3
Instruction ID: 0a5c47465f494fccee522e3d163a71bc3ba206cfb52ab78a1d0fd1c69d3930ad
Opcode Fuzzy Hash: 1ef74323d5e5563689be6b1bfb996e7b3dc88041b64241e1f10cc03e020b5ba3
Instruction Fuzzy Hash: 5011C820A512A9B9D720B6A2CC4AEFFBB7CEF91F14F40041DB441A7096DEA81D45D5A0

Function 00FC48F3 Relevance: 19.3, APIs: 10, Strings: 1, Instructions: 73networkCOMMON

Download Yara Rule

APIs

WSAStartup.WSOCK32(00000101,?), ref: 00FC490E
gethostname.WSOCK32(?,00000100), ref: 00FC4928
gethostbyname.WSOCK32(?), ref: 00FC4935
_wcscpy.LIBCMT ref: 00FC495D
_memmove.LIBCMT ref: 00FC4970
inet_ntoa.WSOCK32(?), ref: 00FC497B
_strcat.LIBCMT ref: 00FC4989
_wcscpy.LIBCMT ref: 00FC49A0
WSACleanup.WSOCK32 ref: 00FC49AE
_wcscpy.LIBCMT ref: 00FC49BC

Strings

0.0.0.0, xrefs: 00FC4957

Memory Dump Source

Source File: 00000000.00000002.1667912702.0000000000F61000.00000020.00000001.01000000.00000003.sdmp, Offset: 00F60000, based on PE: true

Associated: 00000000.00000002.1667891216.0000000000F60000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667966851.0000000000FEF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667966851.0000000001015000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1668035777.000000000101F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1668053678.0000000001028000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f60000_tgBNtoWqIp.jbxd

Similarity

API ID: _wcscpy$CleanupStartup_memmove_strcatgethostbynamegethostnameinet_ntoa
String ID: 0.0.0.0
API String ID: 208665112-3771769585
Opcode ID: 66eb3415619e2f3b5fcbee2f12cf625637a28b1a26bcae896d34d4aba422d945
Instruction ID: 49d64f93f14e4191279b3b37cc39a0a41f5a4fee4bbff58591f41fba605c0e1b
Opcode Fuzzy Hash: 66eb3415619e2f3b5fcbee2f12cf625637a28b1a26bcae896d34d4aba422d945
Instruction Fuzzy Hash: 8011D232E0412AABCB20EB249D4AFDB77BCDF40720F0401BAF5459A051EF75AA85F761

Function 00FC5217 Relevance: 19.3, APIs: 10, Strings: 1, Instructions: 72sleepwindowtimeCOMMON

Download Yara Rule

APIs

timeGetTime.WINMM ref: 00FC521C

Part of subcall function 00F80719: timeGetTime.WINMM(?,75C0B400,00F70FF9), ref: 00F8071D

Sleep.KERNEL32(0000000A), ref: 00FC5248
EnumThreadWindows.USER32(?,Function_000651CA,00000000), ref: 00FC526C
FindWindowExW.USER32(00000000,00000000,BUTTON,00000000), ref: 00FC528E
SetActiveWindow.USER32 ref: 00FC52AD
SendMessageW.USER32(00000000,000000F5,00000000,00000000), ref: 00FC52BB
SendMessageW.USER32(00000010,00000000,00000000), ref: 00FC52DA
Sleep.KERNEL32(000000FA), ref: 00FC52E5
IsWindow.USER32 ref: 00FC52F1
EndDialog.USER32(00000000), ref: 00FC5302

Strings

BUTTON, xrefs: 00FC5280

Memory Dump Source

Source File: 00000000.00000002.1667912702.0000000000F61000.00000020.00000001.01000000.00000003.sdmp, Offset: 00F60000, based on PE: true

Associated: 00000000.00000002.1667891216.0000000000F60000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667966851.0000000000FEF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667966851.0000000001015000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1668035777.000000000101F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1668053678.0000000001028000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f60000_tgBNtoWqIp.jbxd

Similarity

API ID: Window$MessageSendSleepTimetime$ActiveDialogEnumFindThreadWindows
String ID: BUTTON
API String ID: 1194449130-3405671355
Opcode ID: 8caa23c24a90e511293aeaa89b9292d19955a077bb1c21a6800b4d28e165aed8
Instruction ID: 246e5cc4b9273ef5b134c3114232b259e6a72f3b983946deeb6fe3c2b5fc7b2e
Opcode Fuzzy Hash: 8caa23c24a90e511293aeaa89b9292d19955a077bb1c21a6800b4d28e165aed8
Instruction Fuzzy Hash: 1721FC70100789AFE7205F30EECAF257B59EB65756F54002CF445851A1CBBA6D48B721

Function 00FCD7F8 Relevance: 18.3, APIs: 12, Instructions: 283comCOMMON

Download Yara Rule

APIs

Part of subcall function 00F69997: __itow.LIBCMT ref: 00F699C2
Part of subcall function 00F69997: __swprintf.LIBCMT ref: 00F69A0C

CoInitialize.OLE32(00000000), ref: 00FCD855
SHGetSpecialFolderLocation.SHELL32(00000000,00000000,?), ref: 00FCD8E8
SHGetDesktopFolder.SHELL32(?), ref: 00FCD8FC
CoCreateInstance.OLE32(00FF2D7C,00000000,00000001,0101A89C,?), ref: 00FCD948
SHCreateShellItem.SHELL32(00000000,00000000,?,00000003), ref: 00FCD9B7
CoTaskMemFree.OLE32(?,?), ref: 00FCDA0F
_memset.LIBCMT ref: 00FCDA4C
SHBrowseForFolderW.SHELL32(?), ref: 00FCDA88
SHGetPathFromIDListW.SHELL32(00000000,?), ref: 00FCDAAB
CoTaskMemFree.OLE32(00000000), ref: 00FCDAB2
CoTaskMemFree.OLE32(00000000,00000001,00000000), ref: 00FCDAE9
CoUninitialize.OLE32(00000001,00000000), ref: 00FCDAEB

Memory Dump Source

Source File: 00000000.00000002.1667912702.0000000000F61000.00000020.00000001.01000000.00000003.sdmp, Offset: 00F60000, based on PE: true

Associated: 00000000.00000002.1667891216.0000000000F60000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667966851.0000000000FEF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667966851.0000000001015000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1668035777.000000000101F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1668053678.0000000001028000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f60000_tgBNtoWqIp.jbxd

Similarity

API ID: FolderFreeTask$Create$BrowseDesktopFromInitializeInstanceItemListLocationPathShellSpecialUninitialize__itow__swprintf_memset
String ID:
API String ID: 1246142700-0
Opcode ID: 4bcb4bf373ade333b3774616dbbb89b3e9e81776852faffa2d81ccf9aad08564
Instruction ID: 9a1634980efca1e975f5e8e2626329cc205c3ceced82e865334ef4350a39d838
Opcode Fuzzy Hash: 4bcb4bf373ade333b3774616dbbb89b3e9e81776852faffa2d81ccf9aad08564
Instruction Fuzzy Hash: 3CB11C75A00109AFDB04DF64CD85EAEBBB9FF88314B148469F409EB261DB34EE45DB50

Function 00FC052C Relevance: 18.2, APIs: 12, Instructions: 186keyboardCOMMON

Download Yara Rule

APIs

GetKeyboardState.USER32(?), ref: 00FC05A7
SetKeyboardState.USER32(?), ref: 00FC0612
GetAsyncKeyState.USER32(000000A0), ref: 00FC0632
GetKeyState.USER32(000000A0), ref: 00FC0649
GetAsyncKeyState.USER32(000000A1), ref: 00FC0678
GetKeyState.USER32(000000A1), ref: 00FC0689
GetAsyncKeyState.USER32(00000011), ref: 00FC06B5
GetKeyState.USER32(00000011), ref: 00FC06C3
GetAsyncKeyState.USER32(00000012), ref: 00FC06EC
GetKeyState.USER32(00000012), ref: 00FC06FA
GetAsyncKeyState.USER32(0000005B), ref: 00FC0723
GetKeyState.USER32(0000005B), ref: 00FC0731

Memory Dump Source

Source File: 00000000.00000002.1667912702.0000000000F61000.00000020.00000001.01000000.00000003.sdmp, Offset: 00F60000, based on PE: true

Associated: 00000000.00000002.1667891216.0000000000F60000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667966851.0000000000FEF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667966851.0000000001015000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1668035777.000000000101F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1668053678.0000000001028000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f60000_tgBNtoWqIp.jbxd

Similarity

API ID: State$Async$Keyboard
String ID:
API String ID: 541375521-0
Opcode ID: b28d26f15c7007a42e8688a8ad47a6c5f3585c4ce0c67912810498e52b521832
Instruction ID: 44a0452e06f78e378f626478879575a491166877cc541026986d3fa3a37255d4
Opcode Fuzzy Hash: b28d26f15c7007a42e8688a8ad47a6c5f3585c4ce0c67912810498e52b521832
Instruction Fuzzy Hash: 61510B20E0478A5AFB34DBA08A52FEABFB49F02350F0C459D95C25A1C2DE549B4DEB51

Function 00FBC72A Relevance: 18.2, APIs: 12, Instructions: 174COMMON

Download Yara Rule

APIs

GetDlgItem.USER32(?,00000001), ref: 00FBC746
GetWindowRect.USER32(00000000,?), ref: 00FBC758
MoveWindow.USER32(00000001,0000000A,?,00000001,?,00000000), ref: 00FBC7B6
GetDlgItem.USER32(?,00000002), ref: 00FBC7C1
GetWindowRect.USER32(00000000,?), ref: 00FBC7D3
MoveWindow.USER32(00000001,?,00000000,00000001,?,00000000), ref: 00FBC827
GetDlgItem.USER32(?,000003E9), ref: 00FBC835
GetWindowRect.USER32(00000000,?), ref: 00FBC846
MoveWindow.USER32(00000000,0000000A,00000000,?,?,00000000), ref: 00FBC889
GetDlgItem.USER32(?,000003EA), ref: 00FBC897
MoveWindow.USER32(00000000,0000000A,0000000A,?,-00000005,00000000), ref: 00FBC8B4
InvalidateRect.USER32(?,00000000,00000001), ref: 00FBC8C1

Memory Dump Source

Source File: 00000000.00000002.1667912702.0000000000F61000.00000020.00000001.01000000.00000003.sdmp, Offset: 00F60000, based on PE: true

Associated: 00000000.00000002.1667891216.0000000000F60000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667966851.0000000000FEF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667966851.0000000001015000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1668035777.000000000101F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1668053678.0000000001028000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f60000_tgBNtoWqIp.jbxd

Similarity

API ID: Window$ItemMoveRect$Invalidate
String ID:
API String ID: 3096461208-0
Opcode ID: 97ded801c87dd4ea02b5d3bec214c8842dc1eeae4b27ffb306edc3e5bf27c591
Instruction ID: 470c395f3fd1aac13c5d72af95d7f197cc123ff93f0bf4aa615b831ef9049dad
Opcode Fuzzy Hash: 97ded801c87dd4ea02b5d3bec214c8842dc1eeae4b27ffb306edc3e5bf27c591
Instruction Fuzzy Hash: 1A512F71F00209AFDB18CFA9DD99AAEBBBAEB88311F14812DF515D72A0D7709D049B50

Function 00F6201B Relevance: 18.2, APIs: 12, Instructions: 170timeCOMMON

Download Yara Rule

APIs

Part of subcall function 00F61B41: InvalidateRect.USER32(?,00000000,00000001,?,?,?,00F62036,?,00000000,?,?,?,?,00F616CB,00000000,?), ref: 00F61B9A

DestroyWindow.USER32(?,?,?,?,?,?,?,?,?,?,?,00000000,?,?), ref: 00F620D3
KillTimer.USER32(-00000001,?,?,?,?,00F616CB,00000000,?,?,00F61AE2,?,?), ref: 00F6216E
DestroyAcceleratorTable.USER32(00000000), ref: 00F9BEF6
ImageList_Destroy.COMCTL32(00000000,?,00000000,?,?,?,?,00F616CB,00000000,?,?,00F61AE2,?,?), ref: 00F9BF27
ImageList_Destroy.COMCTL32(00000000,?,00000000,?,?,?,?,00F616CB,00000000,?,?,00F61AE2,?,?), ref: 00F9BF3E
ImageList_Destroy.COMCTL32(00000000,?,00000000,?,?,?,?,00F616CB,00000000,?,?,00F61AE2,?,?), ref: 00F9BF5A
DeleteObject.GDI32(00000000), ref: 00F9BF6C

Memory Dump Source

Source File: 00000000.00000002.1667912702.0000000000F61000.00000020.00000001.01000000.00000003.sdmp, Offset: 00F60000, based on PE: true

Associated: 00000000.00000002.1667891216.0000000000F60000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667966851.0000000000FEF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667966851.0000000001015000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1668035777.000000000101F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1668053678.0000000001028000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f60000_tgBNtoWqIp.jbxd

Similarity

API ID: Destroy$ImageList_$AcceleratorDeleteInvalidateKillObjectRectTableTimerWindow
String ID:
API String ID: 641708696-0
Opcode ID: 8252a976660ecc90f8680ef5d85169320a740a431680d016b835bf465e91a4e5
Instruction ID: c684e87bd2ecce5f6fdf01a9970df1d928f5eea2dcf40c9f05c4945ce18cd4ed
Opcode Fuzzy Hash: 8252a976660ecc90f8680ef5d85169320a740a431680d016b835bf465e91a4e5
Instruction Fuzzy Hash: 4261AF31904A50EFDB359F14E988B29B7F1FF41326F204568E9829B964C77AA891FF40

Function 00F621A5 Relevance: 18.1, APIs: 12, Instructions: 132COMMON

Download Yara Rule

APIs

Part of subcall function 00F625DB: GetWindowLongW.USER32(?,000000EB), ref: 00F625EC

GetSysColor.USER32(0000000F), ref: 00F621D3

Memory Dump Source

Source File: 00000000.00000002.1667912702.0000000000F61000.00000020.00000001.01000000.00000003.sdmp, Offset: 00F60000, based on PE: true

Associated: 00000000.00000002.1667891216.0000000000F60000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667966851.0000000000FEF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667966851.0000000001015000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1668035777.000000000101F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1668053678.0000000001028000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f60000_tgBNtoWqIp.jbxd

Similarity

API ID: ColorLongWindow
String ID:
API String ID: 259745315-0
Opcode ID: bcb0e5203bd9b353054c3e84fbc470d59c457fb5fc74a9f2e2eab894b7eb43c8
Instruction ID: 41e871d39ad9a289129bcf10afb5101fc4d3f72e23b72bd91ab8d365a2619b68
Opcode Fuzzy Hash: bcb0e5203bd9b353054c3e84fbc470d59c457fb5fc74a9f2e2eab894b7eb43c8
Instruction Fuzzy Hash: 4941B2314005849BEB215F28DC98BB93B66EB46331F188265FD658E1E2C7358D82FB61

Function 00FCAB12 Relevance: 17.7, APIs: 3, Strings: 7, Instructions: 183COMMON

Download Yara Rule

APIs

CharLowerBuffW.USER32(?,?,00FEF910), ref: 00FCAB76
GetDriveTypeW.KERNEL32(00000061,0101A620,00000061), ref: 00FCAC40
_wcscpy.LIBCMT ref: 00FCAC6A

Strings

fixed, xrefs: 00FCABBE
unknown, xrefs: 00FCAC01
network, xrefs: 00FCABD4
cdrom, xrefs: 00FCAB92
all, xrefs: 00FCAB7C
removable, xrefs: 00FCABA8
ramdisk, xrefs: 00FCABEA

Memory Dump Source

Source File: 00000000.00000002.1667912702.0000000000F61000.00000020.00000001.01000000.00000003.sdmp, Offset: 00F60000, based on PE: true

Associated: 00000000.00000002.1667891216.0000000000F60000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667966851.0000000000FEF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667966851.0000000001015000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1668035777.000000000101F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1668053678.0000000001028000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f60000_tgBNtoWqIp.jbxd

Similarity

API ID: BuffCharDriveLowerType_wcscpy
String ID: all$cdrom$fixed$network$ramdisk$removable$unknown
API String ID: 2820617543-1000479233
Opcode ID: db7673b3505ee9f446449a46bcd235f1714f0a517eccf84a4a72396777218256
Instruction ID: b2f63f8c9bc7fb91d3a6bedb15167b1c379a1da8f81f4a258928dcbf63a4dc3a
Opcode Fuzzy Hash: db7673b3505ee9f446449a46bcd235f1714f0a517eccf84a4a72396777218256
Instruction Fuzzy Hash: E351BF316083069BC710EF14CD82FAAB7A5EF80718F50481DF4965B2A2DB39ED09EB52

Function 00F69997 Relevance: 17.6, APIs: 6, Strings: 4, Instructions: 146COMMON

Download Yara Rule

APIs

__itow.LIBCMT ref: 00F699C2
__swprintf.LIBCMT ref: 00F69A0C
__i64tow.LIBCMT ref: 00F9FA0F

Strings

False, xrefs: 00F9F9D7
%.15g, xrefs: 00F69A06
0x%p, xrefs: 00F9F9F1
True, xrefs: 00F9F9D0

Memory Dump Source

Source File: 00000000.00000002.1667912702.0000000000F61000.00000020.00000001.01000000.00000003.sdmp, Offset: 00F60000, based on PE: true

Associated: 00000000.00000002.1667891216.0000000000F60000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667966851.0000000000FEF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667966851.0000000001015000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1668035777.000000000101F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1668053678.0000000001028000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f60000_tgBNtoWqIp.jbxd

Similarity

API ID: __i64tow__itow__swprintf
String ID: %.15g$0x%p$False$True
API String ID: 421087845-2263619337
Opcode ID: f99f4b0d965380eaaa83a7e6c5836d66b6a18aff7c9a3aa3bfd3adb533b22cf2
Instruction ID: 1aa11eec5b9ce858579b874e942d64b36071db9881bb908851c4a1040d1d341d
Opcode Fuzzy Hash: f99f4b0d965380eaaa83a7e6c5836d66b6a18aff7c9a3aa3bfd3adb533b22cf2
Instruction Fuzzy Hash: 62410372A08205AFEF24AB38DC42F7A73F8EF44320F20446EE549D7295EE759945EB11

Function 00FE73C1 Relevance: 17.6, APIs: 8, Strings: 2, Instructions: 103windowCOMMON

Download Yara Rule

APIs

_memset.LIBCMT ref: 00FE73D9
CreateMenu.USER32 ref: 00FE73F4
SetMenu.USER32(?,00000000), ref: 00FE7403
GetMenuItemInfoW.USER32(?,000000FF,00000000,00000030), ref: 00FE7490
IsMenu.USER32(?), ref: 00FE74A6
CreatePopupMenu.USER32 ref: 00FE74B0
InsertMenuItemW.USER32(?,?,00000001,00000030), ref: 00FE74DD
DrawMenuBar.USER32 ref: 00FE74E5

Strings

0, xrefs: 00FE73CF
F, xrefs: 00FE74D1

Memory Dump Source

Source File: 00000000.00000002.1667912702.0000000000F61000.00000020.00000001.01000000.00000003.sdmp, Offset: 00F60000, based on PE: true

Associated: 00000000.00000002.1667891216.0000000000F60000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667966851.0000000000FEF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667966851.0000000001015000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1668035777.000000000101F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1668053678.0000000001028000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f60000_tgBNtoWqIp.jbxd

Similarity

API ID: Menu$CreateItem$DrawInfoInsertPopup_memset
String ID: 0$F
API String ID: 176399719-3044882817
Opcode ID: 8c37a2f25293323a0222b15fc76379e66bbd94613a0d365ca73803ce13e3b581
Instruction ID: e518a9662b3f6db2f2287d84a5168880a5d0978c773548563d252a37a4546afe
Opcode Fuzzy Hash: 8c37a2f25293323a0222b15fc76379e66bbd94613a0d365ca73803ce13e3b581
Instruction Fuzzy Hash: 3F416875A00389EFDB20EF65D884A9ABBB5FF49310F144029ED4597390DB31A914EF50

Function 00FE772A Relevance: 17.6, APIs: 9, Strings: 1, Instructions: 101windowCOMMON

Download Yara Rule

APIs

MoveWindow.USER32(?,?,?,000000FF,000000FF,00000000,?,?,000000FF,000000FF,?,?,static,00000000,00000000,?), ref: 00FE77CD
CreateCompatibleDC.GDI32(00000000), ref: 00FE77D4
SendMessageW.USER32(?,00000173,00000000,00000000), ref: 00FE77E7
SelectObject.GDI32(00000000,00000000), ref: 00FE77EF
GetPixel.GDI32(00000000,00000000,00000000), ref: 00FE77FA
DeleteDC.GDI32(00000000), ref: 00FE7803
GetWindowLongW.USER32(?,000000EC), ref: 00FE780D
SetLayeredWindowAttributes.USER32(?,00000000,00000000,00000001), ref: 00FE7821
DestroyWindow.USER32(?,?,?,000000FF,000000FF,?,?,static,00000000,00000000,?,?,00000000,00000000,?,?), ref: 00FE782D

Strings

static, xrefs: 00FE7765

Memory Dump Source

Source File: 00000000.00000002.1667912702.0000000000F61000.00000020.00000001.01000000.00000003.sdmp, Offset: 00F60000, based on PE: true

Associated: 00000000.00000002.1667891216.0000000000F60000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667966851.0000000000FEF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667966851.0000000001015000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1668035777.000000000101F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1668053678.0000000001028000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f60000_tgBNtoWqIp.jbxd

Similarity

API ID: Window$AttributesCompatibleCreateDeleteDestroyLayeredLongMessageMoveObjectPixelSelectSend
String ID: static
API String ID: 2559357485-2160076837
Opcode ID: ec7fc13b2f57708e9e746ee6155becfa3b5e593f90fad9bdd74902df736d21bd
Instruction ID: e018813141f3d93a9bc0d4d26d5ca1f89a034738f2a31a5203f5919a403ef43c
Opcode Fuzzy Hash: ec7fc13b2f57708e9e746ee6155becfa3b5e593f90fad9bdd74902df736d21bd
Instruction Fuzzy Hash: 9B31AF32505299BBDF11AF75DC48FDB3B69FF09320F110225FA55A60A0C735D815EBA4

Function 00F87040 Relevance: 16.8, APIs: 11, Instructions: 258COMMON

Download Yara Rule

APIs

_memset.LIBCMT ref: 00F8707B

Part of subcall function 00F88D68: __getptd_noexit.LIBCMT ref: 00F88D68

__gmtime64_s.LIBCMT ref: 00F87114
__gmtime64_s.LIBCMT ref: 00F8714A
__gmtime64_s.LIBCMT ref: 00F87167
__allrem.LIBCMT ref: 00F871BD
__ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z.LIBCMT ref: 00F871D9
__allrem.LIBCMT ref: 00F871F0
__ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z.LIBCMT ref: 00F8720E
__allrem.LIBCMT ref: 00F87225
__ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z.LIBCMT ref: 00F87243
__invoke_watson.LIBCMT ref: 00F872B4

Memory Dump Source

Source File: 00000000.00000002.1667912702.0000000000F61000.00000020.00000001.01000000.00000003.sdmp, Offset: 00F60000, based on PE: true

Associated: 00000000.00000002.1667891216.0000000000F60000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667966851.0000000000FEF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667966851.0000000001015000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1668035777.000000000101F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1668053678.0000000001028000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f60000_tgBNtoWqIp.jbxd

Similarity

API ID: Unothrow_t@std@@@__allrem__ehfuncinfo$??2@__gmtime64_s$__getptd_noexit__invoke_watson_memset
String ID:
API String ID: 384356119-0
Opcode ID: 85949ae18b549cd2d12431497598bef6b028e5a4746e3945652a320069ef6a5a
Instruction ID: 0246a8cdedce7605c184e639ff3f1dffe5b0171853f0a63f32106dfd7bb660ab
Opcode Fuzzy Hash: 85949ae18b549cd2d12431497598bef6b028e5a4746e3945652a320069ef6a5a
Instruction Fuzzy Hash: 7E71DB71E04B16ABEB14FE79CC81BDBB3A4AF11374F24422AF514D7681E774E940AB90

Function 00FC2A16 Relevance: 16.7, APIs: 11, Instructions: 190windowsleepCOMMON

Download Yara Rule

APIs

_memset.LIBCMT ref: 00FC2A31
GetMenuItemInfoW.USER32(01026890,000000FF,00000000,00000030), ref: 00FC2A92
SetMenuItemInfoW.USER32(01026890,00000004,00000000,00000030), ref: 00FC2AC8
Sleep.KERNEL32(000001F4), ref: 00FC2ADA
GetMenuItemCount.USER32(?), ref: 00FC2B1E
GetMenuItemID.USER32(?,00000000), ref: 00FC2B3A
GetMenuItemID.USER32(?,-00000001), ref: 00FC2B64
GetMenuItemID.USER32(?,?), ref: 00FC2BA9
CheckMenuRadioItem.USER32(?,00000000,?,00000000,00000400), ref: 00FC2BEF
GetMenuItemInfoW.USER32(?,000000FF,00000000,00000030), ref: 00FC2C03
SetMenuItemInfoW.USER32(?,000000FF,00000000,00000030), ref: 00FC2C24

Memory Dump Source

Source File: 00000000.00000002.1667912702.0000000000F61000.00000020.00000001.01000000.00000003.sdmp, Offset: 00F60000, based on PE: true

Associated: 00000000.00000002.1667891216.0000000000F60000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667966851.0000000000FEF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667966851.0000000001015000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1668035777.000000000101F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1668053678.0000000001028000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f60000_tgBNtoWqIp.jbxd

Similarity

API ID: ItemMenu$Info$CheckCountRadioSleep_memset
String ID:
API String ID: 4176008265-0
Opcode ID: a80823a27a7a79212c7a9daa4cd9cf8df4a4b6baec73ce47302f35bf1740451a
Instruction ID: 9c85fbed415da6223b84a7670d60430be1a18ae72249731e2d2c0a96ae51e903
Opcode Fuzzy Hash: a80823a27a7a79212c7a9daa4cd9cf8df4a4b6baec73ce47302f35bf1740451a
Instruction Fuzzy Hash: 1461A0B190034AAFDB61CF64CE8AFBE7BB8EB81324F14045DE84197251D735AD09EB21

Function 00FE7192 Relevance: 16.7, APIs: 11, Instructions: 184windowCOMMON

Download Yara Rule

APIs

SendMessageW.USER32(?,0000101F,00000000,00000000), ref: 00FE7214
SendMessageW.USER32(00000000,?,0000101F,00000000), ref: 00FE7217
GetWindowLongW.USER32(?,000000F0), ref: 00FE723B
_memset.LIBCMT ref: 00FE724C
SendMessageW.USER32(?,00001004,00000000,00000000), ref: 00FE725E
SendMessageW.USER32(?,0000104D,00000000,00000007), ref: 00FE72D6

Memory Dump Source

Source File: 00000000.00000002.1667912702.0000000000F61000.00000020.00000001.01000000.00000003.sdmp, Offset: 00F60000, based on PE: true

Associated: 00000000.00000002.1667891216.0000000000F60000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667966851.0000000000FEF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667966851.0000000001015000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1668035777.000000000101F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1668053678.0000000001028000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f60000_tgBNtoWqIp.jbxd

Similarity

API ID: MessageSend$LongWindow_memset
String ID:
API String ID: 830647256-0
Opcode ID: 607c219a9cd6dfdd928388be062a316f8d39e9f823a5cb03390f3eb237770d94
Instruction ID: 3ed85c4557052d90760444524ab98de0ad514ca68fc7d64075df9c6d815fa973
Opcode Fuzzy Hash: 607c219a9cd6dfdd928388be062a316f8d39e9f823a5cb03390f3eb237770d94
Instruction Fuzzy Hash: 11615A75900388AFDB20DFA4CC81EEE77B8EB09710F140159FE54A72A1D775AD45EB60

Function 00FB710E Relevance: 16.6, APIs: 11, Instructions: 123memoryCOMMON

Download Yara Rule

APIs

SafeArrayAllocDescriptorEx.OLEAUT32(0000000C,?,?), ref: 00FB7135
SafeArrayAllocData.OLEAUT32(?), ref: 00FB718E
VariantInit.OLEAUT32(?), ref: 00FB71A0
SafeArrayAccessData.OLEAUT32(?,?), ref: 00FB71C0
VariantCopy.OLEAUT32(?,?), ref: 00FB7213
SafeArrayUnaccessData.OLEAUT32(?), ref: 00FB7227
VariantClear.OLEAUT32(?), ref: 00FB723C
SafeArrayDestroyData.OLEAUT32(?), ref: 00FB7249
SafeArrayDestroyDescriptor.OLEAUT32(?), ref: 00FB7252
VariantClear.OLEAUT32(?), ref: 00FB7264
SafeArrayDestroyDescriptor.OLEAUT32(?), ref: 00FB726F

Memory Dump Source

Source File: 00000000.00000002.1667912702.0000000000F61000.00000020.00000001.01000000.00000003.sdmp, Offset: 00F60000, based on PE: true

Associated: 00000000.00000002.1667891216.0000000000F60000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667966851.0000000000FEF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667966851.0000000001015000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1668035777.000000000101F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1668053678.0000000001028000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f60000_tgBNtoWqIp.jbxd

Similarity

API ID: ArraySafe$DataVariant$DescriptorDestroy$AllocClear$AccessCopyInitUnaccess
String ID:
API String ID: 2706829360-0
Opcode ID: da83c80546c85acf0fb982d0604251c7097f0aa645097a3da2b5824561bb9058
Instruction ID: 8455b7413a83f7e84ace62b6a460460cd3ae9b8a4a41886f2635e80078ff6b0e
Opcode Fuzzy Hash: da83c80546c85acf0fb982d0604251c7097f0aa645097a3da2b5824561bb9058
Instruction Fuzzy Hash: AA4130359042199FCB00EFA5DC84DEEBBB9EF48354F008069F915EB2A1CB35A945EF90

Function 00FD5A45 Relevance: 15.9, APIs: 8, Strings: 1, Instructions: 163networkfileCOMMON

Download Yara Rule

APIs

WSAStartup.WSOCK32(00000101,?), ref: 00FD5AA6
inet_addr.WSOCK32(?,?,?), ref: 00FD5AEB
gethostbyname.WSOCK32(?), ref: 00FD5AF7
IcmpCreateFile.IPHLPAPI ref: 00FD5B05
IcmpSendEcho.IPHLPAPI(?,?,?,00000005,00000000,?,00000029,00000FA0), ref: 00FD5B75
IcmpSendEcho.IPHLPAPI(00000000,00000000,?,00000005,00000000,?,00000029,00000FA0), ref: 00FD5B8B
IcmpCloseHandle.IPHLPAPI(00000000), ref: 00FD5C00
WSACleanup.WSOCK32 ref: 00FD5C06

Strings

Ping, xrefs: 00FD5B29

Memory Dump Source

Source File: 00000000.00000002.1667912702.0000000000F61000.00000020.00000001.01000000.00000003.sdmp, Offset: 00F60000, based on PE: true

Associated: 00000000.00000002.1667891216.0000000000F60000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667966851.0000000000FEF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667966851.0000000001015000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1668035777.000000000101F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1668053678.0000000001028000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f60000_tgBNtoWqIp.jbxd

Similarity

API ID: Icmp$EchoSend$CleanupCloseCreateFileHandleStartupgethostbynameinet_addr
String ID: Ping
API String ID: 1028309954-2246546115
Opcode ID: e25aa2308a63db88b63d1315012cc1c5383bf1092791233d0f16843fce4b634c
Instruction ID: bfbb7110b468b462e4019ee8f5edbe5e73152e96e2116958a12d61df78e2feb5
Opcode Fuzzy Hash: e25aa2308a63db88b63d1315012cc1c5383bf1092791233d0f16843fce4b634c
Instruction Fuzzy Hash: 6C5182316047019FDB10AF24CC85B2AB7E5EF84B20F18892BF556DB3A1DB78E944EB45

Function 00FCB72E Relevance: 15.8, APIs: 4, Strings: 5, Instructions: 98COMMON

Download Yara Rule

APIs

SetErrorMode.KERNEL32(00000001), ref: 00FCB73B
GetDiskFreeSpaceW.KERNEL32(?,?,?,?,?,00000002,00000001), ref: 00FCB7B1
GetLastError.KERNEL32 ref: 00FCB7BB
SetErrorMode.KERNEL32(00000000,READY), ref: 00FCB828

Strings

NOTREADY, xrefs: 00FCB7E7
READONLY, xrefs: 00FCB7F3
READY, xrefs: 00FCB801
UNKNOWN, xrefs: 00FCB7E0
INVALID, xrefs: 00FCB7FA

Memory Dump Source

Source File: 00000000.00000002.1667912702.0000000000F61000.00000020.00000001.01000000.00000003.sdmp, Offset: 00F60000, based on PE: true

Associated: 00000000.00000002.1667891216.0000000000F60000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667966851.0000000000FEF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667966851.0000000001015000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1668035777.000000000101F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1668053678.0000000001028000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f60000_tgBNtoWqIp.jbxd

Similarity

API ID: Error$Mode$DiskFreeLastSpace
String ID: INVALID$NOTREADY$READONLY$READY$UNKNOWN
API String ID: 4194297153-14809454
Opcode ID: 9d0ecd3306ef5215eb9c8c986a28cd7577056312de97bac91dacb969e7957426
Instruction ID: 8f72cf6483174e69936c072e8a2437cdff4d747c3763da5d3f8b39b7f0cb8ef1
Opcode Fuzzy Hash: 9d0ecd3306ef5215eb9c8c986a28cd7577056312de97bac91dacb969e7957426
Instruction Fuzzy Hash: 9C318339A0020A9FDB00EF64CD87FAE7BB8EF84710F14402DE901DB291DB799946E750

Function 00FB9471 Relevance: 15.8, APIs: 7, Strings: 2, Instructions: 82windowCOMMON

Download Yara Rule

APIs

Part of subcall function 00F67F41: _memmove.LIBCMT ref: 00F67F82

Part of subcall function 00FBB0C4: GetClassNameW.USER32(?,?,000000FF), ref: 00FBB0E7

SendMessageW.USER32(?,0000018C,000000FF,00000002), ref: 00FB94F6
GetDlgCtrlID.USER32 ref: 00FB9501
GetParent.USER32 ref: 00FB951D
SendMessageW.USER32(00000000,?,00000111,?), ref: 00FB9520
GetDlgCtrlID.USER32(?), ref: 00FB9529
GetParent.USER32(?), ref: 00FB9545
SendMessageW.USER32(00000000,?,?,00000111), ref: 00FB9548

Strings

ListBox, xrefs: 00FB94B3
ComboBox, xrefs: 00FB947E

Memory Dump Source

Source File: 00000000.00000002.1667912702.0000000000F61000.00000020.00000001.01000000.00000003.sdmp, Offset: 00F60000, based on PE: true

Associated: 00000000.00000002.1667891216.0000000000F60000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667966851.0000000000FEF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667966851.0000000001015000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1668035777.000000000101F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1668053678.0000000001028000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f60000_tgBNtoWqIp.jbxd

Similarity

API ID: MessageSend$CtrlParent$ClassName_memmove
String ID: ComboBox$ListBox
API String ID: 1536045017-1403004172
Opcode ID: 34474603d75497c18ed477f81ffb6de341ff2a84e7855520a8934f9ce0dd9cf8
Instruction ID: 94af3c40f26ecfe19a975c7e920455d927a2a568238397769701bec1029053ec
Opcode Fuzzy Hash: 34474603d75497c18ed477f81ffb6de341ff2a84e7855520a8934f9ce0dd9cf8
Instruction Fuzzy Hash: 2821D674D04248BBCF04ABA5CCD5EFEBBB4EF45310F104119B661972A2DB799919EF20

Function 00FB955C Relevance: 15.8, APIs: 7, Strings: 2, Instructions: 81windowCOMMON

Download Yara Rule

APIs

Part of subcall function 00F67F41: _memmove.LIBCMT ref: 00F67F82

Part of subcall function 00FBB0C4: GetClassNameW.USER32(?,?,000000FF), ref: 00FBB0E7

SendMessageW.USER32(?,00000186,00000002,00000000), ref: 00FB95DF
GetDlgCtrlID.USER32 ref: 00FB95EA
GetParent.USER32 ref: 00FB9606
SendMessageW.USER32(00000000,?,00000111,?), ref: 00FB9609
GetDlgCtrlID.USER32(?), ref: 00FB9612
GetParent.USER32(?), ref: 00FB962E
SendMessageW.USER32(00000000,?,?,00000111), ref: 00FB9631

Strings

ListBox, xrefs: 00FB959E
ComboBox, xrefs: 00FB9569

Memory Dump Source

Source File: 00000000.00000002.1667912702.0000000000F61000.00000020.00000001.01000000.00000003.sdmp, Offset: 00F60000, based on PE: true

Associated: 00000000.00000002.1667891216.0000000000F60000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667966851.0000000000FEF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667966851.0000000001015000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1668035777.000000000101F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1668053678.0000000001028000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f60000_tgBNtoWqIp.jbxd

Similarity

API ID: MessageSend$CtrlParent$ClassName_memmove
String ID: ComboBox$ListBox
API String ID: 1536045017-1403004172
Opcode ID: 8347b78a33f41dcd22b35d6d7ec86ccf842d8f690a1f0d55f4700f0614b342c9
Instruction ID: a0b399542d0fe34ff227c3113fba4f9d48a63b1bead242a2a1ba295440fedd55
Opcode Fuzzy Hash: 8347b78a33f41dcd22b35d6d7ec86ccf842d8f690a1f0d55f4700f0614b342c9
Instruction Fuzzy Hash: 3021D671904248BBDF00ABA5CCD5EFEBB75EF44300F104019B551971A5DB795919AF20

Function 00FB9645 Relevance: 15.8, APIs: 4, Strings: 5, Instructions: 72windowCOMMON

Download Yara Rule

APIs

GetParent.USER32 ref: 00FB9651
GetClassNameW.USER32(00000000,?,00000100), ref: 00FB9666
_wcscmp.LIBCMT ref: 00FB9678
SendMessageW.USER32(00000000,00000111,0000702B,00000000), ref: 00FB96F3

Strings

smallicons, xrefs: 00FB96BB
largeicons, xrefs: 00FB9687
details, xrefs: 00FB96A1
list, xrefs: 00FB96D5
SHELLDLL_DefView, xrefs: 00FB9672

Memory Dump Source

Source File: 00000000.00000002.1667912702.0000000000F61000.00000020.00000001.01000000.00000003.sdmp, Offset: 00F60000, based on PE: true

Associated: 00000000.00000002.1667891216.0000000000F60000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667966851.0000000000FEF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667966851.0000000001015000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1668035777.000000000101F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1668053678.0000000001028000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f60000_tgBNtoWqIp.jbxd

Similarity

API ID: ClassMessageNameParentSend_wcscmp
String ID: SHELLDLL_DefView$details$largeicons$list$smallicons
API String ID: 1704125052-3381328864
Opcode ID: e0d523494957960bdfded5b1254e8f1d1c3adcccfdb407eec53eeb6b8682a1bf
Instruction ID: fa64997b3150278e584f96c1af5f4a38f922048c1986652d1e34e7f65001582e
Opcode Fuzzy Hash: e0d523494957960bdfded5b1254e8f1d1c3adcccfdb407eec53eeb6b8682a1bf
Instruction Fuzzy Hash: 31110A7764C747BAFB002622DC1BEE6779D8B05B74B20002AFA04A90A1FEE959107F58

Function 00FD8BC0 Relevance: 15.3, APIs: 10, Instructions: 324fileCOMMON

Download Yara Rule

APIs

VariantInit.OLEAUT32(?), ref: 00FD8BEC
CoInitialize.OLE32(00000000), ref: 00FD8C19
CoUninitialize.OLE32 ref: 00FD8C23
GetRunningObjectTable.OLE32(00000000,?), ref: 00FD8D23
SetErrorMode.KERNEL32(00000001,00000029), ref: 00FD8E50
CoGetInstanceFromFile.OLE32(00000000,?,00000000,00000015,00000002,?,00000001,00FF2C0C), ref: 00FD8E84
CoGetObject.OLE32(?,00000000,00FF2C0C,?), ref: 00FD8EA7
SetErrorMode.KERNEL32(00000000), ref: 00FD8EBA
SetErrorMode.KERNEL32(00000000,00000000,00000000,00000000,00000000), ref: 00FD8F3A
VariantClear.OLEAUT32(?), ref: 00FD8F4A

Memory Dump Source

Source File: 00000000.00000002.1667912702.0000000000F61000.00000020.00000001.01000000.00000003.sdmp, Offset: 00F60000, based on PE: true

Associated: 00000000.00000002.1667891216.0000000000F60000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667966851.0000000000FEF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667966851.0000000001015000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1668035777.000000000101F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1668053678.0000000001028000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f60000_tgBNtoWqIp.jbxd

