Edit tour

Windows Analysis Report
New Quotation - FE7191PO154.exe

Overview

General Information

Sample name:	New Quotation - FE7191PO154.exe
Analysis ID:	1467842
MD5:	494d46b06be2512d5224dcbb309cc9c8
SHA1:	8b2ff6a1c15a9b0e0f1700d449040d6177ed0456
SHA256:	a9d81d4d219333b4aae2743cb1b2ddb1f13c6182c773bae002ad26db214a054a
Tags:	exe
Infos:

Detection

FormBook

Score:	92
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

Malicious sample detected (through community Yara rule)

Multi AV Scanner detection for submitted file

Yara detected FormBook

AI detected suspicious sample

Binary is likely a compiled AutoIt script file

Initial sample is a PE file and has a suspicious name

Machine Learning detection for sample

Maps a DLL or memory area into another process

Switches to a custom stack to bypass stack traces

Writes to foreign memory regions

Checks if the current process is being debugged

Contains functionality for execution timing, often used to detect debuggers

Contains functionality for read data from the clipboard

Contains functionality to access loader functionality (e.g. LdrGetProcedureAddress)

Contains functionality to block mouse and keyboard input (often used to hinder debugging)

Contains functionality to call native functions

Contains functionality to check if a debugger is running (IsDebuggerPresent)

Contains functionality to check if a debugger is running (OutputDebugString,GetLastError)

Contains functionality to check if a window is minimized (may be used to check if an application is visible)

Contains functionality to communicate with device drivers

Contains functionality to dynamically determine API calls

Contains functionality to execute programs as a different user

Contains functionality to launch a process as a different user

Contains functionality to launch a program with higher privileges

Contains functionality to modify clipboard data

Contains functionality to open a port and listen for incoming connection (possibly a backdoor)

Contains functionality to query CPU information (cpuid)

Contains functionality to read the PEB

Contains functionality to read the clipboard data

Contains functionality to retrieve information about pressed keystrokes

Contains functionality to shutdown / reboot the system

Contains functionality to simulate keystroke presses

Contains functionality to simulate mouse events

Contains functionality which may be used to detect a debugger (GetProcessHeap)

Creates a process in suspended mode (likely to inject code)

Detected potential crypto function

Extensive use of GetProcAddress (often used to hide API calls)

Found evasive API chain (date check)

Found evasive API chain (may stop execution after accessing registry keys)

Found large amount of non-executed APIs

Found potential string decryption / allocating functions

May sleep (evasive loops) to hinder dynamic analysis

OS version to string mapping found (often used in BOTs)

Potential key logger detected (key state polling based)

Sample file is different than original file name gathered from version info

Sigma detected: Uncommon Svchost Parent Process

Uses 32bit PE files

Uses code obfuscation techniques (call, push, ret)

Yara signature match

Classification

Process Tree

System is w10x64

New Quotation - FE7191PO154.exe (PID: 4916 cmdline: "C:\Users\user\Desktop\New Quotation - FE7191PO154.exe" MD5: 494D46B06BE2512D5224DCBB309CC9C8)

svchost.exe (PID: 3576 cmdline: "C:\Users\user\Desktop\New Quotation - FE7191PO154.exe" MD5: 1ED18311E3DA35942DB37D15FA40CC5B)

cleanup

Malware Threat Intel

Provided by

Name	Description	Attribution	Blogpost URLs	Link
Formbook, Formbo	FormBook contains a unique crypter RunPE that has unique behavioral patterns subject to detection. It was initially called "Babushka Crypter" by Insidemalware.	SWEED Cobalt	http://blog.inquest.net/blog/2018/06/22/a-look-at-formbook-stealer/ http://cambuz.blogspot.de/2016/06/form-grabber-2016-cromeffoperathunderbi.html http://www.vkremez.com/2018/01/lets-learn-dissecting-formbook.html https://0xmrmagnezi.github.io/malware%20analysis/FormBook/ https://any.run/cybersecurity-blog/xloader-formbook-encryption-analysis-and-malware-decryption/	https://malpedia.caad.fkie.fraunhofer.de/details/win.formbook

Yara Signatures

Memory Dumps

Source	Rule	Description	Author	Strings
00000002.00000002.2581820388.0000000000470000.00000040.80000000.00040000.00000000.sdmp	JoeSecurity_FormBook_1	Yara detected FormBook	Joe Security
00000002.00000002.2581820388.0000000000470000.00000040.80000000.00040000.00000000.sdmp	Windows_Trojan_Formbook_1112e116	unknown	unknown	0x2da53:$a2: 74 0A 4E 0F B6 08 8D 44 08 01 75 F6 8D 70 01 0F B6 00 8D 55 0x17292:$a3: 1A D2 80 E2 AF 80 C2 7E EB 2A 80 FA 2F 75 11 8A D0 80 E2 01
00000002.00000002.2582022123.0000000002CC0000.00000004.00001000.00020000.00000000.sdmp	JoeSecurity_FormBook_1	Yara detected FormBook	Joe Security
00000002.00000002.2582022123.0000000002CC0000.00000004.00001000.00020000.00000000.sdmp	Windows_Trojan_Formbook_1112e116	unknown	unknown	0x2a610:$a2: 74 0A 4E 0F B6 08 8D 44 08 01 75 F6 8D 70 01 0F B6 00 8D 55 0x13e4f:$a3: 1A D2 80 E2 AF 80 C2 7E EB 2A 80 FA 2F 75 11 8A D0 80 E2 01

Unpacked PEs

Source	Rule	Description	Author	Strings
2.2.svchost.exe.470000.0.unpack	JoeSecurity_FormBook_1	Yara detected FormBook	Joe Security
2.2.svchost.exe.470000.0.unpack	Windows_Trojan_Formbook_1112e116	unknown	unknown	0x2cc53:$a2: 74 0A 4E 0F B6 08 8D 44 08 01 75 F6 8D 70 01 0F B6 00 8D 55 0x16492:$a3: 1A D2 80 E2 AF 80 C2 7E EB 2A 80 FA 2F 75 11 8A D0 80 E2 01
2.2.svchost.exe.470000.0.raw.unpack	JoeSecurity_FormBook_1	Yara detected FormBook	Joe Security
2.2.svchost.exe.470000.0.raw.unpack	Windows_Trojan_Formbook_1112e116	unknown	unknown	0x2da53:$a2: 74 0A 4E 0F B6 08 8D 44 08 01 75 F6 8D 70 01 0F B6 00 8D 55 0x17292:$a3: 1A D2 80 E2 AF 80 C2 7E EB 2A 80 FA 2F 75 11 8A D0 80 E2 01

Sigma Signatures

System Summary

Sigma detected: Uncommon Svchost Parent Process

Source: Process started

Author: Florian Roth (Nextron Systems): Data: Command: "C:\Users\user\Desktop\New Quotation - FE7191PO154.exe", CommandLine: "C:\Users\user\Desktop\New Quotation - FE7191PO154.exe", CommandLine|base64offset|contains: B-j, Image: C:\Windows\SysWOW64\svchost.exe, NewProcessName: C:\Windows\SysWOW64\svchost.exe, OriginalFileName: C:\Windows\SysWOW64\svchost.exe, ParentCommandLine: "C:\Users\user\Desktop\New Quotation - FE7191PO154.exe", ParentImage: C:\Users\user\Desktop\New Quotation - FE7191PO154.exe, ParentProcessId: 4916, ParentProcessName: New Quotation - FE7191PO154.exe, ProcessCommandLine: "C:\Users\user\Desktop\New Quotation - FE7191PO154.exe", ProcessId: 3576, ProcessName: svchost.exe

Sigma detected: Windows Processes Suspicious Parent Directory

Source: Process started

Author: vburov: Data: Command: "C:\Users\user\Desktop\New Quotation - FE7191PO154.exe", CommandLine: "C:\Users\user\Desktop\New Quotation - FE7191PO154.exe", CommandLine|base64offset|contains: B-j, Image: C:\Windows\SysWOW64\svchost.exe, NewProcessName: C:\Windows\SysWOW64\svchost.exe, OriginalFileName: C:\Windows\SysWOW64\svchost.exe, ParentCommandLine: "C:\Users\user\Desktop\New Quotation - FE7191PO154.exe", ParentImage: C:\Users\user\Desktop\New Quotation - FE7191PO154.exe, ParentProcessId: 4916, ParentProcessName: New Quotation - FE7191PO154.exe, ProcessCommandLine: "C:\Users\user\Desktop\New Quotation - FE7191PO154.exe", ProcessId: 3576, ProcessName: svchost.exe

Snort Signatures

⊘No Snort rule has matched

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

AV Detection

Multi AV Scanner detection for submitted file

Source: New Quotation - FE7191PO154.exe

ReversingLabs: Detection: 50%

Yara detected FormBook

Source: Yara match	File source: 2.2.svchost.exe.470000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 2.2.svchost.exe.470000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000002.00000002.2581820388.0000000000470000.00000040.80000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000002.00000002.2582022123.0000000002CC0000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY

AI detected suspicious sample

Source: Submited Sample

Integrated Neural Analysis Model: Matched 100.0% probability

Machine Learning detection for sample

Source: New Quotation - FE7191PO154.exe

Joe Sandbox ML: detected

Source: New Quotation - FE7191PO154.exe

Static PE information: EXECUTABLE_IMAGE, LARGE_ADDRESS_AWARE, 32BIT_MACHINE

Source:	Binary string: wntdll.pdbUGP source: New Quotation - FE7191PO154.exe, 00000000.00000003.2096404794.0000000003460000.00000004.00001000.00020000.00000000.sdmp, New Quotation - FE7191PO154.exe, 00000000.00000003.2095860304.00000000035B0000.00000004.00001000.00020000.00000000.sdmp, svchost.exe, 00000002.00000002.2582048600.000000000309E000.00000040.00001000.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2250272838.0000000002D00000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000002.2582048600.0000000002F00000.00000040.00001000.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2248695787.0000000002B00000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: wntdll.pdb source: New Quotation - FE7191PO154.exe, 00000000.00000003.2096404794.0000000003460000.00000004.00001000.00020000.00000000.sdmp, New Quotation - FE7191PO154.exe, 00000000.00000003.2095860304.00000000035B0000.00000004.00001000.00020000.00000000.sdmp, svchost.exe, svchost.exe, 00000002.00000002.2582048600.000000000309E000.00000040.00001000.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2250272838.0000000002D00000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000002.2582048600.0000000002F00000.00000040.00001000.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2248695787.0000000002B00000.00000004.00000020.00020000.00000000.sdmp

Source: C:\Users\user\Desktop\New Quotation - FE7191PO154.exe	Code function: 0_2_00E14696 GetFileAttributesW,FindFirstFileW,FindClose,	0_2_00E14696
Source: C:\Users\user\Desktop\New Quotation - FE7191PO154.exe	Code function: 0_2_00E1C9C7 FindFirstFileW,FindClose,FileTimeToLocalFileTime,FileTimeToLocalFileTime,FileTimeToLocalFileTime,FileTimeToSystemTime,__swprintf,__swprintf,__swprintf,__swprintf,__swprintf,__swprintf,__swprintf,	0_2_00E1C9C7
Source: C:\Users\user\Desktop\New Quotation - FE7191PO154.exe	Code function: 0_2_00E1C93C FindFirstFileW,FindClose,	0_2_00E1C93C
Source: C:\Users\user\Desktop\New Quotation - FE7191PO154.exe	Code function: 0_2_00E1F200 SetCurrentDirectoryW,FindFirstFileW,FindFirstFileW,_wcscmp,_wcscmp,GetFileAttributesW,SetFileAttributesW,FindNextFileW,FindClose,FindFirstFileW,SetCurrentDirectoryW,_wcscmp,_wcscmp,SetCurrentDirectoryW,SetCurrentDirectoryW,FindNextFileW,FindClose,FindClose,	0_2_00E1F200
Source: C:\Users\user\Desktop\New Quotation - FE7191PO154.exe	Code function: 0_2_00E1F35D SetCurrentDirectoryW,FindFirstFileW,FindFirstFileW,_wcscmp,_wcscmp,FindNextFileW,FindClose,FindFirstFileW,SetCurrentDirectoryW,_wcscmp,_wcscmp,SetCurrentDirectoryW,SetCurrentDirectoryW,FindNextFileW,FindClose,FindClose,	0_2_00E1F35D
Source: C:\Users\user\Desktop\New Quotation - FE7191PO154.exe	Code function: 0_2_00E1F65E FindFirstFileW,Sleep,_wcscmp,_wcscmp,FindNextFileW,FindClose,	0_2_00E1F65E
Source: C:\Users\user\Desktop\New Quotation - FE7191PO154.exe	Code function: 0_2_00E13A2B FindFirstFileW,DeleteFileW,DeleteFileW,MoveFileW,DeleteFileW,FindNextFileW,FindClose,FindClose,	0_2_00E13A2B
Source: C:\Users\user\Desktop\New Quotation - FE7191PO154.exe	Code function: 0_2_00E13D4E FindFirstFileW,DeleteFileW,FindNextFileW,FindClose,FindClose,	0_2_00E13D4E
Source: C:\Users\user\Desktop\New Quotation - FE7191PO154.exe	Code function: 0_2_00E1BF27 FindFirstFileW,_wcscmp,_wcscmp,FindNextFileW,FindClose,	0_2_00E1BF27

Source: C:\Users\user\Desktop\New Quotation - FE7191PO154.exe

Code function: 0_2_00E225E2 InternetReadFile,InternetQueryDataAvailable,InternetReadFile,

0_2_00E225E2

Source: C:\Users\user\Desktop\New Quotation - FE7191PO154.exe

Code function: 0_2_00E2425A OpenClipboard,IsClipboardFormatAvailable,IsClipboardFormatAvailable,GetClipboardData,CloseClipboard,GlobalLock,CloseClipboard,GlobalUnlock,IsClipboardFormatAvailable,GetClipboardData,GlobalLock,GlobalUnlock,IsClipboardFormatAvailable,GetClipboardData,GlobalLock,DragQueryFileW,DragQueryFileW,DragQueryFileW,GlobalUnlock,CountClipboardFormats,CloseClipboard,

0_2_00E2425A

Source: C:\Users\user\Desktop\New Quotation - FE7191PO154.exe

Code function: 0_2_00E24458 OpenClipboard,EmptyClipboard,GlobalAlloc,GlobalLock,_wcscpy,GlobalUnlock,OpenClipboard,EmptyClipboard,SetClipboardData,CloseClipboard,

0_2_00E24458

Source: C:\Users\user\Desktop\New Quotation - FE7191PO154.exe

0_2_00E2425A

Source: C:\Users\user\Desktop\New Quotation - FE7191PO154.exe

Code function: 0_2_00E10219 GetKeyboardState,GetAsyncKeyState,GetKeyState,GetKeyState,GetAsyncKeyState,GetKeyState,GetAsyncKeyState,GetKeyState,GetAsyncKeyState,GetKeyState,GetAsyncKeyState,GetKeyState,

0_2_00E10219

Source: C:\Users\user\Desktop\New Quotation - FE7191PO154.exe

Code function: 0_2_00E3CDAC DefDlgProcW,SendMessageW,GetWindowLongW,SendMessageW,SendMessageW,_wcsncpy,GetKeyState,GetKeyState,GetKeyState,SendMessageW,GetKeyState,SendMessageW,SendMessageW,SendMessageW,ImageList_SetDragCursorImage,ImageList_BeginDrag,SetCapture,ClientToScreen,ImageList_DragEnter,InvalidateRect,ReleaseCapture,GetCursorPos,ScreenToClient,SendMessageW,SendMessageW,SendMessageW,SendMessageW,SendMessageW,SendMessageW,SendMessageW,GetCursorPos,ScreenToClient,GetParent,SendMessageW,SendMessageW,ClientToScreen,TrackPopupMenuEx,SendMessageW,SendMessageW,ClientToScreen,TrackPopupMenuEx,GetWindowLongW,

0_2_00E3CDAC

E-Banking Fraud

Yara detected FormBook

Source: Yara match	File source: 2.2.svchost.exe.470000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 2.2.svchost.exe.470000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000002.00000002.2581820388.0000000000470000.00000040.80000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000002.00000002.2582022123.0000000002CC0000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY

System Summary

Malicious sample detected (through community Yara rule)

Source: 2.2.svchost.exe.470000.0.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Formbook_1112e116 Author: unknown
Source: 2.2.svchost.exe.470000.0.raw.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Formbook_1112e116 Author: unknown
Source: 00000002.00000002.2581820388.0000000000470000.00000040.80000000.00040000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Formbook_1112e116 Author: unknown
Source: 00000002.00000002.2582022123.0000000002CC0000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Formbook_1112e116 Author: unknown

Binary is likely a compiled AutoIt script file

Source: C:\Users\user\Desktop\New Quotation - FE7191PO154.exe	Code function: This is a third-party compiled AutoIt script.	0_2_00DB3B4C
Source: New Quotation - FE7191PO154.exe	String found in binary or memory: This is a third-party compiled AutoIt script.
Source: New Quotation - FE7191PO154.exe, 00000000.00000000.2087610787.0000000000E65000.00000002.00000001.01000000.00000003.sdmp	String found in binary or memory: This is a third-party compiled AutoIt script.	memstr_d316814a-5
Source: New Quotation - FE7191PO154.exe, 00000000.00000000.2087610787.0000000000E65000.00000002.00000001.01000000.00000003.sdmp	String found in binary or memory: SDSOFTWARE\Classes\\CLSID\\\IPC$This is a third-party compiled AutoIt script."runasError allocating memory.SeAssignPrimaryTokenPrivilegeSeIncreaseQuotaPrivilegeSeBackupPrivilegeSeRestorePrivilegewinsta0defaultwinsta0\defaultComboBoxListBox\|SHELLDLL_DefViewlargeiconsdetailssmalliconslistCLASSCLASSNNREGEXPCLASSIDNAMEXYWHINSTANCETEXT%s%u%s%dLAST[LASTACTIVE[ACTIVEHANDLE=[HANDLE:REGEXP=[REGEXPTITLE:CLASSNAME=[CLASS:ALL[ALL]HANDLEREGEXPTITLETITLEThumbnailClassAutoIt3GUIContainer	memstr_83e30acd-4
Source: New Quotation - FE7191PO154.exe	String found in binary or memory: This is a third-party compiled AutoIt script.	memstr_dbc0b98e-7
Source: New Quotation - FE7191PO154.exe	String found in binary or memory: SDSOFTWARE\Classes\\CLSID\\\IPC$This is a third-party compiled AutoIt script."runasError allocating memory.SeAssignPrimaryTokenPrivilegeSeIncreaseQuotaPrivilegeSeBackupPrivilegeSeRestorePrivilegewinsta0defaultwinsta0\defaultComboBoxListBox\|SHELLDLL_DefViewlargeiconsdetailssmalliconslistCLASSCLASSNNREGEXPCLASSIDNAMEXYWHINSTANCETEXT%s%u%s%dLAST[LASTACTIVE[ACTIVEHANDLE=[HANDLE:REGEXP=[REGEXPTITLE:CLASSNAME=[CLASS:ALL[ALL]HANDLEREGEXPTITLETITLEThumbnailClassAutoIt3GUIContainer	memstr_e5dde886-3

Initial sample is a PE file and has a suspicious name

Source: initial sample

Static PE information: Filename: New Quotation - FE7191PO154.exe

Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_0049AFB3 NtClose,	2_2_0049AFB3
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_00471A37 NtProtectVirtualMemory,	2_2_00471A37
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_02F72B60 NtClose,LdrInitializeThunk,	2_2_02F72B60
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_02F72DF0 NtQuerySystemInformation,LdrInitializeThunk,	2_2_02F72DF0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_02F735C0 NtCreateMutant,LdrInitializeThunk,	2_2_02F735C0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_02F74340 NtSetContextThread,	2_2_02F74340
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_02F74650 NtSuspendThread,	2_2_02F74650
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_02F72AF0 NtWriteFile,	2_2_02F72AF0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_02F72AD0 NtReadFile,	2_2_02F72AD0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_02F72AB0 NtWaitForSingleObject,	2_2_02F72AB0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_02F72BF0 NtAllocateVirtualMemory,	2_2_02F72BF0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_02F72BE0 NtQueryValueKey,	2_2_02F72BE0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_02F72BA0 NtEnumerateValueKey,	2_2_02F72BA0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_02F72B80 NtQueryInformationFile,	2_2_02F72B80
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_02F72EE0 NtQueueApcThread,	2_2_02F72EE0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_02F72EA0 NtAdjustPrivilegesToken,	2_2_02F72EA0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_02F72E80 NtReadVirtualMemory,	2_2_02F72E80
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_02F72E30 NtWriteVirtualMemory,	2_2_02F72E30
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_02F72FE0 NtCreateFile,	2_2_02F72FE0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_02F72FB0 NtResumeThread,	2_2_02F72FB0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_02F72FA0 NtQuerySection,	2_2_02F72FA0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_02F72F90 NtProtectVirtualMemory,	2_2_02F72F90
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_02F72F60 NtCreateProcessEx,	2_2_02F72F60
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_02F72F30 NtCreateSection,	2_2_02F72F30
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_02F72CF0 NtOpenProcess,	2_2_02F72CF0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_02F72CC0 NtQueryVirtualMemory,	2_2_02F72CC0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_02F72CA0 NtQueryInformationToken,	2_2_02F72CA0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_02F72C70 NtFreeVirtualMemory,	2_2_02F72C70
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_02F72C60 NtCreateKey,	2_2_02F72C60
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_02F72C00 NtQueryInformationProcess,	2_2_02F72C00
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_02F72DD0 NtDelayExecution,	2_2_02F72DD0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_02F72DB0 NtEnumerateKey,	2_2_02F72DB0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_02F72D30 NtUnmapViewOfSection,	2_2_02F72D30
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_02F72D10 NtMapViewOfSection,	2_2_02F72D10
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_02F72D00 NtSetInformationFile,	2_2_02F72D00
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_02F73090 NtSetValueKey,	2_2_02F73090
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_02F73010 NtOpenDirectoryObject,	2_2_02F73010
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_02F739B0 NtGetContextThread,	2_2_02F739B0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_02F73D70 NtOpenThread,	2_2_02F73D70
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_02F73D10 NtOpenProcessToken,	2_2_02F73D10

Source: C:\Users\user\Desktop\New Quotation - FE7191PO154.exe

Code function: 0_2_00E140B1: CreateFileW,_memset,DeviceIoControl,CloseHandle,

0_2_00E140B1

Source: C:\Users\user\Desktop\New Quotation - FE7191PO154.exe

Code function: 0_2_00E08858 _memset,DuplicateTokenEx,CloseHandle,OpenWindowStationW,GetProcessWindowStation,SetProcessWindowStation,OpenDesktopW,_wcscpy,LoadUserProfileW,CreateEnvironmentBlock,CreateProcessAsUserW,UnloadUserProfile,CloseWindowStation,CloseDesktop,SetProcessWindowStation,CloseHandle,DestroyEnvironmentBlock,

0_2_00E08858

Source: C:\Users\user\Desktop\New Quotation - FE7191PO154.exe

Code function: 0_2_00E1545F ExitWindowsEx,InitiateSystemShutdownExW,SetSystemPowerState,

0_2_00E1545F

Source: C:\Users\user\Desktop\New Quotation - FE7191PO154.exe	Code function: 0_2_00DBE800	0_2_00DBE800
Source: C:\Users\user\Desktop\New Quotation - FE7191PO154.exe	Code function: 0_2_00DDDBB5	0_2_00DDDBB5
Source: C:\Users\user\Desktop\New Quotation - FE7191PO154.exe	Code function: 0_2_00E3804A	0_2_00E3804A
Source: C:\Users\user\Desktop\New Quotation - FE7191PO154.exe	Code function: 0_2_00DBE060	0_2_00DBE060
Source: C:\Users\user\Desktop\New Quotation - FE7191PO154.exe	Code function: 0_2_00DC4140	0_2_00DC4140
Source: C:\Users\user\Desktop\New Quotation - FE7191PO154.exe	Code function: 0_2_00DD2405	0_2_00DD2405
Source: C:\Users\user\Desktop\New Quotation - FE7191PO154.exe	Code function: 0_2_00DE6522	0_2_00DE6522
Source: C:\Users\user\Desktop\New Quotation - FE7191PO154.exe	Code function: 0_2_00E30665	0_2_00E30665
Source: C:\Users\user\Desktop\New Quotation - FE7191PO154.exe	Code function: 0_2_00DE267E	0_2_00DE267E
Source: C:\Users\user\Desktop\New Quotation - FE7191PO154.exe	Code function: 0_2_00DC6843	0_2_00DC6843
Source: C:\Users\user\Desktop\New Quotation - FE7191PO154.exe	Code function: 0_2_00DD283A	0_2_00DD283A
Source: C:\Users\user\Desktop\New Quotation - FE7191PO154.exe	Code function: 0_2_00DE89DF	0_2_00DE89DF
Source: C:\Users\user\Desktop\New Quotation - FE7191PO154.exe	Code function: 0_2_00E30AE2	0_2_00E30AE2
Source: C:\Users\user\Desktop\New Quotation - FE7191PO154.exe	Code function: 0_2_00DE6A94	0_2_00DE6A94
Source: C:\Users\user\Desktop\New Quotation - FE7191PO154.exe	Code function: 0_2_00DC8A0E	0_2_00DC8A0E
Source: C:\Users\user\Desktop\New Quotation - FE7191PO154.exe	Code function: 0_2_00E0EB07	0_2_00E0EB07
Source: C:\Users\user\Desktop\New Quotation - FE7191PO154.exe	Code function: 0_2_00E18B13	0_2_00E18B13
Source: C:\Users\user\Desktop\New Quotation - FE7191PO154.exe	Code function: 0_2_00DDCD61	0_2_00DDCD61
Source: C:\Users\user\Desktop\New Quotation - FE7191PO154.exe	Code function: 0_2_00DE7006	0_2_00DE7006
Source: C:\Users\user\Desktop\New Quotation - FE7191PO154.exe	Code function: 0_2_00DC3190	0_2_00DC3190
Source: C:\Users\user\Desktop\New Quotation - FE7191PO154.exe	Code function: 0_2_00DC710E	0_2_00DC710E
Source: C:\Users\user\Desktop\New Quotation - FE7191PO154.exe	Code function: 0_2_00DB1287	0_2_00DB1287
Source: C:\Users\user\Desktop\New Quotation - FE7191PO154.exe	Code function: 0_2_00DD33C7	0_2_00DD33C7
Source: C:\Users\user\Desktop\New Quotation - FE7191PO154.exe	Code function: 0_2_00DDF419	0_2_00DDF419
Source: C:\Users\user\Desktop\New Quotation - FE7191PO154.exe	Code function: 0_2_00DD16C4	0_2_00DD16C4
Source: C:\Users\user\Desktop\New Quotation - FE7191PO154.exe	Code function: 0_2_00DC5680	0_2_00DC5680
Source: C:\Users\user\Desktop\New Quotation - FE7191PO154.exe	Code function: 0_2_00DD78D3	0_2_00DD78D3
Source: C:\Users\user\Desktop\New Quotation - FE7191PO154.exe	Code function: 0_2_00DC58C0	0_2_00DC58C0
Source: C:\Users\user\Desktop\New Quotation - FE7191PO154.exe	Code function: 0_2_00DD1BB8	0_2_00DD1BB8
Source: C:\Users\user\Desktop\New Quotation - FE7191PO154.exe	Code function: 0_2_00DE9D05	0_2_00DE9D05
Source: C:\Users\user\Desktop\New Quotation - FE7191PO154.exe	Code function: 0_2_00DBFE40	0_2_00DBFE40
Source: C:\Users\user\Desktop\New Quotation - FE7191PO154.exe	Code function: 0_2_00DD1FD0	0_2_00DD1FD0
Source: C:\Users\user\Desktop\New Quotation - FE7191PO154.exe	Code function: 0_2_00DDBFE6	0_2_00DDBFE6
Source: C:\Users\user\Desktop\New Quotation - FE7191PO154.exe	Code function: 0_2_03043620	0_2_03043620
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_0047E023	2_2_0047E023
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_004731B0	2_2_004731B0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_0049D343	2_2_0049D343
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_00474564	2_2_00474564
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_0047FD7A	2_2_0047FD7A
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_0047FD83	2_2_0047FD83
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_00486603	2_2_00486603
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_00472700	2_2_00472700
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_0047FFA3	2_2_0047FFA3
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_02FC02C0	2_2_02FC02C0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_02FE0274	2_2_02FE0274
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_030003E6	2_2_030003E6
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_02F4E3F0	2_2_02F4E3F0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_02FFA352	2_2_02FFA352
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_030001AA	2_2_030001AA
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_02FD2000	2_2_02FD2000
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_02FF81CC	2_2_02FF81CC
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_02FF41A2	2_2_02FF41A2
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_02FC8158	2_2_02FC8158
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_02FDA118	2_2_02FDA118
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_02F30100	2_2_02F30100
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_02F5C6E0	2_2_02F5C6E0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_02F3C7C0	2_2_02F3C7C0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_02F40770	2_2_02F40770
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_02F64750	2_2_02F64750
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_02FEE4F6	2_2_02FEE4F6
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03000591	2_2_03000591
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_02FF2446	2_2_02FF2446
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_02FE4420	2_2_02FE4420
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_02F40535	2_2_02F40535
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_02F3EA80	2_2_02F3EA80
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_02FF6BD7	2_2_02FF6BD7
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_02FFAB40	2_2_02FFAB40
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_02F6E8F0	2_2_02F6E8F0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_02F268B8	2_2_02F268B8
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_0300A9A6	2_2_0300A9A6
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_02F4A840	2_2_02F4A840
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_02F42840	2_2_02F42840
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_02F429A0	2_2_02F429A0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_02F56962	2_2_02F56962
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_02FFEEDB	2_2_02FFEEDB
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_02F52E90	2_2_02F52E90
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_02FFCE93	2_2_02FFCE93
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_02F40E59	2_2_02F40E59
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_02FFEE26	2_2_02FFEE26
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_02F4CFE0	2_2_02F4CFE0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_02F32FC8	2_2_02F32FC8
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_02FBEFA0	2_2_02FBEFA0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_02FB4F40	2_2_02FB4F40
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_02F60F30	2_2_02F60F30
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_02FE2F30	2_2_02FE2F30
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_02F82F28	2_2_02F82F28
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_02F30CF2	2_2_02F30CF2
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_02FE0CB5	2_2_02FE0CB5
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_02F40C00	2_2_02F40C00
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_02F3ADE0	2_2_02F3ADE0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_02F58DBF	2_2_02F58DBF
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_02FDCD1F	2_2_02FDCD1F
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_02F4AD00	2_2_02F4AD00
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_02FE12ED	2_2_02FE12ED
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_02F5B2C0	2_2_02F5B2C0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_02F452A0	2_2_02F452A0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_02F8739A	2_2_02F8739A
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_02F2D34C	2_2_02F2D34C
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_02FF132D	2_2_02FF132D
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_02FF70E9	2_2_02FF70E9
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_02FFF0E0	2_2_02FFF0E0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_02FEF0CC	2_2_02FEF0CC
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_02F470C0	2_2_02F470C0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_0300B16B	2_2_0300B16B
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_02F4B1B0	2_2_02F4B1B0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_02F2F172	2_2_02F2F172
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_02F7516C	2_2_02F7516C
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_02FF16CC	2_2_02FF16CC
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_02F85630	2_2_02F85630
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_02FFF7B0	2_2_02FFF7B0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_02F31460	2_2_02F31460
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_02FFF43F	2_2_02FFF43F
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_030095C3	2_2_030095C3
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_02FDD5B0	2_2_02FDD5B0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_02FF7571	2_2_02FF7571
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_02FEDAC6	2_2_02FEDAC6
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_02FDDAAC	2_2_02FDDAAC
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_02F85AA0	2_2_02F85AA0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_02FE1AA3	2_2_02FE1AA3
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_02FB3A6C	2_2_02FB3A6C
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_02FFFA49	2_2_02FFFA49
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_02FF7A46	2_2_02FF7A46
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_02FB5BF0	2_2_02FB5BF0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_02F7DBF9	2_2_02F7DBF9
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_02F5FB80	2_2_02F5FB80
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_02FFFB76	2_2_02FFFB76
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_02F438E0	2_2_02F438E0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_02FAD800	2_2_02FAD800
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_02F49950	2_2_02F49950
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_02F5B950	2_2_02F5B950
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_02FD5910	2_2_02FD5910
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_02F49EB0	2_2_02F49EB0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_02F03FD2	2_2_02F03FD2
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_02F03FD5	2_2_02F03FD5
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_02FFFFB1	2_2_02FFFFB1
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_02F41F92	2_2_02F41F92
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_02FFFF09	2_2_02FFFF09
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_02FFFCF2	2_2_02FFFCF2
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_02FB9C32	2_2_02FB9C32
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_02F5FDC0	2_2_02F5FDC0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_02FF7D73	2_2_02FF7D73
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_02FF1D5A	2_2_02FF1D5A
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_02F43D40	2_2_02F43D40

Source: C:\Windows\SysWOW64\svchost.exe	Code function: String function: 02FAEA12 appears 86 times
Source: C:\Windows\SysWOW64\svchost.exe	Code function: String function: 02FBF290 appears 105 times
Source: C:\Windows\SysWOW64\svchost.exe	Code function: String function: 02F75130 appears 58 times
Source: C:\Windows\SysWOW64\svchost.exe	Code function: String function: 02F87E54 appears 111 times
Source: C:\Windows\SysWOW64\svchost.exe	Code function: String function: 02F2B970 appears 280 times
Source: C:\Users\user\Desktop\New Quotation - FE7191PO154.exe	Code function: String function: 00DB7F41 appears 35 times
Source: C:\Users\user\Desktop\New Quotation - FE7191PO154.exe	Code function: String function: 00DD0D27 appears 70 times
Source: C:\Users\user\Desktop\New Quotation - FE7191PO154.exe	Code function: String function: 00DD8B40 appears 42 times

Source: New Quotation - FE7191PO154.exe, 00000000.00000003.2096733682.0000000003583000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamentdll.dllj% vs New Quotation - FE7191PO154.exe
Source: New Quotation - FE7191PO154.exe, 00000000.00000003.2097766264.000000000372D000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamentdll.dllj% vs New Quotation - FE7191PO154.exe

Source: New Quotation - FE7191PO154.exe

Static PE information: EXECUTABLE_IMAGE, LARGE_ADDRESS_AWARE, 32BIT_MACHINE

Source: 2.2.svchost.exe.470000.0.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Formbook_1112e116 reference_sample = 6246f3b89f0e4913abd88ae535ae3597865270f58201dc7f8ec0c87f15ff370a, os = windows, severity = x86, creation_date = 2021-06-14, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Formbook, fingerprint = b8b88451ad8c66b54e21455d835a5d435e52173c86e9b813ffab09451aff7134, id = 1112e116-dee0-4818-a41f-ca5c1c41b4b8, last_modified = 2021-08-23
Source: 2.2.svchost.exe.470000.0.raw.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Formbook_1112e116 reference_sample = 6246f3b89f0e4913abd88ae535ae3597865270f58201dc7f8ec0c87f15ff370a, os = windows, severity = x86, creation_date = 2021-06-14, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Formbook, fingerprint = b8b88451ad8c66b54e21455d835a5d435e52173c86e9b813ffab09451aff7134, id = 1112e116-dee0-4818-a41f-ca5c1c41b4b8, last_modified = 2021-08-23
Source: 00000002.00000002.2581820388.0000000000470000.00000040.80000000.00040000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Formbook_1112e116 reference_sample = 6246f3b89f0e4913abd88ae535ae3597865270f58201dc7f8ec0c87f15ff370a, os = windows, severity = x86, creation_date = 2021-06-14, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Formbook, fingerprint = b8b88451ad8c66b54e21455d835a5d435e52173c86e9b813ffab09451aff7134, id = 1112e116-dee0-4818-a41f-ca5c1c41b4b8, last_modified = 2021-08-23
Source: 00000002.00000002.2582022123.0000000002CC0000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Formbook_1112e116 reference_sample = 6246f3b89f0e4913abd88ae535ae3597865270f58201dc7f8ec0c87f15ff370a, os = windows, severity = x86, creation_date = 2021-06-14, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Formbook, fingerprint = b8b88451ad8c66b54e21455d835a5d435e52173c86e9b813ffab09451aff7134, id = 1112e116-dee0-4818-a41f-ca5c1c41b4b8, last_modified = 2021-08-23

Source: classification engine

Classification label: mal92.troj.evad.winEXE@3/4@0/0

Source: C:\Users\user\Desktop\New Quotation - FE7191PO154.exe

Code function: 0_2_00E1A2D5 GetLastError,FormatMessageW,

0_2_00E1A2D5

Source: C:\Users\user\Desktop\New Quotation - FE7191PO154.exe	Code function: 0_2_00E08713 AdjustTokenPrivileges,CloseHandle,		0_2_00E08713
Source: C:\Users\user\Desktop\New Quotation - FE7191PO154.exe	Code function: 0_2_00E08CC3 LookupPrivilegeValueW,AdjustTokenPrivileges,GetLastError,		0_2_00E08CC3

Source: C:\Users\user\Desktop\New Quotation - FE7191PO154.exe

Code function: 0_2_00E1B59E SetErrorMode,GetDiskFreeSpaceExW,SetErrorMode,

0_2_00E1B59E

Source: C:\Users\user\Desktop\New Quotation - FE7191PO154.exe

Code function: 0_2_00E2F121 CreateToolhelp32Snapshot,Process32FirstW,Process32NextW,CloseHandle,

0_2_00E2F121

Source: C:\Users\user\Desktop\New Quotation - FE7191PO154.exe

Code function: 0_2_00E286D0 CoInitialize,CoUninitialize,CoCreateInstance,IIDFromString,VariantInit,VariantClear,

0_2_00E286D0

Source: C:\Users\user\Desktop\New Quotation - FE7191PO154.exe

Code function: 0_2_00DB4FE9 CreateStreamOnHGlobal,FindResourceExW,LoadResource,SizeofResource,LockResource,

0_2_00DB4FE9

Source: C:\Users\user\Desktop\New Quotation - FE7191PO154.exe

File created: C:\Users\user\AppData\Local\Temp\aut10C0.tmp

Jump to behavior

Source: New Quotation - FE7191PO154.exe

Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ

Source: C:\Users\user\Desktop\New Quotation - FE7191PO154.exe

Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: New Quotation - FE7191PO154.exe

ReversingLabs: Detection: 50%

Source: unknown	Process created: C:\Users\user\Desktop\New Quotation - FE7191PO154.exe "C:\Users\user\Desktop\New Quotation - FE7191PO154.exe"
Source: C:\Users\user\Desktop\New Quotation - FE7191PO154.exe	Process created: C:\Windows\SysWOW64\svchost.exe "C:\Users\user\Desktop\New Quotation - FE7191PO154.exe"
Source: C:\Users\user\Desktop\New Quotation - FE7191PO154.exe	Process created: C:\Windows\SysWOW64\svchost.exe "C:\Users\user\Desktop\New Quotation - FE7191PO154.exe"	Jump to behavior

Source: C:\Users\user\Desktop\New Quotation - FE7191PO154.exe	Section loaded: wsock32.dll	Jump to behavior
Source: C:\Users\user\Desktop\New Quotation - FE7191PO154.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Users\user\Desktop\New Quotation - FE7191PO154.exe	Section loaded: winmm.dll	Jump to behavior
Source: C:\Users\user\Desktop\New Quotation - FE7191PO154.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Users\user\Desktop\New Quotation - FE7191PO154.exe	Section loaded: wininet.dll	Jump to behavior
Source: C:\Users\user\Desktop\New Quotation - FE7191PO154.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\New Quotation - FE7191PO154.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Users\user\Desktop\New Quotation - FE7191PO154.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Users\user\Desktop\New Quotation - FE7191PO154.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\Desktop\New Quotation - FE7191PO154.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Users\user\Desktop\New Quotation - FE7191PO154.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Users\user\Desktop\New Quotation - FE7191PO154.exe	Section loaded: ntmarta.dll	Jump to behavior

Source: New Quotation - FE7191PO154.exe

Static file information: File size 1173504 > 1048576

Source: New Quotation - FE7191PO154.exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_IMPORT
Source: New Quotation - FE7191PO154.exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_RESOURCE
Source: New Quotation - FE7191PO154.exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_BASERELOC
Source: New Quotation - FE7191PO154.exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_DEBUG
Source: New Quotation - FE7191PO154.exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG
Source: New Quotation - FE7191PO154.exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_IAT

Source: New Quotation - FE7191PO154.exe

Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_DEBUG

Source:	Binary string: wntdll.pdbUGP source: New Quotation - FE7191PO154.exe, 00000000.00000003.2096404794.0000000003460000.00000004.00001000.00020000.00000000.sdmp, New Quotation - FE7191PO154.exe, 00000000.00000003.2095860304.00000000035B0000.00000004.00001000.00020000.00000000.sdmp, svchost.exe, 00000002.00000002.2582048600.000000000309E000.00000040.00001000.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2250272838.0000000002D00000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000002.2582048600.0000000002F00000.00000040.00001000.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2248695787.0000000002B00000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: wntdll.pdb source: New Quotation - FE7191PO154.exe, 00000000.00000003.2096404794.0000000003460000.00000004.00001000.00020000.00000000.sdmp, New Quotation - FE7191PO154.exe, 00000000.00000003.2095860304.00000000035B0000.00000004.00001000.00020000.00000000.sdmp, svchost.exe, svchost.exe, 00000002.00000002.2582048600.000000000309E000.00000040.00001000.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2250272838.0000000002D00000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000002.2582048600.0000000002F00000.00000040.00001000.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2248695787.0000000002B00000.00000004.00000020.00020000.00000000.sdmp

Source: New Quotation - FE7191PO154.exe	Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_IMPORT is in: .rdata
Source: New Quotation - FE7191PO154.exe	Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_RESOURCE is in: .rsrc
Source: New Quotation - FE7191PO154.exe	Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_BASERELOC is in: .reloc
Source: New Quotation - FE7191PO154.exe	Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG is in: .rdata
Source: New Quotation - FE7191PO154.exe	Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_IAT is in: .rdata

Source: C:\Users\user\Desktop\New Quotation - FE7191PO154.exe

Code function: 0_2_00E2C304 LoadLibraryA,GetProcAddress,

0_2_00E2C304

Source: C:\Users\user\Desktop\New Quotation - FE7191PO154.exe	Code function: 0_2_00DD8B85 push ecx; ret	0_2_00DD8B98
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_00482173 push ecx; retf	2_2_00482174
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_0047A90C push es; iretd	2_2_0047A913
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_0047D13F push esp; iretd	2_2_0047D14C
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_00473440 push eax; ret	2_2_00473442
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_00474FFA push 00000046h; retf	2_2_00474FFC
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_02F0225F pushad ; ret	2_2_02F027F9
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_02F027FA pushad ; ret	2_2_02F027F9
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_02F0283D push eax; iretd	2_2_02F02858
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_02F309AD push ecx; mov dword ptr [esp], ecx	2_2_02F309B6
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_02F01368 push eax; iretd	2_2_02F01369

Source: C:\Users\user\Desktop\New Quotation - FE7191PO154.exe	Code function: 0_2_00DB4A35 GetForegroundWindow,FindWindowW,IsIconic,ShowWindow,SetForegroundWindow,GetWindowThreadProcessId,GetWindowThreadProcessId,GetCurrentThreadId,GetWindowThreadProcessId,AttachThreadInput,AttachThreadInput,AttachThreadInput,AttachThreadInput,SetForegroundWindow,MapVirtualKeyW,MapVirtualKeyW,keybd_event,keybd_event,MapVirtualKeyW,keybd_event,MapVirtualKeyW,keybd_event,MapVirtualKeyW,keybd_event,SetForegroundWindow,AttachThreadInput,AttachThreadInput,AttachThreadInput,AttachThreadInput,		0_2_00DB4A35
Source: C:\Users\user\Desktop\New Quotation - FE7191PO154.exe	Code function: 0_2_00E355FD IsWindowVisible,IsWindowEnabled,GetForegroundWindow,IsIconic,IsZoomed,		0_2_00E355FD

Source: C:\Users\user\Desktop\New Quotation - FE7191PO154.exe

Code function: 0_2_00DD33C7 EncodePointer,__initp_misc_winsig,GetModuleHandleW,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,

0_2_00DD33C7

Source: C:\Users\user\Desktop\New Quotation - FE7191PO154.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Users\user\Desktop\New Quotation - FE7191PO154.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior

Malware Analysis System Evasion

Switches to a custom stack to bypass stack traces

Source: C:\Users\user\Desktop\New Quotation - FE7191PO154.exe

API/Special instruction interceptor: Address: 3043244

Source: C:\Windows\SysWOW64\svchost.exe

Code function: 2_2_02F7096E rdtsc

2_2_02F7096E

Source: C:\Users\user\Desktop\New Quotation - FE7191PO154.exe

Evasive API call chain: GetSystemTimeAsFileTime,DecisionNodes

graph_0-99683

Source: C:\Users\user\Desktop\New Quotation - FE7191PO154.exe

Evasive API call chain: RegOpenKey,DecisionNodes,Sleep

graph_0-98266

Source: C:\Users\user\Desktop\New Quotation - FE7191PO154.exe	API coverage: 4.7 %
Source: C:\Windows\SysWOW64\svchost.exe	API coverage: 0.6 %

Source: C:\Windows\SysWOW64\svchost.exe TID: 6336

Thread sleep time: -30000s >= -30000s

Jump to behavior

Source: C:\Users\user\Desktop\New Quotation - FE7191PO154.exe	Code function: 0_2_00E14696 GetFileAttributesW,FindFirstFileW,FindClose,	0_2_00E14696
Source: C:\Users\user\Desktop\New Quotation - FE7191PO154.exe	Code function: 0_2_00E1C9C7 FindFirstFileW,FindClose,FileTimeToLocalFileTime,FileTimeToLocalFileTime,FileTimeToLocalFileTime,FileTimeToSystemTime,__swprintf,__swprintf,__swprintf,__swprintf,__swprintf,__swprintf,__swprintf,	0_2_00E1C9C7
Source: C:\Users\user\Desktop\New Quotation - FE7191PO154.exe	Code function: 0_2_00E1C93C FindFirstFileW,FindClose,	0_2_00E1C93C
Source: C:\Users\user\Desktop\New Quotation - FE7191PO154.exe	Code function: 0_2_00E1F200 SetCurrentDirectoryW,FindFirstFileW,FindFirstFileW,_wcscmp,_wcscmp,GetFileAttributesW,SetFileAttributesW,FindNextFileW,FindClose,FindFirstFileW,SetCurrentDirectoryW,_wcscmp,_wcscmp,SetCurrentDirectoryW,SetCurrentDirectoryW,FindNextFileW,FindClose,FindClose,	0_2_00E1F200
Source: C:\Users\user\Desktop\New Quotation - FE7191PO154.exe	Code function: 0_2_00E1F35D SetCurrentDirectoryW,FindFirstFileW,FindFirstFileW,_wcscmp,_wcscmp,FindNextFileW,FindClose,FindFirstFileW,SetCurrentDirectoryW,_wcscmp,_wcscmp,SetCurrentDirectoryW,SetCurrentDirectoryW,FindNextFileW,FindClose,FindClose,	0_2_00E1F35D
Source: C:\Users\user\Desktop\New Quotation - FE7191PO154.exe	Code function: 0_2_00E1F65E FindFirstFileW,Sleep,_wcscmp,_wcscmp,FindNextFileW,FindClose,	0_2_00E1F65E
Source: C:\Users\user\Desktop\New Quotation - FE7191PO154.exe	Code function: 0_2_00E13A2B FindFirstFileW,DeleteFileW,DeleteFileW,MoveFileW,DeleteFileW,FindNextFileW,FindClose,FindClose,	0_2_00E13A2B
Source: C:\Users\user\Desktop\New Quotation - FE7191PO154.exe	Code function: 0_2_00E13D4E FindFirstFileW,DeleteFileW,FindNextFileW,FindClose,FindClose,	0_2_00E13D4E
Source: C:\Users\user\Desktop\New Quotation - FE7191PO154.exe	Code function: 0_2_00E1BF27 FindFirstFileW,_wcscmp,_wcscmp,FindNextFileW,FindClose,	0_2_00E1BF27

Source: C:\Users\user\Desktop\New Quotation - FE7191PO154.exe

Code function: 0_2_00DB4AFE GetVersionExW,GetCurrentProcess,IsWow64Process,GetNativeSystemInfo,FreeLibrary,GetSystemInfo,GetSystemInfo,

0_2_00DB4AFE

Source: C:\Users\user\Desktop\New Quotation - FE7191PO154.exe	API call chain: ExitProcess graph end node			graph_0-98400
Source: C:\Users\user\Desktop\New Quotation - FE7191PO154.exe	API call chain: ExitProcess graph end node			graph_0-98466

Source: C:\Windows\SysWOW64\svchost.exe

Process information queried: ProcessInformation

Jump to behavior

Source: C:\Windows\SysWOW64\svchost.exe

Process queried: DebugPort

Jump to behavior

Source: C:\Windows\SysWOW64\svchost.exe

Code function: 2_2_02F7096E rdtsc

2_2_02F7096E

Source: C:\Windows\SysWOW64\svchost.exe

Code function: 2_2_004875B3 LdrLoadDll,

2_2_004875B3

Source: C:\Users\user\Desktop\New Quotation - FE7191PO154.exe

Code function: 0_2_00E241FD BlockInput,

0_2_00E241FD

Source: C:\Users\user\Desktop\New Quotation - FE7191PO154.exe

Code function: 0_2_00DB3B4C GetCurrentDirectoryW,IsDebuggerPresent,GetFullPathNameW,SetCurrentDirectoryW,MessageBoxA,SetCurrentDirectoryW,GetForegroundWindow,ShellExecuteW,

0_2_00DB3B4C

Source: C:\Users\user\Desktop\New Quotation - FE7191PO154.exe

Code function: 0_2_00DE5CCC EncodePointer,EncodePointer,___crtIsPackagedApp,LoadLibraryExW,GetLastError,LoadLibraryExW,GetProcAddress,EncodePointer,GetProcAddress,EncodePointer,GetProcAddress,EncodePointer,GetProcAddress,EncodePointer,GetProcAddress,EncodePointer,IsDebuggerPresent,OutputDebugStringW,DecodePointer,DecodePointer,DecodePointer,DecodePointer,DecodePointer,DecodePointer,DecodePointer,

0_2_00DE5CCC

Source: C:\Users\user\Desktop\New Quotation - FE7191PO154.exe

Code function: 0_2_00E2C304 LoadLibraryA,GetProcAddress,

0_2_00E2C304

Source: C:\Users\user\Desktop\New Quotation - FE7191PO154.exe	Code function: 0_2_03043510 mov eax, dword ptr fs:[00000030h]	0_2_03043510
Source: C:\Users\user\Desktop\New Quotation - FE7191PO154.exe	Code function: 0_2_030434B0 mov eax, dword ptr fs:[00000030h]	0_2_030434B0
Source: C:\Users\user\Desktop\New Quotation - FE7191PO154.exe	Code function: 0_2_03041E70 mov eax, dword ptr fs:[00000030h]	0_2_03041E70
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_02F402E1 mov eax, dword ptr fs:[00000030h]	2_2_02F402E1
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_02F402E1 mov eax, dword ptr fs:[00000030h]	2_2_02F402E1
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_02F402E1 mov eax, dword ptr fs:[00000030h]	2_2_02F402E1
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03008324 mov eax, dword ptr fs:[00000030h]	2_2_03008324
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03008324 mov ecx, dword ptr fs:[00000030h]	2_2_03008324
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03008324 mov eax, dword ptr fs:[00000030h]	2_2_03008324
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03008324 mov eax, dword ptr fs:[00000030h]	2_2_03008324
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_02F3A2C3 mov eax, dword ptr fs:[00000030h]	2_2_02F3A2C3
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_02F3A2C3 mov eax, dword ptr fs:[00000030h]	2_2_02F3A2C3
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_02F3A2C3 mov eax, dword ptr fs:[00000030h]	2_2_02F3A2C3
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_02F3A2C3 mov eax, dword ptr fs:[00000030h]	2_2_02F3A2C3
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_02F3A2C3 mov eax, dword ptr fs:[00000030h]	2_2_02F3A2C3
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_0300634F mov eax, dword ptr fs:[00000030h]	2_2_0300634F
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_02FC62A0 mov eax, dword ptr fs:[00000030h]	2_2_02FC62A0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_02FC62A0 mov ecx, dword ptr fs:[00000030h]	2_2_02FC62A0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_02FC62A0 mov eax, dword ptr fs:[00000030h]	2_2_02FC62A0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_02FC62A0 mov eax, dword ptr fs:[00000030h]	2_2_02FC62A0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_02FC62A0 mov eax, dword ptr fs:[00000030h]	2_2_02FC62A0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_02FC62A0 mov eax, dword ptr fs:[00000030h]	2_2_02FC62A0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_02F6E284 mov eax, dword ptr fs:[00000030h]	2_2_02F6E284
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_02F6E284 mov eax, dword ptr fs:[00000030h]	2_2_02F6E284
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_02FB0283 mov eax, dword ptr fs:[00000030h]	2_2_02FB0283
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_02FB0283 mov eax, dword ptr fs:[00000030h]	2_2_02FB0283
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_02FB0283 mov eax, dword ptr fs:[00000030h]	2_2_02FB0283
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_02FE0274 mov eax, dword ptr fs:[00000030h]	2_2_02FE0274
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_02FE0274 mov eax, dword ptr fs:[00000030h]	2_2_02FE0274
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_02FE0274 mov eax, dword ptr fs:[00000030h]	2_2_02FE0274
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_02FE0274 mov eax, dword ptr fs:[00000030h]	2_2_02FE0274
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_02FE0274 mov eax, dword ptr fs:[00000030h]	2_2_02FE0274
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_02FE0274 mov eax, dword ptr fs:[00000030h]	2_2_02FE0274
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_02FE0274 mov eax, dword ptr fs:[00000030h]	2_2_02FE0274
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_02FE0274 mov eax, dword ptr fs:[00000030h]	2_2_02FE0274
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_02FE0274 mov eax, dword ptr fs:[00000030h]	2_2_02FE0274
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_02FE0274 mov eax, dword ptr fs:[00000030h]	2_2_02FE0274
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_02FE0274 mov eax, dword ptr fs:[00000030h]	2_2_02FE0274
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_02FE0274 mov eax, dword ptr fs:[00000030h]	2_2_02FE0274
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_02F34260 mov eax, dword ptr fs:[00000030h]	2_2_02F34260
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_02F34260 mov eax, dword ptr fs:[00000030h]	2_2_02F34260
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_02F34260 mov eax, dword ptr fs:[00000030h]	2_2_02F34260
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_02F2826B mov eax, dword ptr fs:[00000030h]	2_2_02F2826B
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_02F2A250 mov eax, dword ptr fs:[00000030h]	2_2_02F2A250
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_02F36259 mov eax, dword ptr fs:[00000030h]	2_2_02F36259
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_02FEA250 mov eax, dword ptr fs:[00000030h]	2_2_02FEA250
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_02FEA250 mov eax, dword ptr fs:[00000030h]	2_2_02FEA250
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_02FB8243 mov eax, dword ptr fs:[00000030h]	2_2_02FB8243
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_02FB8243 mov ecx, dword ptr fs:[00000030h]	2_2_02FB8243
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_02F2823B mov eax, dword ptr fs:[00000030h]	2_2_02F2823B
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_02F4E3F0 mov eax, dword ptr fs:[00000030h]	2_2_02F4E3F0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_02F4E3F0 mov eax, dword ptr fs:[00000030h]	2_2_02F4E3F0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_02F4E3F0 mov eax, dword ptr fs:[00000030h]	2_2_02F4E3F0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_02F663FF mov eax, dword ptr fs:[00000030h]	2_2_02F663FF
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_02F403E9 mov eax, dword ptr fs:[00000030h]	2_2_02F403E9
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_02F403E9 mov eax, dword ptr fs:[00000030h]	2_2_02F403E9
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_02F403E9 mov eax, dword ptr fs:[00000030h]	2_2_02F403E9
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_02F403E9 mov eax, dword ptr fs:[00000030h]	2_2_02F403E9
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_02F403E9 mov eax, dword ptr fs:[00000030h]	2_2_02F403E9
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_02F403E9 mov eax, dword ptr fs:[00000030h]	2_2_02F403E9
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_02F403E9 mov eax, dword ptr fs:[00000030h]	2_2_02F403E9
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_02F403E9 mov eax, dword ptr fs:[00000030h]	2_2_02F403E9
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_02FDE3DB mov eax, dword ptr fs:[00000030h]	2_2_02FDE3DB
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_02FDE3DB mov eax, dword ptr fs:[00000030h]	2_2_02FDE3DB
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_02FDE3DB mov ecx, dword ptr fs:[00000030h]	2_2_02FDE3DB
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_02FDE3DB mov eax, dword ptr fs:[00000030h]	2_2_02FDE3DB
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_02FD43D4 mov eax, dword ptr fs:[00000030h]	2_2_02FD43D4
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_02FD43D4 mov eax, dword ptr fs:[00000030h]	2_2_02FD43D4
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_02FEC3CD mov eax, dword ptr fs:[00000030h]	2_2_02FEC3CD
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_02F3A3C0 mov eax, dword ptr fs:[00000030h]	2_2_02F3A3C0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_02F3A3C0 mov eax, dword ptr fs:[00000030h]	2_2_02F3A3C0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_02F3A3C0 mov eax, dword ptr fs:[00000030h]	2_2_02F3A3C0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_02F3A3C0 mov eax, dword ptr fs:[00000030h]	2_2_02F3A3C0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_02F3A3C0 mov eax, dword ptr fs:[00000030h]	2_2_02F3A3C0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_02F3A3C0 mov eax, dword ptr fs:[00000030h]	2_2_02F3A3C0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_02F383C0 mov eax, dword ptr fs:[00000030h]	2_2_02F383C0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_02F383C0 mov eax, dword ptr fs:[00000030h]	2_2_02F383C0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_02F383C0 mov eax, dword ptr fs:[00000030h]	2_2_02F383C0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_02F383C0 mov eax, dword ptr fs:[00000030h]	2_2_02F383C0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_02FB63C0 mov eax, dword ptr fs:[00000030h]	2_2_02FB63C0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_0300625D mov eax, dword ptr fs:[00000030h]	2_2_0300625D
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_02F28397 mov eax, dword ptr fs:[00000030h]	2_2_02F28397
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_02F28397 mov eax, dword ptr fs:[00000030h]	2_2_02F28397
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_02F28397 mov eax, dword ptr fs:[00000030h]	2_2_02F28397
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_02F2E388 mov eax, dword ptr fs:[00000030h]	2_2_02F2E388
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_02F2E388 mov eax, dword ptr fs:[00000030h]	2_2_02F2E388
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_02F2E388 mov eax, dword ptr fs:[00000030h]	2_2_02F2E388
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_02F5438F mov eax, dword ptr fs:[00000030h]	2_2_02F5438F
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_02F5438F mov eax, dword ptr fs:[00000030h]	2_2_02F5438F
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_02FD437C mov eax, dword ptr fs:[00000030h]	2_2_02FD437C
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_02FB035C mov eax, dword ptr fs:[00000030h]	2_2_02FB035C
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_02FB035C mov eax, dword ptr fs:[00000030h]	2_2_02FB035C
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_02FB035C mov eax, dword ptr fs:[00000030h]	2_2_02FB035C
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_02FB035C mov ecx, dword ptr fs:[00000030h]	2_2_02FB035C
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_02FB035C mov eax, dword ptr fs:[00000030h]	2_2_02FB035C
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_02FB035C mov eax, dword ptr fs:[00000030h]	2_2_02FB035C
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_02FFA352 mov eax, dword ptr fs:[00000030h]	2_2_02FFA352
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_02FD8350 mov ecx, dword ptr fs:[00000030h]	2_2_02FD8350
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_02FB2349 mov eax, dword ptr fs:[00000030h]	2_2_02FB2349
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_02FB2349 mov eax, dword ptr fs:[00000030h]	2_2_02FB2349
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_02FB2349 mov eax, dword ptr fs:[00000030h]	2_2_02FB2349
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_02FB2349 mov eax, dword ptr fs:[00000030h]	2_2_02FB2349
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_02FB2349 mov eax, dword ptr fs:[00000030h]	2_2_02FB2349
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_02FB2349 mov eax, dword ptr fs:[00000030h]	2_2_02FB2349
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_02FB2349 mov eax, dword ptr fs:[00000030h]	2_2_02FB2349
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_02FB2349 mov eax, dword ptr fs:[00000030h]	2_2_02FB2349
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_02FB2349 mov eax, dword ptr fs:[00000030h]	2_2_02FB2349
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_02FB2349 mov eax, dword ptr fs:[00000030h]	2_2_02FB2349
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_02FB2349 mov eax, dword ptr fs:[00000030h]	2_2_02FB2349
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_02FB2349 mov eax, dword ptr fs:[00000030h]	2_2_02FB2349
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_02FB2349 mov eax, dword ptr fs:[00000030h]	2_2_02FB2349
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_02FB2349 mov eax, dword ptr fs:[00000030h]	2_2_02FB2349
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_02FB2349 mov eax, dword ptr fs:[00000030h]	2_2_02FB2349
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_030062D6 mov eax, dword ptr fs:[00000030h]	2_2_030062D6
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_02F2C310 mov ecx, dword ptr fs:[00000030h]	2_2_02F2C310
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_02F50310 mov ecx, dword ptr fs:[00000030h]	2_2_02F50310
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_02F6A30B mov eax, dword ptr fs:[00000030h]	2_2_02F6A30B
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_02F6A30B mov eax, dword ptr fs:[00000030h]	2_2_02F6A30B
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_02F6A30B mov eax, dword ptr fs:[00000030h]	2_2_02F6A30B
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_02F2C0F0 mov eax, dword ptr fs:[00000030h]	2_2_02F2C0F0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_02F720F0 mov ecx, dword ptr fs:[00000030h]	2_2_02F720F0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_02F2A0E3 mov ecx, dword ptr fs:[00000030h]	2_2_02F2A0E3
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_02F380E9 mov eax, dword ptr fs:[00000030h]	2_2_02F380E9
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_02FB60E0 mov eax, dword ptr fs:[00000030h]	2_2_02FB60E0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_02FB20DE mov eax, dword ptr fs:[00000030h]	2_2_02FB20DE
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_02FF60B8 mov eax, dword ptr fs:[00000030h]	2_2_02FF60B8
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_02FF60B8 mov ecx, dword ptr fs:[00000030h]	2_2_02FF60B8
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_02F280A0 mov eax, dword ptr fs:[00000030h]	2_2_02F280A0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_02FC80A8 mov eax, dword ptr fs:[00000030h]	2_2_02FC80A8
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03004164 mov eax, dword ptr fs:[00000030h]	2_2_03004164
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03004164 mov eax, dword ptr fs:[00000030h]	2_2_03004164
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_02F3208A mov eax, dword ptr fs:[00000030h]	2_2_02F3208A
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_02F5C073 mov eax, dword ptr fs:[00000030h]	2_2_02F5C073
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_02F32050 mov eax, dword ptr fs:[00000030h]	2_2_02F32050
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_02FB6050 mov eax, dword ptr fs:[00000030h]	2_2_02FB6050
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_02FC6030 mov eax, dword ptr fs:[00000030h]	2_2_02FC6030
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_02F2A020 mov eax, dword ptr fs:[00000030h]	2_2_02F2A020
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_02F2C020 mov eax, dword ptr fs:[00000030h]	2_2_02F2C020
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_02F4E016 mov eax, dword ptr fs:[00000030h]	2_2_02F4E016
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_02F4E016 mov eax, dword ptr fs:[00000030h]	2_2_02F4E016
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_02F4E016 mov eax, dword ptr fs:[00000030h]	2_2_02F4E016
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_02F4E016 mov eax, dword ptr fs:[00000030h]	2_2_02F4E016
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_030061E5 mov eax, dword ptr fs:[00000030h]	2_2_030061E5
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_02FB4000 mov ecx, dword ptr fs:[00000030h]	2_2_02FB4000
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_02FD2000 mov eax, dword ptr fs:[00000030h]	2_2_02FD2000
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_02FD2000 mov eax, dword ptr fs:[00000030h]	2_2_02FD2000
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_02FD2000 mov eax, dword ptr fs:[00000030h]	2_2_02FD2000
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_02FD2000 mov eax, dword ptr fs:[00000030h]	2_2_02FD2000
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_02FD2000 mov eax, dword ptr fs:[00000030h]	2_2_02FD2000
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_02FD2000 mov eax, dword ptr fs:[00000030h]	2_2_02FD2000
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_02FD2000 mov eax, dword ptr fs:[00000030h]	2_2_02FD2000
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_02FD2000 mov eax, dword ptr fs:[00000030h]	2_2_02FD2000
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_02F601F8 mov eax, dword ptr fs:[00000030h]	2_2_02F601F8
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_02FAE1D0 mov eax, dword ptr fs:[00000030h]	2_2_02FAE1D0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_02FAE1D0 mov eax, dword ptr fs:[00000030h]	2_2_02FAE1D0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_02FAE1D0 mov ecx, dword ptr fs:[00000030h]	2_2_02FAE1D0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_02FAE1D0 mov eax, dword ptr fs:[00000030h]	2_2_02FAE1D0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_02FAE1D0 mov eax, dword ptr fs:[00000030h]	2_2_02FAE1D0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_02FF61C3 mov eax, dword ptr fs:[00000030h]	2_2_02FF61C3
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_02FF61C3 mov eax, dword ptr fs:[00000030h]	2_2_02FF61C3
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_02FB019F mov eax, dword ptr fs:[00000030h]	2_2_02FB019F
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_02FB019F mov eax, dword ptr fs:[00000030h]	2_2_02FB019F
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_02FB019F mov eax, dword ptr fs:[00000030h]	2_2_02FB019F
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_02FB019F mov eax, dword ptr fs:[00000030h]	2_2_02FB019F
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_02F2A197 mov eax, dword ptr fs:[00000030h]	2_2_02F2A197
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_02F2A197 mov eax, dword ptr fs:[00000030h]	2_2_02F2A197
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_02F2A197 mov eax, dword ptr fs:[00000030h]	2_2_02F2A197
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_02F70185 mov eax, dword ptr fs:[00000030h]	2_2_02F70185
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_02FEC188 mov eax, dword ptr fs:[00000030h]	2_2_02FEC188
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_02FEC188 mov eax, dword ptr fs:[00000030h]	2_2_02FEC188
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_02FD4180 mov eax, dword ptr fs:[00000030h]	2_2_02FD4180
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_02FD4180 mov eax, dword ptr fs:[00000030h]	2_2_02FD4180
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_02F2C156 mov eax, dword ptr fs:[00000030h]	2_2_02F2C156
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_02FC8158 mov eax, dword ptr fs:[00000030h]	2_2_02FC8158
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_02F36154 mov eax, dword ptr fs:[00000030h]	2_2_02F36154
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_02F36154 mov eax, dword ptr fs:[00000030h]	2_2_02F36154
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_02FC4144 mov eax, dword ptr fs:[00000030h]	2_2_02FC4144
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_02FC4144 mov eax, dword ptr fs:[00000030h]	2_2_02FC4144
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_02FC4144 mov ecx, dword ptr fs:[00000030h]	2_2_02FC4144
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_02FC4144 mov eax, dword ptr fs:[00000030h]	2_2_02FC4144
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_02FC4144 mov eax, dword ptr fs:[00000030h]	2_2_02FC4144
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_02F60124 mov eax, dword ptr fs:[00000030h]	2_2_02F60124
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_02FDA118 mov ecx, dword ptr fs:[00000030h]	2_2_02FDA118
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_02FDA118 mov eax, dword ptr fs:[00000030h]	2_2_02FDA118
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_02FDA118 mov eax, dword ptr fs:[00000030h]	2_2_02FDA118
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_02FDA118 mov eax, dword ptr fs:[00000030h]	2_2_02FDA118
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_02FF0115 mov eax, dword ptr fs:[00000030h]	2_2_02FF0115
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_02FDE10E mov eax, dword ptr fs:[00000030h]	2_2_02FDE10E
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_02FDE10E mov ecx, dword ptr fs:[00000030h]	2_2_02FDE10E
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_02FDE10E mov eax, dword ptr fs:[00000030h]	2_2_02FDE10E
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_02FDE10E mov eax, dword ptr fs:[00000030h]	2_2_02FDE10E
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_02FDE10E mov ecx, dword ptr fs:[00000030h]	2_2_02FDE10E
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_02FDE10E mov eax, dword ptr fs:[00000030h]	2_2_02FDE10E
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_02FDE10E mov eax, dword ptr fs:[00000030h]	2_2_02FDE10E
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_02FDE10E mov ecx, dword ptr fs:[00000030h]	2_2_02FDE10E
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_02FDE10E mov eax, dword ptr fs:[00000030h]	2_2_02FDE10E
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_02FDE10E mov ecx, dword ptr fs:[00000030h]	2_2_02FDE10E
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_02FAE6F2 mov eax, dword ptr fs:[00000030h]	2_2_02FAE6F2
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_02FAE6F2 mov eax, dword ptr fs:[00000030h]	2_2_02FAE6F2
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_02FAE6F2 mov eax, dword ptr fs:[00000030h]	2_2_02FAE6F2
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_02FAE6F2 mov eax, dword ptr fs:[00000030h]	2_2_02FAE6F2
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_02FB06F1 mov eax, dword ptr fs:[00000030h]	2_2_02FB06F1
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_02FB06F1 mov eax, dword ptr fs:[00000030h]	2_2_02FB06F1
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_02F6A6C7 mov ebx, dword ptr fs:[00000030h]	2_2_02F6A6C7
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_02F6A6C7 mov eax, dword ptr fs:[00000030h]	2_2_02F6A6C7
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_02F666B0 mov eax, dword ptr fs:[00000030h]	2_2_02F666B0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_02F6C6A6 mov eax, dword ptr fs:[00000030h]	2_2_02F6C6A6
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_02F34690 mov eax, dword ptr fs:[00000030h]	2_2_02F34690
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_02F34690 mov eax, dword ptr fs:[00000030h]	2_2_02F34690
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_02F62674 mov eax, dword ptr fs:[00000030h]	2_2_02F62674
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_02FF866E mov eax, dword ptr fs:[00000030h]	2_2_02FF866E
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_02FF866E mov eax, dword ptr fs:[00000030h]	2_2_02FF866E
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_02F6A660 mov eax, dword ptr fs:[00000030h]	2_2_02F6A660
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_02F6A660 mov eax, dword ptr fs:[00000030h]	2_2_02F6A660
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_02F4C640 mov eax, dword ptr fs:[00000030h]	2_2_02F4C640
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_02F4E627 mov eax, dword ptr fs:[00000030h]	2_2_02F4E627
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_02F66620 mov eax, dword ptr fs:[00000030h]	2_2_02F66620
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_02F68620 mov eax, dword ptr fs:[00000030h]	2_2_02F68620
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_02F3262C mov eax, dword ptr fs:[00000030h]	2_2_02F3262C
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_02F72619 mov eax, dword ptr fs:[00000030h]	2_2_02F72619
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_02FAE609 mov eax, dword ptr fs:[00000030h]	2_2_02FAE609
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_02F4260B mov eax, dword ptr fs:[00000030h]	2_2_02F4260B
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_02F4260B mov eax, dword ptr fs:[00000030h]	2_2_02F4260B
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_02F4260B mov eax, dword ptr fs:[00000030h]	2_2_02F4260B
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_02F4260B mov eax, dword ptr fs:[00000030h]	2_2_02F4260B
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_02F4260B mov eax, dword ptr fs:[00000030h]	2_2_02F4260B
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_02F4260B mov eax, dword ptr fs:[00000030h]	2_2_02F4260B
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_02F4260B mov eax, dword ptr fs:[00000030h]	2_2_02F4260B
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_02F347FB mov eax, dword ptr fs:[00000030h]	2_2_02F347FB
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_02F347FB mov eax, dword ptr fs:[00000030h]	2_2_02F347FB
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_02F527ED mov eax, dword ptr fs:[00000030h]	2_2_02F527ED
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_02F527ED mov eax, dword ptr fs:[00000030h]	2_2_02F527ED
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_02F527ED mov eax, dword ptr fs:[00000030h]	2_2_02F527ED
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_02FBE7E1 mov eax, dword ptr fs:[00000030h]	2_2_02FBE7E1
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_02F3C7C0 mov eax, dword ptr fs:[00000030h]	2_2_02F3C7C0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_02FB07C3 mov eax, dword ptr fs:[00000030h]	2_2_02FB07C3
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_02F307AF mov eax, dword ptr fs:[00000030h]	2_2_02F307AF
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_02FE47A0 mov eax, dword ptr fs:[00000030h]	2_2_02FE47A0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_02FD678E mov eax, dword ptr fs:[00000030h]	2_2_02FD678E
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_02F38770 mov eax, dword ptr fs:[00000030h]	2_2_02F38770
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_02F40770 mov eax, dword ptr fs:[00000030h]	2_2_02F40770
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_02F40770 mov eax, dword ptr fs:[00000030h]	2_2_02F40770
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_02F40770 mov eax, dword ptr fs:[00000030h]	2_2_02F40770
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_02F40770 mov eax, dword ptr fs:[00000030h]	2_2_02F40770
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_02F40770 mov eax, dword ptr fs:[00000030h]	2_2_02F40770
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_02F40770 mov eax, dword ptr fs:[00000030h]	2_2_02F40770
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_02F40770 mov eax, dword ptr fs:[00000030h]	2_2_02F40770
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_02F40770 mov eax, dword ptr fs:[00000030h]	2_2_02F40770
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_02F40770 mov eax, dword ptr fs:[00000030h]	2_2_02F40770
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_02F40770 mov eax, dword ptr fs:[00000030h]	2_2_02F40770
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_02F40770 mov eax, dword ptr fs:[00000030h]	2_2_02F40770
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_02F40770 mov eax, dword ptr fs:[00000030h]	2_2_02F40770
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_02F30750 mov eax, dword ptr fs:[00000030h]	2_2_02F30750
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_02FBE75D mov eax, dword ptr fs:[00000030h]	2_2_02FBE75D
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_02F72750 mov eax, dword ptr fs:[00000030h]	2_2_02F72750
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_02F72750 mov eax, dword ptr fs:[00000030h]	2_2_02F72750
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_02FB4755 mov eax, dword ptr fs:[00000030h]	2_2_02FB4755
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_02F6674D mov esi, dword ptr fs:[00000030h]	2_2_02F6674D
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_02F6674D mov eax, dword ptr fs:[00000030h]	2_2_02F6674D
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_02F6674D mov eax, dword ptr fs:[00000030h]	2_2_02F6674D
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_02F6273C mov eax, dword ptr fs:[00000030h]	2_2_02F6273C
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_02F6273C mov ecx, dword ptr fs:[00000030h]	2_2_02F6273C
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_02F6273C mov eax, dword ptr fs:[00000030h]	2_2_02F6273C
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_02FAC730 mov eax, dword ptr fs:[00000030h]	2_2_02FAC730
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_02F6C720 mov eax, dword ptr fs:[00000030h]	2_2_02F6C720
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_02F6C720 mov eax, dword ptr fs:[00000030h]	2_2_02F6C720
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_02F30710 mov eax, dword ptr fs:[00000030h]	2_2_02F30710
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_02F60710 mov eax, dword ptr fs:[00000030h]	2_2_02F60710
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_02F6C700 mov eax, dword ptr fs:[00000030h]	2_2_02F6C700
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03004500 mov eax, dword ptr fs:[00000030h]	2_2_03004500
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03004500 mov eax, dword ptr fs:[00000030h]	2_2_03004500
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03004500 mov eax, dword ptr fs:[00000030h]	2_2_03004500
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03004500 mov eax, dword ptr fs:[00000030h]	2_2_03004500
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03004500 mov eax, dword ptr fs:[00000030h]	2_2_03004500
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03004500 mov eax, dword ptr fs:[00000030h]	2_2_03004500
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03004500 mov eax, dword ptr fs:[00000030h]	2_2_03004500
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_02F304E5 mov ecx, dword ptr fs:[00000030h]	2_2_02F304E5
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_02F644B0 mov ecx, dword ptr fs:[00000030h]	2_2_02F644B0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_02FBA4B0 mov eax, dword ptr fs:[00000030h]	2_2_02FBA4B0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_02F364AB mov eax, dword ptr fs:[00000030h]	2_2_02F364AB
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_02FEA49A mov eax, dword ptr fs:[00000030h]	2_2_02FEA49A
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_02F5A470 mov eax, dword ptr fs:[00000030h]	2_2_02F5A470
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_02F5A470 mov eax, dword ptr fs:[00000030h]	2_2_02F5A470
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_02F5A470 mov eax, dword ptr fs:[00000030h]	2_2_02F5A470
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_02FBC460 mov ecx, dword ptr fs:[00000030h]	2_2_02FBC460
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_02FEA456 mov eax, dword ptr fs:[00000030h]	2_2_02FEA456
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_02F2645D mov eax, dword ptr fs:[00000030h]	2_2_02F2645D
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_02F5245A mov eax, dword ptr fs:[00000030h]	2_2_02F5245A
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_02F6E443 mov eax, dword ptr fs:[00000030h]	2_2_02F6E443
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_02F6E443 mov eax, dword ptr fs:[00000030h]	2_2_02F6E443
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_02F6E443 mov eax, dword ptr fs:[00000030h]	2_2_02F6E443
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_02F6E443 mov eax, dword ptr fs:[00000030h]	2_2_02F6E443
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_02F6E443 mov eax, dword ptr fs:[00000030h]	2_2_02F6E443
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_02F6E443 mov eax, dword ptr fs:[00000030h]	2_2_02F6E443
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_02F6E443 mov eax, dword ptr fs:[00000030h]	2_2_02F6E443
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_02F6E443 mov eax, dword ptr fs:[00000030h]	2_2_02F6E443
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_02F6A430 mov eax, dword ptr fs:[00000030h]	2_2_02F6A430
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_02F2E420 mov eax, dword ptr fs:[00000030h]	2_2_02F2E420
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_02F2E420 mov eax, dword ptr fs:[00000030h]	2_2_02F2E420
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_02F2E420 mov eax, dword ptr fs:[00000030h]	2_2_02F2E420
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_02F2C427 mov eax, dword ptr fs:[00000030h]	2_2_02F2C427
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_02FB6420 mov eax, dword ptr fs:[00000030h]	2_2_02FB6420
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_02FB6420 mov eax, dword ptr fs:[00000030h]	2_2_02FB6420
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_02FB6420 mov eax, dword ptr fs:[00000030h]	2_2_02FB6420
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_02FB6420 mov eax, dword ptr fs:[00000030h]	2_2_02FB6420
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_02FB6420 mov eax, dword ptr fs:[00000030h]	2_2_02FB6420
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_02FB6420 mov eax, dword ptr fs:[00000030h]	2_2_02FB6420
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_02FB6420 mov eax, dword ptr fs:[00000030h]	2_2_02FB6420
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_02F68402 mov eax, dword ptr fs:[00000030h]	2_2_02F68402
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_02F68402 mov eax, dword ptr fs:[00000030h]	2_2_02F68402
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_02F68402 mov eax, dword ptr fs:[00000030h]	2_2_02F68402
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_02F5E5E7 mov eax, dword ptr fs:[00000030h]	2_2_02F5E5E7
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_02F5E5E7 mov eax, dword ptr fs:[00000030h]	2_2_02F5E5E7
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_02F5E5E7 mov eax, dword ptr fs:[00000030h]	2_2_02F5E5E7
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_02F5E5E7 mov eax, dword ptr fs:[00000030h]	2_2_02F5E5E7
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_02F5E5E7 mov eax, dword ptr fs:[00000030h]	2_2_02F5E5E7
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_02F5E5E7 mov eax, dword ptr fs:[00000030h]	2_2_02F5E5E7
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_02F5E5E7 mov eax, dword ptr fs:[00000030h]	2_2_02F5E5E7
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_02F5E5E7 mov eax, dword ptr fs:[00000030h]	2_2_02F5E5E7
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_02F325E0 mov eax, dword ptr fs:[00000030h]	2_2_02F325E0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_02F6C5ED mov eax, dword ptr fs:[00000030h]	2_2_02F6C5ED
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_02F6C5ED mov eax, dword ptr fs:[00000030h]	2_2_02F6C5ED
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_02F365D0 mov eax, dword ptr fs:[00000030h]	2_2_02F365D0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_02F6A5D0 mov eax, dword ptr fs:[00000030h]	2_2_02F6A5D0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_02F6A5D0 mov eax, dword ptr fs:[00000030h]	2_2_02F6A5D0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_02F6E5CF mov eax, dword ptr fs:[00000030h]	2_2_02F6E5CF
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_02F6E5CF mov eax, dword ptr fs:[00000030h]	2_2_02F6E5CF
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_02F545B1 mov eax, dword ptr fs:[00000030h]	2_2_02F545B1
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_02F545B1 mov eax, dword ptr fs:[00000030h]	2_2_02F545B1
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_02FB05A7 mov eax, dword ptr fs:[00000030h]	2_2_02FB05A7
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_02FB05A7 mov eax, dword ptr fs:[00000030h]	2_2_02FB05A7
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_02FB05A7 mov eax, dword ptr fs:[00000030h]	2_2_02FB05A7
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_02F6E59C mov eax, dword ptr fs:[00000030h]	2_2_02F6E59C
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_02F32582 mov eax, dword ptr fs:[00000030h]	2_2_02F32582
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_02F32582 mov ecx, dword ptr fs:[00000030h]	2_2_02F32582
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_02F64588 mov eax, dword ptr fs:[00000030h]	2_2_02F64588
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_02F6656A mov eax, dword ptr fs:[00000030h]	2_2_02F6656A
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_02F6656A mov eax, dword ptr fs:[00000030h]	2_2_02F6656A
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_02F6656A mov eax, dword ptr fs:[00000030h]	2_2_02F6656A
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_02F38550 mov eax, dword ptr fs:[00000030h]	2_2_02F38550
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_02F38550 mov eax, dword ptr fs:[00000030h]	2_2_02F38550
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_02F40535 mov eax, dword ptr fs:[00000030h]	2_2_02F40535
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_02F40535 mov eax, dword ptr fs:[00000030h]	2_2_02F40535
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_02F40535 mov eax, dword ptr fs:[00000030h]	2_2_02F40535
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_02F40535 mov eax, dword ptr fs:[00000030h]	2_2_02F40535
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_02F40535 mov eax, dword ptr fs:[00000030h]	2_2_02F40535
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_02F40535 mov eax, dword ptr fs:[00000030h]	2_2_02F40535
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_02F5E53E mov eax, dword ptr fs:[00000030h]	2_2_02F5E53E
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_02F5E53E mov eax, dword ptr fs:[00000030h]	2_2_02F5E53E
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_02F5E53E mov eax, dword ptr fs:[00000030h]	2_2_02F5E53E
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_02F5E53E mov eax, dword ptr fs:[00000030h]	2_2_02F5E53E
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_02F5E53E mov eax, dword ptr fs:[00000030h]	2_2_02F5E53E
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_02FC6500 mov eax, dword ptr fs:[00000030h]	2_2_02FC6500
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03004B00 mov eax, dword ptr fs:[00000030h]	2_2_03004B00
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_02F6AAEE mov eax, dword ptr fs:[00000030h]	2_2_02F6AAEE
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_02F6AAEE mov eax, dword ptr fs:[00000030h]	2_2_02F6AAEE
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_02F30AD0 mov eax, dword ptr fs:[00000030h]	2_2_02F30AD0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_02F64AD0 mov eax, dword ptr fs:[00000030h]	2_2_02F64AD0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_02F64AD0 mov eax, dword ptr fs:[00000030h]	2_2_02F64AD0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_02F86ACC mov eax, dword ptr fs:[00000030h]	2_2_02F86ACC
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_02F86ACC mov eax, dword ptr fs:[00000030h]	2_2_02F86ACC
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_02F86ACC mov eax, dword ptr fs:[00000030h]	2_2_02F86ACC
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_02F38AA0 mov eax, dword ptr fs:[00000030h]	2_2_02F38AA0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_02F38AA0 mov eax, dword ptr fs:[00000030h]	2_2_02F38AA0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03002B57 mov eax, dword ptr fs:[00000030h]	2_2_03002B57
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03002B57 mov eax, dword ptr fs:[00000030h]	2_2_03002B57
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03002B57 mov eax, dword ptr fs:[00000030h]	2_2_03002B57
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03002B57 mov eax, dword ptr fs:[00000030h]	2_2_03002B57
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_02F86AA4 mov eax, dword ptr fs:[00000030h]	2_2_02F86AA4
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_02F68A90 mov edx, dword ptr fs:[00000030h]	2_2_02F68A90
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_02F3EA80 mov eax, dword ptr fs:[00000030h]	2_2_02F3EA80
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_02F3EA80 mov eax, dword ptr fs:[00000030h]	2_2_02F3EA80
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_02F3EA80 mov eax, dword ptr fs:[00000030h]	2_2_02F3EA80
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_02F3EA80 mov eax, dword ptr fs:[00000030h]	2_2_02F3EA80
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_02F3EA80 mov eax, dword ptr fs:[00000030h]	2_2_02F3EA80
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_02F3EA80 mov eax, dword ptr fs:[00000030h]	2_2_02F3EA80
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_02F3EA80 mov eax, dword ptr fs:[00000030h]	2_2_02F3EA80
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_02F3EA80 mov eax, dword ptr fs:[00000030h]	2_2_02F3EA80
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_02F3EA80 mov eax, dword ptr fs:[00000030h]	2_2_02F3EA80
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_02FACA72 mov eax, dword ptr fs:[00000030h]	2_2_02FACA72
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_02FACA72 mov eax, dword ptr fs:[00000030h]	2_2_02FACA72
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_02F6CA6F mov eax, dword ptr fs:[00000030h]	2_2_02F6CA6F
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_02F6CA6F mov eax, dword ptr fs:[00000030h]	2_2_02F6CA6F
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_02F6CA6F mov eax, dword ptr fs:[00000030h]	2_2_02F6CA6F
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_02FDEA60 mov eax, dword ptr fs:[00000030h]	2_2_02FDEA60
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_02F36A50 mov eax, dword ptr fs:[00000030h]	2_2_02F36A50
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_02F36A50 mov eax, dword ptr fs:[00000030h]	2_2_02F36A50
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_02F36A50 mov eax, dword ptr fs:[00000030h]	2_2_02F36A50
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_02F36A50 mov eax, dword ptr fs:[00000030h]	2_2_02F36A50
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_02F36A50 mov eax, dword ptr fs:[00000030h]	2_2_02F36A50
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_02F36A50 mov eax, dword ptr fs:[00000030h]	2_2_02F36A50
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_02F36A50 mov eax, dword ptr fs:[00000030h]	2_2_02F36A50
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_02F40A5B mov eax, dword ptr fs:[00000030h]	2_2_02F40A5B
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_02F40A5B mov eax, dword ptr fs:[00000030h]	2_2_02F40A5B
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_02F54A35 mov eax, dword ptr fs:[00000030h]	2_2_02F54A35
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_02F54A35 mov eax, dword ptr fs:[00000030h]	2_2_02F54A35
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_02F6CA38 mov eax, dword ptr fs:[00000030h]	2_2_02F6CA38
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_02F6CA24 mov eax, dword ptr fs:[00000030h]	2_2_02F6CA24
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_02F5EA2E mov eax, dword ptr fs:[00000030h]	2_2_02F5EA2E
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_02FBCA11 mov eax, dword ptr fs:[00000030h]	2_2_02FBCA11
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_02F38BF0 mov eax, dword ptr fs:[00000030h]	2_2_02F38BF0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_02F38BF0 mov eax, dword ptr fs:[00000030h]	2_2_02F38BF0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_02F38BF0 mov eax, dword ptr fs:[00000030h]	2_2_02F38BF0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_02F5EBFC mov eax, dword ptr fs:[00000030h]	2_2_02F5EBFC
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_02FBCBF0 mov eax, dword ptr fs:[00000030h]	2_2_02FBCBF0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_02FDEBD0 mov eax, dword ptr fs:[00000030h]	2_2_02FDEBD0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_02F50BCB mov eax, dword ptr fs:[00000030h]	2_2_02F50BCB
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_02F50BCB mov eax, dword ptr fs:[00000030h]	2_2_02F50BCB
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_02F50BCB mov eax, dword ptr fs:[00000030h]	2_2_02F50BCB
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_02F30BCD mov eax, dword ptr fs:[00000030h]	2_2_02F30BCD
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_02F30BCD mov eax, dword ptr fs:[00000030h]	2_2_02F30BCD
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_02F30BCD mov eax, dword ptr fs:[00000030h]	2_2_02F30BCD
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_02F40BBE mov eax, dword ptr fs:[00000030h]	2_2_02F40BBE
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_02F40BBE mov eax, dword ptr fs:[00000030h]	2_2_02F40BBE
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_02FE4BB0 mov eax, dword ptr fs:[00000030h]	2_2_02FE4BB0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_02FE4BB0 mov eax, dword ptr fs:[00000030h]	2_2_02FE4BB0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03004A80 mov eax, dword ptr fs:[00000030h]	2_2_03004A80
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_02F2CB7E mov eax, dword ptr fs:[00000030h]	2_2_02F2CB7E
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_02F28B50 mov eax, dword ptr fs:[00000030h]	2_2_02F28B50
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_02FDEB50 mov eax, dword ptr fs:[00000030h]	2_2_02FDEB50
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_02FE4B4B mov eax, dword ptr fs:[00000030h]	2_2_02FE4B4B
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_02FE4B4B mov eax, dword ptr fs:[00000030h]	2_2_02FE4B4B
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_02FC6B40 mov eax, dword ptr fs:[00000030h]	2_2_02FC6B40
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_02FC6B40 mov eax, dword ptr fs:[00000030h]	2_2_02FC6B40
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_02FFAB40 mov eax, dword ptr fs:[00000030h]	2_2_02FFAB40
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_02FD8B42 mov eax, dword ptr fs:[00000030h]	2_2_02FD8B42
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_02F5EB20 mov eax, dword ptr fs:[00000030h]	2_2_02F5EB20
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_02F5EB20 mov eax, dword ptr fs:[00000030h]	2_2_02F5EB20
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_02FF8B28 mov eax, dword ptr fs:[00000030h]	2_2_02FF8B28
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_02FF8B28 mov eax, dword ptr fs:[00000030h]	2_2_02FF8B28
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_02FAEB1D mov eax, dword ptr fs:[00000030h]	2_2_02FAEB1D
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_02FAEB1D mov eax, dword ptr fs:[00000030h]	2_2_02FAEB1D
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_02FAEB1D mov eax, dword ptr fs:[00000030h]	2_2_02FAEB1D
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_02FAEB1D mov eax, dword ptr fs:[00000030h]	2_2_02FAEB1D
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_02FAEB1D mov eax, dword ptr fs:[00000030h]	2_2_02FAEB1D
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_02FAEB1D mov eax, dword ptr fs:[00000030h]	2_2_02FAEB1D
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_02FAEB1D mov eax, dword ptr fs:[00000030h]	2_2_02FAEB1D
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_02FAEB1D mov eax, dword ptr fs:[00000030h]	2_2_02FAEB1D
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_02FAEB1D mov eax, dword ptr fs:[00000030h]	2_2_02FAEB1D
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_02F6C8F9 mov eax, dword ptr fs:[00000030h]	2_2_02F6C8F9
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_02F6C8F9 mov eax, dword ptr fs:[00000030h]	2_2_02F6C8F9
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_02FFA8E4 mov eax, dword ptr fs:[00000030h]	2_2_02FFA8E4
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_02F5E8C0 mov eax, dword ptr fs:[00000030h]	2_2_02F5E8C0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03004940 mov eax, dword ptr fs:[00000030h]	2_2_03004940
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_02FBC89D mov eax, dword ptr fs:[00000030h]	2_2_02FBC89D
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_02F30887 mov eax, dword ptr fs:[00000030h]	2_2_02F30887
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_02FBE872 mov eax, dword ptr fs:[00000030h]	2_2_02FBE872
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_02FBE872 mov eax, dword ptr fs:[00000030h]	2_2_02FBE872
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_02FC6870 mov eax, dword ptr fs:[00000030h]	2_2_02FC6870
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_02FC6870 mov eax, dword ptr fs:[00000030h]	2_2_02FC6870
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_02F60854 mov eax, dword ptr fs:[00000030h]	2_2_02F60854
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_02F34859 mov eax, dword ptr fs:[00000030h]	2_2_02F34859
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_02F34859 mov eax, dword ptr fs:[00000030h]	2_2_02F34859
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_02F42840 mov ecx, dword ptr fs:[00000030h]	2_2_02F42840
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_02F52835 mov eax, dword ptr fs:[00000030h]	2_2_02F52835
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_02F52835 mov eax, dword ptr fs:[00000030h]	2_2_02F52835
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_02F52835 mov eax, dword ptr fs:[00000030h]	2_2_02F52835
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_02F52835 mov ecx, dword ptr fs:[00000030h]	2_2_02F52835
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_02F52835 mov eax, dword ptr fs:[00000030h]	2_2_02F52835
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_02F52835 mov eax, dword ptr fs:[00000030h]	2_2_02F52835
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_02F6A830 mov eax, dword ptr fs:[00000030h]	2_2_02F6A830
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_02FD483A mov eax, dword ptr fs:[00000030h]	2_2_02FD483A
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_02FD483A mov eax, dword ptr fs:[00000030h]	2_2_02FD483A
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_02FBC810 mov eax, dword ptr fs:[00000030h]	2_2_02FBC810
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_02F629F9 mov eax, dword ptr fs:[00000030h]	2_2_02F629F9
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_02F629F9 mov eax, dword ptr fs:[00000030h]	2_2_02F629F9
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_02FBE9E0 mov eax, dword ptr fs:[00000030h]	2_2_02FBE9E0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_02F3A9D0 mov eax, dword ptr fs:[00000030h]	2_2_02F3A9D0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_02F3A9D0 mov eax, dword ptr fs:[00000030h]	2_2_02F3A9D0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_02F3A9D0 mov eax, dword ptr fs:[00000030h]	2_2_02F3A9D0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_02F3A9D0 mov eax, dword ptr fs:[00000030h]	2_2_02F3A9D0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_02F3A9D0 mov eax, dword ptr fs:[00000030h]	2_2_02F3A9D0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_02F3A9D0 mov eax, dword ptr fs:[00000030h]	2_2_02F3A9D0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_02F649D0 mov eax, dword ptr fs:[00000030h]	2_2_02F649D0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_02FFA9D3 mov eax, dword ptr fs:[00000030h]	2_2_02FFA9D3
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_02FC69C0 mov eax, dword ptr fs:[00000030h]	2_2_02FC69C0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_02FB89B3 mov esi, dword ptr fs:[00000030h]	2_2_02FB89B3
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_02FB89B3 mov eax, dword ptr fs:[00000030h]	2_2_02FB89B3
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_02FB89B3 mov eax, dword ptr fs:[00000030h]	2_2_02FB89B3
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_02F429A0 mov eax, dword ptr fs:[00000030h]	2_2_02F429A0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_02F429A0 mov eax, dword ptr fs:[00000030h]	2_2_02F429A0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_02F429A0 mov eax, dword ptr fs:[00000030h]	2_2_02F429A0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_02F429A0 mov eax, dword ptr fs:[00000030h]	2_2_02F429A0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_02F429A0 mov eax, dword ptr fs:[00000030h]	2_2_02F429A0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_02F429A0 mov eax, dword ptr fs:[00000030h]	2_2_02F429A0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_02F429A0 mov eax, dword ptr fs:[00000030h]	2_2_02F429A0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_02F429A0 mov eax, dword ptr fs:[00000030h]	2_2_02F429A0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_02F429A0 mov eax, dword ptr fs:[00000030h]	2_2_02F429A0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_02F429A0 mov eax, dword ptr fs:[00000030h]	2_2_02F429A0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_02F429A0 mov eax, dword ptr fs:[00000030h]	2_2_02F429A0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_02F429A0 mov eax, dword ptr fs:[00000030h]	2_2_02F429A0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_02F429A0 mov eax, dword ptr fs:[00000030h]	2_2_02F429A0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_02F309AD mov eax, dword ptr fs:[00000030h]	2_2_02F309AD
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_02F309AD mov eax, dword ptr fs:[00000030h]	2_2_02F309AD
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_02FD4978 mov eax, dword ptr fs:[00000030h]	2_2_02FD4978
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_02FD4978 mov eax, dword ptr fs:[00000030h]	2_2_02FD4978
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_02FBC97C mov eax, dword ptr fs:[00000030h]	2_2_02FBC97C
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_02F56962 mov eax, dword ptr fs:[00000030h]	2_2_02F56962
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_02F56962 mov eax, dword ptr fs:[00000030h]	2_2_02F56962
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_02F56962 mov eax, dword ptr fs:[00000030h]	2_2_02F56962

Source: C:\Users\user\Desktop\New Quotation - FE7191PO154.exe

Code function: 0_2_00E081F7 GetSecurityDescriptorDacl,_memset,GetAclInformation,GetLengthSid,GetAce,AddAce,GetLengthSid,GetProcessHeap,HeapAlloc,GetLengthSid,CopySid,AddAce,SetSecurityDescriptorDacl,SetUserObjectSecurity,

0_2_00E081F7

Source: C:\Users\user\Desktop\New Quotation - FE7191PO154.exe	Code function: 0_2_00DDA395 SetUnhandledExceptionFilter,UnhandledExceptionFilter,		0_2_00DDA395
Source: C:\Users\user\Desktop\New Quotation - FE7191PO154.exe	Code function: 0_2_00DDA364 SetUnhandledExceptionFilter,		0_2_00DDA364

HIPS / PFW / Operating System Protection Evasion

Maps a DLL or memory area into another process

Source: C:\Users\user\Desktop\New Quotation - FE7191PO154.exe

Section loaded: NULL target: C:\Windows\SysWOW64\svchost.exe protection: execute and read and write

Jump to behavior

Writes to foreign memory regions

Source: C:\Users\user\Desktop\New Quotation - FE7191PO154.exe

Memory written: C:\Windows\SysWOW64\svchost.exe base: 393008

Jump to behavior

Source: C:\Users\user\Desktop\New Quotation - FE7191PO154.exe

Code function: 0_2_00E08C93 LogonUserW,

0_2_00E08C93

Source: C:\Users\user\Desktop\New Quotation - FE7191PO154.exe

Code function: 0_2_00DB3B4C GetCurrentDirectoryW,IsDebuggerPresent,GetFullPathNameW,SetCurrentDirectoryW,MessageBoxA,SetCurrentDirectoryW,GetForegroundWindow,ShellExecuteW,

0_2_00DB3B4C

Source: C:\Users\user\Desktop\New Quotation - FE7191PO154.exe

Code function: 0_2_00DB4A35 GetForegroundWindow,FindWindowW,IsIconic,ShowWindow,SetForegroundWindow,GetWindowThreadProcessId,GetWindowThreadProcessId,GetCurrentThreadId,GetWindowThreadProcessId,AttachThreadInput,AttachThreadInput,AttachThreadInput,AttachThreadInput,SetForegroundWindow,MapVirtualKeyW,MapVirtualKeyW,keybd_event,keybd_event,MapVirtualKeyW,keybd_event,MapVirtualKeyW,keybd_event,MapVirtualKeyW,keybd_event,SetForegroundWindow,AttachThreadInput,AttachThreadInput,AttachThreadInput,AttachThreadInput,

0_2_00DB4A35

Source: C:\Users\user\Desktop\New Quotation - FE7191PO154.exe

Code function: 0_2_00E14EF5 mouse_event,

0_2_00E14EF5

Source: C:\Users\user\Desktop\New Quotation - FE7191PO154.exe

Process created: C:\Windows\SysWOW64\svchost.exe "C:\Users\user\Desktop\New Quotation - FE7191PO154.exe"

Jump to behavior

Source: C:\Users\user\Desktop\New Quotation - FE7191PO154.exe

0_2_00E081F7

Source: C:\Users\user\Desktop\New Quotation - FE7191PO154.exe

Code function: 0_2_00E14C03 AllocateAndInitializeSid,CheckTokenMembership,FreeSid,

0_2_00E14C03

Source: New Quotation - FE7191PO154.exe	Binary or memory string: Run Script:AutoIt script files (.au3, .a3x).au3;.a3xAll files (.).au3#include depth exceeded. Make sure there are no recursive includesError opening the file>>>AUTOIT SCRIPT<<<Bad directive syntax errorUnterminated stringCannot parse #includeUnterminated group of commentsONOFF0%d%dShell_TrayWndREMOVEKEYSEXISTSAPPENDblankinfoquestionstopwarning
Source: New Quotation - FE7191PO154.exe	Binary or memory string: Shell_TrayWnd

Source: C:\Users\user\Desktop\New Quotation - FE7191PO154.exe

Code function: 0_2_00DD886B cpuid

0_2_00DD886B

Source: C:\Users\user\Desktop\New Quotation - FE7191PO154.exe

Code function: 0_2_00DE50D7 GetSystemTimeAsFileTime,GetCurrentThreadId,GetCurrentProcessId,QueryPerformanceCounter,

0_2_00DE50D7

Source: C:\Users\user\Desktop\New Quotation - FE7191PO154.exe

Code function: 0_2_00DF2230 GetUserNameW,

0_2_00DF2230

Source: C:\Users\user\Desktop\New Quotation - FE7191PO154.exe

Code function: 0_2_00DE418A __lock,____lc_codepage_func,__getenv_helper_nolock,_free,_strlen,__malloc_crt,_strlen,__invoke_watson,_free,GetTimeZoneInformation,WideCharToMultiByte,WideCharToMultiByte,

0_2_00DE418A

Source: C:\Users\user\Desktop\New Quotation - FE7191PO154.exe

Code function: 0_2_00DB4AFE GetVersionExW,GetCurrentProcess,IsWow64Process,GetNativeSystemInfo,FreeLibrary,GetSystemInfo,GetSystemInfo,

0_2_00DB4AFE

Stealing of Sensitive Information

Yara detected FormBook

Source: Yara match	File source: 2.2.svchost.exe.470000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 2.2.svchost.exe.470000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000002.00000002.2581820388.0000000000470000.00000040.80000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000002.00000002.2582022123.0000000002CC0000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY

Source: New Quotation - FE7191PO154.exe	Binary or memory string: WIN_81
Source: New Quotation - FE7191PO154.exe	Binary or memory string: WIN_XP
Source: New Quotation - FE7191PO154.exe	Binary or memory string: WIN_XPe
Source: New Quotation - FE7191PO154.exe	Binary or memory string: WIN_VISTA
Source: New Quotation - FE7191PO154.exe	Binary or memory string: WIN_7
Source: New Quotation - FE7191PO154.exe	Binary or memory string: WIN_8
Source: New Quotation - FE7191PO154.exe	Binary or memory string: %.3d%S%M%H%m%Y%jX86IA64X64WIN32_NTWIN_10WIN_2016WIN_81WIN_2012R2WIN_2012WIN_8WIN_2008R2WIN_7WIN_2008WIN_VISTAWIN_2003WIN_XPeWIN_XPInstallLanguageSYSTEM\CurrentControlSet\Control\Nls\LanguageSchemeLangIDControl Panel\Appearance3, 3, 14, 5USERPROFILEUSERDOMAINUSERDNSDOMAINGetSystemWow64DirectoryWSeDebugPrivilege:winapistdcallubyte

Remote Access Functionality

Yara detected FormBook

Source: Yara match	File source: 2.2.svchost.exe.470000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 2.2.svchost.exe.470000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000002.00000002.2581820388.0000000000470000.00000040.80000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000002.00000002.2582022123.0000000002CC0000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY

Source: C:\Users\user\Desktop\New Quotation - FE7191PO154.exe	Code function: 0_2_00E26596 socket,WSAGetLastError,bind,listen,WSAGetLastError,closesocket,		0_2_00E26596
Source: C:\Users\user\Desktop\New Quotation - FE7191PO154.exe	Code function: 0_2_00E26A5A socket,WSAGetLastError,bind,WSAGetLastError,closesocket,		0_2_00E26A5A

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	Acquire Infrastructure	2 Valid Accounts	2 Native API	2 Valid Accounts	2 Valid Accounts	2 Valid Accounts	21 Input Capture	2 System Time Discovery	Remote Services	21 Input Capture	1 Encrypted Channel	Exfiltration Over Other Network Medium	1 System Shutdown/Reboot
Credentials	Domains	Default Accounts	Scheduled Task/Job	1 DLL Side-Loading	1 Exploitation for Privilege Escalation	1 Disable or Modify Tools	LSASS Memory	15 Security Software Discovery	Remote Desktop Protocol	1 Archive Collected Data	1 Ingress Tool Transfer	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	At	Logon Script (Windows)	21 Access Token Manipulation	2 Virtualization/Sandbox Evasion	Security Account Manager	2 Virtualization/Sandbox Evasion	SMB/Windows Admin Shares	3 Clipboard Data	Steganography	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	Cron	Login Hook	212 Process Injection	21 Access Token Manipulation	NTDS	3 Process Discovery	Distributed Component Object Model	Input Capture	Protocol Impersonation	Traffic Duplication	Data Destruction
Gather Victim Network Information	Server	Cloud Accounts	Launchd	Network Logon Script	1 DLL Side-Loading	212 Process Injection	LSA Secrets	1 Application Window Discovery	SSH	Keylogging	Fallback Channels	Scheduled Transfer	Data Encrypted for Impact
Domain Properties	Botnet	Replication Through Removable Media	Scheduled Task	RC Scripts	RC Scripts	1 Deobfuscate/Decode Files or Information	Cached Domain Credentials	1 Account Discovery	VNC	GUI Input Capture	Multiband Communication	Data Transfer Size Limits	Service Stop
DNS	Web Services	External Remote Services	Systemd Timers	Startup Items	Startup Items	2 Obfuscated Files or Information	DCSync	1 System Owner/User Discovery	Windows Remote Management	Web Portal Capture	Commonly Used Port	Exfiltration Over C2 Channel	Inhibit System Recovery
Network Trust Dependencies	Serverless	Drive-by Compromise	Container Orchestration Job	Scheduled Task/Job	Scheduled Task/Job	1 DLL Side-Loading	Proc Filesystem	1 File and Directory Discovery	Cloud Services	Credential API Hooking	Application Layer Protocol	Exfiltration Over Alternative Protocol	Defacement
Network Topology	Malvertising	Exploit Public-Facing Application	Command and Scripting Interpreter	At	At	HTML Smuggling	/etc/passwd and /etc/shadow	115 System Information Discovery	Direct Cloud VM Connections	Data Staged	Web Protocols	Exfiltration Over Symmetric Encrypted Non-C2 Protocol	Internal Defacement

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Source	Detection	Scanner	Label	Link
New Quotation - FE7191PO154.exe	50%	ReversingLabs	Win32.Trojan.Strab
New Quotation - FE7191PO154.exe	100%	Joe Sandbox ML

Joe Sandbox version:	40.0.0 Tourmaline
Analysis ID:	1467842
Start date and time:	2024-07-04 21:43:13 +02:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 6m 53s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Run name:	Run with higher sleep bypass
Number of analysed new started processes analysed:	8
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Sample name:	New Quotation - FE7191PO154.exe
Detection:	MAL
Classification:	mal92.troj.evad.winEXE@3/4@0/0
EGA Information:	Successful, ratio: 100%
HCA Information:	Successful, ratio: 98% Number of executed functions: 59 Number of non-executed functions: 271
Cookbook Comments:	Found application associated with file extension: .exe Sleeps bigger than 100000000ms are automatically reduced to 1000ms

Warnings

Exclude process from analysis (whitelisted): dllhost.exe, WMIADAP.exe, SIHClient.exe, svchost.exe
Excluded domains from analysis (whitelisted): client.wns.windows.com, ocsp.digicert.com, slscr.update.microsoft.com, ctldl.windowsupdate.com, fe3cr.delivery.mp.microsoft.com
Report size exceeded maximum capacity and may have missing disassembly code.
VT rate limit hit for: New Quotation - FE7191PO154.exe

Process:	C:\Users\user\Desktop\New Quotation - FE7191PO154.exe
File Type:	data
Category:	dropped
Size (bytes):	270848
Entropy (8bit):	7.992931146075326
Encrypted:	true
SSDEEP:	6144:6SsT7GYfpZCCkO1qrptykwpHXJ1pOLzXCEra+wYDs3j88oxyOP8k:tY7GYfp8gqrpoXROLOwaXeIk
MD5:	6417747445BC858FBF9BD204C824AD00
SHA1:	EC17DEDFECA8EF363D1285F5C2416FD5C3CBC7BB
SHA-256:	CEB41F7016A5B596FDE72F9CD032707A7E0D9D6A7E9BB890E493F340057660B5
SHA-512:	BF3DFE6F149783035F2F0269C99F0EA5F0C1233D7226CCFB896F0D03E5239AFEC4CCE3F6F4A69F5F6DADCB6E020C3756C9DF03ECBAC4BCCD8796B97EADCAA59B
Malicious:	false
Reputation:	low
Preview:	...b.3YGU...Y....3Z...LX...C0S3YGUZ6OPTOLC0S3YGUZ6OPTOLC0.3YG[E.AP.F.b.R..f.2_<p$=#$B2^y$44X $t-)cB&]y.;zr..t"#'U}>TMqZ6OPTOL:1Z.d'2../7.r,$.I..o:Q.J...P4.C..../7..% XnS>.UZ6OPTOL.uS3.FTZ6M.5OLC0S3YG.Z4N[UDLC W3YGUZ6OPT._C0S#YGUz2OPT.LC S3YEUZ0OPTOLC0U3YGUZ6OPtKLC2S3YGUZ4O..OLS0S#YGUZ&OPDOLC0S3IGUZ6OPTOLC0S3YGUZ6OPTOLC0S3YGUZ6OPTOLC0S3YGUZ6OPTOLC0S3YGUZ6OPTOLC0S3YGUZ6OPTOLC0S3YGUZ6OPTOLC0S3YGUZ6OPTOLC0S3YGUZ6OPTOLC0S3YGUZ6O~ *470S3.IQZ6_PTO\G0S#YGUZ6OPTOLC0S3yGU:6OPTOLC0S3YGUZ6OPTOLC0S3YGUZ6OPTOLC0S3YGUZ6OPTOLC0S3YGUZ6OPTOLC0S3YGUZ6OPTOLC0S3YGUZ6OPTOLC0S3YGUZ6OPTOLC0S3YGUZ6OPTOLC0S3YGUZ6OPTOLC0S3YGUZ6OPTOLC0S3YGUZ6OPTOLC0S3YGUZ6OPTOLC0S3YGUZ6OPTOLC0S3YGUZ6OPTOLC0S3YGUZ6OPTOLC0S3YGUZ6OPTOLC0S3YGUZ6OPTOLC0S3YGUZ6OPTOLC0S3YGUZ6OPTOLC0S3YGUZ6OPTOLC0S3YGUZ6OPTOLC0S3YGUZ6OPTOLC0S3YGUZ6OPTOLC0S3YGUZ6OPTOLC0S3YGUZ6OPTOLC0S3YGUZ6OPTOLC0S3YGUZ6OPTOLC0S3YGUZ6OPTOLC0S3YGUZ6OPTOLC0S3YGUZ6OPTOLC0S3YGUZ6OPTOLC0S3YGUZ6OPTOLC0S3YGUZ6OPTOLC0S3YGUZ6OPTOLC0S3YGUZ6OPTOLC0S3YGUZ6OPTOLC0S3YGUZ6OPTOLC0S3

C:\Users\user\AppData\Local\Temp\aut10E0.tmp

Download File

Process:	C:\Users\user\Desktop\New Quotation - FE7191PO154.exe
File Type:	data
Category:	dropped
Size (bytes):	9826
Entropy (8bit):	7.595089588495937
Encrypted:	false
SSDEEP:	192:65jwEiqiSLLhK6mXmHAMo0XrFZbHuAAAGVp200bAsmIr+C3VfebKfAIEev+3pCj7:I6qin6OZ70XrFZbsp200csmIr+C3gbmb
MD5:	958A965896D1772DACD23BD36F1585DF
SHA1:	3A52A92A2514F9B8383E08694D9A136CB09C5CCB
SHA-256:	BE6F4489EEC42717CAC963F68D65DC9352E923C20EF4901B915B2BC7EA1AEDE8
SHA-512:	D30AA929195A8ADD7F0C24FD7A3466A3E357168DCA4FCADE75005DC0BF83616DD268D94787ECD684C6B2C9B666846BAB5463DCCD40507852BB6650D66C940173
Malicious:	false
Reputation:	low
Preview:	EA06..pT.Q&...8.M.z,.D.Lf....y9......o3.N&T...5...j..m1..f.Y..cD.L'.....3.N(s...m9...s.5..8.L/.Y...e..&6[...0.L..I..k7.N&. ..a0.M.....q4.Nf.P.....K..d.%...p.lY@.......c.Xf.0.o..b.L.`...,@. ...3+..d....s4.l&..........\|....sa...`.........Y&.K0.....-vs5.M..2...N&.I...@.>..........$.0...fx. ..$l...I...#..$6...... ..... .Z...a.5..&.).....L.j.;$....M.j.;$....X@j.;%....Y@j.;,.....j.e.\|f #^...j......l.....l.5....>0..Xf....M.^....$zn.....G..I....C...M.\|........}S{....7...\| l..P..........0...`>;..c7.6..{......=..7..............6,......b...,S ...i5.M.4.b..i\|v)....b.h.,@..%........9....c...\|3Y..h......._......@.>K...,v[..q5.M,.@..i7.X......9....2.......,.`....3.,.i8........}.k(.f..@..M&V....7.,.x....&.......0.......Fh...Fb.....3.."a9...`....,vb.....cd.X..P.Fl.Y.$..c. ....I...d..f.!...,vd......8..P.......0.....2...y...D.......c.0.......b.<NA...NM..;4.X.q1..&@Q..B.Y.ah......Yl.i..."..Bvj.........ic..'3Y..'f.....,j.1........C.`....7b.., .p..T.......Y,Vi......@

C:\Users\user\AppData\Local\Temp\derogates

Download File

Process:	C:\Users\user\Desktop\New Quotation - FE7191PO154.exe
File Type:	ASCII text, with very long lines (28756), with no line terminators
Category:	dropped
Size (bytes):	28756
Entropy (8bit):	3.5919091749017946
Encrypted:	false
SSDEEP:	768:miTZ+2QoioGRk6ZklputwjpjBkCiw2RuJ3nXKUrvzjsNbCO+IFh6q84vfF3if6gZ:miTZ+2QoioGRk6ZklputwjpjBkCiw2RG
MD5:	CF204ECCC6E01B0BC79FAD4C51B0D33B
SHA1:	18A40B98F2356C7CC85074E825114116BBFA1100
SHA-256:	5342B804D95791B480BC59490287E480C67181F208D24CB2FDAC982B92D619E3
SHA-512:	2D5832E1EF9D67C16B49B71BE2F42BBA1E17784904B0DFD26A92AEEE6A97CFAC738005E4CA147BEFF718DECC30B035E4D8C30C0FC80479A93A7AB211B68C26DF
Malicious:	false
Reputation:	low
Preview:	8D6804F867D7E3ED21599F86932DA5673082A29A59B06B261C54E6F1DF089BBB368C973697738FDC880x558bec81eccc0200005657b86b00000066894584b96500000066894d86ba7200000066895588b86e0000006689458ab96500000066894d8cba6c0000006689558eb83300000066894590b93200000066894d92ba2e00000066895594b86400000066894596b96c00000066894d98ba6c0000006689559a33c06689459cb96e00000066898d44ffffffba7400000066899546ffffffb86400000066898548ffffffb96c00000066898d4affffffba6c0000006689954cffffffb82e0000006689854effffffb96400000066898d50ffffffba6c00000066899552ffffffb86c00000066898554ffffff33c966898d56ffffffba75000000668955d0b873000000668945d2b96500000066894dd4ba72000000668955d6b833000000668945d8b93200000066894ddaba2e000000668955dcb864000000668945deb96c00000066894de0ba6c000000668955e233c0668945e4b96100000066898d68ffffffba640000006689956affffffb8760000006689856cffffffb96100000066898d6effffffba7000000066899570ffffffb86900000066898572ffffffb93300000066898d74ffffffba3200000066899576ffffffb82e00000066898578ffffffb96400000066898d7affffff

C:\Users\user\AppData\Local\Temp\nonagglutinant

Download File

Process:	C:\Users\user\Desktop\New Quotation - FE7191PO154.exe
File Type:	data
Category:	dropped
Size (bytes):	270848
Entropy (8bit):	7.992931146075326
Encrypted:	true
SSDEEP:	6144:6SsT7GYfpZCCkO1qrptykwpHXJ1pOLzXCEra+wYDs3j88oxyOP8k:tY7GYfp8gqrpoXROLOwaXeIk
MD5:	6417747445BC858FBF9BD204C824AD00
SHA1:	EC17DEDFECA8EF363D1285F5C2416FD5C3CBC7BB
SHA-256:	CEB41F7016A5B596FDE72F9CD032707A7E0D9D6A7E9BB890E493F340057660B5
SHA-512:	BF3DFE6F149783035F2F0269C99F0EA5F0C1233D7226CCFB896F0D03E5239AFEC4CCE3F6F4A69F5F6DADCB6E020C3756C9DF03ECBAC4BCCD8796B97EADCAA59B
Malicious:	false
Reputation:	low
Preview:	...b.3YGU...Y....3Z...LX...C0S3YGUZ6OPTOLC0S3YGUZ6OPTOLC0.3YG[E.AP.F.b.R..f.2_<p$=#$B2^y$44X $t-)cB&]y.;zr..t"#'U}>TMqZ6OPTOL:1Z.d'2../7.r,$.I..o:Q.J...P4.C..../7..% XnS>.UZ6OPTOL.uS3.FTZ6M.5OLC0S3YG.Z4N[UDLC W3YGUZ6OPT._C0S#YGUz2OPT.LC S3YEUZ0OPTOLC0U3YGUZ6OPtKLC2S3YGUZ4O..OLS0S#YGUZ&OPDOLC0S3IGUZ6OPTOLC0S3YGUZ6OPTOLC0S3YGUZ6OPTOLC0S3YGUZ6OPTOLC0S3YGUZ6OPTOLC0S3YGUZ6OPTOLC0S3YGUZ6OPTOLC0S3YGUZ6OPTOLC0S3YGUZ6OPTOLC0S3YGUZ6O~ *470S3.IQZ6_PTO\G0S#YGUZ6OPTOLC0S3yGU:6OPTOLC0S3YGUZ6OPTOLC0S3YGUZ6OPTOLC0S3YGUZ6OPTOLC0S3YGUZ6OPTOLC0S3YGUZ6OPTOLC0S3YGUZ6OPTOLC0S3YGUZ6OPTOLC0S3YGUZ6OPTOLC0S3YGUZ6OPTOLC0S3YGUZ6OPTOLC0S3YGUZ6OPTOLC0S3YGUZ6OPTOLC0S3YGUZ6OPTOLC0S3YGUZ6OPTOLC0S3YGUZ6OPTOLC0S3YGUZ6OPTOLC0S3YGUZ6OPTOLC0S3YGUZ6OPTOLC0S3YGUZ6OPTOLC0S3YGUZ6OPTOLC0S3YGUZ6OPTOLC0S3YGUZ6OPTOLC0S3YGUZ6OPTOLC0S3YGUZ6OPTOLC0S3YGUZ6OPTOLC0S3YGUZ6OPTOLC0S3YGUZ6OPTOLC0S3YGUZ6OPTOLC0S3YGUZ6OPTOLC0S3YGUZ6OPTOLC0S3YGUZ6OPTOLC0S3YGUZ6OPTOLC0S3YGUZ6OPTOLC0S3YGUZ6OPTOLC0S3YGUZ6OPTOLC0S3YGUZ6OPTOLC0S3YGUZ6OPTOLC0S3

Static File Info

General

File type:	PE32 executable (GUI) Intel 80386, for MS Windows
Entropy (8bit):	7.123899764764069
TrID:	Win32 Executable (generic) a (10002005/4) 99.96% Generic Win/DOS Executable (2004/3) 0.02% DOS Executable Generic (2002/1) 0.02% Autodesk FLIC Image File (extensions: flc, fli, cel) (7/3) 0.00%
File name:	New Quotation - FE7191PO154.exe
File size:	1'173'504 bytes
MD5:	494d46b06be2512d5224dcbb309cc9c8
SHA1:	8b2ff6a1c15a9b0e0f1700d449040d6177ed0456
SHA256:	a9d81d4d219333b4aae2743cb1b2ddb1f13c6182c773bae002ad26db214a054a
SHA512:	80a2c2466845f59d311efe7cea463f219062d08f542e2de1f796e181bbd9826b4fd46cb5ff769e6cf9b6cd7ec7a0e8a5413b6d12e19a21dc268b81da38aaa67d
SSDEEP:	24576:FAHnh+eWsN3skA4RV1Hom2KXMmHa7tlktThsYldX5:0h+ZkldoPK8Ya7/kx/l7
TLSH:	8045BE0273D2C036FFAB92739B6AF20556BC79254123852F13981DB9BD701B2277E663
File Content Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........s..R...R...R....C..P.....;.S..._@#.a..._@......_@..g...[j..[...[jo.w...R...r.............#.S..._@'.S...R.k.S.....".S...RichR..