Similarity

API ID: ErrorMode$ObjectVariant$ClearFileFromInitInitializeInstanceRunningTableUninitialize
String ID:
API String ID: 2395222682-0
Opcode ID: 13f60bd6c01160cb0c64b0f396bb8e83c1cc78242f5c621efe878bd710e4b7b3
Instruction ID: e9fe663a08a71fae8871b07997f7daff29b01ec10187bf92ccbc25a5d03c07b2
Opcode Fuzzy Hash: 13f60bd6c01160cb0c64b0f396bb8e83c1cc78242f5c621efe878bd710e4b7b3
Instruction Fuzzy Hash: BDC12671608305AFC700EF64C88492AB7EAFF88758F04496EF5899B391DB71ED06DB52

Function 00FC4189 Relevance: 15.1, APIs: 10, Instructions: 108windowCOMMON

Download Yara Rule

APIs

__swprintf.LIBCMT ref: 00FC419D
__swprintf.LIBCMT ref: 00FC41AA

Part of subcall function 00F838D8: __woutput_l.LIBCMT ref: 00F83931

FindResourceW.KERNEL32(?,?,0000000E), ref: 00FC41D4
LoadResource.KERNEL32(?,00000000), ref: 00FC41E0
LockResource.KERNEL32(00000000), ref: 00FC41ED
FindResourceW.KERNEL32(?,?,00000003), ref: 00FC420D
LoadResource.KERNEL32(?,00000000), ref: 00FC421F
SizeofResource.KERNEL32(?,00000000), ref: 00FC422E
LockResource.KERNEL32(?), ref: 00FC423A
CreateIconFromResourceEx.USER32(?,?,00000001,00030000,00000000,00000000,00000000), ref: 00FC429B

Memory Dump Source

Source File: 00000000.00000002.1667912702.0000000000F61000.00000020.00000001.01000000.00000003.sdmp, Offset: 00F60000, based on PE: true

Associated: 00000000.00000002.1667891216.0000000000F60000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667966851.0000000000FEF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667966851.0000000001015000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1668035777.000000000101F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1668053678.0000000001028000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f60000_tgBNtoWqIp.jbxd

Similarity

API ID: Resource$FindLoadLock__swprintf$CreateFromIconSizeof__woutput_l
String ID:
API String ID: 1433390588-0
Opcode ID: b8a4e88e04b431a520b0fa9c5173c17578139bb86fe0e35c50eba024706c3a4c
Instruction ID: 21619b838cd80db0007b7574d659273f0b13f9054b6369d69850eb2820e11073
Opcode Fuzzy Hash: b8a4e88e04b431a520b0fa9c5173c17578139bb86fe0e35c50eba024706c3a4c
Instruction Fuzzy Hash: AF31BD72A0125BABCB119F60DD9AFFF7BA8EF08301F044429F901D6150D774EA11ABA0

Function 00FC16DE Relevance: 15.1, APIs: 10, Instructions: 89threadCOMMON

Download Yara Rule

APIs

GetCurrentThreadId.KERNEL32 ref: 00FC1700
GetForegroundWindow.USER32(00000000,?,?,?,?,?,00FC0778,?,00000001), ref: 00FC1714
GetWindowThreadProcessId.USER32(00000000), ref: 00FC171B
AttachThreadInput.USER32(00000000,00000000,00000001,?,?,?,?,?,00FC0778,?,00000001), ref: 00FC172A
GetWindowThreadProcessId.USER32(?,00000000), ref: 00FC173C
AttachThreadInput.USER32(00000000,00000000,00000001,?,?,?,?,?,00FC0778,?,00000001), ref: 00FC1755
AttachThreadInput.USER32(00000000,00000000,00000001,?,?,?,?,?,00FC0778,?,00000001), ref: 00FC1767
AttachThreadInput.USER32(00000000,00000000,?,?,?,?,?,00FC0778,?,00000001), ref: 00FC17AC
AttachThreadInput.USER32(00000000,00000000,00000000,?,?,?,?,?,00FC0778,?,00000001), ref: 00FC17C1
AttachThreadInput.USER32(00000000,00000000,00000000,?,?,?,?,?,00FC0778,?,00000001), ref: 00FC17CC

Memory Dump Source

Source File: 00000000.00000002.1667912702.0000000000F61000.00000020.00000001.01000000.00000003.sdmp, Offset: 00F60000, based on PE: true

Associated: 00000000.00000002.1667891216.0000000000F60000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667966851.0000000000FEF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667966851.0000000001015000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1668035777.000000000101F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1668053678.0000000001028000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f60000_tgBNtoWqIp.jbxd

Similarity

API ID: Thread$AttachInput$Window$Process$CurrentForeground
String ID:
API String ID: 2156557900-0
Opcode ID: 25d8df7ea8ae8762a4d3f1a01d07b70fdd633f665082f90697555ea77e2b20f5
Instruction ID: a9a82ce63a89e6927b24da680eab8b372bb068ea5e936e752cc2f66cc8f19b57
Opcode Fuzzy Hash: 25d8df7ea8ae8762a4d3f1a01d07b70fdd633f665082f90697555ea77e2b20f5
Instruction Fuzzy Hash: 2731E371A00209BBDB319F10DE86F7937E9FF66721F204018F800CA296D7799D44AF50

Function 00F6FBBD Relevance: 14.3, APIs: 7, Strings: 1, Instructions: 264comCOMMON

Download Yara Rule

APIs

mciSendStringW.WINMM(close all,00000000,00000000,00000000), ref: 00F6FC06
OleUninitialize.OLE32(?,00000000), ref: 00F6FCA5
UnregisterHotKey.USER32(?), ref: 00F6FDFC
DestroyWindow.USER32(?), ref: 00FA4A00
FreeLibrary.KERNEL32(?), ref: 00FA4A65
VirtualFree.KERNEL32(?,00000000,00008000), ref: 00FA4A92

Strings

close all, xrefs: 00F6FC01

Memory Dump Source

Source File: 00000000.00000002.1667912702.0000000000F61000.00000020.00000001.01000000.00000003.sdmp, Offset: 00F60000, based on PE: true

Associated: 00000000.00000002.1667891216.0000000000F60000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667966851.0000000000FEF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667966851.0000000001015000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1668035777.000000000101F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1668053678.0000000001028000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f60000_tgBNtoWqIp.jbxd

Similarity

API ID: Free$DestroyLibrarySendStringUninitializeUnregisterVirtualWindow
String ID: close all
API String ID: 469580280-3243417748
Opcode ID: 4fd21244db54ba8c9cdceddfd97145d42f96239502ffd399170ebe1da2b166c0
Instruction ID: 0617075690cb139cda0af40a74f43a61cd2b0ac9af52a42493997e1ef5a43fd5
Opcode Fuzzy Hash: 4fd21244db54ba8c9cdceddfd97145d42f96239502ffd399170ebe1da2b166c0
Instruction Fuzzy Hash: 40A1AE71B01212CFCB28EF14D995B69F364BF45710F1442ADE80AAB262CB74ED1AEF54

Function 00FBA693 Relevance: 14.2, APIs: 2, Strings: 6, Instructions: 241COMMON

Download Yara Rule

APIs

EnumChildWindows.USER32(?,00FBAA64), ref: 00FBA9A2

Strings

CLASS, xrefs: 00FBA721
REGEXPCLASS, xrefs: 00FBA767
CLASSNN, xrefs: 00FBA744
TEXT, xrefs: 00FBA8D9
NAME, xrefs: 00FBA7D4
INSTANCE, xrefs: 00FBA8B0

Memory Dump Source

Source File: 00000000.00000002.1667912702.0000000000F61000.00000020.00000001.01000000.00000003.sdmp, Offset: 00F60000, based on PE: true

Associated: 00000000.00000002.1667891216.0000000000F60000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667966851.0000000000FEF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667966851.0000000001015000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1668035777.000000000101F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1668053678.0000000001028000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f60000_tgBNtoWqIp.jbxd

Similarity

API ID: ChildEnumWindows
String ID: CLASS$CLASSNN$INSTANCE$NAME$REGEXPCLASS$TEXT
API String ID: 3555792229-1603158881
Opcode ID: d04487c214a56a17540d48c38ce55a6adfac94b768a1b72a2e71cb7d872cae77
Instruction ID: 9120244160d617bad4447fb64800ccb614cd595b1cccd5523c814feb3e398e9c
Opcode Fuzzy Hash: d04487c214a56a17540d48c38ce55a6adfac94b768a1b72a2e71cb7d872cae77
Instruction Fuzzy Hash: C891B431A00206EBDB18EF61C881BEDFB75BF04314F508119D89AA7151DF34AA5AFFA1

Function 00F62E26 Relevance: 14.2, APIs: 7, Strings: 1, Instructions: 186windowCOMMON

Download Yara Rule

APIs

SetWindowLongW.USER32(?,000000EB), ref: 00F62EAE

Part of subcall function 00F61DB3: GetClientRect.USER32(?,?), ref: 00F61DDC
Part of subcall function 00F61DB3: GetWindowRect.USER32(?,?), ref: 00F61E1D
Part of subcall function 00F61DB3: ScreenToClient.USER32(?,?), ref: 00F61E45

GetDC.USER32 ref: 00F9CF82
SendMessageW.USER32(?,00000031,00000000,00000000), ref: 00F9CF95
SelectObject.GDI32(00000000,00000000), ref: 00F9CFA3
SelectObject.GDI32(00000000,00000000), ref: 00F9CFB8
ReleaseDC.USER32(?,00000000), ref: 00F9CFC0
MoveWindow.USER32(?,?,?,?,?,?,?,00000031,00000000,00000000), ref: 00F9D04B

Strings

U, xrefs: 00F9CF20

Memory Dump Source

Source File: 00000000.00000002.1667912702.0000000000F61000.00000020.00000001.01000000.00000003.sdmp, Offset: 00F60000, based on PE: true

Associated: 00000000.00000002.1667891216.0000000000F60000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667966851.0000000000FEF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667966851.0000000001015000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1668035777.000000000101F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1668053678.0000000001028000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f60000_tgBNtoWqIp.jbxd

Similarity

API ID: Window$ClientObjectRectSelect$LongMessageMoveReleaseScreenSend
String ID: U
API String ID: 4009187628-3372436214
Opcode ID: bc526e69d8d290ab68ca93e8cc25b5c86c8dd99bda163f37b55980a617113648
Instruction ID: a90e452a53b25f9c614c31a54e754fb7c90fb2868144db84c7ccdebbf3774e51
Opcode Fuzzy Hash: bc526e69d8d290ab68ca93e8cc25b5c86c8dd99bda163f37b55980a617113648
Instruction Fuzzy Hash: B771B631900205DFDF21CF64CC84AAA7BB6FF59364F24426AED555A1AAC7368C41FB60

Function 00FEC27C Relevance: 14.1, APIs: 6, Strings: 2, Instructions: 149windowCOMMON

Download Yara Rule

APIs

Part of subcall function 00F62612: GetWindowLongW.USER32(?,000000EB), ref: 00F62623

Part of subcall function 00F62344: GetCursorPos.USER32(?), ref: 00F62357
Part of subcall function 00F62344: ScreenToClient.USER32(010267B0,?), ref: 00F62374
Part of subcall function 00F62344: GetAsyncKeyState.USER32(00000001), ref: 00F62399
Part of subcall function 00F62344: GetAsyncKeyState.USER32(00000002), ref: 00F623A7

ImageList_DragLeave.COMCTL32(00000000,00000000,00000001,?,?), ref: 00FEC2E4
ImageList_EndDrag.COMCTL32 ref: 00FEC2EA
ReleaseCapture.USER32 ref: 00FEC2F0
SetWindowTextW.USER32(?,00000000), ref: 00FEC39A
SendMessageW.USER32(?,000000B1,00000000,000000FF), ref: 00FEC3AD
DefDlgProcW.USER32(?,00000202,?,?,00000000,00000001,?,?), ref: 00FEC48F

Strings

@GUI_DROPID, xrefs: 00FEC3E1
@GUI_DRAGFILE, xrefs: 00FEC424

Memory Dump Source

Source File: 00000000.00000002.1667912702.0000000000F61000.00000020.00000001.01000000.00000003.sdmp, Offset: 00F60000, based on PE: true

Associated: 00000000.00000002.1667891216.0000000000F60000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667966851.0000000000FEF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667966851.0000000001015000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1668035777.000000000101F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1668053678.0000000001028000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f60000_tgBNtoWqIp.jbxd

Similarity

API ID: AsyncDragImageList_StateWindow$CaptureClientCursorLeaveLongMessageProcReleaseScreenSendText
String ID: @GUI_DRAGFILE$@GUI_DROPID
API String ID: 1924731296-2107944366
Opcode ID: 2b93e8ad1921fcff179d339f182e7362b46c79784963cbd6d4a9afa19797ee65
Instruction ID: 2abe9d0eaf1599b04551f80efefc3cd702c6043730377008d55f2492d0ae7608
Opcode Fuzzy Hash: 2b93e8ad1921fcff179d339f182e7362b46c79784963cbd6d4a9afa19797ee65
Instruction Fuzzy Hash: D951D270204384AFD710EF25CC95F6A7BE4FB88310F10461DF9958B2E1CB79A949EB52

Function 00FD8F5B Relevance: 13.9, APIs: 9, Instructions: 438COMMON

Download Yara Rule

APIs

GetModuleFileNameW.KERNEL32(?,?,00000104,?,00FEF910), ref: 00FD903D
FreeLibrary.KERNEL32(00000000,00000001,00000000,?,00FEF910), ref: 00FD9071
QueryPathOfRegTypeLib.OLEAUT32(?,?,?,?,?), ref: 00FD91EB
SysFreeString.OLEAUT32(?), ref: 00FD9215

Memory Dump Source

Source File: 00000000.00000002.1667912702.0000000000F61000.00000020.00000001.01000000.00000003.sdmp, Offset: 00F60000, based on PE: true

Associated: 00000000.00000002.1667891216.0000000000F60000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667966851.0000000000FEF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667966851.0000000001015000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1668035777.000000000101F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1668053678.0000000001028000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f60000_tgBNtoWqIp.jbxd

Similarity

API ID: Free$FileLibraryModuleNamePathQueryStringType
String ID:
API String ID: 560350794-0
Opcode ID: 168025adba5079adf04a41c78c18218127b53959f88e3de6673f061f3d9120f2
Instruction ID: 830cb78404c04cf16eebdd6ba17b6d6433c556883304fed6e9c7c51f184dacee
Opcode Fuzzy Hash: 168025adba5079adf04a41c78c18218127b53959f88e3de6673f061f3d9120f2
Instruction Fuzzy Hash: 71F15E71A04109EFDF04DF94C888EAEB7BAFF89314F14815AF515AB290CB71AE46DB50

Function 00FDF9A8 Relevance: 13.9, APIs: 9, Instructions: 386processCOMMON

Download Yara Rule

APIs

_memset.LIBCMT ref: 00FDF9C9
GetSystemDirectoryW.KERNEL32(00000000,00000000), ref: 00FDFB5C
GetSystemDirectoryW.KERNEL32(00000000,00000000), ref: 00FDFB80
GetCurrentDirectoryW.KERNEL32(00000000,00000000), ref: 00FDFBC0
GetCurrentDirectoryW.KERNEL32(00000000,00000000), ref: 00FDFBE2
CreateProcessW.KERNEL32(00000000,?,00000000,00000000,?,?,00000000,?,?,?), ref: 00FDFD5E
GetLastError.KERNEL32(00000000,00000001,00000000), ref: 00FDFD90
CloseHandle.KERNEL32(?), ref: 00FDFDBF
CloseHandle.KERNEL32(?), ref: 00FDFE36

Memory Dump Source

Source File: 00000000.00000002.1667912702.0000000000F61000.00000020.00000001.01000000.00000003.sdmp, Offset: 00F60000, based on PE: true

Associated: 00000000.00000002.1667891216.0000000000F60000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667966851.0000000000FEF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667966851.0000000001015000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1668035777.000000000101F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1668053678.0000000001028000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f60000_tgBNtoWqIp.jbxd

Similarity

API ID: Directory$CloseCurrentHandleSystem$CreateErrorLastProcess_memset
String ID:
API String ID: 4090791747-0
Opcode ID: eddb3679959f9d5c7fa6a12607a4cbcac0060599c77fca64fd2a07985cbc37bd
Instruction ID: 8baf8dca0eb9f27b85dfa31183cf1a7358644d66175354bf34615ba46e4f9d6c
Opcode Fuzzy Hash: eddb3679959f9d5c7fa6a12607a4cbcac0060599c77fca64fd2a07985cbc37bd
Instruction Fuzzy Hash: 81E1A3315043419FC714EF24C891F6ABBE5AF84310F18856EF89A8B3A2DB35DD49EB52

Function 00FC4F63 Relevance: 13.7, APIs: 9, Instructions: 170filestringCOMMON

Download Yara Rule

APIs

Part of subcall function 00FC48AA: GetFullPathNameW.KERNEL32(00000000,00007FFF,?,?,?,?,?,?,00FC38D3,?), ref: 00FC48C7

Part of subcall function 00FC48AA: GetFullPathNameW.KERNEL32(?,00007FFF,?,?,?,?,?,00FC38D3,?), ref: 00FC48E0

Part of subcall function 00FC4CD3: GetFileAttributesW.KERNEL32(?,00FC3947), ref: 00FC4CD4

lstrcmpiW.KERNEL32(?,?), ref: 00FC4FE2
_wcscmp.LIBCMT ref: 00FC4FFC
MoveFileW.KERNEL32(?,?), ref: 00FC5017

Memory Dump Source

Source File: 00000000.00000002.1667912702.0000000000F61000.00000020.00000001.01000000.00000003.sdmp, Offset: 00F60000, based on PE: true

Associated: 00000000.00000002.1667891216.0000000000F60000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667966851.0000000000FEF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667966851.0000000001015000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1668035777.000000000101F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1668053678.0000000001028000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f60000_tgBNtoWqIp.jbxd

Similarity

API ID: FileFullNamePath$AttributesMove_wcscmplstrcmpi
String ID:
API String ID: 793581249-0
Opcode ID: 38e10c4f9de1b2686901f868af17edd9e5d61778ad762f519c120a19b539679d
Instruction ID: 78e25df2be4e4eca96a914b2d59f39d2e9488ce93656932e49d8bc12f762f9c4
Opcode Fuzzy Hash: 38e10c4f9de1b2686901f868af17edd9e5d61778ad762f519c120a19b539679d
Instruction Fuzzy Hash: 0A5173B24087859BC724EB50DD92EDFB3ECAF84710F10492EB189D7151EE78B288D766

Function 00FE88B4 Relevance: 13.7, APIs: 9, Instructions: 168COMMON

Download Yara Rule

APIs

InvalidateRect.USER32(?,00000000,00000001,?,00000001), ref: 00FE896E

Memory Dump Source

Source File: 00000000.00000002.1667912702.0000000000F61000.00000020.00000001.01000000.00000003.sdmp, Offset: 00F60000, based on PE: true

Associated: 00000000.00000002.1667891216.0000000000F60000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667966851.0000000000FEF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667966851.0000000001015000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1668035777.000000000101F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1668053678.0000000001028000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f60000_tgBNtoWqIp.jbxd

Similarity

API ID: InvalidateRect
String ID:
API String ID: 634782764-0
Opcode ID: 1d662c213e54a3a6f4b284f89a7eff7dbbb5870ccd83c6ec83cc2462591e89d1
Instruction ID: baaf3f1d2192ce74f0c4fe65e710bf9c2552f99f56617ee93960da41d8792861
Opcode Fuzzy Hash: 1d662c213e54a3a6f4b284f89a7eff7dbbb5870ccd83c6ec83cc2462591e89d1
Instruction Fuzzy Hash: 7B51D8309002C8BFDF30AF26CC85B6D3B65BB057A0F604122F919E61E1DF75AA86B751

Function 00F62B72 Relevance: 13.7, APIs: 9, Instructions: 161windowCOMMON

Download Yara Rule

APIs

LoadImageW.USER32(00000000,?,00000001,00000010,00000010,00000010), ref: 00F9C547
ExtractIconExW.SHELL32(?,00000000,00000000,00000000,00000001), ref: 00F9C569
LoadImageW.USER32(00000000,?,00000001,00000000,00000000,00000050), ref: 00F9C581
ExtractIconExW.SHELL32(?,00000000,?,00000000,00000001), ref: 00F9C59F
SendMessageW.USER32(00000000,00000080,00000000,00000000), ref: 00F9C5C0
DestroyIcon.USER32(00000000), ref: 00F9C5CF
SendMessageW.USER32(00000000,00000080,00000001,00000000), ref: 00F9C5EC
DestroyIcon.USER32(?), ref: 00F9C5FB

Part of subcall function 00FEA71E: DeleteObject.GDI32(00000000), ref: 00FEA757

Memory Dump Source

Source File: 00000000.00000002.1667912702.0000000000F61000.00000020.00000001.01000000.00000003.sdmp, Offset: 00F60000, based on PE: true

Associated: 00000000.00000002.1667891216.0000000000F60000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667966851.0000000000FEF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667966851.0000000001015000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1668035777.000000000101F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1668053678.0000000001028000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f60000_tgBNtoWqIp.jbxd

Similarity

API ID: Icon$DestroyExtractImageLoadMessageSend$DeleteObject
String ID:
API String ID: 2819616528-0
Opcode ID: ff70006073da50db726960da60316c091d1171a36a8bd978430a34a1f9377780
Instruction ID: a78200f99f4c63d6de784ca176f9986b47981cbe6c9810c4fffe26c85dbae899
Opcode Fuzzy Hash: ff70006073da50db726960da60316c091d1171a36a8bd978430a34a1f9377780
Instruction Fuzzy Hash: 01515A71A00609AFEB24DF24CC85FAA37B5FB58760F104528F946A7290DB75ED90EB90

Function 00FB9B50 Relevance: 13.6, APIs: 9, Instructions: 66sleepkeyboardwindowCOMMON

Download Yara Rule

APIs

Part of subcall function 00FBAE57: GetWindowThreadProcessId.USER32(?,00000000), ref: 00FBAE77
Part of subcall function 00FBAE57: GetCurrentThreadId.KERNEL32 ref: 00FBAE7E
Part of subcall function 00FBAE57: AttachThreadInput.USER32(00000000,?,00FB9B65,?,00000001), ref: 00FBAE85

MapVirtualKeyW.USER32(00000025,00000000), ref: 00FB9B70
PostMessageW.USER32(?,00000100,00000025,00000000), ref: 00FB9B8D
Sleep.KERNEL32(00000000,?,00000100,00000025,00000000,?,00000001), ref: 00FB9B90
MapVirtualKeyW.USER32(00000025,00000000), ref: 00FB9B99
PostMessageW.USER32(?,00000100,00000027,00000000), ref: 00FB9BB7
Sleep.KERNEL32(00000000,?,00000100,00000027,00000000,?,00000001), ref: 00FB9BBA
MapVirtualKeyW.USER32(00000025,00000000), ref: 00FB9BC3
PostMessageW.USER32(?,00000101,00000027,00000000), ref: 00FB9BDA
Sleep.KERNEL32(00000000,?,00000100,00000027,00000000,?,00000001), ref: 00FB9BDD

Memory Dump Source

Source File: 00000000.00000002.1667912702.0000000000F61000.00000020.00000001.01000000.00000003.sdmp, Offset: 00F60000, based on PE: true

Associated: 00000000.00000002.1667891216.0000000000F60000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667966851.0000000000FEF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667966851.0000000001015000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1668035777.000000000101F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1668053678.0000000001028000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f60000_tgBNtoWqIp.jbxd

Similarity

API ID: MessagePostSleepThreadVirtual$AttachCurrentInputProcessWindow
String ID:
API String ID: 2014098862-0
Opcode ID: 69da8862cc409bccd2d4705cfc85092dc43084c31ceafdfe0a3338af1aea65d9
Instruction ID: c9a7c8b2202f023bb991ec57941a640605ad7bbd423132d2fb9bdde7e891c733
Opcode Fuzzy Hash: 69da8862cc409bccd2d4705cfc85092dc43084c31ceafdfe0a3338af1aea65d9
Instruction Fuzzy Hash: 1811E17155025CBFFA106B61DC89FAA3B2DEB4D751F100425F344AF0E1C9F25C10EAA4

Function 00FB8E03 Relevance: 13.5, APIs: 9, Instructions: 49memorythreadCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32(00000008,0000000C,00000000,00000000,?,00FB8A84,00000B00,?,?), ref: 00FB8E0C
HeapAlloc.KERNEL32(00000000,?,00FB8A84,00000B00,?,?), ref: 00FB8E13
GetCurrentProcess.KERNEL32(00000000,00000000,00000000,00000002,?,00FB8A84,00000B00,?,?), ref: 00FB8E28
GetCurrentProcess.KERNEL32(?,00000000,?,00FB8A84,00000B00,?,?), ref: 00FB8E30
DuplicateHandle.KERNEL32(00000000,?,00FB8A84,00000B00,?,?), ref: 00FB8E33
GetCurrentProcess.KERNEL32(00000008,00000000,00000000,00000002,?,00FB8A84,00000B00,?,?), ref: 00FB8E43
GetCurrentProcess.KERNEL32(00FB8A84,00000000,?,00FB8A84,00000B00,?,?), ref: 00FB8E4B
DuplicateHandle.KERNEL32(00000000,?,00FB8A84,00000B00,?,?), ref: 00FB8E4E
CreateThread.KERNEL32(00000000,00000000,00FB8E74,00000000,00000000,00000000), ref: 00FB8E68

Memory Dump Source

Source File: 00000000.00000002.1667912702.0000000000F61000.00000020.00000001.01000000.00000003.sdmp, Offset: 00F60000, based on PE: true

Associated: 00000000.00000002.1667891216.0000000000F60000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667966851.0000000000FEF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667966851.0000000001015000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1668035777.000000000101F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1668053678.0000000001028000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f60000_tgBNtoWqIp.jbxd

Similarity

API ID: Process$Current$DuplicateHandleHeap$AllocCreateThread
String ID:
API String ID: 1957940570-0
Opcode ID: c63b292f6a10905b3213d8c43be9627f4786e946e3265e065440ee3bebf9fcca
Instruction ID: 477c71e5a6b5baf4d9ea75af14371f90158db7f1f04f7f142461d2c1f57cc502
Opcode Fuzzy Hash: c63b292f6a10905b3213d8c43be9627f4786e946e3265e065440ee3bebf9fcca
Instruction Fuzzy Hash: D901A4B524034CFFE610ABA5DC89F6B3BACEB89711F018421FA05DF2A1CA749804DA20

Function 00FD9428 Relevance: 12.5, APIs: 5, Strings: 2, Instructions: 263COMMON

Download Yara Rule

APIs

_memset.LIBCMT ref: 00FD947C
VariantInit.OLEAUT32(?), ref: 00FD954D
VariantInit.OLEAUT32(?), ref: 00FD964E
VariantClear.OLEAUT32(?), ref: 00FD9658
VariantClear.OLEAUT32(?), ref: 00FD96B5

Strings

Incorrect Object type in FOR..IN loop, xrefs: 00FD9631
Null Object assignment in FOR..IN loop, xrefs: 00FD94DD, 00FD960B, 00FD96C3

Memory Dump Source

Source File: 00000000.00000002.1667912702.0000000000F61000.00000020.00000001.01000000.00000003.sdmp, Offset: 00F60000, based on PE: true

Associated: 00000000.00000002.1667891216.0000000000F60000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667966851.0000000000FEF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667966851.0000000001015000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1668035777.000000000101F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1668053678.0000000001028000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f60000_tgBNtoWqIp.jbxd

Similarity

API ID: Variant$ClearInit$_memset
String ID: Incorrect Object type in FOR..IN loop$Null Object assignment in FOR..IN loop
API String ID: 2862541840-625585964
Opcode ID: 672a57f129601862882b221b146a7e9f506fb86fd091f71e23d84a86dcf4f702
Instruction ID: 86cce31bcc624d3140cb4b5c851f1437996cb855144af697765b63ed0ca51cab
Opcode Fuzzy Hash: 672a57f129601862882b221b146a7e9f506fb86fd091f71e23d84a86dcf4f702
Instruction Fuzzy Hash: FA91B171E04209ABCF20DFA1D844FAEB7B9EF45324F18855AF505AB281D7B0D905DFA0

Function 00FD9A72 Relevance: 12.5, APIs: 6, Strings: 1, Instructions: 242COMMON

Download Yara Rule

APIs

Part of subcall function 00FB7652: CLSIDFromProgID.OLE32(?,?,00000000,?,00000000,?,?,-C0000018,00000001,?,00FB758C,80070057,?,?,?,00FB799D), ref: 00FB766F
Part of subcall function 00FB7652: ProgIDFromCLSID.OLE32(?,00000000,?,?,00000000,?,00000000,?,?,-C0000018,00000001,?,00FB758C,80070057,?,?), ref: 00FB768A
Part of subcall function 00FB7652: lstrcmpiW.KERNEL32(?,00000000,?,?,00000000,?,00000000,?,?,-C0000018,00000001,?,00FB758C,80070057,?,?), ref: 00FB7698
Part of subcall function 00FB7652: CoTaskMemFree.OLE32(00000000,?,00000000,?,?,00000000,?,00000000,?,?,-C0000018,00000001,?,00FB758C,80070057,?), ref: 00FB76A8

CoInitializeSecurity.OLE32(00000000,000000FF,00000000,00000000,00000002,00000003,00000000,00000000,00000000,?,?,?), ref: 00FD9B1B
_memset.LIBCMT ref: 00FD9B28
_memset.LIBCMT ref: 00FD9C6B
CoCreateInstanceEx.OLE32(?,00000000,00000015,?,00000001,00000000), ref: 00FD9C97
CoTaskMemFree.OLE32(?), ref: 00FD9CA2

Strings

NULL Pointer assignment, xrefs: 00FD9CF0

Memory Dump Source

Source File: 00000000.00000002.1667912702.0000000000F61000.00000020.00000001.01000000.00000003.sdmp, Offset: 00F60000, based on PE: true

Associated: 00000000.00000002.1667891216.0000000000F60000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667966851.0000000000FEF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667966851.0000000001015000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1668035777.000000000101F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1668053678.0000000001028000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f60000_tgBNtoWqIp.jbxd

Similarity

API ID: FreeFromProgTask_memset$CreateInitializeInstanceSecuritylstrcmpi
String ID: NULL Pointer assignment
API String ID: 1300414916-2785691316
Opcode ID: 2db9e9737895c23897bd4132667b421ede12d7f280e890663130564686a3cf1c
Instruction ID: c6158cde471cca099fcc5d37a5318a874d9a38fd16c14b2a1d634b64ac013715
Opcode Fuzzy Hash: 2db9e9737895c23897bd4132667b421ede12d7f280e890663130564686a3cf1c
Instruction Fuzzy Hash: 8E914872D00219EBDB10DFE5DC80ADEBBB9AF08710F20415AF519A7281DB759A44DFA0

Function 00FE6FEF Relevance: 12.4, APIs: 6, Strings: 1, Instructions: 143windowCOMMON

Download Yara Rule

APIs

SendMessageW.USER32(00000000,00001036,00000010,00000010), ref: 00FE7093
SendMessageW.USER32(?,00001036,00000000,?), ref: 00FE70A7
SetWindowPos.USER32(?,00000000,00000000,00000000,00000000,00000000,00000013), ref: 00FE70C1
_wcscat.LIBCMT ref: 00FE711C
SendMessageW.USER32(?,00001057,00000000,?), ref: 00FE7133
SendMessageW.USER32(?,00001061,?,0000000F), ref: 00FE7161

Strings

SysListView32, xrefs: 00FE7065

Memory Dump Source

Source File: 00000000.00000002.1667912702.0000000000F61000.00000020.00000001.01000000.00000003.sdmp, Offset: 00F60000, based on PE: true

Associated: 00000000.00000002.1667891216.0000000000F60000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667966851.0000000000FEF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667966851.0000000001015000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1668035777.000000000101F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1668053678.0000000001028000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f60000_tgBNtoWqIp.jbxd

Similarity

API ID: MessageSend$Window_wcscat
String ID: SysListView32
API String ID: 307300125-78025650
Opcode ID: d1775fdcfe4c909becd732a49c23cd232a11e44d17e3567f43ab6ed6cc1cec7f
Instruction ID: 9aca2d2595347dd464557ffd811d88510b405c49f3ead06c49377340fff7c512
Opcode Fuzzy Hash: d1775fdcfe4c909becd732a49c23cd232a11e44d17e3567f43ab6ed6cc1cec7f
Instruction Fuzzy Hash: 3141A671904388AFEB219F65CC85BEE77B8EF08360F10042AFA84D7191D7769D84AB50

Function 00FDEC47 Relevance: 12.4, APIs: 6, Strings: 1, Instructions: 136COMMON

Download Yara Rule

APIs

Part of subcall function 00FC3E91: CreateToolhelp32Snapshot.KERNEL32 ref: 00FC3EB6
Part of subcall function 00FC3E91: Process32FirstW.KERNEL32(00000000,?), ref: 00FC3EC4
Part of subcall function 00FC3E91: CloseHandle.KERNEL32(00000000), ref: 00FC3F8E

OpenProcess.KERNEL32(00000001,00000000,?), ref: 00FDECB8
GetLastError.KERNEL32 ref: 00FDECCB
OpenProcess.KERNEL32(00000001,00000000,?), ref: 00FDECFA
TerminateProcess.KERNEL32(00000000,00000000), ref: 00FDED77
GetLastError.KERNEL32(00000000), ref: 00FDED82
CloseHandle.KERNEL32(00000000), ref: 00FDEDB7

Strings

SeDebugPrivilege, xrefs: 00FDECD6

Memory Dump Source

Source File: 00000000.00000002.1667912702.0000000000F61000.00000020.00000001.01000000.00000003.sdmp, Offset: 00F60000, based on PE: true

Associated: 00000000.00000002.1667891216.0000000000F60000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667966851.0000000000FEF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667966851.0000000001015000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1668035777.000000000101F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1668053678.0000000001028000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f60000_tgBNtoWqIp.jbxd

Similarity

API ID: Process$CloseErrorHandleLastOpen$CreateFirstProcess32SnapshotTerminateToolhelp32
String ID: SeDebugPrivilege
API String ID: 2533919879-2896544425
Opcode ID: d0229da2a0b5d0796bb4927b6bf071e70f6be96e3e18d99a5c5c993cd4cdfd66
Instruction ID: 2cc6ff6839d0b2b3963fbb9410c5a80c7cef196f5053c9aec56071bb525ef54a
Opcode Fuzzy Hash: d0229da2a0b5d0796bb4927b6bf071e70f6be96e3e18d99a5c5c993cd4cdfd66
Instruction Fuzzy Hash: 5141AF716042019FDB14EF14CC95F6DB7A6AF80714F188059F8469F3D2DFB9A808EB92

Function 00FC3226 Relevance: 12.3, APIs: 2, Strings: 5, Instructions: 82windowCOMMON

Download Yara Rule

APIs

LoadIconW.USER32(00000000,00007F03), ref: 00FC32C5

Strings

stop, xrefs: 00FC3296
blank, xrefs: 00FC3247
question, xrefs: 00FC327E
warning, xrefs: 00FC32AE
info, xrefs: 00FC3266

Memory Dump Source

Source File: 00000000.00000002.1667912702.0000000000F61000.00000020.00000001.01000000.00000003.sdmp, Offset: 00F60000, based on PE: true

Associated: 00000000.00000002.1667891216.0000000000F60000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667966851.0000000000FEF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667966851.0000000001015000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1668035777.000000000101F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1668053678.0000000001028000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f60000_tgBNtoWqIp.jbxd

Similarity

API ID: IconLoad
String ID: blank$info$question$stop$warning
API String ID: 2457776203-404129466
Opcode ID: 2a6c639a361b041a801e699caa9f12bd143f8bf6f0c96218e749d5ca85b20f07
Instruction ID: f40a63de78595e66dff1a1ea7d36f00963df21074c29cb250fc9df5a54b97b67
Opcode Fuzzy Hash: 2a6c639a361b041a801e699caa9f12bd143f8bf6f0c96218e749d5ca85b20f07
Instruction Fuzzy Hash: FD11EB32B09797BAAB015A55DD43FEAB39CDF1ABB0F10402EF9009A181D6B95B4066A4

Function 00FC4534 Relevance: 12.3, APIs: 6, Strings: 1, Instructions: 47windowCOMMON

Download Yara Rule

APIs

GetModuleHandleW.KERNEL32(00000000,?,?,00000100,00000000), ref: 00FC454E
LoadStringW.USER32(00000000), ref: 00FC4555
GetModuleHandleW.KERNEL32(00000000,00001389,?,00000100), ref: 00FC456B
LoadStringW.USER32(00000000), ref: 00FC4572
_wprintf.LIBCMT ref: 00FC4598
MessageBoxW.USER32(00000000,?,?,00011010), ref: 00FC45B6

Strings

%s (%d) : ==> %s: %s %s, xrefs: 00FC4593

Memory Dump Source

Source File: 00000000.00000002.1667912702.0000000000F61000.00000020.00000001.01000000.00000003.sdmp, Offset: 00F60000, based on PE: true

Associated: 00000000.00000002.1667891216.0000000000F60000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667966851.0000000000FEF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667966851.0000000001015000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1668035777.000000000101F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1668053678.0000000001028000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f60000_tgBNtoWqIp.jbxd

Similarity

API ID: HandleLoadModuleString$Message_wprintf
String ID: %s (%d) : ==> %s: %s %s
API String ID: 3648134473-3128320259
Opcode ID: 7ceae1c7d716f93f71e199abbbeb618e606af9de08f784a6e2791b2404dcbd4b
Instruction ID: 48caa66c7b35c05eabb2c1fb7c85e2d63d435075ec6869efd608fbdf511dd002
Opcode Fuzzy Hash: 7ceae1c7d716f93f71e199abbbeb618e606af9de08f784a6e2791b2404dcbd4b
Instruction Fuzzy Hash: 0E0162F290024CBFE720ABA0DD89FFB776CDB08301F4005A5BB45D6011EA749E899B70

Function 00FED74C Relevance: 12.3, APIs: 8, Instructions: 257windowCOMMON

Download Yara Rule

APIs

Part of subcall function 00F62612: GetWindowLongW.USER32(?,000000EB), ref: 00F62623

GetSystemMetrics.USER32(0000000F), ref: 00FED78A
GetSystemMetrics.USER32(0000000F), ref: 00FED7AA
MoveWindow.USER32(00000003,?,?,?,?,00000000,?,?,?), ref: 00FED9E5
SendMessageW.USER32(00000003,00000142,00000000,0000FFFF), ref: 00FEDA03
SendMessageW.USER32(00000003,00000469,?,00000000), ref: 00FEDA24
ShowWindow.USER32(00000003,00000000), ref: 00FEDA43
InvalidateRect.USER32(?,00000000,00000001), ref: 00FEDA68
DefDlgProcW.USER32(?,00000005,?,?), ref: 00FEDA8B

Memory Dump Source

Source File: 00000000.00000002.1667912702.0000000000F61000.00000020.00000001.01000000.00000003.sdmp, Offset: 00F60000, based on PE: true

Associated: 00000000.00000002.1667891216.0000000000F60000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667966851.0000000000FEF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667966851.0000000001015000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1668035777.000000000101F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1668053678.0000000001028000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f60000_tgBNtoWqIp.jbxd

Similarity

API ID: Window$MessageMetricsSendSystem$InvalidateLongMoveProcRectShow
String ID:
API String ID: 1211466189-0
Opcode ID: 16fbc0efd6e25258884e43ed927b832e4bf53b86dbdb3f4f9adfe05c427873fc
Instruction ID: afa2fee90719b0e161c65c10d233b62ab484667907a49223506d45797733fef8
Opcode Fuzzy Hash: 16fbc0efd6e25258884e43ed927b832e4bf53b86dbdb3f4f9adfe05c427873fc
Instruction Fuzzy Hash: D0B1AA71A002A9EFDF14CF6AC9C57BD7BB1BF04710F088079EC489A696D735AA50EB50

Function 00F62A5B Relevance: 12.1, APIs: 8, Instructions: 129COMMON

Download Yara Rule

APIs

ShowWindow.USER32(FFFFFFFF,?,00000000,00000000,?,00F9C417,00000004,00000000,00000000,00000000), ref: 00F62ACF
ShowWindow.USER32(FFFFFFFF,00000000,00000000,00000000,?,00F9C417,00000004,00000000,00000000,00000000,000000FF), ref: 00F62B17
ShowWindow.USER32(FFFFFFFF,00000006,00000000,00000000,?,00F9C417,00000004,00000000,00000000,00000000), ref: 00F9C46A
ShowWindow.USER32(FFFFFFFF,?,00000000,00000000,?,00F9C417,00000004,00000000,00000000,00000000), ref: 00F9C4D6