File Icon


Icon Hash:	aaf3e3e3938382a0

Static PE Info

General

Entrypoint:	0x42800a
Entrypoint Section:	.text
Digitally signed:	false
Imagebase:	0x400000
Subsystem:	windows gui
Image File Characteristics:	EXECUTABLE_IMAGE, LARGE_ADDRESS_AWARE, 32BIT_MACHINE
DLL Characteristics:	DYNAMIC_BASE, TERMINAL_SERVER_AWARE
Time Stamp:	0x6685F3F0 [Thu Jul 4 00:59:28 2024 UTC]
TLS Callbacks:
CLR (.Net) Version:
OS Version Major:	5
OS Version Minor:	1
File Version Major:	5
File Version Minor:	1
Subsystem Version Major:	5
Subsystem Version Minor:	1
Import Hash:	afcdf79be1557326c854b6e20cb900a7

Entrypoint Preview

Instruction
call 00007F122CC5E5CDh
jmp 00007F122CC51384h
int3
int3
int3
int3
int3
int3
int3
int3
int3
int3
int3
int3
push edi
push esi
mov esi, dword ptr [esp+10h]
mov ecx, dword ptr [esp+14h]
mov edi, dword ptr [esp+0Ch]
mov eax, ecx
mov edx, ecx
add eax, esi
cmp edi, esi
jbe 00007F122CC5150Ah
cmp edi, eax
jc 00007F122CC5186Eh
bt dword ptr [004C41FCh], 01h
jnc 00007F122CC51509h
rep movsb
jmp 00007F122CC5181Ch
cmp ecx, 00000080h
jc 00007F122CC516D4h
mov eax, edi
xor eax, esi
test eax, 0000000Fh
jne 00007F122CC51510h
bt dword ptr [004BF324h], 01h
jc 00007F122CC519E0h
bt dword ptr [004C41FCh], 00000000h
jnc 00007F122CC516ADh
test edi, 00000003h
jne 00007F122CC516BEh
test esi, 00000003h
jne 00007F122CC5169Dh
bt edi, 02h
jnc 00007F122CC5150Fh
mov eax, dword ptr [esi]
sub ecx, 04h
lea esi, dword ptr [esi+04h]
mov dword ptr [edi], eax
lea edi, dword ptr [edi+04h]
bt edi, 03h
jnc 00007F122CC51513h
movq xmm1, qword ptr [esi]
sub ecx, 08h
lea esi, dword ptr [esi+08h]
movq qword ptr [edi], xmm1
lea edi, dword ptr [edi+08h]
test esi, 00000007h
je 00007F122CC51565h
bt esi, 03h

Rich Headers

Programming Language:

[ASM] VS2013 build 21005
[ C ] VS2013 build 21005
[C++] VS2013 build 21005
[ C ] VS2008 SP1 build 30729
[IMP] VS2008 SP1 build 30729
[ASM] VS2013 UPD5 build 40629
[RES] VS2013 build 21005
[LNK] VS2013 UPD5 build 40629

Data Directories

Name	Virtual Address	Virtual Size	Is in Section
IMAGE_DIRECTORY_ENTRY_EXPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IMPORT	0xbc0cc	0x17c	.rdata
IMAGE_DIRECTORY_ENTRY_RESOURCE	0xc8000	0x541a0	.rsrc
IMAGE_DIRECTORY_ENTRY_EXCEPTION	0x0	0x0
IMAGE_DIRECTORY_ENTRY_SECURITY	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BASERELOC	0x11d000	0x7134	.reloc
IMAGE_DIRECTORY_ENTRY_DEBUG	0x92bc0	0x1c	.rdata
IMAGE_DIRECTORY_ENTRY_COPYRIGHT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_GLOBALPTR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_TLS	0x0	0x0
IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG	0xa4b50	0x40	.rdata
IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IAT	0x8f000	0x884	.rdata
IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_RESERVED	0x0	0x0

Sections

Name	Virtual Address	Virtual Size	Raw Size	MD5	Xored PE	ZLIB Complexity	File Type	Entropy	Characteristics
.text	0x1000	0x8dfdd	0x8e000	310e36668512d53489c005622bb1b4a9	False	0.5735602580325704	data	6.675248351711057	IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
.rdata	0x8f000	0x2fd8e	0x2fe00	748cf1ab2605ce1fd72d53d912abb68f	False	0.32828818537859006	data	5.763244005758284	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.data	0xbf000	0x8f74	0x5200	aae9601d920f07080bdfadf43dfeff12	False	0.1017530487804878	data	1.1963819235530628	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.rsrc	0xc8000	0x541a0	0x54200	3d97934f0eb54532f0676f34a19ceff7	False	0.9221942329123328	data	7.881061150222204	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.reloc	0x11d000	0x7134	0x7200	f04128ad0f87f42830e4a6cdbc38c719	False	0.7617530153508771	data	6.783955557128661	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_READ

Resources

Name	RVA	Size	Type	Language	Country	ZLIB Complexity
RT_ICON	0xc85a8	0x128	Device independent bitmap graphic, 16 x 32 x 4, image size 192	English	Great Britain	0.7466216216216216
RT_ICON	0xc86d0	0x128	Device independent bitmap graphic, 16 x 32 x 4, image size 128, 16 important colors	English	Great Britain	0.3277027027027027
RT_ICON	0xc87f8	0x128	Device independent bitmap graphic, 16 x 32 x 4, image size 192	English	Great Britain	0.3885135135135135
RT_ICON	0xc8920	0x2e8	Device independent bitmap graphic, 32 x 64 x 4, image size 0	English	Great Britain	0.3333333333333333
RT_ICON	0xc8c08	0x128	Device independent bitmap graphic, 16 x 32 x 4, image size 0	English	Great Britain	0.5
RT_ICON	0xc8d30	0xea8	Device independent bitmap graphic, 48 x 96 x 8, image size 0	English	Great Britain	0.2835820895522388
RT_ICON	0xc9bd8	0x8a8	Device independent bitmap graphic, 32 x 64 x 8, image size 0	English	Great Britain	0.37906137184115524
RT_ICON	0xca480	0x568	Device independent bitmap graphic, 16 x 32 x 8, image size 0	English	Great Britain	0.23699421965317918
RT_ICON	0xca9e8	0x25a8	Device independent bitmap graphic, 48 x 96 x 32, image size 0	English	Great Britain	0.13858921161825727
RT_ICON	0xccf90	0x10a8	Device independent bitmap graphic, 32 x 64 x 32, image size 0	English	Great Britain	0.25070356472795496
RT_ICON	0xce038	0x468	Device independent bitmap graphic, 16 x 32 x 32, image size 0	English	Great Britain	0.3173758865248227
RT_MENU	0xce4a0	0x50	data	English	Great Britain	0.9
RT_STRING	0xce4f0	0x594	data	English	Great Britain	0.3333333333333333
RT_STRING	0xcea84	0x68a	data	English	Great Britain	0.2747909199522103
RT_STRING	0xcf110	0x490	data	English	Great Britain	0.3715753424657534
RT_STRING	0xcf5a0	0x5fc	data	English	Great Britain	0.3087467362924282
RT_STRING	0xcfb9c	0x65c	data	English	Great Britain	0.34336609336609336
RT_STRING	0xd01f8	0x466	data	English	Great Britain	0.3605683836589698
RT_STRING	0xd0660	0x158	Matlab v4 mat-file (little endian) n, numeric, rows 0, columns 0	English	Great Britain	0.502906976744186
RT_RCDATA	0xd07b8	0x4b468	data			1.0003275732336991
RT_GROUP_ICON	0x11bc20	0x76	data	English	Great Britain	0.6610169491525424
RT_GROUP_ICON	0x11bc98	0x14	data	English	Great Britain	1.25
RT_GROUP_ICON	0x11bcac	0x14	data	English	Great Britain	1.15
RT_GROUP_ICON	0x11bcc0	0x14	data	English	Great Britain	1.25
RT_VERSION	0x11bcd4	0xdc	data	English	Great Britain	0.6181818181818182
RT_MANIFEST	0x11bdb0	0x3ef	ASCII text, with CRLF line terminators	English	Great Britain	0.5074478649453823

Imports

DLL	Import
WSOCK32.dll	WSACleanup, socket, inet_ntoa, setsockopt, ntohs, recvfrom, ioctlsocket, htons, WSAStartup, __WSAFDIsSet, select, accept, listen, bind, closesocket, WSAGetLastError, recv, sendto, send, inet_addr, gethostbyname, gethostname, connect
VERSION.dll	GetFileVersionInfoW, GetFileVersionInfoSizeW, VerQueryValueW
WINMM.dll	timeGetTime, waveOutSetVolume, mciSendStringW
COMCTL32.dll	ImageList_ReplaceIcon, ImageList_Destroy, ImageList_Remove, ImageList_SetDragCursorImage, ImageList_BeginDrag, ImageList_DragEnter, ImageList_DragLeave, ImageList_EndDrag, ImageList_DragMove, InitCommonControlsEx, ImageList_Create
MPR.dll	WNetUseConnectionW, WNetCancelConnection2W, WNetGetConnectionW, WNetAddConnection2W
WININET.dll	InternetQueryDataAvailable, InternetCloseHandle, InternetOpenW, InternetSetOptionW, InternetCrackUrlW, HttpQueryInfoW, InternetQueryOptionW, HttpOpenRequestW, HttpSendRequestW, FtpOpenFileW, FtpGetFileSize, InternetOpenUrlW, InternetReadFile, InternetConnectW
PSAPI.DLL	GetProcessMemoryInfo
IPHLPAPI.DLL	IcmpCreateFile, IcmpCloseHandle, IcmpSendEcho
USERENV.dll	DestroyEnvironmentBlock, UnloadUserProfile, CreateEnvironmentBlock, LoadUserProfileW
UxTheme.dll	IsThemeActive
KERNEL32.dll	DuplicateHandle, CreateThread, WaitForSingleObject, HeapAlloc, GetProcessHeap, HeapFree, Sleep, GetCurrentThreadId, MultiByteToWideChar, MulDiv, GetVersionExW, IsWow64Process, GetSystemInfo, FreeLibrary, LoadLibraryA, GetProcAddress, SetErrorMode, GetModuleFileNameW, WideCharToMultiByte, lstrcpyW, lstrlenW, GetModuleHandleW, QueryPerformanceCounter, VirtualFreeEx, OpenProcess, VirtualAllocEx, WriteProcessMemory, ReadProcessMemory, CreateFileW, SetFilePointerEx, SetEndOfFile, ReadFile, WriteFile, FlushFileBuffers, TerminateProcess, CreateToolhelp32Snapshot, Process32FirstW, Process32NextW, SetFileTime, GetFileAttributesW, FindFirstFileW, SetCurrentDirectoryW, GetLongPathNameW, GetShortPathNameW, DeleteFileW, FindNextFileW, CopyFileExW, MoveFileW, CreateDirectoryW, RemoveDirectoryW, SetSystemPowerState, QueryPerformanceFrequency, FindResourceW, LoadResource, LockResource, SizeofResource, EnumResourceNamesW, OutputDebugStringW, GetTempPathW, GetTempFileNameW, DeviceIoControl, GetLocalTime, CompareStringW, GetCurrentProcess, EnterCriticalSection, LeaveCriticalSection, GetStdHandle, CreatePipe, InterlockedExchange, TerminateThread, LoadLibraryExW, FindResourceExW, CopyFileW, VirtualFree, FormatMessageW, GetExitCodeProcess, GetPrivateProfileStringW, WritePrivateProfileStringW, GetPrivateProfileSectionW, WritePrivateProfileSectionW, GetPrivateProfileSectionNamesW, FileTimeToLocalFileTime, FileTimeToSystemTime, SystemTimeToFileTime, LocalFileTimeToFileTime, GetDriveTypeW, GetDiskFreeSpaceExW, GetDiskFreeSpaceW, GetVolumeInformationW, SetVolumeLabelW, CreateHardLinkW, SetFileAttributesW, CreateEventW, SetEvent, GetEnvironmentVariableW, SetEnvironmentVariableW, GlobalLock, GlobalUnlock, GlobalAlloc, GetFileSize, GlobalFree, GlobalMemoryStatusEx, Beep, GetSystemDirectoryW, HeapReAlloc, HeapSize, GetComputerNameW, GetWindowsDirectoryW, GetCurrentProcessId, GetProcessIoCounters, CreateProcessW, GetProcessId, SetPriorityClass, LoadLibraryW, VirtualAlloc, IsDebuggerPresent, GetCurrentDirectoryW, lstrcmpiW, DecodePointer, GetLastError, RaiseException, InitializeCriticalSectionAndSpinCount, DeleteCriticalSection, InterlockedDecrement, InterlockedIncrement, GetCurrentThread, CloseHandle, GetFullPathNameW, EncodePointer, ExitProcess, GetModuleHandleExW, ExitThread, GetSystemTimeAsFileTime, ResumeThread, GetCommandLineW, IsProcessorFeaturePresent, IsValidCodePage, GetACP, GetOEMCP, GetCPInfo, SetLastError, UnhandledExceptionFilter, SetUnhandledExceptionFilter, TlsAlloc, TlsGetValue, TlsSetValue, TlsFree, GetStartupInfoW, GetStringTypeW, SetStdHandle, GetFileType, GetConsoleCP, GetConsoleMode, RtlUnwind, ReadConsoleW, GetTimeZoneInformation, GetDateFormatW, GetTimeFormatW, LCMapStringW, GetEnvironmentStringsW, FreeEnvironmentStringsW, WriteConsoleW, FindClose, SetEnvironmentVariableA
USER32.dll	AdjustWindowRectEx, CopyImage, SetWindowPos, GetCursorInfo, RegisterHotKey, ClientToScreen, GetKeyboardLayoutNameW, IsCharAlphaW, IsCharAlphaNumericW, IsCharLowerW, IsCharUpperW, GetMenuStringW, GetSubMenu, GetCaretPos, IsZoomed, MonitorFromPoint, GetMonitorInfoW, SetWindowLongW, SetLayeredWindowAttributes, FlashWindow, GetClassLongW, TranslateAcceleratorW, IsDialogMessageW, GetSysColor, InflateRect, DrawFocusRect, DrawTextW, FrameRect, DrawFrameControl, FillRect, PtInRect, DestroyAcceleratorTable, CreateAcceleratorTableW, SetCursor, GetWindowDC, GetSystemMetrics, GetActiveWindow, CharNextW, wsprintfW, RedrawWindow, DrawMenuBar, DestroyMenu, SetMenu, GetWindowTextLengthW, CreateMenu, IsDlgButtonChecked, DefDlgProcW, CallWindowProcW, ReleaseCapture, SetCapture, CreateIconFromResourceEx, mouse_event, ExitWindowsEx, SetActiveWindow, FindWindowExW, EnumThreadWindows, SetMenuDefaultItem, InsertMenuItemW, IsMenu, TrackPopupMenuEx, GetCursorPos, DeleteMenu, SetRect, GetMenuItemID, GetMenuItemCount, SetMenuItemInfoW, GetMenuItemInfoW, SetForegroundWindow, IsIconic, FindWindowW, MonitorFromRect, keybd_event, SendInput, GetAsyncKeyState, SetKeyboardState, GetKeyboardState, GetKeyState, VkKeyScanW, LoadStringW, DialogBoxParamW, MessageBeep, EndDialog, SendDlgItemMessageW, GetDlgItem, SetWindowTextW, CopyRect, ReleaseDC, GetDC, EndPaint, BeginPaint, GetClientRect, GetMenu, DestroyWindow, EnumWindows, GetDesktopWindow, IsWindow, IsWindowEnabled, IsWindowVisible, EnableWindow, InvalidateRect, GetWindowLongW, GetWindowThreadProcessId, AttachThreadInput, GetFocus, GetWindowTextW, ScreenToClient, SendMessageTimeoutW, EnumChildWindows, CharUpperBuffW, GetParent, GetDlgCtrlID, SendMessageW, MapVirtualKeyW, PostMessageW, GetWindowRect, SetUserObjectSecurity, CloseDesktop, CloseWindowStation, OpenDesktopW, SetProcessWindowStation, GetProcessWindowStation, OpenWindowStationW, GetUserObjectSecurity, MessageBoxW, DefWindowProcW, SetClipboardData, EmptyClipboard, CountClipboardFormats, CloseClipboard, GetClipboardData, IsClipboardFormatAvailable, OpenClipboard, BlockInput, GetMessageW, LockWindowUpdate, DispatchMessageW, TranslateMessage, PeekMessageW, UnregisterHotKey, CheckMenuRadioItem, CharLowerBuffW, MoveWindow, SetFocus, PostQuitMessage, KillTimer, CreatePopupMenu, RegisterWindowMessageW, SetTimer, ShowWindow, CreateWindowExW, RegisterClassExW, LoadIconW, LoadCursorW, GetSysColorBrush, GetForegroundWindow, MessageBoxA, DestroyIcon, SystemParametersInfoW, LoadImageW, GetClassNameW
GDI32.dll	StrokePath, DeleteObject, GetTextExtentPoint32W, ExtCreatePen, GetDeviceCaps, EndPath, SetPixel, CloseFigure, CreateCompatibleBitmap, CreateCompatibleDC, SelectObject, StretchBlt, GetDIBits, LineTo, AngleArc, MoveToEx, Ellipse, DeleteDC, GetPixel, CreateDCW, GetStockObject, GetTextFaceW, CreateFontW, SetTextColor, PolyDraw, BeginPath, Rectangle, SetViewportOrgEx, GetObjectW, SetBkMode, RoundRect, SetBkColor, CreatePen, CreateSolidBrush, StrokeAndFillPath
COMDLG32.dll	GetOpenFileNameW, GetSaveFileNameW
ADVAPI32.dll	GetAce, RegEnumValueW, RegDeleteValueW, RegDeleteKeyW, RegEnumKeyExW, RegSetValueExW, RegOpenKeyExW, RegCloseKey, RegQueryValueExW, RegConnectRegistryW, InitializeSecurityDescriptor, InitializeAcl, AdjustTokenPrivileges, OpenThreadToken, OpenProcessToken, LookupPrivilegeValueW, DuplicateTokenEx, CreateProcessAsUserW, CreateProcessWithLogonW, GetLengthSid, CopySid, LogonUserW, AllocateAndInitializeSid, CheckTokenMembership, RegCreateKeyExW, FreeSid, GetTokenInformation, GetSecurityDescriptorDacl, GetAclInformation, AddAce, SetSecurityDescriptorDacl, GetUserNameW, InitiateSystemShutdownExW
SHELL32.dll	DragQueryPoint, ShellExecuteExW, DragQueryFileW, SHEmptyRecycleBinW, SHGetPathFromIDListW, SHBrowseForFolderW, SHCreateShellItem, SHGetDesktopFolder, SHGetSpecialFolderLocation, SHGetFolderPathW, SHFileOperationW, ExtractIconExW, Shell_NotifyIconW, ShellExecuteW, DragFinish
ole32.dll	CoTaskMemAlloc, CoTaskMemFree, CLSIDFromString, ProgIDFromCLSID, CLSIDFromProgID, OleSetMenuDescriptor, MkParseDisplayName, OleSetContainedObject, CoCreateInstance, IIDFromString, StringFromGUID2, CreateStreamOnHGlobal, OleInitialize, OleUninitialize, CoInitialize, CoUninitialize, GetRunningObjectTable, CoGetInstanceFromFile, CoGetObject, CoSetProxyBlanket, CoCreateInstanceEx, CoInitializeSecurity
OLEAUT32.dll	LoadTypeLibEx, VariantCopyInd, SysReAllocString, SysFreeString, SafeArrayDestroyDescriptor, SafeArrayDestroyData, SafeArrayUnaccessData, SafeArrayAccessData, SafeArrayAllocData, SafeArrayAllocDescriptorEx, SafeArrayCreateVector, RegisterTypeLib, CreateStdDispatch, DispCallFunc, VariantChangeType, SysStringLen, VariantTimeToSystemTime, VarR8FromDec, SafeArrayGetVartype, VariantCopy, VariantClear, OleLoadPicture, QueryPathOfRegTypeLib, RegisterTypeLibForUser, UnRegisterTypeLibForUser, UnRegisterTypeLib, CreateDispTypeInfo, SysAllocString, VariantInit

Possible Origin

Language of compilation system	Country where language is spoken	Map
English	Great Britain

Target ID:	0
Start time:	15:44:00
Start date:	04/07/2024
Path:	C:\Users\user\Desktop\New Quotation - FE7191PO154.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\Desktop\New Quotation - FE7191PO154.exe"
Imagebase:	0xdb0000
File size:	1'173'504 bytes
MD5 hash:	494D46B06BE2512D5224DCBB309CC9C8
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	2
Start time:	15:44:01
Start date:	04/07/2024
Path:	C:\Windows\SysWOW64\svchost.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\Desktop\New Quotation - FE7191PO154.exe"
Imagebase:	0xa30000
File size:	46'504 bytes
MD5 hash:	1ED18311E3DA35942DB37D15FA40CC5B
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_FormBook_1, Description: Yara detected FormBook, Source: 00000002.00000002.2581820388.0000000000470000.00000040.80000000.00040000.00000000.sdmp, Author: Joe Security Rule: Windows_Trojan_Formbook_1112e116, Description: unknown, Source: 00000002.00000002.2581820388.0000000000470000.00000040.80000000.00040000.00000000.sdmp, Author: unknown Rule: JoeSecurity_FormBook_1, Description: Yara detected FormBook, Source: 00000002.00000002.2582022123.0000000002CC0000.00000004.00001000.00020000.00000000.sdmp, Author: Joe Security Rule: Windows_Trojan_Formbook_1112e116, Description: unknown, Source: 00000002.00000002.2582022123.0000000002CC0000.00000004.00001000.00020000.00000000.sdmp, Author: unknown
Reputation:	moderate
Has exited:	true

Show Windows behavior

Execution Graph

Execution Coverage:	4%
Dynamic/Decrypted Code Coverage:	0.4%
Signature Coverage:	3%
Total number of Nodes:	2000
Total number of Limit Nodes:	162

Executed Functions

Function 00DB3B4C Relevance: 19.4, APIs: 8, Strings: 3, Instructions: 153
windowCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetCurrentDirectoryW.KERNEL32(00007FFF,?), ref: 00DB3B7A
IsDebuggerPresent.KERNEL32 ref: 00DB3B8C
GetFullPathNameW.KERNEL32(00007FFF,?,?,00E762F8,00E762E0,?,?), ref: 00DB3BFD

Part of subcall function 00DB7D2C: _memmove.LIBCMT ref: 00DB7D66

Part of subcall function 00DC0A8D: GetFullPathNameW.KERNEL32(?,00007FFF,?,?,?,00DB3C26,00E762F8,?,?,?), ref: 00DC0ACE

SetCurrentDirectoryW.KERNEL32(?), ref: 00DB3C81
MessageBoxA.USER32(00000000,This is a third-party compiled AutoIt script.,00E693F0,00000010), ref: 00DED4BC
SetCurrentDirectoryW.KERNEL32(?,00E762F8,?,?,?), ref: 00DED4F4
GetForegroundWindow.USER32(runas,?,?,?,00000001,?,00E65D40,00E762F8,?,?,?), ref: 00DED57A
ShellExecuteW.SHELL32(00000000,?,?), ref: 00DED581

Part of subcall function 00DB3A58: GetSysColorBrush.USER32(0000000F), ref: 00DB3A62
Part of subcall function 00DB3A58: LoadCursorW.USER32(00000000,00007F00), ref: 00DB3A71
Part of subcall function 00DB3A58: LoadIconW.USER32(00000063), ref: 00DB3A88
Part of subcall function 00DB3A58: LoadIconW.USER32(000000A4), ref: 00DB3A9A
Part of subcall function 00DB3A58: LoadIconW.USER32(000000A2), ref: 00DB3AAC
Part of subcall function 00DB3A58: LoadImageW.USER32(00000063,00000001,00000010,00000010,00000000), ref: 00DB3AD2
Part of subcall function 00DB3A58: RegisterClassExW.USER32(?), ref: 00DB3B28

Part of subcall function 00DB39E7: CreateWindowExW.USER32(00000000,AutoIt v3,AutoIt v3,00CF0000,80000000,80000000,0000012C,00000064,00000000,00000000,00000000,00000001), ref: 00DB3A15
Part of subcall function 00DB39E7: CreateWindowExW.USER32(00000000,edit,00000000,50B008C4,00000000,00000000,00000000,00000000,00000000,00000001,00000000), ref: 00DB3A36
Part of subcall function 00DB39E7: ShowWindow.USER32(00000000,?,?), ref: 00DB3A4A
Part of subcall function 00DB39E7: ShowWindow.USER32(00000000,?,?), ref: 00DB3A53

Part of subcall function 00DB43DB: _memset.LIBCMT ref: 00DB4401
Part of subcall function 00DB43DB: Shell_NotifyIconW.SHELL32(00000000,?), ref: 00DB44A6

Strings

This is a third-party compiled AutoIt script., xrefs: 00DED4B4
%, xrefs: 00DB3C56
runas, xrefs: 00DED575

Memory Dump Source

Source File: 00000000.00000002.2103545536.0000000000DB1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00DB0000, based on PE: true

Associated: 00000000.00000002.2103534640.0000000000DB0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103580373.0000000000E3F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103580373.0000000000E65000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103609603.0000000000E6F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103621893.0000000000E78000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_db0000_New Quotation - FE7191PO154.jbxd

Similarity

API ID: LoadWindow$Icon$CurrentDirectory$CreateFullNamePathShow$BrushClassColorCursorDebuggerExecuteForegroundImageMessageNotifyPresentRegisterShellShell__memmove_memset
String ID: This is a third-party compiled AutoIt script.$runas$%
API String ID: 529118366-3343222573
Opcode ID: 2f8b2ced53ac6a52746799d6b5d899978609072f9bc96ab17923bf47190fe568
Instruction ID: 1b436f2b1a78525b3cdfed594c41b4dabb732addb73c79f888fcaefba5b3f872
Opcode Fuzzy Hash: 2f8b2ced53ac6a52746799d6b5d899978609072f9bc96ab17923bf47190fe568
Instruction Fuzzy Hash: DA51F430904289EFCB11EBB1DC0AEED7F79EB44304B044065F45AB21B2CE709A49DB31

Function 00DB4AFE Relevance: 10.7, APIs: 7, Instructions: 223
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetVersionExW.KERNEL32(?), ref: 00DB4B2B

Part of subcall function 00DB7D2C: _memmove.LIBCMT ref: 00DB7D66

GetCurrentProcess.KERNEL32(?,00E3FAEC,00000000,00000000,?), ref: 00DB4BF8
IsWow64Process.KERNEL32(00000000), ref: 00DB4BFF
GetNativeSystemInfo.KERNELBASE(00000000), ref: 00DB4C45
FreeLibrary.KERNEL32(00000000), ref: 00DB4C50
GetSystemInfo.KERNEL32(00000000), ref: 00DB4C81
GetSystemInfo.KERNEL32(00000000), ref: 00DB4C8D

Memory Dump Source

Source File: 00000000.00000002.2103545536.0000000000DB1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00DB0000, based on PE: true

Associated: 00000000.00000002.2103534640.0000000000DB0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103580373.0000000000E3F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103580373.0000000000E65000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103609603.0000000000E6F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103621893.0000000000E78000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_db0000_New Quotation - FE7191PO154.jbxd

Similarity

API ID: InfoSystem$Process$CurrentFreeLibraryNativeVersionWow64_memmove
String ID:
API String ID: 1986165174-0
Opcode ID: 5e2090cdf55f15fdd80ef553b86c1f5d8eee42badab5c29ec9e5324a64e3a392
Instruction ID: f84c1c09cbbefdfd8ff57cb602b648ac94651beea2ab1f02bacd52aa421027e9
Opcode Fuzzy Hash: 5e2090cdf55f15fdd80ef553b86c1f5d8eee42badab5c29ec9e5324a64e3a392
Instruction Fuzzy Hash: AA91E33194ABC4DEC731DB6984511EABFF5AF2A300B58499ED0CB93A42D630E908C779

Function 00DB4FE9 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 62
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateStreamOnHGlobal.OLE32(00000000,00000001,?,?,?,?,?,00DB4EEE,?,?,00000000,00000000), ref: 00DB4FF9
FindResourceExW.KERNEL32(?,0000000A,SCRIPT,00000000,?,?,00DB4EEE,?,?,00000000,00000000), ref: 00DB5010
LoadResource.KERNEL32(?,00000000,?,?,00DB4EEE,?,?,00000000,00000000,?,?,?,?,?,?,00DB4F8F), ref: 00DEDD60
SizeofResource.KERNEL32(?,00000000,?,?,00DB4EEE,?,?,00000000,00000000,?,?,?,?,?,?,00DB4F8F), ref: 00DEDD75
LockResource.KERNEL32(00DB4EEE,?,?,00DB4EEE,?,?,00000000,00000000,?,?,?,?,?,?,00DB4F8F,00000000), ref: 00DEDD88

Strings

SCRIPT, xrefs: 00DB5006

Memory Dump Source

Source File: 00000000.00000002.2103545536.0000000000DB1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00DB0000, based on PE: true

Associated: 00000000.00000002.2103534640.0000000000DB0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103580373.0000000000E3F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103580373.0000000000E65000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103609603.0000000000E6F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103621893.0000000000E78000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_db0000_New Quotation - FE7191PO154.jbxd

Similarity

API ID: Resource$CreateFindGlobalLoadLockSizeofStream
String ID: SCRIPT
API String ID: 3051347437-3967369404
Opcode ID: 1fb73d7976676c691e35a89d949f589e1ad74f26b96bcbda41e17f2861921437
Instruction ID: c81b2252896e167bb2af0602bbb1c583672aebecaf0b04d26ebaaeb062dd95b0
Opcode Fuzzy Hash: 1fb73d7976676c691e35a89d949f589e1ad74f26b96bcbda41e17f2861921437
Instruction Fuzzy Hash: 3F115A75600704EFD7219B66EC58F677BB9EBC9B12F244168F40696260DB62E8048670

Function 00DBE800 Relevance: 7.4, Strings: 5, Instructions: 1102COMMON

Download Yara Rule

Strings

Variable must be of type 'Object'., xrefs: 00DF428C
Dt, xrefs: 00DBEC1A
Dt, xrefs: 00DBEC21
Dt, xrefs: 00DF3F1F
Dt, xrefs: 00DF3F58

Memory Dump Source

Source File: 00000000.00000002.2103545536.0000000000DB1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00DB0000, based on PE: true

Associated: 00000000.00000002.2103534640.0000000000DB0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103580373.0000000000E3F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103580373.0000000000E65000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103609603.0000000000E6F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103621893.0000000000E78000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_db0000_New Quotation - FE7191PO154.jbxd

Similarity

API ID:
String ID: Dt$Dt$Dt$Dt$Variable must be of type 'Object'.
API String ID: 0-3952547859
Opcode ID: f9145c10a2645941609057480ef8dd9b7c78ca541dfd972fedc2546b26db0096
Instruction ID: 6908a6e06ae32d47e653ba9b8fae368586648168029501bc1c0e7d236bcc67b4
Opcode Fuzzy Hash: f9145c10a2645941609057480ef8dd9b7c78ca541dfd972fedc2546b26db0096
Instruction Fuzzy Hash: 90A26B74A04205CFCB24CF58C880AEEB7B1FF48310F698469E956AB351D775ED86CBA1

Function 00E14696 Relevance: 4.5, APIs: 3, Instructions: 25fileCOMMON

Download Yara Rule

APIs

GetFileAttributesW.KERNELBASE(?,00DEE7C1), ref: 00E146A6
FindFirstFileW.KERNELBASE(?,?), ref: 00E146B7
FindClose.KERNEL32(00000000), ref: 00E146C7

Memory Dump Source

Source File: 00000000.00000002.2103545536.0000000000DB1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00DB0000, based on PE: true

Associated: 00000000.00000002.2103534640.0000000000DB0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103580373.0000000000E3F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103580373.0000000000E65000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103609603.0000000000E6F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103621893.0000000000E78000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_db0000_New Quotation - FE7191PO154.jbxd

Similarity

API ID: FileFind$AttributesCloseFirst
String ID:
API String ID: 48322524-0
Opcode ID: ee7fd6085e065652f4699451613750255849e271ead3be3450bad15eab084e58
Instruction ID: c64931f03294409d847ec8d7c23f084cfad86a3b8164b649866679a4ca7d0275
Opcode Fuzzy Hash: ee7fd6085e065652f4699451613750255849e271ead3be3450bad15eab084e58
Instruction Fuzzy Hash: B3E0D8728104059F42106738EC4D8EB7B5C9F06339F100755F875E21F0E7B05D948595

Function 00DC0B30 Relevance: 64.3, APIs: 27, Strings: 9, Instructions: 1300windowsleeptimeCOMMON

Download Yara Rule

APIs

PeekMessageW.USER32(?,00000000,00000000,00000000,00000001), ref: 00DC0BBB
timeGetTime.WINMM ref: 00DC0E76
PeekMessageW.USER32(?,00000000,00000000,00000000,00000001), ref: 00DC0FB3
TranslateMessage.USER32(?), ref: 00DC0FC7
DispatchMessageW.USER32(?), ref: 00DC0FD5
Sleep.KERNEL32(0000000A), ref: 00DC0FDF
LockWindowUpdate.USER32(00000000,?,?), ref: 00DC105A
DestroyWindow.USER32 ref: 00DC1066
GetMessageW.USER32(?,00000000,00000000,00000000), ref: 00DC1080
Sleep.KERNEL32(0000000A,?,?), ref: 00DF52AD
TranslateMessage.USER32(?), ref: 00DF608A
DispatchMessageW.USER32(?), ref: 00DF6098
GetMessageW.USER32(?,00000000,00000000,00000000), ref: 00DF60AC

Strings

@GUI_CTRLHANDLE, xrefs: 00DF540E
pr, xrefs: 00DF5BDE
pr, xrefs: 00DF542D
@TRAY_ID, xrefs: 00DF5BB9
@GUI_WINHANDLE, xrefs: 00DF53B9
@GUI_CTRLID, xrefs: 00DF5364
pr, xrefs: 00DF5383
@COM_EVENTOBJ, xrefs: 00DF591A
pr, xrefs: 00DF53D8

Memory Dump Source

Source File: 00000000.00000002.2103545536.0000000000DB1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00DB0000, based on PE: true

Associated: 00000000.00000002.2103534640.0000000000DB0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103580373.0000000000E3F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103580373.0000000000E65000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103609603.0000000000E6F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103621893.0000000000E78000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_db0000_New Quotation - FE7191PO154.jbxd

Similarity

API ID: Message$DispatchPeekSleepTranslateWindow$DestroyLockTimeUpdatetime
String ID: @COM_EVENTOBJ$@GUI_CTRLHANDLE$@GUI_CTRLID$@GUI_WINHANDLE$@TRAY_ID$pr$pr$pr$pr
API String ID: 4003667617-1825247661
Opcode ID: cf5f71823d535fdb21d7c0c47ba1e1312aec20ef45baae554c7cb567129a923a
Instruction ID: bfd97dd3ca97b9a52e9e0d70fca1e25d7a2f20d1f4c7ad53b6f598a8dc30f388
Opcode Fuzzy Hash: cf5f71823d535fdb21d7c0c47ba1e1312aec20ef45baae554c7cb567129a923a
Instruction Fuzzy Hash: 17B2C370608746DFD724DF24D844FAABBE4FF84304F18851DE69A97291DB71E884CBA2

Function 00E193DF Relevance: 19.8, APIs: 13, Instructions: 322
fileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 00E191E9: __time64.LIBCMT ref: 00E191F3

Part of subcall function 00DB5045: _fseek.LIBCMT ref: 00DB505D

__wsplitpath.LIBCMT ref: 00E194BE

Part of subcall function 00DD432E: __wsplitpath_helper.LIBCMT ref: 00DD436E

_wcscpy.LIBCMT ref: 00E194D1
_wcscat.LIBCMT ref: 00E194E4
__wsplitpath.LIBCMT ref: 00E19509
_wcscat.LIBCMT ref: 00E1951F
_wcscat.LIBCMT ref: 00E19532

Part of subcall function 00E1922F: _memmove.LIBCMT ref: 00E19268
Part of subcall function 00E1922F: _memmove.LIBCMT ref: 00E19277

_wcscmp.LIBCMT ref: 00E19479

Part of subcall function 00E199BE: _wcscmp.LIBCMT ref: 00E19AAE
Part of subcall function 00E199BE: _wcscmp.LIBCMT ref: 00E19AC1

DeleteFileW.KERNEL32(?,?,?,?,00000004,00000001,?,?,00000004,00000001,?,?,00000004,00000001,?,?), ref: 00E196DC
_wcsncpy.LIBCMT ref: 00E1974F
DeleteFileW.KERNEL32(?,?), ref: 00E19785
CopyFileW.KERNELBASE(?,?,00000000,?,?,?,00000004,00000001,?,?,00000004,00000001,?,?,00000004,00000001), ref: 00E1979B
DeleteFileW.KERNEL32(?,?,?,00000004,00000001,?,?,00000004,00000001,?,?,00000004,00000001,?,?,00000004), ref: 00E197AC
DeleteFileW.KERNELBASE(?,?,?,00000004,00000001,?,?,00000004,00000001,?,?,00000004,00000001,?,?,00000004), ref: 00E197BE

Memory Dump Source

Source File: 00000000.00000002.2103545536.0000000000DB1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00DB0000, based on PE: true

Associated: 00000000.00000002.2103534640.0000000000DB0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103580373.0000000000E3F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103580373.0000000000E65000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103609603.0000000000E6F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103621893.0000000000E78000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_db0000_New Quotation - FE7191PO154.jbxd

Similarity

API ID: File$Delete$_wcscat_wcscmp$__wsplitpath_memmove$Copy__time64__wsplitpath_helper_fseek_wcscpy_wcsncpy
String ID:
API String ID: 1500180987-0
Opcode ID: c556ddb1e434239fbe7db094be795d392efc5262ea9da969b73971df12de630f
Instruction ID: 76462d4da7bca844520da420fa5ec13efe35a2ae8d9678db6658f39cc88f3390
Opcode Fuzzy Hash: c556ddb1e434239fbe7db094be795d392efc5262ea9da969b73971df12de630f
Instruction Fuzzy Hash: ABC11BB1D00219AADF11DFA5DC95EDEBBBDEF45310F0040AAF609F6251DB309A848F65

Function 00DB3015 Relevance: 19.3, APIs: 7, Strings: 4, Instructions: 73
windowregistryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetSysColorBrush.USER32(0000000F), ref: 00DB3074
RegisterClassExW.USER32(00000030), ref: 00DB309E
RegisterWindowMessageW.USER32(TaskbarCreated), ref: 00DB30AF
InitCommonControlsEx.COMCTL32(?), ref: 00DB30CC
ImageList_Create.COMCTL32(00000010,00000010,00000021,00000001,00000001), ref: 00DB30DC
LoadIconW.USER32(000000A9), ref: 00DB30F2
ImageList_ReplaceIcon.COMCTL32(000000FF,00000000), ref: 00DB3101

Strings

+, xrefs: 00DB305D
0, xrefs: 00DB3056
AutoIt v3 GUI, xrefs: 00DB3090
TaskbarCreated, xrefs: 00DB30A4

Memory Dump Source

Source File: 00000000.00000002.2103545536.0000000000DB1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00DB0000, based on PE: true

Associated: 00000000.00000002.2103534640.0000000000DB0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103580373.0000000000E3F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103580373.0000000000E65000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103609603.0000000000E6F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103621893.0000000000E78000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_db0000_New Quotation - FE7191PO154.jbxd

Similarity

API ID: IconImageList_Register$BrushClassColorCommonControlsCreateInitLoadMessageReplaceWindow
String ID: +$0$AutoIt v3 GUI$TaskbarCreated
API String ID: 2914291525-1005189915
Opcode ID: 5b8acc27058409058f5c586a0c1dcba0ca8988cd90462ab49a999379c236e816
Instruction ID: 3003c7cbd14996b3cb22812ccf2521b150b24ba98967876bea3a4bd469279e47
Opcode Fuzzy Hash: 5b8acc27058409058f5c586a0c1dcba0ca8988cd90462ab49a999379c236e816
Instruction Fuzzy Hash: A73147B1C14309AFEB00CFA5E889AD9BFF0FB09314F10412AE544B62A0E3B50589CF91

Function 00DB3041 Relevance: 19.3, APIs: 7, Strings: 4, Instructions: 54
windowregistryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetSysColorBrush.USER32(0000000F), ref: 00DB3074
RegisterClassExW.USER32(00000030), ref: 00DB309E
RegisterWindowMessageW.USER32(TaskbarCreated), ref: 00DB30AF
InitCommonControlsEx.COMCTL32(?), ref: 00DB30CC
ImageList_Create.COMCTL32(00000010,00000010,00000021,00000001,00000001), ref: 00DB30DC
LoadIconW.USER32(000000A9), ref: 00DB30F2
ImageList_ReplaceIcon.COMCTL32(000000FF,00000000), ref: 00DB3101

Strings

+, xrefs: 00DB305D
0, xrefs: 00DB3056
AutoIt v3 GUI, xrefs: 00DB3090
TaskbarCreated, xrefs: 00DB30A4

Memory Dump Source

Source File: 00000000.00000002.2103545536.0000000000DB1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00DB0000, based on PE: true

Associated: 00000000.00000002.2103534640.0000000000DB0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103580373.0000000000E3F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103580373.0000000000E65000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103609603.0000000000E6F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103621893.0000000000E78000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_db0000_New Quotation - FE7191PO154.jbxd

Similarity

API ID: IconImageList_Register$BrushClassColorCommonControlsCreateInitLoadMessageReplaceWindow
String ID: +$0$AutoIt v3 GUI$TaskbarCreated
API String ID: 2914291525-1005189915
Opcode ID: 31d92c2f02f1b9d00c181ba3d83cb51bb4794ed688c8b859ea85150b29ceaabe
Instruction ID: 99db6b21dfafe2eaff1431b28791405dab201d0c821b253ae0ecfd1eddef9ea4
Opcode Fuzzy Hash: 31d92c2f02f1b9d00c181ba3d83cb51bb4794ed688c8b859ea85150b29ceaabe
Instruction Fuzzy Hash: D321C5B1D10218AFEB00DFA6E989B9DBFF4FB08704F00412AF515B62A1D7B14588CF95

Function 00DB71EB Relevance: 17.7, APIs: 6, Strings: 4, Instructions: 201
registryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 00DB4864: GetModuleFileNameW.KERNEL32(00000000,?,00007FFF,00E762F8,?,00DB37C0,?), ref: 00DB4882

Part of subcall function 00DD074F: GetFullPathNameW.KERNEL32(?,00007FFF,?,?,?,?,00DB72C5), ref: 00DD0771

RegOpenKeyExW.KERNELBASE(80000001,Software\AutoIt v3\AutoIt,00000000,00000001,?,?,\Include\), ref: 00DB7308
RegQueryValueExW.ADVAPI32(?,Include,00000000,00000000,00000000,?), ref: 00DEECF1
RegQueryValueExW.ADVAPI32(?,Include,00000000,00000000,?,?,00000000), ref: 00DEED32
RegCloseKey.ADVAPI32(?), ref: 00DEED70
_wcscat.LIBCMT ref: 00DEEDC9

Strings

\, xrefs: 00DEEDEC
Software\AutoIt v3\AutoIt, xrefs: 00DB72FE
\Include\, xrefs: 00DB72C5
Include, xrefs: 00DEECE8, 00DEED29

Memory Dump Source

Source File: 00000000.00000002.2103545536.0000000000DB1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00DB0000, based on PE: true

Associated: 00000000.00000002.2103534640.0000000000DB0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103580373.0000000000E3F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103580373.0000000000E65000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103609603.0000000000E6F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103621893.0000000000E78000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_db0000_New Quotation - FE7191PO154.jbxd

Similarity

API ID: NameQueryValue$CloseFileFullModuleOpenPath_wcscat
String ID: Include$Software\AutoIt v3\AutoIt$\$\Include\
API String ID: 2673923337-2727554177
Opcode ID: 5ef900162707f1d5615693bb8d7e75a9117e632fe94880bd875401be117e1585
Instruction ID: 968f529d598b41ccc82723e133ea1e2694313d4ac004cbb3efbb0444bab21b4c
Opcode Fuzzy Hash: 5ef900162707f1d5615693bb8d7e75a9117e632fe94880bd875401be117e1585
Instruction Fuzzy Hash: 8B7152B14083419EC314EF66EC859ABBBE8FF94750F44492EF499A3271DB709988CB71

Function 00DB3633 Relevance: 17.7, APIs: 8, Strings: 2, Instructions: 151
windowtimeregistryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

DefWindowProcW.USER32(?,?,?,?), ref: 00DB36D2
KillTimer.USER32(?,00000001), ref: 00DB36FC
SetTimer.USER32(?,00000001,000002EE,00000000), ref: 00DB371F
RegisterWindowMessageW.USER32(TaskbarCreated), ref: 00DB372A
CreatePopupMenu.USER32 ref: 00DB373E
PostQuitMessage.USER32(00000000), ref: 00DB375F

Strings

%, xrefs: 00DED2D1, 00DED31F
TaskbarCreated, xrefs: 00DB3725

Memory Dump Source

Source File: 00000000.00000002.2103545536.0000000000DB1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00DB0000, based on PE: true

Associated: 00000000.00000002.2103534640.0000000000DB0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103580373.0000000000E3F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103580373.0000000000E65000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103609603.0000000000E6F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103621893.0000000000E78000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_db0000_New Quotation - FE7191PO154.jbxd

Similarity

API ID: MessageTimerWindow$CreateKillMenuPopupPostProcQuitRegister
String ID: TaskbarCreated$%
API String ID: 129472671-3835587964
Opcode ID: ceff00b7a3cab395d383a781cd6e973fa6f57d5c9cbf70755ed3875f167e1329
Instruction ID: 23a40ac0afd9e2696c55b1a84c0d0cf74bd337e5fb44cbe2c4141b6a04ab9d43
Opcode Fuzzy Hash: ceff00b7a3cab395d383a781cd6e973fa6f57d5c9cbf70755ed3875f167e1329
Instruction Fuzzy Hash: 894119B1210A45FFDB14AF69DC0ABF93B55EB40300F180129F947E62B2DE64DE94A772

Function 00DB3A58 Relevance: 17.6, APIs: 7, Strings: 3, Instructions: 71
windowregistryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetSysColorBrush.USER32(0000000F), ref: 00DB3A62
LoadCursorW.USER32(00000000,00007F00), ref: 00DB3A71
LoadIconW.USER32(00000063), ref: 00DB3A88
LoadIconW.USER32(000000A4), ref: 00DB3A9A
LoadIconW.USER32(000000A2), ref: 00DB3AAC
LoadImageW.USER32(00000063,00000001,00000010,00000010,00000000), ref: 00DB3AD2
RegisterClassExW.USER32(?), ref: 00DB3B28

Part of subcall function 00DB3041: GetSysColorBrush.USER32(0000000F), ref: 00DB3074
Part of subcall function 00DB3041: RegisterClassExW.USER32(00000030), ref: 00DB309E
Part of subcall function 00DB3041: RegisterWindowMessageW.USER32(TaskbarCreated), ref: 00DB30AF
Part of subcall function 00DB3041: InitCommonControlsEx.COMCTL32(?), ref: 00DB30CC
Part of subcall function 00DB3041: ImageList_Create.COMCTL32(00000010,00000010,00000021,00000001,00000001), ref: 00DB30DC
Part of subcall function 00DB3041: LoadIconW.USER32(000000A9), ref: 00DB30F2
Part of subcall function 00DB3041: ImageList_ReplaceIcon.COMCTL32(000000FF,00000000), ref: 00DB3101

Strings

0, xrefs: 00DB3B06
#, xrefs: 00DB3B0D
AutoIt v3, xrefs: 00DB3B17

Memory Dump Source

Source File: 00000000.00000002.2103545536.0000000000DB1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00DB0000, based on PE: true

Associated: 00000000.00000002.2103534640.0000000000DB0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103580373.0000000000E3F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103580373.0000000000E65000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103609603.0000000000E6F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103621893.0000000000E78000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_db0000_New Quotation - FE7191PO154.jbxd

Similarity

API ID: Load$Icon$ImageRegister$BrushClassColorList_$CommonControlsCreateCursorInitMessageReplaceWindow
String ID: #$0$AutoIt v3
API String ID: 423443420-4155596026
Opcode ID: b402b9e556ba057402f748912ad4585798fc993aa6be2e9710a3ca4bd68c9b62
Instruction ID: c6243855201f351b98f38335b27bb2cea4ec5ba516cb443b81e52e1d583fd985
Opcode Fuzzy Hash: b402b9e556ba057402f748912ad4585798fc993aa6be2e9710a3ca4bd68c9b62
Instruction Fuzzy Hash: F6213C70D10348AFDB50DFA6EC09B9D7FB5EB08714F00012AF608BA2B1D7B655989F94

Function 00DB3778 Relevance: 16.0, APIs: 1, Strings: 8, Instructions: 267
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

/AutoIt3OutputDebug, xrefs: 00DB38A4
/ErrorStdOut, xrefs: 00DB388F
/AutoIt3ExecuteLine, xrefs: 00DB38B9
b, xrefs: 00DED44E
/AutoIt3ExecuteScript, xrefs: 00DB38CE
CMDLINERAW, xrefs: 00DB380D
CMDLINE, xrefs: 00DB3834
>>>AUTOIT NO CMDEXECUTE<<<, xrefs: 00DB37C0

Memory Dump Source

Source File: 00000000.00000002.2103545536.0000000000DB1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00DB0000, based on PE: true

Associated: 00000000.00000002.2103534640.0000000000DB0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103580373.0000000000E3F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103580373.0000000000E65000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103609603.0000000000E6F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103621893.0000000000E78000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_db0000_New Quotation - FE7191PO154.jbxd

Similarity

API ID: FileLibraryLoadModuleName__wcsicmp_l_memmove
String ID: /AutoIt3ExecuteLine$/AutoIt3ExecuteScript$/AutoIt3OutputDebug$/ErrorStdOut$>>>AUTOIT NO CMDEXECUTE<<<$CMDLINE$CMDLINERAW$b
API String ID: 1825951767-3834736419
Opcode ID: 9fc6ce983d731fb98b348b1c1790372020ad50ffc68e86eacd6fda468fc5eebf
Instruction ID: 4962bcc28267939a7ca9efcc65033a3bcbe27e9b6d1cff899ed26df453cac7cb
Opcode Fuzzy Hash: 9fc6ce983d731fb98b348b1c1790372020ad50ffc68e86eacd6fda468fc5eebf
Instruction Fuzzy Hash: EDA12871910269DACB04EFA4CC96AEEB778FF54300F44052AE416B6192EF75AA09DB70

Function 00DBF8CF Relevance: 12.4, APIs: 3, Strings: 4, Instructions: 168
comCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 00DD03A2: MapVirtualKeyW.USER32(0000005B,00000000), ref: 00DD03D3
Part of subcall function 00DD03A2: MapVirtualKeyW.USER32(00000010,00000000), ref: 00DD03DB
Part of subcall function 00DD03A2: MapVirtualKeyW.USER32(000000A0,00000000), ref: 00DD03E6
Part of subcall function 00DD03A2: MapVirtualKeyW.USER32(000000A1,00000000), ref: 00DD03F1
Part of subcall function 00DD03A2: MapVirtualKeyW.USER32(00000011,00000000), ref: 00DD03F9
Part of subcall function 00DD03A2: MapVirtualKeyW.USER32(00000012,00000000), ref: 00DD0401

Part of subcall function 00DC6259: RegisterWindowMessageW.USER32(WM_GETCONTROLNAME,?,00DBFA90), ref: 00DC62B4

GetStdHandle.KERNEL32(000000F6,00000000,00000000), ref: 00DBFB2D
OleInitialize.OLE32(00000000), ref: 00DBFBAA
CloseHandle.KERNEL32(00000000), ref: 00DF49F2

Strings

\d, xrefs: 00DBF957
%, xrefs: 00DBF8F6, 00DBF908, 00DBFACE, 00DBFBB1
<g, xrefs: 00DBFA90
c, xrefs: 00DBF94B

Memory Dump Source

Source File: 00000000.00000002.2103545536.0000000000DB1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00DB0000, based on PE: true

Associated: 00000000.00000002.2103534640.0000000000DB0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103580373.0000000000E3F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103580373.0000000000E65000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103609603.0000000000E6F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103621893.0000000000E78000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_db0000_New Quotation - FE7191PO154.jbxd

Similarity

API ID: Virtual$Handle$CloseInitializeMessageRegisterWindow
String ID: <g$\d$%$c
API String ID: 1986988660-619945097
Opcode ID: 3631f911e61f758b164fee8876a6764a0561e31fe537319445b6db910caeb007
Instruction ID: c0ca0d3ebaa98cb6c63816fe9ea41036308bc6bb29992169ebdc19eb84ba661c
Opcode Fuzzy Hash: 3631f911e61f758b164fee8876a6764a0561e31fe537319445b6db910caeb007
Instruction Fuzzy Hash: BE8187B0900A419FC798DF2BA9566557BE5FB8830C710956AD02DFB262FB31848DCF61

Function 03042600 Relevance: 10.7, APIs: 7, Instructions: 239
fileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateFileW.KERNELBASE(00000000,?,80000000,00000007,00000000,00000003,00000080,00000000,?,00000000), ref: 030426D1
VirtualFree.KERNELBASE(00000000,00000000,00008000,00000000,00000000,00000000,00000000,?,?,00000000), ref: 030428F7

Memory Dump Source

Source File: 00000000.00000002.2103783677.0000000003040000.00000040.00001000.00020000.00000000.sdmp, Offset: 03040000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_3040000_New Quotation - FE7191PO154.jbxd

Similarity

API ID: CreateFileFreeVirtual
String ID:
API String ID: 204039940-0
Opcode ID: c604c45430315f2d7ac9edfc96fa3ed3524b16f7139e20e6f85f26396c7b052c
Instruction ID: 1166a3c2daa89fcee9e58d6edea108a859aa8897b27930040ca95fe01f8d20c2
Opcode Fuzzy Hash: c604c45430315f2d7ac9edfc96fa3ed3524b16f7139e20e6f85f26396c7b052c
Instruction Fuzzy Hash: 10A1FDB4E02209EBDB14CFA4C954BEEBBB9FF48304F2485A9E501BB280D7759A45CF54

Function 00DB39E7 Relevance: 10.5, APIs: 4, Strings: 2, Instructions: 44
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateWindowExW.USER32(00000000,AutoIt v3,AutoIt v3,00CF0000,80000000,80000000,0000012C,00000064,00000000,00000000,00000000,00000001), ref: 00DB3A15
CreateWindowExW.USER32(00000000,edit,00000000,50B008C4,00000000,00000000,00000000,00000000,00000000,00000001,00000000), ref: 00DB3A36
ShowWindow.USER32(00000000,?,?), ref: 00DB3A4A
ShowWindow.USER32(00000000,?,?), ref: 00DB3A53

Strings

edit, xrefs: 00DB3A30
AutoIt v3, xrefs: 00DB3A0D, 00DB3A12, 00DB3A13

Memory Dump Source

Source File: 00000000.00000002.2103545536.0000000000DB1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00DB0000, based on PE: true

Associated: 00000000.00000002.2103534640.0000000000DB0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103580373.0000000000E3F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103580373.0000000000E65000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103609603.0000000000E6F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103621893.0000000000E78000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_db0000_New Quotation - FE7191PO154.jbxd

Similarity

API ID: Window$CreateShow
String ID: AutoIt v3$edit
API String ID: 1584632944-3779509399
Opcode ID: 65b6d301e65b13920e8736d1c97464353987e62939bcf3aba01968325b802360
Instruction ID: bdb603bf2cfd6ee0955c37c3ab3f70ff9295445d1f2b0c5c4663ea0b3a9d1b64
Opcode Fuzzy Hash: 65b6d301e65b13920e8736d1c97464353987e62939bcf3aba01968325b802360
Instruction Fuzzy Hash: 1DF03A70A002D47EEA7097236C0DE272E7DD7C6F54F00002AFA08B6271C6A50884DAB0

Function 030423B0 Relevance: 8.9, APIs: 4, Strings: 1, Instructions: 152
fileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 030422A0: Sleep.KERNELBASE(000001F4), ref: 030422B1

CreateFileW.KERNELBASE(?,80000000,00000007,00000000,00000003,00000080,00000000), ref: 030424F6

Strings

OLC0S3YGUZ6OPT, xrefs: 03042559, 0304255C

Memory Dump Source

Source File: 00000000.00000002.2103783677.0000000003040000.00000040.00001000.00020000.00000000.sdmp, Offset: 03040000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_3040000_New Quotation - FE7191PO154.jbxd

Similarity

API ID: CreateFileSleep
String ID: OLC0S3YGUZ6OPT
API String ID: 2694422964-1454880221
Opcode ID: c54f2b8c7de979a0b91e8ec36cab0d8863dcd02fdf0132ad507d3107ab6cace6
Instruction ID: 962dccfc5ca5dab0e4f79c3690ddefea37e3b5b5880f85b94e6603b25b0d5e1f
Opcode Fuzzy Hash: c54f2b8c7de979a0b91e8ec36cab0d8863dcd02fdf0132ad507d3107ab6cace6
Instruction Fuzzy Hash: E251A470E15248EBEF10DBB4C854BEEBBB9AF54300F0045A8E608BB2C0D7B91B45CB65

Function 00DB410D Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 88
windowCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

LoadStringW.USER32(00000065,?,0000007F,00000104), ref: 00DED5EC

Part of subcall function 00DB7D2C: _memmove.LIBCMT ref: 00DB7D66

_memset.LIBCMT ref: 00DB418D
_wcscpy.LIBCMT ref: 00DB41E1
Shell_NotifyIconW.SHELL32(00000001,000003A8), ref: 00DB41F1

Strings

Line: , xrefs: 00DED615

Memory Dump Source

Source File: 00000000.00000002.2103545536.0000000000DB1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00DB0000, based on PE: true

Associated: 00000000.00000002.2103534640.0000000000DB0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103580373.0000000000E3F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103580373.0000000000E65000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103609603.0000000000E6F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103621893.0000000000E78000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_db0000_New Quotation - FE7191PO154.jbxd

Similarity

API ID: IconLoadNotifyShell_String_memmove_memset_wcscpy
String ID: Line:
API String ID: 3942752672-1585850449
Opcode ID: f1bbca41e40dd5117867ef1a3de954221aeb11988fe8d689e0282b1614aaeb85
Instruction ID: 2f7f48aa9a584f415cf5c6c0339b7a954ffff522b0018dec8f43e1dc07fe4ad7
Opcode Fuzzy Hash: f1bbca41e40dd5117867ef1a3de954221aeb11988fe8d689e0282b1614aaeb85
Instruction Fuzzy Hash: 4331B071408345EFD761EB64DC46FDB77E8AF54304F10451EF19AA21A2EB70A688CBB2

Function 00DD564D Relevance: 7.7, APIs: 5, Instructions: 163COMMONLIBRARYCODE

Download Yara Rule

APIs

_memset.LIBCMT ref: 00DD56AB
_memcpy_s.LIBCMT ref: 00DD571D
__read_nolock.LIBCMT ref: 00DD577B
__filbuf.LIBCMT ref: 00DD579E
_memset.LIBCMT ref: 00DD57E2

Part of subcall function 00DD8D68: __getptd_noexit.LIBCMT ref: 00DD8D68

Memory Dump Source

Source File: 00000000.00000002.2103545536.0000000000DB1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00DB0000, based on PE: true

Associated: 00000000.00000002.2103534640.0000000000DB0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103580373.0000000000E3F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103580373.0000000000E65000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103609603.0000000000E6F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103621893.0000000000E78000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_db0000_New Quotation - FE7191PO154.jbxd

Similarity

API ID: _memset$__filbuf__getptd_noexit__read_nolock_memcpy_s
String ID:
API String ID: 1559183368-0
Opcode ID: cbc132a2d90f1fa170c901e77712e707e3c45fd9b9f6dd10e42efcbbdaed9f46
Instruction ID: cd0144ae160e79300af837d5d32537b6066c3f4fa2133059e03f7f2795d49531
Opcode Fuzzy Hash: cbc132a2d90f1fa170c901e77712e707e3c45fd9b9f6dd10e42efcbbdaed9f46
Instruction Fuzzy Hash: 52519234A00B05EBDB249FA9E88066E77A1EF40320F38876BE825963D8D770DD559B70

Function 00DB69CA Relevance: 7.3, APIs: 2, Strings: 2, Instructions: 260COMMON

Download Yara Rule

APIs

Part of subcall function 00DB4F3D: LoadLibraryExW.KERNELBASE(?,00000000,00000002,?,00E762F8,00000001,>>>AUTOIT NO CMDEXECUTE<<<,?), ref: 00DB4F6F

_free.LIBCMT ref: 00DEE68C
_free.LIBCMT ref: 00DEE6D3

Part of subcall function 00DB6BEC: SetCurrentDirectoryW.KERNEL32(?,?,?,?,00000000), ref: 00DB6D0D

Strings

Bad directive syntax error, xrefs: 00DEE6BB
>>>AUTOIT SCRIPT<<<, xrefs: 00DEE462

Memory Dump Source

Source File: 00000000.00000002.2103545536.0000000000DB1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00DB0000, based on PE: true

Associated: 00000000.00000002.2103534640.0000000000DB0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103580373.0000000000E3F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103580373.0000000000E65000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103609603.0000000000E6F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103621893.0000000000E78000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_db0000_New Quotation - FE7191PO154.jbxd

Similarity

API ID: _free$CurrentDirectoryLibraryLoad
String ID: >>>AUTOIT SCRIPT<<<$Bad directive syntax error
API String ID: 2861923089-1757145024
Opcode ID: 9c90400caa4765588a054730d8f296447b0c3238c4518630c92046cb124d222e
Instruction ID: cd1c4a7f7d395b38b86af3e3d75d6441d328cfa10d05c16a53b6cb31595b7305
Opcode Fuzzy Hash: 9c90400caa4765588a054730d8f296447b0c3238c4518630c92046cb124d222e
Instruction Fuzzy Hash: 03914871910259EFCF14EFA5C8919EDBBB4FF18314F14446AE816AB2A1EB30E945CB70

Function 00DB35B0 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 59registryCOMMON

Download Yara Rule

APIs

RegOpenKeyExW.KERNELBASE(80000001,Control Panel\Mouse,00000000,00000001,00000000,00000003,00000000,80000001,80000001,?,00DB35A1,SwapMouseButtons,00000004,?), ref: 00DB35D4
RegQueryValueExW.KERNELBASE(00000000,00000000,00000000,00000000,?,?,?,?,00DB35A1,SwapMouseButtons,00000004,?,?,?,?,00DB2754), ref: 00DB35F5
RegCloseKey.KERNELBASE(00000000,?,?,00DB35A1,SwapMouseButtons,00000004,?,?,?,?,00DB2754), ref: 00DB3617

Strings

Control Panel\Mouse, xrefs: 00DB35D2

Memory Dump Source

Source File: 00000000.00000002.2103545536.0000000000DB1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00DB0000, based on PE: true

Associated: 00000000.00000002.2103534640.0000000000DB0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103580373.0000000000E3F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103580373.0000000000E65000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103609603.0000000000E6F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103621893.0000000000E78000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_db0000_New Quotation - FE7191PO154.jbxd

Similarity

API ID: CloseOpenQueryValue
String ID: Control Panel\Mouse
API String ID: 3677997916-824357125
Opcode ID: 849f746deca79a02ef6e8e18ffd08050142853fdac17c948a79726fe13954405
Instruction ID: 6dac5da2cff3517745fdec884732f368075f8cef5dd52361ce6cfd758ce2441f
Opcode Fuzzy Hash: 849f746deca79a02ef6e8e18ffd08050142853fdac17c948a79726fe13954405
Instruction Fuzzy Hash: 631148B5910208FFDB208F69DC84AEEBBB8EF04740F005469E806E7210D2719E44AB60

Function 030412A0 Relevance: 6.7, APIs: 4, Instructions: 720processthreadCOMMON

Download Yara Rule

APIs

CreateProcessW.KERNELBASE(?,00000000), ref: 03041A5B
Wow64GetThreadContext.KERNEL32(?,00010007), ref: 03041AF1
ReadProcessMemory.KERNELBASE(?,?,?,00000004,00000000), ref: 03041B13

Memory Dump Source

Source File: 00000000.00000002.2103783677.0000000003040000.00000040.00001000.00020000.00000000.sdmp, Offset: 03040000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_3040000_New Quotation - FE7191PO154.jbxd

Similarity

API ID: Process$ContextCreateMemoryReadThreadWow64
String ID:
API String ID: 2438371351-0
Opcode ID: e8e7a77c1c38f92167ec50984bffac71589908538948dc0fdf133907e09ee162
Instruction ID: a4f0afc9bd31553a54b034d888d5b00966481cbd4334edbaa9902259e3ac9d56
Opcode Fuzzy Hash: e8e7a77c1c38f92167ec50984bffac71589908538948dc0fdf133907e09ee162
Instruction Fuzzy Hash: 62621974A15218DBEB24CFA4C850BDEB376EF58300F1095A9D10DEB390E77A9E81CB59

Function 00E197E5 Relevance: 6.2, APIs: 4, Instructions: 155COMMON

Download Yara Rule

APIs

Part of subcall function 00DB5045: _fseek.LIBCMT ref: 00DB505D

Part of subcall function 00E199BE: _wcscmp.LIBCMT ref: 00E19AAE
Part of subcall function 00E199BE: _wcscmp.LIBCMT ref: 00E19AC1

_free.LIBCMT ref: 00E1992C
_free.LIBCMT ref: 00E19933
_free.LIBCMT ref: 00E1999E

Part of subcall function 00DD2F95: RtlFreeHeap.NTDLL(00000000,00000000,?,00DD9C64), ref: 00DD2FA9
Part of subcall function 00DD2F95: GetLastError.KERNEL32(00000000,?,00DD9C64), ref: 00DD2FBB

_free.LIBCMT ref: 00E199A6

Memory Dump Source

Source File: 00000000.00000002.2103545536.0000000000DB1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00DB0000, based on PE: true

Associated: 00000000.00000002.2103534640.0000000000DB0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103580373.0000000000E3F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103580373.0000000000E65000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103609603.0000000000E6F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103621893.0000000000E78000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_db0000_New Quotation - FE7191PO154.jbxd

Similarity

API ID: _free$_wcscmp$ErrorFreeHeapLast_fseek
String ID:
API String ID: 1552873950-0
Opcode ID: c040f5d591410a8d3afab51092a26b6f5939c84b98243336257d617f1f09bfd3
Instruction ID: 403166e37b69326ec9c2bda3635a63c93fd3351644acd3aa5c0ca411d47cefbd
Opcode Fuzzy Hash: c040f5d591410a8d3afab51092a26b6f5939c84b98243336257d617f1f09bfd3
Instruction Fuzzy Hash: F8514FB1D04218AFDF249F65DC41ADEBBB9EF48310F1004AEB609A7241DB715A80CF69

Function 00DD493A Relevance: 6.1, APIs: 4, Instructions: 136COMMON

Download Yara Rule

APIs

_memmove.LIBCMT ref: 00DD49D0
__flush.LIBCMT ref: 00DD49F0
__write.LIBCMT ref: 00DD4A23
__flsbuf.LIBCMT ref: 00DD4A51

Part of subcall function 00DD8D68: __getptd_noexit.LIBCMT ref: 00DD8D68

Memory Dump Source

Source File: 00000000.00000002.2103545536.0000000000DB1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00DB0000, based on PE: true

Associated: 00000000.00000002.2103534640.0000000000DB0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103580373.0000000000E3F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103580373.0000000000E65000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103609603.0000000000E6F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103621893.0000000000E78000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_db0000_New Quotation - FE7191PO154.jbxd

Similarity

API ID: __flsbuf__flush__getptd_noexit__write_memmove
String ID:
API String ID: 2782032738-0
Opcode ID: 6b900c82ae833c016f0ad4fafe5841f230cacf6ecaddb2f96621bb99e00bcb06
Instruction ID: 51a4515d72d387282f58712ee06fd2523e4045e48a0a0058c8f65d94ebc655fc
Opcode Fuzzy Hash: 6b900c82ae833c016f0ad4fafe5841f230cacf6ecaddb2f96621bb99e00bcb06
Instruction Fuzzy Hash: EC41D5706406069BDF28CFAAC8909AF77AAEF80364B28813FE855C7740D770DD408B74

Function 00DB4DD0 Relevance: 5.4, APIs: 1, Strings: 2, Instructions: 141COMMON

Download Yara Rule

APIs

_memmove.LIBCMT ref: 00DB4E1A

Strings

AU3!P/, xrefs: 00DB4E14
EA06, xrefs: 00DEDCF5

Memory Dump Source

Source File: 00000000.00000002.2103545536.0000000000DB1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00DB0000, based on PE: true

Associated: 00000000.00000002.2103534640.0000000000DB0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103580373.0000000000E3F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103580373.0000000000E65000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103609603.0000000000E6F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103621893.0000000000E78000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_db0000_New Quotation - FE7191PO154.jbxd

Similarity

API ID: _memmove
String ID: AU3!P/$EA06
API String ID: 4104443479-182974850
Opcode ID: a390387629a8b7b0c4733d6915d3d8dadddaa65684a1e4d8b91a150f47150228
Instruction ID: c4273c27a0216daac81bd45a7c768109d318c8227d97352d24f0aa675291ab32
Opcode Fuzzy Hash: a390387629a8b7b0c4733d6915d3d8dadddaa65684a1e4d8b91a150f47150228
Instruction Fuzzy Hash: 25415922A04154EBDF21DB6498617FE7FA6EF05300F6C4465F883AB287CA21DD4487B1

Function 00DB73E5 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 65COMMON

Download Yara Rule

APIs

_memset.LIBCMT ref: 00DEEE62
GetOpenFileNameW.COMDLG32(?), ref: 00DEEEAC

Part of subcall function 00DB48AE: GetFullPathNameW.KERNEL32(?,00007FFF,?,00000000,?,?,00DB48A1,?,?,00DB37C0,?), ref: 00DB48CE

Part of subcall function 00DD09D5: GetLongPathNameW.KERNELBASE(?,?,00007FFF), ref: 00DD09F4

Strings

X, xrefs: 00DEEE7A

Memory Dump Source

Source File: 00000000.00000002.2103545536.0000000000DB1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00DB0000, based on PE: true

Associated: 00000000.00000002.2103534640.0000000000DB0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103580373.0000000000E3F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103580373.0000000000E65000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103609603.0000000000E6F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103621893.0000000000E78000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_db0000_New Quotation - FE7191PO154.jbxd

Similarity

API ID: Name$Path$FileFullLongOpen_memset
String ID: X
API String ID: 3777226403-3081909835
Opcode ID: 6d90a90790129622427671c9a6ffbb7945b4abf5c3c489a1d8cb6e025f191016
Instruction ID: 9e845837a37c7d1871e9b3560074cec57413904ad273b3cb6386140589bf0d81
Opcode Fuzzy Hash: 6d90a90790129622427671c9a6ffbb7945b4abf5c3c489a1d8cb6e025f191016
Instruction Fuzzy Hash: D421A170A002989BCB11DF94C845BEE7BFC9F89714F04801AE409F7282DBB499898FB1

Function 00E1901B Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 51COMMON

Download Yara Rule

APIs

_memmove.LIBCMT ref: 00E19036
__fread_nolock.LIBCMT ref: 00E1904B

Strings

EA06, xrefs: 00E1907D

Memory Dump Source

Source File: 00000000.00000002.2103545536.0000000000DB1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00DB0000, based on PE: true

Associated: 00000000.00000002.2103534640.0000000000DB0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103580373.0000000000E3F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103580373.0000000000E65000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103609603.0000000000E6F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103621893.0000000000E78000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_db0000_New Quotation - FE7191PO154.jbxd

Similarity

API ID: __fread_nolock_memmove
String ID: EA06
API String ID: 1988441806-3962188686
Opcode ID: 54cf71aeeab781c0b32d3cdcec2e7332abf2a28f8f72601ce2ac72e11e6e4fd3
Instruction ID: 62404e1038df38ef296b71009ad0a3b39773352425409dd593345d9bbf4e3c6d
Opcode Fuzzy Hash: 54cf71aeeab781c0b32d3cdcec2e7332abf2a28f8f72601ce2ac72e11e6e4fd3
Instruction Fuzzy Hash: 2001B9719042587EDB28D6A8DC56EFEBBF8DB15301F00419BF552E2281E575A6049B70

Function 00E19B6D Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 16COMMON

Download Yara Rule

APIs

GetTempPathW.KERNEL32(00000104,?), ref: 00E19B82
GetTempFileNameW.KERNELBASE(?,aut,00000000,?), ref: 00E19B99

Strings

aut, xrefs: 00E19B93

Memory Dump Source

Source File: 00000000.00000002.2103545536.0000000000DB1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00DB0000, based on PE: true

Associated: 00000000.00000002.2103534640.0000000000DB0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103580373.0000000000E3F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103580373.0000000000E65000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103609603.0000000000E6F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103621893.0000000000E78000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_db0000_New Quotation - FE7191PO154.jbxd

Similarity

API ID: Temp$FileNamePath
String ID: aut
API String ID: 3285503233-3010740371
Opcode ID: 1909f62eb420000cf451bb16b49b7f617ee0e72b877a01b1faa84d5b39ba4dfc
Instruction ID: aab6523c6ed003cc5e5f1aa3ca78729221ddd1362469728e55e5988c66f2b588
Opcode Fuzzy Hash: 1909f62eb420000cf451bb16b49b7f617ee0e72b877a01b1faa84d5b39ba4dfc
Instruction Fuzzy Hash: D5D0177998030DABDA109A90AC0EF9ABB2CA704701F0042A1BA64A10A1EEB055988A91

Function 00E2CDF1 Relevance: 4.9, APIs: 3, Instructions: 392COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2103545536.0000000000DB1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00DB0000, based on PE: true

Associated: 00000000.00000002.2103534640.0000000000DB0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103580373.0000000000E3F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103580373.0000000000E65000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103609603.0000000000E6F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103621893.0000000000E78000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_db0000_New Quotation - FE7191PO154.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 05fceeabee190aec5a068a07da106074466af8cbc57f47015cd9c66f715bc124
Instruction ID: c1812573fbb977a5b76fb509361064dbd8787799fa09965f8516a3dbcb825515
Opcode Fuzzy Hash: 05fceeabee190aec5a068a07da106074466af8cbc57f47015cd9c66f715bc124
Instruction Fuzzy Hash: B2F15871608350DFC714DF28D880A6ABBE5FF88314F14992DF99AAB251D730E945CF92

Function 00DB43DB Relevance: 4.6, APIs: 3, Instructions: 77windowCOMMON

Download Yara Rule

APIs

_memset.LIBCMT ref: 00DB4401
Shell_NotifyIconW.SHELL32(00000000,?), ref: 00DB44A6
Shell_NotifyIconW.SHELL32(00000001,?), ref: 00DB44C3

Memory Dump Source

Source File: 00000000.00000002.2103545536.0000000000DB1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00DB0000, based on PE: true

Associated: 00000000.00000002.2103534640.0000000000DB0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103580373.0000000000E3F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103580373.0000000000E65000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103609603.0000000000E6F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103621893.0000000000E78000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_db0000_New Quotation - FE7191PO154.jbxd

Similarity

API ID: IconNotifyShell_$_memset
String ID:
API String ID: 1505330794-0
Opcode ID: 7707feec82da7878e49463af0e48508116e8574df4e4aeaff8f13eca1f449400
Instruction ID: 37745f947935e6ba82dc1f822943d2af179398cf2a196cdc3098a57944e6f681
Opcode Fuzzy Hash: 7707feec82da7878e49463af0e48508116e8574df4e4aeaff8f13eca1f449400
Instruction Fuzzy Hash: 13316170504741CFD760DF25D8847D7BBE8FB49308F04092EF59A93252D7B5A958CBA2

Function 00DD594C Relevance: 4.6, APIs: 3, Instructions: 59memoryCOMMONLIBRARYCODE

Download Yara Rule

APIs

__FF_MSGBANNER.LIBCMT ref: 00DD5963

Part of subcall function 00DDA3AB: __NMSG_WRITE.LIBCMT ref: 00DDA3D2
Part of subcall function 00DDA3AB: __NMSG_WRITE.LIBCMT ref: 00DDA3DC

__NMSG_WRITE.LIBCMT ref: 00DD596A

Part of subcall function 00DDA408: GetModuleFileNameW.KERNEL32(00000000,00E743BA,00000104,?,00000001,00000000), ref: 00DDA49A
Part of subcall function 00DDA408: ___crtMessageBoxW.LIBCMT ref: 00DDA548

Part of subcall function 00DD32DF: ___crtCorExitProcess.LIBCMT ref: 00DD32E5
Part of subcall function 00DD32DF: ExitProcess.KERNEL32 ref: 00DD32EE

Part of subcall function 00DD8D68: __getptd_noexit.LIBCMT ref: 00DD8D68

RtlAllocateHeap.NTDLL(00FB0000,00000000,00000001,00000000,?,?,?,00DD1013,?), ref: 00DD598F

Memory Dump Source

Source File: 00000000.00000002.2103545536.0000000000DB1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00DB0000, based on PE: true

Associated: 00000000.00000002.2103534640.0000000000DB0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103580373.0000000000E3F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103580373.0000000000E65000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103609603.0000000000E6F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103621893.0000000000E78000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_db0000_New Quotation - FE7191PO154.jbxd

Similarity

API ID: ExitProcess___crt$AllocateFileHeapMessageModuleName__getptd_noexit
String ID:
API String ID: 1372826849-0
Opcode ID: da41ac73d783e20474c070897a23cdbdb3dbd065146a60f6905b55343994121d
Instruction ID: 0c34e632910b017ecfa4d9cc292d0f4f861db4d8fd531a26e040f6cc8f6f61d1
Opcode Fuzzy Hash: da41ac73d783e20474c070897a23cdbdb3dbd065146a60f6905b55343994121d
Instruction Fuzzy Hash: D301F531241B15DEE6227B66FC62A2E7249CF51770F14002BF405AA3D1DF70DD418B75

Function 00E19B2C Relevance: 4.5, APIs: 3, Instructions: 24filetimeCOMMON

Download Yara Rule

APIs

CreateFileW.KERNELBASE(?,40000000,00000001,00000000,00000003,00000080,00000000,?,?,00E197D2,?,?,?,?,?,00000004), ref: 00E19B45
SetFileTime.KERNELBASE(00000000,?,00000000,?,?,00E197D2,?,?,?,?,?,00000004,00000001,?,?,00000004), ref: 00E19B5B
CloseHandle.KERNEL32(00000000,?,00E197D2,?,?,?,?,?,00000004,00000001,?,?,00000004,00000001,?,?), ref: 00E19B62

Memory Dump Source

Source File: 00000000.00000002.2103545536.0000000000DB1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00DB0000, based on PE: true

Associated: 00000000.00000002.2103534640.0000000000DB0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103580373.0000000000E3F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103580373.0000000000E65000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103609603.0000000000E6F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103621893.0000000000E78000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_db0000_New Quotation - FE7191PO154.jbxd

Similarity

API ID: File$CloseCreateHandleTime
String ID:
API String ID: 3397143404-0
Opcode ID: 9e80002c9f213457ed26f7057f3d3e32fe50b52ff1e2ee329eb62c360db37104
Instruction ID: 25ef95496966c419369bdee1b54498e3e3c920f15fb596a4bd1519dfe0405510
Opcode Fuzzy Hash: 9e80002c9f213457ed26f7057f3d3e32fe50b52ff1e2ee329eb62c360db37104
Instruction Fuzzy Hash: 90E08632581318BBD7211B55FC0DFDA7F68AB05765F104220FB64790E187B125159798

Function 00E18F97 Relevance: 4.5, APIs: 3, Instructions: 22COMMON

Download Yara Rule

APIs

_free.LIBCMT ref: 00E18FA5

Part of subcall function 00DD2F95: RtlFreeHeap.NTDLL(00000000,00000000,?,00DD9C64), ref: 00DD2FA9
Part of subcall function 00DD2F95: GetLastError.KERNEL32(00000000,?,00DD9C64), ref: 00DD2FBB

_free.LIBCMT ref: 00E18FB6
_free.LIBCMT ref: 00E18FC8

Memory Dump Source

Source File: 00000000.00000002.2103545536.0000000000DB1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00DB0000, based on PE: true

Associated: 00000000.00000002.2103534640.0000000000DB0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103580373.0000000000E3F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103580373.0000000000E65000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103609603.0000000000E6F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103621893.0000000000E78000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_db0000_New Quotation - FE7191PO154.jbxd

Similarity

API ID: _free$ErrorFreeHeapLast
String ID:
API String ID: 776569668-0
Opcode ID: 358057a8cee776a4634d1da6a11f7167cf7af4a4bc472a0de26b354d0d310ced
Instruction ID: 0a44cac538ed9a3116cdcbb6c31bfa64d5fecb6b2d1d0de0c71e0c2d9cfed8d7
Opcode Fuzzy Hash: 358057a8cee776a4634d1da6a11f7167cf7af4a4bc472a0de26b354d0d310ced
Instruction Fuzzy Hash: 1BE012B17097054ACA24A679AE40EE757EE9F4C3547181C1EB409EB242DF24E8828134

Function 00DBAB23 Relevance: 4.0, APIs: 1, Strings: 1, Instructions: 534COMMON

Download Yara Rule

Strings

CALL, xrefs: 00DF002B

Memory Dump Source

Source File: 00000000.00000002.2103545536.0000000000DB1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00DB0000, based on PE: true

Associated: 00000000.00000002.2103534640.0000000000DB0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103580373.0000000000E3F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103580373.0000000000E65000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103609603.0000000000E6F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103621893.0000000000E78000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_db0000_New Quotation - FE7191PO154.jbxd

Similarity

API ID:
String ID: CALL
API String ID: 0-4196123274
Opcode ID: 95055b08f9d5ea284c226c1f21da94c34a0da6a07275ef0435a76b1adc4c93a3
Instruction ID: c7cc00c7409aa0d0e066506acc43bdf810f85b1ae77a99f212eced1dee092056
Opcode Fuzzy Hash: 95055b08f9d5ea284c226c1f21da94c34a0da6a07275ef0435a76b1adc4c93a3
Instruction Fuzzy Hash: 60223774508341DFC724DF18C494BAABBE1FF85300F19895DE89A9B262D771EC85CBA2

Function 00DB492E Relevance: 3.1, APIs: 2, Instructions: 59COMMON

Download Yara Rule

APIs

IsThemeActive.UXTHEME ref: 00DB4992

Part of subcall function 00DD35AC: __lock.LIBCMT ref: 00DD35B2
Part of subcall function 00DD35AC: DecodePointer.KERNEL32(00000001,?,00DB49A7,00E081BC), ref: 00DD35BE
Part of subcall function 00DD35AC: EncodePointer.KERNEL32(?,?,00DB49A7,00E081BC), ref: 00DD35C9

Part of subcall function 00DB4A5B: SystemParametersInfoW.USER32(00002000,00000000,?,00000000), ref: 00DB4A73
Part of subcall function 00DB4A5B: SystemParametersInfoW.USER32(00002001,00000000,00000000,00000002), ref: 00DB4A88

Part of subcall function 00DB3B4C: GetCurrentDirectoryW.KERNEL32(00007FFF,?), ref: 00DB3B7A
Part of subcall function 00DB3B4C: IsDebuggerPresent.KERNEL32 ref: 00DB3B8C
Part of subcall function 00DB3B4C: GetFullPathNameW.KERNEL32(00007FFF,?,?,00E762F8,00E762E0,?,?), ref: 00DB3BFD
Part of subcall function 00DB3B4C: SetCurrentDirectoryW.KERNEL32(?), ref: 00DB3C81

SystemParametersInfoW.USER32(00002001,00000000,00000000,00000002), ref: 00DB49D2

Memory Dump Source

Source File: 00000000.00000002.2103545536.0000000000DB1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00DB0000, based on PE: true

Associated: 00000000.00000002.2103534640.0000000000DB0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103580373.0000000000E3F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103580373.0000000000E65000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103609603.0000000000E6F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103621893.0000000000E78000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_db0000_New Quotation - FE7191PO154.jbxd

Similarity

API ID: InfoParametersSystem$CurrentDirectoryPointer$ActiveDebuggerDecodeEncodeFullNamePathPresentTheme__lock
String ID:
API String ID: 1438897964-0
Opcode ID: b59c02b5fdd83de8312f5746980bf22a7aefa4d6ea4d39c39f37fe04525020fb
Instruction ID: 77a857c50a978c3b753cd62332df99649fa99df1f53c29d8849e4f5530a21edf
Opcode Fuzzy Hash: b59c02b5fdd83de8312f5746980bf22a7aefa4d6ea4d39c39f37fe04525020fb
Instruction Fuzzy Hash: 98119D719183519FC700DF2AEC0594AFFE8EF95710F00451EF19AA72B2DB709588CBA6

Function 00DB5DF9 Relevance: 3.1, APIs: 2, Instructions: 57fileCOMMON

Download Yara Rule

APIs

CreateFileW.KERNELBASE(?,80000000,00000007,00000000,00000003,00000080,00000000,?,00000000,?,00DB5981,?,?,?,?), ref: 00DB5E27
CreateFileW.KERNEL32(?,C0000000,00000007,00000000,00000004,00000080,00000000,?,00000000,?,00DB5981,?,?,?,?), ref: 00DEE19C

Memory Dump Source

Source File: 00000000.00000002.2103545536.0000000000DB1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00DB0000, based on PE: true

Associated: 00000000.00000002.2103534640.0000000000DB0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103580373.0000000000E3F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103580373.0000000000E65000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103609603.0000000000E6F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103621893.0000000000E78000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_db0000_New Quotation - FE7191PO154.jbxd

Similarity

API ID: CreateFile
String ID:
API String ID: 823142352-0
Opcode ID: 05e6f458238db5e2b0fd067324aa3bd27e6050d0b10312b9a762f9698d9ab330
Instruction ID: 5e1b178107c4eacd3d6cac37135f08045865ebe038e396bf637e2b13240d4c40
Opcode Fuzzy Hash: 05e6f458238db5e2b0fd067324aa3bd27e6050d0b10312b9a762f9698d9ab330
Instruction Fuzzy Hash: 6E019670244708FEF3251E14DC8AFB67BDCEB05768F148314FAE66A1D0C6B05E458B60

Function 00DD0FF6 Relevance: 3.0, APIs: 2, Instructions: 44COMMONLIBRARYCODE

Download Yara Rule

APIs

Part of subcall function 00DD594C: __FF_MSGBANNER.LIBCMT ref: 00DD5963
Part of subcall function 00DD594C: __NMSG_WRITE.LIBCMT ref: 00DD596A
Part of subcall function 00DD594C: RtlAllocateHeap.NTDLL(00FB0000,00000000,00000001,00000000,?,?,?,00DD1013,?), ref: 00DD598F

std::exception::exception.LIBCMT ref: 00DD102C
__CxxThrowException@8.LIBCMT ref: 00DD1041

Part of subcall function 00DD87DB: RaiseException.KERNEL32(?,?,?,00E6BAF8,00000000,?,?,?,?,00DD1046,?,00E6BAF8,?,00000001), ref: 00DD8830

Memory Dump Source

Source File: 00000000.00000002.2103545536.0000000000DB1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00DB0000, based on PE: true

Associated: 00000000.00000002.2103534640.0000000000DB0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103580373.0000000000E3F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103580373.0000000000E65000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103609603.0000000000E6F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103621893.0000000000E78000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_db0000_New Quotation - FE7191PO154.jbxd

Similarity

API ID: AllocateExceptionException@8HeapRaiseThrowstd::exception::exception
String ID:
API String ID: 3902256705-0
Opcode ID: 36c80f2f93f54b242e971a99100ed8bcea8d595d5515451c472a6422f7bdf301
Instruction ID: 7fc5f7a7fb73ad46c4f35e1abaf7b260cc4286cbe798e361c4d3d56cc82a1514
Opcode Fuzzy Hash: 36c80f2f93f54b242e971a99100ed8bcea8d595d5515451c472a6422f7bdf301
Instruction Fuzzy Hash: 07F0A439540219B7CB21BA98FC069EF7BACDF00761F50042BF904A6791DFB18A8496B5

Function 00DD582D Relevance: 3.0, APIs: 2, Instructions: 42COMMONLIBRARYCODE

Download Yara Rule

APIs

_memset.LIBCMT ref: 00DD585C
__lock_file.LIBCMT ref: 00DD587D

Memory Dump Source

Source File: 00000000.00000002.2103545536.0000000000DB1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00DB0000, based on PE: true

Associated: 00000000.00000002.2103534640.0000000000DB0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103580373.0000000000E3F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103580373.0000000000E65000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103609603.0000000000E6F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103621893.0000000000E78000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_db0000_New Quotation - FE7191PO154.jbxd

Similarity

API ID: __lock_file_memset
String ID:
API String ID: 26237723-0
Opcode ID: cac2b8681814f5fcb3d0d047d34b659e7f3578f8ccb629557978d2853348cd06
Instruction ID: 06a8d34bc67a295b5c7fea6465a0433d9ef801e90f2ff798bb4a07197853909d
Opcode Fuzzy Hash: cac2b8681814f5fcb3d0d047d34b659e7f3578f8ccb629557978d2853348cd06
Instruction Fuzzy Hash: B1014471800609EBCF12AF69DC0699E7B65EF40360F198217F8245A3A5DB31CA51FBB1

Function 00DD55D6 Relevance: 3.0, APIs: 2, Instructions: 33COMMONLIBRARYCODE

Download Yara Rule

APIs

Part of subcall function 00DD8D68: __getptd_noexit.LIBCMT ref: 00DD8D68

__lock_file.LIBCMT ref: 00DD561B

Part of subcall function 00DD6E4E: __lock.LIBCMT ref: 00DD6E71

__fclose_nolock.LIBCMT ref: 00DD5626

Memory Dump Source

Source File: 00000000.00000002.2103545536.0000000000DB1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00DB0000, based on PE: true

Associated: 00000000.00000002.2103534640.0000000000DB0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103580373.0000000000E3F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103580373.0000000000E65000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103609603.0000000000E6F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103621893.0000000000E78000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_db0000_New Quotation - FE7191PO154.jbxd

Similarity

API ID: __fclose_nolock__getptd_noexit__lock__lock_file
String ID:
API String ID: 2800547568-0
Opcode ID: 7a340a15d9d9f374030eae5f0cb3579b90299f452185d30297de9230b54173fc
Instruction ID: 8f389ae79c0b63ffefb57a91771b5b8fb4a6977a5c4c1a2a810cfa0e030cbd95
Opcode Fuzzy Hash: 7a340a15d9d9f374030eae5f0cb3579b90299f452185d30297de9230b54173fc
Instruction Fuzzy Hash: CAF0BB71840B049AD7217F79A80275E77A19F41374F558207F465AB3C5CF7CC9019B75

Function 0304129D Relevance: 1.9, APIs: 1, Instructions: 400processthreadCOMMON

Download Yara Rule

APIs

CreateProcessW.KERNELBASE(?,00000000), ref: 03041A5B
Wow64GetThreadContext.KERNEL32(?,00010007), ref: 03041AF1
ReadProcessMemory.KERNELBASE(?,?,?,00000004,00000000), ref: 03041B13

Memory Dump Source

Source File: 00000000.00000002.2103783677.0000000003040000.00000040.00001000.00020000.00000000.sdmp, Offset: 03040000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_3040000_New Quotation - FE7191PO154.jbxd

Similarity

API ID: Process$ContextCreateMemoryReadThreadWow64
String ID:
API String ID: 2438371351-0
Opcode ID: 45c0bcdfd50c24934144be52d4489c8f4aeee23b26077383fd0484b0fd6f3e51
Instruction ID: b2db96474e39d17f4719f8af3f165efb6d795a4bd8a731e98c8cea5c9f3494a4
Opcode Fuzzy Hash: 45c0bcdfd50c24934144be52d4489c8f4aeee23b26077383fd0484b0fd6f3e51
Instruction Fuzzy Hash: EB12DE24E24658C6EB24DF60D8507DEB272EF68300F1090E9910DEB7A5E77A4F81CF5A

Function 00DBF3F0 Relevance: 1.7, APIs: 1, Instructions: 185COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2103545536.0000000000DB1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00DB0000, based on PE: true

Associated: 00000000.00000002.2103534640.0000000000DB0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103580373.0000000000E3F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103580373.0000000000E65000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103609603.0000000000E6F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103621893.0000000000E78000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_db0000_New Quotation - FE7191PO154.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b8204ffb721d0b8cf222ee1075889514ca900138ea801adf5dbf1a3c19d7f749
Instruction ID: 81a2d2b09b3fa98ce04524e663520c7079c885a71e4b2e4564c9eef5ac6d0b7b
Opcode Fuzzy Hash: b8204ffb721d0b8cf222ee1075889514ca900138ea801adf5dbf1a3c19d7f749
Instruction Fuzzy Hash: F661787460020ADFDB20EF64C991ABBB7E5EF49300F188479EA479B241E771ED51CBA1

Function 00DC2123 Relevance: 1.7, APIs: 1, Instructions: 171COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2103545536.0000000000DB1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00DB0000, based on PE: true

Associated: 00000000.00000002.2103534640.0000000000DB0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103580373.0000000000E3F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103580373.0000000000E65000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103609603.0000000000E6F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103621893.0000000000E78000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_db0000_New Quotation - FE7191PO154.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f888a73a01c3bd74e46f385ad7cd492500fdecaad020f888c1fb1f901869ce67
Instruction ID: f8afb880765ae72bd5d237dd6ea7c19ea2b3bd37dd6092e912ce9ec1d8fcc3c9
Opcode Fuzzy Hash: f888a73a01c3bd74e46f385ad7cd492500fdecaad020f888c1fb1f901869ce67
Instruction Fuzzy Hash: E5515E35600605EBCF14EB64C991FBEB7A6EF85310F198168F946AB396CB30ED048B75

Function 00DB5C4E Relevance: 1.6, APIs: 1, Instructions: 97COMMON

Download Yara Rule

APIs

SetFilePointerEx.KERNELBASE(?,?,00000001,00000000,00000000,?,?,00000000), ref: 00DB5CF6

Memory Dump Source

Source File: 00000000.00000002.2103545536.0000000000DB1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00DB0000, based on PE: true

Associated: 00000000.00000002.2103534640.0000000000DB0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103580373.0000000000E3F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103580373.0000000000E65000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103609603.0000000000E6F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103621893.0000000000E78000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_db0000_New Quotation - FE7191PO154.jbxd

Similarity

API ID: FilePointer
String ID:
API String ID: 973152223-0
Opcode ID: d4f6e179bb3f384b4f269016e5222dc7b11375686e5609b1c1858d967800ec48
Instruction ID: aab1f0d6bff1fb6a79023c6bfad3cb327fc7ec9627a52f0d66c1c8147ccfe6b6
Opcode Fuzzy Hash: d4f6e179bb3f384b4f269016e5222dc7b11375686e5609b1c1858d967800ec48
Instruction Fuzzy Hash: A9313D71A00B09EBCB18DF29D48479DBBB6FF48310F188619D81A93754D771A950DBA0

Function 00DF00D6 Relevance: 1.6, APIs: 1, Instructions: 88COMMON

Download Yara Rule

APIs

VariantClear.OLEAUT32 ref: 00DF00E1

Memory Dump Source

Source File: 00000000.00000002.2103545536.0000000000DB1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00DB0000, based on PE: true

Associated: 00000000.00000002.2103534640.0000000000DB0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103580373.0000000000E3F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103580373.0000000000E65000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103609603.0000000000E6F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103621893.0000000000E78000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_db0000_New Quotation - FE7191PO154.jbxd

Similarity

API ID: ClearVariant
String ID:
API String ID: 1473721057-0
Opcode ID: 87e95d9bbb88ec48af4eb9360be9bfb18c35b4951569206d6b0fa0b8d4e7fd23
Instruction ID: d36a7e960182a75366f93ee159d83aa47b4d415cbd04effe759ac28d227573c0
Opcode Fuzzy Hash: 87e95d9bbb88ec48af4eb9360be9bfb18c35b4951569206d6b0fa0b8d4e7fd23
Instruction Fuzzy Hash: 84410474604341DFDB24DF18C484B6ABBE0AF45318F09889CE98A8B362C772EC45CB62

Function 00DB5B19 Relevance: 1.6, APIs: 1, Instructions: 72COMMON

Download Yara Rule

APIs

_memmove.LIBCMT ref: 00DB5B61

Memory Dump Source

Source File: 00000000.00000002.2103545536.0000000000DB1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00DB0000, based on PE: true

Associated: 00000000.00000002.2103534640.0000000000DB0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103580373.0000000000E3F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103580373.0000000000E65000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103609603.0000000000E6F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103621893.0000000000E78000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_db0000_New Quotation - FE7191PO154.jbxd

Similarity

API ID: _memmove
String ID:
API String ID: 4104443479-0
Opcode ID: 4571315d0a9bb4359420e8d281eab6ab4d5a0071ea703f077da96249364c6918
Instruction ID: 515b37c7906ccdf2af6af3540b52532c5fa1026071b83d1bf4592a7865cb76e3
Opcode Fuzzy Hash: 4571315d0a9bb4359420e8d281eab6ab4d5a0071ea703f077da96249364c6918
Instruction Fuzzy Hash: 5621D230A00A08EBDF106F56F8857AA7FF8FF14390F21846AE486D5114EBB194E4D775

Function 00DB4F3D Relevance: 1.6, APIs: 1, Instructions: 64libraryCOMMON

Download Yara Rule

APIs

Part of subcall function 00DB4D13: FreeLibrary.KERNEL32(00000000,?), ref: 00DB4D4D

Part of subcall function 00DD548B: __wfsopen.LIBCMT ref: 00DD5496

LoadLibraryExW.KERNELBASE(?,00000000,00000002,?,00E762F8,00000001,>>>AUTOIT NO CMDEXECUTE<<<,?), ref: 00DB4F6F

Part of subcall function 00DB4CC8: FreeLibrary.KERNEL32(00000000), ref: 00DB4D02

Part of subcall function 00DB4DD0: _memmove.LIBCMT ref: 00DB4E1A

Memory Dump Source

Source File: 00000000.00000002.2103545536.0000000000DB1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00DB0000, based on PE: true

Associated: 00000000.00000002.2103534640.0000000000DB0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103580373.0000000000E3F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103580373.0000000000E65000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103609603.0000000000E6F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103621893.0000000000E78000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_db0000_New Quotation - FE7191PO154.jbxd

Similarity

API ID: Library$Free$Load__wfsopen_memmove
String ID:
API String ID: 1396898556-0
Opcode ID: 234413dfb53905e9427531e22d233ab631aa223477a5e8454be8dc5a7d6229f5
Instruction ID: 2c8b07ff9aaed19df699bdad258196e85335eeb8a4d2889eb57a6c928ad2dff8
Opcode Fuzzy Hash: 234413dfb53905e9427531e22d233ab631aa223477a5e8454be8dc5a7d6229f5
Instruction Fuzzy Hash: 0911C131A00309EACB10FF70DC16BEE77A9DF84701F108429F542A7283DE719A059BB1

Function 00DF01AF Relevance: 1.6, APIs: 1, Instructions: 63COMMON

Download Yara Rule

APIs

VariantClear.OLEAUT32(?), ref: 00DF01BB

Memory Dump Source

Source File: 00000000.00000002.2103545536.0000000000DB1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00DB0000, based on PE: true

Associated: 00000000.00000002.2103534640.0000000000DB0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103580373.0000000000E3F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103580373.0000000000E65000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103609603.0000000000E6F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103621893.0000000000E78000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_db0000_New Quotation - FE7191PO154.jbxd

Similarity

API ID: ClearVariant
String ID:
API String ID: 1473721057-0
Opcode ID: ee1142c9a190ff4fbecdbedfc0f34dd4c56ceacd3b100571225c878b2aa2e3cf
Instruction ID: 0a2ae79918a1e41754aaa225da637d898b6a8c52e7098794663adb8a13a92b39
Opcode Fuzzy Hash: ee1142c9a190ff4fbecdbedfc0f34dd4c56ceacd3b100571225c878b2aa2e3cf
Instruction Fuzzy Hash: 3D210474A08341DFCB14DF18C445A6ABBE0FF84704F098968F98A57722D731E849CB62

Function 00DB5D20 Relevance: 1.6, APIs: 1, Instructions: 53fileCOMMON

Download Yara Rule

APIs

ReadFile.KERNELBASE(?,?,00010000,?,00000000,00000000,?,00010000,?,00DB5807,00000000,00010000,00000000,00000000,00000000,00000000), ref: 00DB5D76

Memory Dump Source

Source File: 00000000.00000002.2103545536.0000000000DB1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00DB0000, based on PE: true

Associated: 00000000.00000002.2103534640.0000000000DB0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103580373.0000000000E3F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103580373.0000000000E65000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103609603.0000000000E6F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103621893.0000000000E78000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_db0000_New Quotation - FE7191PO154.jbxd

Similarity

API ID: FileRead
String ID:
API String ID: 2738559852-0
Opcode ID: a9d84a3f66523f7b00ce351cc20535e7c7c28b1c373db6ebd03a90efbacf0ed2
Instruction ID: f58fc4f01ab5ce3277819718573364069c8a10f0ce023aa0a5758ef1adb9a584
Opcode Fuzzy Hash: a9d84a3f66523f7b00ce351cc20535e7c7c28b1c373db6ebd03a90efbacf0ed2
Instruction Fuzzy Hash: F9110631200B05DFD3308F15E888BA6B7E9EF45760F14CA2EE5AB86A54D7B1E945CB60

Function 00DB5BDA Relevance: 1.5, APIs: 1, Instructions: 48COMMON

Download Yara Rule

APIs

_memmove.LIBCMT ref: 00DEE141

Memory Dump Source

Source File: 00000000.00000002.2103545536.0000000000DB1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00DB0000, based on PE: true

Associated: 00000000.00000002.2103534640.0000000000DB0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103580373.0000000000E3F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103580373.0000000000E65000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103609603.0000000000E6F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103621893.0000000000E78000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_db0000_New Quotation - FE7191PO154.jbxd

Similarity

API ID: _memmove
String ID:
API String ID: 4104443479-0
Opcode ID: 9b54afcf07a23b9ff4e0bf05bec20c5cd47f57aecc711df460a32f44145caaaf
Instruction ID: 31c3ef3db1a07d6e43201d7e462fa37d5aa1df88cfd36069ff08c2506ca2fadc
Opcode Fuzzy Hash: 9b54afcf07a23b9ff4e0bf05bec20c5cd47f57aecc711df460a32f44145caaaf
Instruction Fuzzy Hash: 83018FB9600642AFC305EB69D841E66FBA9FF8A3107148159F819C7702DB30EC21CBF0

Function 00DD4A93 Relevance: 1.5, APIs: 1, Instructions: 36COMMON

Download Yara Rule

APIs

__lock_file.LIBCMT ref: 00DD4AD6

Part of subcall function 00DD8D68: __getptd_noexit.LIBCMT ref: 00DD8D68

Memory Dump Source

Source File: 00000000.00000002.2103545536.0000000000DB1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00DB0000, based on PE: true

Associated: 00000000.00000002.2103534640.0000000000DB0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103580373.0000000000E3F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103580373.0000000000E65000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103609603.0000000000E6F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103621893.0000000000E78000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_db0000_New Quotation - FE7191PO154.jbxd

Similarity

API ID: __getptd_noexit__lock_file
String ID:
API String ID: 2597487223-0
Opcode ID: 03783bc402692f09e960dd3a665cb01ea3c5063a81a0f8f7ee9fb51e0de20461
Instruction ID: 36b29ef047bc2c32b39cf87f4f7c7cadfa23f00f51f4bc03602ff960ef9009ae
Opcode Fuzzy Hash: 03783bc402692f09e960dd3a665cb01ea3c5063a81a0f8f7ee9fb51e0de20461
Instruction Fuzzy Hash: 7BF08C31940209ABDB62AF65CC0639E36A5EF00329F198516B424AA2D1DB788A50EF71

Function 00DB4FAA Relevance: 1.5, APIs: 1, Instructions: 28COMMON

Download Yara Rule

APIs

FreeLibrary.KERNEL32(?,?,00E762F8,00000001,>>>AUTOIT NO CMDEXECUTE<<<,?), ref: 00DB4FDE

Memory Dump Source

Source File: 00000000.00000002.2103545536.0000000000DB1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00DB0000, based on PE: true

Associated: 00000000.00000002.2103534640.0000000000DB0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103580373.0000000000E3F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103580373.0000000000E65000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103609603.0000000000E6F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103621893.0000000000E78000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_db0000_New Quotation - FE7191PO154.jbxd

Similarity

API ID: FreeLibrary
String ID:
API String ID: 3664257935-0
Opcode ID: 3e55577daaba46858ebe9ce2c3691aec7da0adfd2c9ef040950b4a23c54c07db
Instruction ID: 049a3eb2d43a1dad83140df72a1a87719a8ff32cc85dd6753cea043f1e49c293
Opcode Fuzzy Hash: 3e55577daaba46858ebe9ce2c3691aec7da0adfd2c9ef040950b4a23c54c07db
Instruction Fuzzy Hash: 95F03971505712CFCB34DF65E4948A2BBE1BF083293248A3EE1D783612CB71A844DF60

Function 00DD09D5 Relevance: 1.5, APIs: 1, Instructions: 24COMMON

Download Yara Rule

APIs

GetLongPathNameW.KERNELBASE(?,?,00007FFF), ref: 00DD09F4

Part of subcall function 00DB7D2C: _memmove.LIBCMT ref: 00DB7D66

Memory Dump Source

Source File: 00000000.00000002.2103545536.0000000000DB1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00DB0000, based on PE: true

Associated: 00000000.00000002.2103534640.0000000000DB0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103580373.0000000000E3F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103580373.0000000000E65000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103609603.0000000000E6F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103621893.0000000000E78000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_db0000_New Quotation - FE7191PO154.jbxd

Similarity

API ID: LongNamePath_memmove
String ID:
API String ID: 2514874351-0
Opcode ID: 7b8e57c17b091ea779c139ed125b3e5fe21d68b1fc193cf8260f73700659e582
Instruction ID: b1097c70497ee5684d48d21e64e8ef132de9aee2adaed0b258260a3b4311f414
Opcode Fuzzy Hash: 7b8e57c17b091ea779c139ed125b3e5fe21d68b1fc193cf8260f73700659e582
Instruction Fuzzy Hash: DAE08636E042289BC720E659DC05FFA77ADDF89690F0401B5FC0CD7254D9609C8186A0

Function 00E19129 Relevance: 1.5, APIs: 1, Instructions: 22COMMON

Download Yara Rule

APIs

__fread_nolock.LIBCMT ref: 00E1914B

Memory Dump Source

Source File: 00000000.00000002.2103545536.0000000000DB1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00DB0000, based on PE: true

Associated: 00000000.00000002.2103534640.0000000000DB0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103580373.0000000000E3F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103580373.0000000000E65000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103609603.0000000000E6F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103621893.0000000000E78000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_db0000_New Quotation - FE7191PO154.jbxd

Similarity

API ID: __fread_nolock
String ID:
API String ID: 2638373210-0
Opcode ID: 7603a7e23398706fbe611478ecf9e3358d47b441acc83f726054c373298f7434
Instruction ID: b6fef3a3b81123ee4382a6933cb7995ebd7a00e2e8b4072093ddefe3d7946bef
Opcode Fuzzy Hash: 7603a7e23398706fbe611478ecf9e3358d47b441acc83f726054c373298f7434
Instruction Fuzzy Hash: 28E092B1204B005FD7348A24D810BE373E0EB06319F00081DF2DA93342EB6278818759

Function 00DB5DAE Relevance: 1.5, APIs: 1, Instructions: 16COMMON

Download Yara Rule

APIs

SetFilePointerEx.KERNELBASE(?,00000000,00000000,?,00000001,?,?,?,00DEE16B,?,?,00000000), ref: 00DB5DBF

Memory Dump Source

Source File: 00000000.00000002.2103545536.0000000000DB1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00DB0000, based on PE: true

Associated: 00000000.00000002.2103534640.0000000000DB0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103580373.0000000000E3F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103580373.0000000000E65000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103609603.0000000000E6F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103621893.0000000000E78000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_db0000_New Quotation - FE7191PO154.jbxd

Similarity

API ID: FilePointer
String ID:
API String ID: 973152223-0
Opcode ID: 19b1eec67a7f61517e69670b652d01e0552d98e99fa4eb2e43d1e8bc5b41a0dc
Instruction ID: 64647a2519f553d9e759ea8a87869a11bbc55671fab6ac98e50cc4792607eeb6
Opcode Fuzzy Hash: 19b1eec67a7f61517e69670b652d01e0552d98e99fa4eb2e43d1e8bc5b41a0dc
Instruction Fuzzy Hash: A4D0C77464020CBFE710DB81DC46FA97BBCD705710F100294FD0466290D6F27D548795

Function 00DD548B Relevance: 1.5, APIs: 1, Instructions: 9COMMON

Download Yara Rule

APIs

__wfsopen.LIBCMT ref: 00DD5496

Memory Dump Source

Source File: 00000000.00000002.2103545536.0000000000DB1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00DB0000, based on PE: true

Associated: 00000000.00000002.2103534640.0000000000DB0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103580373.0000000000E3F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103580373.0000000000E65000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103609603.0000000000E6F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103621893.0000000000E78000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_db0000_New Quotation - FE7191PO154.jbxd

Similarity

API ID: __wfsopen
String ID:
API String ID: 197181222-0
Opcode ID: 6ddf6e1ab81d7b85eaff3423c11cf18e9f26fa56f97d638f5b10e7f164e3c6f3
Instruction ID: e99affe6c373cb2789816aae53f19b72078613052c2bd4c633dbde1d8cec9f40
Opcode Fuzzy Hash: 6ddf6e1ab81d7b85eaff3423c11cf18e9f26fa56f97d638f5b10e7f164e3c6f3
Instruction Fuzzy Hash: 43B0927684020C77DE112E82FC02A593B199B40679F808021FB0C18262A673A6A096AA

Function 00DF220E Relevance: 1.5, APIs: 1, Instructions: 7COMMON

Download Yara Rule

APIs

GetTempPathW.KERNEL32(00000104,?), ref: 00DF221A

Memory Dump Source

Source File: 00000000.00000002.2103545536.0000000000DB1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00DB0000, based on PE: true

Associated: 00000000.00000002.2103534640.0000000000DB0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103580373.0000000000E3F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103580373.0000000000E65000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103609603.0000000000E6F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103621893.0000000000E78000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_db0000_New Quotation - FE7191PO154.jbxd

Similarity

API ID: PathTemp
String ID:
API String ID: 2920410445-0
Opcode ID: d2587227563240f673f74011fce32936bbdc7ecb97793a611dab5d42f5cb892a
Instruction ID: d3120f4b27c69b315b42165fd55adfc82a5b729011d5c5a0f9281e1a154fbbab
Opcode Fuzzy Hash: d2587227563240f673f74011fce32936bbdc7ecb97793a611dab5d42f5cb892a
Instruction Fuzzy Hash: DEC04C7485401DDFEB15A750CC95AB9762CEF01701F1040D5B6459515095B05B44CE31

Function 00E1D2E6 Relevance: 1.4, APIs: 1, Instructions: 198COMMON

Download Yara Rule

APIs

GetLastError.KERNEL32(00000002,00000000), ref: 00E1D46A

Memory Dump Source

Source File: 00000000.00000002.2103545536.0000000000DB1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00DB0000, based on PE: true

Associated: 00000000.00000002.2103534640.0000000000DB0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103580373.0000000000E3F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103580373.0000000000E65000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103609603.0000000000E6F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103621893.0000000000E78000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_db0000_New Quotation - FE7191PO154.jbxd

Similarity

API ID: ErrorLast
String ID:
API String ID: 1452528299-0
Opcode ID: ef12e7705a926443a3db37c3d180b8a0695a77398eb566ae85eb31a360db3a27
Instruction ID: f82212c1074bb09a3cda4c896517aea42514e4d4da557d553310e96f43c11261
Opcode Fuzzy Hash: ef12e7705a926443a3db37c3d180b8a0695a77398eb566ae85eb31a360db3a27
Instruction Fuzzy Hash: E2713034208341DFC714EF24D891AEEB7E5EF88314F04556DF596AB2A2DB30E949CB62

Function 00DD0E48 Relevance: 1.3, APIs: 1, Instructions: 94memoryCOMMON

Download Yara Rule

APIs

VirtualAlloc.KERNELBASE ref: 00DD0EF7

Memory Dump Source

Source File: 00000000.00000002.2103545536.0000000000DB1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00DB0000, based on PE: true

Associated: 00000000.00000002.2103534640.0000000000DB0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103580373.0000000000E3F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103580373.0000000000E65000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103609603.0000000000E6F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103621893.0000000000E78000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_db0000_New Quotation - FE7191PO154.jbxd

Similarity

API ID: AllocVirtual
String ID:
API String ID: 4275171209-0
Opcode ID: 160be14eaa7db79452b6aeb530136e2f2731e3e0b6e758b09a27e7bca35b483d
Instruction ID: 65a8874955dce3cce5f1359d8d738d7e5881881f3b1fc460dfb6f1dbbda6277b
Opcode Fuzzy Hash: 160be14eaa7db79452b6aeb530136e2f2731e3e0b6e758b09a27e7bca35b483d
Instruction Fuzzy Hash: 3531B271A00105DBC718DF59D480A69FBA6FF99310F688AA6E44ACB751DB31EDC1CBE0

Function 030422A0 Relevance: 1.3, APIs: 1, Instructions: 18sleepCOMMON

Download Yara Rule

APIs

Sleep.KERNELBASE(000001F4), ref: 030422B1

Memory Dump Source

Source File: 00000000.00000002.2103783677.0000000003040000.00000040.00001000.00020000.00000000.sdmp, Offset: 03040000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_3040000_New Quotation - FE7191PO154.jbxd

Similarity

API ID: Sleep
String ID:
API String ID: 3472027048-0
Opcode ID: 368835ae2f5fba710e6c01549c2017e46dd928bc4d187f44ede00cceab054826
Instruction ID: d668eca4f08a61279d4ee9fb1f1137c1989e0bdb66c67398174e59f296caaf5f
Opcode Fuzzy Hash: 368835ae2f5fba710e6c01549c2017e46dd928bc4d187f44ede00cceab054826
Instruction Fuzzy Hash: 68E0E67494110EEFDB00EFB8D64969E7FB4EF04301F1005A1FD01D2280D6309E508A72

Non-executed Functions

Function 00E3CDAC Relevance: 75.9, APIs: 40, Strings: 3, Instructions: 637windowkeyboardCOMMON

Download Yara Rule

APIs

Part of subcall function 00DB2612: GetWindowLongW.USER32(?,000000EB), ref: 00DB2623

DefDlgProcW.USER32(?,0000004E,?,?,?,?,?,?), ref: 00E3CE50
SendMessageW.USER32(?,0000130B,00000000,00000000), ref: 00E3CE91
GetWindowLongW.USER32(FFFFFDD9,000000F0), ref: 00E3CED6
SendMessageW.USER32(?,0000110A,00000009,00000000), ref: 00E3CF00
SendMessageW.USER32 ref: 00E3CF29
_wcsncpy.LIBCMT ref: 00E3CFA1
GetKeyState.USER32(00000011), ref: 00E3CFC2
GetKeyState.USER32(00000009), ref: 00E3CFCF
SendMessageW.USER32(?,0000130B,00000000,00000000), ref: 00E3CFE5
GetKeyState.USER32(00000010), ref: 00E3CFEF
SendMessageW.USER32(?,0000110A,00000009,00000000), ref: 00E3D018
SendMessageW.USER32 ref: 00E3D03F
SendMessageW.USER32(?,00001030,?,00E3B602), ref: 00E3D145
ImageList_SetDragCursorImage.COMCTL32(00000000,00000000,00000000,?,?,?), ref: 00E3D15B
ImageList_BeginDrag.COMCTL32(00000000,000000F8,000000F0), ref: 00E3D16E
SetCapture.USER32(?), ref: 00E3D177
ClientToScreen.USER32(?,?), ref: 00E3D1DC
ImageList_DragEnter.COMCTL32(00000000,?,?), ref: 00E3D1E9
InvalidateRect.USER32(?,00000000,00000001,?,?,?), ref: 00E3D203
ReleaseCapture.USER32 ref: 00E3D20E
GetCursorPos.USER32(?), ref: 00E3D248
ScreenToClient.USER32(?,?), ref: 00E3D255
SendMessageW.USER32(?,00001012,00000000,?), ref: 00E3D2B1
SendMessageW.USER32 ref: 00E3D2DF
SendMessageW.USER32(?,00001111,00000000,?), ref: 00E3D31C
SendMessageW.USER32 ref: 00E3D34B
SendMessageW.USER32(?,0000110B,00000009,00000000), ref: 00E3D36C
SendMessageW.USER32(?,0000110B,00000009,?), ref: 00E3D37B
GetCursorPos.USER32(?), ref: 00E3D39B
ScreenToClient.USER32(?,?), ref: 00E3D3A8
GetParent.USER32(?), ref: 00E3D3C8
SendMessageW.USER32(?,00001012,00000000,?), ref: 00E3D431
SendMessageW.USER32 ref: 00E3D462
ClientToScreen.USER32(?,?), ref: 00E3D4C0
TrackPopupMenuEx.USER32(?,00000000,?,?,?,00000000), ref: 00E3D4F0
SendMessageW.USER32(?,00001111,00000000,?), ref: 00E3D51A
SendMessageW.USER32 ref: 00E3D53D
ClientToScreen.USER32(?,?), ref: 00E3D58F
TrackPopupMenuEx.USER32(?,00000080,?,?,?,00000000), ref: 00E3D5C3

Part of subcall function 00DB25DB: GetWindowLongW.USER32(?,000000EB), ref: 00DB25EC

GetWindowLongW.USER32(?,000000F0), ref: 00E3D65F

Strings

@GUI_DRAGID, xrefs: 00E3D1AA
pr, xrefs: 00E3D1BD
F, xrefs: 00E3D543

Memory Dump Source

Source File: 00000000.00000002.2103545536.0000000000DB1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00DB0000, based on PE: true

Associated: 00000000.00000002.2103534640.0000000000DB0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103580373.0000000000E3F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103580373.0000000000E65000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103609603.0000000000E6F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103621893.0000000000E78000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_db0000_New Quotation - FE7191PO154.jbxd

Similarity

API ID: MessageSend$ClientScreen$ImageLongWindow$CursorDragList_State$CaptureMenuPopupTrack$BeginEnterInvalidateParentProcRectRelease_wcsncpy
String ID: @GUI_DRAGID$F$pr
API String ID: 3977979337-1436871235
Opcode ID: deb885c9ec5cfc75f0a74ff56195762f1b78b90ec47a8fc7457e1e32a7725024
Instruction ID: 4781c8c225f16427d0770eecea760417ab3dcb5b9cc609c4a4ec617714b2f0e2
Opcode Fuzzy Hash: deb885c9ec5cfc75f0a74ff56195762f1b78b90ec47a8fc7457e1e32a7725024
Instruction Fuzzy Hash: D842AD30608241AFD725CF29C848EAABFE5FF48318F24151DF69AB72A1C731D854DB92

Function 00E3804A Relevance: 60.1, APIs: 33, Strings: 1, Instructions: 571windowCOMMON

Download Yara Rule

APIs

SendMessageW.USER32(?,00000400,00000000,00000000), ref: 00E3873F

Strings

%d/%02d/%02d, xrefs: 00E38478

Memory Dump Source

Source File: 00000000.00000002.2103545536.0000000000DB1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00DB0000, based on PE: true

Associated: 00000000.00000002.2103534640.0000000000DB0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103580373.0000000000E3F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103580373.0000000000E65000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103609603.0000000000E6F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103621893.0000000000E78000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_db0000_New Quotation - FE7191PO154.jbxd

Similarity

API ID: MessageSend
String ID: %d/%02d/%02d
API String ID: 3850602802-328681919
Opcode ID: 5cd09b78fc3acdf68b57a9af30d15d307791126347483697cd4a4e8ad5f5d7be
Instruction ID: 7c1cfbe2afe584302569a702e50a54acf9185b1be55e3a0360ee6eebce037a3e
Opcode Fuzzy Hash: 5cd09b78fc3acdf68b57a9af30d15d307791126347483697cd4a4e8ad5f5d7be
Instruction Fuzzy Hash: AE12AE71500308AFEB258F25CE4DFAA7FA5EF49714F20612AF915FB2A1DB708945CB60

Function 00DC710E Relevance: 50.6, APIs: 19, Strings: 7, Instructions: 5093COMMON

Download Yara Rule

APIs

_memmove.LIBCMT ref: 00DC75C2
_memset.LIBCMT ref: 00DC76B1
_memmove.LIBCMT ref: 00DC7C4B
_memmove.LIBCMT ref: 00DC7E4F

Strings

0w, xrefs: 00E01F5B
\b(?=\w), xrefs: 00E03C34
[:>:]], xrefs: 00DC760A
\b(?<=\w), xrefs: 00E03C41
DEFINE, xrefs: 00E025AF
Q\E, xrefs: 00DC81C1
[:<:]], xrefs: 00DC75F1

Memory Dump Source

Source File: 00000000.00000002.2103545536.0000000000DB1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00DB0000, based on PE: true

Associated: 00000000.00000002.2103534640.0000000000DB0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103580373.0000000000E3F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103580373.0000000000E65000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103609603.0000000000E6F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103621893.0000000000E78000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_db0000_New Quotation - FE7191PO154.jbxd

Similarity

API ID: _memmove$_memset
String ID: 0w$DEFINE$Q\E$[:<:]]$[:>:]]$\b(?<=\w)$\b(?=\w)
API String ID: 1357608183-3460961967
Opcode ID: 914409acad636d6c78012b7b98c1a09040d1f8098b5e443de9d103ff586efa89
Instruction ID: e2fbd4b4a48195bcb4b26990cb2440edfadee77274eaa4df1622a1fa1298c844
Opcode Fuzzy Hash: 914409acad636d6c78012b7b98c1a09040d1f8098b5e443de9d103ff586efa89
Instruction Fuzzy Hash: 5A938F75A002169BDB24CFA8D885BADB7F1FF48314F24916AE955BB2C0E7709EC1CB50

Function 00DB4A35 Relevance: 43.9, APIs: 24, Strings: 1, Instructions: 131keyboardthreadwindowCOMMON

Download Yara Rule

APIs

GetForegroundWindow.USER32(00000000,?), ref: 00DB4A3D
FindWindowW.USER32(Shell_TrayWnd,00000000), ref: 00DEDA8E
IsIconic.USER32(?), ref: 00DEDA97
ShowWindow.USER32(?,00000009), ref: 00DEDAA4
SetForegroundWindow.USER32(?), ref: 00DEDAAE
GetWindowThreadProcessId.USER32(00000000,00000000), ref: 00DEDAC4
GetCurrentThreadId.KERNEL32 ref: 00DEDACB
GetWindowThreadProcessId.USER32(?,00000000), ref: 00DEDAD7
AttachThreadInput.USER32(?,00000000,00000001), ref: 00DEDAE8
AttachThreadInput.USER32(?,00000000,00000001), ref: 00DEDAF0
AttachThreadInput.USER32(00000000,?,00000001), ref: 00DEDAF8
SetForegroundWindow.USER32(?), ref: 00DEDAFB
MapVirtualKeyW.USER32(00000012,00000000), ref: 00DEDB10
keybd_event.USER32(00000012,00000000), ref: 00DEDB1B
MapVirtualKeyW.USER32(00000012,00000000), ref: 00DEDB25
keybd_event.USER32(00000012,00000000), ref: 00DEDB2A
MapVirtualKeyW.USER32(00000012,00000000), ref: 00DEDB33
keybd_event.USER32(00000012,00000000), ref: 00DEDB38
MapVirtualKeyW.USER32(00000012,00000000), ref: 00DEDB42
keybd_event.USER32(00000012,00000000), ref: 00DEDB47
SetForegroundWindow.USER32(?), ref: 00DEDB4A
AttachThreadInput.USER32(?,?,00000000), ref: 00DEDB71

Strings

Shell_TrayWnd, xrefs: 00DEDA89

Memory Dump Source

Source File: 00000000.00000002.2103545536.0000000000DB1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00DB0000, based on PE: true

Associated: 00000000.00000002.2103534640.0000000000DB0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103580373.0000000000E3F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103580373.0000000000E65000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103609603.0000000000E6F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103621893.0000000000E78000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_db0000_New Quotation - FE7191PO154.jbxd

Similarity

API ID: Window$Thread$AttachForegroundInputVirtualkeybd_event$Process$CurrentFindIconicShow
String ID: Shell_TrayWnd
API String ID: 4125248594-2988720461
Opcode ID: ac048435735081d11d72827e50dc7bea0e18905f1de96e7bbffb75aa847500cc
Instruction ID: 3fa01a650a4ccc097fe2320b05afd85242929c844a6ca3cbb4f149b5b6bf74ba
Opcode Fuzzy Hash: ac048435735081d11d72827e50dc7bea0e18905f1de96e7bbffb75aa847500cc
Instruction Fuzzy Hash: 4F315271E4031CBFEB216F629C4AF7E3E6DEB44B50F154025FA04BA1D1DAB09D00AAA0

Function 00E08858 Relevance: 35.2, APIs: 17, Strings: 3, Instructions: 224COMMON

Download Yara Rule

APIs

Part of subcall function 00E08CC3: LookupPrivilegeValueW.ADVAPI32(00000000,00000000,00000004), ref: 00E08D0D
Part of subcall function 00E08CC3: AdjustTokenPrivileges.ADVAPI32(?,00000000,00000000,?,00000000,?), ref: 00E08D3A
Part of subcall function 00E08CC3: GetLastError.KERNEL32 ref: 00E08D47

_memset.LIBCMT ref: 00E0889B
DuplicateTokenEx.ADVAPI32(?,00000000,00000000,00000002,00000001,?,?,?,?,00000001,?,?), ref: 00E088ED
CloseHandle.KERNEL32(?), ref: 00E088FE
OpenWindowStationW.USER32(winsta0,00000000,00060000), ref: 00E08915
GetProcessWindowStation.USER32 ref: 00E0892E
SetProcessWindowStation.USER32(00000000), ref: 00E08938
OpenDesktopW.USER32(default,00000000,00000000,00060081), ref: 00E08952

Part of subcall function 00E08713: AdjustTokenPrivileges.ADVAPI32(?,00000000,?,00000000,00000000,00000000,?,00E08851), ref: 00E08728
Part of subcall function 00E08713: CloseHandle.KERNEL32(?,?,00E08851), ref: 00E0873A

Strings

, xrefs: 00E088AA
default, xrefs: 00E0894D
winsta0, xrefs: 00E08910

Memory Dump Source

Source File: 00000000.00000002.2103545536.0000000000DB1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00DB0000, based on PE: true

Associated: 00000000.00000002.2103534640.0000000000DB0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103580373.0000000000E3F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103580373.0000000000E65000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103609603.0000000000E6F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103621893.0000000000E78000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_db0000_New Quotation - FE7191PO154.jbxd