Memory Dump Source

Source File: 00000000.00000002.1667912702.0000000000F61000.00000020.00000001.01000000.00000003.sdmp, Offset: 00F60000, based on PE: true

Associated: 00000000.00000002.1667891216.0000000000F60000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667966851.0000000000FEF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667966851.0000000001015000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1668035777.000000000101F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1668053678.0000000001028000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f60000_tgBNtoWqIp.jbxd

Similarity

API ID: ShowWindow
String ID:
API String ID: 1268545403-0
Opcode ID: ef4c63b503b07b6d79ec8215cbb0654eb7cd0de1d7ddef3f97576e1584ed293c
Instruction ID: f4c8a7e7cfb5292c0e48ee8f9eb7384b5120611ddecca88e62a55be2f7e726d1
Opcode Fuzzy Hash: ef4c63b503b07b6d79ec8215cbb0654eb7cd0de1d7ddef3f97576e1584ed293c
Instruction Fuzzy Hash: 2E413931B08BC09ADBB59B6CDCDCB7A3B92AB85320F14891DE08786561C6BDA845F750

Function 00FC7368 Relevance: 12.1, APIs: 8, Instructions: 101fileCOMMON

Download Yara Rule

APIs

InterlockedExchange.KERNEL32(?,000001F5), ref: 00FC737F

Part of subcall function 00F80FF6: std::exception::exception.LIBCMT ref: 00F8102C
Part of subcall function 00F80FF6: __CxxThrowException@8.LIBCMT ref: 00F81041

ReadFile.KERNEL32(0000FFFF,00000000,0000FFFF,?,00000000), ref: 00FC73B6
EnterCriticalSection.KERNEL32(?), ref: 00FC73D2
_memmove.LIBCMT ref: 00FC7420
_memmove.LIBCMT ref: 00FC743D
LeaveCriticalSection.KERNEL32(?), ref: 00FC744C
ReadFile.KERNEL32(0000FFFF,00000000,0000FFFF,00000000,00000000), ref: 00FC7461
InterlockedExchange.KERNEL32(?,000001F6), ref: 00FC7480

Memory Dump Source

Source File: 00000000.00000002.1667912702.0000000000F61000.00000020.00000001.01000000.00000003.sdmp, Offset: 00F60000, based on PE: true

Associated: 00000000.00000002.1667891216.0000000000F60000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667966851.0000000000FEF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667966851.0000000001015000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1668035777.000000000101F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1668053678.0000000001028000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f60000_tgBNtoWqIp.jbxd

Similarity

API ID: CriticalExchangeFileInterlockedReadSection_memmove$EnterException@8LeaveThrowstd::exception::exception
String ID:
API String ID: 256516436-0
Opcode ID: e457f3273c75e290d36b1406dfd2fa1bd27e91acaac18cccbf1f670b315ef655
Instruction ID: eb338e46afc933eedd441c77cdb084caf7f565b2973d969a92d426ab83436d1b
Opcode Fuzzy Hash: e457f3273c75e290d36b1406dfd2fa1bd27e91acaac18cccbf1f670b315ef655
Instruction Fuzzy Hash: AD318131904245EBCF10EF54DD85EAF7B78FF45710B1481A9F9049B246DB349A14EBA0

Function 00FE6442 Relevance: 12.1, APIs: 8, Instructions: 95windowCOMMON

Download Yara Rule

APIs

DeleteObject.GDI32(00000000), ref: 00FE645A
GetDC.USER32(00000000), ref: 00FE6462
GetDeviceCaps.GDI32(00000000,0000005A), ref: 00FE646D
ReleaseDC.USER32(00000000,00000000), ref: 00FE6479
CreateFontW.GDI32(?,00000000,00000000,00000000,?,00000000,00000000,00000000,00000001,00000004,00000000,?,00000000,?), ref: 00FE64B5
SendMessageW.USER32(?,00000030,00000000,00000001), ref: 00FE64C6
MoveWindow.USER32(?,?,?,?,?,00000000,?,?,00FE9299,?,?,000000FF,00000000,?,000000FF,?), ref: 00FE6500
SendMessageW.USER32(?,00000142,00000000,00000000), ref: 00FE6520

Memory Dump Source

Source File: 00000000.00000002.1667912702.0000000000F61000.00000020.00000001.01000000.00000003.sdmp, Offset: 00F60000, based on PE: true

Associated: 00000000.00000002.1667891216.0000000000F60000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667966851.0000000000FEF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667966851.0000000001015000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1668035777.000000000101F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1668053678.0000000001028000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f60000_tgBNtoWqIp.jbxd

Similarity

API ID: MessageSend$CapsCreateDeleteDeviceFontMoveObjectReleaseWindow
String ID:
API String ID: 3864802216-0
Opcode ID: 204acab184b22fe413ef76f1bbce3ac8edec90cf443ce06c0083f6cc0d03f8d8
Instruction ID: 91caa28010d24d3235aa75d4c5f03ea4da9afde0201ed4522d0f896ef1ecd998
Opcode Fuzzy Hash: 204acab184b22fe413ef76f1bbce3ac8edec90cf443ce06c0083f6cc0d03f8d8
Instruction Fuzzy Hash: 40318D72201258BFEB118F51CC8AFEA3FA9EF59765F044065FE08DE191C6759841DB60

Function 00FBC072 Relevance: 12.1, APIs: 8, Instructions: 92COMMON

Download Yara Rule

APIs

_memcmp.LIBCMT ref: 00FBC087
_memcmp.LIBCMT ref: 00FBC0A9
_memcmp.LIBCMT ref: 00FBC0C1
_memcmp.LIBCMT ref: 00FBC0D4
_memcmp.LIBCMT ref: 00FBC0EE
_memcmp.LIBCMT ref: 00FBC101
_memcmp.LIBCMT ref: 00FBC119
_memcmp.LIBCMT ref: 00FBC134

Memory Dump Source

Source File: 00000000.00000002.1667912702.0000000000F61000.00000020.00000001.01000000.00000003.sdmp, Offset: 00F60000, based on PE: true

Associated: 00000000.00000002.1667891216.0000000000F60000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667966851.0000000000FEF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667966851.0000000001015000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1668035777.000000000101F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1668053678.0000000001028000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f60000_tgBNtoWqIp.jbxd

Similarity

API ID: _memcmp
String ID:
API String ID: 2931989736-0
Opcode ID: 22c5261a00371c89e9d3fed8f2e3688b63be369d4e980f02094c7d952dad67a7
Instruction ID: a046a7e4a4c8a7b98f0da1f561012233f4aea55281c1a60e6e8e9f911bcbf423
Opcode Fuzzy Hash: 22c5261a00371c89e9d3fed8f2e3688b63be369d4e980f02094c7d952dad67a7
Instruction Fuzzy Hash: 40218372A41209B79654B5269D42FFF335CAF107E4B044020FE05E6292F755DE12BAE6

Function 00FCED8E Relevance: 10.8, APIs: 5, Strings: 1, Instructions: 323COMMON

Download Yara Rule

APIs

Part of subcall function 00F69997: __itow.LIBCMT ref: 00F699C2
Part of subcall function 00F69997: __swprintf.LIBCMT ref: 00F69A0C

Part of subcall function 00F7FEC6: _wcscpy.LIBCMT ref: 00F7FEE9

_wcstok.LIBCMT ref: 00FCEEFF
_wcscpy.LIBCMT ref: 00FCEF8E
_memset.LIBCMT ref: 00FCEFC1

Strings

X, xrefs: 00FCEFFE

Memory Dump Source

Source File: 00000000.00000002.1667912702.0000000000F61000.00000020.00000001.01000000.00000003.sdmp, Offset: 00F60000, based on PE: true

Associated: 00000000.00000002.1667891216.0000000000F60000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667966851.0000000000FEF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667966851.0000000001015000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1668035777.000000000101F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1668053678.0000000001028000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f60000_tgBNtoWqIp.jbxd

Similarity

API ID: _wcscpy$__itow__swprintf_memset_wcstok
String ID: X
API String ID: 774024439-3081909835
Opcode ID: 7e6fe222d891a2310889878f7260afcdd21e631ac20f015a6e8795eae4a26f39
Instruction ID: 4f0b7caa8b5c4713e820a8d01b3051457d90c17b7bb9f2dfa10e68853fd3d678
Opcode Fuzzy Hash: 7e6fe222d891a2310889878f7260afcdd21e631ac20f015a6e8795eae4a26f39
Instruction Fuzzy Hash: BCC16D315083019FC724EF24CD82E5AB7E4EF84714F04492DF8999B2A2DB74ED49EB82

Function 00F61424 Relevance: 10.7, APIs: 7, Instructions: 219COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1667912702.0000000000F61000.00000020.00000001.01000000.00000003.sdmp, Offset: 00F60000, based on PE: true

Associated: 00000000.00000002.1667891216.0000000000F60000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667966851.0000000000FEF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667966851.0000000001015000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1668035777.000000000101F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1668053678.0000000001028000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f60000_tgBNtoWqIp.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6aaac349f9ac5a73e7ded0de76076b7122acf5473af31f0b248abd8e91dc2540
Instruction ID: 5902792bd82419fbad7d801d997adf57d329f0401a2df55916cf73911a8e86a8
Opcode Fuzzy Hash: 6aaac349f9ac5a73e7ded0de76076b7122acf5473af31f0b248abd8e91dc2540
Instruction Fuzzy Hash: 53715031900109EFDF14DF58CC89ABEBB79FF86324F288159F915AB251C734AA51EB60

Function 00FD6E8A Relevance: 10.7, APIs: 7, Instructions: 212COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1667912702.0000000000F61000.00000020.00000001.01000000.00000003.sdmp, Offset: 00F60000, based on PE: true

Associated: 00000000.00000002.1667891216.0000000000F60000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667966851.0000000000FEF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667966851.0000000001015000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1668035777.000000000101F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1668053678.0000000001028000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f60000_tgBNtoWqIp.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 48ea7866759fbe8358146b3d266a29a525404a35ec56f3c53ccee73a163a10bd
Instruction ID: 6c22144a396fd52a33506f41ef7b0d4db34cb42ae0f5e0a3d9859342c91f750e
Opcode Fuzzy Hash: 48ea7866759fbe8358146b3d266a29a525404a35ec56f3c53ccee73a163a10bd
Instruction Fuzzy Hash: F661C032508300ABC710EB24CC95E6FB7EAEF84B14F14491EF5459B292DB799D05E752

Function 00FEB60B Relevance: 10.7, APIs: 7, Instructions: 199windowCOMMON

Download Yara Rule

APIs

IsWindow.USER32(01A857E0), ref: 00FEB6A5
IsWindowEnabled.USER32(01A857E0), ref: 00FEB6B1
SendMessageW.USER32(?,0000041C,00000000,00000000), ref: 00FEB795
SendMessageW.USER32(01A857E0,000000B0,?,?), ref: 00FEB7CC
IsDlgButtonChecked.USER32(?,?), ref: 00FEB809
GetWindowLongW.USER32(01A857E0,000000EC), ref: 00FEB82B
SendMessageW.USER32(?,000000A1,00000002,00000000), ref: 00FEB843

Memory Dump Source

Source File: 00000000.00000002.1667912702.0000000000F61000.00000020.00000001.01000000.00000003.sdmp, Offset: 00F60000, based on PE: true

Associated: 00000000.00000002.1667891216.0000000000F60000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667966851.0000000000FEF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667966851.0000000001015000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1668035777.000000000101F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1668053678.0000000001028000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f60000_tgBNtoWqIp.jbxd

Similarity

API ID: MessageSendWindow$ButtonCheckedEnabledLong
String ID:
API String ID: 4072528602-0
Opcode ID: e926dad96c26c7f6042113b035151b5d79445ef7c965421174b097a609baa915
Instruction ID: 17ac83a15c26e74dfa323ce10a3aaaee398c51aa53acb1c864b49834c37c6b7c
Opcode Fuzzy Hash: e926dad96c26c7f6042113b035151b5d79445ef7c965421174b097a609baa915
Instruction Fuzzy Hash: 5E719074A01284AFDB209F66C8D4FAB7BB9FF89320F144099ED8597361C732AD51EB50

Function 00FDF732 Relevance: 10.7, APIs: 5, Strings: 1, Instructions: 177COMMON

Download Yara Rule

APIs

_memset.LIBCMT ref: 00FDF75C
_memset.LIBCMT ref: 00FDF825
ShellExecuteExW.SHELL32(?), ref: 00FDF86A

Part of subcall function 00F69997: __itow.LIBCMT ref: 00F699C2
Part of subcall function 00F69997: __swprintf.LIBCMT ref: 00F69A0C

Part of subcall function 00F7FEC6: _wcscpy.LIBCMT ref: 00F7FEE9

GetProcessId.KERNEL32(00000000), ref: 00FDF8E1
CloseHandle.KERNEL32(00000000), ref: 00FDF910

Strings

@, xrefs: 00FDF839

Memory Dump Source

Source File: 00000000.00000002.1667912702.0000000000F61000.00000020.00000001.01000000.00000003.sdmp, Offset: 00F60000, based on PE: true

Associated: 00000000.00000002.1667891216.0000000000F60000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667966851.0000000000FEF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667966851.0000000001015000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1668035777.000000000101F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1668053678.0000000001028000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f60000_tgBNtoWqIp.jbxd

Similarity

API ID: _memset$CloseExecuteHandleProcessShell__itow__swprintf_wcscpy
String ID: @
API String ID: 3522835683-2766056989
Opcode ID: 47afd67aa34f89f4287db1ba7ce48f97c2177d940d58ae274f4bccbc9fca991f
Instruction ID: 0bc4c67425b0f2eef0333562aa204ce540e8f9fa98171347a3ff1dcb09d0f874
Opcode Fuzzy Hash: 47afd67aa34f89f4287db1ba7ce48f97c2177d940d58ae274f4bccbc9fca991f
Instruction Fuzzy Hash: 52619C75E00619DFCF14EF54C9809AEBBF5FF48310B18846AE84AAB351CB34AD45EB91

Function 00FC145D Relevance: 10.7, APIs: 7, Instructions: 166windowCOMMON

Download Yara Rule

APIs

GetParent.USER32(?), ref: 00FC149C
GetKeyboardState.USER32(?), ref: 00FC14B1
SetKeyboardState.USER32(?), ref: 00FC1512
PostMessageW.USER32(?,00000101,00000010,?), ref: 00FC1540
PostMessageW.USER32(?,00000101,00000011,?), ref: 00FC155F
PostMessageW.USER32(?,00000101,00000012,?), ref: 00FC15A5
PostMessageW.USER32(?,00000101,0000005B,?), ref: 00FC15C8

Memory Dump Source

Source File: 00000000.00000002.1667912702.0000000000F61000.00000020.00000001.01000000.00000003.sdmp, Offset: 00F60000, based on PE: true

Associated: 00000000.00000002.1667891216.0000000000F60000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667966851.0000000000FEF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667966851.0000000001015000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1668035777.000000000101F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1668053678.0000000001028000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f60000_tgBNtoWqIp.jbxd

Similarity

API ID: MessagePost$KeyboardState$Parent
String ID:
API String ID: 87235514-0
Opcode ID: d917f40d2c8bf23fec78f496e10be2c46265467785e53a538e9fab61d661eb73
Instruction ID: 83913126b7797c0258f9b75389e260bf65dfb766825796820b63633780ca671e
Opcode Fuzzy Hash: d917f40d2c8bf23fec78f496e10be2c46265467785e53a538e9fab61d661eb73
Instruction Fuzzy Hash: 7051C2A0A047D63EFB3686248D46FB67EA97B47314F0C498DA1D5498C3C398D8A8F750

Function 00FC1276 Relevance: 10.7, APIs: 7, Instructions: 165windowCOMMON

Download Yara Rule

APIs

GetParent.USER32(00000000), ref: 00FC12B5
GetKeyboardState.USER32(?), ref: 00FC12CA
SetKeyboardState.USER32(?), ref: 00FC132B
PostMessageW.USER32(00000000,00000100,00000010,?), ref: 00FC1357
PostMessageW.USER32(00000000,00000100,00000011,?), ref: 00FC1374
PostMessageW.USER32(00000000,00000100,00000012,?), ref: 00FC13B8
PostMessageW.USER32(00000000,00000100,0000005B,?), ref: 00FC13D9

Memory Dump Source

Source File: 00000000.00000002.1667912702.0000000000F61000.00000020.00000001.01000000.00000003.sdmp, Offset: 00F60000, based on PE: true

Associated: 00000000.00000002.1667891216.0000000000F60000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667966851.0000000000FEF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667966851.0000000001015000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1668035777.000000000101F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1668053678.0000000001028000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f60000_tgBNtoWqIp.jbxd

Similarity

API ID: MessagePost$KeyboardState$Parent
String ID:
API String ID: 87235514-0
Opcode ID: 6e4cd8529b3cc7b6864c5ec431db11153f039da79cec9a7f56e76fb27044c3ad
Instruction ID: 1f324bff15fa3090930c05d933b5aad2dd440df7211c706c7c243a0a2aa9174a
Opcode Fuzzy Hash: 6e4cd8529b3cc7b6864c5ec431db11153f039da79cec9a7f56e76fb27044c3ad
Instruction Fuzzy Hash: 9651D3A09046D63DFB3682248D46FBABFA97F07314F08858DE1D44A8C3D395ACA8F750

Function 00FC589F Relevance: 10.6, APIs: 7, Instructions: 138timeCOMMON

Download Yara Rule

APIs

GetLocalTime.KERNEL32 ref: 00FC58AC
_wcsncpy.LIBCMT ref: 00FC58E1
_wcsncpy.LIBCMT ref: 00FC5913
_wcsncpy.LIBCMT ref: 00FC5946
_wcsncpy.LIBCMT ref: 00FC5988
_wcsncpy.LIBCMT ref: 00FC59C2
_wcsncpy.LIBCMT ref: 00FC59F1

Memory Dump Source

Source File: 00000000.00000002.1667912702.0000000000F61000.00000020.00000001.01000000.00000003.sdmp, Offset: 00F60000, based on PE: true

Associated: 00000000.00000002.1667891216.0000000000F60000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667966851.0000000000FEF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667966851.0000000001015000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1668035777.000000000101F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1668053678.0000000001028000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f60000_tgBNtoWqIp.jbxd

Similarity

API ID: _wcsncpy$LocalTime
String ID:
API String ID: 2945705084-0
Opcode ID: a37eefc83360b3a4746b6c261a5d22f33f6809dc24b01aa69e765159f60c78a0
Instruction ID: 83ca9f9a141adbf233f5c2dad608069c79498d56141a99a4f6253d81ce61f938
Opcode Fuzzy Hash: a37eefc83360b3a4746b6c261a5d22f33f6809dc24b01aa69e765159f60c78a0
Instruction Fuzzy Hash: 83418265C20519B6CB50FBB48C8AACFB3B8AF04710F508556F918E3122E638F755E7A9

Function 00F62344 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 111keyboardCOMMON

Download Yara Rule

APIs

GetCursorPos.USER32(?), ref: 00F62357
ScreenToClient.USER32(010267B0,?), ref: 00F62374
GetAsyncKeyState.USER32(00000001), ref: 00F62399
GetAsyncKeyState.USER32(00000002), ref: 00F623A7

Strings

-es, xrefs: 00F9C249

Memory Dump Source

Source File: 00000000.00000002.1667912702.0000000000F61000.00000020.00000001.01000000.00000003.sdmp, Offset: 00F60000, based on PE: true

Associated: 00000000.00000002.1667891216.0000000000F60000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667966851.0000000000FEF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667966851.0000000001015000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1668035777.000000000101F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1668053678.0000000001028000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f60000_tgBNtoWqIp.jbxd

Similarity

API ID: AsyncState$ClientCursorScreen
String ID: -es
API String ID: 4210589936-508736453
Opcode ID: 3c8c5271f9c6cb9fe297cb4a423ba6c660c2dcaa166712ad0e9c36db7e2af7c3
Instruction ID: ab9d3f454cc34df3bcaf073e803abe793061a87bb412f1339dcff6508336fb5f
Opcode Fuzzy Hash: 3c8c5271f9c6cb9fe297cb4a423ba6c660c2dcaa166712ad0e9c36db7e2af7c3
Instruction Fuzzy Hash: 11417F31904659FFDF159FA8CC44AEDBB74FB05370F20436AF82896290C7355994EB91

Function 00FC38AD Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 111filestringCOMMON

Download Yara Rule

APIs

Part of subcall function 00FC48AA: GetFullPathNameW.KERNEL32(00000000,00007FFF,?,?,?,?,?,?,00FC38D3,?), ref: 00FC48C7

Part of subcall function 00FC48AA: GetFullPathNameW.KERNEL32(?,00007FFF,?,?,?,?,?,00FC38D3,?), ref: 00FC48E0

lstrcmpiW.KERNEL32(?,?), ref: 00FC38F3
_wcscmp.LIBCMT ref: 00FC390F
MoveFileW.KERNEL32(?,?), ref: 00FC3927
_wcscat.LIBCMT ref: 00FC396F
SHFileOperationW.SHELL32(?), ref: 00FC39DB

Strings

\*.*, xrefs: 00FC3969

Memory Dump Source

Source File: 00000000.00000002.1667912702.0000000000F61000.00000020.00000001.01000000.00000003.sdmp, Offset: 00F60000, based on PE: true

Associated: 00000000.00000002.1667891216.0000000000F60000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667966851.0000000000FEF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667966851.0000000001015000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1668035777.000000000101F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1668053678.0000000001028000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f60000_tgBNtoWqIp.jbxd

Similarity

API ID: FileFullNamePath$MoveOperation_wcscat_wcscmplstrcmpi
String ID: \*.*
API String ID: 1377345388-1173974218
Opcode ID: c23f2ae186a0d8a58fb466fae16d7ca3f7499b0d154764975b09c3ef54e4afce
Instruction ID: 66e6e2e88abbdf2eca462bb6d8a2a71f613ebf203984adb09a305af324cf0dc2
Opcode Fuzzy Hash: c23f2ae186a0d8a58fb466fae16d7ca3f7499b0d154764975b09c3ef54e4afce
Instruction Fuzzy Hash: DD41B1B250C3859EC751EF64C982EDFB7E8AF88380F00482EF499C3161EA78D648D752

Function 00FE7500 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 103windowCOMMON

Download Yara Rule

APIs

_memset.LIBCMT ref: 00FE7519
GetMenuItemInfoW.USER32(?,000000FF,00000000,00000030), ref: 00FE75C0
IsMenu.USER32(?), ref: 00FE75D8
InsertMenuItemW.USER32(?,?,00000001,00000030), ref: 00FE7620
DrawMenuBar.USER32 ref: 00FE7633

Strings

0, xrefs: 00FE750D

Memory Dump Source

Source File: 00000000.00000002.1667912702.0000000000F61000.00000020.00000001.01000000.00000003.sdmp, Offset: 00F60000, based on PE: true

Associated: 00000000.00000002.1667891216.0000000000F60000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667966851.0000000000FEF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667966851.0000000001015000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1668035777.000000000101F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1668053678.0000000001028000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f60000_tgBNtoWqIp.jbxd

Similarity

API ID: Menu$Item$DrawInfoInsert_memset
String ID: 0
API String ID: 3866635326-4108050209
Opcode ID: 93e02ef783bbc08dcc314458ac53a25cf05d5033a3a399bc62fcc987f2e5ebd3
Instruction ID: d9f0bac784bfc3fdb7bab01d4fcc462c2e37a9e0cec31b5273a44e4c3d9639e7
Opcode Fuzzy Hash: 93e02ef783bbc08dcc314458ac53a25cf05d5033a3a399bc62fcc987f2e5ebd3
Instruction Fuzzy Hash: 4A416971A04788EFDB20EF55D884E9ABBF8FB04324F048129ED559B250D731AD00EF90

Function 00FE122D Relevance: 10.6, APIs: 7, Instructions: 101registryCOMMON

Download Yara Rule

APIs

RegEnumKeyExW.ADVAPI32(?,00000000,?,000000FF,00000000,00000000,00000000,?,?,?), ref: 00FE125C
RegOpenKeyExW.ADVAPI32(?,?,00000000,?,?), ref: 00FE1286
FreeLibrary.KERNEL32(00000000), ref: 00FE133D

Part of subcall function 00FE122D: RegCloseKey.ADVAPI32(?), ref: 00FE12A3
Part of subcall function 00FE122D: FreeLibrary.KERNEL32(?), ref: 00FE12F5
Part of subcall function 00FE122D: RegEnumKeyExW.ADVAPI32(?,00000000,?,000000FF,00000000,00000000,00000000,?), ref: 00FE1318

RegDeleteKeyW.ADVAPI32(?,?), ref: 00FE12E0

Memory Dump Source

Source File: 00000000.00000002.1667912702.0000000000F61000.00000020.00000001.01000000.00000003.sdmp, Offset: 00F60000, based on PE: true

Associated: 00000000.00000002.1667891216.0000000000F60000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667966851.0000000000FEF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667966851.0000000001015000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1668035777.000000000101F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1668053678.0000000001028000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f60000_tgBNtoWqIp.jbxd

Similarity

API ID: EnumFreeLibrary$CloseDeleteOpen
String ID:
API String ID: 395352322-0
Opcode ID: a5e07fa228d7b119a9cf5d76c23c39bb5c81c8f60660c7f0bb8163016052229d
Instruction ID: 054e0773546056ca60812a4c3049d6d476058ced7ad2a39be9eb89158e13ed3f
Opcode Fuzzy Hash: a5e07fa228d7b119a9cf5d76c23c39bb5c81c8f60660c7f0bb8163016052229d
Instruction Fuzzy Hash: BA310CB1D0115DBFDB159B92DC89AFEB7BCFB08310F00016AE611E6151DA749F49AAA0

Function 00FE653C Relevance: 10.6, APIs: 7, Instructions: 99windowCOMMON

Download Yara Rule

APIs

SendMessageW.USER32(00000000,000000F0,00000000,00000000), ref: 00FE655B
GetWindowLongW.USER32(01A857E0,000000F0), ref: 00FE658E
GetWindowLongW.USER32(01A857E0,000000F0), ref: 00FE65C3
SendMessageW.USER32(00000000,000000F1,00000000,00000000), ref: 00FE65F5
SendMessageW.USER32(00000000,000000F1,00000001,00000000), ref: 00FE661F
GetWindowLongW.USER32(00000000,000000F0), ref: 00FE6630
SetWindowLongW.USER32(00000000,000000F0,00000000), ref: 00FE664A

Memory Dump Source

Source File: 00000000.00000002.1667912702.0000000000F61000.00000020.00000001.01000000.00000003.sdmp, Offset: 00F60000, based on PE: true

Associated: 00000000.00000002.1667891216.0000000000F60000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667966851.0000000000FEF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667966851.0000000001015000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1668035777.000000000101F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1668053678.0000000001028000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f60000_tgBNtoWqIp.jbxd

Similarity

API ID: LongWindow$MessageSend
String ID:
API String ID: 2178440468-0
Opcode ID: badcc7ee7f11c070ceb843647cb9760881317c0daba64899a8aaa17bc7e4f0ce
Instruction ID: a2ea08cdee52510d0c056ee7c3785e27be36299c025ce237f02ff8b9aba21e6f
Opcode Fuzzy Hash: badcc7ee7f11c070ceb843647cb9760881317c0daba64899a8aaa17bc7e4f0ce
Instruction Fuzzy Hash: BD310570B04298AFDB308F19DC84F5537E1FB597A0F280168F951CF2A5CB62A844EB41

Function 00FD6486 Relevance: 10.6, APIs: 7, Instructions: 94networkCOMMON

Download Yara Rule

APIs

Part of subcall function 00FD80A0: inet_addr.WSOCK32(00000000,?,00000000,?,?,?,00000000), ref: 00FD80CB

socket.WSOCK32(00000002,00000001,00000006,?,?,00000000), ref: 00FD64D9
WSAGetLastError.WSOCK32(00000000), ref: 00FD64E8
ioctlsocket.WSOCK32(00000000,8004667E,00000000), ref: 00FD6521
connect.WSOCK32(00000000,?,00000010), ref: 00FD652A
WSAGetLastError.WSOCK32 ref: 00FD6534
closesocket.WSOCK32(00000000), ref: 00FD655D
ioctlsocket.WSOCK32(00000000,8004667E,00000000), ref: 00FD6576

Memory Dump Source

Source File: 00000000.00000002.1667912702.0000000000F61000.00000020.00000001.01000000.00000003.sdmp, Offset: 00F60000, based on PE: true

Associated: 00000000.00000002.1667891216.0000000000F60000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667966851.0000000000FEF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667966851.0000000001015000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1668035777.000000000101F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1668053678.0000000001028000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f60000_tgBNtoWqIp.jbxd

Similarity

API ID: ErrorLastioctlsocket$closesocketconnectinet_addrsocket
String ID:
API String ID: 910771015-0
Opcode ID: 5fc760611842aa4904c4dc61e3d09a57adb6136ca8c56b3d146f7cd885d6c704
Instruction ID: f6eaf7f8a82c2928c9d82435bcf152beaa1f9402db105f70afb28ee988e2da41
Opcode Fuzzy Hash: 5fc760611842aa4904c4dc61e3d09a57adb6136ca8c56b3d146f7cd885d6c704
Instruction Fuzzy Hash: 0531B531600118AFDB10AF54DC85BBE77AEEB45724F08806AF905DB391CB74AD48EB61

Function 00FBE0B5 Relevance: 10.6, APIs: 7, Instructions: 90memoryCOMMON

Download Yara Rule

APIs

MultiByteToWideChar.KERNEL32(00000000,00000000,?,000000FF,00000000,00000000), ref: 00FBE0FA
MultiByteToWideChar.KERNEL32(00000000,00000000,?,000000FF,00000000,00000000), ref: 00FBE120
SysAllocString.OLEAUT32(00000000), ref: 00FBE123
SysAllocString.OLEAUT32 ref: 00FBE144
SysFreeString.OLEAUT32 ref: 00FBE14D
StringFromGUID2.OLE32(?,?,00000028), ref: 00FBE167
SysAllocString.OLEAUT32(?), ref: 00FBE175

Memory Dump Source

Source File: 00000000.00000002.1667912702.0000000000F61000.00000020.00000001.01000000.00000003.sdmp, Offset: 00F60000, based on PE: true

Associated: 00000000.00000002.1667891216.0000000000F60000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667966851.0000000000FEF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667966851.0000000001015000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1668035777.000000000101F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1668053678.0000000001028000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f60000_tgBNtoWqIp.jbxd

Similarity

API ID: String$Alloc$ByteCharMultiWide$FreeFrom
String ID:
API String ID: 3761583154-0
Opcode ID: 47d790da5c4bc932ef035e1582752791a309f7681f090810200fc0e2cd758968
Instruction ID: 48b481b6551146e30ceddcb4fa030a0290737f316189b0a0b3327e9690b42f06
Opcode Fuzzy Hash: 47d790da5c4bc932ef035e1582752791a309f7681f090810200fc0e2cd758968
Instruction Fuzzy Hash: 2421B072601208AFDB10EFADDC88DEB77ECEB09760B108135F914CB2A1DA70DC45AB60

Function 00FBFB6E Relevance: 10.6, APIs: 3, Strings: 3, Instructions: 90COMMON

Download Yara Rule

APIs

__wcsnicmp.LIBCMT ref: 00FBFB81
__wcsnicmp.LIBCMT ref: 00FBFBA2
__wcsnicmp.LIBCMT ref: 00FBFBBC

Strings

#requireadmin, xrefs: 00FBFB9C
#notrayicon, xrefs: 00FBFB79
#OnAutoItStartRegister, xrefs: 00FBFBB6

Memory Dump Source

Source File: 00000000.00000002.1667912702.0000000000F61000.00000020.00000001.01000000.00000003.sdmp, Offset: 00F60000, based on PE: true

Associated: 00000000.00000002.1667891216.0000000000F60000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667966851.0000000000FEF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667966851.0000000001015000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1668035777.000000000101F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1668053678.0000000001028000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f60000_tgBNtoWqIp.jbxd

Similarity

API ID: __wcsnicmp
String ID: #OnAutoItStartRegister$#notrayicon$#requireadmin
API String ID: 1038674560-2734436370
Opcode ID: 270e00ba7799f9a6332887a4ea5019ad5dcca5d35dcb5facb9713694de0a6737
Instruction ID: e24ec59d376d9a3a8d3a8847e8cbf6a625efe66ca54777a69098a9cb354e0549
Opcode Fuzzy Hash: 270e00ba7799f9a6332887a4ea5019ad5dcca5d35dcb5facb9713694de0a6737
Instruction Fuzzy Hash: 05216A72500216A6D734B625DC12FF77798EF91310F14C036F88586151EB55AA86F791

Function 00FE783C Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 75windowCOMMON

Download Yara Rule

APIs

Part of subcall function 00F61D35: CreateWindowExW.USER32(?,?,?,?,?,?,?,?,?,?,00000000,00000096), ref: 00F61D73
Part of subcall function 00F61D35: GetStockObject.GDI32(00000011), ref: 00F61D87
Part of subcall function 00F61D35: SendMessageW.USER32(00000000,00000030,00000000), ref: 00F61D91

SendMessageW.USER32(00000000,00002001,00000000,FF000000), ref: 00FE78A1
SendMessageW.USER32(?,00000409,00000000,FF000000), ref: 00FE78AE
SendMessageW.USER32(?,00000402,00000000,00000000), ref: 00FE78B9
SendMessageW.USER32(?,00000401,00000000,00640000), ref: 00FE78C8
SendMessageW.USER32(?,00000404,00000001,00000000), ref: 00FE78D4

Strings

Msctls_Progress32, xrefs: 00FE7872

Memory Dump Source

Source File: 00000000.00000002.1667912702.0000000000F61000.00000020.00000001.01000000.00000003.sdmp, Offset: 00F60000, based on PE: true

Associated: 00000000.00000002.1667891216.0000000000F60000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667966851.0000000000FEF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667966851.0000000001015000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1668035777.000000000101F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1668053678.0000000001028000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f60000_tgBNtoWqIp.jbxd

Similarity

API ID: MessageSend$CreateObjectStockWindow
String ID: Msctls_Progress32
API String ID: 1025951953-3636473452
Opcode ID: dc15396b2952dbe25391e47fe8f75b7bbcfe7ec7c9849bfd1ab45fa80820e7c2
Instruction ID: 727dc945d1993e9d78bbad5ad33090eb45d84046dbba195ae0498492efdec50c
Opcode Fuzzy Hash: dc15396b2952dbe25391e47fe8f75b7bbcfe7ec7c9849bfd1ab45fa80820e7c2
Instruction Fuzzy Hash: 1A11B2B2510219BFEF159F61CC85EE77F6DEF08768F114114FA04A6090C7729C21EBA0

Function 00F841C9 Relevance: 10.5, APIs: 4, Strings: 2, Instructions: 24libraryloaderCOMMONLIBRARYCODE

Download Yara Rule

APIs

LoadLibraryExW.KERNEL32(combase.dll,00000000,00000800,RoInitialize,00F84292,?), ref: 00F841E3
GetProcAddress.KERNEL32(00000000), ref: 00F841EA
EncodePointer.KERNEL32(00000000), ref: 00F841F6
DecodePointer.KERNEL32(00000001,00F84292,?), ref: 00F84213

Strings

RoInitialize, xrefs: 00F841D2
combase.dll, xrefs: 00F841DE

Memory Dump Source

Source File: 00000000.00000002.1667912702.0000000000F61000.00000020.00000001.01000000.00000003.sdmp, Offset: 00F60000, based on PE: true

Associated: 00000000.00000002.1667891216.0000000000F60000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667966851.0000000000FEF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667966851.0000000001015000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1668035777.000000000101F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1668053678.0000000001028000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f60000_tgBNtoWqIp.jbxd

Similarity

API ID: Pointer$AddressDecodeEncodeLibraryLoadProc
String ID: RoInitialize$combase.dll
API String ID: 3489934621-340411864
Opcode ID: 32f8766cca327319d648dd19af5fd5aab1f902356c6abf1da278e9da0661280b
Instruction ID: 32e6ee343581a936cfa3e93aa46e690e4f2bcc13867badf2b324135c7a44cb92
Opcode Fuzzy Hash: 32f8766cca327319d648dd19af5fd5aab1f902356c6abf1da278e9da0661280b
Instruction Fuzzy Hash: F7E012B0A90749DFEB306F70EC4DB543594BB61B02F704434F551D90E4DBBA5055AF00

Function 00F8429E Relevance: 10.5, APIs: 4, Strings: 2, Instructions: 19libraryloaderCOMMONLIBRARYCODE

Download Yara Rule

APIs

LoadLibraryExW.KERNEL32(combase.dll,00000000,00000800,RoUninitialize,00F841B8), ref: 00F842B8
GetProcAddress.KERNEL32(00000000), ref: 00F842BF
EncodePointer.KERNEL32(00000000), ref: 00F842CA
DecodePointer.KERNEL32(00F841B8), ref: 00F842E5

Strings

combase.dll, xrefs: 00F842B3
RoUninitialize, xrefs: 00F842A7

Memory Dump Source

Source File: 00000000.00000002.1667912702.0000000000F61000.00000020.00000001.01000000.00000003.sdmp, Offset: 00F60000, based on PE: true

Associated: 00000000.00000002.1667891216.0000000000F60000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667966851.0000000000FEF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667966851.0000000001015000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1668035777.000000000101F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1668053678.0000000001028000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f60000_tgBNtoWqIp.jbxd

Similarity

API ID: Pointer$AddressDecodeEncodeLibraryLoadProc
String ID: RoUninitialize$combase.dll
API String ID: 3489934621-2819208100
Opcode ID: 3c74ba0e51ea693a84e34e3869a366fdb5c3adb94072cc2f8dc970a88cf1e16b
Instruction ID: 3d16d5a8f24147e70b7d85bf41c4f1d69c2beb2e7be3d37cd395e8640d58e79c
Opcode Fuzzy Hash: 3c74ba0e51ea693a84e34e3869a366fdb5c3adb94072cc2f8dc970a88cf1e16b
Instruction Fuzzy Hash: 06E0BF787453499FEB709F60EC4DB543AA4BB14742F304029F951D50A4CB799504FB15

Function 00FC675A Relevance: 9.2, APIs: 6, Instructions: 205COMMON

Download Yara Rule

APIs

_memmove.LIBCMT ref: 00FC68AD
_memmove.LIBCMT ref: 00FC67E8

Part of subcall function 00F69997: __itow.LIBCMT ref: 00F699C2
Part of subcall function 00F69997: __swprintf.LIBCMT ref: 00F69A0C

_memmove.LIBCMT ref: 00FC685B
_memmove.LIBCMT ref: 00FC6942
_memmove.LIBCMT ref: 00FC695B
_memmove.LIBCMT ref: 00FC6977

Memory Dump Source

Source File: 00000000.00000002.1667912702.0000000000F61000.00000020.00000001.01000000.00000003.sdmp, Offset: 00F60000, based on PE: true

Associated: 00000000.00000002.1667891216.0000000000F60000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667966851.0000000000FEF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667966851.0000000001015000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1668035777.000000000101F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1668053678.0000000001028000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f60000_tgBNtoWqIp.jbxd

Similarity

API ID: _memmove$__itow__swprintf
String ID:
API String ID: 3253778849-0
Opcode ID: b6af34302f73e7cc86d124cdaa6c703dbf7dfb6507262c8ff84fb63fda3a9fb8
Instruction ID: 1424080d343ff85106060c815ade5aef2f92f98e5d5070c7e6bb6c9edefbb9fa
Opcode Fuzzy Hash: b6af34302f73e7cc86d124cdaa6c703dbf7dfb6507262c8ff84fb63fda3a9fb8
Instruction Fuzzy Hash: 9561AB3150825A9BCF11FF20CD82FFE37A8EF44708F044519F95A9B292DB78A946EB51

Function 00FE046F Relevance: 9.2, APIs: 6, Instructions: 167registryCOMMON

Download Yara Rule

APIs

Part of subcall function 00F67F41: _memmove.LIBCMT ref: 00F67F82

Part of subcall function 00FE10A5: CharUpperBuffW.USER32(?,?,?,?,?,?,?,00FE0038,?,?), ref: 00FE10BC

RegConnectRegistryW.ADVAPI32(?,?,?), ref: 00FE0548
RegOpenKeyExW.ADVAPI32(?,?,00000000,?,?), ref: 00FE0588
RegCloseKey.ADVAPI32(?,00000001,00000000), ref: 00FE05AB
RegEnumValueW.ADVAPI32(?,-00000001,?,?,00000000,?,00000000,00000000), ref: 00FE05D4
RegCloseKey.ADVAPI32(?,?,00000000), ref: 00FE0617
RegCloseKey.ADVAPI32(00000000), ref: 00FE0624

Memory Dump Source

Source File: 00000000.00000002.1667912702.0000000000F61000.00000020.00000001.01000000.00000003.sdmp, Offset: 00F60000, based on PE: true