Similarity

API ID: StationTokenWindow$AdjustCloseHandleOpenPrivilegesProcess$DesktopDuplicateErrorLastLookupPrivilegeValue_memset
String ID: $default$winsta0
API String ID: 2063423040-1027155976
Opcode ID: 72247526e41b41101232f6af5a0ad7143c523c8774bcc644417de75f1df1d8fd
Instruction ID: dfe53becf8170e727e8e44711f099ced70ada8efc4372179f9563797aef6cbd1
Opcode Fuzzy Hash: 72247526e41b41101232f6af5a0ad7143c523c8774bcc644417de75f1df1d8fd
Instruction Fuzzy Hash: 85815F71D00209AFDF11DFA4DE49AEE7BB8EF04308F08516AF954B62A1DB358E54DB60

Function 00E2425A Relevance: 30.2, APIs: 20, Instructions: 167clipboardCOMMON

Download Yara Rule

APIs

OpenClipboard.USER32(00E3F910), ref: 00E24284
IsClipboardFormatAvailable.USER32(0000000D), ref: 00E24292
GetClipboardData.USER32(0000000D), ref: 00E2429A
CloseClipboard.USER32 ref: 00E242A6
GlobalLock.KERNEL32(00000000), ref: 00E242C2
CloseClipboard.USER32 ref: 00E242CC
GlobalUnlock.KERNEL32(00000000,00000000), ref: 00E242E1
IsClipboardFormatAvailable.USER32(00000001), ref: 00E242EE
GetClipboardData.USER32(00000001), ref: 00E242F6
GlobalLock.KERNEL32(00000000), ref: 00E24303
GlobalUnlock.KERNEL32(00000000,00000000,?), ref: 00E24337
CloseClipboard.USER32 ref: 00E24447

Memory Dump Source

Source File: 00000000.00000002.2103545536.0000000000DB1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00DB0000, based on PE: true

Associated: 00000000.00000002.2103534640.0000000000DB0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103580373.0000000000E3F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103580373.0000000000E65000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103609603.0000000000E6F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103621893.0000000000E78000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_db0000_New Quotation - FE7191PO154.jbxd

Similarity

API ID: Clipboard$Global$Close$AvailableDataFormatLockUnlock$Open
String ID:
API String ID: 3222323430-0
Opcode ID: 0d4742447cfb284c161f8e6b37e34196abbe2dc782ebb5ace50fd76f14ce4212
Instruction ID: 6b736fee5f52a8de62aa660b12d391e018314494f1b15e5c2a744257aae2bd5c
Opcode Fuzzy Hash: 0d4742447cfb284c161f8e6b37e34196abbe2dc782ebb5ace50fd76f14ce4212
Instruction Fuzzy Hash: 78517F71604215AFD311FF61EC9AFAE7BA8AF84B00F105529F556B21F1DF7099088B62

Function 00E1C9C7 Relevance: 28.3, APIs: 13, Strings: 3, Instructions: 280timefileCOMMON

Download Yara Rule

APIs

FindFirstFileW.KERNEL32(?,?), ref: 00E1C9F8
FindClose.KERNEL32(00000000), ref: 00E1CA4C
FileTimeToLocalFileTime.KERNEL32(?,?), ref: 00E1CA71
FileTimeToLocalFileTime.KERNEL32(?,?), ref: 00E1CA88
FileTimeToSystemTime.KERNEL32(?,?), ref: 00E1CAAF
__swprintf.LIBCMT ref: 00E1CAFB
__swprintf.LIBCMT ref: 00E1CB3E

Part of subcall function 00DB7F41: _memmove.LIBCMT ref: 00DB7F82

__swprintf.LIBCMT ref: 00E1CB92

Part of subcall function 00DD38D8: __woutput_l.LIBCMT ref: 00DD3931

__swprintf.LIBCMT ref: 00E1CBE0

Part of subcall function 00DD38D8: __flsbuf.LIBCMT ref: 00DD3953
Part of subcall function 00DD38D8: __flsbuf.LIBCMT ref: 00DD396B

__swprintf.LIBCMT ref: 00E1CC2F
__swprintf.LIBCMT ref: 00E1CC7E
__swprintf.LIBCMT ref: 00E1CCCD

Strings

%4d, xrefs: 00E1CB38
%02d, xrefs: 00E1CB86, 00E1CB90, 00E1CBDE, 00E1CC2D, 00E1CC7C, 00E1CCCB
%4d%02d%02d%02d%02d%02d, xrefs: 00E1CAF5

Memory Dump Source

Source File: 00000000.00000002.2103545536.0000000000DB1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00DB0000, based on PE: true

Associated: 00000000.00000002.2103534640.0000000000DB0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103580373.0000000000E3F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103580373.0000000000E65000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103609603.0000000000E6F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103621893.0000000000E78000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_db0000_New Quotation - FE7191PO154.jbxd

Similarity

API ID: __swprintf$FileTime$FindLocal__flsbuf$CloseFirstSystem__woutput_l_memmove
String ID: %02d$%4d$%4d%02d%02d%02d%02d%02d
API String ID: 3953360268-2428617273
Opcode ID: 241925cf3a20fde917fc434b97a0a126693f63e18b2300b6de7e377fd069f6c3
Instruction ID: 5fa7a4051a086a391cbca9fcf36e7a60c65f64cdaecd101874a10b85e3c0072e
Opcode Fuzzy Hash: 241925cf3a20fde917fc434b97a0a126693f63e18b2300b6de7e377fd069f6c3
Instruction Fuzzy Hash: A4A10BB1508344EBC700EB64D896DEFB7ECEF94704F404929B686D6291EA34DA48CB72

Function 00E1F200 Relevance: 28.1, APIs: 15, Strings: 1, Instructions: 119fileCOMMON

Download Yara Rule

APIs

FindFirstFileW.KERNEL32(?,?,76228FB0,?,00000000), ref: 00E1F221
_wcscmp.LIBCMT ref: 00E1F236
_wcscmp.LIBCMT ref: 00E1F24D
GetFileAttributesW.KERNEL32(?), ref: 00E1F25F
SetFileAttributesW.KERNEL32(?,?), ref: 00E1F279
FindNextFileW.KERNEL32(00000000,?), ref: 00E1F291
FindClose.KERNEL32(00000000), ref: 00E1F29C
FindFirstFileW.KERNEL32(*.*,?), ref: 00E1F2B8
_wcscmp.LIBCMT ref: 00E1F2DF
_wcscmp.LIBCMT ref: 00E1F2F6
SetCurrentDirectoryW.KERNEL32(?), ref: 00E1F308
SetCurrentDirectoryW.KERNEL32(00E6A5A0), ref: 00E1F326
FindNextFileW.KERNEL32(00000000,00000010), ref: 00E1F330
FindClose.KERNEL32(00000000), ref: 00E1F33D
FindClose.KERNEL32(00000000), ref: 00E1F34F

Strings

*.*, xrefs: 00E1F2B3

Memory Dump Source

Source File: 00000000.00000002.2103545536.0000000000DB1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00DB0000, based on PE: true

Associated: 00000000.00000002.2103534640.0000000000DB0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103580373.0000000000E3F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103580373.0000000000E65000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103609603.0000000000E6F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103621893.0000000000E78000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_db0000_New Quotation - FE7191PO154.jbxd

Similarity

API ID: Find$File$_wcscmp$Close$AttributesCurrentDirectoryFirstNext
String ID: *.*
API String ID: 1803514871-438819550
Opcode ID: 0289381235f4603bcaf627074d2a09ee9746e6083a3de600ef1a5015e1b1d990
Instruction ID: 44a3e5315a41baafa222b3031667f174d2b1f5049fd1e7e551834deee6036778
Opcode Fuzzy Hash: 0289381235f4603bcaf627074d2a09ee9746e6083a3de600ef1a5015e1b1d990
Instruction Fuzzy Hash: 3031B4769002196FDB10DBB5EC58ADE77AC9F48365F141176F815F30A0EB30DA85CAA0

Function 00E30AE2 Relevance: 26.7, APIs: 9, Strings: 6, Instructions: 477registryCOMMON

Download Yara Rule

APIs

RegConnectRegistryW.ADVAPI32(?,?,?), ref: 00E30BDE
RegCreateKeyExW.ADVAPI32(?,?,00000000,00E3F910,00000000,?,00000000,?,?), ref: 00E30C4C
RegCloseKey.ADVAPI32(00000000,00000001,00000000,00000000,00000000), ref: 00E30C94
RegSetValueExW.ADVAPI32(00000001,?,00000000,00000002,?), ref: 00E30D1D
RegCloseKey.ADVAPI32(?), ref: 00E3103D
RegCloseKey.ADVAPI32(00000000), ref: 00E3104A

Strings

REG_DWORD, xrefs: 00E30F0E
REG_SZ, xrefs: 00E30D5B
REG_MULTI_SZ, xrefs: 00E30E05
REG_BINARY, xrefs: 00E30FD8
REG_EXPAND_SZ, xrefs: 00E30CBA
REG_QWORD, xrefs: 00E30F8B

Memory Dump Source

Source File: 00000000.00000002.2103545536.0000000000DB1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00DB0000, based on PE: true

Associated: 00000000.00000002.2103534640.0000000000DB0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103580373.0000000000E3F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103580373.0000000000E65000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103609603.0000000000E6F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103621893.0000000000E78000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_db0000_New Quotation - FE7191PO154.jbxd

Similarity

API ID: Close$ConnectCreateRegistryValue
String ID: REG_BINARY$REG_DWORD$REG_EXPAND_SZ$REG_MULTI_SZ$REG_QWORD$REG_SZ
API String ID: 536824911-966354055
Opcode ID: 84f1638e23ab85e3f5b2218a7c1322d5b8425a72a39346b8db490c7d5930e6cd
Instruction ID: 7abbae2894f9be668a91d882f4f347bc99246aea55baa6a29d26eb222857f9ac
Opcode Fuzzy Hash: 84f1638e23ab85e3f5b2218a7c1322d5b8425a72a39346b8db490c7d5930e6cd
Instruction Fuzzy Hash: BE025B752006419FCB14EF24C895E6ABBE5EF89714F04985DF98AAB362CB30ED41CB61

Function 00E1F35D Relevance: 24.6, APIs: 13, Strings: 1, Instructions: 112fileCOMMON

Download Yara Rule

APIs

FindFirstFileW.KERNEL32(?,?,76228FB0,?,00000000), ref: 00E1F37E
_wcscmp.LIBCMT ref: 00E1F393
_wcscmp.LIBCMT ref: 00E1F3AA

Part of subcall function 00E145C1: CreateFileW.KERNEL32(?,40000000,00000001,00000000,00000003,02000080,00000000), ref: 00E145DC

FindNextFileW.KERNEL32(00000000,?), ref: 00E1F3D9
FindClose.KERNEL32(00000000), ref: 00E1F3E4
FindFirstFileW.KERNEL32(*.*,?), ref: 00E1F400
_wcscmp.LIBCMT ref: 00E1F427
_wcscmp.LIBCMT ref: 00E1F43E
SetCurrentDirectoryW.KERNEL32(?), ref: 00E1F450
SetCurrentDirectoryW.KERNEL32(00E6A5A0), ref: 00E1F46E
FindNextFileW.KERNEL32(00000000,00000010), ref: 00E1F478
FindClose.KERNEL32(00000000), ref: 00E1F485
FindClose.KERNEL32(00000000), ref: 00E1F497

Strings

*.*, xrefs: 00E1F3FB

Memory Dump Source

Source File: 00000000.00000002.2103545536.0000000000DB1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00DB0000, based on PE: true

Associated: 00000000.00000002.2103534640.0000000000DB0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103580373.0000000000E3F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103580373.0000000000E65000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103609603.0000000000E6F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103621893.0000000000E78000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_db0000_New Quotation - FE7191PO154.jbxd

Similarity

API ID: Find$File$_wcscmp$Close$CurrentDirectoryFirstNext$Create
String ID: *.*
API String ID: 1824444939-438819550
Opcode ID: 04b20aaee95a60ac8740adbbda84111cf35878d9d77118607ebceacd69eb062b
Instruction ID: 0ff31e3e0afbbb4867680f40611605d4375cbd464996c705574b8a5b0275f31b
Opcode Fuzzy Hash: 04b20aaee95a60ac8740adbbda84111cf35878d9d77118607ebceacd69eb062b
Instruction Fuzzy Hash: 6F31C57290121D6FCB10DFA4EC98ADF77AC9F49365F141276E864B31A0DB30DAC4CAA4

Function 00E081F7 Relevance: 21.2, APIs: 14, Instructions: 179memoryCOMMON

Download Yara Rule

APIs

Part of subcall function 00E0874A: GetUserObjectSecurity.USER32(?,00000004,?,00000000,?), ref: 00E08766
Part of subcall function 00E0874A: GetLastError.KERNEL32(?,00E0822A,?,?,?), ref: 00E08770
Part of subcall function 00E0874A: GetProcessHeap.KERNEL32(00000008,?,?,00E0822A,?,?,?), ref: 00E0877F
Part of subcall function 00E0874A: HeapAlloc.KERNEL32(00000000,?,00E0822A,?,?,?), ref: 00E08786
Part of subcall function 00E0874A: GetUserObjectSecurity.USER32(?,00000004,00000000,?,?), ref: 00E0879D

Part of subcall function 00E087E7: GetProcessHeap.KERNEL32(00000008,00E08240,00000000,00000000,?,00E08240,?), ref: 00E087F3
Part of subcall function 00E087E7: HeapAlloc.KERNEL32(00000000,?,00E08240,?), ref: 00E087FA
Part of subcall function 00E087E7: InitializeSecurityDescriptor.ADVAPI32(00000000,00000001,?,00E08240,?), ref: 00E0880B

GetSecurityDescriptorDacl.ADVAPI32(?,?,?,?), ref: 00E0825B
_memset.LIBCMT ref: 00E08270
GetAclInformation.ADVAPI32(?,?,0000000C,00000002), ref: 00E0828F
GetLengthSid.ADVAPI32(?), ref: 00E082A0
GetAce.ADVAPI32(?,00000000,?), ref: 00E082DD
AddAce.ADVAPI32(?,00000002,000000FF,?,?), ref: 00E082F9
GetLengthSid.ADVAPI32(?), ref: 00E08316
GetProcessHeap.KERNEL32(00000008,-00000008), ref: 00E08325
HeapAlloc.KERNEL32(00000000), ref: 00E0832C
GetLengthSid.ADVAPI32(?,00000008,?), ref: 00E0834D
CopySid.ADVAPI32(00000000), ref: 00E08354
AddAce.ADVAPI32(?,00000002,000000FF,00000000,?), ref: 00E08385
SetSecurityDescriptorDacl.ADVAPI32(?,00000001,?,00000000), ref: 00E083AB
SetUserObjectSecurity.USER32(?,00000004,?), ref: 00E083BF

Memory Dump Source

Source File: 00000000.00000002.2103545536.0000000000DB1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00DB0000, based on PE: true

Associated: 00000000.00000002.2103534640.0000000000DB0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103580373.0000000000E3F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103580373.0000000000E65000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103609603.0000000000E6F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103621893.0000000000E78000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_db0000_New Quotation - FE7191PO154.jbxd

Similarity

API ID: HeapSecurity$AllocDescriptorLengthObjectProcessUser$Dacl$CopyErrorInformationInitializeLast_memset
String ID:
API String ID: 3996160137-0
Opcode ID: f28d6d70227b04e52969590fdc1142e47b65fc61ca3e30aed5b684e86aac208e
Instruction ID: d1ddcfd1882df13a0eb03cd604932d50928e3fc90b12b81b74e3bbaa1c237669
Opcode Fuzzy Hash: f28d6d70227b04e52969590fdc1142e47b65fc61ca3e30aed5b684e86aac208e
Instruction Fuzzy Hash: 90617870900209EFCF048FA5DE89EAEBBB9FF44714F049129E855B6291DB359A49CF60

Function 00DC6843 Relevance: 19.6, Strings: 15, Instructions: 883COMMON

Download Yara Rule

Strings

UTF), xrefs: 00E01533
LIMIT_MATCH=, xrefs: 00E015A9
LIMIT_RECURSION=, xrefs: 00E01635
ANYCRLF), xrefs: 00E01734
ANY), xrefs: 00E01717
NO_AUTO_POSSESS), xrefs: 00E01567
UTF16), xrefs: 00E01508
BSR_ANYCRLF), xrefs: 00E01757
LF), xrefs: 00E016DD
NO_START_OPT), xrefs: 00E01588
PJ, xrefs: 00DC68B3
CR), xrefs: 00E016C0
BSR_UNICODE), xrefs: 00E01771
UCP), xrefs: 00E01546
CRLF), xrefs: 00E016FA

Memory Dump Source

Source File: 00000000.00000002.2103545536.0000000000DB1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00DB0000, based on PE: true

Associated: 00000000.00000002.2103534640.0000000000DB0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103580373.0000000000E3F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103580373.0000000000E65000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103609603.0000000000E6F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103621893.0000000000E78000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_db0000_New Quotation - FE7191PO154.jbxd

Similarity

API ID:
String ID: ANY)$ANYCRLF)$BSR_ANYCRLF)$BSR_UNICODE)$CR)$CRLF)$LF)$LIMIT_MATCH=$LIMIT_RECURSION=$NO_AUTO_POSSESS)$NO_START_OPT)$PJ$UCP)$UTF)$UTF16)
API String ID: 0-1624373025
Opcode ID: f3ae9b4b2187ba07ffa5e67c103d13f2e7cb9bb189a9227378c952007747ebcb
Instruction ID: 13909577e620817b59eb7eae1ad238cc9a73c6ae0d8835f1607b49398964105f
Opcode Fuzzy Hash: f3ae9b4b2187ba07ffa5e67c103d13f2e7cb9bb189a9227378c952007747ebcb
Instruction Fuzzy Hash: E0726275E0021A9BDB14CF59D881BADB7B5FF88310F1491AAE945FB290D770DD81CBA0

Function 00E30665 Relevance: 16.9, APIs: 11, Instructions: 397registryCOMMON

Download Yara Rule

APIs

Part of subcall function 00E310A5: CharUpperBuffW.USER32(?,?,?,?,?,?,?,00E30038,?,?), ref: 00E310BC

RegConnectRegistryW.ADVAPI32(?,?,?), ref: 00E30737

Part of subcall function 00DB9997: __itow.LIBCMT ref: 00DB99C2
Part of subcall function 00DB9997: __swprintf.LIBCMT ref: 00DB9A0C

RegQueryValueExW.ADVAPI32(?,?,00000000,?,00000000,?), ref: 00E307D6
RegQueryValueExW.ADVAPI32(?,?,00000000,00000000,?,00000008), ref: 00E3086E
RegCloseKey.ADVAPI32(000000FE,000000FE,00000000,?,00000000), ref: 00E30AAD
RegCloseKey.ADVAPI32(00000000), ref: 00E30ABA

Memory Dump Source

Source File: 00000000.00000002.2103545536.0000000000DB1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00DB0000, based on PE: true

Associated: 00000000.00000002.2103534640.0000000000DB0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103580373.0000000000E3F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103580373.0000000000E65000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103609603.0000000000E6F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103621893.0000000000E78000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_db0000_New Quotation - FE7191PO154.jbxd

Similarity

API ID: CloseQueryValue$BuffCharConnectRegistryUpper__itow__swprintf
String ID:
API String ID: 1240663315-0
Opcode ID: f692a4a256642e196fd23054415e545d107c10ff80c7b61920906e18c27e58a6
Instruction ID: 107fd73f8d86fb6f585f384111d15ad95278b9cf9afdde1e104885a76b16859c
Opcode Fuzzy Hash: f692a4a256642e196fd23054415e545d107c10ff80c7b61920906e18c27e58a6
Instruction Fuzzy Hash: 39E15D31604304AFCB14DF29C895E6ABBE5EF89714F04956DF44AEB262DB30ED05CB61

Function 00E10219 Relevance: 16.6, APIs: 11, Instructions: 120keyboardCOMMON

Download Yara Rule

APIs

GetKeyboardState.USER32(?), ref: 00E10241
GetAsyncKeyState.USER32(000000A0), ref: 00E102C2
GetKeyState.USER32(000000A0), ref: 00E102DD
GetAsyncKeyState.USER32(000000A1), ref: 00E102F7
GetKeyState.USER32(000000A1), ref: 00E1030C
GetAsyncKeyState.USER32(00000011), ref: 00E10324
GetKeyState.USER32(00000011), ref: 00E10336
GetAsyncKeyState.USER32(00000012), ref: 00E1034E
GetKeyState.USER32(00000012), ref: 00E10360
GetAsyncKeyState.USER32(0000005B), ref: 00E10378
GetKeyState.USER32(0000005B), ref: 00E1038A

Memory Dump Source

Source File: 00000000.00000002.2103545536.0000000000DB1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00DB0000, based on PE: true

Associated: 00000000.00000002.2103534640.0000000000DB0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103580373.0000000000E3F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103580373.0000000000E65000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103609603.0000000000E6F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103621893.0000000000E78000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_db0000_New Quotation - FE7191PO154.jbxd

Similarity

API ID: State$Async$Keyboard
String ID:
API String ID: 541375521-0
Opcode ID: 615d80f18c27e797fb8afe4d3c6a475a009df55e6c975581ac52b6cab1ab9563
Instruction ID: 21f3b4d075c2aa223a2e5bc944b9b9c4d13e7d09508e625e86f110858e96b274
Opcode Fuzzy Hash: 615d80f18c27e797fb8afe4d3c6a475a009df55e6c975581ac52b6cab1ab9563
Instruction Fuzzy Hash: 864189349047C9AFFF319A6488083E5BFA06F16348F08509DD9D6A61D3E7E45DC8C7A2

Function 00E286D0 Relevance: 15.9, APIs: 6, Strings: 3, Instructions: 197comCOMMON

Download Yara Rule

APIs

Part of subcall function 00DB9997: __itow.LIBCMT ref: 00DB99C2
Part of subcall function 00DB9997: __swprintf.LIBCMT ref: 00DB9A0C

CoInitialize.OLE32 ref: 00E28718
CoUninitialize.OLE32 ref: 00E28723
CoCreateInstance.OLE32(?,00000000,00000017,00E42BEC,?), ref: 00E28783
IIDFromString.OLE32(?,?), ref: 00E287F6
VariantInit.OLEAUT32(?), ref: 00E28890
VariantClear.OLEAUT32(?), ref: 00E288F1

Strings

NULL Pointer assignment, xrefs: 00E287C8
Invalid parameter, xrefs: 00E2880F
Failed to create object, xrefs: 00E2878E, 00E28844

Memory Dump Source

Source File: 00000000.00000002.2103545536.0000000000DB1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00DB0000, based on PE: true

Associated: 00000000.00000002.2103534640.0000000000DB0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103580373.0000000000E3F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103580373.0000000000E65000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103609603.0000000000E6F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103621893.0000000000E78000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_db0000_New Quotation - FE7191PO154.jbxd

Similarity

API ID: Variant$ClearCreateFromInitInitializeInstanceStringUninitialize__itow__swprintf
String ID: Failed to create object$Invalid parameter$NULL Pointer assignment
API String ID: 834269672-1287834457
Opcode ID: 206314ad5147a192c5cc9dd661da6c1903612deda54f65f2c54ee868cd051dbe
Instruction ID: 4ccb3b675549fd54c4e447c03e9217ecaf83f61d1c1c4038709fb1cbac4b8b87
Opcode Fuzzy Hash: 206314ad5147a192c5cc9dd661da6c1903612deda54f65f2c54ee868cd051dbe
Instruction Fuzzy Hash: FD61C3306093119FD718DF24DA48B5ABBE4EF44714F54581EF585AB291CB70ED48CBA2

Function 00E24458 Relevance: 15.1, APIs: 10, Instructions: 83clipboardmemoryCOMMON

Download Yara Rule

APIs

OpenClipboard.USER32 ref: 00E2447F
EmptyClipboard.USER32 ref: 00E24485
GlobalAlloc.KERNEL32(00000002,?), ref: 00E2449A
CloseClipboard.USER32 ref: 00E24539

Memory Dump Source

Source File: 00000000.00000002.2103545536.0000000000DB1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00DB0000, based on PE: true

Associated: 00000000.00000002.2103534640.0000000000DB0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103580373.0000000000E3F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103580373.0000000000E65000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103609603.0000000000E6F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103621893.0000000000E78000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_db0000_New Quotation - FE7191PO154.jbxd

Similarity

API ID: Clipboard$AllocCloseEmptyGlobalOpen
String ID:
API String ID: 1737998785-0
Opcode ID: 914cd7c05126def2604283baf0d035d683145881b3372cd7045cb2971330cd41
Instruction ID: e3df8e1497dbee051dd60a80a9db6d9e4d6e5cba44e4271b51dcda3efc001b94
Opcode Fuzzy Hash: 914cd7c05126def2604283baf0d035d683145881b3372cd7045cb2971330cd41
Instruction Fuzzy Hash: AD2180756006249FDB10AF21EC19B6A7BA8EF54714F108016F946EB2B1CB30AD04CBA4

Function 00E13A2B Relevance: 14.2, APIs: 7, Strings: 1, Instructions: 167fileCOMMON

Download Yara Rule

APIs

Part of subcall function 00DB48AE: GetFullPathNameW.KERNEL32(?,00007FFF,?,00000000,?,?,00DB48A1,?,?,00DB37C0,?), ref: 00DB48CE

Part of subcall function 00E14CD3: GetFileAttributesW.KERNEL32(?,00E13947), ref: 00E14CD4

FindFirstFileW.KERNEL32(?,?), ref: 00E13ADF
DeleteFileW.KERNEL32(?,?,00000000,?,?,?,?), ref: 00E13B87
MoveFileW.KERNEL32(?,?), ref: 00E13B9A
DeleteFileW.KERNEL32(?,?,?,?,?), ref: 00E13BB7
FindNextFileW.KERNEL32(00000000,00000010), ref: 00E13BD9
FindClose.KERNEL32(00000000,?,?,?,?), ref: 00E13BF5

Strings

\*.*, xrefs: 00E13A8A, 00E13A93, 00E13AA8

Memory Dump Source

Source File: 00000000.00000002.2103545536.0000000000DB1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00DB0000, based on PE: true

Associated: 00000000.00000002.2103534640.0000000000DB0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103580373.0000000000E3F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103580373.0000000000E65000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103609603.0000000000E6F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103621893.0000000000E78000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_db0000_New Quotation - FE7191PO154.jbxd

Similarity

API ID: File$Find$Delete$AttributesCloseFirstFullMoveNameNextPath
String ID: \*.*
API String ID: 4002782344-1173974218
Opcode ID: 5e71b828c99ea8594342cfcd1bf3ffe1d08f60ffd295cf63edaf494a809e72bc
Instruction ID: ccc1e8448ab9c1ba7098c19bc00f0be465be0968b6784077d222625f890f0a16
Opcode Fuzzy Hash: 5e71b828c99ea8594342cfcd1bf3ffe1d08f60ffd295cf63edaf494a809e72bc
Instruction Fuzzy Hash: 96516A3180524DABCB15EBA0DE92DEDB7B9AF54304F6451A9E40277192EF206F49CBB0

Function 00E1F65E Relevance: 12.4, APIs: 6, Strings: 1, Instructions: 120filesleepCOMMON

Download Yara Rule

APIs

Part of subcall function 00DB7F41: _memmove.LIBCMT ref: 00DB7F82

FindFirstFileW.KERNEL32(?,?,*.*,?,?,00000000,00000000), ref: 00E1F6AB
Sleep.KERNEL32(0000000A), ref: 00E1F6DB
_wcscmp.LIBCMT ref: 00E1F6EF
_wcscmp.LIBCMT ref: 00E1F70A
FindNextFileW.KERNEL32(?,?), ref: 00E1F7A8
FindClose.KERNEL32(00000000), ref: 00E1F7BE

Strings

*.*, xrefs: 00E1F690

Memory Dump Source

Source File: 00000000.00000002.2103545536.0000000000DB1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00DB0000, based on PE: true

Associated: 00000000.00000002.2103534640.0000000000DB0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103580373.0000000000E3F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103580373.0000000000E65000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103609603.0000000000E6F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103621893.0000000000E78000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_db0000_New Quotation - FE7191PO154.jbxd

Similarity

API ID: Find$File_wcscmp$CloseFirstNextSleep_memmove
String ID: *.*
API String ID: 713712311-438819550
Opcode ID: 225494b5ff77f2f4f811f81ce59efda66c971d32a8c287cd7fc45b0639d5abe0
Instruction ID: 6263549d3d9d410f0f6ad077eb57102a3d53d8c498baef9702dd7fbf8b2ab94c
Opcode Fuzzy Hash: 225494b5ff77f2f4f811f81ce59efda66c971d32a8c287cd7fc45b0639d5abe0
Instruction Fuzzy Hash: 4541507191021AAFDF15DF64CC89AEEBBB4FF05314F144566E815B31A1DB309E84CBA0

Function 00DC4140 Relevance: 11.6, APIs: 1, Strings: 5, Instructions: 1132COMMON

Download Yara Rule

Strings

VUUU, xrefs: 00DC4520
ERCP, xrefs: 00DC421F
VUUU, xrefs: 00DC44ED
VUUU, xrefs: 00DC44DB
VUUU, xrefs: 00DF7B0C

Memory Dump Source

Source File: 00000000.00000002.2103545536.0000000000DB1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00DB0000, based on PE: true

Associated: 00000000.00000002.2103534640.0000000000DB0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103580373.0000000000E3F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103580373.0000000000E65000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103609603.0000000000E6F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103621893.0000000000E78000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_db0000_New Quotation - FE7191PO154.jbxd

Similarity

API ID:
String ID: ERCP$VUUU$VUUU$VUUU$VUUU
API String ID: 0-1546025612
Opcode ID: 246dac8a1a65c130b98b72fda383866e0619d4b6d2dc2e000db987c1df22be30
Instruction ID: 32c7741799ff8f61fea60af105a895442e1bc480b0b32cbdc8e07bf545ca6f46
Opcode Fuzzy Hash: 246dac8a1a65c130b98b72fda383866e0619d4b6d2dc2e000db987c1df22be30
Instruction Fuzzy Hash: 0BA27D70E0421ACBDF24CF58C960BFDB7B1AF54314F2981AAE955A7284DB709E81DF60

Function 00DC58C0 Relevance: 11.0, APIs: 7, Instructions: 532COMMON

Download Yara Rule

APIs

_memmove.LIBCMT ref: 00DC5A05
_memmove.LIBCMT ref: 00DC5A55
_memmove.LIBCMT ref: 00DC5ABB

Memory Dump Source

Source File: 00000000.00000002.2103545536.0000000000DB1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00DB0000, based on PE: true

Associated: 00000000.00000002.2103534640.0000000000DB0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103580373.0000000000E3F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103580373.0000000000E65000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103609603.0000000000E6F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103621893.0000000000E78000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_db0000_New Quotation - FE7191PO154.jbxd

Similarity

API ID: _memmove
String ID:
API String ID: 4104443479-0
Opcode ID: 1d21f585c98c2566fc71f0a07125d83bea3c73b54cd602d9d7e4f7295c29ee5c
Instruction ID: c1273a5fe0aac718fc248309fc4be65f2815ff46ce58ecf0f918a3b8386c6062
Opcode Fuzzy Hash: 1d21f585c98c2566fc71f0a07125d83bea3c73b54cd602d9d7e4f7295c29ee5c
Instruction Fuzzy Hash: D3128970A0060ADFDF04DFA5E981BEEB7B5FF48300F104169E446A7295EB35AD95CB60

Function 00E1545F Relevance: 10.6, APIs: 3, Strings: 3, Instructions: 59shutdownCOMMON

Download Yara Rule

APIs

Part of subcall function 00E08CC3: LookupPrivilegeValueW.ADVAPI32(00000000,00000000,00000004), ref: 00E08D0D
Part of subcall function 00E08CC3: AdjustTokenPrivileges.ADVAPI32(?,00000000,00000000,?,00000000,?), ref: 00E08D3A
Part of subcall function 00E08CC3: GetLastError.KERNEL32 ref: 00E08D47

ExitWindowsEx.USER32(?,00000000), ref: 00E1549B

Strings

, xrefs: 00E15489
SeShutdownPrivilege, xrefs: 00E1546B
@, xrefs: 00E1548E

Memory Dump Source

Source File: 00000000.00000002.2103545536.0000000000DB1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00DB0000, based on PE: true

Associated: 00000000.00000002.2103534640.0000000000DB0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103580373.0000000000E3F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103580373.0000000000E65000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103609603.0000000000E6F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103621893.0000000000E78000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_db0000_New Quotation - FE7191PO154.jbxd

Similarity

API ID: AdjustErrorExitLastLookupPrivilegePrivilegesTokenValueWindows
String ID: $@$SeShutdownPrivilege
API String ID: 2234035333-194228
Opcode ID: 0206c6a7fd35cc1fb9027bc4c6bf846e44f0b4c6fc2fd5aac6aa06b46ba57c6b
Instruction ID: 9c8907183676c2426e39f5ca7c245fcfddf316aa9bc9044c6118c0ff63a14620
Opcode Fuzzy Hash: 0206c6a7fd35cc1fb9027bc4c6bf846e44f0b4c6fc2fd5aac6aa06b46ba57c6b
Instruction Fuzzy Hash: 0A01D832A55B15AEE7285678AC4ABFB7258AB85352F242531FC27F21D2D6B01CC04590

Function 00E26596 Relevance: 9.1, APIs: 6, Instructions: 84networkCOMMON

Download Yara Rule

APIs

socket.WSOCK32(00000002,00000001,00000006,?,00000002,00000000), ref: 00E265EF
WSAGetLastError.WSOCK32(00000000), ref: 00E265FE
bind.WSOCK32(00000000,?,00000010), ref: 00E2661A
listen.WSOCK32(00000000,00000005), ref: 00E26629
WSAGetLastError.WSOCK32(00000000), ref: 00E26643
closesocket.WSOCK32(00000000,00000000), ref: 00E26657

Memory Dump Source

Source File: 00000000.00000002.2103545536.0000000000DB1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00DB0000, based on PE: true

Associated: 00000000.00000002.2103534640.0000000000DB0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103580373.0000000000E3F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103580373.0000000000E65000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103609603.0000000000E6F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103621893.0000000000E78000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_db0000_New Quotation - FE7191PO154.jbxd

Similarity

API ID: ErrorLast$bindclosesocketlistensocket
String ID:
API String ID: 1279440585-0
Opcode ID: 6ec25b2baf3bc49d4b2e28929601511432e8e36b13c32ad610a1b3052e7072c1
Instruction ID: ae0a25c6e6f373c0efa0dce42bb3f104547d398d7781ed20b5ffccfbc1add8c6
Opcode Fuzzy Hash: 6ec25b2baf3bc49d4b2e28929601511432e8e36b13c32ad610a1b3052e7072c1
Instruction Fuzzy Hash: 3121CE31600214AFCB10AF24D849F6EBBF9EF48324F148259E916B73D1CB30AD048B60

Function 00DC5680 Relevance: 8.0, APIs: 5, Instructions: 516COMMON

Download Yara Rule

APIs

Part of subcall function 00DD0FF6: std::exception::exception.LIBCMT ref: 00DD102C
Part of subcall function 00DD0FF6: __CxxThrowException@8.LIBCMT ref: 00DD1041

_memmove.LIBCMT ref: 00E0062F
_memmove.LIBCMT ref: 00E00744
_memmove.LIBCMT ref: 00E007EB

Memory Dump Source

Source File: 00000000.00000002.2103545536.0000000000DB1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00DB0000, based on PE: true

Associated: 00000000.00000002.2103534640.0000000000DB0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103580373.0000000000E3F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103580373.0000000000E65000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103609603.0000000000E6F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103621893.0000000000E78000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_db0000_New Quotation - FE7191PO154.jbxd

Similarity

API ID: _memmove$Exception@8Throwstd::exception::exception
String ID:
API String ID: 1300846289-0
Opcode ID: 32dd0c1e52f691fb14b0bc6d536d11c6f2e074bbd88da08f3dc90bcef51f62f9
Instruction ID: 8093d7431b9ab7dfcdd92886d02627a3887f993d8739b1af1d84148a53e63a86
Opcode Fuzzy Hash: 32dd0c1e52f691fb14b0bc6d536d11c6f2e074bbd88da08f3dc90bcef51f62f9
Instruction Fuzzy Hash: FF028270A00205DFDF14DF64E981AAE7BB5FF84340F148069E806EB395EB35E995CBA1

Function 00DB1287 Relevance: 7.9, APIs: 5, Instructions: 379COMMON

Download Yara Rule

APIs

Part of subcall function 00DB2612: GetWindowLongW.USER32(?,000000EB), ref: 00DB2623

DefDlgProcW.USER32(?,?,?,?,?), ref: 00DB19FA
GetSysColor.USER32(0000000F), ref: 00DB1A4E
SetBkColor.GDI32(?,00000000), ref: 00DB1A61

Part of subcall function 00DB1290: DefDlgProcW.USER32(?,00000020,?), ref: 00DB12D8

Memory Dump Source

Source File: 00000000.00000002.2103545536.0000000000DB1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00DB0000, based on PE: true

Associated: 00000000.00000002.2103534640.0000000000DB0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103580373.0000000000E3F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103580373.0000000000E65000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103609603.0000000000E6F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103621893.0000000000E78000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_db0000_New Quotation - FE7191PO154.jbxd

Similarity

API ID: ColorProc$LongWindow
String ID:
API String ID: 3744519093-0
Opcode ID: a2b8309eec51e1b123e9e39866e19233164704ecd30b4d1735d694f4acab3a37
Instruction ID: 1b204f5fc0d5cdba74ceb2ee4c33d5571e7add264594ceb793a54bebb913a917
Opcode Fuzzy Hash: a2b8309eec51e1b123e9e39866e19233164704ecd30b4d1735d694f4acab3a37
Instruction Fuzzy Hash: 81A15979105585FEEA28AA2A9C7DDFF399CDB42355FA8011EF443F6191CA10FD02C2B2

Function 00E26A5A Relevance: 7.6, APIs: 5, Instructions: 141networkCOMMON

Download Yara Rule

APIs

Part of subcall function 00E280A0: inet_addr.WSOCK32(00000000,?,00000000,?,?,?,00000000), ref: 00E280CB

socket.WSOCK32(00000002,00000002,00000011,?,?,00000000), ref: 00E26AB1
WSAGetLastError.WSOCK32(00000000), ref: 00E26ADA
bind.WSOCK32(00000000,?,00000010), ref: 00E26B13
WSAGetLastError.WSOCK32(00000000), ref: 00E26B20
closesocket.WSOCK32(00000000,00000000), ref: 00E26B34

Memory Dump Source

Source File: 00000000.00000002.2103545536.0000000000DB1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00DB0000, based on PE: true

Associated: 00000000.00000002.2103534640.0000000000DB0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103580373.0000000000E3F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103580373.0000000000E65000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103609603.0000000000E6F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103621893.0000000000E78000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_db0000_New Quotation - FE7191PO154.jbxd

Similarity

API ID: ErrorLast$bindclosesocketinet_addrsocket
String ID:
API String ID: 99427753-0
Opcode ID: 52cc7e8cfdd0fdf13cc173b438bb555402b64ba7ef5452181f7b38164a6e582b
Instruction ID: b0143e0c70dd5dbd673250daa0a1fa01ef8cb290fe0ea577da144de5c0d7a2ab
Opcode Fuzzy Hash: 52cc7e8cfdd0fdf13cc173b438bb555402b64ba7ef5452181f7b38164a6e582b
Instruction Fuzzy Hash: D641B575B40214EFEB10AF64DC96FAEB7A9DB44710F448158FA1ABB3D2DA709D0087B1

Function 00E355FD Relevance: 7.6, APIs: 5, Instructions: 69windowCOMMON

Download Yara Rule

APIs

IsWindowVisible.USER32 ref: 00E3564C
IsWindowEnabled.USER32 ref: 00E3565A
GetForegroundWindow.USER32(?,?,00000001), ref: 00E35667
IsIconic.USER32 ref: 00E35675
IsZoomed.USER32 ref: 00E35683

Memory Dump Source

Source File: 00000000.00000002.2103545536.0000000000DB1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00DB0000, based on PE: true

Associated: 00000000.00000002.2103534640.0000000000DB0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103580373.0000000000E3F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103580373.0000000000E65000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103609603.0000000000E6F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103621893.0000000000E78000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_db0000_New Quotation - FE7191PO154.jbxd

Similarity

API ID: Window$EnabledForegroundIconicVisibleZoomed
String ID:
API String ID: 292994002-0
Opcode ID: 8e8c997f1320f05f84894cfb24ab86f61d46a166d5092717b0e851a07426f1a0
Instruction ID: 95aa56627ff0e4ba395369fbcc935737267afba16bef0be0decdbf813c0b7a1b
Opcode Fuzzy Hash: 8e8c997f1320f05f84894cfb24ab86f61d46a166d5092717b0e851a07426f1a0
Instruction Fuzzy Hash: 7311B232700915AFEB211F26DC4EA6BBFA8EF44721F815429F846F7341CB709901CAA5

Function 00E2C304 Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 19libraryloaderCOMMON

Download Yara Rule

APIs

LoadLibraryA.KERNEL32(kernel32.dll,?,00DF1D88,?), ref: 00E2C312
GetProcAddress.KERNEL32(00000000,GetSystemWow64DirectoryW), ref: 00E2C324

Strings

kernel32.dll, xrefs: 00E2C30D
GetSystemWow64DirectoryW, xrefs: 00E2C31E

Memory Dump Source

Source File: 00000000.00000002.2103545536.0000000000DB1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00DB0000, based on PE: true

Associated: 00000000.00000002.2103534640.0000000000DB0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103580373.0000000000E3F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103580373.0000000000E65000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103609603.0000000000E6F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103621893.0000000000E78000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_db0000_New Quotation - FE7191PO154.jbxd

Similarity

API ID: AddressLibraryLoadProc
String ID: GetSystemWow64DirectoryW$kernel32.dll
API String ID: 2574300362-1816364905
Opcode ID: 330ddff1f3a5f5e414453b2b2b81e292fe7f10e3947ee584db8456a51ba7aa30
Instruction ID: 74c9476ff9fb26a8b60e75b287d409124798c0538a110129d1a7df88a867acb6
Opcode Fuzzy Hash: 330ddff1f3a5f5e414453b2b2b81e292fe7f10e3947ee584db8456a51ba7aa30
Instruction Fuzzy Hash: 40E08670600313CFCB209B26E808A4A7AD4EF08758B50987AD485F2210D770D840C660

Function 00DC3190 Relevance: 6.6, APIs: 4, Instructions: 587COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2103545536.0000000000DB1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00DB0000, based on PE: true

Associated: 00000000.00000002.2103534640.0000000000DB0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103580373.0000000000E3F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103580373.0000000000E65000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103609603.0000000000E6F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103621893.0000000000E78000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_db0000_New Quotation - FE7191PO154.jbxd

Similarity

API ID: __itow__swprintf
String ID:
API String ID: 674341424-0
Opcode ID: fc68cf6bb7380639a8247beeddd491308a8993359ad71ea7feec1cbc78a0107f
Instruction ID: aabd6f24841e12f8762735990a09894452f5f9aa0929f9da935db3331e831e84
Opcode Fuzzy Hash: fc68cf6bb7380639a8247beeddd491308a8993359ad71ea7feec1cbc78a0107f
Instruction Fuzzy Hash: A82289716083429FC724DF24C891BAEB7E4EF84300F14891DF99A97291DB71EA44CBB2

Function 00E2F121 Relevance: 6.2, APIs: 4, Instructions: 164processCOMMON

Download Yara Rule

APIs

CreateToolhelp32Snapshot.KERNEL32 ref: 00E2F151
Process32FirstW.KERNEL32(00000000,?), ref: 00E2F15F

Part of subcall function 00DB7F41: _memmove.LIBCMT ref: 00DB7F82

Process32NextW.KERNEL32(00000000,?), ref: 00E2F21F
CloseHandle.KERNEL32(00000000,?,?,?), ref: 00E2F22E

Memory Dump Source

Source File: 00000000.00000002.2103545536.0000000000DB1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00DB0000, based on PE: true

Associated: 00000000.00000002.2103534640.0000000000DB0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103580373.0000000000E3F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103580373.0000000000E65000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103609603.0000000000E6F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103621893.0000000000E78000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_db0000_New Quotation - FE7191PO154.jbxd

Similarity

API ID: Process32$CloseCreateFirstHandleNextSnapshotToolhelp32_memmove
String ID:
API String ID: 2576544623-0
Opcode ID: 1ca1815888d1660da5cd483122ac4b19c072364fc791a7412762a564bcc6bd34
Instruction ID: d3cf3d665c90fbf621787f1dcedd5a8ecaca6ec8f25cf1d8060a20c7b1ba6499
Opcode Fuzzy Hash: 1ca1815888d1660da5cd483122ac4b19c072364fc791a7412762a564bcc6bd34
Instruction Fuzzy Hash: 88514D71504310DFD310EF24DC95AABBBE8EF95710F50492DF596A7262DB70E908CBA2

Function 00E140B1 Relevance: 6.1, APIs: 4, Instructions: 65fileCOMMON

Download Yara Rule

APIs

CreateFileW.KERNEL32(?,C0000000,00000003,00000000,00000003,00000080,00000000), ref: 00E140D1
_memset.LIBCMT ref: 00E140F2
DeviceIoControl.KERNEL32(00000000,0004D02C,?,00000200,?,00000200,?,00000000), ref: 00E14144
CloseHandle.KERNEL32(00000000), ref: 00E1414D

Memory Dump Source

Source File: 00000000.00000002.2103545536.0000000000DB1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00DB0000, based on PE: true

Associated: 00000000.00000002.2103534640.0000000000DB0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103580373.0000000000E3F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103580373.0000000000E65000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103609603.0000000000E6F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103621893.0000000000E78000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_db0000_New Quotation - FE7191PO154.jbxd

Similarity

API ID: CloseControlCreateDeviceFileHandle_memset
String ID:
API String ID: 1157408455-0
Opcode ID: a3e109db0e8d8262c9b92b99a4fa5c14e48ccec81d78163c8ebf016db3aab03e
Instruction ID: 6bda7f6b2a08969b5ef34518d41f8e931ee6796cc1d62532329c7dc7fe063753
Opcode Fuzzy Hash: a3e109db0e8d8262c9b92b99a4fa5c14e48ccec81d78163c8ebf016db3aab03e
Instruction Fuzzy Hash: 3311EB75D0122C7AD7305BA6AC4DFEBBB7CEF44760F104196F908E7280D6744E848BA4

Function 00E0EB07 Relevance: 5.1, APIs: 1, Strings: 2, Instructions: 561stringCOMMON

Download Yara Rule

APIs

lstrlenW.KERNEL32(?,?,?,00000000), ref: 00E0EB19

Strings

(, xrefs: 00E0EB5F
|, xrefs: 00E0EB49

Memory Dump Source

Source File: 00000000.00000002.2103545536.0000000000DB1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00DB0000, based on PE: true

Associated: 00000000.00000002.2103534640.0000000000DB0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103580373.0000000000E3F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103580373.0000000000E65000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103609603.0000000000E6F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103621893.0000000000E78000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_db0000_New Quotation - FE7191PO154.jbxd

Similarity

API ID: lstrlen
String ID: ($|
API String ID: 1659193697-1631851259
Opcode ID: 9775a784fc38616d9a30f5f77ce673ca933f656c5996dd2e6f76bea09fefc9ad
Instruction ID: f164f229e014a17d62472fbaf8379518ae2bf5e7bb22cdec21eaa28f0b72ba5b
Opcode Fuzzy Hash: 9775a784fc38616d9a30f5f77ce673ca933f656c5996dd2e6f76bea09fefc9ad
Instruction Fuzzy Hash: 83321675A006059FD728CF19C481A6AB7F1FF48310B15D96EE49AEB7A1D770E981CB40

Function 00E225E2 Relevance: 4.7, APIs: 3, Instructions: 164networkfileCOMMON

Download Yara Rule

APIs

InternetQueryDataAvailable.WININET(00000001,?,00000000,00000000), ref: 00E226D5
InternetReadFile.WININET(00000001,00000000,00000001,00000001), ref: 00E2270C

Memory Dump Source

Source File: 00000000.00000002.2103545536.0000000000DB1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00DB0000, based on PE: true

Associated: 00000000.00000002.2103534640.0000000000DB0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103580373.0000000000E3F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103580373.0000000000E65000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103609603.0000000000E6F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103621893.0000000000E78000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_db0000_New Quotation - FE7191PO154.jbxd

Similarity

API ID: Internet$AvailableDataFileQueryRead
String ID:
API String ID: 599397726-0
Opcode ID: a5a49535eb892371220e0686819e53991684513a9ca5623a7aab7352cfcb47e3
Instruction ID: 207894921efec803939b6392b2a45c8d9459f99145497db5fc42a32d1c4cd924
Opcode Fuzzy Hash: a5a49535eb892371220e0686819e53991684513a9ca5623a7aab7352cfcb47e3
Instruction Fuzzy Hash: C641D572904219BFEB20DE55EC85EFBB7BCEB40718F10506FF701B6240EA719E459664

Function 00E1B59E Relevance: 4.6, APIs: 3, Instructions: 73COMMON

Download Yara Rule

APIs

SetErrorMode.KERNEL32(00000001), ref: 00E1B5AE
GetDiskFreeSpaceExW.KERNEL32(?,?,?,?), ref: 00E1B608
SetErrorMode.KERNEL32(00000000,00000001,00000000), ref: 00E1B655

Memory Dump Source

Source File: 00000000.00000002.2103545536.0000000000DB1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00DB0000, based on PE: true

Associated: 00000000.00000002.2103534640.0000000000DB0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103580373.0000000000E3F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103580373.0000000000E65000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103609603.0000000000E6F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103621893.0000000000E78000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_db0000_New Quotation - FE7191PO154.jbxd

Similarity

API ID: ErrorMode$DiskFreeSpace
String ID:
API String ID: 1682464887-0
Opcode ID: d0d4f4cfd2a7874433cb71791708283c184f8e3d7c8ae07ab30aab9b11ed235f
Instruction ID: 6de3d891cfb1787374f1098e362cae8afca6e6ce9b8d7bb2afbeb200dfba99e9
Opcode Fuzzy Hash: d0d4f4cfd2a7874433cb71791708283c184f8e3d7c8ae07ab30aab9b11ed235f
Instruction Fuzzy Hash: 6D215175A00118EFCB00EF65D884EEDBBB8FF49310F1480A9E905AB361DB319955CB61

Function 00E08CC3 Relevance: 4.6, APIs: 3, Instructions: 67COMMON

Download Yara Rule

APIs

Part of subcall function 00DD0FF6: std::exception::exception.LIBCMT ref: 00DD102C
Part of subcall function 00DD0FF6: __CxxThrowException@8.LIBCMT ref: 00DD1041

LookupPrivilegeValueW.ADVAPI32(00000000,00000000,00000004), ref: 00E08D0D
AdjustTokenPrivileges.ADVAPI32(?,00000000,00000000,?,00000000,?), ref: 00E08D3A
GetLastError.KERNEL32 ref: 00E08D47

Memory Dump Source

Source File: 00000000.00000002.2103545536.0000000000DB1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00DB0000, based on PE: true

Associated: 00000000.00000002.2103534640.0000000000DB0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103580373.0000000000E3F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103580373.0000000000E65000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103609603.0000000000E6F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103621893.0000000000E78000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_db0000_New Quotation - FE7191PO154.jbxd

Similarity

API ID: AdjustErrorException@8LastLookupPrivilegePrivilegesThrowTokenValuestd::exception::exception
String ID:
API String ID: 1922334811-0
Opcode ID: f0a6f4323098a128524d0edf973ea2fc4cf5da1dd651f3bfb954fcafbe5a6b95
Instruction ID: 27d112195a895328a2d22a21b8ef6ed985285150c26275e3518f136f7ed6d46d
Opcode Fuzzy Hash: f0a6f4323098a128524d0edf973ea2fc4cf5da1dd651f3bfb954fcafbe5a6b95
Instruction Fuzzy Hash: 251194B1914209AFD728EF64ED85D6BBBBCFF54710B20852EF495A3251DF30AC448A70

Function 00E14C03 Relevance: 4.5, APIs: 3, Instructions: 43memoryCOMMON

Download Yara Rule

APIs

AllocateAndInitializeSid.ADVAPI32(?,00000002,00000020,00000220,00000000,00000000,00000000,00000000,00000000,00000000,?), ref: 00E14C2C
CheckTokenMembership.ADVAPI32(00000000,?,?), ref: 00E14C43
FreeSid.ADVAPI32(?), ref: 00E14C53

Memory Dump Source

Source File: 00000000.00000002.2103545536.0000000000DB1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00DB0000, based on PE: true

Associated: 00000000.00000002.2103534640.0000000000DB0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103580373.0000000000E3F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103580373.0000000000E65000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103609603.0000000000E6F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103621893.0000000000E78000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_db0000_New Quotation - FE7191PO154.jbxd

Similarity

API ID: AllocateCheckFreeInitializeMembershipToken
String ID:
API String ID: 3429775523-0
Opcode ID: ba9f5691e5ef8f980ab9d132decce3d53c6d7fa3a7bf981663181a1dcc2eb84b
Instruction ID: db20aedfebf6f254201157ec7fa2c1d4d7498f4ca3a753f72e2a6f54f8154c20
Opcode Fuzzy Hash: ba9f5691e5ef8f980ab9d132decce3d53c6d7fa3a7bf981663181a1dcc2eb84b
Instruction Fuzzy Hash: 1FF04975E1130CBFDF04DFF4DD89AAEBBBCEF08201F0044A9E905E2281E6706A488B50

Function 00E18B13 Relevance: 3.6, APIs: 1, Strings: 1, Instructions: 68COMMON

Download Yara Rule

APIs

__time64.LIBCMT ref: 00E18B25

Part of subcall function 00DD543A: GetSystemTimeAsFileTime.KERNEL32(00000000,?,?,?,00E191F8,00000000,?,?,?,?,00E193A9,00000000,?), ref: 00DD5443
Part of subcall function 00DD543A: __aulldiv.LIBCMT ref: 00DD5463

Strings

0u, xrefs: 00E18B1C

Memory Dump Source

Source File: 00000000.00000002.2103545536.0000000000DB1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00DB0000, based on PE: true

Associated: 00000000.00000002.2103534640.0000000000DB0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103580373.0000000000E3F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103580373.0000000000E65000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103609603.0000000000E6F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103621893.0000000000E78000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_db0000_New Quotation - FE7191PO154.jbxd

Similarity

API ID: Time$FileSystem__aulldiv__time64
String ID: 0u
API String ID: 2893107130-1339160046
Opcode ID: 3a6616b50d6dab63d9cf0fc5e2d2ff1ba1dc66dec8f495de52d1d069b503c0b2
Instruction ID: 41dbbf61620d4ed43b091ea4a0204ef3bfc20804c98004c57630d87c4e8b58c1
Opcode Fuzzy Hash: 3a6616b50d6dab63d9cf0fc5e2d2ff1ba1dc66dec8f495de52d1d069b503c0b2
Instruction Fuzzy Hash: 5A21E472639510CFC329CF25D441A92B3E1EFA4311B289E6CD4E9DB2D0CA34B985CB94

Function 00DBE060 Relevance: 3.5, APIs: 2, Instructions: 539COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2103545536.0000000000DB1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00DB0000, based on PE: true

Associated: 00000000.00000002.2103534640.0000000000DB0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103580373.0000000000E3F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103580373.0000000000E65000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103609603.0000000000E6F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103621893.0000000000E78000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_db0000_New Quotation - FE7191PO154.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 21b1f48cf03f3dce734403fcffdb8808641f52f2cb7123a9dcd5ddde1bc78c7f
Instruction ID: 4f1f7f8669b1a2492efd75837a957a5e4a6e1bf00cb1a2853e918351c49434a6
Opcode Fuzzy Hash: 21b1f48cf03f3dce734403fcffdb8808641f52f2cb7123a9dcd5ddde1bc78c7f
Instruction Fuzzy Hash: 48225A74900219DFDB24DF58C491AEABBF0FF08300F298569E997AB351D734E985CBA1

Function 00E1C93C Relevance: 3.1, APIs: 2, Instructions: 52fileCOMMON

Download Yara Rule

APIs

FindFirstFileW.KERNEL32(?,?), ref: 00E1C966
FindClose.KERNEL32(00000000), ref: 00E1C996

Memory Dump Source

Source File: 00000000.00000002.2103545536.0000000000DB1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00DB0000, based on PE: true

Associated: 00000000.00000002.2103534640.0000000000DB0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103580373.0000000000E3F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103580373.0000000000E65000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103609603.0000000000E6F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103621893.0000000000E78000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_db0000_New Quotation - FE7191PO154.jbxd

Similarity

API ID: Find$CloseFileFirst
String ID:
API String ID: 2295610775-0
Opcode ID: 2dd906865070ffaf2cd407c7934af1b59eab47fcb991ee3ce500e22c7d152406
Instruction ID: f94eefa8bd8d292a888315bd9d5cbab3aded2ba41b25a4d35c3eabfc2d8dbfb3
Opcode Fuzzy Hash: 2dd906865070ffaf2cd407c7934af1b59eab47fcb991ee3ce500e22c7d152406
Instruction Fuzzy Hash: E711C8326002049FDB10EF29C855E6AF7E5FF85324F00851EF9A6E72A1DB30AC04CB91

Function 00E1A2D5 Relevance: 3.0, APIs: 2, Instructions: 31windowCOMMON

Download Yara Rule

APIs

GetLastError.KERNEL32(00000000,?,00000FFF,00000000,00000016,?,00E2977D,?,00E3FB84,?), ref: 00E1A302
FormatMessageW.KERNEL32(00001000,00000000,000000FF,00000000,?,00000FFF,00000000,00000016,?,00E2977D,?,00E3FB84,?), ref: 00E1A314

Memory Dump Source

Source File: 00000000.00000002.2103545536.0000000000DB1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00DB0000, based on PE: true

Associated: 00000000.00000002.2103534640.0000000000DB0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103580373.0000000000E3F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103580373.0000000000E65000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103609603.0000000000E6F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103621893.0000000000E78000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_db0000_New Quotation - FE7191PO154.jbxd

Similarity

API ID: ErrorFormatLastMessage
String ID:
API String ID: 3479602957-0
Opcode ID: a5454bf4f8f9484a8afcacb61cb8ade1c4a5766849519a732554551e67e07cce
Instruction ID: b27b3cb16c94e5e2bce750f7cba12e482ffa898ebaf0da40ad80c085be3c90ea
Opcode Fuzzy Hash: a5454bf4f8f9484a8afcacb61cb8ade1c4a5766849519a732554551e67e07cce
Instruction Fuzzy Hash: 3FF0BE3560522DABDB10AEA4CC48FFE776CEF08761F004165F818A2190D6309944CBB1

Function 00E08713 Relevance: 3.0, APIs: 2, Instructions: 22COMMON

Download Yara Rule

APIs

AdjustTokenPrivileges.ADVAPI32(?,00000000,?,00000000,00000000,00000000,?,00E08851), ref: 00E08728
CloseHandle.KERNEL32(?,?,00E08851), ref: 00E0873A

Memory Dump Source

Source File: 00000000.00000002.2103545536.0000000000DB1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00DB0000, based on PE: true

Associated: 00000000.00000002.2103534640.0000000000DB0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103580373.0000000000E3F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103580373.0000000000E65000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103609603.0000000000E6F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103621893.0000000000E78000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_db0000_New Quotation - FE7191PO154.jbxd

Similarity

API ID: AdjustCloseHandlePrivilegesToken
String ID:
API String ID: 81990902-0
Opcode ID: a07a5d5b84b0a3dbad52e3889a7605521260ceafdbc2676f3c45480e20dca777
Instruction ID: 6d524c00f48bd7b9cddd1986155855d8eec75c80bfdcb010cd648ce3eb88f435
Opcode Fuzzy Hash: a07a5d5b84b0a3dbad52e3889a7605521260ceafdbc2676f3c45480e20dca777
Instruction Fuzzy Hash: 62E0B676010610EFE7253B65FD09D777BA9EB04355B24882AF49690470DB62AC94DB20

Function 00DDA395 Relevance: 3.0, APIs: 2, Instructions: 8COMMONLIBRARYCODE

Download Yara Rule

APIs

SetUnhandledExceptionFilter.KERNEL32(00000000,?,00DD8F97,?,?,?,00000001), ref: 00DDA39A
UnhandledExceptionFilter.KERNEL32(?,?,?,00000001), ref: 00DDA3A3

Memory Dump Source

Source File: 00000000.00000002.2103545536.0000000000DB1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00DB0000, based on PE: true

Associated: 00000000.00000002.2103534640.0000000000DB0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103580373.0000000000E3F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103580373.0000000000E65000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103609603.0000000000E6F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103621893.0000000000E78000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_db0000_New Quotation - FE7191PO154.jbxd

Similarity

API ID: ExceptionFilterUnhandled
String ID:
API String ID: 3192549508-0
Opcode ID: 0eb0746b939d59aeedf565d32440053b35c0eb4a0b298a62c7f324eed1475b48
Instruction ID: f42cc8ec042260f591367339f9d523db20d354d0f2eb9090a102c65dee20de75
Opcode Fuzzy Hash: 0eb0746b939d59aeedf565d32440053b35c0eb4a0b298a62c7f324eed1475b48
Instruction Fuzzy Hash: 44B0923145420CAFCA002B92EC0DB8A3F68EB45AA2F404020F60D95060CB6254548A91

Function 00DDF419 Relevance: 2.1, APIs: 1, Instructions: 645COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2103545536.0000000000DB1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00DB0000, based on PE: true

Associated: 00000000.00000002.2103534640.0000000000DB0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103580373.0000000000E3F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103580373.0000000000E65000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103609603.0000000000E6F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103621893.0000000000E78000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_db0000_New Quotation - FE7191PO154.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d1796a7e423208de68f684808a33f1bac30fd1b20aa8cbdd8930e60954edbe1e
Instruction ID: 450391a1628fa8b8bfefb1651cdd55e9ceef710851c97b0a76bd14e59820f2c6
Opcode Fuzzy Hash: d1796a7e423208de68f684808a33f1bac30fd1b20aa8cbdd8930e60954edbe1e
Instruction Fuzzy Hash: CA323826D29F414DD7239639D8723356289EFB73C4F15D737F85AB5AA6DB28C4830140

Function 00DE267E Relevance: 1.8, APIs: 1, Instructions: 294COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2103545536.0000000000DB1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00DB0000, based on PE: true