Associated: 00000000.00000002.1667891216.0000000000F60000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667966851.0000000000FEF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667966851.0000000001015000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1668035777.000000000101F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1668053678.0000000001028000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f60000_tgBNtoWqIp.jbxd

Similarity

API ID: Close$BuffCharConnectEnumOpenRegistryUpperValue_memmove
String ID:
API String ID: 4046560759-0
Opcode ID: c5a378eb6c1f9f87c4bb0c259cec158cbd5af801ff9c0a1c91c672cd37740149
Instruction ID: a7c91598dccd3c3b6d708ec33fa96d4b287eb1247b2cb5092b457afdbd3ac896
Opcode Fuzzy Hash: c5a378eb6c1f9f87c4bb0c259cec158cbd5af801ff9c0a1c91c672cd37740149
Instruction Fuzzy Hash: 2A518831508340AFCB10EB25CC85E6ABBE8FF88714F04491DF5858B2A2DB75E945EB52

Function 00FE5A20 Relevance: 9.2, APIs: 6, Instructions: 160windowCOMMON

Download Yara Rule

APIs

GetMenu.USER32(?), ref: 00FE5A82
GetMenuItemCount.USER32(00000000), ref: 00FE5AB9
GetMenuStringW.USER32(00000000,00000000,?,00007FFF,00000400), ref: 00FE5AE1
GetMenuItemID.USER32(?,?), ref: 00FE5B50
GetSubMenu.USER32(?,?), ref: 00FE5B5E
PostMessageW.USER32(?,00000111,?,00000000), ref: 00FE5BAF

Memory Dump Source

Source File: 00000000.00000002.1667912702.0000000000F61000.00000020.00000001.01000000.00000003.sdmp, Offset: 00F60000, based on PE: true

Associated: 00000000.00000002.1667891216.0000000000F60000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667966851.0000000000FEF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667966851.0000000001015000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1668035777.000000000101F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1668053678.0000000001028000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f60000_tgBNtoWqIp.jbxd

Similarity

API ID: Menu$Item$CountMessagePostString
String ID:
API String ID: 650687236-0
Opcode ID: 61f2c9cdc11028154b4d1b8fbaead181e73b34647f05795b3439a134b37b0523
Instruction ID: ffb933951ed184e69b9511bd8f9feda39a6d526eb3d72871f88e943b84d6162c
Opcode Fuzzy Hash: 61f2c9cdc11028154b4d1b8fbaead181e73b34647f05795b3439a134b37b0523
Instruction Fuzzy Hash: 3D518232E00615AFCF11EF65CC85AAEB7B4EF48724F144469F801BB351CB78AE41AB91

Function 00FBF3DD Relevance: 9.2, APIs: 6, Instructions: 159COMMON

Download Yara Rule

APIs

VariantInit.OLEAUT32(?), ref: 00FBF3F7
VariantClear.OLEAUT32(00000013), ref: 00FBF469
VariantClear.OLEAUT32(00000000), ref: 00FBF4C4
_memmove.LIBCMT ref: 00FBF4EE
VariantClear.OLEAUT32(?), ref: 00FBF53B
VariantChangeType.OLEAUT32(?,?,00000000,00000013), ref: 00FBF569

Memory Dump Source

Source File: 00000000.00000002.1667912702.0000000000F61000.00000020.00000001.01000000.00000003.sdmp, Offset: 00F60000, based on PE: true

Associated: 00000000.00000002.1667891216.0000000000F60000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667966851.0000000000FEF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667966851.0000000001015000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1668035777.000000000101F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1668053678.0000000001028000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f60000_tgBNtoWqIp.jbxd

Similarity

API ID: Variant$Clear$ChangeInitType_memmove
String ID:
API String ID: 1101466143-0
Opcode ID: 81622e4ee1f29103731eabd9b64ae8ebc2084dfa5075b7c94734a01e41f3353e
Instruction ID: 7057e21c860f552f8c540cf4b20a7c2907810d54449208b07b2df6f14e9993da
Opcode Fuzzy Hash: 81622e4ee1f29103731eabd9b64ae8ebc2084dfa5075b7c94734a01e41f3353e
Instruction Fuzzy Hash: C05168B5A00209EFCB20CF58D880EAAB7B8FF4C314B158169E959DB340D730E915CFA0

Function 00FC26F9 Relevance: 9.1, APIs: 6, Instructions: 138windowCOMMON

Download Yara Rule

APIs

_memset.LIBCMT ref: 00FC2747
GetMenuItemInfoW.USER32(?,000000FF,00000000,00000030), ref: 00FC2792
IsMenu.USER32(00000000), ref: 00FC27B2
CreatePopupMenu.USER32 ref: 00FC27E6
GetMenuItemCount.USER32(000000FF), ref: 00FC2844
InsertMenuItemW.USER32(00000000,?,00000001,00000030), ref: 00FC2875

Memory Dump Source

Source File: 00000000.00000002.1667912702.0000000000F61000.00000020.00000001.01000000.00000003.sdmp, Offset: 00F60000, based on PE: true

Associated: 00000000.00000002.1667891216.0000000000F60000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667966851.0000000000FEF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667966851.0000000001015000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1668035777.000000000101F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1668053678.0000000001028000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f60000_tgBNtoWqIp.jbxd

Similarity

API ID: Menu$Item$CountCreateInfoInsertPopup_memset
String ID:
API String ID: 3311875123-0
Opcode ID: d3b851233f7ca1ce61fefde70b487ea524f6da5fa449c41ab6fcd00f85ae262f
Instruction ID: 0b097ec07715436e180ca61ce21068894a4b158894464d43ef53ba197a3a4d3e
Opcode Fuzzy Hash: d3b851233f7ca1ce61fefde70b487ea524f6da5fa449c41ab6fcd00f85ae262f
Instruction Fuzzy Hash: 85518C70A0034ADBDB64CF68DA8AFAEBBF4EF44324F14416EE4119B2D0D7718904EB51

Function 00F61765 Relevance: 9.1, APIs: 6, Instructions: 113COMMON

Download Yara Rule

APIs

Part of subcall function 00F62612: GetWindowLongW.USER32(?,000000EB), ref: 00F62623

BeginPaint.USER32(?,?,?,?,?,?), ref: 00F6179A
GetWindowRect.USER32(?,?), ref: 00F617FE
ScreenToClient.USER32(?,?), ref: 00F6181B
SetViewportOrgEx.GDI32(00000000,?,?,00000000), ref: 00F6182C
EndPaint.USER32(?,?), ref: 00F61876

Memory Dump Source

Source File: 00000000.00000002.1667912702.0000000000F61000.00000020.00000001.01000000.00000003.sdmp, Offset: 00F60000, based on PE: true

Associated: 00000000.00000002.1667891216.0000000000F60000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667966851.0000000000FEF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667966851.0000000001015000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1668035777.000000000101F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1668053678.0000000001028000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f60000_tgBNtoWqIp.jbxd

Similarity

API ID: PaintWindow$BeginClientLongRectScreenViewport
String ID:
API String ID: 1827037458-0
Opcode ID: 6d07934ff2fae211038d0e95ff6fd88bfe9dc5e0a0cac25e3e42e67adfac10a4
Instruction ID: eaf751049507e2eb22fe36af338fd9c95145addaf212414a21e7077edc01a55f
Opcode Fuzzy Hash: 6d07934ff2fae211038d0e95ff6fd88bfe9dc5e0a0cac25e3e42e67adfac10a4
Instruction Fuzzy Hash: 3041AD71500340AFDB21DF25DC84FBA7BE8FB4A724F180628F9958B2A1C7769C45EB61

Function 00FEB958 Relevance: 9.1, APIs: 6, Instructions: 109windowCOMMON

Download Yara Rule

APIs

ShowWindow.USER32(010267B0,00000000,01A857E0,?,?,010267B0,?,00FEB862,?,?), ref: 00FEB9CC
EnableWindow.USER32(00000000,00000000), ref: 00FEB9F0
ShowWindow.USER32(010267B0,00000000,01A857E0,?,?,010267B0,?,00FEB862,?,?), ref: 00FEBA50
ShowWindow.USER32(00000000,00000004,?,00FEB862,?,?), ref: 00FEBA62
EnableWindow.USER32(00000000,00000001), ref: 00FEBA86
SendMessageW.USER32(?,0000130C,?,00000000), ref: 00FEBAA9

Memory Dump Source

Source File: 00000000.00000002.1667912702.0000000000F61000.00000020.00000001.01000000.00000003.sdmp, Offset: 00F60000, based on PE: true

Associated: 00000000.00000002.1667891216.0000000000F60000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667966851.0000000000FEF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667966851.0000000001015000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1668035777.000000000101F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1668053678.0000000001028000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f60000_tgBNtoWqIp.jbxd

Similarity

API ID: Window$Show$Enable$MessageSend
String ID:
API String ID: 642888154-0
Opcode ID: 1570493404290b9a51e3cd46284557de683864786dd2adf91144dbbfb8a1b95e
Instruction ID: 2219f96bd6dc9d0d48b5c48aed5b80749b4597609a31dde1ba1fbcd293685d80
Opcode Fuzzy Hash: 1570493404290b9a51e3cd46284557de683864786dd2adf91144dbbfb8a1b95e
Instruction Fuzzy Hash: 2B416230A00285AFDB22CF55C4C9BA67BE1FF05721F1841B9EE488F2A3C735A845EB51

Function 00FD73B1 Relevance: 9.1, APIs: 6, Instructions: 97COMMON

Download Yara Rule

APIs

GetForegroundWindow.USER32(?,?,?,?,?,?,00FD5134,?,?,00000000,00000001), ref: 00FD73BF

Part of subcall function 00FD3C94: GetWindowRect.USER32(?,?), ref: 00FD3CA7

GetDesktopWindow.USER32 ref: 00FD73E9
GetWindowRect.USER32(00000000), ref: 00FD73F0
mouse_event.USER32(00008001,?,?,00000001,00000001), ref: 00FD7422

Part of subcall function 00FC54E6: Sleep.KERNEL32(?,00000000,?,?,?,?,?,?,?,?,?,?), ref: 00FC555E

GetCursorPos.USER32(?), ref: 00FD744E
mouse_event.USER32(00008001,?,?,00000000,00000000), ref: 00FD74AC

Memory Dump Source

Source File: 00000000.00000002.1667912702.0000000000F61000.00000020.00000001.01000000.00000003.sdmp, Offset: 00F60000, based on PE: true

Associated: 00000000.00000002.1667891216.0000000000F60000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667966851.0000000000FEF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667966851.0000000001015000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1668035777.000000000101F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1668053678.0000000001028000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f60000_tgBNtoWqIp.jbxd

Similarity

API ID: Window$Rectmouse_event$CursorDesktopForegroundSleep
String ID:
API String ID: 4137160315-0
Opcode ID: 5ee1426ff7f515342c2f7f486fa6ba722be66c794e19e2c25eeb1f6bc91dc875
Instruction ID: c57c8201453c6aae3d5a7a669884e8e8d8eb89df702949ce61da28b6e4dfa08e
Opcode Fuzzy Hash: 5ee1426ff7f515342c2f7f486fa6ba722be66c794e19e2c25eeb1f6bc91dc875
Instruction Fuzzy Hash: FC31063250834AABC720EF14CC49F5BBBEAFF89314F04091AF5889B191D770E948DB92

Function 00FB8D5B Relevance: 9.1, APIs: 6, Instructions: 69memoryCOMMON

Download Yara Rule

APIs

Part of subcall function 00FB85F1: GetTokenInformation.ADVAPI32(?,00000002,?,00000000,?), ref: 00FB8608
Part of subcall function 00FB85F1: GetLastError.KERNEL32(?,00000002,?,00000000,?), ref: 00FB8612
Part of subcall function 00FB85F1: GetProcessHeap.KERNEL32(00000008,?,?,00000002,?,00000000,?), ref: 00FB8621
Part of subcall function 00FB85F1: HeapAlloc.KERNEL32(00000000,?,00000002,?,00000000,?), ref: 00FB8628
Part of subcall function 00FB85F1: GetTokenInformation.ADVAPI32(?,00000002,00000000,?,?,?,00000002,?,00000000,?), ref: 00FB863E

GetLengthSid.ADVAPI32(?,00000000,00FB8977), ref: 00FB8DAC
GetProcessHeap.KERNEL32(00000008,00000000), ref: 00FB8DB8
HeapAlloc.KERNEL32(00000000), ref: 00FB8DBF
CopySid.ADVAPI32(00000000,00000000,?), ref: 00FB8DD8
GetProcessHeap.KERNEL32(00000000,00000000,00FB8977), ref: 00FB8DEC
HeapFree.KERNEL32(00000000), ref: 00FB8DF3

Memory Dump Source

Source File: 00000000.00000002.1667912702.0000000000F61000.00000020.00000001.01000000.00000003.sdmp, Offset: 00F60000, based on PE: true

Associated: 00000000.00000002.1667891216.0000000000F60000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667966851.0000000000FEF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667966851.0000000001015000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1668035777.000000000101F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1668053678.0000000001028000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f60000_tgBNtoWqIp.jbxd

Similarity

API ID: Heap$Process$AllocInformationToken$CopyErrorFreeLastLength
String ID:
API String ID: 3008561057-0
Opcode ID: f9bd727dd2ae69fdf3b31646f9eca7f9f6b47cac02aa4e77ec175e4d28a4452e
Instruction ID: 75ebf9151a346fbbdc26e000be78e7efab5c92a21e91e5e476f5cb5feeaefdbd
Opcode Fuzzy Hash: f9bd727dd2ae69fdf3b31646f9eca7f9f6b47cac02aa4e77ec175e4d28a4452e
Instruction Fuzzy Hash: 7C11E131901608FFDF108F65CC48BEE776DEF893A6F10402AE84597291CB359905EF60

Function 00FB8AF9 Relevance: 9.1, APIs: 6, Instructions: 65processCOMMON

Download Yara Rule

APIs

GetCurrentProcess.KERNEL32(0000000A,00000004), ref: 00FB8B2A
OpenProcessToken.ADVAPI32(00000000), ref: 00FB8B31
CreateEnvironmentBlock.USERENV(?,00000004,00000001), ref: 00FB8B40
CloseHandle.KERNEL32(00000004), ref: 00FB8B4B
CreateProcessWithLogonW.ADVAPI32(?,?,?,00000000,00000000,?,?,00000000,?,?,?), ref: 00FB8B7A
DestroyEnvironmentBlock.USERENV(00000000), ref: 00FB8B8E

Memory Dump Source

Source File: 00000000.00000002.1667912702.0000000000F61000.00000020.00000001.01000000.00000003.sdmp, Offset: 00F60000, based on PE: true

Associated: 00000000.00000002.1667891216.0000000000F60000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667966851.0000000000FEF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667966851.0000000001015000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1668035777.000000000101F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1668053678.0000000001028000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f60000_tgBNtoWqIp.jbxd

Similarity

API ID: Process$BlockCreateEnvironment$CloseCurrentDestroyHandleLogonOpenTokenWith
String ID:
API String ID: 1413079979-0
Opcode ID: 7d192a2578dc9354b47ee013b68c4e8f2e5bddfd0ed321812209c331972cc2e7
Instruction ID: 17473a759d142fb77c8504c478b6b96b0a95a978896bb8915c6b7ba1e83fdf0b
Opcode Fuzzy Hash: 7d192a2578dc9354b47ee013b68c4e8f2e5bddfd0ed321812209c331972cc2e7
Instruction Fuzzy Hash: 3C114AB250124DABDB018FA5ED49FDA7BADEF88358F044064FA04A6160C7718E65EB60

Function 00FEC19A Relevance: 9.0, APIs: 6, Instructions: 49COMMON

Download Yara Rule

APIs

Part of subcall function 00F612F3: ExtCreatePen.GDI32(?,?,00000000,00000000,00000000,?,00000000), ref: 00F6134D
Part of subcall function 00F612F3: SelectObject.GDI32(?,00000000), ref: 00F6135C
Part of subcall function 00F612F3: BeginPath.GDI32(?), ref: 00F61373
Part of subcall function 00F612F3: SelectObject.GDI32(?,00000000), ref: 00F6139C

MoveToEx.GDI32(00000000,-00000002,?,00000000), ref: 00FEC1C4
LineTo.GDI32(00000000,00000003,?), ref: 00FEC1D8
MoveToEx.GDI32(00000000,00000000,?,00000000), ref: 00FEC1E6
LineTo.GDI32(00000000,00000000,?), ref: 00FEC1F6
EndPath.GDI32(00000000), ref: 00FEC206
StrokePath.GDI32(00000000), ref: 00FEC216

Memory Dump Source

Source File: 00000000.00000002.1667912702.0000000000F61000.00000020.00000001.01000000.00000003.sdmp, Offset: 00F60000, based on PE: true

Associated: 00000000.00000002.1667891216.0000000000F60000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667966851.0000000000FEF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667966851.0000000001015000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1668035777.000000000101F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1668053678.0000000001028000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f60000_tgBNtoWqIp.jbxd

Similarity

API ID: Path$LineMoveObjectSelect$BeginCreateStroke
String ID:
API String ID: 43455801-0
Opcode ID: adb6c55ec7bc5fbc1c5d620b18ab991055d1040534f4daa0483b6d7423e962ce
Instruction ID: 8ef91cecad04c9b37d9bfbc0631d1c48256492be8afda96c07937cd94a8cffdc
Opcode Fuzzy Hash: adb6c55ec7bc5fbc1c5d620b18ab991055d1040534f4daa0483b6d7423e962ce
Instruction Fuzzy Hash: 1011097640014CBFDB119F91DC88EAA7FADEB08364F048025FA188A161C7729E59EBA0

Function 00F803A2 Relevance: 9.0, APIs: 6, Instructions: 44keyboardCOMMON

Download Yara Rule

APIs

MapVirtualKeyW.USER32(0000005B,00000000), ref: 00F803D3
MapVirtualKeyW.USER32(00000010,00000000), ref: 00F803DB
MapVirtualKeyW.USER32(000000A0,00000000), ref: 00F803E6
MapVirtualKeyW.USER32(000000A1,00000000), ref: 00F803F1
MapVirtualKeyW.USER32(00000011,00000000), ref: 00F803F9
MapVirtualKeyW.USER32(00000012,00000000), ref: 00F80401

Memory Dump Source

Source File: 00000000.00000002.1667912702.0000000000F61000.00000020.00000001.01000000.00000003.sdmp, Offset: 00F60000, based on PE: true

Associated: 00000000.00000002.1667891216.0000000000F60000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667966851.0000000000FEF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667966851.0000000001015000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1668035777.000000000101F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1668053678.0000000001028000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f60000_tgBNtoWqIp.jbxd

Similarity

API ID: Virtual
String ID:
API String ID: 4278518827-0
Opcode ID: 15b74b1b4fe4f7e41e6ad27789e9ab1f9c8cdfefaa08d4e24601faedb97b1f02
Instruction ID: 6b6b98f33abeb5c106c7d7b958ce25a675de3bd843a406afe56e0fa7f1ab5e81
Opcode Fuzzy Hash: 15b74b1b4fe4f7e41e6ad27789e9ab1f9c8cdfefaa08d4e24601faedb97b1f02
Instruction Fuzzy Hash: DB016CB09017597DE3008F5A8C85B52FFA8FF19354F00411BA15C4B941C7F5A868CBE5

Function 00FC568B Relevance: 9.0, APIs: 6, Instructions: 43windowtimethreadCOMMON

Download Yara Rule

APIs

PostMessageW.USER32(?,00000010,00000000,00000000), ref: 00FC569B
SendMessageTimeoutW.USER32(?,00000010,00000000,00000000,00000002,000001F4,?), ref: 00FC56B1
GetWindowThreadProcessId.USER32(?,?), ref: 00FC56C0
OpenProcess.KERNEL32(001F0FFF,00000000,?,?,?,?,00000010,00000000,00000000,00000002,000001F4,?,?,00000010,00000000,00000000), ref: 00FC56CF
TerminateProcess.KERNEL32(00000000,00000000,?,?,?,00000010,00000000,00000000,00000002,000001F4,?,?,00000010,00000000,00000000), ref: 00FC56D9
CloseHandle.KERNEL32(00000000,?,?,?,00000010,00000000,00000000,00000002,000001F4,?,?,00000010,00000000,00000000), ref: 00FC56E0

Memory Dump Source

Source File: 00000000.00000002.1667912702.0000000000F61000.00000020.00000001.01000000.00000003.sdmp, Offset: 00F60000, based on PE: true

Associated: 00000000.00000002.1667891216.0000000000F60000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667966851.0000000000FEF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667966851.0000000001015000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1668035777.000000000101F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1668053678.0000000001028000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f60000_tgBNtoWqIp.jbxd

Similarity

API ID: Process$Message$CloseHandleOpenPostSendTerminateThreadTimeoutWindow
String ID:
API String ID: 839392675-0
Opcode ID: abc30061a31aab2d7d9c2445993720c664f8faf3bba5818ccd979022879e446a
Instruction ID: a73f9003920894f390c177fb9b01f701fa02d7d8682714195865ab1e67ba7398
Opcode Fuzzy Hash: abc30061a31aab2d7d9c2445993720c664f8faf3bba5818ccd979022879e446a
Instruction Fuzzy Hash: 22F0903224119CBBE7205BA2DC4EEEF7B7CEFC6B11F000169FA00D50A0D7A01A05A6B5

Function 00FC74D2 Relevance: 9.0, APIs: 6, Instructions: 33synchronizationthreadCOMMONLIBRARYCODE

Download Yara Rule

APIs

InterlockedExchange.KERNEL32(?,?), ref: 00FC74E5
EnterCriticalSection.KERNEL32(?,?,00F71044,?,?), ref: 00FC74F6
TerminateThread.KERNEL32(00000000,000001F6,?,00F71044,?,?), ref: 00FC7503
WaitForSingleObject.KERNEL32(00000000,000003E8,?,00F71044,?,?), ref: 00FC7510

Part of subcall function 00FC6ED7: CloseHandle.KERNEL32(00000000,?,00FC751D,?,00F71044,?,?), ref: 00FC6EE1

InterlockedExchange.KERNEL32(?,000001F6), ref: 00FC7523
LeaveCriticalSection.KERNEL32(?,?,00F71044,?,?), ref: 00FC752A

Memory Dump Source

Source File: 00000000.00000002.1667912702.0000000000F61000.00000020.00000001.01000000.00000003.sdmp, Offset: 00F60000, based on PE: true

Associated: 00000000.00000002.1667891216.0000000000F60000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667966851.0000000000FEF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667966851.0000000001015000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1668035777.000000000101F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1668053678.0000000001028000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f60000_tgBNtoWqIp.jbxd

Similarity

API ID: CriticalExchangeInterlockedSection$CloseEnterHandleLeaveObjectSingleTerminateThreadWait
String ID:
API String ID: 3495660284-0
Opcode ID: 15b944f8fdb40cd15d364b3846e736b40cd88dac1fb7112a78c411562be47a1a
Instruction ID: 50c8e3e97713d7da0681c9954ca3c48a1c7a337fa36b62bb4e6d4220be88635e
Opcode Fuzzy Hash: 15b944f8fdb40cd15d364b3846e736b40cd88dac1fb7112a78c411562be47a1a
Instruction Fuzzy Hash: 4BF0BE3A841716EBDB112B24FDCDEEB372AEF45312B010536F202990B0CB751904EB50

Function 00FB8E74 Relevance: 9.0, APIs: 6, Instructions: 23memorysynchronizationCOMMON

Download Yara Rule

APIs

WaitForSingleObject.KERNEL32(?,000000FF), ref: 00FB8E7F
UnloadUserProfile.USERENV(?,?), ref: 00FB8E8B
CloseHandle.KERNEL32(?), ref: 00FB8E94
CloseHandle.KERNEL32(?), ref: 00FB8E9C
GetProcessHeap.KERNEL32(00000000,?), ref: 00FB8EA5
HeapFree.KERNEL32(00000000), ref: 00FB8EAC

Memory Dump Source

Source File: 00000000.00000002.1667912702.0000000000F61000.00000020.00000001.01000000.00000003.sdmp, Offset: 00F60000, based on PE: true

Associated: 00000000.00000002.1667891216.0000000000F60000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667966851.0000000000FEF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667966851.0000000001015000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1668035777.000000000101F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1668053678.0000000001028000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f60000_tgBNtoWqIp.jbxd

Similarity

API ID: CloseHandleHeap$FreeObjectProcessProfileSingleUnloadUserWait
String ID:
API String ID: 146765662-0
Opcode ID: a50badaac7900717a49a4f84df06479854e5cebf292282424b8dd365d913863d
Instruction ID: d3c1ca235203e48b61118f9d7174927692239fa213c959d1931517d8e5491aeb
Opcode Fuzzy Hash: a50badaac7900717a49a4f84df06479854e5cebf292282424b8dd365d913863d
Instruction Fuzzy Hash: 4AE0C236004049FFDA011FE1EC4C90ABB69FB89322B108230F219890B0CB369468EB50

Function 00FD8902 Relevance: 9.0, APIs: 3, Strings: 2, Instructions: 225COMMON

Download Yara Rule

APIs

VariantInit.OLEAUT32(?), ref: 00FD8928
CharUpperBuffW.USER32(?,?), ref: 00FD8A37
VariantClear.OLEAUT32(?), ref: 00FD8BAF

Part of subcall function 00FC7804: VariantInit.OLEAUT32(00000000), ref: 00FC7844
Part of subcall function 00FC7804: VariantCopy.OLEAUT32(00000000,?), ref: 00FC784D
Part of subcall function 00FC7804: VariantClear.OLEAUT32(00000000), ref: 00FC7859

Strings

AUTOIT.ERROR, xrefs: 00FD8A3D
Incorrect Parameter format, xrefs: 00FD8960, 00FD8B22

Memory Dump Source

Source File: 00000000.00000002.1667912702.0000000000F61000.00000020.00000001.01000000.00000003.sdmp, Offset: 00F60000, based on PE: true

Associated: 00000000.00000002.1667891216.0000000000F60000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667966851.0000000000FEF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667966851.0000000001015000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1668035777.000000000101F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1668053678.0000000001028000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f60000_tgBNtoWqIp.jbxd

Similarity

API ID: Variant$ClearInit$BuffCharCopyUpper
String ID: AUTOIT.ERROR$Incorrect Parameter format
API String ID: 4237274167-1221869570
Opcode ID: 40798ee3e6bb78296689eaa4f7bf8289e4a6feff0bcb6a4f96b2c6449af2eef5
Instruction ID: ca7880269c173b8bb013321394836e55d9b5500af30edc63aaa76e33caffc75a
Opcode Fuzzy Hash: 40798ee3e6bb78296689eaa4f7bf8289e4a6feff0bcb6a4f96b2c6449af2eef5
Instruction Fuzzy Hash: 71918F71608301DFC700EF24C88195ABBE5EFC9754F08496EF8968B362DB35E906DB52

Function 00FC2F86 Relevance: 8.9, APIs: 4, Strings: 1, Instructions: 195windowCOMMON

Download Yara Rule

APIs

Part of subcall function 00F7FEC6: _wcscpy.LIBCMT ref: 00F7FEE9

_memset.LIBCMT ref: 00FC3077
GetMenuItemInfoW.USER32(?,?,00000000,?), ref: 00FC30A6
SetMenuItemInfoW.USER32(?,?,00000000,?), ref: 00FC3159
SetMenuDefaultItem.USER32(?,000000FF,00000000), ref: 00FC3187

Strings

0, xrefs: 00FC3063

Memory Dump Source

Source File: 00000000.00000002.1667912702.0000000000F61000.00000020.00000001.01000000.00000003.sdmp, Offset: 00F60000, based on PE: true

Associated: 00000000.00000002.1667891216.0000000000F60000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667966851.0000000000FEF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667966851.0000000001015000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1668035777.000000000101F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1668053678.0000000001028000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f60000_tgBNtoWqIp.jbxd

Similarity

API ID: ItemMenu$Info$Default_memset_wcscpy
String ID: 0
API String ID: 4152858687-4108050209
Opcode ID: bfdadc01116270853c1db850267ff4affdef71da0f732737d28d79b4ea3a2649
Instruction ID: b4dfd167f4e1e2cecefe37040afba5aafffcaee239f72c511e4291291dab006f
Opcode Fuzzy Hash: bfdadc01116270853c1db850267ff4affdef71da0f732737d28d79b4ea3a2649
Instruction Fuzzy Hash: 7551E372E083029ED7259F24CE46F6B77E4EF443A4F088A2DF885D2191DB75CE44A752

Function 00FBDA5D Relevance: 8.9, APIs: 4, Strings: 1, Instructions: 121comlibraryloaderCOMMON

Download Yara Rule

APIs

CoCreateInstance.OLE32(?,00000000,00000005,?,?,?,?,?,?,?,?,?,?,?), ref: 00FBDAC5
SetErrorMode.KERNEL32(00000001,?,?,?,?,?,?,?,?,?), ref: 00FBDAFB
GetProcAddress.KERNEL32(?,DllGetClassObject), ref: 00FBDB0C
SetErrorMode.KERNEL32(00000000,?,?,?,?,?,?,?,?,?), ref: 00FBDB8E

Strings

DllGetClassObject, xrefs: 00FBDB01

Memory Dump Source

Source File: 00000000.00000002.1667912702.0000000000F61000.00000020.00000001.01000000.00000003.sdmp, Offset: 00F60000, based on PE: true

Associated: 00000000.00000002.1667891216.0000000000F60000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667966851.0000000000FEF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667966851.0000000001015000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1668035777.000000000101F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1668053678.0000000001028000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f60000_tgBNtoWqIp.jbxd

Similarity

API ID: ErrorMode$AddressCreateInstanceProc
String ID: DllGetClassObject
API String ID: 753597075-1075368562
Opcode ID: 84c564d5864a85ca1a7641607eb5de8ac919d36f1b83473e59cdec9f43cbd0ac
Instruction ID: 0f7c130864c83ee8c1ae0b6851d51cb24453b5b04fa1df37b177736e27c6b61c
Opcode Fuzzy Hash: 84c564d5864a85ca1a7641607eb5de8ac919d36f1b83473e59cdec9f43cbd0ac
Instruction Fuzzy Hash: 3141B2B1600208DFDB04CF56C884ADA7BB9EF84310F1580ADAD099F255E7B5DE44EFA1

Function 00FC2C42 Relevance: 8.9, APIs: 4, Strings: 1, Instructions: 114windowCOMMON

Download Yara Rule

APIs

_memset.LIBCMT ref: 00FC2CAF
GetMenuItemInfoW.USER32(00000004,00000000,00000000,?), ref: 00FC2CCB
DeleteMenu.USER32(?,00000007,00000000), ref: 00FC2D11
DeleteMenu.USER32(?,00000000,00000000,?,00000000,00000000,01026890,00000000), ref: 00FC2D5A

Strings

0, xrefs: 00FC2CA4

Memory Dump Source

Source File: 00000000.00000002.1667912702.0000000000F61000.00000020.00000001.01000000.00000003.sdmp, Offset: 00F60000, based on PE: true

Associated: 00000000.00000002.1667891216.0000000000F60000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667966851.0000000000FEF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667966851.0000000001015000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1668035777.000000000101F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1668053678.0000000001028000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f60000_tgBNtoWqIp.jbxd

Similarity

API ID: Menu$Delete$InfoItem_memset
String ID: 0
API String ID: 1173514356-4108050209
Opcode ID: 3898fdb9a9716c2b961796a3765d266cce08133a7907f75b02c1c9c19b67c497
Instruction ID: 9b9b13b93de70dd2abd71fdcb0ecfa13c94b10d79b96ba7963f94b456ee772c9
Opcode Fuzzy Hash: 3898fdb9a9716c2b961796a3765d266cce08133a7907f75b02c1c9c19b67c497
Instruction Fuzzy Hash: D541C2716043029FD720DF24CD86F1ABBE4EF95320F14462DF96697291D770E904DB92

Function 00FC0FE6 Relevance: 8.9, APIs: 4, Strings: 1, Instructions: 105keyboardwindowCOMMON

Download Yara Rule

APIs

GetKeyboardState.USER32(?,00000000,?,00000001), ref: 00FC1037
SetKeyboardState.USER32(00000080,?,00000001), ref: 00FC1053
PostMessageW.USER32(00000000,00000102,00000001,00000001), ref: 00FC10B9
SendInput.USER32(00000001,00000000,0000001C,00000000,?,00000001), ref: 00FC110B

Strings

-es, xrefs: 00FC106D

Memory Dump Source

Source File: 00000000.00000002.1667912702.0000000000F61000.00000020.00000001.01000000.00000003.sdmp, Offset: 00F60000, based on PE: true

Associated: 00000000.00000002.1667891216.0000000000F60000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667966851.0000000000FEF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667966851.0000000001015000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1668035777.000000000101F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1668053678.0000000001028000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f60000_tgBNtoWqIp.jbxd

Similarity

API ID: KeyboardState$InputMessagePostSend
String ID: -es
API String ID: 432972143-508736453
Opcode ID: 398d9dac1bbf2b1710cb09836382010f7fd615393eca60ae6c86a0efecddac3a
Instruction ID: 7b0a5939af436b36d14e865baeaeb1c5da349b2d982c9d9aa0223db116803a6e
Opcode Fuzzy Hash: 398d9dac1bbf2b1710cb09836382010f7fd615393eca60ae6c86a0efecddac3a
Instruction Fuzzy Hash: 60312A31E8068A9AFB348A258D07FF9BBA9BF46320F08431EE581521D2C37549E5B751

Function 00FC1121 Relevance: 8.9, APIs: 4, Strings: 1, Instructions: 101keyboardwindowCOMMON

Download Yara Rule

APIs

GetKeyboardState.USER32(?,75C0C0D0,?,00008000), ref: 00FC1176
SetKeyboardState.USER32(00000080,?,00008000), ref: 00FC1192
PostMessageW.USER32(00000000,00000101,00000000), ref: 00FC11F1
SendInput.USER32(00000001,?,0000001C,75C0C0D0,?,00008000), ref: 00FC1243

Strings

-es, xrefs: 00FC11AF

Memory Dump Source

Source File: 00000000.00000002.1667912702.0000000000F61000.00000020.00000001.01000000.00000003.sdmp, Offset: 00F60000, based on PE: true

Associated: 00000000.00000002.1667891216.0000000000F60000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667966851.0000000000FEF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667966851.0000000001015000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1668035777.000000000101F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1668053678.0000000001028000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f60000_tgBNtoWqIp.jbxd

Similarity

API ID: KeyboardState$InputMessagePostSend
String ID: -es
API String ID: 432972143-508736453
Opcode ID: f3af25a5ea999b66dbb5da46a599ce401fbda57a168f8251e58fd17180358160
Instruction ID: c7fedbd1d3f7623e84955c611d55d9898a8400881359c67846a89f3c186ba3c7
Opcode Fuzzy Hash: f3af25a5ea999b66dbb5da46a599ce401fbda57a168f8251e58fd17180358160
Instruction Fuzzy Hash: E9313930D4024E9AFF348A658D0AFFABB6DBB46320F18431EE580921D2C3384965B751

Function 00FDDAB9 Relevance: 8.9, APIs: 1, Strings: 4, Instructions: 101COMMON

Download Yara Rule

APIs

CharLowerBuffW.USER32(?,?,?,?,00000000,?,?), ref: 00FDDAD9

Part of subcall function 00F679AB: _memmove.LIBCMT ref: 00F679F9

Strings

winapi, xrefs: 00FDDB4A
stdcall, xrefs: 00FDDB5B
cdecl, xrefs: 00FDDB30
none, xrefs: 00FDDBB4

Memory Dump Source

Source File: 00000000.00000002.1667912702.0000000000F61000.00000020.00000001.01000000.00000003.sdmp, Offset: 00F60000, based on PE: true

Associated: 00000000.00000002.1667891216.0000000000F60000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667966851.0000000000FEF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667966851.0000000001015000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1668035777.000000000101F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1668053678.0000000001028000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f60000_tgBNtoWqIp.jbxd

Similarity

API ID: BuffCharLower_memmove
String ID: cdecl$none$stdcall$winapi
API String ID: 3425801089-567219261
Opcode ID: 388b6bd25dea56b14a33ac2d63d1accc9b80029519751dbe9f8c0c8f0a9f225a
Instruction ID: 0e3ee7f92b20790e01b8b97cce08009cc148ab43e4b67ed17c2744c38d565edd
Opcode Fuzzy Hash: 388b6bd25dea56b14a33ac2d63d1accc9b80029519751dbe9f8c0c8f0a9f225a
Instruction Fuzzy Hash: 6931E671A0061AAFCF10EF54CC809EEB3B5FF44724B04861AE865AB7D5CB35A909DB80

Function 00FB9372 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 94windowCOMMON

Download Yara Rule

APIs

Part of subcall function 00F67F41: _memmove.LIBCMT ref: 00F67F82

Part of subcall function 00FBB0C4: GetClassNameW.USER32(?,?,000000FF), ref: 00FBB0E7

SendMessageW.USER32(?,00000188,00000000,00000000), ref: 00FB93F6
SendMessageW.USER32(?,0000018A,00000000,00000000), ref: 00FB9409
SendMessageW.USER32(?,00000189,?,00000000), ref: 00FB9439

Part of subcall function 00F67D2C: _memmove.LIBCMT ref: 00F67D66

Strings

ListBox, xrefs: 00FB93B5
ComboBox, xrefs: 00FB9380

Memory Dump Source

Source File: 00000000.00000002.1667912702.0000000000F61000.00000020.00000001.01000000.00000003.sdmp, Offset: 00F60000, based on PE: true

Associated: 00000000.00000002.1667891216.0000000000F60000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667966851.0000000000FEF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667966851.0000000001015000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1668035777.000000000101F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1668053678.0000000001028000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f60000_tgBNtoWqIp.jbxd

Similarity

API ID: MessageSend$_memmove$ClassName
String ID: ComboBox$ListBox
API String ID: 365058703-1403004172
Opcode ID: 4e540ce8d433bb1acc6e4bb2771f1182bf29de479d208f4786ebf4113d20d5c4
Instruction ID: 92a2f431020d5a9f1a22bd0f5c1b2dbc8d121e0d0db5a24236cd8005ce23744f
Opcode Fuzzy Hash: 4e540ce8d433bb1acc6e4bb2771f1182bf29de479d208f4786ebf4113d20d5c4
Instruction Fuzzy Hash: 1821F671D04208BBDB14ABB2CC85DFFB77CDF05760B148119FA25A71E1DB794A0ABA20

Function 00FD1B21 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 86networkCOMMON

Download Yara Rule

APIs

InternetOpenUrlW.WININET(?,?,00000000,00000000,?,00000000), ref: 00FD1B40
HttpSendRequestW.WININET(00000000,00000000,00000000,00000000,00000000), ref: 00FD1B66
HttpQueryInfoW.WININET(00000000,00000005,?,?,?), ref: 00FD1B96
InternetCloseHandle.WININET(00000000), ref: 00FD1BDD

Part of subcall function 00FD2777: GetLastError.KERNEL32(?,?,00FD1B0B,00000000,00000000,00000001), ref: 00FD278C
Part of subcall function 00FD2777: SetEvent.KERNEL32(?,?,00FD1B0B,00000000,00000000,00000001), ref: 00FD27A1

Strings

, xrefs: 00FD1B87

Memory Dump Source

Source File: 00000000.00000002.1667912702.0000000000F61000.00000020.00000001.01000000.00000003.sdmp, Offset: 00F60000, based on PE: true

Associated: 00000000.00000002.1667891216.0000000000F60000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667966851.0000000000FEF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667966851.0000000001015000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1668035777.000000000101F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1668053678.0000000001028000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f60000_tgBNtoWqIp.jbxd

Similarity

API ID: HttpInternet$CloseErrorEventHandleInfoLastOpenQueryRequestSend
String ID:
API String ID: 3113390036-3916222277
Opcode ID: 0bb55d29ab210a944b1d15277a20be2da6b3397ef4c68ab4a138a5a68ba259da
Instruction ID: 5b4f6f4b53c129c26db7e40e29bd52aca7b8149f9f893c165ce1b789bcae6ca2
Opcode Fuzzy Hash: 0bb55d29ab210a944b1d15277a20be2da6b3397ef4c68ab4a138a5a68ba259da
Instruction Fuzzy Hash: 03218EB260020CBFEB219F609CC5EBF76EEFB89754F14412BF505A7240EA349D05A7A1

Function 00FE6656 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 80windowlibraryCOMMON

Download Yara Rule

APIs

Part of subcall function 00F61D35: CreateWindowExW.USER32(?,?,?,?,?,?,?,?,?,?,00000000,00000096), ref: 00F61D73
Part of subcall function 00F61D35: GetStockObject.GDI32(00000011), ref: 00F61D87
Part of subcall function 00F61D35: SendMessageW.USER32(00000000,00000030,00000000), ref: 00F61D91