Associated: 00000000.00000002.2103534640.0000000000DB0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103580373.0000000000E3F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103580373.0000000000E65000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103609603.0000000000E6F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103621893.0000000000E78000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_db0000_New Quotation - FE7191PO154.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d08623c682a344198be183996909da24b98229fbf1eb98ab5f5985a8520fcf8d
Instruction ID: 9c5d804235a12269a481a47a1d14aac39a9d0cb9bcef242eda6e3a97a3c28e37
Opcode Fuzzy Hash: d08623c682a344198be183996909da24b98229fbf1eb98ab5f5985a8520fcf8d
Instruction Fuzzy Hash: 5EB1F224D6AF414DD323AA3A883133AB64CAFBB2D5F55D72BFC2670D22FB2185874141

Function 00E241FD Relevance: 1.5, APIs: 1, Instructions: 25keyboardCOMMON

Download Yara Rule

APIs

BlockInput.USER32(00000001), ref: 00E24218

Memory Dump Source

Source File: 00000000.00000002.2103545536.0000000000DB1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00DB0000, based on PE: true

Associated: 00000000.00000002.2103534640.0000000000DB0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103580373.0000000000E3F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103580373.0000000000E65000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103609603.0000000000E6F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103621893.0000000000E78000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_db0000_New Quotation - FE7191PO154.jbxd

Similarity

API ID: BlockInput
String ID:
API String ID: 3456056419-0
Opcode ID: cca0bd50dd402b8ecc97542d2895901613a3965f24c9ded37012b1682dc1fb5f
Instruction ID: 156af05a3094cc1a79c2abff1ce57e07b9fe40987008b0e35f515bffe0632249
Opcode Fuzzy Hash: cca0bd50dd402b8ecc97542d2895901613a3965f24c9ded37012b1682dc1fb5f
Instruction Fuzzy Hash: 73E04872240154DFC710DF5AE445A9AFBD8EF54760F048015FD4AD7362DA70E8408BB0

Function 00E14EF5 Relevance: 1.5, APIs: 1, Instructions: 24COMMON

Download Yara Rule

APIs

mouse_event.USER32(00000004,00000000,00000000,00000000,00000000), ref: 00E14F18

Memory Dump Source

Source File: 00000000.00000002.2103545536.0000000000DB1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00DB0000, based on PE: true

Associated: 00000000.00000002.2103534640.0000000000DB0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103580373.0000000000E3F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103580373.0000000000E65000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103609603.0000000000E6F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103621893.0000000000E78000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_db0000_New Quotation - FE7191PO154.jbxd

Similarity

API ID: mouse_event
String ID:
API String ID: 2434400541-0
Opcode ID: 2e49ed6160ae5c034005ce17e365a7674bdebe3ca126c84b9ea1e88522bb69b9
Instruction ID: 7a7a84bd2c8c280481d49272dc2d7dae6cf20636d2e7773f890ac2d53a57da6c
Opcode Fuzzy Hash: 2e49ed6160ae5c034005ce17e365a7674bdebe3ca126c84b9ea1e88522bb69b9
Instruction Fuzzy Hash: 14D05EF03642093CFC184B20AC0FFFB010AE348B95F9479897201BA7C198E16CC6A035

Function 00E08C93 Relevance: 1.5, APIs: 1, Instructions: 19COMMON

Download Yara Rule

APIs

LogonUserW.ADVAPI32(?,00000001,?,?,00000000,00E088D1), ref: 00E08CB3

Memory Dump Source

Source File: 00000000.00000002.2103545536.0000000000DB1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00DB0000, based on PE: true

Associated: 00000000.00000002.2103534640.0000000000DB0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103580373.0000000000E3F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103580373.0000000000E65000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103609603.0000000000E6F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103621893.0000000000E78000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_db0000_New Quotation - FE7191PO154.jbxd

Similarity

API ID: LogonUser
String ID:
API String ID: 1244722697-0
Opcode ID: e9e2330a16d6fdd69641bbaa26b3050109e031bd68ba54ef7f6b03661b2eb552
Instruction ID: 631bae2a241bc307e80dff3139ae9b471ba56d3d7971140c1a8585b00761d241
Opcode Fuzzy Hash: e9e2330a16d6fdd69641bbaa26b3050109e031bd68ba54ef7f6b03661b2eb552
Instruction Fuzzy Hash: 18D05E3226450EAFEF018EA8DC05EAE3B69EB04B01F408111FE15D50A1C775D835AF60

Function 00DF2230 Relevance: 1.5, APIs: 1, Instructions: 7COMMON

Download Yara Rule

APIs

GetUserNameW.ADVAPI32(?,?), ref: 00DF2242

Memory Dump Source

Source File: 00000000.00000002.2103545536.0000000000DB1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00DB0000, based on PE: true

Associated: 00000000.00000002.2103534640.0000000000DB0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103580373.0000000000E3F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103580373.0000000000E65000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103609603.0000000000E6F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103621893.0000000000E78000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_db0000_New Quotation - FE7191PO154.jbxd

Similarity

API ID: NameUser
String ID:
API String ID: 2645101109-0
Opcode ID: f5c5cb85475067d505becff71c76a17e75563a85743ef2a7c624231637539972
Instruction ID: baf2d9ef76d34496470444b5bff921bcdc38978b8c90b811134780958ad50f9f
Opcode Fuzzy Hash: f5c5cb85475067d505becff71c76a17e75563a85743ef2a7c624231637539972
Instruction Fuzzy Hash: BDC04CF5C0410DDBDB05DB90D988DFE77BCAB05304F104055E541F2100D7749B488E71

Function 00DDA364 Relevance: 1.5, APIs: 1, Instructions: 6COMMON

Download Yara Rule

APIs

SetUnhandledExceptionFilter.KERNEL32(?), ref: 00DDA36A

Memory Dump Source

Source File: 00000000.00000002.2103545536.0000000000DB1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00DB0000, based on PE: true

Associated: 00000000.00000002.2103534640.0000000000DB0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103580373.0000000000E3F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103580373.0000000000E65000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103609603.0000000000E6F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103621893.0000000000E78000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_db0000_New Quotation - FE7191PO154.jbxd

Similarity

API ID: ExceptionFilterUnhandled
String ID:
API String ID: 3192549508-0
Opcode ID: 4df796e5a379344f992edde1fa41f3d555d3ee547b9b6d9b75ba567db9e1301d
Instruction ID: f5c16491fc8689bbcd2ca357b70ccc2aa81bb07555354b69332c4b6425f84ffa
Opcode Fuzzy Hash: 4df796e5a379344f992edde1fa41f3d555d3ee547b9b6d9b75ba567db9e1301d
Instruction Fuzzy Hash: F8A0113000020CAB8A002B82EC0888ABFACEB022A0B008020F80C820228B32A8208A80

Function 00DC8A0E Relevance: .6, Instructions: 608COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2103545536.0000000000DB1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00DB0000, based on PE: true

Associated: 00000000.00000002.2103534640.0000000000DB0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103580373.0000000000E3F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103580373.0000000000E65000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103609603.0000000000E6F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103621893.0000000000E78000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_db0000_New Quotation - FE7191PO154.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e18375cb9be3445f8a0829d383013b64cbbd8ae08cc26b3a8760dc66a2587f57
Instruction ID: 66ccdadb9010936818d28746eeb6b19002e12b210ad0560120c730c22469374f
Opcode Fuzzy Hash: e18375cb9be3445f8a0829d383013b64cbbd8ae08cc26b3a8760dc66a2587f57
Instruction Fuzzy Hash: E822F3319016278BDF288B18D5D4F7E77A1EB41344F68846ED892AB2D1DB349DC1EB70

Function 00DD2405 Relevance: .3, Instructions: 345COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2103545536.0000000000DB1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00DB0000, based on PE: true

Associated: 00000000.00000002.2103534640.0000000000DB0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103580373.0000000000E3F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103580373.0000000000E65000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103609603.0000000000E6F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103621893.0000000000E78000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_db0000_New Quotation - FE7191PO154.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: bf6ffcbe3773841c348058a39a16573d3b2338b254e5945c46ce03dce2746f28
Instruction ID: 2c27766f555632c968013d2b7cbd2dd4384f9f8c179a3db834ba9796f723bfd7
Opcode Fuzzy Hash: bf6ffcbe3773841c348058a39a16573d3b2338b254e5945c46ce03dce2746f28
Instruction Fuzzy Hash: D5C1713720519309DB2D4639987453EBAE19EB27B131E0B5FE8B2CB6C4EF20D524E630

Function 00DD283A Relevance: .3, Instructions: 341COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2103545536.0000000000DB1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00DB0000, based on PE: true

Associated: 00000000.00000002.2103534640.0000000000DB0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103580373.0000000000E3F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103580373.0000000000E65000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103609603.0000000000E6F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103621893.0000000000E78000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_db0000_New Quotation - FE7191PO154.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a635e2a33a60bcf8d734eac2a911e111534612f0cd64c6a362f1e57f4f360174
Instruction ID: 9e84b2ac6ded39aa8e59d1c078bfb874bb2a0034beeb3558ce6a3155c90c4e9b
Opcode Fuzzy Hash: a635e2a33a60bcf8d734eac2a911e111534612f0cd64c6a362f1e57f4f360174
Instruction Fuzzy Hash: A1C1843720519309DB2D4639987413EBBE19EA27B131E1B6FE4B2DB6D4EF20D524E630

Function 00DD1BB8 Relevance: .3, Instructions: 323COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2103545536.0000000000DB1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00DB0000, based on PE: true

Associated: 00000000.00000002.2103534640.0000000000DB0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103580373.0000000000E3F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103580373.0000000000E65000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103609603.0000000000E6F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103621893.0000000000E78000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_db0000_New Quotation - FE7191PO154.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b18fb967447e529c76739499a87999de3f08bdf72590393fa5476362680146d7
Instruction ID: 477061f03665faa611784b936f6f3732432d34c10cdb101069304b0d6626ec27
Opcode Fuzzy Hash: b18fb967447e529c76739499a87999de3f08bdf72590393fa5476362680146d7
Instruction Fuzzy Hash: ECC1623B20515319DB2D463A987413EBBE2DEA27B131E0B5EE4B2CB6D4EF20D5249630

Function 00E337F3 Relevance: 51.1, APIs: 6, Strings: 23, Instructions: 365windowCOMMON

Download Yara Rule

APIs

CharUpperBuffW.USER32(?,?,00E3F910), ref: 00E338AF
IsWindowVisible.USER32(?), ref: 00E338D3

Strings

SENDCOMMANDID, xrefs: 00E33C62
TABRIGHT, xrefs: 00E33925
HIDEDROPDOWN, xrefs: 00E33988
TABLEFT, xrefs: 00E3390F
UNCHECK, xrefs: 00E33B0B
GETLINECOUNT, xrefs: 00E33B4E
GETLINE, xrefs: 00E33C23
ADDSTRING, xrefs: 00E3399E
EDITPASTE, xrefs: 00E33BE7
SELECTSTRING, xrefs: 00E33A8E
ISVISIBLE, xrefs: 00E338BF
GETCURRENTSELECTION, xrefs: 00E33A6B
DELSTRING, xrefs: 00E339D1
ISCHECKED, xrefs: 00E33AC1
FINDSTRING, xrefs: 00E339FE
GETSELECTED, xrefs: 00E33B2B
SHOWDROPDOWN, xrefs: 00E33968
CHECK, xrefs: 00E33AF5
GETCURRENTCOL, xrefs: 00E33BB0
CURRENTTAB, xrefs: 00E33945
SETCURRENTSELECTION, xrefs: 00E33A3E
GETCURRENTLINE, xrefs: 00E33B75
ISENABLED, xrefs: 00E338F3

Memory Dump Source

Source File: 00000000.00000002.2103545536.0000000000DB1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00DB0000, based on PE: true

Associated: 00000000.00000002.2103534640.0000000000DB0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103580373.0000000000E3F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103580373.0000000000E65000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103609603.0000000000E6F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103621893.0000000000E78000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_db0000_New Quotation - FE7191PO154.jbxd

Similarity

API ID: BuffCharUpperVisibleWindow
String ID: ADDSTRING$CHECK$CURRENTTAB$DELSTRING$EDITPASTE$FINDSTRING$GETCURRENTCOL$GETCURRENTLINE$GETCURRENTSELECTION$GETLINE$GETLINECOUNT$GETSELECTED$HIDEDROPDOWN$ISCHECKED$ISENABLED$ISVISIBLE$SELECTSTRING$SENDCOMMANDID$SETCURRENTSELECTION$SHOWDROPDOWN$TABLEFT$TABRIGHT$UNCHECK
API String ID: 4105515805-45149045
Opcode ID: ffde6527060519ba93a38bc59be60d31183e601d9a9c06b5e3fbc736e9296030
Instruction ID: 084d8cc1b191ffe58e369867ff74d69e4deb813dcfe4460631334ecf6deca5f1
Opcode Fuzzy Hash: ffde6527060519ba93a38bc59be60d31183e601d9a9c06b5e3fbc736e9296030
Instruction Fuzzy Hash: C2D12330204205DBCB14EF30C455EA9BFA6EF94354F146459B8867B7E3DB21EE4ACB61

Function 00E3A849 Relevance: 49.8, APIs: 33, Instructions: 274COMMON

Download Yara Rule

APIs

SetTextColor.GDI32(?,00000000), ref: 00E3A89F
GetSysColorBrush.USER32(0000000F), ref: 00E3A8D0
GetSysColor.USER32(0000000F), ref: 00E3A8DC
SetBkColor.GDI32(?,000000FF), ref: 00E3A8F6
SelectObject.GDI32(?,?), ref: 00E3A905
InflateRect.USER32(?,000000FF,000000FF), ref: 00E3A930
GetSysColor.USER32(00000010), ref: 00E3A938
CreateSolidBrush.GDI32(00000000), ref: 00E3A93F
FrameRect.USER32(?,?,00000000), ref: 00E3A94E
DeleteObject.GDI32(00000000), ref: 00E3A955
InflateRect.USER32(?,000000FE,000000FE), ref: 00E3A9A0
FillRect.USER32(?,?,?), ref: 00E3A9D2
GetWindowLongW.USER32(?,000000F0), ref: 00E3A9FD

Part of subcall function 00E3AB60: GetSysColor.USER32(00000012), ref: 00E3AB99
Part of subcall function 00E3AB60: SetTextColor.GDI32(?,?), ref: 00E3AB9D
Part of subcall function 00E3AB60: GetSysColorBrush.USER32(0000000F), ref: 00E3ABB3
Part of subcall function 00E3AB60: GetSysColor.USER32(0000000F), ref: 00E3ABBE
Part of subcall function 00E3AB60: GetSysColor.USER32(00000011), ref: 00E3ABDB
Part of subcall function 00E3AB60: CreatePen.GDI32(00000000,00000001,00743C00), ref: 00E3ABE9
Part of subcall function 00E3AB60: SelectObject.GDI32(?,00000000), ref: 00E3ABFA
Part of subcall function 00E3AB60: SetBkColor.GDI32(?,00000000), ref: 00E3AC03
Part of subcall function 00E3AB60: SelectObject.GDI32(?,?), ref: 00E3AC10
Part of subcall function 00E3AB60: InflateRect.USER32(?,000000FF,000000FF), ref: 00E3AC2F
Part of subcall function 00E3AB60: RoundRect.GDI32(?,?,?,?,?,00000005,00000005), ref: 00E3AC46
Part of subcall function 00E3AB60: GetWindowLongW.USER32(00000000,000000F0), ref: 00E3AC5B

Memory Dump Source

Source File: 00000000.00000002.2103545536.0000000000DB1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00DB0000, based on PE: true

Associated: 00000000.00000002.2103534640.0000000000DB0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103580373.0000000000E3F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103580373.0000000000E65000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103609603.0000000000E6F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103621893.0000000000E78000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_db0000_New Quotation - FE7191PO154.jbxd

Similarity

API ID: Color$Rect$Object$BrushInflateSelect$CreateLongTextWindow$DeleteFillFrameRoundSolid
String ID:
API String ID: 4124339563-0
Opcode ID: 61092b8810a359abbfa6c8b5c3e7cfd945f060e78262b22e129f92bf19efd87b
Instruction ID: 17dda948f039036b6ecc08b8b357bbd377205781af8d9bedafc5e8548691cf53
Opcode Fuzzy Hash: 61092b8810a359abbfa6c8b5c3e7cfd945f060e78262b22e129f92bf19efd87b
Instruction Fuzzy Hash: 91A19E72408305BFD7109F65DC0CE6BBFA9FF88325F145A29F9A2A61A1D731D848CB52

Function 00E277BE Relevance: 45.8, APIs: 22, Strings: 4, Instructions: 284windowCOMMON

Download Yara Rule

APIs

DestroyWindow.USER32(00000000), ref: 00E277F1
SystemParametersInfoW.USER32(00000030,00000000,?,00000000), ref: 00E278B0
SetRect.USER32(?,00000000,00000000,0000012C,00000064), ref: 00E278EE
AdjustWindowRectEx.USER32(?,88C00000,00000000,00000006), ref: 00E27900
CreateWindowExW.USER32(00000006,AutoIt v3,?,88C00000,?,?,?,?,00000000,00000000,00000000), ref: 00E27946
GetClientRect.USER32(00000000,?), ref: 00E27952
CreateWindowExW.USER32(00000000,static,?,50000000,?,00000004,00000500,00000018,00000000,00000000,00000000), ref: 00E27996
CreateDCW.GDI32(DISPLAY,00000000,00000000,00000000), ref: 00E279A5
GetStockObject.GDI32(00000011), ref: 00E279B5
SelectObject.GDI32(00000000,00000000), ref: 00E279B9
GetTextFaceW.GDI32(00000000,00000040,?,?,50000000,?,00000004,00000500,00000018,00000000,00000000,00000000,?,88C00000,?), ref: 00E279C9
GetDeviceCaps.GDI32(00000000,0000005A), ref: 00E279D2
DeleteDC.GDI32(00000000), ref: 00E279DB
CreateFontW.GDI32(00000000,00000000,00000000,00000000,00000258,00000000,00000000,00000000,00000001,00000004,00000000,00000002,00000000,?), ref: 00E27A07
SendMessageW.USER32(00000030,00000000,00000001), ref: 00E27A1E
CreateWindowExW.USER32(00000200,msctls_progress32,00000000,50000001,?,0000001E,00000104,00000014,00000000,00000000,00000000), ref: 00E27A59
SendMessageW.USER32(00000000,00000401,00000000,00640000), ref: 00E27A6D
SendMessageW.USER32(00000404,00000001,00000000), ref: 00E27A7E
CreateWindowExW.USER32(00000000,static,?,50000000,?,00000037,00000500,00000032,00000000,00000000,00000000), ref: 00E27AAE
GetStockObject.GDI32(00000011), ref: 00E27AB9
SendMessageW.USER32(00000030,00000000,?,50000000), ref: 00E27AC4
ShowWindow.USER32(00000004,?,50000000,?,00000004,00000500,00000018,00000000,00000000,00000000,?,88C00000,?,?,?,?), ref: 00E27ACE

Strings

msctls_progress32, xrefs: 00E27A4F
static, xrefs: 00E27990, 00E27AA8
AutoIt v3, xrefs: 00E2793E
DISPLAY, xrefs: 00E2799B

Memory Dump Source

Source File: 00000000.00000002.2103545536.0000000000DB1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00DB0000, based on PE: true

Associated: 00000000.00000002.2103534640.0000000000DB0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103580373.0000000000E3F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103580373.0000000000E65000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103609603.0000000000E6F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103621893.0000000000E78000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_db0000_New Quotation - FE7191PO154.jbxd

Similarity

API ID: Window$Create$MessageSend$ObjectRect$Stock$AdjustCapsClientDeleteDestroyDeviceFaceFontInfoParametersSelectShowSystemText
String ID: AutoIt v3$DISPLAY$msctls_progress32$static
API String ID: 2910397461-517079104
Opcode ID: 2192159897ed476fb31135a39b0eef7f63744d8811c33ef2795a52b45d287f24
Instruction ID: 705d35456143e69b10fa9944bf84491fab96feb2c9faecc973393b06c3091595
Opcode Fuzzy Hash: 2192159897ed476fb31135a39b0eef7f63744d8811c33ef2795a52b45d287f24
Instruction Fuzzy Hash: B1A19FB1A40619BFEB14DBA5DC4AFAEBBB9EB44714F004114FA15B72E1CB70AD04CB60

Function 00E1AF7B Relevance: 45.7, APIs: 3, Strings: 23, Instructions: 186COMMON

Download Yara Rule

APIs

SetErrorMode.KERNEL32(00000001), ref: 00E1AF89
GetDriveTypeW.KERNEL32(?,00E3FAC0,?,\\.\,00E3F910), ref: 00E1B066
SetErrorMode.KERNEL32(00000000,00E3FAC0,?,\\.\,00E3F910), ref: 00E1B1C4

Strings

FileBackedVirtual, xrefs: 00E1B193
ATAPI, xrefs: 00E1B138
CDROM, xrefs: 00E1B09A
PhysicalDrive, xrefs: 00E1B012
Fixed, xrefs: 00E1B0AE
Virtual, xrefs: 00E1B18C
iSCSI, xrefs: 00E1B169
RAMDisk, xrefs: 00E1B090
SAS, xrefs: 00E1B170
RAID, xrefs: 00E1B162
1394, xrefs: 00E1B146
Fibre, xrefs: 00E1B154
ATA, xrefs: 00E1B13F
SSA, xrefs: 00E1B14D
Removable, xrefs: 00E1B0B8
SCSI, xrefs: 00E1B131
\\.\, xrefs: 00E1AFDB
Unknown, xrefs: 00E1B086, 00E1B12A
SSD, xrefs: 00E1B0F1
MMC, xrefs: 00E1B185
SATA, xrefs: 00E1B177
USB, xrefs: 00E1B15B
Network, xrefs: 00E1B0A4

Memory Dump Source

Source File: 00000000.00000002.2103545536.0000000000DB1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00DB0000, based on PE: true

Associated: 00000000.00000002.2103534640.0000000000DB0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103580373.0000000000E3F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103580373.0000000000E65000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103609603.0000000000E6F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103621893.0000000000E78000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_db0000_New Quotation - FE7191PO154.jbxd

Similarity

API ID: ErrorMode$DriveType
String ID: 1394$ATA$ATAPI$CDROM$Fibre$FileBackedVirtual$Fixed$MMC$Network$PhysicalDrive$RAID$RAMDisk$Removable$SAS$SATA$SCSI$SSA$SSD$USB$Unknown$Virtual$\\.\$iSCSI
API String ID: 2907320926-4222207086
Opcode ID: ef8fe4b908a08f7f8250a7940cd45212e7924fac677e82545a26aace55100db7
Instruction ID: b8b4ae1ef3dd61aa8fb1ac9f478519d2150010c162372698dd1634af35db099b
Opcode Fuzzy Hash: ef8fe4b908a08f7f8250a7940cd45212e7924fac677e82545a26aace55100db7
Instruction Fuzzy Hash: 2251A130B85345FB8B00DB20D9A29FD73B0EB583857296026E80BB7291C775AD81DF52

Function 00DB6A3C Relevance: 44.0, APIs: 12, Strings: 13, Instructions: 275COMMON

Download Yara Rule

APIs

__wcsnicmp.LIBCMT ref: 00DB6A91
__wcsnicmp.LIBCMT ref: 00DB6AA9
__wcsnicmp.LIBCMT ref: 00DB6AC1
__wcsnicmp.LIBCMT ref: 00DB6AD9
__wcsnicmp.LIBCMT ref: 00DB6AF1
__wcsnicmp.LIBCMT ref: 00DB6B09
__wcsnicmp.LIBCMT ref: 00DB6B21
__wcsnicmp.LIBCMT ref: 00DB6B35
__wcsnicmp.LIBCMT ref: 00DB6B76
__wcsnicmp.LIBCMT ref: 00DB6B8A
__wcsnicmp.LIBCMT ref: 00DB6B9E
__wcsnicmp.LIBCMT ref: 00DB6BB2

Strings

#include, xrefs: 00DB6B03
#requireadmin, xrefs: 00DB6ABB
#comments-end, xrefs: 00DB6B98
Bad directive syntax error, xrefs: 00DEE743
#include-once, xrefs: 00DB6AEB
#comments-start, xrefs: 00DB6B1B, 00DB6B70
#pragma compile, xrefs: 00DB6A8B
#OnAutoItStartRegister, xrefs: 00DB6AD3
Unterminated group of comments, xrefs: 00DEE82C
#cs, xrefs: 00DB6B2F, 00DB6B84
#notrayicon, xrefs: 00DB6AA3
#ce, xrefs: 00DB6BAC
Cannot parse #include, xrefs: 00DEE819

Memory Dump Source

Source File: 00000000.00000002.2103545536.0000000000DB1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00DB0000, based on PE: true

Associated: 00000000.00000002.2103534640.0000000000DB0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103580373.0000000000E3F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103580373.0000000000E65000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103609603.0000000000E6F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103621893.0000000000E78000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_db0000_New Quotation - FE7191PO154.jbxd

Similarity

API ID: __wcsnicmp
String ID: #OnAutoItStartRegister$#ce$#comments-end$#comments-start$#cs$#include$#include-once$#notrayicon$#pragma compile$#requireadmin$Bad directive syntax error$Cannot parse #include$Unterminated group of comments
API String ID: 1038674560-86951937
Opcode ID: 2b2246ffa68637f4c8b00cc0dfbfb0521114a97c599dec6e5adfcad445795b05
Instruction ID: 5b0f2808bbfed80aca10e201b72abb82ad1f126a1c06a46d50431e7a3b94f7e5
Opcode Fuzzy Hash: 2b2246ffa68637f4c8b00cc0dfbfb0521114a97c599dec6e5adfcad445795b05
Instruction Fuzzy Hash: C6810870740345FBCB20BB61DC83FEE7768EF15700F085026F946AA296EB64EA45C675

Function 00E3AB60 Relevance: 39.2, APIs: 26, Instructions: 201windowCOMMON

Download Yara Rule

APIs

GetSysColor.USER32(00000012), ref: 00E3AB99
SetTextColor.GDI32(?,?), ref: 00E3AB9D
GetSysColorBrush.USER32(0000000F), ref: 00E3ABB3
GetSysColor.USER32(0000000F), ref: 00E3ABBE
CreateSolidBrush.GDI32(?), ref: 00E3ABC3
GetSysColor.USER32(00000011), ref: 00E3ABDB
CreatePen.GDI32(00000000,00000001,00743C00), ref: 00E3ABE9
SelectObject.GDI32(?,00000000), ref: 00E3ABFA
SetBkColor.GDI32(?,00000000), ref: 00E3AC03
SelectObject.GDI32(?,?), ref: 00E3AC10
InflateRect.USER32(?,000000FF,000000FF), ref: 00E3AC2F
RoundRect.GDI32(?,?,?,?,?,00000005,00000005), ref: 00E3AC46
GetWindowLongW.USER32(00000000,000000F0), ref: 00E3AC5B
SendMessageW.USER32(00000000,0000000E,00000000,00000000), ref: 00E3ACA7
GetWindowTextW.USER32(00000000,00000000,00000001), ref: 00E3ACCE
InflateRect.USER32(?,000000FD,000000FD), ref: 00E3ACEC
DrawFocusRect.USER32(?,?), ref: 00E3ACF7
GetSysColor.USER32(00000011), ref: 00E3AD05
SetTextColor.GDI32(?,00000000), ref: 00E3AD0D
DrawTextW.USER32(?,00000000,000000FF,?,?), ref: 00E3AD21
SelectObject.GDI32(?,00E3A869), ref: 00E3AD38
DeleteObject.GDI32(?), ref: 00E3AD43
SelectObject.GDI32(?,?), ref: 00E3AD49
DeleteObject.GDI32(?), ref: 00E3AD4E
SetTextColor.GDI32(?,?), ref: 00E3AD54
SetBkColor.GDI32(?,?), ref: 00E3AD5E

Memory Dump Source

Source File: 00000000.00000002.2103545536.0000000000DB1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00DB0000, based on PE: true

Associated: 00000000.00000002.2103534640.0000000000DB0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103580373.0000000000E3F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103580373.0000000000E65000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103609603.0000000000E6F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103621893.0000000000E78000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_db0000_New Quotation - FE7191PO154.jbxd

Similarity

API ID: Color$Object$Text$RectSelect$BrushCreateDeleteDrawInflateWindow$FocusLongMessageRoundSendSolid
String ID:
API String ID: 1996641542-0
Opcode ID: 58a9db8a65c4440c4f656f7c9ed1838697925a5126a51470fb7bd321ec5993e8
Instruction ID: 70776c46530003379cae86b9564c3c4633d514380e9738255d532b193428252b
Opcode Fuzzy Hash: 58a9db8a65c4440c4f656f7c9ed1838697925a5126a51470fb7bd321ec5993e8
Instruction Fuzzy Hash: 71614971D01218BFDB119FA9DC4CEAEBFB9EB08320F148126F915BB2A1D6719D44DB90

Function 00E38C44 Relevance: 38.9, APIs: 21, Strings: 1, Instructions: 401windowCOMMON

Download Yara Rule

APIs

SendMessageW.USER32(?,00000158,000000FF,0000014E), ref: 00E38D34
SendMessageW.USER32(?,0000014E,00000000,00000000), ref: 00E38D45
CharNextW.USER32(0000014E), ref: 00E38D74
SendMessageW.USER32(?,0000014B,00000000,00000000), ref: 00E38DB5
SendMessageW.USER32(?,00000158,000000FF,00000158), ref: 00E38DCB
SendMessageW.USER32(?,0000014E,00000000,00000000), ref: 00E38DDC
SendMessageW.USER32(?,000000C2,00000001,0000014E), ref: 00E38DF9
SetWindowTextW.USER32(?,0000014E), ref: 00E38E45
SendMessageW.USER32(?,000000B1,000F4240,000F423F), ref: 00E38E5B
SendMessageW.USER32(?,00001002,00000000,?), ref: 00E38E8C
_memset.LIBCMT ref: 00E38EB1
SendMessageW.USER32(00000000,00001060,00000001,00000004), ref: 00E38EFA
_memset.LIBCMT ref: 00E38F59
SendMessageW.USER32(?,00001053,000000FF,?), ref: 00E38F83
SendMessageW.USER32(?,00001074,?,00000001), ref: 00E38FDB
SendMessageW.USER32(?,0000133D,?,?), ref: 00E39088
InvalidateRect.USER32(?,00000000,00000001), ref: 00E390AA
GetMenuItemInfoW.USER32(?,?,00000000,00000030), ref: 00E390F4
SetMenuItemInfoW.USER32(?,?,00000000,00000030), ref: 00E39121
DrawMenuBar.USER32(?), ref: 00E39130
SetWindowTextW.USER32(?,0000014E), ref: 00E39158

Strings

0, xrefs: 00E390C2

Memory Dump Source

Source File: 00000000.00000002.2103545536.0000000000DB1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00DB0000, based on PE: true

Associated: 00000000.00000002.2103534640.0000000000DB0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103580373.0000000000E3F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103580373.0000000000E65000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103609603.0000000000E6F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103621893.0000000000E78000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_db0000_New Quotation - FE7191PO154.jbxd

Similarity

API ID: MessageSend$Menu$InfoItemTextWindow_memset$CharDrawInvalidateNextRect
String ID: 0
API String ID: 1073566785-4108050209
Opcode ID: 5e13a6770c788b13fca39ace8435337de5bf999758f2ee637e7356e60f83a535
Instruction ID: 0e721643abf7da0ed39dac34e206c16aee98423531a58078ac8a8d3f12aa9239
Opcode Fuzzy Hash: 5e13a6770c788b13fca39ace8435337de5bf999758f2ee637e7356e60f83a535
Instruction Fuzzy Hash: BFE19E70901209AFDB209F61CC8DEEEBFB9EF05714F009156F919BA291DB708A85DF61

Function 00E34B16 Relevance: 37.0, APIs: 18, Strings: 3, Instructions: 290windowCOMMON

Download Yara Rule

APIs

GetCursorPos.USER32(?), ref: 00E34C51
GetDesktopWindow.USER32 ref: 00E34C66
GetWindowRect.USER32(00000000), ref: 00E34C6D
GetWindowLongW.USER32(?,000000F0), ref: 00E34CCF
DestroyWindow.USER32(?), ref: 00E34CFB
CreateWindowExW.USER32(00000008,tooltips_class32,00000000,00000003,80000000,80000000,80000000,80000000,00000000,00000000,00000000,00000000), ref: 00E34D24
SendMessageW.USER32(00000000,00000432,00000000,00000030), ref: 00E34D42
SendMessageW.USER32(?,00000439,00000000,00000030), ref: 00E34D68
SendMessageW.USER32(?,00000421,?,?), ref: 00E34D7D
SendMessageW.USER32(?,0000041D,00000000,00000000), ref: 00E34D90
IsWindowVisible.USER32(?), ref: 00E34DB0
SendMessageW.USER32(?,00000412,00000000,D8F0D8F0), ref: 00E34DCB
SendMessageW.USER32(?,00000411,00000001,00000030), ref: 00E34DDF
GetWindowRect.USER32(?,?), ref: 00E34DF7
MonitorFromPoint.USER32(?,?,00000002), ref: 00E34E1D
GetMonitorInfoW.USER32(00000000,?), ref: 00E34E37
CopyRect.USER32(?,?), ref: 00E34E4E
SendMessageW.USER32(?,00000412,00000000), ref: 00E34EB9

Strings

tooltips_class32, xrefs: 00E34D1D
0, xrefs: 00E34BFC
(, xrefs: 00E34E2A

Memory Dump Source

Source File: 00000000.00000002.2103545536.0000000000DB1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00DB0000, based on PE: true

Associated: 00000000.00000002.2103534640.0000000000DB0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103580373.0000000000E3F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103580373.0000000000E65000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103609603.0000000000E6F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103621893.0000000000E78000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_db0000_New Quotation - FE7191PO154.jbxd

Similarity

API ID: MessageSendWindow$Rect$Monitor$CopyCreateCursorDesktopDestroyFromInfoLongPointVisible
String ID: ($0$tooltips_class32
API String ID: 698492251-4156429822
Opcode ID: 17c90175660c85525fd4d4399efb5ab85c7c0714a9bfd941ceafcc9faffaf519
Instruction ID: d365e692b0aea073dc5a1d712598866eb57715695afd5c62cc3e57789d7e93fa
Opcode Fuzzy Hash: 17c90175660c85525fd4d4399efb5ab85c7c0714a9bfd941ceafcc9faffaf519
Instruction Fuzzy Hash: 02B147B1604341AFDB04DF25C849B6ABFE4FF88714F00991DF59AAB2A1D771E805CBA1

Function 00E146D6 Relevance: 36.9, APIs: 16, Strings: 5, Instructions: 179COMMON

Download Yara Rule

APIs

GetFileVersionInfoSizeW.VERSION(?,?), ref: 00E146E8
GetFileVersionInfoW.VERSION(?,00000000,00000000,00000000,?,?), ref: 00E1470E
_wcscpy.LIBCMT ref: 00E1473C
_wcscmp.LIBCMT ref: 00E14747
_wcscat.LIBCMT ref: 00E1475D
_wcsstr.LIBCMT ref: 00E14768
VerQueryValueW.VERSION(?,\VarFileInfo\Translation,?,?,?,?,?,?,00000000,?,?), ref: 00E14784
_wcscat.LIBCMT ref: 00E147CD
_wcscat.LIBCMT ref: 00E147D4
_wcsncpy.LIBCMT ref: 00E147FF

Strings

StringFileInfo\, xrefs: 00E14757
04090000, xrefs: 00E147BA
\VarFileInfo\Translation, xrefs: 00E1477C
DefaultLangCodepage, xrefs: 00E147E7
%u.%u.%u.%u, xrefs: 00E14862

Memory Dump Source

Source File: 00000000.00000002.2103545536.0000000000DB1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00DB0000, based on PE: true

Associated: 00000000.00000002.2103534640.0000000000DB0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103580373.0000000000E3F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103580373.0000000000E65000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103609603.0000000000E6F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103621893.0000000000E78000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_db0000_New Quotation - FE7191PO154.jbxd

Similarity

API ID: _wcscat$FileInfoVersion$QuerySizeValue_wcscmp_wcscpy_wcsncpy_wcsstr
String ID: %u.%u.%u.%u$04090000$DefaultLangCodepage$StringFileInfo\$\VarFileInfo\Translation
API String ID: 699586101-1459072770
Opcode ID: 76a0516fcf07fffa983a939818a4af1469040a9f6bb477923884021f90058f3d
Instruction ID: fabcd5cd931e294f7ffa98e8cff734eb3f33ba36eeae4fcdc949fb35a5de830b
Opcode Fuzzy Hash: 76a0516fcf07fffa983a939818a4af1469040a9f6bb477923884021f90058f3d
Instruction Fuzzy Hash: FD41EF72A003057ADB14AB759C46EBF7BACDF41710F04006BF905B6292EB61AA41A6B5

Function 00DB27D9 Relevance: 33.5, APIs: 18, Strings: 1, Instructions: 286windowtimeCOMMON

Download Yara Rule

APIs

SystemParametersInfoW.USER32(00000030,00000000,000000FF,00000000), ref: 00DB28BC
GetSystemMetrics.USER32(00000007), ref: 00DB28C4
SystemParametersInfoW.USER32(00000030,00000000,000000FF,00000000), ref: 00DB28EF
GetSystemMetrics.USER32(00000008), ref: 00DB28F7
GetSystemMetrics.USER32(00000004), ref: 00DB291C
SetRect.USER32(000000FF,00000000,00000000,000000FF,000000FF), ref: 00DB2939
AdjustWindowRectEx.USER32(000000FF,?,00000000,?), ref: 00DB2949
CreateWindowExW.USER32(?,AutoIt v3 GUI,?,?,?,000000FF,000000FF,000000FF,?,00000000,00000000), ref: 00DB297C
SetWindowLongW.USER32(00000000,000000EB,00000000), ref: 00DB2990
GetClientRect.USER32(00000000,000000FF), ref: 00DB29AE
GetStockObject.GDI32(00000011), ref: 00DB29CA
SendMessageW.USER32(00000000,00000030,00000000), ref: 00DB29D5

Part of subcall function 00DB2344: GetCursorPos.USER32(?), ref: 00DB2357
Part of subcall function 00DB2344: ScreenToClient.USER32(00E767B0,?), ref: 00DB2374
Part of subcall function 00DB2344: GetAsyncKeyState.USER32(00000001), ref: 00DB2399
Part of subcall function 00DB2344: GetAsyncKeyState.USER32(00000002), ref: 00DB23A7

SetTimer.USER32(00000000,00000000,00000028,00DB1256), ref: 00DB29FC

Strings

AutoIt v3 GUI, xrefs: 00DB2974

Memory Dump Source

Source File: 00000000.00000002.2103545536.0000000000DB1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00DB0000, based on PE: true

Associated: 00000000.00000002.2103534640.0000000000DB0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103580373.0000000000E3F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103580373.0000000000E65000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103609603.0000000000E6F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103621893.0000000000E78000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_db0000_New Quotation - FE7191PO154.jbxd

Similarity

API ID: System$MetricsRectWindow$AsyncClientInfoParametersState$AdjustCreateCursorLongMessageObjectScreenSendStockTimer
String ID: AutoIt v3 GUI
API String ID: 1458621304-248962490
Opcode ID: 5b457e3b665ac3bd5ce4b29566ecf9392a0d90a30a1fa331807df137feeae8e4
Instruction ID: 4903a70fcb10e1675ec4e0bf7a9b103ec1c96efc468ddda1a9a87c93a5758eaa
Opcode Fuzzy Hash: 5b457e3b665ac3bd5ce4b29566ecf9392a0d90a30a1fa331807df137feeae8e4
Instruction Fuzzy Hash: 70B16071A00249EFDB14DF69DC49BEE7BB4FB08315F108129FA16A72A0DB74D845CB60

Function 00E34069 Relevance: 28.3, APIs: 3, Strings: 13, Instructions: 283windowCOMMON

Download Yara Rule

APIs

CharUpperBuffW.USER32(?,?), ref: 00E340F6
SendMessageW.USER32(?,00001032,00000000,00000000), ref: 00E341B6

Strings

SELECT, xrefs: 00E34250
SELECTINVERT, xrefs: 00E34286
SELECTALL, xrefs: 00E3421D
FINDITEM, xrefs: 00E34329
VIEWCHANGE, xrefs: 00E34375
GETSELECTEDCOUNT, xrefs: 00E34199
GETTEXT, xrefs: 00E3415F
DESELECT, xrefs: 00E342A4
ISSELECTED, xrefs: 00E341C1
GETSELECTED, xrefs: 00E342E4
GETSUBITEMCOUNT, xrefs: 00E34141
GETITEMCOUNT, xrefs: 00E34128
SELECTCLEAR, xrefs: 00E34235

Memory Dump Source

Source File: 00000000.00000002.2103545536.0000000000DB1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00DB0000, based on PE: true

Associated: 00000000.00000002.2103534640.0000000000DB0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103580373.0000000000E3F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103580373.0000000000E65000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103609603.0000000000E6F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103621893.0000000000E78000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_db0000_New Quotation - FE7191PO154.jbxd

Similarity

API ID: BuffCharMessageSendUpper
String ID: DESELECT$FINDITEM$GETITEMCOUNT$GETSELECTED$GETSELECTEDCOUNT$GETSUBITEMCOUNT$GETTEXT$ISSELECTED$SELECT$SELECTALL$SELECTCLEAR$SELECTINVERT$VIEWCHANGE
API String ID: 3974292440-719923060
Opcode ID: 838c791dda965eabd302e8bcb5ba190e242f0e657a78c9d12c8d9607cf13eaa4
Instruction ID: 457e336ee0d8844b6a008bc0a9491669f4b7932c286794556162aa438ed66559
Opcode Fuzzy Hash: 838c791dda965eabd302e8bcb5ba190e242f0e657a78c9d12c8d9607cf13eaa4
Instruction Fuzzy Hash: 61A1AF70214241DBCB14EF20C856EAABBE5EF84314F105869B896BB7E2DB30FC05CB61

Function 00E252F0 Relevance: 27.1, APIs: 18, Instructions: 124COMMON

Download Yara Rule

APIs

LoadCursorW.USER32(00000000,00007F89), ref: 00E25309
LoadCursorW.USER32(00000000,00007F8A), ref: 00E25314
LoadCursorW.USER32(00000000,00007F00), ref: 00E2531F
LoadCursorW.USER32(00000000,00007F03), ref: 00E2532A
LoadCursorW.USER32(00000000,00007F8B), ref: 00E25335
LoadCursorW.USER32(00000000,00007F01), ref: 00E25340
LoadCursorW.USER32(00000000,00007F81), ref: 00E2534B
LoadCursorW.USER32(00000000,00007F88), ref: 00E25356
LoadCursorW.USER32(00000000,00007F80), ref: 00E25361
LoadCursorW.USER32(00000000,00007F86), ref: 00E2536C
LoadCursorW.USER32(00000000,00007F83), ref: 00E25377
LoadCursorW.USER32(00000000,00007F85), ref: 00E25382
LoadCursorW.USER32(00000000,00007F82), ref: 00E2538D
LoadCursorW.USER32(00000000,00007F84), ref: 00E25398
LoadCursorW.USER32(00000000,00007F04), ref: 00E253A3
LoadCursorW.USER32(00000000,00007F02), ref: 00E253AE
GetCursorInfo.USER32(?), ref: 00E253BE
GetLastError.KERNEL32(00000001,00000000), ref: 00E253E9

Memory Dump Source

Source File: 00000000.00000002.2103545536.0000000000DB1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00DB0000, based on PE: true

Associated: 00000000.00000002.2103534640.0000000000DB0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103580373.0000000000E3F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103580373.0000000000E65000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103609603.0000000000E6F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103621893.0000000000E78000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_db0000_New Quotation - FE7191PO154.jbxd

Similarity

API ID: Cursor$Load$ErrorInfoLast
String ID:
API String ID: 3215588206-0
Opcode ID: e7e79b404f4ce90f7bb672ef6091f04a6dc6efb1719ff6994c0513c559aac577
Instruction ID: 2492aec7d325336b918e99c1327edd0fcb109b0d1e94873b26229751399379c9
Opcode Fuzzy Hash: e7e79b404f4ce90f7bb672ef6091f04a6dc6efb1719ff6994c0513c559aac577
Instruction Fuzzy Hash: 13417370E043296ADB10AFBA9C4996EFFF8EF51B10B10452FE519E7290DAB895008E61

Function 00E0AA64 Relevance: 26.5, APIs: 14, Strings: 1, Instructions: 273windowtimeCOMMON

Download Yara Rule

APIs

GetClassNameW.USER32(?,?,00000100), ref: 00E0AAA5
__swprintf.LIBCMT ref: 00E0AB46
_wcscmp.LIBCMT ref: 00E0AB59
SendMessageTimeoutW.USER32(?,?,00000101,00000000,00000002,00001388,?), ref: 00E0ABAE
_wcscmp.LIBCMT ref: 00E0ABEA
GetClassNameW.USER32(?,?,00000400), ref: 00E0AC21
GetDlgCtrlID.USER32(?), ref: 00E0AC73
GetWindowRect.USER32(?,?), ref: 00E0ACA9
GetParent.USER32(?), ref: 00E0ACC7
ScreenToClient.USER32(00000000), ref: 00E0ACCE
GetClassNameW.USER32(?,?,00000100), ref: 00E0AD48
_wcscmp.LIBCMT ref: 00E0AD5C
GetWindowTextW.USER32(?,?,00000400), ref: 00E0AD82
_wcscmp.LIBCMT ref: 00E0AD96

Part of subcall function 00DD386C: _iswctype.LIBCMT ref: 00DD3874

Strings

%s%u, xrefs: 00E0AB40

Memory Dump Source

Source File: 00000000.00000002.2103545536.0000000000DB1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00DB0000, based on PE: true

Associated: 00000000.00000002.2103534640.0000000000DB0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103580373.0000000000E3F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103580373.0000000000E65000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103609603.0000000000E6F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103621893.0000000000E78000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_db0000_New Quotation - FE7191PO154.jbxd

Similarity

API ID: _wcscmp$ClassName$Window$ClientCtrlMessageParentRectScreenSendTextTimeout__swprintf_iswctype
String ID: %s%u
API String ID: 3744389584-679674701
Opcode ID: 08cf4cfeecc55858c0312874b6cddf37c8271244ecb7441239939b485992247e
Instruction ID: 96efdddf70ccd083492045f0226a084857f5871c6dce7ffe6c1164203f1147c9
Opcode Fuzzy Hash: 08cf4cfeecc55858c0312874b6cddf37c8271244ecb7441239939b485992247e
Instruction Fuzzy Hash: 53A1B07120470AAFD714DF20C884BEAF7E8FF04319F085639F999A2190D730E985CBA2

Function 00E0B397 Relevance: 26.5, APIs: 13, Strings: 2, Instructions: 249COMMON

Download Yara Rule

APIs

GetClassNameW.USER32(00000008,?,00000400), ref: 00E0B3DB
_wcscmp.LIBCMT ref: 00E0B3EC
GetWindowTextW.USER32(00000001,?,00000400), ref: 00E0B414
CharUpperBuffW.USER32(?,00000000), ref: 00E0B431
_wcscmp.LIBCMT ref: 00E0B44F
_wcsstr.LIBCMT ref: 00E0B460
GetClassNameW.USER32(00000018,?,00000400), ref: 00E0B498
_wcscmp.LIBCMT ref: 00E0B4A8
GetWindowTextW.USER32(00000002,?,00000400), ref: 00E0B4CF
GetClassNameW.USER32(00000018,?,00000400), ref: 00E0B518
_wcscmp.LIBCMT ref: 00E0B528
GetClassNameW.USER32(00000010,?,00000400), ref: 00E0B550
GetWindowRect.USER32(00000004,?), ref: 00E0B5B9

Strings

ThumbnailClass, xrefs: 00E0B4A3, 00E0B523
@, xrefs: 00E0B3BC

Memory Dump Source

Source File: 00000000.00000002.2103545536.0000000000DB1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00DB0000, based on PE: true

Associated: 00000000.00000002.2103534640.0000000000DB0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103580373.0000000000E3F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103580373.0000000000E65000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103609603.0000000000E6F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103621893.0000000000E78000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_db0000_New Quotation - FE7191PO154.jbxd

Similarity

API ID: ClassName_wcscmp$Window$Text$BuffCharRectUpper_wcsstr
String ID: @$ThumbnailClass
API String ID: 1788623398-1539354611
Opcode ID: 01e408d3420a185521c3f2353530069c7f4039f386a4bd58413eadfabc345053
Instruction ID: ae78b09516db8263faf6d558e35998e66e6927c557d44af5d170f426d465db7a
Opcode Fuzzy Hash: 01e408d3420a185521c3f2353530069c7f4039f386a4bd58413eadfabc345053
Instruction Fuzzy Hash: B2819E710042059FDB14DF10D885FAA7BE8FF44718F0495AAFD85AA1D2EB34DE89CBA1

Function 00E3C8EE Relevance: 26.4, APIs: 11, Strings: 4, Instructions: 181windowfileCOMMON

Download Yara Rule

APIs

Part of subcall function 00DB2612: GetWindowLongW.USER32(?,000000EB), ref: 00DB2623

DragQueryPoint.SHELL32(?,?), ref: 00E3C917

Part of subcall function 00E3ADF1: ClientToScreen.USER32(?,?), ref: 00E3AE1A
Part of subcall function 00E3ADF1: GetWindowRect.USER32(?,?), ref: 00E3AE90
Part of subcall function 00E3ADF1: PtInRect.USER32(?,?,00E3C304), ref: 00E3AEA0

SendMessageW.USER32(?,000000B0,?,?), ref: 00E3C980
DragQueryFileW.SHELL32(?,000000FF,00000000,00000000), ref: 00E3C98B
DragQueryFileW.SHELL32(?,00000000,?,00000104), ref: 00E3C9AE
_wcscat.LIBCMT ref: 00E3C9DE
SendMessageW.USER32(?,000000C2,00000001,?), ref: 00E3C9F5
SendMessageW.USER32(?,000000B0,?,?), ref: 00E3CA0E
SendMessageW.USER32(?,000000B1,?,?), ref: 00E3CA25
SendMessageW.USER32(?,000000B1,?,?), ref: 00E3CA47
DragFinish.SHELL32(?), ref: 00E3CA4E
DefDlgProcW.USER32(?,00000233,?,00000000,?,?,?), ref: 00E3CB41

Strings

@GUI_DRAGID, xrefs: 00E3CAB9
@GUI_DROPID, xrefs: 00E3CA6E
@GUI_DRAGFILE, xrefs: 00E3CAF0
pr, xrefs: 00E3CA8B

Memory Dump Source

Source File: 00000000.00000002.2103545536.0000000000DB1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00DB0000, based on PE: true

Associated: 00000000.00000002.2103534640.0000000000DB0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103580373.0000000000E3F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103580373.0000000000E65000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103609603.0000000000E6F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103621893.0000000000E78000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_db0000_New Quotation - FE7191PO154.jbxd

Similarity

API ID: MessageSend$Drag$Query$FileRectWindow$ClientFinishLongPointProcScreen_wcscat
String ID: @GUI_DRAGFILE$@GUI_DRAGID$@GUI_DROPID$pr
API String ID: 169749273-2073472848
Opcode ID: 6c07c05de770804c9e3a3511ddadb10cd1143365ae4760dc929474fccc342160
Instruction ID: 1e467b1b7d19ef2c375bb542bada20ee2e34c63a1e17ff4329d8a15f6f410861
Opcode Fuzzy Hash: 6c07c05de770804c9e3a3511ddadb10cd1143365ae4760dc929474fccc342160
Instruction Fuzzy Hash: 71615D71508304AFC701EF61DC89DAFBFE8EF89754F00092DF596A61A1DB709A49CB62

Function 00E0B1E0 Relevance: 26.4, APIs: 3, Strings: 12, Instructions: 105COMMON

Download Yara Rule

APIs

__wcsnicmp.LIBCMT ref: 00E0B23F

Strings

ACTIVE, xrefs: 00E0B21A
CLASSNAME=, xrefs: 00E0B27C
[LAST, xrefs: 00E0B2EC
ALL, xrefs: 00E0B2D3
[HANDLE:, xrefs: 00E0B24B
[ACTIVE, xrefs: 00E0B22C
HANDLE=, xrefs: 00E0B238
REGEXP=, xrefs: 00E0B254
LAST, xrefs: 00E0B204
[CLASS:, xrefs: 00E0B28F
[REGEXPTITLE:, xrefs: 00E0B267
[ALL, xrefs: 00E0B2E5

Memory Dump Source

Source File: 00000000.00000002.2103545536.0000000000DB1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00DB0000, based on PE: true

Associated: 00000000.00000002.2103534640.0000000000DB0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103580373.0000000000E3F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103580373.0000000000E65000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103609603.0000000000E6F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103621893.0000000000E78000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_db0000_New Quotation - FE7191PO154.jbxd

Similarity

API ID: __wcsnicmp
String ID: ACTIVE$ALL$CLASSNAME=$HANDLE=$LAST$REGEXP=$[ACTIVE$[ALL$[CLASS:$[HANDLE:$[LAST$[REGEXPTITLE:
API String ID: 1038674560-1810252412
Opcode ID: 19e0fca5db65d92eeb972967f1ba8396193344c41c34c82ff7eaddf219263858
Instruction ID: f1d11247428033b4b80cc29ce45a638f975b26c92b8751f23da6598cf60edb4f
Opcode Fuzzy Hash: 19e0fca5db65d92eeb972967f1ba8396193344c41c34c82ff7eaddf219263858
Instruction Fuzzy Hash: 7A314131A84306E6DB14FA60DD43EEE77A8EF24790F60152AF452720E6EF71AE44C571

Function 00E0C4C1 Relevance: 25.7, APIs: 17, Instructions: 169windowtimeCOMMON

Download Yara Rule

APIs

LoadIconW.USER32(00000063), ref: 00E0C4D4
SendMessageW.USER32(?,00000080,00000000,00000000), ref: 00E0C4E6
SetWindowTextW.USER32(?,?), ref: 00E0C4FD
GetDlgItem.USER32(?,000003EA), ref: 00E0C512
SetWindowTextW.USER32(00000000,?), ref: 00E0C518
GetDlgItem.USER32(?,000003E9), ref: 00E0C528
SetWindowTextW.USER32(00000000,?), ref: 00E0C52E
SendDlgItemMessageW.USER32(?,000003E9,000000CC,?,00000000), ref: 00E0C54F
SendDlgItemMessageW.USER32(?,000003E9,000000C5,00000000,00000000), ref: 00E0C569
GetWindowRect.USER32(?,?), ref: 00E0C572
SetWindowTextW.USER32(?,?), ref: 00E0C5DD
GetDesktopWindow.USER32 ref: 00E0C5E3
GetWindowRect.USER32(00000000), ref: 00E0C5EA
MoveWindow.USER32(?,?,?,?,00000000,00000000), ref: 00E0C636
GetClientRect.USER32(?,?), ref: 00E0C643
PostMessageW.USER32(?,00000005,00000000,00000000), ref: 00E0C668
SetTimer.USER32(?,0000040A,00000000,00000000), ref: 00E0C693

Memory Dump Source

Source File: 00000000.00000002.2103545536.0000000000DB1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00DB0000, based on PE: true

Associated: 00000000.00000002.2103534640.0000000000DB0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103580373.0000000000E3F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103580373.0000000000E65000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103609603.0000000000E6F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103621893.0000000000E78000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_db0000_New Quotation - FE7191PO154.jbxd

Similarity

API ID: Window$ItemMessageText$RectSend$ClientDesktopIconLoadMovePostTimer
String ID:
API String ID: 3869813825-0
Opcode ID: cf24f3e139e2e5d4879fc74ba815d4ea51409d35e9c4f8c7bca78511eb56d421
Instruction ID: 6e4cf0ecf04e89c8b524d6032b33c4e64c2766fb69118702a2cf7025ac7116df
Opcode Fuzzy Hash: cf24f3e139e2e5d4879fc74ba815d4ea51409d35e9c4f8c7bca78511eb56d421
Instruction Fuzzy Hash: FA515070900709AFDB20DFA9DD89B6EBBF5FF04705F104629E686B25E0C775A944CB50

Function 00E3A428 Relevance: 24.7, APIs: 12, Strings: 2, Instructions: 205windowCOMMON

Download Yara Rule

APIs

_memset.LIBCMT ref: 00E3A4C8
DestroyWindow.USER32(?,?), ref: 00E3A542

Part of subcall function 00DB7D2C: _memmove.LIBCMT ref: 00DB7D66

CreateWindowExW.USER32(00000008,tooltips_class32,00000000,?,80000000,80000000,80000000,80000000,?,00000000,00000000,?), ref: 00E3A5BC
SendMessageW.USER32(00000000,00000433,00000000,00000030), ref: 00E3A5DE
SendMessageW.USER32(00000000,00000432,00000000,00000030), ref: 00E3A5F1
DestroyWindow.USER32(00000000), ref: 00E3A613
CreateWindowExW.USER32(00000008,tooltips_class32,00000000,?,80000000,80000000,80000000,80000000,?,00000000,00DB0000,00000000), ref: 00E3A64A
SendMessageW.USER32(00000000,00000432,00000000,00000030), ref: 00E3A663
GetDesktopWindow.USER32 ref: 00E3A67C
GetWindowRect.USER32(00000000), ref: 00E3A683
SendMessageW.USER32(00000000,00000418,00000000,?), ref: 00E3A69B
SendMessageW.USER32(00000000,00000421,?,00000000), ref: 00E3A6B3

Part of subcall function 00DB25DB: GetWindowLongW.USER32(?,000000EB), ref: 00DB25EC

Strings

0, xrefs: 00E3A4DE
tooltips_class32, xrefs: 00E3A5B5, 00E3A643

Memory Dump Source

Source File: 00000000.00000002.2103545536.0000000000DB1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00DB0000, based on PE: true

Associated: 00000000.00000002.2103534640.0000000000DB0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103580373.0000000000E3F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103580373.0000000000E65000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103609603.0000000000E6F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103621893.0000000000E78000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_db0000_New Quotation - FE7191PO154.jbxd

Similarity

API ID: Window$MessageSend$CreateDestroy$DesktopLongRect_memmove_memset
String ID: 0$tooltips_class32
API String ID: 1297703922-3619404913
Opcode ID: 0b5a83cf3f8577d5a4d54bb421d52844d85bc8482762cb6cd43d0da11507e09a
Instruction ID: 47b3bae95daa379edef748c47923e526093b6edff5b7afb29efeb7bba92b9e56
Opcode Fuzzy Hash: 0b5a83cf3f8577d5a4d54bb421d52844d85bc8482762cb6cd43d0da11507e09a
Instruction Fuzzy Hash: C671A171540205AFD724CF29CC4AF667FE5FB88308F08452DF985A72A0D770E985CB62

Function 00E34619 Relevance: 23.0, APIs: 2, Strings: 11, Instructions: 251windowCOMMON

Download Yara Rule

APIs

CharUpperBuffW.USER32(?,?), ref: 00E346AB
SendMessageW.USER32(?,00001105,00000000,00000000), ref: 00E346F6

Strings

COLLAPSE, xrefs: 00E3473C
SELECT, xrefs: 00E348A7
ISCHECKED, xrefs: 00E34879
EXISTS, xrefs: 00E3475F
EXPAND, xrefs: 00E347A8
GETSELECTED, xrefs: 00E34806
CHECK, xrefs: 00E34716
UNCHECK, xrefs: 00E348D2
GETITEMCOUNT, xrefs: 00E347D8
GETTEXT, xrefs: 00E34849
GETTOTALCOUNT, xrefs: 00E346DD

Memory Dump Source

Source File: 00000000.00000002.2103545536.0000000000DB1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00DB0000, based on PE: true

Associated: 00000000.00000002.2103534640.0000000000DB0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103580373.0000000000E3F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103580373.0000000000E65000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103609603.0000000000E6F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103621893.0000000000E78000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_db0000_New Quotation - FE7191PO154.jbxd

Similarity

API ID: BuffCharMessageSendUpper
String ID: CHECK$COLLAPSE$EXISTS$EXPAND$GETITEMCOUNT$GETSELECTED$GETTEXT$GETTOTALCOUNT$ISCHECKED$SELECT$UNCHECK
API String ID: 3974292440-4258414348
Opcode ID: 2081b52e9524f678d18939098c3768479168d50e9ce8b80c5cee2c29ab4ff5bc
Instruction ID: 25b932c56f3ca5ef294f435985786bcc33bc99e4da24f7f1acc857f1d8ea7535
Opcode Fuzzy Hash: 2081b52e9524f678d18939098c3768479168d50e9ce8b80c5cee2c29ab4ff5bc
Instruction Fuzzy Hash: D3916E742043019BCB14EF20C455AAABBE2EF95354F04646DF8966B7E2CB30FD46CB61

Function 00E3BAB8 Relevance: 22.9, APIs: 10, Strings: 3, Instructions: 197windowlibraryCOMMON

Download Yara Rule

APIs

LoadImageW.USER32(00000000,?,00000001,?,?,00002010), ref: 00E3BB6E
LoadLibraryExW.KERNEL32(?,00000000,00000032,00000000,?,?,?,?,?,00E39431), ref: 00E3BBCA
LoadImageW.USER32(?,?,00000001,?,?,00000000), ref: 00E3BC03
LoadImageW.USER32(00000000,?,00000001,?,?,00000000), ref: 00E3BC46
LoadImageW.USER32(?,?,00000001,?,?,00000000), ref: 00E3BC7D
FreeLibrary.KERNEL32(?), ref: 00E3BC89
ExtractIconExW.SHELL32(?,00000000,00000000,00000000,00000001), ref: 00E3BC99
DestroyIcon.USER32(?,?,?,?,?,00E39431), ref: 00E3BCA8
SendMessageW.USER32(?,00000170,00000000,00000000), ref: 00E3BCC5
SendMessageW.USER32(?,00000064,00000172,00000001), ref: 00E3BCD1

Part of subcall function 00DD313D: __wcsicmp_l.LIBCMT ref: 00DD31C6

Strings

.dll, xrefs: 00E3BB27
.icl, xrefs: 00E3BAE4
.exe, xrefs: 00E3BB04

Memory Dump Source

Source File: 00000000.00000002.2103545536.0000000000DB1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00DB0000, based on PE: true

Associated: 00000000.00000002.2103534640.0000000000DB0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103580373.0000000000E3F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103580373.0000000000E65000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103609603.0000000000E6F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103621893.0000000000E78000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_db0000_New Quotation - FE7191PO154.jbxd