SendMessageW.USER32(00000000,00000467,00000000,?), ref: 00FE66D0
LoadLibraryW.KERNEL32(?), ref: 00FE66D7
SendMessageW.USER32(?,00000467,00000000,00000000), ref: 00FE66EC
DestroyWindow.USER32(?), ref: 00FE66F4

Strings

SysAnimate32, xrefs: 00FE66AB

Memory Dump Source

Source File: 00000000.00000002.1667912702.0000000000F61000.00000020.00000001.01000000.00000003.sdmp, Offset: 00F60000, based on PE: true

Associated: 00000000.00000002.1667891216.0000000000F60000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667966851.0000000000FEF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667966851.0000000001015000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1668035777.000000000101F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1668053678.0000000001028000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f60000_tgBNtoWqIp.jbxd

Similarity

API ID: MessageSend$Window$CreateDestroyLibraryLoadObjectStock
String ID: SysAnimate32
API String ID: 4146253029-1011021900
Opcode ID: 3484148da0303b826b1a2a2adb7e1af611f76c7dc121b05001c0f1b2519e7f42
Instruction ID: a0239adecded754eeac445170c9151dc45a3b420238329aa52a04d84dab09065
Opcode Fuzzy Hash: 3484148da0303b826b1a2a2adb7e1af611f76c7dc121b05001c0f1b2519e7f42
Instruction Fuzzy Hash: AF21BE7151028DAFEF104F66EC80EAB37A9EB693B8F100229F910DA190D7718C40A760

Function 00FC703E Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 79filepipeCOMMON

Download Yara Rule

APIs

GetStdHandle.KERNEL32(0000000C), ref: 00FC705E
CreatePipe.KERNEL32(?,?,0000000C,00000000), ref: 00FC7091
GetStdHandle.KERNEL32(0000000C), ref: 00FC70A3
CreateFileW.KERNEL32(nul,40000000,00000002,0000000C,00000003,00000080,00000000), ref: 00FC70DD

Strings

nul, xrefs: 00FC70D8

Memory Dump Source

Source File: 00000000.00000002.1667912702.0000000000F61000.00000020.00000001.01000000.00000003.sdmp, Offset: 00F60000, based on PE: true

Associated: 00000000.00000002.1667891216.0000000000F60000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667966851.0000000000FEF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667966851.0000000001015000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1668035777.000000000101F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1668053678.0000000001028000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f60000_tgBNtoWqIp.jbxd

Similarity

API ID: CreateHandle$FilePipe
String ID: nul
API String ID: 4209266947-2873401336
Opcode ID: 23aee6f1e7f23ad087cf9e0b8bab9e7f17b5d1f8a564626cc19f8c216353b5ba
Instruction ID: b83fa107a75030e7f9e13d9860ba27d963941ddce5ce4fc9254035f8d9ecc535
Opcode Fuzzy Hash: 23aee6f1e7f23ad087cf9e0b8bab9e7f17b5d1f8a564626cc19f8c216353b5ba
Instruction Fuzzy Hash: 4D217F7594430AABDB20AF29DD46F9A77A8AF44720F20461DFDA1D72D0EB719840EB50

Function 00FC710C Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 79filepipeCOMMON

Download Yara Rule

APIs

GetStdHandle.KERNEL32(000000F6), ref: 00FC712B
CreatePipe.KERNEL32(?,?,0000000C,00000000), ref: 00FC715D
GetStdHandle.KERNEL32(000000F6), ref: 00FC716E
CreateFileW.KERNEL32(nul,80000000,00000001,0000000C,00000003,00000080,00000000), ref: 00FC71A8

Strings

nul, xrefs: 00FC71A3

Memory Dump Source

Source File: 00000000.00000002.1667912702.0000000000F61000.00000020.00000001.01000000.00000003.sdmp, Offset: 00F60000, based on PE: true

Associated: 00000000.00000002.1667891216.0000000000F60000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667966851.0000000000FEF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667966851.0000000001015000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1668035777.000000000101F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1668053678.0000000001028000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f60000_tgBNtoWqIp.jbxd

Similarity

API ID: CreateHandle$FilePipe
String ID: nul
API String ID: 4209266947-2873401336
Opcode ID: 7f304d3c5da0cc6e9e120927af5b574fa4cd6e2ae30edd9ca354a0c2f201eaab
Instruction ID: 674be7d44d8744704c57f25912acef18175130882a49760a86657aff01da2524
Opcode Fuzzy Hash: 7f304d3c5da0cc6e9e120927af5b574fa4cd6e2ae30edd9ca354a0c2f201eaab
Instruction Fuzzy Hash: 2321C47590830B9BDB20AF689D46F9AB7A8AF85330F24061DFDA0D72D0D7709841EF50

Function 00FCAEAB Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 73COMMON

Download Yara Rule

APIs

SetErrorMode.KERNEL32(00000001), ref: 00FCAEBF
GetVolumeInformationW.KERNEL32(?,?,00007FFF,?,00000000,00000000,00000000,00000000), ref: 00FCAF13
__swprintf.LIBCMT ref: 00FCAF2C
SetErrorMode.KERNEL32(00000000,00000001,00000000,00FEF910), ref: 00FCAF6A

Strings

%lu, xrefs: 00FCAF26

Memory Dump Source

Source File: 00000000.00000002.1667912702.0000000000F61000.00000020.00000001.01000000.00000003.sdmp, Offset: 00F60000, based on PE: true

Associated: 00000000.00000002.1667891216.0000000000F60000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667966851.0000000000FEF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667966851.0000000001015000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1668035777.000000000101F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1668053678.0000000001028000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f60000_tgBNtoWqIp.jbxd

Similarity

API ID: ErrorMode$InformationVolume__swprintf
String ID: %lu
API String ID: 3164766367-685833217
Opcode ID: 7c73eca23fce8925d1eeaf0536bc5aae627d126b40d076895280c4f172cd4212
Instruction ID: 58a942e2bc18b7f3518d1d975be476978cd7217c2f07eebc4c405ebb1853dc27
Opcode Fuzzy Hash: 7c73eca23fce8925d1eeaf0536bc5aae627d126b40d076895280c4f172cd4212
Instruction Fuzzy Hash: 70218331A0014DAFCB10EF65CD85EEE7BB8EF89704B004069F909EB251DB75EA45EB21

Function 00FBA52F Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 68windowCOMMON

Download Yara Rule

APIs

Part of subcall function 00F67D2C: _memmove.LIBCMT ref: 00F67D66

Part of subcall function 00FBA37C: SendMessageTimeoutW.USER32(?,00000000,00000000,00000000,00000002,00001388,00000001), ref: 00FBA399
Part of subcall function 00FBA37C: GetWindowThreadProcessId.USER32(?,00000000), ref: 00FBA3AC
Part of subcall function 00FBA37C: GetCurrentThreadId.KERNEL32 ref: 00FBA3B3
Part of subcall function 00FBA37C: AttachThreadInput.USER32(00000000), ref: 00FBA3BA

GetFocus.USER32 ref: 00FBA554

Part of subcall function 00FBA3C5: GetParent.USER32(?), ref: 00FBA3D3

GetClassNameW.USER32(?,?,00000100), ref: 00FBA59D
EnumChildWindows.USER32(?,00FBA615), ref: 00FBA5C5
__swprintf.LIBCMT ref: 00FBA5DF

Strings

%s%d, xrefs: 00FBA5D9

Memory Dump Source

Source File: 00000000.00000002.1667912702.0000000000F61000.00000020.00000001.01000000.00000003.sdmp, Offset: 00F60000, based on PE: true

Associated: 00000000.00000002.1667891216.0000000000F60000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667966851.0000000000FEF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667966851.0000000001015000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1668035777.000000000101F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1668053678.0000000001028000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f60000_tgBNtoWqIp.jbxd

Similarity

API ID: Thread$AttachChildClassCurrentEnumFocusInputMessageNameParentProcessSendTimeoutWindowWindows__swprintf_memmove
String ID: %s%d
API String ID: 1941087503-1110647743
Opcode ID: 323007c830ba4a0f5c2068fbc5833b363d1934bedf55c5bf9e9ff31fc07d8f0e
Instruction ID: 9b8f98f0bc7e948f0ca94f97f112b0213f2d80570f8572c336429bae6fbcb953
Opcode Fuzzy Hash: 323007c830ba4a0f5c2068fbc5833b363d1934bedf55c5bf9e9ff31fc07d8f0e
Instruction Fuzzy Hash: 8211B4716003087BDF117F61DC85FEA37B99F48710F044075BA18AA152CA759945AF75

Function 00FC2017 Relevance: 8.8, APIs: 1, Strings: 4, Instructions: 49COMMON

Download Yara Rule

APIs

CharUpperBuffW.USER32(?,?), ref: 00FC2048

Strings

EXISTS, xrefs: 00FC2070
REMOVE, xrefs: 00FC204E
APPEND, xrefs: 00FC2081
KEYS, xrefs: 00FC205F

Memory Dump Source

Source File: 00000000.00000002.1667912702.0000000000F61000.00000020.00000001.01000000.00000003.sdmp, Offset: 00F60000, based on PE: true

Associated: 00000000.00000002.1667891216.0000000000F60000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667966851.0000000000FEF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667966851.0000000001015000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1668035777.000000000101F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1668053678.0000000001028000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f60000_tgBNtoWqIp.jbxd

Similarity

API ID: BuffCharUpper
String ID: APPEND$EXISTS$KEYS$REMOVE
API String ID: 3964851224-769500911
Opcode ID: 5fe1babe7e38ed5c75b5f50f3b5f026d7b5d8c7bdc7670881829e8e182abea76
Instruction ID: fe68f1340a88d24bcd7d321727e0046e9036bb30cf0687c95ea929170a25ecc6
Opcode Fuzzy Hash: 5fe1babe7e38ed5c75b5f50f3b5f026d7b5d8c7bdc7670881829e8e182abea76
Instruction Fuzzy Hash: DB11AD31A4010ACFCF40FFA4CD919FEB3B0FF15314B508459D891AB256EB36690AEB50

Function 00FDEE69 Relevance: 7.7, APIs: 5, Instructions: 247COMMON

Download Yara Rule

APIs

OpenProcess.KERNEL32(00000410,00000000,00000000), ref: 00FDEF1B
GetProcessIoCounters.KERNEL32(00000000,?), ref: 00FDEF4B
GetProcessMemoryInfo.PSAPI(00000000,?,00000028), ref: 00FDF07E
CloseHandle.KERNEL32(?), ref: 00FDF0FF

Memory Dump Source

Source File: 00000000.00000002.1667912702.0000000000F61000.00000020.00000001.01000000.00000003.sdmp, Offset: 00F60000, based on PE: true

Associated: 00000000.00000002.1667891216.0000000000F60000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667966851.0000000000FEF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667966851.0000000001015000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1668035777.000000000101F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1668053678.0000000001028000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f60000_tgBNtoWqIp.jbxd

Similarity

API ID: Process$CloseCountersHandleInfoMemoryOpen
String ID:
API String ID: 2364364464-0
Opcode ID: d07b44c3b8abc8f069af38668bce3dcec56aa314c92667c9c3cfbaacb0a69504
Instruction ID: 7274c73433a60313411503bcbe708f8174617469c1c13fccf64f75fa96f630eb
Opcode Fuzzy Hash: d07b44c3b8abc8f069af38668bce3dcec56aa314c92667c9c3cfbaacb0a69504
Instruction Fuzzy Hash: 66816E716043009FD720EF24CC86F2AB7EAEF48720F14891DF5969B392DAB5AC05AB51

Function 00FE02C2 Relevance: 7.6, APIs: 5, Instructions: 144registryCOMMON

Download Yara Rule

APIs

Part of subcall function 00F67F41: _memmove.LIBCMT ref: 00F67F82

Part of subcall function 00FE10A5: CharUpperBuffW.USER32(?,?,?,?,?,?,?,00FE0038,?,?), ref: 00FE10BC

RegConnectRegistryW.ADVAPI32(?,?,?), ref: 00FE0388
RegOpenKeyExW.ADVAPI32(?,?,00000000,?,?), ref: 00FE03C7
RegEnumKeyExW.ADVAPI32(?,-00000001,?,?,00000000,00000000,00000000,?), ref: 00FE040E
RegCloseKey.ADVAPI32(?,?), ref: 00FE043A
RegCloseKey.ADVAPI32(00000000), ref: 00FE0447

Memory Dump Source

Source File: 00000000.00000002.1667912702.0000000000F61000.00000020.00000001.01000000.00000003.sdmp, Offset: 00F60000, based on PE: true

Associated: 00000000.00000002.1667891216.0000000000F60000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667966851.0000000000FEF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667966851.0000000001015000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1668035777.000000000101F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1668053678.0000000001028000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f60000_tgBNtoWqIp.jbxd

Similarity

API ID: Close$BuffCharConnectEnumOpenRegistryUpper_memmove
String ID:
API String ID: 3440857362-0
Opcode ID: 5153d953281de8b6686a5adf3095acdc0b00c076383710046a918f33ddf04e07
Instruction ID: c3e9262bb8adb073473ae7c7f7bc52b6f3c97ae4fbfae50acc9b4e1ff0a9269f
Opcode Fuzzy Hash: 5153d953281de8b6686a5adf3095acdc0b00c076383710046a918f33ddf04e07
Instruction Fuzzy Hash: 30517B31208244AFD700EF65CC81F6EB7E8FF84714F04892DB595872A2DB78E905EB52

Function 00FDDBDC Relevance: 7.6, APIs: 5, Instructions: 139libraryloaderCOMMON

Download Yara Rule

APIs

Part of subcall function 00F69997: __itow.LIBCMT ref: 00F699C2
Part of subcall function 00F69997: __swprintf.LIBCMT ref: 00F69A0C

LoadLibraryW.KERNEL32(?,?,?,00000000,?,?,?,?,?,?,?,?), ref: 00FDDC3B
GetProcAddress.KERNEL32(00000000,?), ref: 00FDDCBE
GetProcAddress.KERNEL32(00000000,00000000), ref: 00FDDCDA
GetProcAddress.KERNEL32(00000000,?), ref: 00FDDD1B
FreeLibrary.KERNEL32(00000000,?,?,00000000,?,?,?,?,?,?,?,?), ref: 00FDDD35

Part of subcall function 00F65B75: WideCharToMultiByte.KERNEL32(00000000,00000000,?,00000001,00000000,00000000,00000000,00000000,00000000,00000000,?,00FC7B20,?,?,00000000), ref: 00F65B8C
Part of subcall function 00F65B75: WideCharToMultiByte.KERNEL32(00000000,00000000,?,00000001,00000000,?,00000000,00000000,?,?,00FC7B20,?,?,00000000,?,?), ref: 00F65BB0

Memory Dump Source

Source File: 00000000.00000002.1667912702.0000000000F61000.00000020.00000001.01000000.00000003.sdmp, Offset: 00F60000, based on PE: true

Associated: 00000000.00000002.1667891216.0000000000F60000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667966851.0000000000FEF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667966851.0000000001015000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1668035777.000000000101F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1668053678.0000000001028000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f60000_tgBNtoWqIp.jbxd

Similarity

API ID: AddressProc$ByteCharLibraryMultiWide$FreeLoad__itow__swprintf
String ID:
API String ID: 327935632-0
Opcode ID: 8c834cdec15fce5d99d31f0909ce10b59ee8a1a9bb006def3bc92937c04e4367
Instruction ID: f810fc194305b802ba3b9b2a05fb625fd0758f44c3dca63dca3d6e041acce3d6
Opcode Fuzzy Hash: 8c834cdec15fce5d99d31f0909ce10b59ee8a1a9bb006def3bc92937c04e4367
Instruction Fuzzy Hash: 78511B35A00609DFCB00EFA8C884D9DB7F5FF58320B18806AE815AB322D774AD45EF51

Function 00FCE7DC Relevance: 7.6, APIs: 5, Instructions: 135COMMON

Download Yara Rule

APIs

GetPrivateProfileSectionW.KERNEL32(00000003,?,00007FFF,?), ref: 00FCE88A
GetPrivateProfileSectionW.KERNEL32(?,00000001,00000003,?), ref: 00FCE8B3
WritePrivateProfileSectionW.KERNEL32(?,?,?), ref: 00FCE8F2

Part of subcall function 00F69997: __itow.LIBCMT ref: 00F699C2
Part of subcall function 00F69997: __swprintf.LIBCMT ref: 00F69A0C

WritePrivateProfileStringW.KERNEL32(00000003,00000000,00000000,?), ref: 00FCE917
WritePrivateProfileStringW.KERNEL32(00000000,00000000,00000000,?), ref: 00FCE91F

Memory Dump Source

Source File: 00000000.00000002.1667912702.0000000000F61000.00000020.00000001.01000000.00000003.sdmp, Offset: 00F60000, based on PE: true

Associated: 00000000.00000002.1667891216.0000000000F60000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667966851.0000000000FEF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667966851.0000000001015000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1668035777.000000000101F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1668053678.0000000001028000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f60000_tgBNtoWqIp.jbxd

Similarity

API ID: PrivateProfile$SectionWrite$String$__itow__swprintf
String ID:
API String ID: 1389676194-0
Opcode ID: 64824f55c9257f4450462710f3f47c41836cb9dfcebc542bf2899a8a48a36b55
Instruction ID: 0d3609f1417adb1a69130bc3bfe173924eeb2984b6042d88f68967d8ddfb4092
Opcode Fuzzy Hash: 64824f55c9257f4450462710f3f47c41836cb9dfcebc542bf2899a8a48a36b55
Instruction Fuzzy Hash: AD512E35A00205DFCF01EF64C981AADBBF9FF08310B188099E949AB362CB75ED15EB50

Function 00FEA2C5 Relevance: 7.6, APIs: 5, Instructions: 130COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1667912702.0000000000F61000.00000020.00000001.01000000.00000003.sdmp, Offset: 00F60000, based on PE: true

Associated: 00000000.00000002.1667891216.0000000000F60000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667966851.0000000000FEF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667966851.0000000001015000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1668035777.000000000101F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1668053678.0000000001028000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f60000_tgBNtoWqIp.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 36613cb89f89c1c514d16a25cdbc6998d4c8f9bb530703dc377fb59a3a78389e
Instruction ID: 92822df0a1ad6ced78095dc949d7fda7c5b6a331715118374147b92b9db15c8d
Opcode Fuzzy Hash: 36613cb89f89c1c514d16a25cdbc6998d4c8f9bb530703dc377fb59a3a78389e
Instruction Fuzzy Hash: 9D41E435D00298AFD720DF29CC88FA9BBA5FB09320F144165F855A72E1D772BD41FA52

Function 00FB6920 Relevance: 7.6, APIs: 5, Instructions: 97windowCOMMON

Download Yara Rule

APIs

PeekMessageW.USER32(?,00000000,00000000,00000000,00000001), ref: 00FB695D
TranslateAcceleratorW.USER32(?,?,?), ref: 00FB69A9
TranslateMessage.USER32(?), ref: 00FB69D2
DispatchMessageW.USER32(?), ref: 00FB69DC
PeekMessageW.USER32(?,00000000,00000000,00000000,00000001), ref: 00FB69EB

Memory Dump Source

Source File: 00000000.00000002.1667912702.0000000000F61000.00000020.00000001.01000000.00000003.sdmp, Offset: 00F60000, based on PE: true

Associated: 00000000.00000002.1667891216.0000000000F60000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667966851.0000000000FEF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667966851.0000000001015000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1668035777.000000000101F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1668053678.0000000001028000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f60000_tgBNtoWqIp.jbxd

Similarity

API ID: Message$PeekTranslate$AcceleratorDispatch
String ID:
API String ID: 2108273632-0
Opcode ID: d7598f5895563cf9b363fbc2591c6dea5350aca42d0a8e58cc50a8f34b6d1137
Instruction ID: 03410685213d2e22d7292816e3c24a5ed95e82e9cbd3a9b72f49d880878e719d
Opcode Fuzzy Hash: d7598f5895563cf9b363fbc2591c6dea5350aca42d0a8e58cc50a8f34b6d1137
Instruction Fuzzy Hash: C931C67190024A9BDB308E769C84BF67BACBB06320F244165E461D7091E77E9849FF60

Function 00FB8F01 Relevance: 7.6, APIs: 5, Instructions: 89sleepwindowCOMMON

Download Yara Rule

APIs

GetWindowRect.USER32(?,?), ref: 00FB8F12
PostMessageW.USER32(?,00000201,00000001), ref: 00FB8FBC
Sleep.KERNEL32(00000000,?,00000201,00000001,?,?,?), ref: 00FB8FC4
PostMessageW.USER32(?,00000202,00000000), ref: 00FB8FD2
Sleep.KERNEL32(00000000,?,00000202,00000000,?,?,00000201,00000001,?,?,?), ref: 00FB8FDA

Memory Dump Source

Source File: 00000000.00000002.1667912702.0000000000F61000.00000020.00000001.01000000.00000003.sdmp, Offset: 00F60000, based on PE: true

Associated: 00000000.00000002.1667891216.0000000000F60000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667966851.0000000000FEF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667966851.0000000001015000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1668035777.000000000101F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1668053678.0000000001028000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f60000_tgBNtoWqIp.jbxd

Similarity

API ID: MessagePostSleep$RectWindow
String ID:
API String ID: 3382505437-0
Opcode ID: a82f036230d17b80d0e119ed0c4eb24ccef457cefb4258217a9adf7d8bed2660
Instruction ID: d53d97673641f83076d25add02b6d4ed4a9e88e0f9ab808368a1ea51a861b1a9
Opcode Fuzzy Hash: a82f036230d17b80d0e119ed0c4eb24ccef457cefb4258217a9adf7d8bed2660
Instruction Fuzzy Hash: ED31D17190021DEBDF00CF69D948AEE7BBAEB84325F104229F924AA1D0C7709914EF50

Function 00FBB6AF Relevance: 7.6, APIs: 5, Instructions: 88windowCOMMON

Download Yara Rule

APIs

IsWindowVisible.USER32(?), ref: 00FBB6C7
SendMessageW.USER32(?,0000000E,00000000,00000000), ref: 00FBB6E4
SendMessageW.USER32(?,0000000D,00000001,00000000), ref: 00FBB71C
CharUpperBuffW.USER32(00000000,00000000,?,?,?,?), ref: 00FBB742
_wcsstr.LIBCMT ref: 00FBB74C

Memory Dump Source

Source File: 00000000.00000002.1667912702.0000000000F61000.00000020.00000001.01000000.00000003.sdmp, Offset: 00F60000, based on PE: true

Associated: 00000000.00000002.1667891216.0000000000F60000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667966851.0000000000FEF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667966851.0000000001015000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1668035777.000000000101F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1668053678.0000000001028000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f60000_tgBNtoWqIp.jbxd

Similarity

API ID: MessageSend$BuffCharUpperVisibleWindow_wcsstr
String ID:
API String ID: 3902887630-0
Opcode ID: 0180a292416d22fe14c41bc48eeecf72417c96dd4c085b8dd9b2fddf2eafb1a5
Instruction ID: e5fa104c43f9132311dd4ac167a156932e86b8ad26320cde0c16f4ce562b1de7
Opcode Fuzzy Hash: 0180a292416d22fe14c41bc48eeecf72417c96dd4c085b8dd9b2fddf2eafb1a5
Instruction Fuzzy Hash: 4A21C532604244BBEB255B7A9C49EBB7B99DF85720F104069FC05CA1A1EFA5DC41AB60

Function 00FEB405 Relevance: 7.6, APIs: 5, Instructions: 85COMMON

Download Yara Rule

APIs

Part of subcall function 00F62612: GetWindowLongW.USER32(?,000000EB), ref: 00F62623

GetWindowLongW.USER32(?,000000F0), ref: 00FEB44C
SetWindowLongW.USER32(00000000,000000F0,00000001), ref: 00FEB471
SetWindowLongW.USER32(00000000,000000EC,000000FF), ref: 00FEB489
GetSystemMetrics.USER32(00000004), ref: 00FEB4B2
SetWindowPos.USER32(00000000,00000000,00000000,00000000,00000000,00000000,00000047,?,?,?,?,?,?,?,00FD1184,00000000), ref: 00FEB4D0

Memory Dump Source

Source File: 00000000.00000002.1667912702.0000000000F61000.00000020.00000001.01000000.00000003.sdmp, Offset: 00F60000, based on PE: true

Associated: 00000000.00000002.1667891216.0000000000F60000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667966851.0000000000FEF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667966851.0000000001015000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1668035777.000000000101F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1668053678.0000000001028000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f60000_tgBNtoWqIp.jbxd

Similarity

API ID: Window$Long$MetricsSystem
String ID:
API String ID: 2294984445-0
Opcode ID: f2813c591ce293fd3bbcac9d3b40e4e938fef85a6799269c820ccd787cb7bf08
Instruction ID: 5d3f4ba7b1fcd2793f4616c3ee388024ce2dbc75e50731f611a92b02158c3705
Opcode Fuzzy Hash: f2813c591ce293fd3bbcac9d3b40e4e938fef85a6799269c820ccd787cb7bf08
Instruction Fuzzy Hash: 022180719102A6AFCB20CF39DC48B6A37A4FB05730B144729FD26D61E1E7319911EB80

Function 00FB97E9 Relevance: 7.6, APIs: 5, Instructions: 84windowCOMMON

Download Yara Rule

APIs

SendMessageW.USER32(?,00001004,00000000,00000000), ref: 00FB9802

Part of subcall function 00F67D2C: _memmove.LIBCMT ref: 00F67D66

SendMessageW.USER32(?,0000102C,00000000,00000002), ref: 00FB9834
__itow.LIBCMT ref: 00FB984C
SendMessageW.USER32(?,0000102C,00000000,00000002), ref: 00FB9874
__itow.LIBCMT ref: 00FB9885

Memory Dump Source

Source File: 00000000.00000002.1667912702.0000000000F61000.00000020.00000001.01000000.00000003.sdmp, Offset: 00F60000, based on PE: true

Associated: 00000000.00000002.1667891216.0000000000F60000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667966851.0000000000FEF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667966851.0000000001015000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1668035777.000000000101F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1668053678.0000000001028000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f60000_tgBNtoWqIp.jbxd

Similarity

API ID: MessageSend$__itow$_memmove
String ID:
API String ID: 2983881199-0
Opcode ID: ff3a8b3081b1260df8387449243d4787741fbf6903722fd27905012e691f7bee
Instruction ID: f7b435929219c54e3f778b0b845b3b82e9e38f576e225ec6fe90e3bc0a4bccaa
Opcode Fuzzy Hash: ff3a8b3081b1260df8387449243d4787741fbf6903722fd27905012e691f7bee
Instruction Fuzzy Hash: F3210A31B04348ABDB10AB628C86EEE3BA8DF49724F440025FE04DB251D6B5CD45BB91

Function 00F612F3 Relevance: 7.6, APIs: 5, Instructions: 67COMMON

Download Yara Rule

APIs

ExtCreatePen.GDI32(?,?,00000000,00000000,00000000,?,00000000), ref: 00F6134D
SelectObject.GDI32(?,00000000), ref: 00F6135C
BeginPath.GDI32(?), ref: 00F61373
SelectObject.GDI32(?,00000000), ref: 00F6139C

Memory Dump Source

Source File: 00000000.00000002.1667912702.0000000000F61000.00000020.00000001.01000000.00000003.sdmp, Offset: 00F60000, based on PE: true

Associated: 00000000.00000002.1667891216.0000000000F60000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667966851.0000000000FEF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667966851.0000000001015000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1668035777.000000000101F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1668053678.0000000001028000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f60000_tgBNtoWqIp.jbxd

Similarity

API ID: ObjectSelect$BeginCreatePath
String ID:
API String ID: 3225163088-0
Opcode ID: b42a60702f24792d08b12ce798cb76eddb4536972b8fdffe0511c89c23f72828
Instruction ID: 818a7dc59630db28ab654654711baff071bbb7cbfa8253dbe59ee53f38b4ecd3
Opcode Fuzzy Hash: b42a60702f24792d08b12ce798cb76eddb4536972b8fdffe0511c89c23f72828
Instruction Fuzzy Hash: 3D2171B1C00208EFEB318F25DD457697BB8FB00321F384326F85196294D7B79995EB90

Function 00FBC161 Relevance: 7.6, APIs: 5, Instructions: 61COMMON

Download Yara Rule

APIs

_memcmp.LIBCMT ref: 00FBC176
_memcmp.LIBCMT ref: 00FBC194
_memcmp.LIBCMT ref: 00FBC1A7
_memcmp.LIBCMT ref: 00FBC1BF
_memcmp.LIBCMT ref: 00FBC1D7

Memory Dump Source

Source File: 00000000.00000002.1667912702.0000000000F61000.00000020.00000001.01000000.00000003.sdmp, Offset: 00F60000, based on PE: true

Associated: 00000000.00000002.1667891216.0000000000F60000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667966851.0000000000FEF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667966851.0000000001015000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1668035777.000000000101F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1668053678.0000000001028000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f60000_tgBNtoWqIp.jbxd

Similarity

API ID: _memcmp
String ID:
API String ID: 2931989736-0
Opcode ID: 224ba109c9ea1906f0dcfff39ccb365375443b7902cb137485b613d8cc6f1b6f
Instruction ID: 3c97697bd6e11ab5c16fd473a2d38623e9d2f3f760f3b6ec30b62333e74513fa
Opcode Fuzzy Hash: 224ba109c9ea1906f0dcfff39ccb365375443b7902cb137485b613d8cc6f1b6f
Instruction Fuzzy Hash: 670192B2A0510A7BE204B62A5C42FFB735CAF613A4B044121FE04B6293F654DE12BAE1

Function 00FC4D35 Relevance: 7.6, APIs: 5, Instructions: 56synchronizationthreadwindowCOMMON

Download Yara Rule

APIs

GetCurrentThreadId.KERNEL32 ref: 00FC4D5C
__beginthreadex.LIBCMT ref: 00FC4D7A
MessageBoxW.USER32(?,?,?,?), ref: 00FC4D8F
WaitForSingleObject.KERNEL32(00000000,000000FF,?,?,?,?), ref: 00FC4DA5
CloseHandle.KERNEL32(00000000,?,?,?,?), ref: 00FC4DAC

Memory Dump Source

Source File: 00000000.00000002.1667912702.0000000000F61000.00000020.00000001.01000000.00000003.sdmp, Offset: 00F60000, based on PE: true

Associated: 00000000.00000002.1667891216.0000000000F60000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667966851.0000000000FEF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667966851.0000000001015000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1668035777.000000000101F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1668053678.0000000001028000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f60000_tgBNtoWqIp.jbxd

Similarity

API ID: CloseCurrentHandleMessageObjectSingleThreadWait__beginthreadex
String ID:
API String ID: 3824534824-0
Opcode ID: 20ab8617bc94b624639b0721c833d4c9292753a3b296c1b16644bb70b2bb7bda
Instruction ID: 87f90aab56e31b3476a2ddf0c90fe6e1639a24329b95f40a0dce71e64175edcf
Opcode Fuzzy Hash: 20ab8617bc94b624639b0721c833d4c9292753a3b296c1b16644bb70b2bb7bda
Instruction Fuzzy Hash: 07114872D04249BBC7209FA89C44FDB7FACEB45324F244269FC15D3240C67A9D0897A0

Function 00FB874A Relevance: 7.5, APIs: 5, Instructions: 49memoryCOMMON

Download Yara Rule

APIs

GetUserObjectSecurity.USER32(?,00000004,?,00000000,?), ref: 00FB8766
GetLastError.KERNEL32(?,00FB822A,?,?,?), ref: 00FB8770
GetProcessHeap.KERNEL32(00000008,?,?,00FB822A,?,?,?), ref: 00FB877F
HeapAlloc.KERNEL32(00000000,?,00FB822A,?,?,?), ref: 00FB8786
GetUserObjectSecurity.USER32(?,00000004,00000000,?,?), ref: 00FB879D

Memory Dump Source

Source File: 00000000.00000002.1667912702.0000000000F61000.00000020.00000001.01000000.00000003.sdmp, Offset: 00F60000, based on PE: true

Associated: 00000000.00000002.1667891216.0000000000F60000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667966851.0000000000FEF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667966851.0000000001015000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1668035777.000000000101F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1668053678.0000000001028000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f60000_tgBNtoWqIp.jbxd

Similarity

API ID: HeapObjectSecurityUser$AllocErrorLastProcess
String ID:
API String ID: 842720411-0
Opcode ID: d9cfcd5baf7d93e95b892b7fc733625d4ea93a6665ece24fd2dfcb54edc23260
Instruction ID: a48c4f88ea21a21b18f9f079cce17585e75baa8ccb2bdc05242f0145b973f5d8
Opcode Fuzzy Hash: d9cfcd5baf7d93e95b892b7fc733625d4ea93a6665ece24fd2dfcb54edc23260
Instruction Fuzzy Hash: D2016271601248FFDB104FA6DC88DA77B6CFF863A57200439F849C6160DE318C05EA60

Function 00FC54E6 Relevance: 7.5, APIs: 5, Instructions: 48sleepCOMMON

Download Yara Rule

APIs

QueryPerformanceCounter.KERNEL32(?,00000000,?,?,?,?,?,?,?,?,?,?), ref: 00FC5502
QueryPerformanceFrequency.KERNEL32(?,?,?,?,?,?,?,?,?,?,?), ref: 00FC5510
Sleep.KERNEL32(00000000,?,?,?,?,?,?,?,?,?,?), ref: 00FC5518
QueryPerformanceCounter.KERNEL32(?,?,?,?,?,?,?,?,?,?,?), ref: 00FC5522
Sleep.KERNEL32(?,00000000,?,?,?,?,?,?,?,?,?,?), ref: 00FC555E

Memory Dump Source

Source File: 00000000.00000002.1667912702.0000000000F61000.00000020.00000001.01000000.00000003.sdmp, Offset: 00F60000, based on PE: true

Associated: 00000000.00000002.1667891216.0000000000F60000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667966851.0000000000FEF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667966851.0000000001015000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1668035777.000000000101F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1668053678.0000000001028000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f60000_tgBNtoWqIp.jbxd

Similarity

API ID: PerformanceQuery$CounterSleep$Frequency
String ID:
API String ID: 2833360925-0
Opcode ID: 547a80a6ee2fea7e78c9e59b2deea90149c2d48a15f94f52048d0656edad500a
Instruction ID: d696f2b00efd2e5943119ee52094472c31ad24024f4822413a29ec34545411bf
Opcode Fuzzy Hash: 547a80a6ee2fea7e78c9e59b2deea90149c2d48a15f94f52048d0656edad500a
Instruction Fuzzy Hash: 6501A136C01A1EDBCF00DFE4E989AEDBB78FB09B15F44045AE501F6140CB346594E7A1

Function 00FB7652 Relevance: 7.5, APIs: 5, Instructions: 48stringCOMMON

Download Yara Rule

APIs

CLSIDFromProgID.OLE32(?,?,00000000,?,00000000,?,?,-C0000018,00000001,?,00FB758C,80070057,?,?,?,00FB799D), ref: 00FB766F
ProgIDFromCLSID.OLE32(?,00000000,?,?,00000000,?,00000000,?,?,-C0000018,00000001,?,00FB758C,80070057,?,?), ref: 00FB768A
lstrcmpiW.KERNEL32(?,00000000,?,?,00000000,?,00000000,?,?,-C0000018,00000001,?,00FB758C,80070057,?,?), ref: 00FB7698
CoTaskMemFree.OLE32(00000000,?,00000000,?,?,00000000,?,00000000,?,?,-C0000018,00000001,?,00FB758C,80070057,?), ref: 00FB76A8
CLSIDFromString.OLE32(?,?,?,?,00000000,?,00000000,?,?,-C0000018,00000001,?,00FB758C,80070057,?,?), ref: 00FB76B4

Memory Dump Source

Source File: 00000000.00000002.1667912702.0000000000F61000.00000020.00000001.01000000.00000003.sdmp, Offset: 00F60000, based on PE: true

Associated: 00000000.00000002.1667891216.0000000000F60000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667966851.0000000000FEF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667966851.0000000001015000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1668035777.000000000101F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1668053678.0000000001028000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f60000_tgBNtoWqIp.jbxd

Similarity

API ID: From$Prog$FreeStringTasklstrcmpi
String ID:
API String ID: 3897988419-0
Opcode ID: 427094509afedd113b73471be9c3e9496f9b27745dc174008ba6752306e0252b
Instruction ID: 43d12105c70c31d2a19efc72e2e883a3cb25ff41468b45f1c19045919780a56e
Opcode Fuzzy Hash: 427094509afedd113b73471be9c3e9496f9b27745dc174008ba6752306e0252b
Instruction Fuzzy Hash: 74017176A01708ABDB106F59DC84BAA7BAEEB84761F144028FD04D6251E731DE44ABA0

Function 00FB85F1 Relevance: 7.5, APIs: 5, Instructions: 45memoryCOMMON

Download Yara Rule

APIs

GetTokenInformation.ADVAPI32(?,00000002,?,00000000,?), ref: 00FB8608
GetLastError.KERNEL32(?,00000002,?,00000000,?), ref: 00FB8612
GetProcessHeap.KERNEL32(00000008,?,?,00000002,?,00000000,?), ref: 00FB8621
HeapAlloc.KERNEL32(00000000,?,00000002,?,00000000,?), ref: 00FB8628
GetTokenInformation.ADVAPI32(?,00000002,00000000,?,?,?,00000002,?,00000000,?), ref: 00FB863E

Memory Dump Source

Source File: 00000000.00000002.1667912702.0000000000F61000.00000020.00000001.01000000.00000003.sdmp, Offset: 00F60000, based on PE: true

Associated: 00000000.00000002.1667891216.0000000000F60000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667966851.0000000000FEF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667966851.0000000001015000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1668035777.000000000101F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1668053678.0000000001028000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f60000_tgBNtoWqIp.jbxd

Similarity

API ID: HeapInformationToken$AllocErrorLastProcess
String ID:
API String ID: 44706859-0
Opcode ID: c9cc3152272c5ad85fff026791bd42ac38b052c071fbf8f00c031c4843c3583e
Instruction ID: b66d39516c5aa84d7b6abefaec4eeecf7de1a46a42669117bb5d7924cf405389
Opcode Fuzzy Hash: c9cc3152272c5ad85fff026791bd42ac38b052c071fbf8f00c031c4843c3583e
Instruction Fuzzy Hash: B5F06831201248AFD7100FA5DCCDEAB3BADEFC67A4B044425F545C7150CB719C45EE60

Function 00FB8652 Relevance: 7.5, APIs: 5, Instructions: 45memoryCOMMON

Download Yara Rule

APIs

GetTokenInformation.ADVAPI32(?,00000003(TokenIntegrityLevel),?,00000000,?), ref: 00FB8669
GetLastError.KERNEL32(?,TokenIntegrityLevel,?,00000000,?), ref: 00FB8673
GetProcessHeap.KERNEL32(00000008,?,?,TokenIntegrityLevel,?,00000000,?), ref: 00FB8682
HeapAlloc.KERNEL32(00000000,?,TokenIntegrityLevel,?,00000000,?), ref: 00FB8689
GetTokenInformation.ADVAPI32(?,00000003(TokenIntegrityLevel),00000000,?,?,?,TokenIntegrityLevel,?,00000000,?), ref: 00FB869F

Memory Dump Source

Source File: 00000000.00000002.1667912702.0000000000F61000.00000020.00000001.01000000.00000003.sdmp, Offset: 00F60000, based on PE: true

Associated: 00000000.00000002.1667891216.0000000000F60000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667966851.0000000000FEF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667966851.0000000001015000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1668035777.000000000101F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1668053678.0000000001028000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f60000_tgBNtoWqIp.jbxd

Similarity

API ID: HeapInformationToken$AllocErrorLastProcess
String ID:
API String ID: 44706859-0
Opcode ID: d201723e9600249d21cf9e9c0977670165eec146bee81c96522cd9b9cda8bd2b
Instruction ID: db98a9f5673684a2e3d7c98b70a27e7293b87ccf05c2ca37313f57b8721c4790
Opcode Fuzzy Hash: d201723e9600249d21cf9e9c0977670165eec146bee81c96522cd9b9cda8bd2b
Instruction Fuzzy Hash: 58F06871201348AFD7111F65DCC8EA73BADEFC57A4B100025F545C6160DB71DD45EE60

Function 00FBC6A6 Relevance: 7.5, APIs: 5, Instructions: 41windowtimeCOMMON

Download Yara Rule

APIs

GetDlgItem.USER32(?,000003E9), ref: 00FBC6BA
GetWindowTextW.USER32(00000000,?,00000100), ref: 00FBC6D1
MessageBeep.USER32(00000000), ref: 00FBC6E9
KillTimer.USER32(?,0000040A), ref: 00FBC705
EndDialog.USER32(?,00000001), ref: 00FBC71F

Memory Dump Source

Source File: 00000000.00000002.1667912702.0000000000F61000.00000020.00000001.01000000.00000003.sdmp, Offset: 00F60000, based on PE: true