Similarity

API ID: Load$Image$IconLibraryMessageSend$DestroyExtractFree__wcsicmp_l
String ID: .dll$.exe$.icl
API String ID: 1212759294-1154884017
Opcode ID: 24aada26336b99cf080bb15ee4474d5be8e204ada0cf6cc38e0c29eec76599d0
Instruction ID: a46c31fd6bb4da2705cb3172d0402d3cce24734800133bfeeacd2a8c21340099
Opcode Fuzzy Hash: 24aada26336b99cf080bb15ee4474d5be8e204ada0cf6cc38e0c29eec76599d0
Instruction Fuzzy Hash: 9661E371900219FEEB24DF65CC49FBABBA8EB08710F105116FA16E61D0DB71A984CBB0

Function 00E1A0B5 Relevance: 22.9, APIs: 7, Strings: 6, Instructions: 156COMMON

Download Yara Rule

APIs

LoadStringW.USER32(00000066,?,00000FFF,00E3FB78), ref: 00E1A0FC

Part of subcall function 00DB7F41: _memmove.LIBCMT ref: 00DB7F82

LoadStringW.USER32(?,?,00000FFF,?), ref: 00E1A11E
__swprintf.LIBCMT ref: 00E1A177
__swprintf.LIBCMT ref: 00E1A190
_wprintf.LIBCMT ref: 00E1A246
_wprintf.LIBCMT ref: 00E1A264

Strings

Error: , xrefs: 00E1A20E
^ ERROR, xrefs: 00E1A1E8
"%s" (%d) : ==> %s:%s%s, xrefs: 00E1A241
%, xrefs: 00E1A0C9
Line %d (File "%s"):, xrefs: 00E1A171, 00E1A18A
"%s" (%d) : ==> %s:, xrefs: 00E1A25F

Memory Dump Source

Source File: 00000000.00000002.2103545536.0000000000DB1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00DB0000, based on PE: true

Associated: 00000000.00000002.2103534640.0000000000DB0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103580373.0000000000E3F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103580373.0000000000E65000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103609603.0000000000E6F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103621893.0000000000E78000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_db0000_New Quotation - FE7191PO154.jbxd

Similarity

API ID: LoadString__swprintf_wprintf$_memmove
String ID: Error: $"%s" (%d) : ==> %s:$"%s" (%d) : ==> %s:%s%s$Line %d (File "%s"):$^ ERROR$%
API String ID: 311963372-1048875529
Opcode ID: 65cb3f58faf817da631cdedb5e7118da3cced9a975a96507a334a0c236fa00c8
Instruction ID: 11d36d1632bba639c17ab088e7848f4eb65c7ca449b2e577d59c2c757751d365
Opcode Fuzzy Hash: 65cb3f58faf817da631cdedb5e7118da3cced9a975a96507a334a0c236fa00c8
Instruction Fuzzy Hash: 6151397190120AABCF15EBA0DD86EEEB7B9EF04304F140165F516721A2EB316E98DB71

Function 00E1A5BD Relevance: 22.9, APIs: 5, Strings: 8, Instructions: 138COMMON

Download Yara Rule

APIs

Part of subcall function 00DB9997: __itow.LIBCMT ref: 00DB99C2
Part of subcall function 00DB9997: __swprintf.LIBCMT ref: 00DB9A0C

CharLowerBuffW.USER32(?,?), ref: 00E1A636
GetDriveTypeW.KERNEL32 ref: 00E1A683
mciSendStringW.WINMM(?,00000000,00000000,00000000), ref: 00E1A6CB
mciSendStringW.WINMM(?,00000000,00000000,00000000), ref: 00E1A702
mciSendStringW.WINMM(?,00000000,00000000,00000000), ref: 00E1A730

Part of subcall function 00DB7D2C: _memmove.LIBCMT ref: 00DB7D66

Strings

type cdaudio alias cd wait, xrefs: 00E1A6AE
set cd door , xrefs: 00E1A6D1
open, xrefs: 00E1A65D
wait, xrefs: 00E1A6ED
open , xrefs: 00E1A692
close, xrefs: 00E1A63C
close cd wait, xrefs: 00E1A71B
closed, xrefs: 00E1A64A, 00E1A653

Memory Dump Source

Source File: 00000000.00000002.2103545536.0000000000DB1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00DB0000, based on PE: true

Associated: 00000000.00000002.2103534640.0000000000DB0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103580373.0000000000E3F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103580373.0000000000E65000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103609603.0000000000E6F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103621893.0000000000E78000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_db0000_New Quotation - FE7191PO154.jbxd

Similarity

API ID: SendString$BuffCharDriveLowerType__itow__swprintf_memmove
String ID: type cdaudio alias cd wait$ wait$close$close cd wait$closed$open$open $set cd door
API String ID: 2698844021-4113822522
Opcode ID: fbf370e20f8ae72da76aee5d7fcf97785405e17445c36b662fc635c41af2f001
Instruction ID: 29a77e77803ca50b3c23f200fdf7dd9c4089ff7691d54217ade0d9b227e5200a
Opcode Fuzzy Hash: fbf370e20f8ae72da76aee5d7fcf97785405e17445c36b662fc635c41af2f001
Instruction Fuzzy Hash: 80514A71504305DFC700EF20D8919AAB7F8EF94758F08596DF896672A1DB31AE0ACB62

Function 00E1A45A Relevance: 22.9, APIs: 10, Strings: 3, Instructions: 102fileCOMMON

Download Yara Rule

APIs

GetFullPathNameW.KERNEL32(?,00007FFF,?,?), ref: 00E1A47A
__swprintf.LIBCMT ref: 00E1A49C
CreateDirectoryW.KERNEL32(?,00000000), ref: 00E1A4D9
CreateFileW.KERNEL32(?,40000000,00000000,00000000,00000003,02200000,00000000), ref: 00E1A4FE
_memset.LIBCMT ref: 00E1A51D
_wcsncpy.LIBCMT ref: 00E1A559
DeviceIoControl.KERNEL32(00000000,000900A4,?,?,00000000,00000000,?,00000000), ref: 00E1A58E
CloseHandle.KERNEL32(00000000), ref: 00E1A599
RemoveDirectoryW.KERNEL32(?), ref: 00E1A5A2
CloseHandle.KERNEL32(00000000), ref: 00E1A5AC

Strings

:, xrefs: 00E1A4BD
\??\%s, xrefs: 00E1A496
\, xrefs: 00E1A4B2

Memory Dump Source

Source File: 00000000.00000002.2103545536.0000000000DB1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00DB0000, based on PE: true

Associated: 00000000.00000002.2103534640.0000000000DB0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103580373.0000000000E3F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103580373.0000000000E65000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103609603.0000000000E6F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103621893.0000000000E78000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_db0000_New Quotation - FE7191PO154.jbxd

Similarity

API ID: CloseCreateDirectoryHandle$ControlDeviceFileFullNamePathRemove__swprintf_memset_wcsncpy
String ID: :$\$\??\%s
API String ID: 2733774712-3457252023
Opcode ID: 84c713ed64ffad65dffb4a2075d6babc32e115b691a6d48704528f03546456de
Instruction ID: 20a4494fb18aca24f336f0413f922954910e22ae1c2e672729789ad9bc616a2e
Opcode Fuzzy Hash: 84c713ed64ffad65dffb4a2075d6babc32e115b691a6d48704528f03546456de
Instruction Fuzzy Hash: B9318EB5900209ABDB219FA1DC49FFB77BDEF88705F1441B6F908E2160E77096888B35

Function 00E1DB04 Relevance: 21.2, APIs: 11, Strings: 1, Instructions: 230COMMON

Download Yara Rule

APIs

__wsplitpath.LIBCMT ref: 00E1DC7B
_wcscat.LIBCMT ref: 00E1DC93
_wcscat.LIBCMT ref: 00E1DCA5
GetCurrentDirectoryW.KERNEL32(00007FFF,?), ref: 00E1DCBA
SetCurrentDirectoryW.KERNEL32(?), ref: 00E1DCCE
GetFileAttributesW.KERNEL32(?), ref: 00E1DCE6
SetFileAttributesW.KERNEL32(?,00000000), ref: 00E1DD00
SetCurrentDirectoryW.KERNEL32(?), ref: 00E1DD12

Strings

*.*, xrefs: 00E1DD51

Memory Dump Source

Source File: 00000000.00000002.2103545536.0000000000DB1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00DB0000, based on PE: true

Associated: 00000000.00000002.2103534640.0000000000DB0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103580373.0000000000E3F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103580373.0000000000E65000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103609603.0000000000E6F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103621893.0000000000E78000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_db0000_New Quotation - FE7191PO154.jbxd

Similarity

API ID: CurrentDirectory$AttributesFile_wcscat$__wsplitpath
String ID: *.*
API String ID: 34673085-438819550
Opcode ID: 815977b4112f4ff85c93bb1f9eb1a19da47fdfb19799a4f1df7b5ed6f37f3cdd
Instruction ID: 14e073216af737477a35e74a160c8d1020b435005627a96edd212b2905b12519
Opcode Fuzzy Hash: 815977b4112f4ff85c93bb1f9eb1a19da47fdfb19799a4f1df7b5ed6f37f3cdd
Instruction Fuzzy Hash: 6F81727150C2459FCB24DF24CC859EEB7E8EB88314F159D2EF886E7251E630E984CB62

Function 00E3C49C Relevance: 21.2, APIs: 11, Strings: 1, Instructions: 229windowCOMMON

Download Yara Rule

APIs

Part of subcall function 00DB2612: GetWindowLongW.USER32(?,000000EB), ref: 00DB2623

PostMessageW.USER32(?,00000111,00000000,00000000), ref: 00E3C4EC
GetFocus.USER32 ref: 00E3C4FC
GetDlgCtrlID.USER32(00000000), ref: 00E3C507
_memset.LIBCMT ref: 00E3C632
GetMenuItemInfoW.USER32(?,00000000,00000000,?), ref: 00E3C65D
GetMenuItemCount.USER32(?), ref: 00E3C67D
GetMenuItemID.USER32(?,00000000), ref: 00E3C690
GetMenuItemInfoW.USER32(?,-00000001,00000001,?), ref: 00E3C6C4
GetMenuItemInfoW.USER32(?,?,00000001,?), ref: 00E3C70C
CheckMenuRadioItem.USER32(?,00000000,?,00000000,00000400), ref: 00E3C744
DefDlgProcW.USER32(?,00000111,?,?,?,?,?,?,?), ref: 00E3C779

Strings

0, xrefs: 00E3C62A

Memory Dump Source

Source File: 00000000.00000002.2103545536.0000000000DB1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00DB0000, based on PE: true

Associated: 00000000.00000002.2103534640.0000000000DB0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103580373.0000000000E3F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103580373.0000000000E65000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103609603.0000000000E6F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103621893.0000000000E78000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_db0000_New Quotation - FE7191PO154.jbxd

Similarity

API ID: ItemMenu$Info$CheckCountCtrlFocusLongMessagePostProcRadioWindow_memset
String ID: 0
API String ID: 1296962147-4108050209
Opcode ID: f48786b3efbf213510c7c072d880ae2a17d9e4685a28c9fc929a39690b7f8aeb
Instruction ID: c824a3b47b07acffb5016e1ae7d4785e0fadeb6303ec9b22092c6392a5b89026
Opcode Fuzzy Hash: f48786b3efbf213510c7c072d880ae2a17d9e4685a28c9fc929a39690b7f8aeb
Instruction Fuzzy Hash: 14819E70608305AFD710DF25C989AABBFE4FB88358F20552EF995B3291D730D945CBA2

Function 00E083F4 Relevance: 21.2, APIs: 14, Instructions: 179memoryCOMMON

Download Yara Rule

APIs

Part of subcall function 00E0874A: GetUserObjectSecurity.USER32(?,00000004,?,00000000,?), ref: 00E08766
Part of subcall function 00E0874A: GetLastError.KERNEL32(?,00E0822A,?,?,?), ref: 00E08770
Part of subcall function 00E0874A: GetProcessHeap.KERNEL32(00000008,?,?,00E0822A,?,?,?), ref: 00E0877F
Part of subcall function 00E0874A: HeapAlloc.KERNEL32(00000000,?,00E0822A,?,?,?), ref: 00E08786
Part of subcall function 00E0874A: GetUserObjectSecurity.USER32(?,00000004,00000000,?,?), ref: 00E0879D

Part of subcall function 00E087E7: GetProcessHeap.KERNEL32(00000008,00E08240,00000000,00000000,?,00E08240,?), ref: 00E087F3
Part of subcall function 00E087E7: HeapAlloc.KERNEL32(00000000,?,00E08240,?), ref: 00E087FA
Part of subcall function 00E087E7: InitializeSecurityDescriptor.ADVAPI32(00000000,00000001,?,00E08240,?), ref: 00E0880B

GetSecurityDescriptorDacl.ADVAPI32(?,?,?,?), ref: 00E08458
_memset.LIBCMT ref: 00E0846D
GetAclInformation.ADVAPI32(?,?,0000000C,00000002), ref: 00E0848C
GetLengthSid.ADVAPI32(?), ref: 00E0849D
GetAce.ADVAPI32(?,00000000,?), ref: 00E084DA
AddAce.ADVAPI32(?,00000002,000000FF,?,?), ref: 00E084F6
GetLengthSid.ADVAPI32(?), ref: 00E08513
GetProcessHeap.KERNEL32(00000008,-00000008), ref: 00E08522
HeapAlloc.KERNEL32(00000000), ref: 00E08529
GetLengthSid.ADVAPI32(?,00000008,?), ref: 00E0854A
CopySid.ADVAPI32(00000000), ref: 00E08551
AddAce.ADVAPI32(?,00000002,000000FF,00000000,?), ref: 00E08582
SetSecurityDescriptorDacl.ADVAPI32(?,00000001,?,00000000), ref: 00E085A8
SetUserObjectSecurity.USER32(?,00000004,?), ref: 00E085BC

Memory Dump Source

Source File: 00000000.00000002.2103545536.0000000000DB1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00DB0000, based on PE: true

Associated: 00000000.00000002.2103534640.0000000000DB0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103580373.0000000000E3F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103580373.0000000000E65000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103609603.0000000000E6F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103621893.0000000000E78000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_db0000_New Quotation - FE7191PO154.jbxd

Similarity

API ID: HeapSecurity$AllocDescriptorLengthObjectProcessUser$Dacl$CopyErrorInformationInitializeLast_memset
String ID:
API String ID: 3996160137-0
Opcode ID: 7cfacc1c7f16a00e80d82424451031705c1f13e893d915b43211a28f7c785024
Instruction ID: 228e735a19e53497af6d7a6377f9a00c1bc7aa8c15b92cc9d35d438fe2fec2e1
Opcode Fuzzy Hash: 7cfacc1c7f16a00e80d82424451031705c1f13e893d915b43211a28f7c785024
Instruction Fuzzy Hash: AF61467190020AAFDF04DFA5DE49AAEBBB9FF04304F048169E855B72D1DB319A49CF60

Function 00E2762D Relevance: 21.2, APIs: 11, Strings: 1, Instructions: 160windowCOMMON

Download Yara Rule

APIs

GetDC.USER32(00000000), ref: 00E276A2
CreateCompatibleBitmap.GDI32(00000000,00000007,?), ref: 00E276AE
CreateCompatibleDC.GDI32(?), ref: 00E276BA
SelectObject.GDI32(00000000,?), ref: 00E276C7
StretchBlt.GDI32(00000006,00000000,00000000,00000007,?,?,?,?,00000007,?,00CC0020), ref: 00E2771B
GetDIBits.GDI32(00000006,?,00000000,00000000,00000000,00000028,00000000), ref: 00E27757
GetDIBits.GDI32(00000006,?,00000000,?,00000000,00000028,00000000), ref: 00E2777B
SelectObject.GDI32(00000006,?), ref: 00E27783
DeleteObject.GDI32(?), ref: 00E2778C
DeleteDC.GDI32(00000006), ref: 00E27793
ReleaseDC.USER32(00000000,?), ref: 00E2779E

Strings

(, xrefs: 00E27723

Memory Dump Source

Source File: 00000000.00000002.2103545536.0000000000DB1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00DB0000, based on PE: true

Associated: 00000000.00000002.2103534640.0000000000DB0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103580373.0000000000E3F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103580373.0000000000E65000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103609603.0000000000E6F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103621893.0000000000E78000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_db0000_New Quotation - FE7191PO154.jbxd

Similarity

API ID: Object$BitsCompatibleCreateDeleteSelect$BitmapReleaseStretch
String ID: (
API String ID: 2598888154-3887548279
Opcode ID: eaeee35236f6801760a55a330f8d9e14912836fa2faa21567a08988ce7362577
Instruction ID: 1c93107d6998c392d007fb837a07415eead9e23ef824aed4f88974d5aad71ce5
Opcode Fuzzy Hash: eaeee35236f6801760a55a330f8d9e14912836fa2faa21567a08988ce7362577
Instruction Fuzzy Hash: 30514C75904719EFCB15CFA9DC89EAEBBB9EF48310F14842DF989A7210D731A844CB60

Function 00DB6BEC Relevance: 19.7, APIs: 4, Strings: 7, Instructions: 478COMMON

Download Yara Rule

APIs

Part of subcall function 00DD0B9B: GetCurrentDirectoryW.KERNEL32(00007FFF,?,?,?,00DB6C6C,?,00008000), ref: 00DD0BB7

Part of subcall function 00DB48AE: GetFullPathNameW.KERNEL32(?,00007FFF,?,00000000,?,?,00DB48A1,?,?,00DB37C0,?), ref: 00DB48CE

SetCurrentDirectoryW.KERNEL32(?,?,?,?,00000000), ref: 00DB6D0D
SetCurrentDirectoryW.KERNEL32(?), ref: 00DB6E5A

Part of subcall function 00DB59CD: _wcscpy.LIBCMT ref: 00DB5A05

Part of subcall function 00DD387D: _iswctype.LIBCMT ref: 00DD3885

Strings

Error opening the file, xrefs: 00DEE866, 00DEE8E1
EA06, xrefs: 00DEE87B
Bad directive syntax error, xrefs: 00DEEBC6
>>>AUTOIT SCRIPT<<<, xrefs: 00DEE8BF
AU3!, xrefs: 00DB6CC1
Unterminated string, xrefs: 00DEEC0D
#include depth exceeded. Make sure there are no recursive includes, xrefs: 00DEE84A

Memory Dump Source

Source File: 00000000.00000002.2103545536.0000000000DB1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00DB0000, based on PE: true

Associated: 00000000.00000002.2103534640.0000000000DB0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103580373.0000000000E3F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103580373.0000000000E65000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103609603.0000000000E6F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103621893.0000000000E78000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_db0000_New Quotation - FE7191PO154.jbxd

Similarity

API ID: CurrentDirectory$FullNamePath_iswctype_wcscpy
String ID: #include depth exceeded. Make sure there are no recursive includes$>>>AUTOIT SCRIPT<<<$AU3!$Bad directive syntax error$EA06$Error opening the file$Unterminated string
API String ID: 537147316-1018226102
Opcode ID: 60149ad230374a86afc7eb76204f569d74ac285724f1d9d9689329366657eb4d
Instruction ID: b5d4856a4099cf0c7bac0b2d20e3db712df3710107a776bebcecdd9ce2c62342
Opcode Fuzzy Hash: 60149ad230374a86afc7eb76204f569d74ac285724f1d9d9689329366657eb4d
Instruction Fuzzy Hash: 5C026C31508381DFC724EF25C891AAFBBE5EF98354F14491DF486A72A1DB30D949CB62

Function 00DB45DF Relevance: 19.7, APIs: 13, Instructions: 215windowCOMMON

Download Yara Rule

APIs

_memset.LIBCMT ref: 00DB45F9
GetMenuItemCount.USER32(00E76890), ref: 00DED7CD
GetMenuItemCount.USER32(00E76890), ref: 00DED87D
GetCursorPos.USER32(?), ref: 00DED8C1
SetForegroundWindow.USER32(00000000), ref: 00DED8CA
TrackPopupMenuEx.USER32(00E76890,00000000,?,00000000,00000000,00000000), ref: 00DED8DD
PostMessageW.USER32(00000000,00000000,00000000,00000000), ref: 00DED8E9

Memory Dump Source

Source File: 00000000.00000002.2103545536.0000000000DB1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00DB0000, based on PE: true

Associated: 00000000.00000002.2103534640.0000000000DB0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103580373.0000000000E3F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103580373.0000000000E65000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103609603.0000000000E6F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103621893.0000000000E78000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_db0000_New Quotation - FE7191PO154.jbxd

Similarity

API ID: Menu$CountItem$CursorForegroundMessagePopupPostTrackWindow_memset
String ID:
API String ID: 2751501086-0
Opcode ID: 97a09d436dccb5e69395268e0cc491bce20f10575a73d08abaeb25ba36b18a75
Instruction ID: fc4da93a4fadf088372c763f3093c863cf5a7cc53e80166456aeeeece18105ee
Opcode Fuzzy Hash: 97a09d436dccb5e69395268e0cc491bce20f10575a73d08abaeb25ba36b18a75
Instruction Fuzzy Hash: 5071F670600249BEEB20AF56DC89FEABF65FF05364F240216F516A61E1CBB19C50DBB4

Function 00E28BC0 Relevance: 19.6, APIs: 10, Strings: 1, Instructions: 324fileCOMMON

Download Yara Rule

APIs

VariantInit.OLEAUT32(?), ref: 00E28BEC
CoInitialize.OLE32(00000000), ref: 00E28C19
CoUninitialize.OLE32 ref: 00E28C23
GetRunningObjectTable.OLE32(00000000,?), ref: 00E28D23
SetErrorMode.KERNEL32(00000001,00000029), ref: 00E28E50
CoGetInstanceFromFile.OLE32(00000000,?,00000000,00000015,00000002,?,00000001,00E42C0C), ref: 00E28E84
CoGetObject.OLE32(?,00000000,00E42C0C,?), ref: 00E28EA7
SetErrorMode.KERNEL32(00000000), ref: 00E28EBA
SetErrorMode.KERNEL32(00000000,00000000,00000000,00000000,00000000), ref: 00E28F3A
VariantClear.OLEAUT32(?), ref: 00E28F4A

Strings

,,, xrefs: 00E28BD6

Memory Dump Source

Source File: 00000000.00000002.2103545536.0000000000DB1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00DB0000, based on PE: true

Associated: 00000000.00000002.2103534640.0000000000DB0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103580373.0000000000E3F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103580373.0000000000E65000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103609603.0000000000E6F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103621893.0000000000E78000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_db0000_New Quotation - FE7191PO154.jbxd

Similarity

API ID: ErrorMode$ObjectVariant$ClearFileFromInitInitializeInstanceRunningTableUninitialize
String ID: ,,
API String ID: 2395222682-1556401989
Opcode ID: 1ed012abf0960ce2aed3f10cbc0bc9f8f581137b0ef595646a3bdd6236862c17
Instruction ID: 0c1039027b4e91da3ab8fb813dd9279279ec8682be306513bcdff16c5e147e6c
Opcode Fuzzy Hash: 1ed012abf0960ce2aed3f10cbc0bc9f8f581137b0ef595646a3bdd6236862c17
Instruction Fuzzy Hash: E1C15671604315AFD704DF64D98496BBBE9FF88308F00591DF58AAB261DB31ED05CB62

Function 00E310A5 Relevance: 19.4, APIs: 1, Strings: 10, Instructions: 120COMMON

Download Yara Rule

APIs

CharUpperBuffW.USER32(?,?,?,?,?,?,?,00E30038,?,?), ref: 00E310BC

Strings

HKEY_CLASSES_ROOT, xrefs: 00E3114F
HKEY_LOCAL_MACHINE, xrefs: 00E31125
HKEY_CURRENT_USER, xrefs: 00E3119B
HKEY_USERS, xrefs: 00E311BD
HKEY_CURRENT_CONFIG, xrefs: 00E31179
HKCC, xrefs: 00E3118A
HKLM, xrefs: 00E3113A
HKU, xrefs: 00E311CE
HKCU, xrefs: 00E311AC
HKCR, xrefs: 00E31164

Memory Dump Source

Source File: 00000000.00000002.2103545536.0000000000DB1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00DB0000, based on PE: true

Associated: 00000000.00000002.2103534640.0000000000DB0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103580373.0000000000E3F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103580373.0000000000E65000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103609603.0000000000E6F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103621893.0000000000E78000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_db0000_New Quotation - FE7191PO154.jbxd

Similarity

API ID: BuffCharUpper
String ID: HKCC$HKCR$HKCU$HKEY_CLASSES_ROOT$HKEY_CURRENT_CONFIG$HKEY_CURRENT_USER$HKEY_LOCAL_MACHINE$HKEY_USERS$HKLM$HKU
API String ID: 3964851224-909552448
Opcode ID: 4e8d917e6843658a4e168c2bee3259baa6fe11b9c16441cdb5bd41ea8a34506c
Instruction ID: 80c75d780f0019bf1a7f4be81d830aed5d423ff2085d7259e8c53e70affb7a15
Opcode Fuzzy Hash: 4e8d917e6843658a4e168c2bee3259baa6fe11b9c16441cdb5bd41ea8a34506c
Instruction Fuzzy Hash: 3F41503014524ADBCF10EFA0E895AEF3B25EF91344F1054AAEC91AB651DB30A95ACB70

Function 00E15569 Relevance: 19.3, APIs: 5, Strings: 6, Instructions: 74COMMON

Download Yara Rule

APIs

Part of subcall function 00DB7D2C: _memmove.LIBCMT ref: 00DB7D66

Part of subcall function 00DB7A84: _memmove.LIBCMT ref: 00DB7B0D

mciSendStringW.WINMM(status PlayMe mode,?,00000100,00000000), ref: 00E155D2
mciSendStringW.WINMM(close PlayMe,00000000,00000000,00000000), ref: 00E155E8
mciSendStringW.WINMM(?,00000000,00000000,00000000), ref: 00E155F9
mciSendStringW.WINMM(play PlayMe wait,00000000,00000000,00000000), ref: 00E1560B
mciSendStringW.WINMM(play PlayMe,00000000,00000000,00000000), ref: 00E1561C

Strings

play PlayMe, xrefs: 00E15617
close PlayMe, xrefs: 00E155E3, 00E15610
alias PlayMe, xrefs: 00E155AB
open , xrefs: 00E15581
status PlayMe mode, xrefs: 00E155CD
play PlayMe wait, xrefs: 00E15606

Memory Dump Source

Source File: 00000000.00000002.2103545536.0000000000DB1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00DB0000, based on PE: true

Associated: 00000000.00000002.2103534640.0000000000DB0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103580373.0000000000E3F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103580373.0000000000E65000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103609603.0000000000E6F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103621893.0000000000E78000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_db0000_New Quotation - FE7191PO154.jbxd

Similarity

API ID: SendString$_memmove
String ID: alias PlayMe$close PlayMe$open $play PlayMe$play PlayMe wait$status PlayMe mode
API String ID: 2279737902-1007645807
Opcode ID: c72e4730c59a856da4bd4dbe278c417b7972fafa609672f431d4502e5d166729
Instruction ID: d224b0f467a75e3f2570a1bf4c06e183c1ca333af1d39d1d5ad68905f5c9809d
Opcode Fuzzy Hash: c72e4730c59a856da4bd4dbe278c417b7972fafa609672f431d4502e5d166729
Instruction Fuzzy Hash: 7A1190319D0269BAD720B661DC8ADFFBB7CEFD1B40F441429B402B20D1DEA05D45C9B1

Function 00E148F3 Relevance: 19.3, APIs: 10, Strings: 1, Instructions: 73networkCOMMON

Download Yara Rule

APIs

WSAStartup.WSOCK32(00000101,?), ref: 00E1490E
gethostname.WSOCK32(?,00000100), ref: 00E14928
gethostbyname.WSOCK32(?), ref: 00E14935
_wcscpy.LIBCMT ref: 00E1495D
_memmove.LIBCMT ref: 00E14970
inet_ntoa.WSOCK32(?), ref: 00E1497B
_strcat.LIBCMT ref: 00E14989
_wcscpy.LIBCMT ref: 00E149A0
WSACleanup.WSOCK32 ref: 00E149AE
_wcscpy.LIBCMT ref: 00E149BC

Strings

0.0.0.0, xrefs: 00E14957

Memory Dump Source

Source File: 00000000.00000002.2103545536.0000000000DB1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00DB0000, based on PE: true

Associated: 00000000.00000002.2103534640.0000000000DB0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103580373.0000000000E3F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103580373.0000000000E65000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103609603.0000000000E6F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103621893.0000000000E78000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_db0000_New Quotation - FE7191PO154.jbxd

Similarity

API ID: _wcscpy$CleanupStartup_memmove_strcatgethostbynamegethostnameinet_ntoa
String ID: 0.0.0.0
API String ID: 208665112-3771769585
Opcode ID: 2a06bf10f3e0e0dbfde00fa0b714551825a9bf4440669643b3b34360d4cd721d
Instruction ID: c18f199471d1de47fa093bf3b4b66e413f876aa9b2d7bcc6e79a5a7dd4eebde7
Opcode Fuzzy Hash: 2a06bf10f3e0e0dbfde00fa0b714551825a9bf4440669643b3b34360d4cd721d
Instruction Fuzzy Hash: B311D571904119AFCB24AB75AC4AEEB7BACDF80710F040176F408B6291EF709AC586B1

Function 00E15217 Relevance: 19.3, APIs: 10, Strings: 1, Instructions: 72sleepwindowtimeCOMMON

Download Yara Rule

APIs

timeGetTime.WINMM ref: 00E1521C

Part of subcall function 00DD0719: timeGetTime.WINMM(?,7694B400,00DC0FF9), ref: 00DD071D

Sleep.KERNEL32(0000000A), ref: 00E15248
EnumThreadWindows.USER32(?,Function_000651CA,00000000), ref: 00E1526C
FindWindowExW.USER32(00000000,00000000,BUTTON,00000000), ref: 00E1528E
SetActiveWindow.USER32 ref: 00E152AD
SendMessageW.USER32(00000000,000000F5,00000000,00000000), ref: 00E152BB
SendMessageW.USER32(00000010,00000000,00000000), ref: 00E152DA
Sleep.KERNEL32(000000FA), ref: 00E152E5
IsWindow.USER32 ref: 00E152F1
EndDialog.USER32(00000000), ref: 00E15302

Strings

BUTTON, xrefs: 00E15280

Memory Dump Source

Source File: 00000000.00000002.2103545536.0000000000DB1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00DB0000, based on PE: true

Associated: 00000000.00000002.2103534640.0000000000DB0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103580373.0000000000E3F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103580373.0000000000E65000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103609603.0000000000E6F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103621893.0000000000E78000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_db0000_New Quotation - FE7191PO154.jbxd

Similarity

API ID: Window$MessageSendSleepTimetime$ActiveDialogEnumFindThreadWindows
String ID: BUTTON
API String ID: 1194449130-3405671355
Opcode ID: 885c836df036aa7df563f436741e8055522c6a7874520f5f2acecac1bf609f32
Instruction ID: df46ad0d3fa19f448db2f90747194bd1443b3154d57434d3f541f2ca7344369e
Opcode Fuzzy Hash: 885c836df036aa7df563f436741e8055522c6a7874520f5f2acecac1bf609f32
Instruction Fuzzy Hash: 8B216872504708EFE7019F72ED8DA693F6AEB8534AF042424F009B2171EB715CC8C661

Function 00E1D7F8 Relevance: 18.3, APIs: 12, Instructions: 283comCOMMON

Download Yara Rule

APIs

Part of subcall function 00DB9997: __itow.LIBCMT ref: 00DB99C2
Part of subcall function 00DB9997: __swprintf.LIBCMT ref: 00DB9A0C

CoInitialize.OLE32(00000000), ref: 00E1D855
SHGetSpecialFolderLocation.SHELL32(00000000,00000000,?), ref: 00E1D8E8
SHGetDesktopFolder.SHELL32(?), ref: 00E1D8FC
CoCreateInstance.OLE32(00E42D7C,00000000,00000001,00E6A89C,?), ref: 00E1D948
SHCreateShellItem.SHELL32(00000000,00000000,?,00000003), ref: 00E1D9B7
CoTaskMemFree.OLE32(?,?), ref: 00E1DA0F
_memset.LIBCMT ref: 00E1DA4C
SHBrowseForFolderW.SHELL32(?), ref: 00E1DA88
SHGetPathFromIDListW.SHELL32(00000000,?), ref: 00E1DAAB
CoTaskMemFree.OLE32(00000000), ref: 00E1DAB2
CoTaskMemFree.OLE32(00000000,00000001,00000000), ref: 00E1DAE9
CoUninitialize.OLE32(00000001,00000000), ref: 00E1DAEB

Memory Dump Source

Source File: 00000000.00000002.2103545536.0000000000DB1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00DB0000, based on PE: true

Associated: 00000000.00000002.2103534640.0000000000DB0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103580373.0000000000E3F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103580373.0000000000E65000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103609603.0000000000E6F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103621893.0000000000E78000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_db0000_New Quotation - FE7191PO154.jbxd

Similarity

API ID: FolderFreeTask$Create$BrowseDesktopFromInitializeInstanceItemListLocationPathShellSpecialUninitialize__itow__swprintf_memset
String ID:
API String ID: 1246142700-0
Opcode ID: a7bb4f10792cb8f1c035e8763cc087ebfaaf15392ced854126a3411eea310b37
Instruction ID: 48d224b4207a0525d74586b668ada48b75a5bf644a692a556afcfba269070f4d
Opcode Fuzzy Hash: a7bb4f10792cb8f1c035e8763cc087ebfaaf15392ced854126a3411eea310b37
Instruction Fuzzy Hash: C4B1EB75A00119EFDB04DF65C889EAEBBB9EF48304B148469F506EB261DB30ED45CB60

Function 00E1052C Relevance: 18.2, APIs: 12, Instructions: 186keyboardCOMMON

Download Yara Rule

APIs

GetKeyboardState.USER32(?), ref: 00E105A7
SetKeyboardState.USER32(?), ref: 00E10612
GetAsyncKeyState.USER32(000000A0), ref: 00E10632
GetKeyState.USER32(000000A0), ref: 00E10649
GetAsyncKeyState.USER32(000000A1), ref: 00E10678
GetKeyState.USER32(000000A1), ref: 00E10689
GetAsyncKeyState.USER32(00000011), ref: 00E106B5
GetKeyState.USER32(00000011), ref: 00E106C3
GetAsyncKeyState.USER32(00000012), ref: 00E106EC
GetKeyState.USER32(00000012), ref: 00E106FA
GetAsyncKeyState.USER32(0000005B), ref: 00E10723
GetKeyState.USER32(0000005B), ref: 00E10731

Memory Dump Source

Source File: 00000000.00000002.2103545536.0000000000DB1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00DB0000, based on PE: true

Associated: 00000000.00000002.2103534640.0000000000DB0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103580373.0000000000E3F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103580373.0000000000E65000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103609603.0000000000E6F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103621893.0000000000E78000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_db0000_New Quotation - FE7191PO154.jbxd

Similarity

API ID: State$Async$Keyboard
String ID:
API String ID: 541375521-0
Opcode ID: 17a4e1bc4b5e983481e90e2f882c369d673a9fe385e96193e0c4460a9c34500e
Instruction ID: 840b83effb302f85d67a3ecba630a0fb3cab0eb3e68216663d4602518723c5c7
Opcode Fuzzy Hash: 17a4e1bc4b5e983481e90e2f882c369d673a9fe385e96193e0c4460a9c34500e
Instruction Fuzzy Hash: 5151FB70A0478829FB35EBB084547EABFF59F01384F08959AD5C2765C2DAE49BCCCB52

Function 00E0C72A Relevance: 18.2, APIs: 12, Instructions: 174COMMON

Download Yara Rule

APIs

GetDlgItem.USER32(?,00000001), ref: 00E0C746
GetWindowRect.USER32(00000000,?), ref: 00E0C758
MoveWindow.USER32(00000001,0000000A,?,00000001,?,00000000), ref: 00E0C7B6
GetDlgItem.USER32(?,00000002), ref: 00E0C7C1
GetWindowRect.USER32(00000000,?), ref: 00E0C7D3
MoveWindow.USER32(00000001,?,00000000,00000001,?,00000000), ref: 00E0C827
GetDlgItem.USER32(?,000003E9), ref: 00E0C835
GetWindowRect.USER32(00000000,?), ref: 00E0C846
MoveWindow.USER32(00000000,0000000A,00000000,?,?,00000000), ref: 00E0C889
GetDlgItem.USER32(?,000003EA), ref: 00E0C897
MoveWindow.USER32(00000000,0000000A,0000000A,?,-00000005,00000000), ref: 00E0C8B4
InvalidateRect.USER32(?,00000000,00000001), ref: 00E0C8C1

Memory Dump Source

Source File: 00000000.00000002.2103545536.0000000000DB1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00DB0000, based on PE: true

Associated: 00000000.00000002.2103534640.0000000000DB0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103580373.0000000000E3F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103580373.0000000000E65000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103609603.0000000000E6F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103621893.0000000000E78000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_db0000_New Quotation - FE7191PO154.jbxd

Similarity

API ID: Window$ItemMoveRect$Invalidate
String ID:
API String ID: 3096461208-0
Opcode ID: d5bc76790965bcf4bfbb784acb405056e83d655c76056f8045e503ccbebdaf17
Instruction ID: d4bb8462c5f8059e6a38057c5d587ad02f0c0170ef321cc8158793e7ff645c21
Opcode Fuzzy Hash: d5bc76790965bcf4bfbb784acb405056e83d655c76056f8045e503ccbebdaf17
Instruction Fuzzy Hash: DF512371F00209AFDB18CF69DD99A6EBBB5EB88311F14822DF515E72D0D770AD448B50

Function 00DB201B Relevance: 18.2, APIs: 12, Instructions: 170timeCOMMON

Download Yara Rule

APIs

Part of subcall function 00DB1B41: InvalidateRect.USER32(?,00000000,00000001,?,?,?,00DB2036,?,00000000,?,?,?,?,00DB16CB,00000000,?), ref: 00DB1B9A

DestroyWindow.USER32(?,?,?,?,?,?,?,?,?,?,?,00000000,?,?), ref: 00DB20D3
KillTimer.USER32(-00000001,?,?,?,?,00DB16CB,00000000,?,?,00DB1AE2,?,?), ref: 00DB216E
DestroyAcceleratorTable.USER32(00000000), ref: 00DEBEF6
ImageList_Destroy.COMCTL32(00000000,?,00000000,?,?,?,?,00DB16CB,00000000,?,?,00DB1AE2,?,?), ref: 00DEBF27
ImageList_Destroy.COMCTL32(00000000,?,00000000,?,?,?,?,00DB16CB,00000000,?,?,00DB1AE2,?,?), ref: 00DEBF3E
ImageList_Destroy.COMCTL32(00000000,?,00000000,?,?,?,?,00DB16CB,00000000,?,?,00DB1AE2,?,?), ref: 00DEBF5A
DeleteObject.GDI32(00000000), ref: 00DEBF6C

Memory Dump Source

Source File: 00000000.00000002.2103545536.0000000000DB1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00DB0000, based on PE: true

Associated: 00000000.00000002.2103534640.0000000000DB0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103580373.0000000000E3F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103580373.0000000000E65000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103609603.0000000000E6F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103621893.0000000000E78000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_db0000_New Quotation - FE7191PO154.jbxd

Similarity

API ID: Destroy$ImageList_$AcceleratorDeleteInvalidateKillObjectRectTableTimerWindow
String ID:
API String ID: 641708696-0
Opcode ID: 16f42cff9620bd325fcd827cc211bedb1d6a4d33e495fc6dbc95465637aa4977
Instruction ID: 5c5d6b0cb49ed80b05d60906effef491e71257617dd189d3ee24150cd3d3749a
Opcode Fuzzy Hash: 16f42cff9620bd325fcd827cc211bedb1d6a4d33e495fc6dbc95465637aa4977
Instruction Fuzzy Hash: 51618B32500A50DFDB29EF1ACD49B7A7BF1FF40316F18852AE18766960C771A884DFA1

Function 00DB21A5 Relevance: 18.1, APIs: 12, Instructions: 132COMMON

Download Yara Rule

APIs

Part of subcall function 00DB25DB: GetWindowLongW.USER32(?,000000EB), ref: 00DB25EC

GetSysColor.USER32(0000000F), ref: 00DB21D3

Memory Dump Source

Source File: 00000000.00000002.2103545536.0000000000DB1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00DB0000, based on PE: true

Associated: 00000000.00000002.2103534640.0000000000DB0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103580373.0000000000E3F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103580373.0000000000E65000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103609603.0000000000E6F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103621893.0000000000E78000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_db0000_New Quotation - FE7191PO154.jbxd

Similarity

API ID: ColorLongWindow
String ID:
API String ID: 259745315-0
Opcode ID: 4a174532de69b60cb75640714f50d28a0f19f75ea31110a4f7436b9d85e82baf
Instruction ID: ebe3af635b86e3a1bf559a221f34047fb4e4f42ad5b70f31ae7009b8d8e19933
Opcode Fuzzy Hash: 4a174532de69b60cb75640714f50d28a0f19f75ea31110a4f7436b9d85e82baf
Instruction Fuzzy Hash: 4341BE32400648EFDB255F29EC89BB93B65EB06331F184265FD66DA1E6C7318C42DB35

Function 00E1AB12 Relevance: 17.7, APIs: 3, Strings: 7, Instructions: 183COMMON

Download Yara Rule

APIs

CharLowerBuffW.USER32(?,?,00E3F910), ref: 00E1AB76
GetDriveTypeW.KERNEL32(00000061,00E6A620,00000061), ref: 00E1AC40
_wcscpy.LIBCMT ref: 00E1AC6A

Strings

unknown, xrefs: 00E1AC01
removable, xrefs: 00E1ABA8
ramdisk, xrefs: 00E1ABEA
network, xrefs: 00E1ABD4
cdrom, xrefs: 00E1AB92
fixed, xrefs: 00E1ABBE
all, xrefs: 00E1AB7C

Memory Dump Source

Source File: 00000000.00000002.2103545536.0000000000DB1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00DB0000, based on PE: true

Associated: 00000000.00000002.2103534640.0000000000DB0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103580373.0000000000E3F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103580373.0000000000E65000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103609603.0000000000E6F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103621893.0000000000E78000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_db0000_New Quotation - FE7191PO154.jbxd

Similarity

API ID: BuffCharDriveLowerType_wcscpy
String ID: all$cdrom$fixed$network$ramdisk$removable$unknown
API String ID: 2820617543-1000479233
Opcode ID: 20bf944d8365ef2e115ecd78ceb0aaf7729491c0b335390079a9941593cb0fc7
Instruction ID: 329183eac673ae9dc1b5a04dcbfb13ce53a5292aa6f1611958086d4f73c92012
Opcode Fuzzy Hash: 20bf944d8365ef2e115ecd78ceb0aaf7729491c0b335390079a9941593cb0fc7
Instruction Fuzzy Hash: 5751BE305483419BC710EF14D892EFEB7A6EF80704F18582AF496672A2DB319D89CB63

Function 00E3C27C Relevance: 17.6, APIs: 6, Strings: 4, Instructions: 149windowCOMMON

Download Yara Rule

APIs

Part of subcall function 00DB2612: GetWindowLongW.USER32(?,000000EB), ref: 00DB2623

Part of subcall function 00DB2344: GetCursorPos.USER32(?), ref: 00DB2357
Part of subcall function 00DB2344: ScreenToClient.USER32(00E767B0,?), ref: 00DB2374
Part of subcall function 00DB2344: GetAsyncKeyState.USER32(00000001), ref: 00DB2399
Part of subcall function 00DB2344: GetAsyncKeyState.USER32(00000002), ref: 00DB23A7

ImageList_DragLeave.COMCTL32(00000000,00000000,00000001,?,?), ref: 00E3C2E4
ImageList_EndDrag.COMCTL32 ref: 00E3C2EA
ReleaseCapture.USER32 ref: 00E3C2F0
SetWindowTextW.USER32(?,00000000), ref: 00E3C39A
SendMessageW.USER32(?,000000B1,00000000,000000FF), ref: 00E3C3AD
DefDlgProcW.USER32(?,00000202,?,?,00000000,00000001,?,?), ref: 00E3C48F

Strings

pr, xrefs: 00E3C438
pr, xrefs: 00E3C3FD
@GUI_DROPID, xrefs: 00E3C3E1
@GUI_DRAGFILE, xrefs: 00E3C424

Memory Dump Source

Source File: 00000000.00000002.2103545536.0000000000DB1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00DB0000, based on PE: true

Associated: 00000000.00000002.2103534640.0000000000DB0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103580373.0000000000E3F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103580373.0000000000E65000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103609603.0000000000E6F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103621893.0000000000E78000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_db0000_New Quotation - FE7191PO154.jbxd

Similarity

API ID: AsyncDragImageList_StateWindow$CaptureClientCursorLeaveLongMessageProcReleaseScreenSendText
String ID: @GUI_DRAGFILE$@GUI_DROPID$pr$pr
API String ID: 1924731296-488423084
Opcode ID: 12fdc071990cf1ab107547ab1cc30233625c0fd41cbc37c8c9a7caa9763df657
Instruction ID: 885238c4fd28efd1b2259fe56cb817ecdab60cd2b1809fe42c7ceedfd5e3ebda
Opcode Fuzzy Hash: 12fdc071990cf1ab107547ab1cc30233625c0fd41cbc37c8c9a7caa9763df657
Instruction Fuzzy Hash: 30518170204304AFD704EF14DC5AFAA7BE5EF88314F10451DF5A6A72E1CB719948CB62

Function 00DB9997 Relevance: 17.6, APIs: 6, Strings: 4, Instructions: 146COMMON

Download Yara Rule

APIs

__itow.LIBCMT ref: 00DB99C2
__swprintf.LIBCMT ref: 00DB9A0C
__i64tow.LIBCMT ref: 00DEFA0F

Strings

0x%p, xrefs: 00DEF9F1
%.15g, xrefs: 00DB9A06
False, xrefs: 00DEF9D7
True, xrefs: 00DEF9D0

Memory Dump Source

Source File: 00000000.00000002.2103545536.0000000000DB1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00DB0000, based on PE: true

Associated: 00000000.00000002.2103534640.0000000000DB0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103580373.0000000000E3F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103580373.0000000000E65000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103609603.0000000000E6F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103621893.0000000000E78000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_db0000_New Quotation - FE7191PO154.jbxd

Similarity

API ID: __i64tow__itow__swprintf
String ID: %.15g$0x%p$False$True
API String ID: 421087845-2263619337
Opcode ID: 1cd23e95190f569573bd2be8cc649dbdaa4db105b181d0238f94827b464f5130
Instruction ID: 5cd2560de8a70ae4b95edb5561af75251f87ff5e2a75f044c6fe00ca48cf80cb
Opcode Fuzzy Hash: 1cd23e95190f569573bd2be8cc649dbdaa4db105b181d0238f94827b464f5130
Instruction Fuzzy Hash: 6341B371604245EBDB24AB35DC42BBAB7E8EF44300F24446EE68AD6292EA71D9458F31

Function 00E373C1 Relevance: 17.6, APIs: 8, Strings: 2, Instructions: 103windowCOMMON

Download Yara Rule

APIs

_memset.LIBCMT ref: 00E373D9
CreateMenu.USER32 ref: 00E373F4
SetMenu.USER32(?,00000000), ref: 00E37403
GetMenuItemInfoW.USER32(?,000000FF,00000000,00000030), ref: 00E37490
IsMenu.USER32(?), ref: 00E374A6
CreatePopupMenu.USER32 ref: 00E374B0
InsertMenuItemW.USER32(?,?,00000001,00000030), ref: 00E374DD
DrawMenuBar.USER32 ref: 00E374E5

Strings

F, xrefs: 00E374D1
0, xrefs: 00E373CF

Memory Dump Source

Source File: 00000000.00000002.2103545536.0000000000DB1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00DB0000, based on PE: true

Associated: 00000000.00000002.2103534640.0000000000DB0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103580373.0000000000E3F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103580373.0000000000E65000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103609603.0000000000E6F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103621893.0000000000E78000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_db0000_New Quotation - FE7191PO154.jbxd

Similarity

API ID: Menu$CreateItem$DrawInfoInsertPopup_memset
String ID: 0$F
API String ID: 176399719-3044882817
Opcode ID: 5aa743e391d749394689ac85258b6ca527431a8b3919685324e02480e7820a0b
Instruction ID: 5cad73631c8b85176bfa19de33208ed2013a1612ec3fc10ff1ae1f5410b90303
Opcode Fuzzy Hash: 5aa743e391d749394689ac85258b6ca527431a8b3919685324e02480e7820a0b
Instruction Fuzzy Hash: AA4125B5A00209EFDB20DF65D888E9ABFB9FF49315F144029E9A5A7360D731AD14CB60

Function 00E3772A Relevance: 17.6, APIs: 9, Strings: 1, Instructions: 101windowCOMMON

Download Yara Rule

APIs

MoveWindow.USER32(?,?,?,000000FF,000000FF,00000000,?,?,000000FF,000000FF,?,?,static,00000000,00000000,?), ref: 00E377CD
CreateCompatibleDC.GDI32(00000000), ref: 00E377D4
SendMessageW.USER32(?,00000173,00000000,00000000), ref: 00E377E7
SelectObject.GDI32(00000000,00000000), ref: 00E377EF
GetPixel.GDI32(00000000,00000000,00000000), ref: 00E377FA
DeleteDC.GDI32(00000000), ref: 00E37803
GetWindowLongW.USER32(?,000000EC), ref: 00E3780D
SetLayeredWindowAttributes.USER32(?,00000000,00000000,00000001), ref: 00E37821
DestroyWindow.USER32(?,?,?,000000FF,000000FF,?,?,static,00000000,00000000,?,?,00000000,00000000,?,?), ref: 00E3782D

Strings

static, xrefs: 00E37765

Memory Dump Source

Source File: 00000000.00000002.2103545536.0000000000DB1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00DB0000, based on PE: true

Associated: 00000000.00000002.2103534640.0000000000DB0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103580373.0000000000E3F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103580373.0000000000E65000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103609603.0000000000E6F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103621893.0000000000E78000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_db0000_New Quotation - FE7191PO154.jbxd

Similarity

API ID: Window$AttributesCompatibleCreateDeleteDestroyLayeredLongMessageMoveObjectPixelSelectSend
String ID: static
API String ID: 2559357485-2160076837
Opcode ID: 58b7f1efaa23b5090dc0d859f2c78c59b5a472c2644777c2e8b5f996b2ce5b68
Instruction ID: c1adc555606930f9fbd4a090e40d2dbd4e7b3a1afc9f981347d72ec2aea3cd2b
Opcode Fuzzy Hash: 58b7f1efaa23b5090dc0d859f2c78c59b5a472c2644777c2e8b5f996b2ce5b68
Instruction Fuzzy Hash: 03319872501219AFDF269FA5DC0DFEA3FA9EF09325F100225FA55B20A0C731D825DBA0

Function 00DD7040 Relevance: 16.8, APIs: 11, Instructions: 258COMMON

Download Yara Rule

APIs

_memset.LIBCMT ref: 00DD707B

Part of subcall function 00DD8D68: __getptd_noexit.LIBCMT ref: 00DD8D68

__gmtime64_s.LIBCMT ref: 00DD7114
__gmtime64_s.LIBCMT ref: 00DD714A
__gmtime64_s.LIBCMT ref: 00DD7167
__allrem.LIBCMT ref: 00DD71BD
__ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z.LIBCMT ref: 00DD71D9
__allrem.LIBCMT ref: 00DD71F0
__ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z.LIBCMT ref: 00DD720E
__allrem.LIBCMT ref: 00DD7225
__ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z.LIBCMT ref: 00DD7243
__invoke_watson.LIBCMT ref: 00DD72B4

Memory Dump Source

Source File: 00000000.00000002.2103545536.0000000000DB1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00DB0000, based on PE: true

Associated: 00000000.00000002.2103534640.0000000000DB0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103580373.0000000000E3F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103580373.0000000000E65000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103609603.0000000000E6F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103621893.0000000000E78000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_db0000_New Quotation - FE7191PO154.jbxd

Similarity

API ID: Unothrow_t@std@@@__allrem__ehfuncinfo$??2@__gmtime64_s$__getptd_noexit__invoke_watson_memset
String ID:
API String ID: 384356119-0
Opcode ID: 85949ae18b549cd2d12431497598bef6b028e5a4746e3945652a320069ef6a5a
Instruction ID: 4dba8240f415de6f9a251fc6a9ecba90b1cd2c466359f5a3a04fa35ae931348f
Opcode Fuzzy Hash: 85949ae18b549cd2d12431497598bef6b028e5a4746e3945652a320069ef6a5a
Instruction Fuzzy Hash: 42719171A04756ABD714AE69CC82B6AB7A8EF10324F18426BF514E73C1F770E94087B4

Function 00E12A16 Relevance: 16.7, APIs: 11, Instructions: 190windowsleepCOMMON

Download Yara Rule

APIs

_memset.LIBCMT ref: 00E12A31
GetMenuItemInfoW.USER32(00E76890,000000FF,00000000,00000030), ref: 00E12A92
SetMenuItemInfoW.USER32(00E76890,00000004,00000000,00000030), ref: 00E12AC8
Sleep.KERNEL32(000001F4), ref: 00E12ADA
GetMenuItemCount.USER32(?), ref: 00E12B1E
GetMenuItemID.USER32(?,00000000), ref: 00E12B3A
GetMenuItemID.USER32(?,-00000001), ref: 00E12B64
GetMenuItemID.USER32(?,?), ref: 00E12BA9
CheckMenuRadioItem.USER32(?,00000000,?,00000000,00000400), ref: 00E12BEF
GetMenuItemInfoW.USER32(?,000000FF,00000000,00000030), ref: 00E12C03
SetMenuItemInfoW.USER32(?,000000FF,00000000,00000030), ref: 00E12C24

Memory Dump Source

Source File: 00000000.00000002.2103545536.0000000000DB1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00DB0000, based on PE: true

Associated: 00000000.00000002.2103534640.0000000000DB0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103580373.0000000000E3F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103580373.0000000000E65000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103609603.0000000000E6F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103621893.0000000000E78000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_db0000_New Quotation - FE7191PO154.jbxd

Similarity

API ID: ItemMenu$Info$CheckCountRadioSleep_memset
String ID:
API String ID: 4176008265-0
Opcode ID: 6b53158dc3bd9bbf2e54b4867ea59a6a35df9ad8918f0954bc5cfab521732687
Instruction ID: a0054cfb93c2fd8be5c3ef1d45cdb1c6b2c2c73802414c3b43c59780129a285d
Opcode Fuzzy Hash: 6b53158dc3bd9bbf2e54b4867ea59a6a35df9ad8918f0954bc5cfab521732687
Instruction Fuzzy Hash: A661BFB0904249AFDB21CF64CC88EEEBBB8EB40308F14555DEA41B3251D731ADA9DB60

Function 00E37192 Relevance: 16.7, APIs: 11, Instructions: 184windowCOMMON

Download Yara Rule

APIs

SendMessageW.USER32(?,0000101F,00000000,00000000), ref: 00E37214
SendMessageW.USER32(00000000,?,0000101F,00000000), ref: 00E37217
GetWindowLongW.USER32(?,000000F0), ref: 00E3723B
_memset.LIBCMT ref: 00E3724C
SendMessageW.USER32(?,00001004,00000000,00000000), ref: 00E3725E
SendMessageW.USER32(?,0000104D,00000000,00000007), ref: 00E372D6

Memory Dump Source

Source File: 00000000.00000002.2103545536.0000000000DB1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00DB0000, based on PE: true

Associated: 00000000.00000002.2103534640.0000000000DB0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103580373.0000000000E3F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103580373.0000000000E65000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103609603.0000000000E6F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103621893.0000000000E78000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_db0000_New Quotation - FE7191PO154.jbxd

Similarity

API ID: MessageSend$LongWindow_memset
String ID:
API String ID: 830647256-0
Opcode ID: 67c0cf886722c699f1e1feca26f1219d8ef89c54faee13ebf4a7ffb5d873eaab
Instruction ID: fb4c6e793a1023ba5dc0668a8f4dae16db51db7ce84801fa7db5753feb593ec1
Opcode Fuzzy Hash: 67c0cf886722c699f1e1feca26f1219d8ef89c54faee13ebf4a7ffb5d873eaab
Instruction Fuzzy Hash: AC617BB5A00248AFDB20DFA4CC85EEE7BF8EB09704F144159FA54B72A1C770AD45DBA0

Function 00E0710E Relevance: 16.6, APIs: 11, Instructions: 123memoryCOMMON

Download Yara Rule

APIs

SafeArrayAllocDescriptorEx.OLEAUT32(0000000C,?,?), ref: 00E07135
SafeArrayAllocData.OLEAUT32(?), ref: 00E0718E
VariantInit.OLEAUT32(?), ref: 00E071A0
SafeArrayAccessData.OLEAUT32(?,?), ref: 00E071C0
VariantCopy.OLEAUT32(?,?), ref: 00E07213
SafeArrayUnaccessData.OLEAUT32(?), ref: 00E07227
VariantClear.OLEAUT32(?), ref: 00E0723C
SafeArrayDestroyData.OLEAUT32(?), ref: 00E07249
SafeArrayDestroyDescriptor.OLEAUT32(?), ref: 00E07252
VariantClear.OLEAUT32(?), ref: 00E07264
SafeArrayDestroyDescriptor.OLEAUT32(?), ref: 00E0726F

Memory Dump Source

Source File: 00000000.00000002.2103545536.0000000000DB1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00DB0000, based on PE: true

Associated: 00000000.00000002.2103534640.0000000000DB0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103580373.0000000000E3F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103580373.0000000000E65000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103609603.0000000000E6F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103621893.0000000000E78000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_db0000_New Quotation - FE7191PO154.jbxd

Similarity

API ID: ArraySafe$DataVariant$DescriptorDestroy$AllocClear$AccessCopyInitUnaccess
String ID:
API String ID: 2706829360-0
Opcode ID: dca86eff849ea1efbfb5424876e39fb7950ab4f541415afbed31552a1b606f28
Instruction ID: 6eab400d11aa4b553e0f86e5b1f1fe0683ff4666d731312dd26040c94174707c
Opcode Fuzzy Hash: dca86eff849ea1efbfb5424876e39fb7950ab4f541415afbed31552a1b606f28
Instruction Fuzzy Hash: 2D413075D04119EFCB04DF65D8489EEBBB9FF48354F008069F955B7261CB30A989CBA0

Function 00E25A45 Relevance: 15.9, APIs: 8, Strings: 1, Instructions: 163networkfileCOMMON

Download Yara Rule

APIs

WSAStartup.WSOCK32(00000101,?), ref: 00E25AA6
inet_addr.WSOCK32(?,?,?), ref: 00E25AEB
gethostbyname.WSOCK32(?), ref: 00E25AF7
IcmpCreateFile.IPHLPAPI ref: 00E25B05
IcmpSendEcho.IPHLPAPI(?,?,?,00000005,00000000,?,00000029,00000FA0), ref: 00E25B75
IcmpSendEcho.IPHLPAPI(00000000,00000000,?,00000005,00000000,?,00000029,00000FA0), ref: 00E25B8B
IcmpCloseHandle.IPHLPAPI(00000000), ref: 00E25C00
WSACleanup.WSOCK32 ref: 00E25C06

Strings

Ping, xrefs: 00E25B29

Memory Dump Source

Source File: 00000000.00000002.2103545536.0000000000DB1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00DB0000, based on PE: true

Associated: 00000000.00000002.2103534640.0000000000DB0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103580373.0000000000E3F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103580373.0000000000E65000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103609603.0000000000E6F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103621893.0000000000E78000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_db0000_New Quotation - FE7191PO154.jbxd

Similarity

API ID: Icmp$EchoSend$CleanupCloseCreateFileHandleStartupgethostbynameinet_addr
String ID: Ping
API String ID: 1028309954-2246546115
Opcode ID: b57450e03b96a4f4799e054616312b782727d4d9d2a27a5e2af9126e17d11048
Instruction ID: 0071e62f499382e11f5293223bde5fee97ac0e28bd357310c74ac407a30d5188
Opcode Fuzzy Hash: b57450e03b96a4f4799e054616312b782727d4d9d2a27a5e2af9126e17d11048
Instruction Fuzzy Hash: E251A032604710DFDB10AF25ED49B6ABBE0EF48310F14992AF556EB2A1DB70E804CB51

Function 00E1B72E Relevance: 15.8, APIs: 4, Strings: 5, Instructions: 98COMMON

Download Yara Rule

APIs

SetErrorMode.KERNEL32(00000001), ref: 00E1B73B
GetDiskFreeSpaceW.KERNEL32(?,?,?,?,?,00000002,00000001), ref: 00E1B7B1
GetLastError.KERNEL32 ref: 00E1B7BB
SetErrorMode.KERNEL32(00000000,READY), ref: 00E1B828

Strings

NOTREADY, xrefs: 00E1B7E7
READONLY, xrefs: 00E1B7F3
INVALID, xrefs: 00E1B7FA
UNKNOWN, xrefs: 00E1B7E0
READY, xrefs: 00E1B801

Memory Dump Source

Source File: 00000000.00000002.2103545536.0000000000DB1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00DB0000, based on PE: true

Associated: 00000000.00000002.2103534640.0000000000DB0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103580373.0000000000E3F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103580373.0000000000E65000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103609603.0000000000E6F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103621893.0000000000E78000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_db0000_New Quotation - FE7191PO154.jbxd

Similarity

API ID: Error$Mode$DiskFreeLastSpace
String ID: INVALID$NOTREADY$READONLY$READY$UNKNOWN
API String ID: 4194297153-14809454
Opcode ID: 60e6882cbfcadbe48cf215dbb9ce509457e1f3ea8e1e3c287886bcd1ec61c986
Instruction ID: a53bc2ae14b9c5a6886c99e58c0e718d8196566513b559d9c7e27e29254a9986
Opcode Fuzzy Hash: 60e6882cbfcadbe48cf215dbb9ce509457e1f3ea8e1e3c287886bcd1ec61c986
Instruction Fuzzy Hash: FE31A135E00209DFCB04EF64D889AEEBBB8EF84744F14512AE502F72D1DB719982CB61

Function 00E09471 Relevance: 15.8, APIs: 7, Strings: 2, Instructions: 82windowCOMMON

Download Yara Rule

APIs

Part of subcall function 00DB7F41: _memmove.LIBCMT ref: 00DB7F82

Part of subcall function 00E0B0C4: GetClassNameW.USER32(?,?,000000FF), ref: 00E0B0E7

SendMessageW.USER32(?,0000018C,000000FF,00000002), ref: 00E094F6
GetDlgCtrlID.USER32 ref: 00E09501
GetParent.USER32 ref: 00E0951D
SendMessageW.USER32(00000000,?,00000111,?), ref: 00E09520
GetDlgCtrlID.USER32(?), ref: 00E09529
GetParent.USER32(?), ref: 00E09545
SendMessageW.USER32(00000000,?,?,00000111), ref: 00E09548

Strings

ListBox, xrefs: 00E094B3
ComboBox, xrefs: 00E0947E

Memory Dump Source

Source File: 00000000.00000002.2103545536.0000000000DB1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00DB0000, based on PE: true

Associated: 00000000.00000002.2103534640.0000000000DB0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103580373.0000000000E3F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103580373.0000000000E65000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103609603.0000000000E6F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103621893.0000000000E78000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_db0000_New Quotation - FE7191PO154.jbxd

Similarity

API ID: MessageSend$CtrlParent$ClassName_memmove
String ID: ComboBox$ListBox
API String ID: 1536045017-1403004172
Opcode ID: 6a7ccd1a607d40d74392bdf19f232aedb2ba7f761c31f2e3e5cb229edd7e6559
Instruction ID: facc95e2f598f006a95165513182bc5901e4ac9dde7f2de668f8719e7c0db791
Opcode Fuzzy Hash: 6a7ccd1a607d40d74392bdf19f232aedb2ba7f761c31f2e3e5cb229edd7e6559
Instruction Fuzzy Hash: FE21B270E00208AFCF05AF65CC96EFEBB68EF49300F101115F562A72E2DB7559599B70

Function 00E0955C Relevance: 15.8, APIs: 7, Strings: 2, Instructions: 81windowCOMMON

Download Yara Rule

APIs

Part of subcall function 00DB7F41: _memmove.LIBCMT ref: 00DB7F82

Part of subcall function 00E0B0C4: GetClassNameW.USER32(?,?,000000FF), ref: 00E0B0E7

SendMessageW.USER32(?,00000186,00000002,00000000), ref: 00E095DF
GetDlgCtrlID.USER32 ref: 00E095EA
GetParent.USER32 ref: 00E09606
SendMessageW.USER32(00000000,?,00000111,?), ref: 00E09609
GetDlgCtrlID.USER32(?), ref: 00E09612
GetParent.USER32(?), ref: 00E0962E
SendMessageW.USER32(00000000,?,?,00000111), ref: 00E09631

Strings

ListBox, xrefs: 00E0959E
ComboBox, xrefs: 00E09569

Memory Dump Source

Source File: 00000000.00000002.2103545536.0000000000DB1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00DB0000, based on PE: true

Associated: 00000000.00000002.2103534640.0000000000DB0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103580373.0000000000E3F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103580373.0000000000E65000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103609603.0000000000E6F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103621893.0000000000E78000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_db0000_New Quotation - FE7191PO154.jbxd

Similarity

API ID: MessageSend$CtrlParent$ClassName_memmove
String ID: ComboBox$ListBox
API String ID: 1536045017-1403004172
Opcode ID: 81e6ff961b8ed8033a363a7bb189805da76aadd8dd0d702ff01b8fc58b9579a3
Instruction ID: b0ee68727ab8fd0e4609db16f5ba7a847b7cd5445304c8af166ccf0f91ab541f
Opcode Fuzzy Hash: 81e6ff961b8ed8033a363a7bb189805da76aadd8dd0d702ff01b8fc58b9579a3
Instruction Fuzzy Hash: 62219074A00208ABDF01AF61DC96EFEBBA8EF48300F105015F952A72E2DB7599599A70

Function 00E09645 Relevance: 15.8, APIs: 4, Strings: 5, Instructions: 72windowCOMMON

Download Yara Rule

APIs

GetParent.USER32 ref: 00E09651
GetClassNameW.USER32(00000000,?,00000100), ref: 00E09666
_wcscmp.LIBCMT ref: 00E09678
SendMessageW.USER32(00000000,00000111,0000702B,00000000), ref: 00E096F3

Strings

details, xrefs: 00E096A1
list, xrefs: 00E096D5
largeicons, xrefs: 00E09687
smallicons, xrefs: 00E096BB
SHELLDLL_DefView, xrefs: 00E09672

Memory Dump Source

Source File: 00000000.00000002.2103545536.0000000000DB1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00DB0000, based on PE: true

Associated: 00000000.00000002.2103534640.0000000000DB0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103580373.0000000000E3F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103580373.0000000000E65000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103609603.0000000000E6F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103621893.0000000000E78000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_db0000_New Quotation - FE7191PO154.jbxd

Similarity

API ID: ClassMessageNameParentSend_wcscmp
String ID: SHELLDLL_DefView$details$largeicons$list$smallicons
API String ID: 1704125052-3381328864
Opcode ID: 2db62688ea98adf4242ff6dc90193ce498f173236291c14f4cde6eff15a75e57
Instruction ID: 541af2499cd3b8a91ea58be8f2f49512e030a494976edb8036bb30b65e94cd54
Opcode Fuzzy Hash: 2db62688ea98adf4242ff6dc90193ce498f173236291c14f4cde6eff15a75e57
Instruction Fuzzy Hash: A8110A76688707BAFA052A21FC1BDE6779CCB05364F201027F901B50E3FE6359904979

Function 00E14189 Relevance: 15.1, APIs: 10, Instructions: 108windowCOMMON

Download Yara Rule

APIs

__swprintf.LIBCMT ref: 00E1419D
__swprintf.LIBCMT ref: 00E141AA

Part of subcall function 00DD38D8: __woutput_l.LIBCMT ref: 00DD3931

FindResourceW.KERNEL32(?,?,0000000E), ref: 00E141D4
LoadResource.KERNEL32(?,00000000), ref: 00E141E0
LockResource.KERNEL32(00000000), ref: 00E141ED
FindResourceW.KERNEL32(?,?,00000003), ref: 00E1420D
LoadResource.KERNEL32(?,00000000), ref: 00E1421F
SizeofResource.KERNEL32(?,00000000), ref: 00E1422E
LockResource.KERNEL32(?), ref: 00E1423A
CreateIconFromResourceEx.USER32(?,?,00000001,00030000,00000000,00000000,00000000), ref: 00E1429B

Memory Dump Source

Source File: 00000000.00000002.2103545536.0000000000DB1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00DB0000, based on PE: true

Associated: 00000000.00000002.2103534640.0000000000DB0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103580373.0000000000E3F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103580373.0000000000E65000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103609603.0000000000E6F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103621893.0000000000E78000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_db0000_New Quotation - FE7191PO154.jbxd

Similarity

API ID: Resource$FindLoadLock__swprintf$CreateFromIconSizeof__woutput_l
String ID:
API String ID: 1433390588-0
Opcode ID: d3c86e20e6da5fec400c69cd9221990537e88ee8bb51f68ebfa9def2bcbb3867
Instruction ID: d0fac8794ae9a53f0a297a88cb51cce2c48accf0fec5a328da6b046b0bc9bc9f
Opcode Fuzzy Hash: d3c86e20e6da5fec400c69cd9221990537e88ee8bb51f68ebfa9def2bcbb3867
Instruction Fuzzy Hash: F23181B1A0521AAFDB119F61EC48EFB7BA8EF04305F044525F915F22A0D770DA91CBB0

Function 00DBFBBD Relevance: 14.3, APIs: 7, Strings: 1, Instructions: 264comCOMMON

Download Yara Rule

APIs

mciSendStringW.WINMM(close all,00000000,00000000,00000000), ref: 00DBFC06
OleUninitialize.OLE32(?,00000000), ref: 00DBFCA5
UnregisterHotKey.USER32(?), ref: 00DBFDFC
DestroyWindow.USER32(?), ref: 00DF4A00
FreeLibrary.KERNEL32(?), ref: 00DF4A65
VirtualFree.KERNEL32(?,00000000,00008000), ref: 00DF4A92

Strings

close all, xrefs: 00DBFC01

Memory Dump Source

Source File: 00000000.00000002.2103545536.0000000000DB1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00DB0000, based on PE: true

Associated: 00000000.00000002.2103534640.0000000000DB0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103580373.0000000000E3F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103580373.0000000000E65000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103609603.0000000000E6F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103621893.0000000000E78000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_db0000_New Quotation - FE7191PO154.jbxd

Similarity

API ID: Free$DestroyLibrarySendStringUninitializeUnregisterVirtualWindow
String ID: close all
API String ID: 469580280-3243417748
Opcode ID: acf2b21a28c2330e833349bee6cb64f4e3a17a8547366859ce8667e7f21f713f
Instruction ID: e72dba9e971ef1199aa355c1fd9caec7c2815baf94f1b11852a00c9eda23e24c
Opcode Fuzzy Hash: acf2b21a28c2330e833349bee6cb64f4e3a17a8547366859ce8667e7f21f713f
Instruction Fuzzy Hash: 11A13E34701216CFCB19EF15C895A6AF7A4EF04704F1982ADE90A6B262DB30ED56CF74

Function 00E29428 Relevance: 14.3, APIs: 5, Strings: 3, Instructions: 263COMMON

Download Yara Rule

APIs

_memset.LIBCMT ref: 00E2947C
VariantInit.OLEAUT32(?), ref: 00E2954D
VariantInit.OLEAUT32(?), ref: 00E2964E
VariantClear.OLEAUT32(?), ref: 00E29658
VariantClear.OLEAUT32(?), ref: 00E296B5

Strings

Incorrect Object type in FOR..IN loop, xrefs: 00E29631
,,, xrefs: 00E294FA
Null Object assignment in FOR..IN loop, xrefs: 00E294DD, 00E2960B, 00E296C3

Memory Dump Source

Source File: 00000000.00000002.2103545536.0000000000DB1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00DB0000, based on PE: true

Associated: 00000000.00000002.2103534640.0000000000DB0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103580373.0000000000E3F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103580373.0000000000E65000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103609603.0000000000E6F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103621893.0000000000E78000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_db0000_New Quotation - FE7191PO154.jbxd

Similarity

API ID: Variant$ClearInit$_memset
String ID: ,,$Incorrect Object type in FOR..IN loop$Null Object assignment in FOR..IN loop
API String ID: 2862541840-218231672
Opcode ID: e397bab693ce5d957e16c827380079733e5651c28e7a7e5edbe7cc7ee1409c79
Instruction ID: f455ee3e64f60df8438254bb4af55024c20ce67447684f03c4b1bf7e5040424a
Opcode Fuzzy Hash: e397bab693ce5d957e16c827380079733e5651c28e7a7e5edbe7cc7ee1409c79
Instruction Fuzzy Hash: 9991BE70A00229ABDF24DFA5E848FAEBBB8EF45714F10A159F515BB281D7709905CFA0

Function 00E0A693 Relevance: 14.2, APIs: 2, Strings: 6, Instructions: 241COMMON

Download Yara Rule

APIs

EnumChildWindows.USER32(?,00E0AA64), ref: 00E0A9A2

Strings

REGEXPCLASS, xrefs: 00E0A767
INSTANCE, xrefs: 00E0A8B0
TEXT, xrefs: 00E0A8D9
CLASS, xrefs: 00E0A721
CLASSNN, xrefs: 00E0A744
NAME, xrefs: 00E0A7D4

Memory Dump Source

Source File: 00000000.00000002.2103545536.0000000000DB1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00DB0000, based on PE: true

Associated: 00000000.00000002.2103534640.0000000000DB0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103580373.0000000000E3F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103580373.0000000000E65000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103609603.0000000000E6F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103621893.0000000000E78000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_db0000_New Quotation - FE7191PO154.jbxd

Similarity

API ID: ChildEnumWindows
String ID: CLASS$CLASSNN$INSTANCE$NAME$REGEXPCLASS$TEXT
API String ID: 3555792229-1603158881
Opcode ID: 2892faea5d04c1cc7d259eb411a27ab8699883f6d58da079912a0d8866e717ca
Instruction ID: 845f5eed5f648c7266d435652e2949570d13802afe42cd336c94145648b2e072
Opcode Fuzzy Hash: 2892faea5d04c1cc7d259eb411a27ab8699883f6d58da079912a0d8866e717ca
Instruction Fuzzy Hash: 62917330A0070AEBDB08DF60D481BE9FB75FF44344F58912AD49AB7291DB306999CBB1

Function 00DB2E26 Relevance: 14.2, APIs: 7, Strings: 1, Instructions: 186windowCOMMON

Download Yara Rule

APIs

SetWindowLongW.USER32(?,000000EB), ref: 00DB2EAE

Part of subcall function 00DB1DB3: GetClientRect.USER32(?,?), ref: 00DB1DDC
Part of subcall function 00DB1DB3: GetWindowRect.USER32(?,?), ref: 00DB1E1D
Part of subcall function 00DB1DB3: ScreenToClient.USER32(?,?), ref: 00DB1E45

GetDC.USER32 ref: 00DECF82
SendMessageW.USER32(?,00000031,00000000,00000000), ref: 00DECF95
SelectObject.GDI32(00000000,00000000), ref: 00DECFA3
SelectObject.GDI32(00000000,00000000), ref: 00DECFB8
ReleaseDC.USER32(?,00000000), ref: 00DECFC0
MoveWindow.USER32(?,?,?,?,?,?,?,00000031,00000000,00000000), ref: 00DED04B

Strings

U, xrefs: 00DECF20

Memory Dump Source

Source File: 00000000.00000002.2103545536.0000000000DB1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00DB0000, based on PE: true

Associated: 00000000.00000002.2103534640.0000000000DB0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103580373.0000000000E3F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103580373.0000000000E65000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103609603.0000000000E6F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103621893.0000000000E78000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_db0000_New Quotation - FE7191PO154.jbxd

Similarity

API ID: Window$ClientObjectRectSelect$LongMessageMoveReleaseScreenSend
String ID: U
API String ID: 4009187628-3372436214
Opcode ID: c89585ada3b7fc65991f78d2a24126624fc4e8577c7ca75895b35d3aaf8de441
Instruction ID: 0076668aa048bd124b5126fc088d2c733d450428033c5d2fe7fef4711b714036
Opcode Fuzzy Hash: c89585ada3b7fc65991f78d2a24126624fc4e8577c7ca75895b35d3aaf8de441
Instruction Fuzzy Hash: 0371E231400245DFCF259F66C884AFA3BB6FF48360F18426AFD566A1A6C731C842DB70

Function 00E28F5B Relevance: 13.9, APIs: 9, Instructions: 438COMMON

Download Yara Rule

APIs

GetModuleFileNameW.KERNEL32(?,?,00000104,?,00E3F910), ref: 00E2903D
FreeLibrary.KERNEL32(00000000,00000001,00000000,?,00E3F910), ref: 00E29071
QueryPathOfRegTypeLib.OLEAUT32(?,?,?,?,?), ref: 00E291EB
SysFreeString.OLEAUT32(?), ref: 00E29215

Memory Dump Source

Source File: 00000000.00000002.2103545536.0000000000DB1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00DB0000, based on PE: true

Associated: 00000000.00000002.2103534640.0000000000DB0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103580373.0000000000E3F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103580373.0000000000E65000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103609603.0000000000E6F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103621893.0000000000E78000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_db0000_New Quotation - FE7191PO154.jbxd

Similarity

API ID: Free$FileLibraryModuleNamePathQueryStringType
String ID:
API String ID: 560350794-0
Opcode ID: 272ab4a613a547a31fcd2736eb6afe37646b550b6d2492e9ee2918b5d8f8775b
Instruction ID: 965fe03818bef8492c79cffc876f2cb8723192e57fcee203769d262c85123383
Opcode Fuzzy Hash: 272ab4a613a547a31fcd2736eb6afe37646b550b6d2492e9ee2918b5d8f8775b
Instruction Fuzzy Hash: 79F10871A00219EFDF04DF94D888EAEB7B9FF49314F109059F516AB291DB31AE45CB60

Function 00E2F9A8 Relevance: 13.9, APIs: 9, Instructions: 386processCOMMON

Download Yara Rule

APIs

_memset.LIBCMT ref: 00E2F9C9
GetSystemDirectoryW.KERNEL32(00000000,00000000), ref: 00E2FB5C
GetSystemDirectoryW.KERNEL32(00000000,00000000), ref: 00E2FB80
GetCurrentDirectoryW.KERNEL32(00000000,00000000), ref: 00E2FBC0
GetCurrentDirectoryW.KERNEL32(00000000,00000000), ref: 00E2FBE2
CreateProcessW.KERNEL32(00000000,?,00000000,00000000,?,?,00000000,?,?,?), ref: 00E2FD5E
GetLastError.KERNEL32(00000000,00000001,00000000), ref: 00E2FD90
CloseHandle.KERNEL32(?), ref: 00E2FDBF
CloseHandle.KERNEL32(?), ref: 00E2FE36

Memory Dump Source

Source File: 00000000.00000002.2103545536.0000000000DB1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00DB0000, based on PE: true

Associated: 00000000.00000002.2103534640.0000000000DB0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103580373.0000000000E3F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103580373.0000000000E65000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103609603.0000000000E6F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103621893.0000000000E78000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_db0000_New Quotation - FE7191PO154.jbxd

Similarity

API ID: Directory$CloseCurrentHandleSystem$CreateErrorLastProcess_memset
String ID:
API String ID: 4090791747-0
Opcode ID: 57b5e4dc52c1fd8cc3fb9035996b4709baa888362df9c646082fd27a0081e4e2
Instruction ID: 41a3b78b5174b1b122748b7b47f6142b02af872a11c38ef5979e840d6781b3b6
Opcode Fuzzy Hash: 57b5e4dc52c1fd8cc3fb9035996b4709baa888362df9c646082fd27a0081e4e2
Instruction Fuzzy Hash: 88E18D31604251DFCB14EF24D491BAABBF1EF84314F14956DF89AAB2A2DB31DC44CB62

Function 00E14F63 Relevance: 13.7, APIs: 9, Instructions: 170filestringCOMMON

Download Yara Rule

APIs

Part of subcall function 00E148AA: GetFullPathNameW.KERNEL32(00000000,00007FFF,?,?,?,?,?,?,00E138D3,?), ref: 00E148C7

Part of subcall function 00E148AA: GetFullPathNameW.KERNEL32(?,00007FFF,?,?,?,?,?,00E138D3,?), ref: 00E148E0

Part of subcall function 00E14CD3: GetFileAttributesW.KERNEL32(?,00E13947), ref: 00E14CD4

lstrcmpiW.KERNEL32(?,?), ref: 00E14FE2
_wcscmp.LIBCMT ref: 00E14FFC
MoveFileW.KERNEL32(?,?), ref: 00E15017

Memory Dump Source

Source File: 00000000.00000002.2103545536.0000000000DB1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00DB0000, based on PE: true

Associated: 00000000.00000002.2103534640.0000000000DB0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103580373.0000000000E3F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103580373.0000000000E65000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103609603.0000000000E6F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103621893.0000000000E78000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_db0000_New Quotation - FE7191PO154.jbxd

Similarity

API ID: FileFullNamePath$AttributesMove_wcscmplstrcmpi
String ID:
API String ID: 793581249-0
Opcode ID: a67e286d9bac5ee9149498e14890f7aab5ad29e7fe4e281dd6491488a69ae512
Instruction ID: 92cdc5229d53e97c2b09589e1eb0cfc06e1407d4e6f59d4e128eed59be0a44f0
Opcode Fuzzy Hash: a67e286d9bac5ee9149498e14890f7aab5ad29e7fe4e281dd6491488a69ae512
Instruction Fuzzy Hash: BD5165B25087859BC724EBA0D8819DFB3DCEF84301F10192EF189E3191EF74A6888776

Function 00E388B4 Relevance: 13.7, APIs: 9, Instructions: 168COMMON

Download Yara Rule

APIs

InvalidateRect.USER32(?,00000000,00000001,?,00000001), ref: 00E3896E

Memory Dump Source

Source File: 00000000.00000002.2103545536.0000000000DB1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00DB0000, based on PE: true

Associated: 00000000.00000002.2103534640.0000000000DB0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103580373.0000000000E3F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103580373.0000000000E65000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103609603.0000000000E6F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103621893.0000000000E78000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_db0000_New Quotation - FE7191PO154.jbxd

Similarity

API ID: InvalidateRect
String ID:
API String ID: 634782764-0
Opcode ID: 517d1e369b9a433810045e4f10b4e7d2a6dd65466cbae01e06c592e8345bec7c
Instruction ID: 136f08f509b23d554cc281cfbf4f84f2b10dfb66c7be86fc21b6b02c9e35e752
Opcode Fuzzy Hash: 517d1e369b9a433810045e4f10b4e7d2a6dd65466cbae01e06c592e8345bec7c
Instruction Fuzzy Hash: 8F519030600308BFEF289F25CE8DBA93FA5EB04354F606116F515F66A1DF71A984DB91

Function 00DB2B72 Relevance: 13.7, APIs: 9, Instructions: 161windowCOMMON

Download Yara Rule

APIs

LoadImageW.USER32(00000000,?,00000001,00000010,00000010,00000010), ref: 00DEC547
ExtractIconExW.SHELL32(?,00000000,00000000,00000000,00000001), ref: 00DEC569
LoadImageW.USER32(00000000,?,00000001,00000000,00000000,00000050), ref: 00DEC581
ExtractIconExW.SHELL32(?,00000000,?,00000000,00000001), ref: 00DEC59F
SendMessageW.USER32(00000000,00000080,00000000,00000000), ref: 00DEC5C0
DestroyIcon.USER32(00000000), ref: 00DEC5CF
SendMessageW.USER32(00000000,00000080,00000001,00000000), ref: 00DEC5EC
DestroyIcon.USER32(?), ref: 00DEC5FB

Part of subcall function 00E3A71E: DeleteObject.GDI32(00000000), ref: 00E3A757

Memory Dump Source

Source File: 00000000.00000002.2103545536.0000000000DB1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00DB0000, based on PE: true

Associated: 00000000.00000002.2103534640.0000000000DB0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103580373.0000000000E3F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103580373.0000000000E65000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103609603.0000000000E6F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103621893.0000000000E78000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_db0000_New Quotation - FE7191PO154.jbxd

Similarity

API ID: Icon$DestroyExtractImageLoadMessageSend$DeleteObject
String ID:
API String ID: 2819616528-0
Opcode ID: c3227707579ff6ce6cf0db6435e292bff288bff531cf6d563030c6e7d8ec64ff
Instruction ID: e468d33b4910c461cf28ea6d708e9194640bef3ea1fd5ed2bac4a45da9b28417
Opcode Fuzzy Hash: c3227707579ff6ce6cf0db6435e292bff288bff531cf6d563030c6e7d8ec64ff
Instruction Fuzzy Hash: 86517771A10249EFDB24EF26CC45FBA3BB5EB48350F140529F946A72A0DB70ED91DB60

Function 00E09B50 Relevance: 13.6, APIs: 9, Instructions: 66sleepkeyboardwindowCOMMON

Download Yara Rule

APIs

Part of subcall function 00E0AE57: GetWindowThreadProcessId.USER32(?,00000000), ref: 00E0AE77
Part of subcall function 00E0AE57: GetCurrentThreadId.KERNEL32 ref: 00E0AE7E
Part of subcall function 00E0AE57: AttachThreadInput.USER32(00000000,?,00E09B65,?,00000001), ref: 00E0AE85

MapVirtualKeyW.USER32(00000025,00000000), ref: 00E09B70
PostMessageW.USER32(?,00000100,00000025,00000000), ref: 00E09B8D
Sleep.KERNEL32(00000000,?,00000100,00000025,00000000,?,00000001), ref: 00E09B90
MapVirtualKeyW.USER32(00000025,00000000), ref: 00E09B99
PostMessageW.USER32(?,00000100,00000027,00000000), ref: 00E09BB7
Sleep.KERNEL32(00000000,?,00000100,00000027,00000000,?,00000001), ref: 00E09BBA
MapVirtualKeyW.USER32(00000025,00000000), ref: 00E09BC3
PostMessageW.USER32(?,00000101,00000027,00000000), ref: 00E09BDA
Sleep.KERNEL32(00000000,?,00000100,00000027,00000000,?,00000001), ref: 00E09BDD

Memory Dump Source

Source File: 00000000.00000002.2103545536.0000000000DB1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00DB0000, based on PE: true

Associated: 00000000.00000002.2103534640.0000000000DB0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103580373.0000000000E3F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103580373.0000000000E65000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103609603.0000000000E6F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103621893.0000000000E78000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_db0000_New Quotation - FE7191PO154.jbxd

Similarity

API ID: MessagePostSleepThreadVirtual$AttachCurrentInputProcessWindow
String ID:
API String ID: 2014098862-0
Opcode ID: f7411ed56d605a7db9a815daecbf15d46961300adc22b8c26685a24161c67e98
Instruction ID: 98960c1e240c8457bcbaff1c7c8e9d1b9c713fa48168eeb6886c4b0bfbbd893d
Opcode Fuzzy Hash: f7411ed56d605a7db9a815daecbf15d46961300adc22b8c26685a24161c67e98
Instruction Fuzzy Hash: C711CE71950618BEF6106F61EC8EFAA3E6DEB4C761F100425F244BB0E1C9F35C909AA4

Function 00E08E03 Relevance: 13.5, APIs: 9, Instructions: 49memorythreadCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32(00000008,0000000C,00000000,00000000,?,00E08A84,00000B00,?,?), ref: 00E08E0C
HeapAlloc.KERNEL32(00000000,?,00E08A84,00000B00,?,?), ref: 00E08E13
GetCurrentProcess.KERNEL32(00000000,00000000,00000000,00000002,?,00E08A84,00000B00,?,?), ref: 00E08E28
GetCurrentProcess.KERNEL32(?,00000000,?,00E08A84,00000B00,?,?), ref: 00E08E30
DuplicateHandle.KERNEL32(00000000,?,00E08A84,00000B00,?,?), ref: 00E08E33
GetCurrentProcess.KERNEL32(00000008,00000000,00000000,00000002,?,00E08A84,00000B00,?,?), ref: 00E08E43
GetCurrentProcess.KERNEL32(00E08A84,00000000,?,00E08A84,00000B00,?,?), ref: 00E08E4B
DuplicateHandle.KERNEL32(00000000,?,00E08A84,00000B00,?,?), ref: 00E08E4E
CreateThread.KERNEL32(00000000,00000000,00E08E74,00000000,00000000,00000000), ref: 00E08E68

Memory Dump Source

Source File: 00000000.00000002.2103545536.0000000000DB1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00DB0000, based on PE: true

Associated: 00000000.00000002.2103534640.0000000000DB0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103580373.0000000000E3F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103580373.0000000000E65000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103609603.0000000000E6F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103621893.0000000000E78000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_db0000_New Quotation - FE7191PO154.jbxd

Similarity

API ID: Process$Current$DuplicateHandleHeap$AllocCreateThread
String ID:
API String ID: 1957940570-0
Opcode ID: c1f926539610bb60f509e5b11ffaf258947966ad95cc90cd2af4e96b94b3939f
Instruction ID: b4cc428c1581939e6297dbd71799faeda26287b4f5398ee89970c55e554055dc
Opcode Fuzzy Hash: c1f926539610bb60f509e5b11ffaf258947966ad95cc90cd2af4e96b94b3939f
Instruction Fuzzy Hash: EC01AC75641308FFE610AB65EC4DF573B6CEB89711F014421FA05EB1A2CA71D8049A20

Function 00E29A72 Relevance: 12.5, APIs: 6, Strings: 1, Instructions: 242COMMON

Download Yara Rule

APIs

Part of subcall function 00E07652: CLSIDFromProgID.OLE32(?,?,00000000,?,00000000,?,?,-C0000018,00000001,?,00E0758C,80070057,?,?,?,00E0799D), ref: 00E0766F
Part of subcall function 00E07652: ProgIDFromCLSID.OLE32(?,00000000,?,?,00000000,?,00000000,?,?,-C0000018,00000001,?,00E0758C,80070057,?,?), ref: 00E0768A
Part of subcall function 00E07652: lstrcmpiW.KERNEL32(?,00000000,?,?,00000000,?,00000000,?,?,-C0000018,00000001,?,00E0758C,80070057,?,?), ref: 00E07698
Part of subcall function 00E07652: CoTaskMemFree.OLE32(00000000,?,00000000,?,?,00000000,?,00000000,?,?,-C0000018,00000001,?,00E0758C,80070057,?), ref: 00E076A8

CoInitializeSecurity.OLE32(00000000,000000FF,00000000,00000000,00000002,00000003,00000000,00000000,00000000,?,?,?), ref: 00E29B1B
_memset.LIBCMT ref: 00E29B28
_memset.LIBCMT ref: 00E29C6B
CoCreateInstanceEx.OLE32(?,00000000,00000015,?,00000001,00000000), ref: 00E29C97
CoTaskMemFree.OLE32(?), ref: 00E29CA2

Strings

NULL Pointer assignment, xrefs: 00E29CF0

Memory Dump Source

Source File: 00000000.00000002.2103545536.0000000000DB1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00DB0000, based on PE: true

Associated: 00000000.00000002.2103534640.0000000000DB0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103580373.0000000000E3F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103580373.0000000000E65000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103609603.0000000000E6F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103621893.0000000000E78000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_db0000_New Quotation - FE7191PO154.jbxd

Similarity

API ID: FreeFromProgTask_memset$CreateInitializeInstanceSecuritylstrcmpi
String ID: NULL Pointer assignment
API String ID: 1300414916-2785691316
Opcode ID: cdfffe1111f191c394b1aaa23ab75de4fba3dc4fba7a4e4662669653d5242113
Instruction ID: 2309f105b874dc5c977226efce21c872b22d0c7c03fb409a347cc54cde0b4cfb
Opcode Fuzzy Hash: cdfffe1111f191c394b1aaa23ab75de4fba3dc4fba7a4e4662669653d5242113
Instruction Fuzzy Hash: 8B912871D00229EBDB10DFA5EC85ADEBBB8EF08710F20515AF519B7281DB716A44CFA0

Function 00E36FEF Relevance: 12.4, APIs: 6, Strings: 1, Instructions: 143windowCOMMON

Download Yara Rule

APIs

SendMessageW.USER32(00000000,00001036,00000010,00000010), ref: 00E37093
SendMessageW.USER32(?,00001036,00000000,?), ref: 00E370A7
SetWindowPos.USER32(?,00000000,00000000,00000000,00000000,00000000,00000013), ref: 00E370C1
_wcscat.LIBCMT ref: 00E3711C
SendMessageW.USER32(?,00001057,00000000,?), ref: 00E37133
SendMessageW.USER32(?,00001061,?,0000000F), ref: 00E37161

Strings

SysListView32, xrefs: 00E37065

Memory Dump Source

Source File: 00000000.00000002.2103545536.0000000000DB1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00DB0000, based on PE: true

Associated: 00000000.00000002.2103534640.0000000000DB0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103580373.0000000000E3F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103580373.0000000000E65000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103609603.0000000000E6F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103621893.0000000000E78000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_db0000_New Quotation - FE7191PO154.jbxd

Similarity

API ID: MessageSend$Window_wcscat
String ID: SysListView32
API String ID: 307300125-78025650
Opcode ID: fe3a2258f8d748fe1a12997d795f423fc3016c2e7da6ef416e4f306da0a46b7a
Instruction ID: 54cec7f574509844df012aa0a95f397c6443b73b2e3514063a417bb1551c220d
Opcode Fuzzy Hash: fe3a2258f8d748fe1a12997d795f423fc3016c2e7da6ef416e4f306da0a46b7a
Instruction Fuzzy Hash: 7B418271A04308AFDB259F64CC89BEE7BE8EF08354F10156AF584B7191D6719D84CB60

Function 00E2EC47 Relevance: 12.4, APIs: 6, Strings: 1, Instructions: 136COMMON

Download Yara Rule

APIs

Part of subcall function 00E13E91: CreateToolhelp32Snapshot.KERNEL32 ref: 00E13EB6
Part of subcall function 00E13E91: Process32FirstW.KERNEL32(00000000,?), ref: 00E13EC4
Part of subcall function 00E13E91: CloseHandle.KERNEL32(00000000), ref: 00E13F8E

OpenProcess.KERNEL32(00000001,00000000,?), ref: 00E2ECB8
GetLastError.KERNEL32 ref: 00E2ECCB
OpenProcess.KERNEL32(00000001,00000000,?), ref: 00E2ECFA
TerminateProcess.KERNEL32(00000000,00000000), ref: 00E2ED77
GetLastError.KERNEL32(00000000), ref: 00E2ED82
CloseHandle.KERNEL32(00000000), ref: 00E2EDB7

Strings

SeDebugPrivilege, xrefs: 00E2ECD6

Memory Dump Source

Source File: 00000000.00000002.2103545536.0000000000DB1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00DB0000, based on PE: true

Associated: 00000000.00000002.2103534640.0000000000DB0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103580373.0000000000E3F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103580373.0000000000E65000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103609603.0000000000E6F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103621893.0000000000E78000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_db0000_New Quotation - FE7191PO154.jbxd

Similarity

API ID: Process$CloseErrorHandleLastOpen$CreateFirstProcess32SnapshotTerminateToolhelp32
String ID: SeDebugPrivilege
API String ID: 2533919879-2896544425
Opcode ID: db2a20d8c9df0f8866679ff7f616120ce68021786740ff69144ad7aeb04d7891
Instruction ID: 4522f079f5eea854ba12613aabf48cca39bbaa38251a6c61889417d18651d851
Opcode Fuzzy Hash: db2a20d8c9df0f8866679ff7f616120ce68021786740ff69144ad7aeb04d7891
Instruction Fuzzy Hash: 8341BF716002219FDB14EF24DC95FAEB7A1EF40714F08845DF946AB3D2DB75A848CBA2

Function 00E13226 Relevance: 12.3, APIs: 2, Strings: 5, Instructions: 82windowCOMMON

Download Yara Rule

APIs

LoadIconW.USER32(00000000,00007F03), ref: 00E132C5

Strings

question, xrefs: 00E1327E
warning, xrefs: 00E132AE
stop, xrefs: 00E13296
info, xrefs: 00E13266
blank, xrefs: 00E13247

Memory Dump Source

Source File: 00000000.00000002.2103545536.0000000000DB1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00DB0000, based on PE: true

Associated: 00000000.00000002.2103534640.0000000000DB0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103580373.0000000000E3F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103580373.0000000000E65000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103609603.0000000000E6F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103621893.0000000000E78000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_db0000_New Quotation - FE7191PO154.jbxd

Similarity

API ID: IconLoad
String ID: blank$info$question$stop$warning
API String ID: 2457776203-404129466
Opcode ID: 1747d0742f818442a3d9ae8295185a715a0ba63c26469a807adc3c66860a1016
Instruction ID: fb4e5d893253b8b981f856318e65a83bb03a3ada90bdf0140cf4d263e81994e9
Opcode Fuzzy Hash: 1747d0742f818442a3d9ae8295185a715a0ba63c26469a807adc3c66860a1016
Instruction Fuzzy Hash: 74112B316493477BA7056B65EC42CEAB79CDF19374F20103BF500B6291D6725F8089B5

Function 00E14534 Relevance: 12.3, APIs: 6, Strings: 1, Instructions: 47windowCOMMON

Download Yara Rule

APIs

GetModuleHandleW.KERNEL32(00000000,?,?,00000100,00000000), ref: 00E1454E
LoadStringW.USER32(00000000), ref: 00E14555
GetModuleHandleW.KERNEL32(00000000,00001389,?,00000100), ref: 00E1456B
LoadStringW.USER32(00000000), ref: 00E14572
_wprintf.LIBCMT ref: 00E14598
MessageBoxW.USER32(00000000,?,?,00011010), ref: 00E145B6

Strings

%s (%d) : ==> %s: %s %s, xrefs: 00E14593

Memory Dump Source

Source File: 00000000.00000002.2103545536.0000000000DB1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00DB0000, based on PE: true

Associated: 00000000.00000002.2103534640.0000000000DB0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103580373.0000000000E3F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103580373.0000000000E65000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103609603.0000000000E6F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103621893.0000000000E78000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_db0000_New Quotation - FE7191PO154.jbxd

Similarity

API ID: HandleLoadModuleString$Message_wprintf
String ID: %s (%d) : ==> %s: %s %s
API String ID: 3648134473-3128320259
Opcode ID: 5440f1ce22b0115dc875190d53e9eb8acdbaacd7d7e6d6b71492ef12ad504220
Instruction ID: 8a17fed872f4cb1552118793af0491fd4382405109f91e9c46218d7edb9fbec6
Opcode Fuzzy Hash: 5440f1ce22b0115dc875190d53e9eb8acdbaacd7d7e6d6b71492ef12ad504220
Instruction Fuzzy Hash: 91014FF290020CBFE750A7A59D8EEE67B6CE708301F0005A5FB45F2152EA749E898B71

Function 00E3D74C Relevance: 12.3, APIs: 8, Instructions: 257windowCOMMON

Download Yara Rule

APIs

Part of subcall function 00DB2612: GetWindowLongW.USER32(?,000000EB), ref: 00DB2623

GetSystemMetrics.USER32(0000000F), ref: 00E3D78A
GetSystemMetrics.USER32(0000000F), ref: 00E3D7AA
MoveWindow.USER32(00000003,?,?,?,?,00000000,?,?,?), ref: 00E3D9E5
SendMessageW.USER32(00000003,00000142,00000000,0000FFFF), ref: 00E3DA03
SendMessageW.USER32(00000003,00000469,?,00000000), ref: 00E3DA24
ShowWindow.USER32(00000003,00000000), ref: 00E3DA43
InvalidateRect.USER32(?,00000000,00000001), ref: 00E3DA68
DefDlgProcW.USER32(?,00000005,?,?), ref: 00E3DA8B

Memory Dump Source

Source File: 00000000.00000002.2103545536.0000000000DB1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00DB0000, based on PE: true

Associated: 00000000.00000002.2103534640.0000000000DB0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103580373.0000000000E3F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103580373.0000000000E65000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103609603.0000000000E6F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103621893.0000000000E78000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_db0000_New Quotation - FE7191PO154.jbxd

Similarity

API ID: Window$MessageMetricsSendSystem$InvalidateLongMoveProcRectShow
String ID:
API String ID: 1211466189-0
Opcode ID: 60229af3d4c11b1f7df4b24a108543f9ef6ea4f5dd77c9bcb0f20c6f950d717c
Instruction ID: 75810c1782b6a7eece3d2c537b7686c1a5fb7aefc6d4566c6575789c3520176b
Opcode Fuzzy Hash: 60229af3d4c11b1f7df4b24a108543f9ef6ea4f5dd77c9bcb0f20c6f950d717c
Instruction Fuzzy Hash: 66B1DA31A08219EFDF18CF69DA897BD7BB1FF44705F089069EC48AB295D730A954CB90

Function 00DB2A5B Relevance: 12.1, APIs: 8, Instructions: 129COMMON

Download Yara Rule

APIs

ShowWindow.USER32(FFFFFFFF,?,00000000,00000000,?,00DEC417,00000004,00000000,00000000,00000000), ref: 00DB2ACF
ShowWindow.USER32(FFFFFFFF,00000000,00000000,00000000,?,00DEC417,00000004,00000000,00000000,00000000,000000FF), ref: 00DB2B17
ShowWindow.USER32(FFFFFFFF,00000006,00000000,00000000,?,00DEC417,00000004,00000000,00000000,00000000), ref: 00DEC46A
ShowWindow.USER32(FFFFFFFF,?,00000000,00000000,?,00DEC417,00000004,00000000,00000000,00000000), ref: 00DEC4D6

Memory Dump Source

Source File: 00000000.00000002.2103545536.0000000000DB1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00DB0000, based on PE: true

Associated: 00000000.00000002.2103534640.0000000000DB0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103580373.0000000000E3F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103580373.0000000000E65000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103609603.0000000000E6F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103621893.0000000000E78000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_db0000_New Quotation - FE7191PO154.jbxd

Similarity

API ID: ShowWindow
String ID:
API String ID: 1268545403-0
Opcode ID: 712d5f593d48a1881d24e4db5c772e369074081b1bf9262fadd425a0e6e03e26
Instruction ID: b03d4dd51d1b1807d3c082e664eef70d780c0ca2766919815d332964c2d37bd6
Opcode Fuzzy Hash: 712d5f593d48a1881d24e4db5c772e369074081b1bf9262fadd425a0e6e03e26
Instruction Fuzzy Hash: BA412C336146C0DED739AB2A8C9CBFB7BA1AB85314F6C841DE087965A0C635E846D731

Function 00E17368 Relevance: 12.1, APIs: 8, Instructions: 101fileCOMMON

Download Yara Rule

APIs

InterlockedExchange.KERNEL32(?,000001F5), ref: 00E1737F

Part of subcall function 00DD0FF6: std::exception::exception.LIBCMT ref: 00DD102C
Part of subcall function 00DD0FF6: __CxxThrowException@8.LIBCMT ref: 00DD1041

ReadFile.KERNEL32(0000FFFF,00000000,0000FFFF,?,00000000), ref: 00E173B6
EnterCriticalSection.KERNEL32(?), ref: 00E173D2
_memmove.LIBCMT ref: 00E17420
_memmove.LIBCMT ref: 00E1743D
LeaveCriticalSection.KERNEL32(?), ref: 00E1744C
ReadFile.KERNEL32(0000FFFF,00000000,0000FFFF,00000000,00000000), ref: 00E17461
InterlockedExchange.KERNEL32(?,000001F6), ref: 00E17480

Memory Dump Source

Source File: 00000000.00000002.2103545536.0000000000DB1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00DB0000, based on PE: true

Associated: 00000000.00000002.2103534640.0000000000DB0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103580373.0000000000E3F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103580373.0000000000E65000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103609603.0000000000E6F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103621893.0000000000E78000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_db0000_New Quotation - FE7191PO154.jbxd

Similarity

API ID: CriticalExchangeFileInterlockedReadSection_memmove$EnterException@8LeaveThrowstd::exception::exception
String ID:
API String ID: 256516436-0
Opcode ID: 28c82821717fb92bce4fbf714cb5a18681135972da74de12361d5d88b23565df
Instruction ID: e6d78b2bfca3d33c63f0ad441573e15737c392afc477918c4d7070afc8097afa
Opcode Fuzzy Hash: 28c82821717fb92bce4fbf714cb5a18681135972da74de12361d5d88b23565df
Instruction Fuzzy Hash: AB317035904205EFCF10EFA5DC89AAF7B78EF44710F1441A6F904AB256DB709A58CBB0

Function 00E36442 Relevance: 12.1, APIs: 8, Instructions: 95windowCOMMON

Download Yara Rule

APIs

DeleteObject.GDI32(00000000), ref: 00E3645A
GetDC.USER32(00000000), ref: 00E36462
GetDeviceCaps.GDI32(00000000,0000005A), ref: 00E3646D
ReleaseDC.USER32(00000000,00000000), ref: 00E36479
CreateFontW.GDI32(?,00000000,00000000,00000000,?,00000000,00000000,00000000,00000001,00000004,00000000,?,00000000,?), ref: 00E364B5
SendMessageW.USER32(?,00000030,00000000,00000001), ref: 00E364C6
MoveWindow.USER32(?,?,?,?,?,00000000,?,?,00E39299,?,?,000000FF,00000000,?,000000FF,?), ref: 00E36500
SendMessageW.USER32(?,00000142,00000000,00000000), ref: 00E36520

Memory Dump Source

Source File: 00000000.00000002.2103545536.0000000000DB1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00DB0000, based on PE: true

Associated: 00000000.00000002.2103534640.0000000000DB0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103580373.0000000000E3F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103580373.0000000000E65000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103609603.0000000000E6F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103621893.0000000000E78000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_db0000_New Quotation - FE7191PO154.jbxd

Similarity

API ID: MessageSend$CapsCreateDeleteDeviceFontMoveObjectReleaseWindow
String ID:
API String ID: 3864802216-0
Opcode ID: 504d0cf2897c248332552bd837b57b434aee47052754393674170371928a0897
Instruction ID: 39dec4447ce1a7dfe159b8da1349cebd60c0e67759931b856d3a07881c3451cb
Opcode Fuzzy Hash: 504d0cf2897c248332552bd837b57b434aee47052754393674170371928a0897
Instruction Fuzzy Hash: 6B319F72601214BFEF108F61CC8AFEA3FA9EF09765F044065FE08AA191C7759C41CBA0

Function 00E0C072 Relevance: 12.1, APIs: 8, Instructions: 92COMMON

Download Yara Rule

APIs

_memcmp.LIBCMT ref: 00E0C087
_memcmp.LIBCMT ref: 00E0C0A9
_memcmp.LIBCMT ref: 00E0C0C1
_memcmp.LIBCMT ref: 00E0C0D4
_memcmp.LIBCMT ref: 00E0C0EE
_memcmp.LIBCMT ref: 00E0C101
_memcmp.LIBCMT ref: 00E0C119
_memcmp.LIBCMT ref: 00E0C134

Memory Dump Source

Source File: 00000000.00000002.2103545536.0000000000DB1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00DB0000, based on PE: true

Associated: 00000000.00000002.2103534640.0000000000DB0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103580373.0000000000E3F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103580373.0000000000E65000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103609603.0000000000E6F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103621893.0000000000E78000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_db0000_New Quotation - FE7191PO154.jbxd

Similarity

API ID: _memcmp
String ID:
API String ID: 2931989736-0
Opcode ID: d748690875740b1d105ec5dde31389119aa13b805db55b0e9378a6a30a28f3c7
Instruction ID: 292f1ec54ca908c301eedc1ae724337f75ab4d40d854321f73336197877fb64e
Opcode Fuzzy Hash: d748690875740b1d105ec5dde31389119aa13b805db55b0e9378a6a30a28f3c7
Instruction Fuzzy Hash: B821C275A01205BBD210BB219C42FAB27ADEF20398B682125FE05B63C3E751DE51C1B6

Function 00E1ED8E Relevance: 10.8, APIs: 5, Strings: 1, Instructions: 323COMMON

Download Yara Rule

APIs

Part of subcall function 00DB9997: __itow.LIBCMT ref: 00DB99C2
Part of subcall function 00DB9997: __swprintf.LIBCMT ref: 00DB9A0C

Part of subcall function 00DCFEC6: _wcscpy.LIBCMT ref: 00DCFEE9

_wcstok.LIBCMT ref: 00E1EEFF
_wcscpy.LIBCMT ref: 00E1EF8E
_memset.LIBCMT ref: 00E1EFC1

Strings

X, xrefs: 00E1EFFE

Memory Dump Source

Source File: 00000000.00000002.2103545536.0000000000DB1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00DB0000, based on PE: true

Associated: 00000000.00000002.2103534640.0000000000DB0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103580373.0000000000E3F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103580373.0000000000E65000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103609603.0000000000E6F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103621893.0000000000E78000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_db0000_New Quotation - FE7191PO154.jbxd

Similarity

API ID: _wcscpy$__itow__swprintf_memset_wcstok
String ID: X
API String ID: 774024439-3081909835
Opcode ID: 54a7573374c963c2d9af1636f3a11e2853b15764e2f633f5481125305ce37aff
Instruction ID: ab05049abbad9fdd088cf41e59b0cc940e3ae0cd98616fdbbcb6ad35e59a6e3b
Opcode Fuzzy Hash: 54a7573374c963c2d9af1636f3a11e2853b15764e2f633f5481125305ce37aff
Instruction Fuzzy Hash: 5FC17171608340DFC714EF24D895A9AB7E4FF84314F00492DF89AA72A2DB30ED45CBA2

Function 00E26E17 Relevance: 10.8, APIs: 7, Instructions: 250networkCOMMON

Download Yara Rule

APIs

__WSAFDIsSet.WSOCK32(00000000,?,00000000,00000000,?,00000064,00000000), ref: 00E26F14
#17.WSOCK32(00000000,?,?,00000000,?,00000010), ref: 00E26F35
WSAGetLastError.WSOCK32(00000000), ref: 00E26F48
htons.WSOCK32(?,?,?,00000000,?), ref: 00E26FFE
inet_ntoa.WSOCK32(?), ref: 00E26FBB

Part of subcall function 00E0AE14: _strlen.LIBCMT ref: 00E0AE1E
Part of subcall function 00E0AE14: _memmove.LIBCMT ref: 00E0AE40

_strlen.LIBCMT ref: 00E27058
_memmove.LIBCMT ref: 00E270C1

Memory Dump Source

Source File: 00000000.00000002.2103545536.0000000000DB1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00DB0000, based on PE: true

Associated: 00000000.00000002.2103534640.0000000000DB0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103580373.0000000000E3F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103580373.0000000000E65000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103609603.0000000000E6F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103621893.0000000000E78000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_db0000_New Quotation - FE7191PO154.jbxd

Similarity

API ID: _memmove_strlen$ErrorLasthtonsinet_ntoa
String ID:
API String ID: 3619996494-0
Opcode ID: 8052f9c6a2d55faf49f75fc43aba4663c3cfcf8b049a13164721fdd16dc7cb1b
Instruction ID: 8d4bb59d76d161a58e161038864df2a6cd6bc9bd0443ece6b1d07ef1bab6b9e9
Opcode Fuzzy Hash: 8052f9c6a2d55faf49f75fc43aba4663c3cfcf8b049a13164721fdd16dc7cb1b
Instruction Fuzzy Hash: 3681E171508310EBC710EF24DC95FABB7E8EF84718F105A1DF556AB2A2DA70AD04C7A2

Function 00DB1424 Relevance: 10.7, APIs: 7, Instructions: 219COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2103545536.0000000000DB1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00DB0000, based on PE: true

Associated: 00000000.00000002.2103534640.0000000000DB0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103580373.0000000000E3F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103580373.0000000000E65000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103609603.0000000000E6F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103621893.0000000000E78000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_db0000_New Quotation - FE7191PO154.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f0a11176c723096773e3a6828a863a3f942704f8b9f183bfe894f9f19457db35
Instruction ID: 39397a64dcac748fb692887708eab101b4660acb17adb2514ca594800e08e892
Opcode Fuzzy Hash: f0a11176c723096773e3a6828a863a3f942704f8b9f183bfe894f9f19457db35
Instruction Fuzzy Hash: 30715734900109EFCB149F99CC99AEFBBB9FF85320F548159E916AA251C730AA51CFB4

Function 00E3B60B Relevance: 10.7, APIs: 7, Instructions: 199windowCOMMON

Download Yara Rule

APIs

IsWindow.USER32(00FC4B58), ref: 00E3B6A5
IsWindowEnabled.USER32(00FC4B58), ref: 00E3B6B1
SendMessageW.USER32(?,0000041C,00000000,00000000), ref: 00E3B795
SendMessageW.USER32(00FC4B58,000000B0,?,?), ref: 00E3B7CC
IsDlgButtonChecked.USER32(?,?), ref: 00E3B809
GetWindowLongW.USER32(00FC4B58,000000EC), ref: 00E3B82B
SendMessageW.USER32(?,000000A1,00000002,00000000), ref: 00E3B843

Memory Dump Source

Source File: 00000000.00000002.2103545536.0000000000DB1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00DB0000, based on PE: true

Associated: 00000000.00000002.2103534640.0000000000DB0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103580373.0000000000E3F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103580373.0000000000E65000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103609603.0000000000E6F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103621893.0000000000E78000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_db0000_New Quotation - FE7191PO154.jbxd

Similarity

API ID: MessageSendWindow$ButtonCheckedEnabledLong
String ID:
API String ID: 4072528602-0
Opcode ID: fad6c89547e6db12909655c793c5d1be80f7f13dee3146e36b7fd7cf3a920add
Instruction ID: 2e5a7a1478b494dfb9dd44ea13f10c736f37e9ffe237256b295c6c0e417f2400
Opcode Fuzzy Hash: fad6c89547e6db12909655c793c5d1be80f7f13dee3146e36b7fd7cf3a920add
Instruction Fuzzy Hash: 8071A034A00204AFDB24DF65C89AFBA7FB9EF89304F14515AEA47B7262C731A945CB50

Function 00E2F732 Relevance: 10.7, APIs: 5, Strings: 1, Instructions: 177COMMON

Download Yara Rule

APIs

_memset.LIBCMT ref: 00E2F75C
_memset.LIBCMT ref: 00E2F825
ShellExecuteExW.SHELL32(?), ref: 00E2F86A

Part of subcall function 00DB9997: __itow.LIBCMT ref: 00DB99C2
Part of subcall function 00DB9997: __swprintf.LIBCMT ref: 00DB9A0C

Part of subcall function 00DCFEC6: _wcscpy.LIBCMT ref: 00DCFEE9

GetProcessId.KERNEL32(00000000), ref: 00E2F8E1
CloseHandle.KERNEL32(00000000), ref: 00E2F910

Strings

@, xrefs: 00E2F839

Memory Dump Source

Source File: 00000000.00000002.2103545536.0000000000DB1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00DB0000, based on PE: true

Associated: 00000000.00000002.2103534640.0000000000DB0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103580373.0000000000E3F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103580373.0000000000E65000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103609603.0000000000E6F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103621893.0000000000E78000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_db0000_New Quotation - FE7191PO154.jbxd

Similarity

API ID: _memset$CloseExecuteHandleProcessShell__itow__swprintf_wcscpy
String ID: @
API String ID: 3522835683-2766056989
Opcode ID: 1a4263cd6cc599bdf564f1edeedc112144c66a0a3a2d8d29eb0a3de07d947a9d
Instruction ID: d0f9071c3b726b5b971f88325397cf333e358e3ccbeb45d27110184006c807ce
Opcode Fuzzy Hash: 1a4263cd6cc599bdf564f1edeedc112144c66a0a3a2d8d29eb0a3de07d947a9d
Instruction Fuzzy Hash: 44616B75A00629DFCF18EF64D591AAEFBB5FF48310B148469E856BB351CB30AD40CBA0

Function 00E1145D Relevance: 10.7, APIs: 7, Instructions: 166windowCOMMON

Download Yara Rule

APIs

GetParent.USER32(?), ref: 00E1149C
GetKeyboardState.USER32(?), ref: 00E114B1
SetKeyboardState.USER32(?), ref: 00E11512
PostMessageW.USER32(?,00000101,00000010,?), ref: 00E11540
PostMessageW.USER32(?,00000101,00000011,?), ref: 00E1155F
PostMessageW.USER32(?,00000101,00000012,?), ref: 00E115A5
PostMessageW.USER32(?,00000101,0000005B,?), ref: 00E115C8

Memory Dump Source

Source File: 00000000.00000002.2103545536.0000000000DB1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00DB0000, based on PE: true

Associated: 00000000.00000002.2103534640.0000000000DB0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103580373.0000000000E3F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103580373.0000000000E65000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103609603.0000000000E6F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103621893.0000000000E78000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_db0000_New Quotation - FE7191PO154.jbxd

Similarity

API ID: MessagePost$KeyboardState$Parent
String ID:
API String ID: 87235514-0
Opcode ID: 271dfeaa3bd70abd63366499f32f7d79ca76590abdd27367aa31f8d5bd49072a
Instruction ID: d9bb7cb1995b13e75044b7b85bb2824a90fc9332030c83c237dadd5dc84f72e9
Opcode Fuzzy Hash: 271dfeaa3bd70abd63366499f32f7d79ca76590abdd27367aa31f8d5bd49072a
Instruction Fuzzy Hash: A751E2B0A047D53EFB3246748C45BFABEAA5B46308F0894C9E2D6668D2D2D9ECC4D750

Function 00E11276 Relevance: 10.7, APIs: 7, Instructions: 165windowCOMMON

Download Yara Rule

APIs

GetParent.USER32(00000000), ref: 00E112B5
GetKeyboardState.USER32(?), ref: 00E112CA
SetKeyboardState.USER32(?), ref: 00E1132B
PostMessageW.USER32(00000000,00000100,00000010,?), ref: 00E11357
PostMessageW.USER32(00000000,00000100,00000011,?), ref: 00E11374
PostMessageW.USER32(00000000,00000100,00000012,?), ref: 00E113B8
PostMessageW.USER32(00000000,00000100,0000005B,?), ref: 00E113D9

Memory Dump Source

Source File: 00000000.00000002.2103545536.0000000000DB1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00DB0000, based on PE: true

Associated: 00000000.00000002.2103534640.0000000000DB0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103580373.0000000000E3F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103580373.0000000000E65000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103609603.0000000000E6F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103621893.0000000000E78000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_db0000_New Quotation - FE7191PO154.jbxd

Similarity

API ID: MessagePost$KeyboardState$Parent
String ID:
API String ID: 87235514-0
Opcode ID: d9824bb11df12efb8dbb2a0d5cac8725af866921dc307ac53850c17ebe28a9e5
Instruction ID: 691b7972d8c9802f11a9ad89c2dcb130e453b7becbae140e6a5c89833d0ca41c
Opcode Fuzzy Hash: d9824bb11df12efb8dbb2a0d5cac8725af866921dc307ac53850c17ebe28a9e5
Instruction Fuzzy Hash: D751E3B09047D53DFB3282248C45BFABFA96B06308F0895C9E2E566CC2D394ACD8E751

Function 00E1589F Relevance: 10.6, APIs: 7, Instructions: 138timeCOMMON

Download Yara Rule

APIs

GetLocalTime.KERNEL32 ref: 00E158AC
_wcsncpy.LIBCMT ref: 00E158E1
_wcsncpy.LIBCMT ref: 00E15913
_wcsncpy.LIBCMT ref: 00E15946
_wcsncpy.LIBCMT ref: 00E15988
_wcsncpy.LIBCMT ref: 00E159C2
_wcsncpy.LIBCMT ref: 00E159F1

Memory Dump Source

Source File: 00000000.00000002.2103545536.0000000000DB1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00DB0000, based on PE: true

Associated: 00000000.00000002.2103534640.0000000000DB0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103580373.0000000000E3F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103580373.0000000000E65000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103609603.0000000000E6F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103621893.0000000000E78000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_db0000_New Quotation - FE7191PO154.jbxd

Similarity

API ID: _wcsncpy$LocalTime
String ID:
API String ID: 2945705084-0
Opcode ID: 8e6225d4cbde9644a719c1a20847fd78802a7c3c0b4e7712f17347dbee4809af
Instruction ID: c3653e9b06093965066238f6a43e3d199d980f09b333f7326587ada50d41b204
Opcode Fuzzy Hash: 8e6225d4cbde9644a719c1a20847fd78802a7c3c0b4e7712f17347dbee4809af
Instruction Fuzzy Hash: 804180B6C20518B6CB10EBB48C869CFB7A8DF44310F509967F918E3221E634E754C7BA

Function 00E0DA5D Relevance: 10.6, APIs: 4, Strings: 2, Instructions: 121comlibraryloaderCOMMON

Download Yara Rule

APIs

CoCreateInstance.OLE32(?,00000000,00000005,?,?,?,?,?,?,?,?,?,?,?), ref: 00E0DAC5
SetErrorMode.KERNEL32(00000001,?,?,?,?,?,?,?,?,?), ref: 00E0DAFB
GetProcAddress.KERNEL32(?,DllGetClassObject), ref: 00E0DB0C
SetErrorMode.KERNEL32(00000000,?,?,?,?,?,?,?,?,?), ref: 00E0DB8E

Strings

DllGetClassObject, xrefs: 00E0DB01
,,, xrefs: 00E0DA69

Memory Dump Source

Source File: 00000000.00000002.2103545536.0000000000DB1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00DB0000, based on PE: true

Associated: 00000000.00000002.2103534640.0000000000DB0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103580373.0000000000E3F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103580373.0000000000E65000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103609603.0000000000E6F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103621893.0000000000E78000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_db0000_New Quotation - FE7191PO154.jbxd

Similarity

API ID: ErrorMode$AddressCreateInstanceProc
String ID: ,,$DllGetClassObject
API String ID: 753597075-2867008933
Opcode ID: e93830f658c6f4fab8ea6b03fcd8dab63c7a552ccf2d60e639d4d0ff9f987647
Instruction ID: ba355c5c93e804696880d558324e01f64d973f4af592a7add984aba8029dcabd
Opcode Fuzzy Hash: e93830f658c6f4fab8ea6b03fcd8dab63c7a552ccf2d60e639d4d0ff9f987647
Instruction Fuzzy Hash: 91418EB1604208EFDB15CF95CC84A9ABBB9EF44350F1590A9ED05AF286D7B1DD84CFA0

Function 00E138AD Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 111filestringCOMMON

Download Yara Rule

APIs

Part of subcall function 00E148AA: GetFullPathNameW.KERNEL32(00000000,00007FFF,?,?,?,?,?,?,00E138D3,?), ref: 00E148C7

Part of subcall function 00E148AA: GetFullPathNameW.KERNEL32(?,00007FFF,?,?,?,?,?,00E138D3,?), ref: 00E148E0

lstrcmpiW.KERNEL32(?,?), ref: 00E138F3
_wcscmp.LIBCMT ref: 00E1390F
MoveFileW.KERNEL32(?,?), ref: 00E13927
_wcscat.LIBCMT ref: 00E1396F
SHFileOperationW.SHELL32(?), ref: 00E139DB

Strings

\*.*, xrefs: 00E13969

Memory Dump Source

Source File: 00000000.00000002.2103545536.0000000000DB1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00DB0000, based on PE: true

Associated: 00000000.00000002.2103534640.0000000000DB0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103580373.0000000000E3F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103580373.0000000000E65000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103609603.0000000000E6F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103621893.0000000000E78000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_db0000_New Quotation - FE7191PO154.jbxd

Similarity

API ID: FileFullNamePath$MoveOperation_wcscat_wcscmplstrcmpi
String ID: \*.*
API String ID: 1377345388-1173974218
Opcode ID: eee7cef9c5c5984dac5d9f1e509da8d8ed37aebb07aabdf87cd43b03badfa57e
Instruction ID: 96c702e07a2fd6800ae365810051130596c2845d8824ad5f82bb877609f06435
Opcode Fuzzy Hash: eee7cef9c5c5984dac5d9f1e509da8d8ed37aebb07aabdf87cd43b03badfa57e
Instruction Fuzzy Hash: 5E4160B15083849EC751EF74D485AEFB7E8EF88340F14192EF49AE3251EA74D688C762

Function 00E37500 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 103