Associated: 00000000.00000002.1667891216.0000000000F60000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667966851.0000000000FEF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667966851.0000000001015000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1668035777.000000000101F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1668053678.0000000001028000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f60000_tgBNtoWqIp.jbxd

Similarity

API ID: BeepDialogItemKillMessageTextTimerWindow
String ID:
API String ID: 3741023627-0
Opcode ID: 72808366ca16299ea8c46c1fbaa6592ac385097fedf58b35c54c1c17ff4c8851
Instruction ID: 2237ca3bd5d33e1b9ddfcdb228b561f9ea58fef3bcb3db4a657ca35e355622a3
Opcode Fuzzy Hash: 72808366ca16299ea8c46c1fbaa6592ac385097fedf58b35c54c1c17ff4c8851
Instruction Fuzzy Hash: C6016230900708ABEB216B21DD8EF9777B9FF00705F000669F546A54E1DBF4A958AF80

Function 00F613B0 Relevance: 7.5, APIs: 5, Instructions: 29COMMON

Download Yara Rule

APIs

EndPath.GDI32(?), ref: 00F613BF
StrokeAndFillPath.GDI32(?,?,00F9BAD8,00000000,?), ref: 00F613DB
SelectObject.GDI32(?,00000000), ref: 00F613EE
DeleteObject.GDI32 ref: 00F61401
StrokePath.GDI32(?), ref: 00F6141C

Memory Dump Source

Source File: 00000000.00000002.1667912702.0000000000F61000.00000020.00000001.01000000.00000003.sdmp, Offset: 00F60000, based on PE: true

Associated: 00000000.00000002.1667891216.0000000000F60000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667966851.0000000000FEF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667966851.0000000001015000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1668035777.000000000101F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1668053678.0000000001028000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f60000_tgBNtoWqIp.jbxd

Similarity

API ID: Path$ObjectStroke$DeleteFillSelect
String ID:
API String ID: 2625713937-0
Opcode ID: 1b1114f5016d055ae30b30128971905b85644440f2e13fa62a367f0978f57dda
Instruction ID: 6159ad517e29705d41cca1bff3220895eccaa15816c34f41130f44233e07a1fb
Opcode Fuzzy Hash: 1b1114f5016d055ae30b30128971905b85644440f2e13fa62a367f0978f57dda
Instruction Fuzzy Hash: E9F0CD70404248DBDB319F16EC4D7643BA8BB01326F28C325E969491F5C77B4595EF51

Function 00FCC602 Relevance: 7.3, APIs: 3, Strings: 1, Instructions: 279comCOMMON

Download Yara Rule

APIs

CoInitialize.OLE32(00000000), ref: 00FCC69D
CoCreateInstance.OLE32(00FF2D6C,00000000,00000001,00FF2BDC,?), ref: 00FCC6B5

Part of subcall function 00F67F41: _memmove.LIBCMT ref: 00F67F82

CoUninitialize.OLE32 ref: 00FCC922

Strings

.lnk, xrefs: 00FCC631, 00FCC659, 00FCC663

Memory Dump Source

Source File: 00000000.00000002.1667912702.0000000000F61000.00000020.00000001.01000000.00000003.sdmp, Offset: 00F60000, based on PE: true

Associated: 00000000.00000002.1667891216.0000000000F60000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667966851.0000000000FEF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667966851.0000000001015000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1668035777.000000000101F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1668053678.0000000001028000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f60000_tgBNtoWqIp.jbxd

Similarity

API ID: CreateInitializeInstanceUninitialize_memmove
String ID: .lnk
API String ID: 2683427295-24824748
Opcode ID: b0b19493720255a573192b051335e33658396a3a36e3f5ac4d62fd0bb1cbc441
Instruction ID: c73acc60bddcf8b14d0c45d8e7e0581d5b1134ea186a894e9e980c3b9f047d71
Opcode Fuzzy Hash: b0b19493720255a573192b051335e33658396a3a36e3f5ac4d62fd0bb1cbc441
Instruction Fuzzy Hash: 60A13B71108205AFD300EF64CC92EABB7ECEF94714F04491DF196971A2DBB4EA09DB92

Function 00F72E5B Relevance: 7.3, APIs: 3, Strings: 1, Instructions: 265COMMON

Download Yara Rule

APIs

Part of subcall function 00F80FF6: std::exception::exception.LIBCMT ref: 00F8102C
Part of subcall function 00F80FF6: __CxxThrowException@8.LIBCMT ref: 00F81041

Part of subcall function 00F67F41: _memmove.LIBCMT ref: 00F67F82

Part of subcall function 00F67BB1: _memmove.LIBCMT ref: 00F67C0B

__swprintf.LIBCMT ref: 00F7302D

Strings

\\[\\nrt]|%%|%[-+ 0#]?([0-9]*|\*)?(\.[0-9]*|\.\*)?[hlL]?[diouxXeEfgGs], xrefs: 00F72EC6

Memory Dump Source

Source File: 00000000.00000002.1667912702.0000000000F61000.00000020.00000001.01000000.00000003.sdmp, Offset: 00F60000, based on PE: true

Associated: 00000000.00000002.1667891216.0000000000F60000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667966851.0000000000FEF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667966851.0000000001015000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1668035777.000000000101F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1668053678.0000000001028000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f60000_tgBNtoWqIp.jbxd

Similarity

API ID: _memmove$Exception@8Throw__swprintfstd::exception::exception
String ID: \\[\\nrt]|%%|%[-+ 0#]?([0-9]*|\*)?(\.[0-9]*|\.\*)?[hlL]?[diouxXeEfgGs]
API String ID: 1943609520-557222456
Opcode ID: dba353a3f1a16cdc9a8a444efd139659de47c9c1ad0eadef05e9dc9aa93eec5d
Instruction ID: a390eefdf17207af9e0be633987551bee44ec77adfe95199acf7fd3b29d33bb1
Opcode Fuzzy Hash: dba353a3f1a16cdc9a8a444efd139659de47c9c1ad0eadef05e9dc9aa93eec5d
Instruction Fuzzy Hash: D7918B71508301AFC718EF24DC85C6EB7A8EF85714F04491EF4969B2A1EA78EE44EB52

Function 00FCBBA6 Relevance: 7.3, APIs: 3, Strings: 1, Instructions: 261comCOMMON

Download Yara Rule

APIs

Part of subcall function 00F648AE: GetFullPathNameW.KERNEL32(?,00007FFF,?,00000000,?,?,00F648A1,?,?,00F637C0,?), ref: 00F648CE

CoInitialize.OLE32(00000000), ref: 00FCBC26
CoCreateInstance.OLE32(00FF2D6C,00000000,00000001,00FF2BDC,?), ref: 00FCBC3F
CoUninitialize.OLE32 ref: 00FCBC5C

Part of subcall function 00F69997: __itow.LIBCMT ref: 00F699C2
Part of subcall function 00F69997: __swprintf.LIBCMT ref: 00F69A0C

Strings

.lnk, xrefs: 00FCBC08, 00FCBC16

Memory Dump Source

Source File: 00000000.00000002.1667912702.0000000000F61000.00000020.00000001.01000000.00000003.sdmp, Offset: 00F60000, based on PE: true

Associated: 00000000.00000002.1667891216.0000000000F60000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667966851.0000000000FEF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667966851.0000000001015000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1668035777.000000000101F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1668053678.0000000001028000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f60000_tgBNtoWqIp.jbxd

Similarity

API ID: CreateFullInitializeInstanceNamePathUninitialize__itow__swprintf
String ID: .lnk
API String ID: 2126378814-24824748
Opcode ID: 44b0ced3de072af67a3bc5c225067256b8ac68e6675e08bc7e25dbe602c20ca8
Instruction ID: 15f890cf1cc599306a2412581bc574a795c4689ac70b028e9f83c2509c3ffc1a
Opcode Fuzzy Hash: 44b0ced3de072af67a3bc5c225067256b8ac68e6675e08bc7e25dbe602c20ca8
Instruction Fuzzy Hash: 2CA135756043029FCB00DF14C985E5ABBE5FF88324F14898CF89A9B2A2CB35ED45DB91

Function 00F8524D Relevance: 7.2, APIs: 3, Strings: 1, Instructions: 180COMMON

Download Yara Rule

APIs

__startOneArgErrorHandling.LIBCMT ref: 00F852DD

Part of subcall function 00F90340: __87except.LIBCMT ref: 00F9037B

Strings

pow, xrefs: 00F852B5, 00F852D2

Memory Dump Source

Source File: 00000000.00000002.1667912702.0000000000F61000.00000020.00000001.01000000.00000003.sdmp, Offset: 00F60000, based on PE: true

Associated: 00000000.00000002.1667891216.0000000000F60000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667966851.0000000000FEF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667966851.0000000001015000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1668035777.000000000101F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1668053678.0000000001028000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f60000_tgBNtoWqIp.jbxd

Similarity

API ID: ErrorHandling__87except__start
String ID: pow
API String ID: 2905807303-2276729525
Opcode ID: a906195c758aa951028274be4c59d42a71dd46129f232314a05aa4548b6ad86f
Instruction ID: 21f8b68162d02c438dc73a74020ecaa32ed61886dacd4cf2015a2bf7c14a2a29
Opcode Fuzzy Hash: a906195c758aa951028274be4c59d42a71dd46129f232314a05aa4548b6ad86f
Instruction Fuzzy Hash: 2E516B61E0C6019BEF11B718C9413FE7B949B00B60F204969E0D5862D9EF788CC4FB46

Function 00F762F2 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 143COMMON

Download Yara Rule

APIs

_memset.LIBCMT ref: 00F763A8
_memmove.LIBCMT ref: 00F76446
_memset.LIBCMT ref: 00F7646A

Strings

ERCP, xrefs: 00F76313

Memory Dump Source

Source File: 00000000.00000002.1667912702.0000000000F61000.00000020.00000001.01000000.00000003.sdmp, Offset: 00F60000, based on PE: true

Associated: 00000000.00000002.1667891216.0000000000F60000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667966851.0000000000FEF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667966851.0000000001015000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1668035777.000000000101F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1668053678.0000000001028000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f60000_tgBNtoWqIp.jbxd

Similarity

API ID: _memset$_memmove
String ID: ERCP
API String ID: 2532777613-1384759551
Opcode ID: e53e784f8704f94d8a421c9906abd253a2dca43d16a9c40d622515396ebda8ed
Instruction ID: 8f861b1ed8e540faf9fc600d9b328990632897cf843910de8d74832aec88d7c5
Opcode Fuzzy Hash: e53e784f8704f94d8a421c9906abd253a2dca43d16a9c40d622515396ebda8ed
Instruction Fuzzy Hash: 71518E729007099BDB24CF65C8917EABBF8FF04724F20856EE94ECA241E7359684DF51

Function 00FE7BB5 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 110COMMON

Download Yara Rule

APIs

SetWindowPos.USER32(00000000,00000000,00000000,00000000,00000000,00000000,00000013,?,?,SysTreeView32,00FEF910,00000000,?,?,?,?), ref: 00FE7C4E
GetWindowLongW.USER32 ref: 00FE7C6B
SetWindowLongW.USER32(?,000000F0,00000000), ref: 00FE7C7B

Strings

SysTreeView32, xrefs: 00FE7C20

Memory Dump Source

Source File: 00000000.00000002.1667912702.0000000000F61000.00000020.00000001.01000000.00000003.sdmp, Offset: 00F60000, based on PE: true

Associated: 00000000.00000002.1667891216.0000000000F60000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667966851.0000000000FEF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667966851.0000000001015000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1668035777.000000000101F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1668053678.0000000001028000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f60000_tgBNtoWqIp.jbxd

Similarity

API ID: Window$Long
String ID: SysTreeView32
API String ID: 847901565-1698111956
Opcode ID: 0cdcf97ee782a00ff8466e0b4159b9d2b0962ab468448f8a7e5477aef12ceb0f
Instruction ID: 597905f7f83f466d37158d6abf531ac6af78ab07f08363286fb35efad09ed0e2
Opcode Fuzzy Hash: 0cdcf97ee782a00ff8466e0b4159b9d2b0962ab468448f8a7e5477aef12ceb0f
Instruction Fuzzy Hash: 1531DE31A04289ABDB219F39CC41BEA77A9FB45334F244725F875922E0D735E851AB50

Function 00FE7648 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 90windowCOMMON

Download Yara Rule

APIs

SendMessageW.USER32(00000000,00001009,00000000,?), ref: 00FE76D0
SetWindowPos.USER32(?,00000000,?,?,?,?,00000004), ref: 00FE76E4
SendMessageW.USER32(?,00001002,00000000,?), ref: 00FE7708

Strings

SysMonthCal32, xrefs: 00FE769B

Memory Dump Source

Source File: 00000000.00000002.1667912702.0000000000F61000.00000020.00000001.01000000.00000003.sdmp, Offset: 00F60000, based on PE: true

Associated: 00000000.00000002.1667891216.0000000000F60000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667966851.0000000000FEF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667966851.0000000001015000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1668035777.000000000101F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1668053678.0000000001028000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f60000_tgBNtoWqIp.jbxd

Similarity

API ID: MessageSend$Window
String ID: SysMonthCal32
API String ID: 2326795674-1439706946
Opcode ID: ce3939e54dc7c4d0213c60e660cb2d7943ef013ed53c594df7565f9a02007bda
Instruction ID: bf36cf85cf555ac6c8b181e79fa68da93c4104ecd82e07787a9ff3c6ca7b6dbf
Opcode Fuzzy Hash: ce3939e54dc7c4d0213c60e660cb2d7943ef013ed53c594df7565f9a02007bda
Instruction Fuzzy Hash: A821D132500259BBDF21DE65CC86FEA3B79FF48724F110214FE156B1D0D6B5A851ABA0

Function 00FE6F1F Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 84windowCOMMON

Download Yara Rule

APIs

SendMessageW.USER32(00000000,00000180,00000000,?), ref: 00FE6FAA
SendMessageW.USER32(?,00000186,00000000,00000000), ref: 00FE6FBA
MoveWindow.USER32(?,?,?,?,?,00000000,?,?,Listbox,00000000,00000000,?,?,?,?,?), ref: 00FE6FDF

Strings

Listbox, xrefs: 00FE6F77

Memory Dump Source

Source File: 00000000.00000002.1667912702.0000000000F61000.00000020.00000001.01000000.00000003.sdmp, Offset: 00F60000, based on PE: true

Associated: 00000000.00000002.1667891216.0000000000F60000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667966851.0000000000FEF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667966851.0000000001015000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1668035777.000000000101F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1668053678.0000000001028000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f60000_tgBNtoWqIp.jbxd

Similarity

API ID: MessageSend$MoveWindow
String ID: Listbox
API String ID: 3315199576-2633736733
Opcode ID: bdb0d00a256495d4aec962642171dbab02f332ac51af42bcaebbed3d04cb1946
Instruction ID: d225742d5aa73a154bcee421c6f8231b782ddf87be5533a45ecc4bd3b07eedc9
Opcode Fuzzy Hash: bdb0d00a256495d4aec962642171dbab02f332ac51af42bcaebbed3d04cb1946
Instruction Fuzzy Hash: 0021C532A1019C7FDF118F55DC85FAB376AEF997A0F018124F904DB190D6719C51A7A0

Function 00FE797D Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 66windowCOMMON

Download Yara Rule

APIs

SendMessageW.USER32(00000000,00000405,00000000,00000000), ref: 00FE79E1
SendMessageW.USER32(?,00000406,00000000,00640000), ref: 00FE79F6
SendMessageW.USER32(?,00000414,0000000A,00000000), ref: 00FE7A03

Strings

msctls_trackbar32, xrefs: 00FE79B8

Memory Dump Source

Source File: 00000000.00000002.1667912702.0000000000F61000.00000020.00000001.01000000.00000003.sdmp, Offset: 00F60000, based on PE: true

Associated: 00000000.00000002.1667891216.0000000000F60000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667966851.0000000000FEF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667966851.0000000001015000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1668035777.000000000101F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1668053678.0000000001028000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f60000_tgBNtoWqIp.jbxd

Similarity

API ID: MessageSend
String ID: msctls_trackbar32
API String ID: 3850602802-1010561917
Opcode ID: 843004cf4fd37c48d1666472e6f3858333e988b3829e25a4222f6ea0b6785856
Instruction ID: 5ff3a66c754d43530f9e991573273d8bb003d1ef4a46a99983a437542f48dd01
Opcode Fuzzy Hash: 843004cf4fd37c48d1666472e6f3858333e988b3829e25a4222f6ea0b6785856
Instruction Fuzzy Hash: E5110A72644348BBEF20AF71CC05FDB77A9EF89B64F110529FA41A6091D276D811EB60

Function 00F64C95 Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 18libraryloaderCOMMON

Download Yara Rule

APIs

LoadLibraryA.KERNEL32(kernel32.dll,?,00F64C2E), ref: 00F64CA3
GetProcAddress.KERNEL32(00000000,GetNativeSystemInfo), ref: 00F64CB5

Strings

GetNativeSystemInfo, xrefs: 00F64CAF
kernel32.dll, xrefs: 00F64C9E

Memory Dump Source

Source File: 00000000.00000002.1667912702.0000000000F61000.00000020.00000001.01000000.00000003.sdmp, Offset: 00F60000, based on PE: true

Associated: 00000000.00000002.1667891216.0000000000F60000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667966851.0000000000FEF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667966851.0000000001015000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1668035777.000000000101F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1668053678.0000000001028000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f60000_tgBNtoWqIp.jbxd

Similarity

API ID: AddressLibraryLoadProc
String ID: GetNativeSystemInfo$kernel32.dll
API String ID: 2574300362-192647395
Opcode ID: 6f8ad40b895cffcbc8186f7136666c02f44eac057198c77cb66d51767cff99d8
Instruction ID: 74a0697d1e6463b7eefa9affb1fa4d6ffed5a53c0ec0be5aa198914d3113dc04
Opcode Fuzzy Hash: 6f8ad40b895cffcbc8186f7136666c02f44eac057198c77cb66d51767cff99d8
Instruction Fuzzy Hash: F9D02B30D0073BCFC7205F31CD4860272D5AF41750B10C83ED881CA650D774D484E610

Function 00F64D94 Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 18libraryloaderCOMMON

Download Yara Rule

APIs

LoadLibraryA.KERNEL32(kernel32.dll,?,00F64CE1,?), ref: 00F64DA2
GetProcAddress.KERNEL32(00000000,Wow64RevertWow64FsRedirection), ref: 00F64DB4

Strings

Wow64RevertWow64FsRedirection, xrefs: 00F64DAE
kernel32.dll, xrefs: 00F64D9D

Memory Dump Source

Source File: 00000000.00000002.1667912702.0000000000F61000.00000020.00000001.01000000.00000003.sdmp, Offset: 00F60000, based on PE: true

Associated: 00000000.00000002.1667891216.0000000000F60000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667966851.0000000000FEF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667966851.0000000001015000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1668035777.000000000101F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1668053678.0000000001028000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f60000_tgBNtoWqIp.jbxd

Similarity

API ID: AddressLibraryLoadProc
String ID: Wow64RevertWow64FsRedirection$kernel32.dll
API String ID: 2574300362-1355242751
Opcode ID: 09687ec7a89af63c5f58b7f0043555a3c22752bd8775689ec8b6315936e87bd6
Instruction ID: 74e281a508815b16d9c6bf11fd7521633a18c09fe1e62790e24527a904358ec0
Opcode Fuzzy Hash: 09687ec7a89af63c5f58b7f0043555a3c22752bd8775689ec8b6315936e87bd6
Instruction Fuzzy Hash: DAD05E71D50717CFD720AF32D848A4676E4AF06369B11C83EE8C6DA560E778E884EA50

Function 00F64D61 Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 18libraryloaderCOMMON

Download Yara Rule

APIs

LoadLibraryA.KERNEL32(kernel32.dll,?,00F64D2E,?,00F64F4F,?,010262F8,00000001,>>>AUTOIT NO CMDEXECUTE<<<,?), ref: 00F64D6F
GetProcAddress.KERNEL32(00000000,Wow64DisableWow64FsRedirection), ref: 00F64D81

Strings

Wow64DisableWow64FsRedirection, xrefs: 00F64D7B
kernel32.dll, xrefs: 00F64D6A

Memory Dump Source

Source File: 00000000.00000002.1667912702.0000000000F61000.00000020.00000001.01000000.00000003.sdmp, Offset: 00F60000, based on PE: true

Associated: 00000000.00000002.1667891216.0000000000F60000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667966851.0000000000FEF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667966851.0000000001015000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1668035777.000000000101F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1668053678.0000000001028000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f60000_tgBNtoWqIp.jbxd

Similarity

API ID: AddressLibraryLoadProc
String ID: Wow64DisableWow64FsRedirection$kernel32.dll
API String ID: 2574300362-3689287502
Opcode ID: 0d967cbcab091627f86dd243c33b65d03655fcd9376236564eba1f06436bcb0c
Instruction ID: f6034989c8e6838ee96f715ed37158703263b05f947c6ed54a1c815ce5158dee
Opcode Fuzzy Hash: 0d967cbcab091627f86dd243c33b65d03655fcd9376236564eba1f06436bcb0c
Instruction Fuzzy Hash: 7CD01730D10757CFD720AF32D84861676E8AF153A6B11C83EA486DA2A0E678E884EA50

Function 00FE1072 Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 18libraryloaderCOMMON

Download Yara Rule

APIs

LoadLibraryA.KERNEL32(advapi32.dll,?,00FE12C1), ref: 00FE1080
GetProcAddress.KERNEL32(00000000,RegDeleteKeyExW), ref: 00FE1092

Strings

RegDeleteKeyExW, xrefs: 00FE108C
advapi32.dll, xrefs: 00FE107B

Memory Dump Source

Source File: 00000000.00000002.1667912702.0000000000F61000.00000020.00000001.01000000.00000003.sdmp, Offset: 00F60000, based on PE: true

Associated: 00000000.00000002.1667891216.0000000000F60000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667966851.0000000000FEF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667966851.0000000001015000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1668035777.000000000101F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1668053678.0000000001028000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f60000_tgBNtoWqIp.jbxd

Similarity

API ID: AddressLibraryLoadProc
String ID: RegDeleteKeyExW$advapi32.dll
API String ID: 2574300362-4033151799
Opcode ID: 5807276a7775847fb3616f32f489d05c65551d2477a3fb06bff24cd0440bbbc8
Instruction ID: 230275db683219312d5553190893adf8481dafc1fe01eba7f5199fa4e74d3b72
Opcode Fuzzy Hash: 5807276a7775847fb3616f32f489d05c65551d2477a3fb06bff24cd0440bbbc8
Instruction Fuzzy Hash: 13D0E230910796CFD7209B36D858A5A76E4BF49361B11882EE4CADA120E7B8C8849A50

Function 00FD93F5 Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 18libraryloaderCOMMON

Download Yara Rule

APIs

LoadLibraryA.KERNEL32(kernel32.dll,00000001,00FD9009,?,00FEF910), ref: 00FD9403
GetProcAddress.KERNEL32(00000000,GetModuleHandleExW), ref: 00FD9415

Strings

GetModuleHandleExW, xrefs: 00FD940F
kernel32.dll, xrefs: 00FD93FE

Memory Dump Source

Source File: 00000000.00000002.1667912702.0000000000F61000.00000020.00000001.01000000.00000003.sdmp, Offset: 00F60000, based on PE: true

Associated: 00000000.00000002.1667891216.0000000000F60000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667966851.0000000000FEF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667966851.0000000001015000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1668035777.000000000101F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1668053678.0000000001028000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f60000_tgBNtoWqIp.jbxd

Similarity

API ID: AddressLibraryLoadProc
String ID: GetModuleHandleExW$kernel32.dll
API String ID: 2574300362-199464113
Opcode ID: 5992773675d9c4b2cd18035035444227d9eeddf65905dfaed298a8f16826ed7c
Instruction ID: 17d4f5629178bd5468832d776cd2d3505d27534c2c702d820fc93852cb989c71
Opcode Fuzzy Hash: 5992773675d9c4b2cd18035035444227d9eeddf65905dfaed298a8f16826ed7c
Instruction Fuzzy Hash: 67D0C731A0475BCFC7208F72C94820372E6AF02361B04C83FA482EA620E6B8C884EA10

Function 00FA1B3E Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 17timeCOMMON

Download Yara Rule

APIs

GetLocalTime.KERNEL32(?), ref: 00FA1B42
__swprintf.LIBCMT ref: 00FA1B73

Strings

WIN_XPe, xrefs: 00FA1BB2
%.3d, xrefs: 00FA1B4D

Memory Dump Source

Source File: 00000000.00000002.1667912702.0000000000F61000.00000020.00000001.01000000.00000003.sdmp, Offset: 00F60000, based on PE: true

Associated: 00000000.00000002.1667891216.0000000000F60000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667966851.0000000000FEF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667966851.0000000001015000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1668035777.000000000101F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1668053678.0000000001028000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f60000_tgBNtoWqIp.jbxd

Similarity

API ID: LocalTime__swprintf
String ID: %.3d$WIN_XPe
API String ID: 2070861257-2409531811
Opcode ID: e6c320d37fe032ccacbfede81770239aa98d4d13a69210df79fb8fd30ef706f5
Instruction ID: 2259ecbe3883aa4f58df4c210adb3cf7ae2e1a3304fdf109957e0a3088ba35ee
Opcode Fuzzy Hash: e6c320d37fe032ccacbfede81770239aa98d4d13a69210df79fb8fd30ef706f5
Instruction Fuzzy Hash: F9D012F7804158EBCB14AA90DC44AF9737CB745341F550592F542D6000F3389B84BB71

Function 00FB76C5 Relevance: 6.3, APIs: 4, Instructions: 333COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1667912702.0000000000F61000.00000020.00000001.01000000.00000003.sdmp, Offset: 00F60000, based on PE: true

Associated: 00000000.00000002.1667891216.0000000000F60000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667966851.0000000000FEF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667966851.0000000001015000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1668035777.000000000101F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1668053678.0000000001028000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f60000_tgBNtoWqIp.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: dae51d08387c71757dd391f41db00909a63a24b6be19927c1a341813d372ce31
Instruction ID: d3e88ee130b32764c1e3bf91524ecafec8cfa86a80cb7e3cd3c15c66ad464c46
Opcode Fuzzy Hash: dae51d08387c71757dd391f41db00909a63a24b6be19927c1a341813d372ce31
Instruction Fuzzy Hash: 23C16E75A04216EFCB14EF95C884EAEB7B5FF88710B218599E805EB251D730EE41EF90

Function 00FDE33E Relevance: 6.3, APIs: 4, Instructions: 307memoryCOMMON

Download Yara Rule

APIs

CharLowerBuffW.USER32(?,?), ref: 00FDE3D2
CharLowerBuffW.USER32(?,?), ref: 00FDE415

Part of subcall function 00FDDAB9: CharLowerBuffW.USER32(?,?,?,?,00000000,?,?), ref: 00FDDAD9

VirtualAlloc.KERNEL32(00000000,00000077,00003000,00000040), ref: 00FDE615
_memmove.LIBCMT ref: 00FDE628

Memory Dump Source

Source File: 00000000.00000002.1667912702.0000000000F61000.00000020.00000001.01000000.00000003.sdmp, Offset: 00F60000, based on PE: true

Associated: 00000000.00000002.1667891216.0000000000F60000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667966851.0000000000FEF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667966851.0000000001015000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1668035777.000000000101F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1668053678.0000000001028000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f60000_tgBNtoWqIp.jbxd

Similarity

API ID: BuffCharLower$AllocVirtual_memmove
String ID:
API String ID: 3659485706-0
Opcode ID: e86820382b118478f7d7968a4501e3130e5186d480497d85726e446733baec64
Instruction ID: 8f11c9f413dbb4d273880b360772f6d1daa6ae73354114a70a0d9a78d31f1cf0
Opcode Fuzzy Hash: e86820382b118478f7d7968a4501e3130e5186d480497d85726e446733baec64
Instruction Fuzzy Hash: 81C15B71A083018FC714EF28C880A5ABBE5FF89714F18896EF8999B351D775E905DF82

Function 00FD83A8 Relevance: 6.3, APIs: 4, Instructions: 267COMMON

Download Yara Rule

APIs

CoInitialize.OLE32(00000000), ref: 00FD83D8
CoUninitialize.OLE32 ref: 00FD83E3

Part of subcall function 00FBDA5D: CoCreateInstance.OLE32(?,00000000,00000005,?,?,?,?,?,?,?,?,?,?,?), ref: 00FBDAC5

VariantInit.OLEAUT32(?), ref: 00FD83EE
VariantClear.OLEAUT32(?), ref: 00FD86BF

Memory Dump Source

Source File: 00000000.00000002.1667912702.0000000000F61000.00000020.00000001.01000000.00000003.sdmp, Offset: 00F60000, based on PE: true

Associated: 00000000.00000002.1667891216.0000000000F60000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667966851.0000000000FEF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667966851.0000000001015000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1668035777.000000000101F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1668053678.0000000001028000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f60000_tgBNtoWqIp.jbxd

Similarity

API ID: Variant$ClearCreateInitInitializeInstanceUninitialize
String ID:
API String ID: 780911581-0
Opcode ID: 6a60c72215aad5436664479686d6f80246c8e9c5ef6f7d1d53fda4418780a333
Instruction ID: a2aeb5b955d3a11348c8883372ff3d9f0d6be14dc5699ab16e2cab581ff8c95c
Opcode Fuzzy Hash: 6a60c72215aad5436664479686d6f80246c8e9c5ef6f7d1d53fda4418780a333
Instruction Fuzzy Hash: 82A138756087019FCB10EF14C891B2AB7E5FF88364F184449F99A9B3A2CB74ED05EB42

Function 00FB7A78 Relevance: 6.2, APIs: 4, Instructions: 231COMMON

Download Yara Rule

APIs

ProgIDFromCLSID.OLE32(?,00000000,?,00000000,00000800,00000000,?,00FF2C7C,?), ref: 00FB7C32
CoTaskMemFree.OLE32(00000000,00000000,?,00000000,00000800,00000000,?,00FF2C7C,?), ref: 00FB7C4A
CLSIDFromProgID.OLE32(?,?,00000000,00FEFB80,000000FF,?,00000000,00000800,00000000,?,00FF2C7C,?), ref: 00FB7C6F
_memcmp.LIBCMT ref: 00FB7C90

Memory Dump Source

Source File: 00000000.00000002.1667912702.0000000000F61000.00000020.00000001.01000000.00000003.sdmp, Offset: 00F60000, based on PE: true

Associated: 00000000.00000002.1667891216.0000000000F60000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667966851.0000000000FEF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667966851.0000000001015000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1668035777.000000000101F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1668053678.0000000001028000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f60000_tgBNtoWqIp.jbxd

Similarity

API ID: FromProg$FreeTask_memcmp
String ID:
API String ID: 314563124-0
Opcode ID: 1951f3fbda095b87adc1bd19860796d74267a4e6c155cc9496186afd09143a6a
Instruction ID: 233dc0f371d3dc4c41c50dc479ad7d6e61fde00d26ba4840432b41a88aa1f4fe
Opcode Fuzzy Hash: 1951f3fbda095b87adc1bd19860796d74267a4e6c155cc9496186afd09143a6a
Instruction Fuzzy Hash: 76811C71A00209EFCB04DF94C984EEEB7B9FF89315F208198E506AB250DB71AE05DF60

Function 00FB6DF3 Relevance: 6.2, APIs: 4, Instructions: 202memoryCOMMON

Download Yara Rule

APIs

VariantInit.OLEAUT32(?), ref: 00FB6E04
SysAllocString.OLEAUT32(00000000), ref: 00FB6EAD
VariantCopy.OLEAUT32 ref: 00FB6EDC
VariantClear.OLEAUT32(?), ref: 00FB6F03

Memory Dump Source

Source File: 00000000.00000002.1667912702.0000000000F61000.00000020.00000001.01000000.00000003.sdmp, Offset: 00F60000, based on PE: true

Associated: 00000000.00000002.1667891216.0000000000F60000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667966851.0000000000FEF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667966851.0000000001015000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1668035777.000000000101F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1668053678.0000000001028000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f60000_tgBNtoWqIp.jbxd

Similarity

API ID: Variant$AllocClearCopyInitString
String ID:
API String ID: 2808897238-0
Opcode ID: 3ae05323bcd04dc8f66616472524d1e789c5afce2e6e6fdd0ad7c87883487989
Instruction ID: 2d2827616e2e22f2a313fa0c12c12f54dbcab4d2a4a5c375c75062e312c6418d
Opcode Fuzzy Hash: 3ae05323bcd04dc8f66616472524d1e789c5afce2e6e6fdd0ad7c87883487989
Instruction Fuzzy Hash: 775198316083029ADB24BF66D891BB9B3E5EF48350F20881FF556CB691EF789844BF15

Function 00FE9A63 Relevance: 6.1, APIs: 4, Instructions: 140COMMON

Download Yara Rule

APIs

GetWindowRect.USER32(01A8E678,?), ref: 00FE9AD2
ScreenToClient.USER32(00000002,00000002), ref: 00FE9B05
MoveWindow.USER32(?,?,?,?,000000FF,00000001,?,?,00000002,?,?), ref: 00FE9B72

Memory Dump Source

Source File: 00000000.00000002.1667912702.0000000000F61000.00000020.00000001.01000000.00000003.sdmp, Offset: 00F60000, based on PE: true

Associated: 00000000.00000002.1667891216.0000000000F60000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667966851.0000000000FEF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667966851.0000000001015000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1668035777.000000000101F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1668053678.0000000001028000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f60000_tgBNtoWqIp.jbxd

Similarity

API ID: Window$ClientMoveRectScreen
String ID:
API String ID: 3880355969-0
Opcode ID: 2baea36a5e7bcb548d45260bb0e40ebfaaecb8b4c0e3c27640698a07c1dfd8e4
Instruction ID: 2079003bd0fe9e0af08fc7fc560d1cb786c64e42dac3941b6a599341ca6f510b
Opcode Fuzzy Hash: 2baea36a5e7bcb548d45260bb0e40ebfaaecb8b4c0e3c27640698a07c1dfd8e4
Instruction Fuzzy Hash: DA518434A04289EFCF24DF55D8809AE7BF5FF84720F108269F8559B290D771AE41DB60

Function 00FD6CBD Relevance: 6.1, APIs: 4, Instructions: 127networkCOMMON

Download Yara Rule

APIs

socket.WSOCK32(00000002,00000002,00000011), ref: 00FD6CE4
WSAGetLastError.WSOCK32(00000000), ref: 00FD6CF4

Part of subcall function 00F69997: __itow.LIBCMT ref: 00F699C2
Part of subcall function 00F69997: __swprintf.LIBCMT ref: 00F69A0C

#21.WSOCK32(?,0000FFFF,00000020,00000002,00000004), ref: 00FD6D58
WSAGetLastError.WSOCK32(00000000), ref: 00FD6D64

Memory Dump Source

Source File: 00000000.00000002.1667912702.0000000000F61000.00000020.00000001.01000000.00000003.sdmp, Offset: 00F60000, based on PE: true

Associated: 00000000.00000002.1667891216.0000000000F60000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667966851.0000000000FEF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667966851.0000000001015000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1668035777.000000000101F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1668053678.0000000001028000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f60000_tgBNtoWqIp.jbxd

Similarity

API ID: ErrorLast$__itow__swprintfsocket
String ID:
API String ID: 2214342067-0
Opcode ID: 0b7da2eea65426b160aece3182b321d3b6e36e0a07e5c44bdd25691896972acf
Instruction ID: 66cf6be5b7bd50c13c8c2958dbd8bba837a11b114e1ff80f21db5b97ab4136ec
Opcode Fuzzy Hash: 0b7da2eea65426b160aece3182b321d3b6e36e0a07e5c44bdd25691896972acf
Instruction Fuzzy Hash: EA41B234740200AFEB10AF24DC86F3A77E9DB04B10F448018FA199B2C2DAB99D01AB91

Function 00FD672D Relevance: 6.1, APIs: 4, Instructions: 116COMMON

Download Yara Rule

APIs

#16.WSOCK32(?,?,00000000,00000000,00000000,00000000,?,?,00000000,00FEF910), ref: 00FD67BA
_strlen.LIBCMT ref: 00FD67EC

Memory Dump Source

Source File: 00000000.00000002.1667912702.0000000000F61000.00000020.00000001.01000000.00000003.sdmp, Offset: 00F60000, based on PE: true

Associated: 00000000.00000002.1667891216.0000000000F60000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667966851.0000000000FEF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667966851.0000000001015000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1668035777.000000000101F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1668053678.0000000001028000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f60000_tgBNtoWqIp.jbxd

Similarity

API ID: _strlen
String ID:
API String ID: 4218353326-0
Opcode ID: 264042cc2376287a9917355f6394de5273598c700a059a91474020195858a70f
Instruction ID: 4fef3e40671c68fb1b6de696db8de9d218a3524f0e5eae0004bccae1d556e5d9
Opcode Fuzzy Hash: 264042cc2376287a9917355f6394de5273598c700a059a91474020195858a70f
Instruction Fuzzy Hash: BC41A431A00104ABCB14EBA5DCD1FAEB3AAEF44710F188156F415DB392DB78AD05FB50

Function 00FCBA5F Relevance: 6.1, APIs: 4, Instructions: 111fileCOMMON

Download Yara Rule

APIs

CreateHardLinkW.KERNEL32(00000002,?,00000000), ref: 00FCBB09
GetLastError.KERNEL32(?,00000000), ref: 00FCBB2F
DeleteFileW.KERNEL32(00000002,?,00000000), ref: 00FCBB54
CreateHardLinkW.KERNEL32(00000002,?,00000000,?,00000000), ref: 00FCBB80

Memory Dump Source

Source File: 00000000.00000002.1667912702.0000000000F61000.00000020.00000001.01000000.00000003.sdmp, Offset: 00F60000, based on PE: true

Associated: 00000000.00000002.1667891216.0000000000F60000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667966851.0000000000FEF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667966851.0000000001015000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1668035777.000000000101F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1668053678.0000000001028000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f60000_tgBNtoWqIp.jbxd

Similarity

API ID: CreateHardLink$DeleteErrorFileLast
String ID:
API String ID: 3321077145-0
Opcode ID: 08e94faef4e1da0710187499ec4af99f5e6e5ef966763467139f6556a96aa831
Instruction ID: bb8ea9fbfdadf1c7f1d7340268ae3924b85f39371da003c7aec05b3dc4102a63
Opcode Fuzzy Hash: 08e94faef4e1da0710187499ec4af99f5e6e5ef966763467139f6556a96aa831
Instruction Fuzzy Hash: 13412B39604651DFCB10EF15C985A5DBBE5EF89320B098498EC4A9B362CB78FD01EB91

Function 00FE8AC0 Relevance: 6.1, APIs: 4, Instructions: 109COMMON

Download Yara Rule

APIs

InvalidateRect.USER32(?,00000000,00000001,?,?,?), ref: 00FE8B4D

Memory Dump Source

Source File: 00000000.00000002.1667912702.0000000000F61000.00000020.00000001.01000000.00000003.sdmp, Offset: 00F60000, based on PE: true

Associated: 00000000.00000002.1667891216.0000000000F60000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667966851.0000000000FEF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667966851.0000000001015000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1668035777.000000000101F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1668053678.0000000001028000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f60000_tgBNtoWqIp.jbxd

Similarity

API ID: InvalidateRect
String ID:
API String ID: 634782764-0
Opcode ID: 9d5fe5de7952e7343b2126e9d35cf102e2e997c0fd67b8faeb7e27d4c44086be
Instruction ID: cea2e67b1860d8c703c6e55020bc204b989a2e1ebd4c0fe508ce953e273c60dc
Opcode Fuzzy Hash: 9d5fe5de7952e7343b2126e9d35cf102e2e997c0fd67b8faeb7e27d4c44086be
Instruction Fuzzy Hash: DD31D874A00288BFEB34BE1ACC85FA93765FB453A0F244612F959D62E1CE359942B741

Function 00FEADF1 Relevance: 6.1, APIs: 4, Instructions: 106windowCOMMON

Download Yara Rule

APIs

ClientToScreen.USER32(?,?), ref: 00FEAE1A
GetWindowRect.USER32(?,?), ref: 00FEAE90
PtInRect.USER32(?,?,00FEC304), ref: 00FEAEA0
MessageBeep.USER32(00000000), ref: 00FEAF11

Memory Dump Source

Source File: 00000000.00000002.1667912702.0000000000F61000.00000020.00000001.01000000.00000003.sdmp, Offset: 00F60000, based on PE: true

Associated: 00000000.00000002.1667891216.0000000000F60000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667966851.0000000000FEF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667966851.0000000001015000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1668035777.000000000101F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1668053678.0000000001028000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f60000_tgBNtoWqIp.jbxd

Similarity

API ID: Rect$BeepClientMessageScreenWindow
String ID:
API String ID: 1352109105-0
Opcode ID: 7bc9cba3c5e969f28bcb6d0858e3d1394c1e6e5dd8385b2718c2eb2a70d418a9
Instruction ID: 7ec4f4e8cfb99193b776de54c5e2efd7c1e6f2606d7051e047c0638fa950bb1e
Opcode Fuzzy Hash: 7bc9cba3c5e969f28bcb6d0858e3d1394c1e6e5dd8385b2718c2eb2a70d418a9
Instruction Fuzzy Hash: E441BF70A00189DFCB21CF6AC884B697BF5FF49310F2881A9E814DB255C731B802EF92

Function 00F96415 Relevance: 6.1, APIs: 4, Instructions: 97COMMONLIBRARYCODE

Download Yara Rule

APIs

_LocaleUpdate::_LocaleUpdate.LIBCMT ref: 00F9644B
__isleadbyte_l.LIBCMT ref: 00F96479
MultiByteToWideChar.KERNEL32(00000080,00000009,00000002,00000001,00000000,00000000,?,00000000,00000000,?,?), ref: 00F964A7
MultiByteToWideChar.KERNEL32(00000080,00000009,00000002,00000001,00000000,00000000,?,00000000,00000000,?,?), ref: 00F964DD

Memory Dump Source

Source File: 00000000.00000002.1667912702.0000000000F61000.00000020.00000001.01000000.00000003.sdmp, Offset: 00F60000, based on PE: true

Associated: 00000000.00000002.1667891216.0000000000F60000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667966851.0000000000FEF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667966851.0000000001015000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1668035777.000000000101F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1668053678.0000000001028000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f60000_tgBNtoWqIp.jbxd

Similarity

API ID: ByteCharLocaleMultiWide$UpdateUpdate::___isleadbyte_l
String ID:
API String ID: 3058430110-0
Opcode ID: 4fc0e59c63ad30db2460ef6cef5ad85bdeb3f1a8c59fcb20c8f91d8447e014c3
Instruction ID: 1f1ba3efac207771711eee7c6f017a783745c25439223576279d339f613feb9c
Opcode Fuzzy Hash: 4fc0e59c63ad30db2460ef6cef5ad85bdeb3f1a8c59fcb20c8f91d8447e014c3
Instruction Fuzzy Hash: CA319031A0024AAFEF21DFB9CC45BAA7BA5FF41320F154429F855C71A1E735D851EB90

Function 00FE5175 Relevance: 6.1, APIs: 4, Instructions: 95COMMON

Download Yara Rule

APIs

GetForegroundWindow.USER32 ref: 00FE5189

Part of subcall function 00FC387D: GetWindowThreadProcessId.USER32(00000000,00000000), ref: 00FC3897
Part of subcall function 00FC387D: GetCurrentThreadId.KERNEL32 ref: 00FC389E
Part of subcall function 00FC387D: AttachThreadInput.USER32(00000000,?,00FC52A7), ref: 00FC38A5

GetCaretPos.USER32(?), ref: 00FE519A
ClientToScreen.USER32(00000000,?), ref: 00FE51D5
GetForegroundWindow.USER32 ref: 00FE51DB

Memory Dump Source

Source File: 00000000.00000002.1667912702.0000000000F61000.00000020.00000001.01000000.00000003.sdmp, Offset: 00F60000, based on PE: true

Associated: 00000000.00000002.1667891216.0000000000F60000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667966851.0000000000FEF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667966851.0000000001015000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1668035777.000000000101F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1668053678.0000000001028000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f60000_tgBNtoWqIp.jbxd

Similarity

API ID: ThreadWindow$Foreground$AttachCaretClientCurrentInputProcessScreen
String ID:
API String ID: 2759813231-0
Opcode ID: 24c3e5aacd8346141084e352e8645b15b05c097f99f01e3cbc490e227f06198f
Instruction ID: ae71e708f057e61ee93e0c346df2e821675c7b410fec8df860d38690aabc369d
Opcode Fuzzy Hash: 24c3e5aacd8346141084e352e8645b15b05c097f99f01e3cbc490e227f06198f
Instruction Fuzzy Hash: 44312E72900108AFDB00EFA5CD85AEFB7FDEF98300F10406AE415E7241DA799E05DBA0

Function 00FEC788 Relevance: 6.1, APIs: 4, Instructions: 83windowCOMMON

Download Yara Rule

APIs

Part of subcall function 00F62612: GetWindowLongW.USER32(?,000000EB), ref: 00F62623

GetCursorPos.USER32(?), ref: 00FEC7C2
TrackPopupMenuEx.USER32(?,00000000,?,?,?,00000000,?,00F9BBFB,?,?,?,?,?), ref: 00FEC7D7
GetCursorPos.USER32(?), ref: 00FEC824
DefDlgProcW.USER32(?,0000007B,?,?,?,?,?,?,?,?,?,?,00F9BBFB,?,?,?), ref: 00FEC85E

Memory Dump Source

Source File: 00000000.00000002.1667912702.0000000000F61000.00000020.00000001.01000000.00000003.sdmp, Offset: 00F60000, based on PE: true

Associated: 00000000.00000002.1667891216.0000000000F60000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667966851.0000000000FEF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667966851.0000000001015000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1668035777.000000000101F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1668053678.0000000001028000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f60000_tgBNtoWqIp.jbxd

Similarity

API ID: Cursor$LongMenuPopupProcTrackWindow
String ID:
API String ID: 2864067406-0
Opcode ID: a0200f231e7fcd4dfb13d5f5ce0868e939e8529715ea92c9df252db9b15fac47
Instruction ID: d5238217d39fdcbef5f9b1745ba41815e99bcd433311d635f7a4fe4007dd03fe
Opcode Fuzzy Hash: a0200f231e7fcd4dfb13d5f5ce0868e939e8529715ea92c9df252db9b15fac47
Instruction Fuzzy Hash: A631D835500198AFCB25CF59C898EEE7BB5FF09320F044169F9458B261C7355E51EFA0

Function 00F80BD0 Relevance: 6.1, APIs: 4, Instructions: 79COMMON

Download Yara Rule

APIs

__setmode.LIBCMT ref: 00F80BF2

Part of subcall function 00F65B75: WideCharToMultiByte.KERNEL32(00000000,00000000,?,00000001,00000000,00000000,00000000,00000000,00000000,00000000,?,00FC7B20,?,?,00000000), ref: 00F65B8C
Part of subcall function 00F65B75: WideCharToMultiByte.KERNEL32(00000000,00000000,?,00000001,00000000,?,00000000,00000000,?,?,00FC7B20,?,?,00000000,?,?), ref: 00F65BB0

_fprintf.LIBCMT ref: 00F80C29
OutputDebugStringW.KERNEL32(?), ref: 00FB6331

Part of subcall function 00F84CDA: _flsall.LIBCMT ref: 00F84CF3

__setmode.LIBCMT ref: 00F80C5E

Memory Dump Source

Source File: 00000000.00000002.1667912702.0000000000F61000.00000020.00000001.01000000.00000003.sdmp, Offset: 00F60000, based on PE: true

Associated: 00000000.00000002.1667891216.0000000000F60000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667966851.0000000000FEF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667966851.0000000001015000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1668035777.000000000101F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1668053678.0000000001028000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f60000_tgBNtoWqIp.jbxd

Similarity

API ID: ByteCharMultiWide__setmode$DebugOutputString_flsall_fprintf
String ID:
API String ID: 521402451-0
Opcode ID: cf90c1619a0fbea600f4921889e35551bd48657f60a09b751abe0a560c29f58d
Instruction ID: 7b258900afb4bf11ca0b34f0b30f9f3b0d58cc0cb6d83c21470402d7fa1976b5
Opcode Fuzzy Hash: cf90c1619a0fbea600f4921889e35551bd48657f60a09b751abe0a560c29f58d
Instruction Fuzzy Hash: 7411E4329042096ACB15BBB49C87EFE7B699F42320F14011AF204A7192DE7D6D46B795

Function 00FB8B9E Relevance: 6.1, APIs: 4, Instructions: 79memoryCOMMON

Download Yara Rule

APIs

Part of subcall function 00FB8652: GetTokenInformation.ADVAPI32(?,00000003(TokenIntegrityLevel),?,00000000,?), ref: 00FB8669
Part of subcall function 00FB8652: GetLastError.KERNEL32(?,TokenIntegrityLevel,?,00000000,?), ref: 00FB8673
Part of subcall function 00FB8652: GetProcessHeap.KERNEL32(00000008,?,?,TokenIntegrityLevel,?,00000000,?), ref: 00FB8682
Part of subcall function 00FB8652: HeapAlloc.KERNEL32(00000000,?,TokenIntegrityLevel,?,00000000,?), ref: 00FB8689
Part of subcall function 00FB8652: GetTokenInformation.ADVAPI32(?,00000003(TokenIntegrityLevel),00000000,?,?,?,TokenIntegrityLevel,?,00000000,?), ref: 00FB869F

LookupPrivilegeValueW.ADVAPI32(00000000,?,?), ref: 00FB8BEB
_memcmp.LIBCMT ref: 00FB8C0E
GetProcessHeap.KERNEL32(00000000,00000000), ref: 00FB8C44
HeapFree.KERNEL32(00000000), ref: 00FB8C4B

Memory Dump Source

Source File: 00000000.00000002.1667912702.0000000000F61000.00000020.00000001.01000000.00000003.sdmp, Offset: 00F60000, based on PE: true

Associated: 00000000.00000002.1667891216.0000000000F60000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667966851.0000000000FEF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667966851.0000000001015000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1668035777.000000000101F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1668053678.0000000001028000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f60000_tgBNtoWqIp.jbxd

Similarity

API ID: Heap$InformationProcessToken$AllocErrorFreeLastLookupPrivilegeValue_memcmp
String ID:
API String ID: 1592001646-0
Opcode ID: b6a1b1a3ef673349f12d66d53960b614a852f366cf0a6c00cef2bb0afd7b05bf
Instruction ID: 2bfea74cc310389a1e34b1eb1c3f0ba5b133d2dd44e1a20651062fd07c7010cc
Opcode Fuzzy Hash: b6a1b1a3ef673349f12d66d53960b614a852f366cf0a6c00cef2bb0afd7b05bf
Instruction Fuzzy Hash: 1221A1B1E01208EFCB00DFA5C945BEEBBB8EF80390F144059E454AB241DB30AE06EF60

Function 00FD1A5B Relevance: 6.1, APIs: 4, Instructions: 78networkCOMMON

Download Yara Rule

APIs

InternetConnectW.WININET(?,?,?,?,?,?,00000000,00000000), ref: 00FD1A97

Part of subcall function 00FD1B21: InternetOpenUrlW.WININET(?,?,00000000,00000000,?,00000000), ref: 00FD1B40
Part of subcall function 00FD1B21: InternetCloseHandle.WININET(00000000), ref: 00FD1BDD

Memory Dump Source

Source File: 00000000.00000002.1667912702.0000000000F61000.00000020.00000001.01000000.00000003.sdmp, Offset: 00F60000, based on PE: true

Associated: 00000000.00000002.1667891216.0000000000F60000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667966851.0000000000FEF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667966851.0000000001015000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1668035777.000000000101F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1668053678.0000000001028000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f60000_tgBNtoWqIp.jbxd

Similarity

API ID: Internet$CloseConnectHandleOpen
String ID:
API String ID: 1463438336-0
Opcode ID: b3c9d4c6ba26747a299d05153d6337dd197964d4107f2c161361679d91831486
Instruction ID: b1f52e43f9d64fc0526d7988c4a8c39d2440ca5cc3304e265144a49cbf594404
Opcode Fuzzy Hash: b3c9d4c6ba26747a299d05153d6337dd197964d4107f2c161361679d91831486
Instruction Fuzzy Hash: 1B21CF32200A04BFEB219F608C00FBAB7AAFF94710F18001BFA0196750EB759814BBA0

Function 00FBE1AF Relevance: 6.1, APIs: 3, Strings: 1, Instructions: 68stringCOMMON

Download Yara Rule

APIs

Part of subcall function 00FBF5AD: lstrlenW.KERNEL32(?,00000002,?,?,000000EF,?,00FBE1C4,?,?,?,00FBEFB7,00000000,000000EF,00000119,?,?), ref: 00FBF5BC
Part of subcall function 00FBF5AD: lstrcpyW.KERNEL32(00000000,?), ref: 00FBF5E2
Part of subcall function 00FBF5AD: lstrcmpiW.KERNEL32(00000000,?,00FBE1C4,?,?,?,00FBEFB7,00000000,000000EF,00000119,?,?), ref: 00FBF613

lstrlenW.KERNEL32(?,00000002,?,?,?,?,00FBEFB7,00000000,000000EF,00000119,?,?,00000000), ref: 00FBE1DD
lstrcpyW.KERNEL32(00000000,?), ref: 00FBE203
lstrcmpiW.KERNEL32(00000002,cdecl,?,00FBEFB7,00000000,000000EF,00000119,?,?,00000000), ref: 00FBE237

Strings

cdecl, xrefs: 00FBE22E

Memory Dump Source

Source File: 00000000.00000002.1667912702.0000000000F61000.00000020.00000001.01000000.00000003.sdmp, Offset: 00F60000, based on PE: true

Associated: 00000000.00000002.1667891216.0000000000F60000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667966851.0000000000FEF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667966851.0000000001015000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1668035777.000000000101F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1668053678.0000000001028000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f60000_tgBNtoWqIp.jbxd

Similarity

API ID: lstrcmpilstrcpylstrlen
String ID: cdecl
API String ID: 4031866154-3896280584
Opcode ID: b8a1ff30594417a2b53b9d0aa157fd4a4dc22af85283c6e0afbcb2b319c94270
Instruction ID: b2889376155ab43128637b8497ceca0443e01670fb3df77b90df667d3718cb7f
Opcode Fuzzy Hash: b8a1ff30594417a2b53b9d0aa157fd4a4dc22af85283c6e0afbcb2b319c94270
Instruction Fuzzy Hash: F011D336500345EFCB25AF65DC45DFA77B8FF84310B80802AF816CB260EB759855EB90

Function 00F95332 Relevance: 6.1, APIs: 4, Instructions: 67COMMONLIBRARYCODE

Download Yara Rule

APIs

_free.LIBCMT ref: 00F95351

Part of subcall function 00F8594C: __FF_MSGBANNER.LIBCMT ref: 00F85963
Part of subcall function 00F8594C: __NMSG_WRITE.LIBCMT ref: 00F8596A
Part of subcall function 00F8594C: RtlAllocateHeap.NTDLL(01A70000,00000000,00000001,00000000,?,?,?,00F81013,?), ref: 00F8598F

Memory Dump Source

Source File: 00000000.00000002.1667912702.0000000000F61000.00000020.00000001.01000000.00000003.sdmp, Offset: 00F60000, based on PE: true

Associated: 00000000.00000002.1667891216.0000000000F60000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667966851.0000000000FEF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667966851.0000000001015000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1668035777.000000000101F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1668053678.0000000001028000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f60000_tgBNtoWqIp.jbxd

Similarity

API ID: AllocateHeap_free
String ID:
API String ID: 614378929-0
Opcode ID: 2460ecc01ee43832eacd0bc36b1ee4ccdbdaac52fe1646f1f363a785cee29d67
Instruction ID: 6cd7ae100927d04716e4f5b0e619df9fa7c4561d5ab31b4b89b642bf3eb6d99b
Opcode Fuzzy Hash: 2460ecc01ee43832eacd0bc36b1ee4ccdbdaac52fe1646f1f363a785cee29d67
Instruction Fuzzy Hash: 1A11E333D04A15AFEF323FB0AC45AAD379A9F10BF0B24442AF944DA190DE798D41B790

Function 00F64531 Relevance: 6.1, APIs: 4, Instructions: 66timewindowCOMMON

Download Yara Rule

APIs

_memset.LIBCMT ref: 00F64560

Part of subcall function 00F6410D: _memset.LIBCMT ref: 00F6418D
Part of subcall function 00F6410D: _wcscpy.LIBCMT ref: 00F641E1
Part of subcall function 00F6410D: Shell_NotifyIconW.SHELL32(00000001,000003A8), ref: 00F641F1

KillTimer.USER32(?,00000001,?,?), ref: 00F645B5
SetTimer.USER32(?,00000001,000002EE,00000000), ref: 00F645C4
Shell_NotifyIconW.SHELL32(00000001,000003A8), ref: 00F9D6CE

Memory Dump Source

Source File: 00000000.00000002.1667912702.0000000000F61000.00000020.00000001.01000000.00000003.sdmp, Offset: 00F60000, based on PE: true

Associated: 00000000.00000002.1667891216.0000000000F60000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667966851.0000000000FEF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667966851.0000000001015000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1668035777.000000000101F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1668053678.0000000001028000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f60000_tgBNtoWqIp.jbxd

Similarity

API ID: IconNotifyShell_Timer_memset$Kill_wcscpy
String ID:
API String ID: 1378193009-0
Opcode ID: f1fe1eb9cbc0b3a9c509d5004724a9ca41f3924f1c06d65521723bb45da55b84
Instruction ID: 3c6c52d033256bf7763fa99a50b1a648e4cc769a099d21691824fcfc6e271849
Opcode Fuzzy Hash: f1fe1eb9cbc0b3a9c509d5004724a9ca41f3924f1c06d65521723bb45da55b84
Instruction Fuzzy Hash: AD210771904784AFFB329B24CC55BE7BBEC9F02318F14009EE69E56281C7742E88AB51

Function 00FD667C Relevance: 6.1, APIs: 4, Instructions: 61networkCOMMON

Download Yara Rule

APIs

Part of subcall function 00F65B75: WideCharToMultiByte.KERNEL32(00000000,00000000,?,00000001,00000000,00000000,00000000,00000000,00000000,00000000,?,00FC7B20,?,?,00000000), ref: 00F65B8C
Part of subcall function 00F65B75: WideCharToMultiByte.KERNEL32(00000000,00000000,?,00000001,00000000,?,00000000,00000000,?,?,00FC7B20,?,?,00000000,?,?), ref: 00F65BB0

gethostbyname.WSOCK32(?,?,?), ref: 00FD66AC
WSAGetLastError.WSOCK32(00000000), ref: 00FD66B7
_memmove.LIBCMT ref: 00FD66E4
inet_ntoa.WSOCK32(?), ref: 00FD66EF

Memory Dump Source

Source File: 00000000.00000002.1667912702.0000000000F61000.00000020.00000001.01000000.00000003.sdmp, Offset: 00F60000, based on PE: true

Associated: 00000000.00000002.1667891216.0000000000F60000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667966851.0000000000FEF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667966851.0000000001015000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1668035777.000000000101F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1668053678.0000000001028000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f60000_tgBNtoWqIp.jbxd

Similarity

API ID: ByteCharMultiWide$ErrorLast_memmovegethostbynameinet_ntoa
String ID:
API String ID: 1504782959-0
Opcode ID: ec73ab69059aa11ebeca5fc7bd531c12090d4a7dc4ae49e1ea073bed99a1f5ef
Instruction ID: c9cc92edf6f833d02b893b4616dfe07d5ded1b8a81f316b2852254bd8876a4bf
Opcode Fuzzy Hash: ec73ab69059aa11ebeca5fc7bd531c12090d4a7dc4ae49e1ea073bed99a1f5ef
Instruction Fuzzy Hash: 14115135900508AFCB00FBA4DD96DEE77B9EF44710B144066F502A7261DF349F04EB51

Function 00FB9023 Relevance: 6.1, APIs: 4, Instructions: 59windowCOMMON

Download Yara Rule

APIs

SendMessageW.USER32(?,000000B0,?,?), ref: 00FB9043
SendMessageW.USER32(?,000000C9,?,00000000), ref: 00FB9055
SendMessageW.USER32(?,000000C9,?,00000000), ref: 00FB906B
SendMessageW.USER32(?,000000C9,?,00000000), ref: 00FB9086

Memory Dump Source

Source File: 00000000.00000002.1667912702.0000000000F61000.00000020.00000001.01000000.00000003.sdmp, Offset: 00F60000, based on PE: true

Associated: 00000000.00000002.1667891216.0000000000F60000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667966851.0000000000FEF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667966851.0000000001015000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1668035777.000000000101F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1668053678.0000000001028000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f60000_tgBNtoWqIp.jbxd

Similarity

API ID: MessageSend
String ID:
API String ID: 3850602802-0
Opcode ID: be117c7e9b464ae31e5afa18ad321c5fa937b96908975f9914fb0bf96e4a9f2a
Instruction ID: 27aeaf7d779b33db0655c8b39953ee2e0eb89e008383dd5b825f03872d4c0414
Opcode Fuzzy Hash: be117c7e9b464ae31e5afa18ad321c5fa937b96908975f9914fb0bf96e4a9f2a
Instruction Fuzzy Hash: 36114C7A900218FFDB10DFA5CC84EDDBB74FB48350F2040A5EA04B7250D6716E10EB90

Function 00F61290 Relevance: 6.1, APIs: 4, Instructions: 59COMMON

Download Yara Rule

APIs

Part of subcall function 00F62612: GetWindowLongW.USER32(?,000000EB), ref: 00F62623

DefDlgProcW.USER32(?,00000020,?), ref: 00F612D8
GetClientRect.USER32(?,?), ref: 00F9B84B
GetCursorPos.USER32(?), ref: 00F9B855
ScreenToClient.USER32(?,?), ref: 00F9B860

Memory Dump Source

Source File: 00000000.00000002.1667912702.0000000000F61000.00000020.00000001.01000000.00000003.sdmp, Offset: 00F60000, based on PE: true

Associated: 00000000.00000002.1667891216.0000000000F60000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667966851.0000000000FEF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667966851.0000000001015000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1668035777.000000000101F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1668053678.0000000001028000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f60000_tgBNtoWqIp.jbxd

Similarity

API ID: Client$CursorLongProcRectScreenWindow
String ID:
API String ID: 4127811313-0
Opcode ID: 044c6bffa77c31c3fd25c8ca1bc3cb0b06f1dca9ae66bcdf297749bffde93544
Instruction ID: e515ac0a69b4cc535f000a5796bcc65e3eef48b5df4ddefacec9cd6694bd79d9
Opcode Fuzzy Hash: 044c6bffa77c31c3fd25c8ca1bc3cb0b06f1dca9ae66bcdf297749bffde93544
Instruction Fuzzy Hash: 5C118876A0005DAFCF10EFA8D8999FE77B8FB05300F040456FA01E7240C734BA55ABA5

Function 00FC1652 Relevance: 6.1, APIs: 4, Instructions: 51sleepCOMMON

Download Yara Rule

APIs

QueryPerformanceCounter.KERNEL32(?,?,?,?,?,?,?,00FC01FD,?,00FC1250,?,00008000), ref: 00FC166F
Sleep.KERNEL32(00000000,?,?,?,?,?,?,00FC01FD,?,00FC1250,?,00008000), ref: 00FC1694
QueryPerformanceCounter.KERNEL32(?,?,?,?,?,?,?,00FC01FD,?,00FC1250,?,00008000), ref: 00FC169E
Sleep.KERNEL32(?,?,?,?,?,?,?,00FC01FD,?,00FC1250,?,00008000), ref: 00FC16D1

Memory Dump Source

Source File: 00000000.00000002.1667912702.0000000000F61000.00000020.00000001.01000000.00000003.sdmp, Offset: 00F60000, based on PE: true

Associated: 00000000.00000002.1667891216.0000000000F60000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667966851.0000000000FEF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667966851.0000000001015000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1668035777.000000000101F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1668053678.0000000001028000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f60000_tgBNtoWqIp.jbxd

Similarity

API ID: CounterPerformanceQuerySleep
String ID:
API String ID: 2875609808-0
Opcode ID: 2ac20e7dad141b9a121408115988078321680da0aea1bfa84fd2e41360645b14
Instruction ID: 9ecd20e86def04fa36cb2ddd8a7ae6f2555c2d61d34d2ddaea1ea02da77d658e
Opcode Fuzzy Hash: 2ac20e7dad141b9a121408115988078321680da0aea1bfa84fd2e41360645b14
Instruction Fuzzy Hash: A9118231C0151ED7CF04AFA5DA85BEEBF78FF0A711F444069D940B6141CB349564BB95

Function 00F97207 Relevance: 6.0, APIs: 4, Instructions: 48COMMONLIBRARYCODE

Download Yara Rule

APIs

__cftof_l.LIBCMT ref: 00F9722B

Part of subcall function 00F97912: __fltout2.LIBCMT ref: 00F9793B

__cftog_l.LIBCMT ref: 00F97251
__cftoe_l.LIBCMT ref: 00F97283

Memory Dump Source

Source File: 00000000.00000002.1667912702.0000000000F61000.00000020.00000001.01000000.00000003.sdmp, Offset: 00F60000, based on PE: true

Associated: 00000000.00000002.1667891216.0000000000F60000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667966851.0000000000FEF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667966851.0000000001015000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1668035777.000000000101F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1668053678.0000000001028000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f60000_tgBNtoWqIp.jbxd

Similarity

API ID: __cftoe_l__cftof_l__cftog_l__fltout2
String ID:
API String ID: 3016257755-0
Opcode ID: a65d1881d29c7e947f5b32dbcea64912f89e558cad637ae539af3f1adf23f7b4
Instruction ID: c1239ea8115795986b2e089efd6205d772e885c293b001238304c6c1f87b3a2e
Opcode Fuzzy Hash: a65d1881d29c7e947f5b32dbcea64912f89e558cad637ae539af3f1adf23f7b4
Instruction Fuzzy Hash: 1901483646838ABBDF166F84CC018EE3F62BF69355B588615FA1858031D237C9B1BF85

Function 00FEB57F Relevance: 6.0, APIs: 4, Instructions: 47COMMON

Download Yara Rule

APIs

GetWindowRect.USER32(?,?), ref: 00FEB59E
ScreenToClient.USER32(?,?), ref: 00FEB5B6
ScreenToClient.USER32(?,?), ref: 00FEB5DA
InvalidateRect.USER32(?,?,?,?,?,?,?,?,?,?,?,?), ref: 00FEB5F5

Memory Dump Source

Source File: 00000000.00000002.1667912702.0000000000F61000.00000020.00000001.01000000.00000003.sdmp, Offset: 00F60000, based on PE: true

Associated: 00000000.00000002.1667891216.0000000000F60000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667966851.0000000000FEF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667966851.0000000001015000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1668035777.000000000101F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1668053678.0000000001028000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f60000_tgBNtoWqIp.jbxd

Similarity

API ID: ClientRectScreen$InvalidateWindow
String ID:
API String ID: 357397906-0
Opcode ID: 7a875328d049ce722970b6808a23ab71373bb33463b71ee111d35361a843a333
Instruction ID: a4743aa49572e440b28c88d816a7ae3b746b58682299855e2f1881c6c44d2096
Opcode Fuzzy Hash: 7a875328d049ce722970b6808a23ab71373bb33463b71ee111d35361a843a333
Instruction Fuzzy Hash: 701143B9D0024DEFDB41CFA9D8849EEFBB9FB08311F108166E914E3220D735AA559F90

Function 00FEB8EF Relevance: 6.0, APIs: 4, Instructions: 40processCOMMON

Download Yara Rule

APIs

_memset.LIBCMT ref: 00FEB8FE
_memset.LIBCMT ref: 00FEB90D
CreateProcessW.KERNEL32(00000000,?,00000000,00000000,00000000,00000020,00000000,00000000,01027F20,01027F64), ref: 00FEB93C
CloseHandle.KERNEL32 ref: 00FEB94E

Memory Dump Source

Source File: 00000000.00000002.1667912702.0000000000F61000.00000020.00000001.01000000.00000003.sdmp, Offset: 00F60000, based on PE: true

Associated: 00000000.00000002.1667891216.0000000000F60000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667966851.0000000000FEF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667966851.0000000001015000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1668035777.000000000101F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1668053678.0000000001028000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f60000_tgBNtoWqIp.jbxd

Similarity

API ID: _memset$CloseCreateHandleProcess
String ID:
API String ID: 3277943733-0
Opcode ID: cfe31e61608f141e200433811c0f5c85aba25ffe8b2483c8a88328e5a90d7793
Instruction ID: ae767944cbb2dce2c5f0823a0f805ff54a3c4c2eec2b100cafcf8856a9d41f9b
Opcode Fuzzy Hash: cfe31e61608f141e200433811c0f5c85aba25ffe8b2483c8a88328e5a90d7793
Instruction Fuzzy Hash: 83F082B25443547FF2702B61AC45FBB3A5CEB18758F100021FB48D919AD77A4D0097B8

Function 00FC6E7C Relevance: 6.0, APIs: 4, Instructions: 33COMMON

Download Yara Rule

APIs

EnterCriticalSection.KERNEL32(?), ref: 00FC6E88

Part of subcall function 00FC794E: _memset.LIBCMT ref: 00FC7983

_memmove.LIBCMT ref: 00FC6EAB
_memset.LIBCMT ref: 00FC6EB8
LeaveCriticalSection.KERNEL32(?), ref: 00FC6EC8

Memory Dump Source

Source File: 00000000.00000002.1667912702.0000000000F61000.00000020.00000001.01000000.00000003.sdmp, Offset: 00F60000, based on PE: true

Associated: 00000000.00000002.1667891216.0000000000F60000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667966851.0000000000FEF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667966851.0000000001015000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1668035777.000000000101F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1668053678.0000000001028000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f60000_tgBNtoWqIp.jbxd

Similarity

API ID: CriticalSection_memset$EnterLeave_memmove
String ID:
API String ID: 48991266-0
Opcode ID: b5bbfce12ad985db1a42d11edab8d81dc9adb3b5afb16d496642dc941bcc6459
Instruction ID: 2fd1e1311c83aacd25e00f717c18758d2adb9b657028b51e7c1887ca65bcbab3
Opcode Fuzzy Hash: b5bbfce12ad985db1a42d11edab8d81dc9adb3b5afb16d496642dc941bcc6459
Instruction Fuzzy Hash: D8F05E3A200204ABCF016F55DC85F8ABB2AEF45360B14C065FE085E22AC735A911EBB4

Function 00FEC00C Relevance: 6.0, APIs: 4, Instructions: 31COMMON

Download Yara Rule

APIs

Part of subcall function 00F612F3: ExtCreatePen.GDI32(?,?,00000000,00000000,00000000,?,00000000), ref: 00F6134D
Part of subcall function 00F612F3: SelectObject.GDI32(?,00000000), ref: 00F6135C
Part of subcall function 00F612F3: BeginPath.GDI32(?), ref: 00F61373
Part of subcall function 00F612F3: SelectObject.GDI32(?,00000000), ref: 00F6139C

MoveToEx.GDI32(00000000,00000000,?,00000000), ref: 00FEC030
LineTo.GDI32(00000000,?,?), ref: 00FEC03D
EndPath.GDI32(00000000), ref: 00FEC04D
StrokePath.GDI32(00000000), ref: 00FEC05B

Memory Dump Source

Source File: 00000000.00000002.1667912702.0000000000F61000.00000020.00000001.01000000.00000003.sdmp, Offset: 00F60000, based on PE: true

Associated: 00000000.00000002.1667891216.0000000000F60000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667966851.0000000000FEF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667966851.0000000001015000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1668035777.000000000101F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1668053678.0000000001028000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f60000_tgBNtoWqIp.jbxd

Similarity

API ID: Path$ObjectSelect$BeginCreateLineMoveStroke
String ID:
API String ID: 1539411459-0
Opcode ID: 044ffbe8f5ace0af36b62021f509d68b9c580adfde3cbc2584e9b0db3da382d1
Instruction ID: 22a9a7ca61b032aa133c60f3045ffba43ad7a3b964063741dfd7def4ac1f021b
Opcode Fuzzy Hash: 044ffbe8f5ace0af36b62021f509d68b9c580adfde3cbc2584e9b0db3da382d1
Instruction Fuzzy Hash: 64F05E3200529DFBDB226F55EC09FCE3F59AF05321F144110FB11650E287BA5665EBD5

Function 00FBA37C Relevance: 6.0, APIs: 4, Instructions: 30threadwindowtimeCOMMON

Download Yara Rule

APIs

SendMessageTimeoutW.USER32(?,00000000,00000000,00000000,00000002,00001388,00000001), ref: 00FBA399
GetWindowThreadProcessId.USER32(?,00000000), ref: 00FBA3AC
GetCurrentThreadId.KERNEL32 ref: 00FBA3B3
AttachThreadInput.USER32(00000000), ref: 00FBA3BA

Memory Dump Source

Source File: 00000000.00000002.1667912702.0000000000F61000.00000020.00000001.01000000.00000003.sdmp, Offset: 00F60000, based on PE: true

Associated: 00000000.00000002.1667891216.0000000000F60000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667966851.0000000000FEF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667966851.0000000001015000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1668035777.000000000101F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1668053678.0000000001028000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f60000_tgBNtoWqIp.jbxd

Similarity

API ID: Thread$AttachCurrentInputMessageProcessSendTimeoutWindow
String ID:
API String ID: 2710830443-0
Opcode ID: e98edf08ef39c6878bd554ed9f1a65f1fbbeaaca424ba772156b49e835846feb
Instruction ID: 7b80c1dd83cd4b918f093f84ccf6fac4d6c7b809440c4a5ecce1105ec722ecbc
Opcode Fuzzy Hash: e98edf08ef39c6878bd554ed9f1a65f1fbbeaaca424ba772156b49e835846feb
Instruction Fuzzy Hash: 5BE0393254136CBBDB201BA2DC4CEDB3F5CEF167A1F048024F508880A0D6728544EBA0

Function 00F62218 Relevance: 6.0, APIs: 4, Instructions: 23COMMON

Download Yara Rule

APIs

GetSysColor.USER32(00000008), ref: 00F62231
SetTextColor.GDI32(?,000000FF), ref: 00F6223B
SetBkMode.GDI32(?,00000001), ref: 00F62250
GetStockObject.GDI32(00000005), ref: 00F62258
GetWindowDC.USER32(?,00000000), ref: 00F9C0D3
GetPixel.GDI32(00000000,00000000,00000000), ref: 00F9C0E0
GetPixel.GDI32(00000000,?,00000000), ref: 00F9C0F9
GetPixel.GDI32(00000000,00000000,?), ref: 00F9C112
GetPixel.GDI32(00000000,?,?), ref: 00F9C132
ReleaseDC.USER32(?,00000000), ref: 00F9C13D

Memory Dump Source

Source File: 00000000.00000002.1667912702.0000000000F61000.00000020.00000001.01000000.00000003.sdmp, Offset: 00F60000, based on PE: true

Associated: 00000000.00000002.1667891216.0000000000F60000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667966851.0000000000FEF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667966851.0000000001015000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1668035777.000000000101F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1668053678.0000000001028000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f60000_tgBNtoWqIp.jbxd

Similarity

API ID: Pixel$Color$ModeObjectReleaseStockTextWindow
String ID:
API String ID: 1946975507-0
Opcode ID: eaeb0f47e1f9dcb404e066af48f5ad14f398810946746b1caf3e1efb6fead76c
Instruction ID: 3d49c75b1f60f461c5de4eaaaba044ae66273ff600658f88d31c99a49e66817a
Opcode Fuzzy Hash: eaeb0f47e1f9dcb404e066af48f5ad14f398810946746b1caf3e1efb6fead76c
Instruction Fuzzy Hash: 4FE03031500288EAEF215F64EC497D83B14AB55332F048366FA69880E187754584EB51

Function 00FB8C5A Relevance: 6.0, APIs: 4, Instructions: 23threadCOMMON

Download Yara Rule

APIs

GetCurrentThread.KERNEL32 ref: 00FB8C63
OpenThreadToken.ADVAPI32(00000000,?,?,?,00FB882E), ref: 00FB8C6A
GetCurrentProcess.KERNEL32(00000028,?,?,?,?,00FB882E), ref: 00FB8C77
OpenProcessToken.ADVAPI32(00000000,?,?,?,00FB882E), ref: 00FB8C7E

Memory Dump Source

Source File: 00000000.00000002.1667912702.0000000000F61000.00000020.00000001.01000000.00000003.sdmp, Offset: 00F60000, based on PE: true

Associated: 00000000.00000002.1667891216.0000000000F60000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667966851.0000000000FEF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667966851.0000000001015000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1668035777.000000000101F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1668053678.0000000001028000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f60000_tgBNtoWqIp.jbxd

Similarity

API ID: CurrentOpenProcessThreadToken
String ID:
API String ID: 3974789173-0
Opcode ID: 072a7fe79bef2351d236ec112870cb89f74e1b4b8dcf81842ed5dfa7d9f5ea35
Instruction ID: 3463723b5b229e1cb6502e2f0e0c3e202293aba36e535b6134b56a46a01bddc8
Opcode Fuzzy Hash: 072a7fe79bef2351d236ec112870cb89f74e1b4b8dcf81842ed5dfa7d9f5ea35
Instruction Fuzzy Hash: 71E086B6A42255DBD7205FB16D4CB963BACEF907E2F054828B345CD040DA34844AEF61

Function 00FA2187 Relevance: 6.0, APIs: 4, Instructions: 20COMMON

Download Yara Rule

APIs

GetDesktopWindow.USER32 ref: 00FA2187
GetDC.USER32(00000000), ref: 00FA2191
GetDeviceCaps.GDI32(00000000,0000000C), ref: 00FA21B1
ReleaseDC.USER32(?), ref: 00FA21D2

Memory Dump Source

Source File: 00000000.00000002.1667912702.0000000000F61000.00000020.00000001.01000000.00000003.sdmp, Offset: 00F60000, based on PE: true

Associated: 00000000.00000002.1667891216.0000000000F60000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667966851.0000000000FEF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667966851.0000000001015000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1668035777.000000000101F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1668053678.0000000001028000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f60000_tgBNtoWqIp.jbxd

Similarity

API ID: CapsDesktopDeviceReleaseWindow
String ID:
API String ID: 2889604237-0
Opcode ID: f76dce4fb836705f6386e3a543711fee9234cc10be308cb82e6ac78ee334fac1
Instruction ID: 92af6d84f3cd25888000e6d173f3ec45c175d14a8fbd61d1874232faecc3d709
Opcode Fuzzy Hash: f76dce4fb836705f6386e3a543711fee9234cc10be308cb82e6ac78ee334fac1
Instruction Fuzzy Hash: 5BE0E5B5800208EFDB019FA0C848AAD7BF5EB4C350F10C425F95ADB220CB788145BF40

Function 00FA219B Relevance: 6.0, APIs: 4, Instructions: 19COMMON

Download Yara Rule

APIs

GetDesktopWindow.USER32 ref: 00FA219B
GetDC.USER32(00000000), ref: 00FA21A5
GetDeviceCaps.GDI32(00000000,0000000C), ref: 00FA21B1
ReleaseDC.USER32(?), ref: 00FA21D2

Memory Dump Source

Source File: 00000000.00000002.1667912702.0000000000F61000.00000020.00000001.01000000.00000003.sdmp, Offset: 00F60000, based on PE: true

Associated: 00000000.00000002.1667891216.0000000000F60000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667966851.0000000000FEF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667966851.0000000001015000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1668035777.000000000101F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1668053678.0000000001028000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f60000_tgBNtoWqIp.jbxd

Similarity

API ID: CapsDesktopDeviceReleaseWindow
String ID:
API String ID: 2889604237-0
Opcode ID: 9bdca41b8c521a46dcaf86ab56d29567cb98b83f1ff9825e50a2f9a65dcd0d39
Instruction ID: 29e79b7b6891ee344b379bc4d7f3cd58d60c7395eb05d60b7d7fca36a3649862
Opcode Fuzzy Hash: 9bdca41b8c521a46dcaf86ab56d29567cb98b83f1ff9825e50a2f9a65dcd0d39
Instruction Fuzzy Hash: 26E01A75800208EFDB019FB0C84869D7BF5FB4C310F10C025F95ADB220CB789145AF40

Function 00FBB7B6 Relevance: 5.5, APIs: 1, Strings: 2, Instructions: 241comCOMMON

Download Yara Rule

APIs

OleSetContainedObject.OLE32(?,00000001), ref: 00FBB981

Strings

Container, xrefs: 00FBB8FE
AutoIt3GUI, xrefs: 00FBB8F9

Memory Dump Source

Source File: 00000000.00000002.1667912702.0000000000F61000.00000020.00000001.01000000.00000003.sdmp, Offset: 00F60000, based on PE: true

Associated: 00000000.00000002.1667891216.0000000000F60000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667966851.0000000000FEF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667966851.0000000001015000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1668035777.000000000101F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1668053678.0000000001028000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f60000_tgBNtoWqIp.jbxd

Similarity

API ID: ContainedObject
String ID: AutoIt3GUI$Container
API String ID: 3565006973-3941886329
Opcode ID: 5a00635d53bea49d1cd3e594816ea4e067a543262aa18865dddfdd6d28d2f082
Instruction ID: 3011d7e7b076c0bd379b860d85fab7b0a0a10da8b58332b7e41c60454ca95c81
Opcode Fuzzy Hash: 5a00635d53bea49d1cd3e594816ea4e067a543262aa18865dddfdd6d28d2f082
Instruction Fuzzy Hash: EE915B706002019FDB64DF69C884BAABBE9FF48710F14856DF94ACB6A1DBB0E841DF50

Function 00FCB217 Relevance: 5.5, APIs: 2, Strings: 1, Instructions: 201shareCOMMON

Download Yara Rule

APIs

Part of subcall function 00F7FEC6: _wcscpy.LIBCMT ref: 00F7FEE9

Part of subcall function 00F69997: __itow.LIBCMT ref: 00F699C2
Part of subcall function 00F69997: __swprintf.LIBCMT ref: 00F69A0C

__wcsnicmp.LIBCMT ref: 00FCB298
WNetUseConnectionW.MPR(00000000,?,?,00000000,?,?,00000100,?), ref: 00FCB361

Strings

LPT, xrefs: 00FCB292

Memory Dump Source

Source File: 00000000.00000002.1667912702.0000000000F61000.00000020.00000001.01000000.00000003.sdmp, Offset: 00F60000, based on PE: true

Associated: 00000000.00000002.1667891216.0000000000F60000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667966851.0000000000FEF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667966851.0000000001015000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1668035777.000000000101F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1668053678.0000000001028000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f60000_tgBNtoWqIp.jbxd

Similarity

API ID: Connection__itow__swprintf__wcsnicmp_wcscpy
String ID: LPT
API String ID: 3222508074-1350329615
Opcode ID: 7835a12ad685a6df7e5f2eaecfa456a0506a84b7d8b2c8ab97f30cb24676348d
Instruction ID: fffcebe5102ec4885dc84bf18e8b0e436ca902277b3ffe82dc84c42a7f556baa
Opcode Fuzzy Hash: 7835a12ad685a6df7e5f2eaecfa456a0506a84b7d8b2c8ab97f30cb24676348d
Instruction Fuzzy Hash: 36618276E04216AFCB14DF94C982FAEB7B8EF08310F15405EF546AB251DB74AE44EB50

Function 00F72AB7 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 144sleepCOMMON

Download Yara Rule

APIs

Sleep.KERNEL32(00000000), ref: 00F72AC8
GlobalMemoryStatusEx.KERNEL32(?), ref: 00F72AE1

Strings

@, xrefs: 00F72AD5

Memory Dump Source

Source File: 00000000.00000002.1667912702.0000000000F61000.00000020.00000001.01000000.00000003.sdmp, Offset: 00F60000, based on PE: true

Associated: 00000000.00000002.1667891216.0000000000F60000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667966851.0000000000FEF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667966851.0000000001015000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1668035777.000000000101F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1668053678.0000000001028000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f60000_tgBNtoWqIp.jbxd

Similarity

API ID: GlobalMemorySleepStatus
String ID: @
API String ID: 2783356886-2766056989
Opcode ID: 9477716cb6a3fa01de4649e467cd205811eb2970200e37cd1977b0fa00010330
Instruction ID: 9f273cb7fc8ad788e687751675edfab7c338f0c45e70356a6c7029e29e6c3667
Opcode Fuzzy Hash: 9477716cb6a3fa01de4649e467cd205811eb2970200e37cd1977b0fa00010330
Instruction Fuzzy Hash: B851587141C744ABD320AF60DC86BABBBECFF84310F42885DF2D981095DB798529DB16

Function 00FC99BE Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 138COMMON

Download Yara Rule

APIs

Part of subcall function 00F6506B: __fread_nolock.LIBCMT ref: 00F65089

_wcscmp.LIBCMT ref: 00FC9AAE
_wcscmp.LIBCMT ref: 00FC9AC1

Strings

FILE, xrefs: 00FC99FA

Memory Dump Source

Source File: 00000000.00000002.1667912702.0000000000F61000.00000020.00000001.01000000.00000003.sdmp, Offset: 00F60000, based on PE: true

Associated: 00000000.00000002.1667891216.0000000000F60000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667966851.0000000000FEF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667966851.0000000001015000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1668035777.000000000101F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1668053678.0000000001028000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f60000_tgBNtoWqIp.jbxd

Similarity

API ID: _wcscmp$__fread_nolock
String ID: FILE
API String ID: 4029003684-3121273764
Opcode ID: 501509ee623491aa78ccf2e1b6868442f3820fac1a163923fb8394fa9f350be4
Instruction ID: 2a9cc3866db48bd0ea0211e5b938514f8c2fb0a200256a75dad93bc6dd21381d
Opcode Fuzzy Hash: 501509ee623491aa78ccf2e1b6868442f3820fac1a163923fb8394fa9f350be4
Instruction Fuzzy Hash: D641C871A0461ABADF209AA4DC46FEFBBBDDF45B14F00006DB900B7181D7B99E04A7A1

Function 00FD2882 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 97networkCOMMON

Download Yara Rule

APIs

_memset.LIBCMT ref: 00FD2892
InternetCrackUrlW.WININET(?,00000000,00000000,0000007C), ref: 00FD28C8

Strings

|, xrefs: 00FD2899

Memory Dump Source

Source File: 00000000.00000002.1667912702.0000000000F61000.00000020.00000001.01000000.00000003.sdmp, Offset: 00F60000, based on PE: true

Associated: 00000000.00000002.1667891216.0000000000F60000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667966851.0000000000FEF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667966851.0000000001015000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1668035777.000000000101F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1668053678.0000000001028000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f60000_tgBNtoWqIp.jbxd

Similarity

API ID: CrackInternet_memset
String ID: |
API String ID: 1413715105-2343686810
Opcode ID: 13e15d04644f8e1214aba58c1a2b66252af0030369685824ad482f05a3dbc3cb
Instruction ID: c00b89c361fecb89f204460502b3e362390daba88487783ad86f2ef378fc34b9
Opcode Fuzzy Hash: 13e15d04644f8e1214aba58c1a2b66252af0030369685824ad482f05a3dbc3cb
Instruction Fuzzy Hash: FC315E71801219AFCF01EFA1CC85EEEBFB9FF18350F14002AF814A6265DB355916EBA0

Function 00FE6CD2 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 95COMMON

Download Yara Rule

APIs

DestroyWindow.USER32(?,?,?,?), ref: 00FE6D86
MoveWindow.USER32(?,?,?,?,?,00000001,?,?,?), ref: 00FE6DC2

Strings

static, xrefs: 00FE6D22

Memory Dump Source

Source File: 00000000.00000002.1667912702.0000000000F61000.00000020.00000001.01000000.00000003.sdmp, Offset: 00F60000, based on PE: true

Associated: 00000000.00000002.1667891216.0000000000F60000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667966851.0000000000FEF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667966851.0000000001015000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1668035777.000000000101F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1668053678.0000000001028000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f60000_tgBNtoWqIp.jbxd

Similarity

API ID: Window$DestroyMove
String ID: static
API String ID: 2139405536-2160076837
Opcode ID: 0c8de503dc189c93c1d387c74c0abae24fa1eb38d5f55dfa32238dedb1ffb91d
Instruction ID: 11946c6645bbd5524fcd1f8c9d79c43e0c8ed38960e2df2a20519565cb716d15
Opcode Fuzzy Hash: 0c8de503dc189c93c1d387c74c0abae24fa1eb38d5f55dfa32238dedb1ffb91d
Instruction Fuzzy Hash: BA31AF71600248AEDB209F69CC80BFB73B9FF58760F508619F8A5D7190DA75AC91EB60

Function 00FC2D91 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 88windowCOMMON

Download Yara Rule

APIs

_memset.LIBCMT ref: 00FC2E00
GetMenuItemInfoW.USER32(?,?,00000000,00000030), ref: 00FC2E3B

Strings

0, xrefs: 00FC2DF9

Memory Dump Source

Source File: 00000000.00000002.1667912702.0000000000F61000.00000020.00000001.01000000.00000003.sdmp, Offset: 00F60000, based on PE: true

Associated: 00000000.00000002.1667891216.0000000000F60000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667966851.0000000000FEF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667966851.0000000001015000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1668035777.000000000101F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1668053678.0000000001028000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f60000_tgBNtoWqIp.jbxd

Similarity

API ID: InfoItemMenu_memset
String ID: 0
API String ID: 2223754486-4108050209
Opcode ID: c10e1517b5ef7a0e170814ef1279dcb1bc34241b6f46424deafbe76678f89fe0
Instruction ID: 4cd92b5dc51eff3959619e0e2396f62d5513cc3de9b64f0f23d7988ba8556324
Opcode Fuzzy Hash: c10e1517b5ef7a0e170814ef1279dcb1bc34241b6f46424deafbe76678f89fe0
Instruction Fuzzy Hash: 2831EB31E0030A9BDB64DF58CA46FEE7BB5FF05360F18402DED85A61A0DB709944EB50

Function 00FE6943 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 72windowCOMMON

Download Yara Rule

APIs

SendMessageW.USER32(00000000,00000143,00000000,?), ref: 00FE69D0
SendMessageW.USER32(?,0000014E,00000000,00000000), ref: 00FE69DB

Strings

Combobox, xrefs: 00FE699D

Memory Dump Source

Source File: 00000000.00000002.1667912702.0000000000F61000.00000020.00000001.01000000.00000003.sdmp, Offset: 00F60000, based on PE: true

Associated: 00000000.00000002.1667891216.0000000000F60000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667966851.0000000000FEF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667966851.0000000001015000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1668035777.000000000101F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1668053678.0000000001028000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f60000_tgBNtoWqIp.jbxd

Similarity

API ID: MessageSend
String ID: Combobox
API String ID: 3850602802-2096851135
Opcode ID: 3952b3a0d140b9eb9d3286ab5b3c1edc6462e31641b87ce7e9419be095e8f2e3
Instruction ID: 85ab081962666895815ff305eb430d64d35b92439cc95f63e6b6b5584e81a057
Opcode Fuzzy Hash: 3952b3a0d140b9eb9d3286ab5b3c1edc6462e31641b87ce7e9419be095e8f2e3
Instruction Fuzzy Hash: 4711B271A0024C6FEF219F15CC80EBF376AEBA93E4F110124F958DB291D6759C51A7A0

Function 00FE6E76 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 68COMMON

Download Yara Rule

APIs

Part of subcall function 00F61D35: CreateWindowExW.USER32(?,?,?,?,?,?,?,?,?,?,00000000,00000096), ref: 00F61D73
Part of subcall function 00F61D35: GetStockObject.GDI32(00000011), ref: 00F61D87
Part of subcall function 00F61D35: SendMessageW.USER32(00000000,00000030,00000000), ref: 00F61D91

GetWindowRect.USER32(00000000,?), ref: 00FE6EE0
GetSysColor.USER32(00000012), ref: 00FE6EFA

Strings

static, xrefs: 00FE6EBD

Memory Dump Source

Source File: 00000000.00000002.1667912702.0000000000F61000.00000020.00000001.01000000.00000003.sdmp, Offset: 00F60000, based on PE: true

Associated: 00000000.00000002.1667891216.0000000000F60000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667966851.0000000000FEF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667966851.0000000001015000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1668035777.000000000101F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1668053678.0000000001028000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f60000_tgBNtoWqIp.jbxd

Similarity

API ID: Window$ColorCreateMessageObjectRectSendStock
String ID: static
API String ID: 1983116058-2160076837
Opcode ID: 212a0a19c66139d1c93df5333ce3b1b38f1d4a2154cbf0d55dc77fd531fcae56
Instruction ID: a5e335c9041b8ad739a7f9e3b3b6e3843d0ac4715702108ad5a86fd3ebde8873
Opcode Fuzzy Hash: 212a0a19c66139d1c93df5333ce3b1b38f1d4a2154cbf0d55dc77fd531fcae56
Instruction Fuzzy Hash: 35218632A1024AAFDB04DFA8CC45AEA7BB8FB08354F004629FD55D3241E734E861AB60

Function 00FE6B8F Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 64windowCOMMON

Download Yara Rule

APIs

GetWindowTextLengthW.USER32(00000000), ref: 00FE6C11
SendMessageW.USER32(?,000000B1,00000000,00000000), ref: 00FE6C20

Strings

edit, xrefs: 00FE6BF5

Memory Dump Source

Source File: 00000000.00000002.1667912702.0000000000F61000.00000020.00000001.01000000.00000003.sdmp, Offset: 00F60000, based on PE: true

Associated: 00000000.00000002.1667891216.0000000000F60000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667966851.0000000000FEF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667966851.0000000001015000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1668035777.000000000101F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1668053678.0000000001028000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f60000_tgBNtoWqIp.jbxd

Similarity

API ID: LengthMessageSendTextWindow
String ID: edit
API String ID: 2978978980-2167791130
Opcode ID: 21598b133ec18eaee58c821c5df59a109f5def808f8498b6c1b58a18a8ccd860
Instruction ID: 933be0a9c56bc8efcc2ed48253bf1c91bde26b8e8875fc865b5ac1cbdc5c28fa
Opcode Fuzzy Hash: 21598b133ec18eaee58c821c5df59a109f5def808f8498b6c1b58a18a8ccd860
Instruction Fuzzy Hash: C311BC7190128CABEB108E65DC81EEB3B69EB643B8F204724F961D71E0C735DC91BB60

Function 00FC2E9E Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 63windowCOMMON

Download Yara Rule

APIs

_memset.LIBCMT ref: 00FC2F11
GetMenuItemInfoW.USER32(00000030,?,00000000,00000030), ref: 00FC2F30

Strings

0, xrefs: 00FC2F07

Memory Dump Source

Source File: 00000000.00000002.1667912702.0000000000F61000.00000020.00000001.01000000.00000003.sdmp, Offset: 00F60000, based on PE: true

Associated: 00000000.00000002.1667891216.0000000000F60000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667966851.0000000000FEF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667966851.0000000001015000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1668035777.000000000101F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1668053678.0000000001028000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f60000_tgBNtoWqIp.jbxd

Similarity

API ID: InfoItemMenu_memset
String ID: 0
API String ID: 2223754486-4108050209
Opcode ID: 59e3fbb431f4808d052e4db7e7d433361e6466dc4fbbb3aa9068943ee80f7743
Instruction ID: f5172aff2b7e3207a724f8b652c52ebdea2f64390781cda741efa836fdc0150a
Opcode Fuzzy Hash: 59e3fbb431f4808d052e4db7e7d433361e6466dc4fbbb3aa9068943ee80f7743
Instruction Fuzzy Hash: 84110832E0121AABCB60DE58DE46FAD77B9EB01320F1400ADEC44B72A0D7B1ED04E791

Function 00FD24CA Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 62networkCOMMON

Download Yara Rule

APIs

InternetOpenW.WININET(?,00000000,00000000,00000000,00000000), ref: 00FD2520
InternetSetOptionW.WININET(00000000,00000032,?,00000008), ref: 00FD2549

Strings

<local>, xrefs: 00FD2511

Memory Dump Source

Source File: 00000000.00000002.1667912702.0000000000F61000.00000020.00000001.01000000.00000003.sdmp, Offset: 00F60000, based on PE: true

Associated: 00000000.00000002.1667891216.0000000000F60000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667966851.0000000000FEF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667966851.0000000001015000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1668035777.000000000101F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1668053678.0000000001028000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f60000_tgBNtoWqIp.jbxd

Similarity

API ID: Internet$OpenOption
String ID: <local>
API String ID: 942729171-4266983199
Opcode ID: 7109a037778d75b855314d417081bfcc83bac947da53728dee2df13092acf4d7
Instruction ID: 6dcf04122bb4d0de1abd97a828ab5a153c7877159729a87c848847ae6e13a694
Opcode Fuzzy Hash: 7109a037778d75b855314d417081bfcc83bac947da53728dee2df13092acf4d7
Instruction Fuzzy Hash: 89113271901225BADB258F119C98FFBFF69FF26360F08812BF90446200D2706980EAF0

Function 00FD80A0 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 55networkCOMMON

Download Yara Rule

APIs

Part of subcall function 00FD830B: WideCharToMultiByte.KERNEL32(00000000,00000000,?,?,00000000,00000000,00000000,00000000,?,?,?,00FD80C8,?,00000000,?,?), ref: 00FD8322

inet_addr.WSOCK32(00000000,?,00000000,?,?,?,00000000), ref: 00FD80CB
htons.WSOCK32(00000000,?,00000000), ref: 00FD8108

Strings

255.255.255.255, xrefs: 00FD80E3

Memory Dump Source

Source File: 00000000.00000002.1667912702.0000000000F61000.00000020.00000001.01000000.00000003.sdmp, Offset: 00F60000, based on PE: true

Associated: 00000000.00000002.1667891216.0000000000F60000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667966851.0000000000FEF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667966851.0000000001015000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1668035777.000000000101F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1668053678.0000000001028000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f60000_tgBNtoWqIp.jbxd

Similarity

API ID: ByteCharMultiWidehtonsinet_addr
String ID: 255.255.255.255
API String ID: 2496851823-2422070025
Opcode ID: b8b2172727c9a93227aed298b1c09e19689f539153f94ad385e38f59596c2820
Instruction ID: 23769dd42e1fb77a240aae4477300c812809c5109728cfe77aee60e2a7a6559a
Opcode Fuzzy Hash: b8b2172727c9a93227aed298b1c09e19689f539153f94ad385e38f59596c2820
Instruction Fuzzy Hash: 74112135600209ABCB20AF64CC86FEDB325FF00360F14851BE911AB381CA36A80AE690

Function 00FB92E7 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 52windowCOMMON

Download Yara Rule

APIs

Part of subcall function 00F67F41: _memmove.LIBCMT ref: 00F67F82

Part of subcall function 00FBB0C4: GetClassNameW.USER32(?,?,000000FF), ref: 00FBB0E7

SendMessageW.USER32(?,000001A2,000000FF,?), ref: 00FB9355

Strings

ListBox, xrefs: 00FB931F
ComboBox, xrefs: 00FB92F4

Memory Dump Source

Source File: 00000000.00000002.1667912702.0000000000F61000.00000020.00000001.01000000.00000003.sdmp, Offset: 00F60000, based on PE: true

Associated: 00000000.00000002.1667891216.0000000000F60000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667966851.0000000000FEF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667966851.0000000001015000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1668035777.000000000101F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1668053678.0000000001028000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f60000_tgBNtoWqIp.jbxd

Similarity

API ID: ClassMessageNameSend_memmove
String ID: ComboBox$ListBox
API String ID: 372448540-1403004172
Opcode ID: 28855b61b405d65e6008c6963c61c9c75411664a8d863f2ed34db50d4231cf5a
Instruction ID: ea93e63f41c51c063250aa790f25ee14e8fa4f57a0117544ccd472a98e68cba4
Opcode Fuzzy Hash: 28855b61b405d65e6008c6963c61c9c75411664a8d863f2ed34db50d4231cf5a
Instruction Fuzzy Hash: 04012871A09214ABCB04FBA2CC91DFE77ADFF06720B140619F972672D2DB79590CAB50

Function 00FB91DF Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 50windowCOMMON

Download Yara Rule

APIs

Part of subcall function 00F67F41: _memmove.LIBCMT ref: 00F67F82

Part of subcall function 00FBB0C4: GetClassNameW.USER32(?,?,000000FF), ref: 00FBB0E7

SendMessageW.USER32(?,00000180,00000000,?), ref: 00FB924D

Strings

ListBox, xrefs: 00FB9217
ComboBox, xrefs: 00FB91EC

Memory Dump Source

Source File: 00000000.00000002.1667912702.0000000000F61000.00000020.00000001.01000000.00000003.sdmp, Offset: 00F60000, based on PE: true

Associated: 00000000.00000002.1667891216.0000000000F60000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667966851.0000000000FEF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667966851.0000000001015000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1668035777.000000000101F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1668053678.0000000001028000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f60000_tgBNtoWqIp.jbxd

Similarity

API ID: ClassMessageNameSend_memmove
String ID: ComboBox$ListBox
API String ID: 372448540-1403004172
Opcode ID: 70a2a85221566ad66b06cec04c395ea13b88350bbbdc596ddae4855d026338a7
Instruction ID: b6b3845357dd6a2bfee9ef5bee7604d4ff2818879c2f55b220d8449bfc7429fe
Opcode Fuzzy Hash: 70a2a85221566ad66b06cec04c395ea13b88350bbbdc596ddae4855d026338a7
Instruction Fuzzy Hash: 0701D471E452087BCB04FBA1CCA2EFF73A89F05700F140019BA5267282EA585F0CBBA1

Function 00FB9264 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 49windowCOMMON

Download Yara Rule

APIs

Part of subcall function 00F67F41: _memmove.LIBCMT ref: 00F67F82

Part of subcall function 00FBB0C4: GetClassNameW.USER32(?,?,000000FF), ref: 00FBB0E7

SendMessageW.USER32(?,00000182,?,00000000), ref: 00FB92D0

Strings

ListBox, xrefs: 00FB929C
ComboBox, xrefs: 00FB9271

Memory Dump Source

Source File: 00000000.00000002.1667912702.0000000000F61000.00000020.00000001.01000000.00000003.sdmp, Offset: 00F60000, based on PE: true

Associated: 00000000.00000002.1667891216.0000000000F60000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667966851.0000000000FEF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667966851.0000000001015000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1668035777.000000000101F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1668053678.0000000001028000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f60000_tgBNtoWqIp.jbxd

Similarity

API ID: ClassMessageNameSend_memmove
String ID: ComboBox$ListBox
API String ID: 372448540-1403004172
Opcode ID: f2bfc8c2e97577b299f0688c503b6d82a1164f8f3eb28803e4e3e137888f0db3
Instruction ID: e73fbcba6391fccc809554cbf22818d1584e9c7f5af4da9a80d03de7537e73d0
Opcode Fuzzy Hash: f2bfc8c2e97577b299f0688c503b6d82a1164f8f3eb28803e4e3e137888f0db3
Instruction Fuzzy Hash: 1601DF71E4520877CB04FAA2CC92EFE77A89F00700F240019B94277282DA695E08BAB1

Function 00FC51CA Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 29COMMON

Download Yara Rule

APIs

GetClassNameW.USER32(?,?,00000100), ref: 00FC51E8
_wcscmp.LIBCMT ref: 00FC51FA

Strings

#32770, xrefs: 00FC51F4

Memory Dump Source

Source File: 00000000.00000002.1667912702.0000000000F61000.00000020.00000001.01000000.00000003.sdmp, Offset: 00F60000, based on PE: true

Associated: 00000000.00000002.1667891216.0000000000F60000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667966851.0000000000FEF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667966851.0000000001015000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1668035777.000000000101F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1668053678.0000000001028000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f60000_tgBNtoWqIp.jbxd

Similarity

API ID: ClassName_wcscmp
String ID: #32770
API String ID: 2292705959-463685578
Opcode ID: 7ccf9b22104a3130fe04590fe4f01795b167f81faa4786d518b213a2a00e971c
Instruction ID: 6ad1c774f233a8843368d2ed86b4852596acf207ae229a96e248b73d09d293d1
Opcode Fuzzy Hash: 7ccf9b22104a3130fe04590fe4f01795b167f81faa4786d518b213a2a00e971c
Instruction Fuzzy Hash: 4FE02B32A0022D16D3209A999C45FD7F7ACEB40B31F00005AF914D7000D5749A4487D0

Function 00FB81BC Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 22windowCOMMON

Download Yara Rule

APIs

MessageBoxW.USER32(00000000,Error allocating memory.,AutoIt,00000010), ref: 00FB81CA

Part of subcall function 00F83598: _doexit.LIBCMT ref: 00F835A2

Strings

Error allocating memory., xrefs: 00FB81C3
AutoIt, xrefs: 00FB81BE

Memory Dump Source

Source File: 00000000.00000002.1667912702.0000000000F61000.00000020.00000001.01000000.00000003.sdmp, Offset: 00F60000, based on PE: true

Associated: 00000000.00000002.1667891216.0000000000F60000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667966851.0000000000FEF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667966851.0000000001015000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1668035777.000000000101F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1668053678.0000000001028000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f60000_tgBNtoWqIp.jbxd

Similarity

API ID: Message_doexit
String ID: AutoIt$Error allocating memory.
API String ID: 1993061046-4017498283
Opcode ID: 17b9911ed2b66855da34cc24e778b5bcc56071f452b07224557785ea11c8a418
Instruction ID: 257483114cbdf743a29ad1a6bac32a23a5ff195cc3257840998ac4b61cbf0571
Opcode Fuzzy Hash: 17b9911ed2b66855da34cc24e778b5bcc56071f452b07224557785ea11c8a418
Instruction Fuzzy Hash: D9D05B323C536C33D21432A96D0BFC67A4C5F05F55F044015BB08595D3CED9958263D9

Function 00F9B511 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 22COMMON

Download Yara Rule

APIs

Part of subcall function 00F9B564: _memset.LIBCMT ref: 00F9B571

Part of subcall function 00F80B84: InitializeCriticalSectionAndSpinCount.KERNEL32(?,00000000,?,00F9B540,?,?,?,00F6100A), ref: 00F80B89

IsDebuggerPresent.KERNEL32(?,?,?,00F6100A), ref: 00F9B544
OutputDebugStringW.KERNEL32(ERROR : Unable to initialize critical section in CAtlBaseModule,?,?,?,00F6100A), ref: 00F9B553

Strings

ERROR : Unable to initialize critical section in CAtlBaseModule, xrefs: 00F9B54E

Memory Dump Source

Source File: 00000000.00000002.1667912702.0000000000F61000.00000020.00000001.01000000.00000003.sdmp, Offset: 00F60000, based on PE: true

Associated: 00000000.00000002.1667891216.0000000000F60000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667966851.0000000000FEF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667966851.0000000001015000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1668035777.000000000101F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1668053678.0000000001028000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f60000_tgBNtoWqIp.jbxd

Similarity

API ID: CountCriticalDebugDebuggerInitializeOutputPresentSectionSpinString_memset
String ID: ERROR : Unable to initialize critical section in CAtlBaseModule
API String ID: 3158253471-631824599
Opcode ID: 8a0b7d4071e29090d902b73bc9bac2547da5fea97f0d851d769a83a00162f5a5
Instruction ID: 1b483a966c0142c3ce0fffb285d79e9c61ab9f22874e9f769104195da70e086b
Opcode Fuzzy Hash: 8a0b7d4071e29090d902b73bc9bac2547da5fea97f0d851d769a83a00162f5a5
Instruction Fuzzy Hash: 37E09270600790CFE731DF28E9087427BE4AF00754F05892CE486C7395DBB9D808DB61

Function 00FE5BEB Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 15windowCOMMON

Download Yara Rule

APIs

FindWindowW.USER32(Shell_TrayWnd,00000000), ref: 00FE5BF5
PostMessageW.USER32(00000000,00000111,00000197,00000000), ref: 00FE5C08

Part of subcall function 00FC54E6: Sleep.KERNEL32(?,00000000,?,?,?,?,?,?,?,?,?,?), ref: 00FC555E

Strings

Shell_TrayWnd, xrefs: 00FE5BEE

Memory Dump Source

Source File: 00000000.00000002.1667912702.0000000000F61000.00000020.00000001.01000000.00000003.sdmp, Offset: 00F60000, based on PE: true

Associated: 00000000.00000002.1667891216.0000000000F60000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667966851.0000000000FEF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667966851.0000000001015000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1668035777.000000000101F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1668053678.0000000001028000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f60000_tgBNtoWqIp.jbxd

Similarity

API ID: FindMessagePostSleepWindow
String ID: Shell_TrayWnd
API String ID: 529655941-2988720461
Opcode ID: 0527082aec4fe959b43ce82954fe2354d3e0bb99b9e9f722ac923efda982affb
Instruction ID: 2d1a05d3adb0472cd0cd1526295601c7953decfb08225995883e9578efd2e138
Opcode Fuzzy Hash: 0527082aec4fe959b43ce82954fe2354d3e0bb99b9e9f722ac923efda982affb
Instruction Fuzzy Hash: AAD0A931388351B7E728AB30AC5BF937A10AB40B40F000828B246AE0E0C8E86800C200

Description:	Adversaries may obtain and abuse credentials of existing accounts as a means of gaining Initial Access, Persistence, Privilege Escalation, or Defense Evasion. Compromised credentials may be used to bypass access controls placed on various resources on systems within the network and may even be used for persistent access to remote systems and externally available services, such as VPNs, Outlook Web Access, network devices, and remote desktop.Compromised credentials may also grant an adversary increased privilege to specific systems or access to restricted areas of the network. Adversaries may choose not to use malware or tools in conjunction with the legitimate access those credentials provide to make it harder to detect their presence.
Tactics:	Defense Evasion, Initial Access, Persistence, Privilege Escalation
Data Sources:	Logon Session: Logon Session Creation, Logon Session: Logon Session Metadata, User Account: User Account Authentication
Platforms:	Azure AD, Containers, Google Workspace, IaaS, Linux, macOS, Network, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse Windows Management Instrumentation (WMI) to execute malicious commands and payloads. WMI is an administration feature that provides a uniform environment to access Windows system components. The WMI service enables both local and remote access, though the latter is facilitated by Remote Services such as Distributed Component Object Model (DCOM) and Windows Remote Management (WinRM).Remote WMI over DCOM operates using port 135, whereas WMI over WinRM operates over port 5985 when using HTTP and 5986 for HTTPS.
Tactics:	Execution
Data Sources:	Command: Command Execution, Network Traffic: Network Connection Creation, Process: Process Creation, WMI: WMI Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may interact with the native OS application programming interface (API) to execute behaviors. Native APIs provide a controlled means of calling low-level OS services within the kernel, such as those involving hardware/devices, memory, and processes.These native APIs are leveraged by the OS during system boot (when other system components are not yet initialized) as well as carrying out tasks and requests during routine operations.
Tactics:	Execution
Data Sources:	Module: Module Load, Process: OS API Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may execute their own malicious payloads by side-loading DLLs. Similar to DLL Search Order Hijacking , side-loading involves hijacking which DLL a program loads. But rather than just planting the DLL within the search order of a program then waiting for the victim application to be invoked, adversaries may directly side-load their payloads by planting then invoking a legitimate application that executes their payload(s).
Tactics:	Defense Evasion, Persistence, Privilege Escalation
Data Sources:	File: File Creation, File: File Modification, Module: Module Load, Process: Process Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may exploit software vulnerabilities in an attempt to elevate privileges. Exploitation of a software vulnerability occurs when an adversary takes advantage of a programming error in a program, service, or within the operating system software or kernel itself to execute adversary-controlled code. Security constructs such as permission levels will often hinder access to information and use of certain techniques, so adversaries will likely need to perform privilege escalation to include use of software exploitation to circumvent those restrictions.
Tactics:	Privilege Escalation
Data Sources:	Driver: Driver Load, Process: Process Creation
Platforms:	Containers, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may modify access tokens to operate under a different user or system security context to perform actions and bypass access controls. Windows uses access tokens to determine the ownership of a running process. A user can manipulate access tokens to make a running process appear as though it is the child of a different process or belongs to someone other than the user that started the process. When this occurs, the process also takes on the security context associated with the new token.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	Active Directory: Active Directory Object Modification, Command: Command Execution, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, User Account: User Account Metadata
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	File: File Metadata, File: File Modification, Module: Module Load, Process: OS API Execution, Process: Process Access, Process: Process Metadata, Process: Process Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may modify and/or disable security tools to avoid possible detection of their malware/tools and activities. This may take many forms, such as killing security software processes or services, modifying / deleting Registry keys or configuration files so that tools do not operate properly, or other methods to interfere with security tools scanning or reporting information. Adversaries may also disable updates to prevent the latest security patches from reaching tools on victim systems.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, Driver: Driver Load, Process: Process Creation, Process: Process Termination, Sensor Health: Host Status, Service: Service Metadata, Windows Registry: Windows Registry Key Deletion, Windows Registry: Windows Registry Key Modification
Platforms:	Containers, IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use Obfuscated Files or Information to hide artifacts of an intrusion from analysis. They may require separate mechanisms to decode or deobfuscate that information depending on how they intend to use it. Methods for doing that include built-in functionality of malware or by using utilities present on the system.
Tactics:	Defense Evasion
Data Sources:	File: File Modification, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit. This is common behavior that can be used across different platforms and the network to evade defenses.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Creation, File: File Metadata, Module: Module Load, Process: OS API Execution, Process: Process Creation, Script: Script Execution, WMI: WMI Creation, Windows Registry: Windows Registry Key Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may perform software packing or virtual machine software protection to conceal their code. Software packing is a method of compressing or encrypting an executable. Packing an executable changes the file signature in an attempt to avoid signature-based detection. Most decompression techniques decompress the executable code in memory. Virtual machine software protection translates an executable's original code into a special format that only a special virtual machine can run. A virtual machine is then called to run this code.
Tactics:	Defense Evasion
Data Sources:	File: File Metadata
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ various means to detect and avoid virtualization and analysis environments. This may include changing behaviors based on the results of checks for the presence of artifacts indicative of a virtual machine environment (VME) or sandbox. If the adversary detects a VME, they may alter their malware to disengage from the victim or conceal the core functions of the implant. They may also search for VME artifacts before dropping secondary or additional payloads. Adversaries may use the information learned from [Virtualization/Sandbox Evasion](https://attack.mitre.org/techniques/T1497) during automated discovery to shape follow-on behaviors.
Tactics:	Defense Evasion, Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to dump credentials to obtain account login and credential material, normally in the form of a hash or a clear text password, from the operating system and software. Credentials can then be used to perform Lateral Movement and access restricted information.
Tactics:	Credential Access
Data Sources:	Active Directory: Active Directory Object Access, Command: Command Execution, File: File Access, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow, Process: OS API Execution, Process: Process Access, Process: Process Creation, Windows Registry: Windows Registry Key Access
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use methods of capturing user input to obtain credentials or collect information. During normal system usage, users often provide credentials to various different locations, such as login pages/portals or system dialog boxes. Input capture mechanisms may be transparent to the user (e.g. Credential API Hooking ) or rely on deceiving the user into providing input into what they believe to be a genuine service (e.g. Web Portal Capture ).
Tactics:	Collection, Credential Access
Data Sources:	Driver: Driver Load, File: File Modification, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, Windows Registry: Windows Registry Key Modification
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may search the Registry on compromised systems for insecurely stored credentials. The Windows Registry stores configuration information that can be used by the system or other programs. Adversaries may query the Registry looking for credentials and passwords that have been stored for use by other programs or services. Sometimes these credentials are used for automatic logons.
Tactics:	Credential Access
Data Sources:	Command: Command Execution, Process: Process Creation, Windows Registry: Windows Registry Key Access
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	An adversary may gather the system time and/or time zone from a local or remote system. The system time is set and stored by the Windows Time Service within a domain to maintain time synchronization between systems and services in an enterprise network.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of valid accounts, usernames, or email addresses on a system or within a compromised environment. This information can help adversaries determine which accounts exist, which can aid in follow-on behavior such as brute-forcing, spear-phishing attacks, or account takeovers (e.g., Valid Accounts ).
Tactics:	Discovery
Data Sources:	Command: Command Execution, File: File Access, Process: Process Creation
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may enumerate files and directories or may search in specific locations of a host or network share for certain information within a file system. Adversaries may use the information from File and Directory Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get information about running processes on a system. Information obtained could be used to gain an understanding of common software/applications running on systems within the network. Adversaries may use the information from Process Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report tgBNtoWqIp.exe

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Threat Intel

Malware Configuration

Threatname: Agenttesla

Yara Signatures

Memory Dumps

Unpacked PEs

Sigma Signatures

System Summary

Snort Signatures

Joe Sandbox Signatures

AV Detection

Compliance

Spreading

Networking

Key, Mouse, Clipboard, Microphone and Screen Capturing

System Summary

Data Obfuscation

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

Anti Debugging

HIPS / PFW / Operating System Protection Evasion

Language, Device and Operating System Detection

Stealing of Sensitive Information

Remote Access Functionality

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

Contacted URLs

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

General Information

Warnings

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

C:\Users\user\AppData\Local\Temp\aut8E4A.tmp

C:\Users\user\AppData\Local\Temp\aut8E7A.tmp

C:\Users\user\AppData\Local\Temp\hepatoduodenostomy

C:\Users\user\AppData\Local\Temp\totten

Static File Info

General

File Icon

Static PE Info

General

Entrypoint Preview

Rich Headers

Data Directories

Sections

Resources

Imports

Windows Analysis Report
tgBNtoWqIp.exe

Function 00F63B4C Relevance: 17.7, APIs: 8, Strings: 2, Instructions: 153
windowCOMMON

Function 00F64AFE Relevance: 10.7, APIs: 7, Instructions: 223
COMMON

Function 00F64FE9 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 62
COMMON

Function 00FC93DF Relevance: 19.8, APIs: 13, Instructions: 322
fileCOMMON

Function 00F63015 Relevance: 19.3, APIs: 7, Strings: 4, Instructions: 72
windowregistryCOMMON

Function 00F63041 Relevance: 19.3, APIs: 7, Strings: 4, Instructions: 54
windowregistryCOMMON

Function 00F671EB Relevance: 17.7, APIs: 6, Strings: 4, Instructions: 201
registryCOMMON

Function 00F63A58 Relevance: 17.6, APIs: 7, Strings: 3, Instructions: 71
windowregistryCOMMON

Function 00F63633 Relevance: 15.9, APIs: 8, Strings: 1, Instructions: 151
windowtimeregistryCOMMON

Function 00F63778 Relevance: 14.3, APIs: 1, Strings: 7, Instructions: 267
COMMON

Function 011B25E0 Relevance: 10.7, APIs: 7, Instructions: 239
fileCOMMON

Function 00F639E7 Relevance: 10.5, APIs: 4, Strings: 2, Instructions: 44
COMMON

Function 011B23B0 Relevance: 8.9, APIs: 4, Strings: 1, Instructions: 144
fileCOMMON

Function 00F6410D Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 88
windowCOMMON

Function 00F8564D Relevance: 7.7, APIs: 5, Instructions: 163
COMMONLIBRARYCODE

Description:	Adversaries may attempt to identify the primary user, currently logged in user, set of users that commonly uses a system, or whether a user is actively using the system. They may do this, for example, by retrieving account usernames or by using OS Credential Dumping . The information may be collected in a number of different ways using other Discovery techniques, because user and username details are prevalent throughout a system and include running process ownership, file/directory ownership, session information, and system logs. Adversaries may use the information from [System Owner/User Discovery](https://attack.mitre.org/techniques/T1033) during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Active Directory: Active Directory Object Access, Command: Command Execution, File: File Access, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow, Process: OS API Execution, Process: Process Access, Process: Process Creation, Windows Registry: Windows Registry Key Access
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may look for details about the network configuration and settings, such as IP and/or MAC addresses, of systems they access or through information discovery of remote systems. Several operating system administration utilities exist that can be used to gather this information. Examples include Arp , ipconfig / ifconfig , nbtstat , and route .
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may compress and/or encrypt data that is collected prior to exfiltration. Compressing the data can help to obfuscate the collected data and minimize the amount of data sent over the network. Encryption can be used to hide information that is being exfiltrated from detection or make exfiltration less conspicuous upon inspection by a defender.
Tactics:	Collection
Data Sources:	Command: Command Execution, File: File Creation, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may search local system sources, such as file systems and configuration files or local databases, to find files of interest and sensitive data prior to Exfiltration.
Tactics:	Collection
Data Sources:	Command: Command Execution, File: File Access, Process: OS API Execution, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may target user email to collect sensitive information. Emails may contain sensitive data, including trade secrets or personal information, that can prove valuable to adversaries. Adversaries can collect or forward email from mail servers or clients.
Tactics:	Collection
Data Sources:	Application Log: Application Log Content, Command: Command Execution, File: File Access, Logon Session: Logon Session Creation, Network Traffic: Network Connection Creation
Platforms:	Google Workspace, Linux, macOS, Office 365, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may collect data stored in the clipboard from users copying information within or between applications.
Tactics:	Collection
Data Sources:	Command: Command Execution, Process: OS API Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may transfer tools or other files from an external system into a compromised environment. Tools or files may be copied from an external adversary-controlled system to the victim network through the command and control channel or through alternate protocols such as ftp . Once present, adversaries may also transfer/spread tools between victim devices within a compromised environment (i.e. Lateral Tool Transfer ).
Tactics:	Command and Control
Data Sources:	Command: Command Execution, File: File Creation, Network Traffic: Network Connection Creation, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ a known encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Despite the use of a secure algorithm, these implementations may be vulnerable to reverse engineering if secret keys are encoded and/or generated within malware samples/configuration files.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using a protocol and port pairing that are typically not associated. For example, HTTPS over port 8088or port 587as opposed to the traditional port 443. Adversaries may make changes to the standard port used by a protocol to bypass filtering or muddle analysis/parsing of network data.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use an OSI non-application layer protocol for communication between host and C2 server or among infected hosts within a network. The list of possible protocols is extensive.Specific examples include use of network layer protocols, such as the Internet Control Message Protocol (ICMP), transport layer protocols, such as the User Datagram Protocol (UDP), session layer protocols, such as Socket Secure (SOCKS), as well as redirected/tunneled protocols, such as Serial over LAN (SOL).
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre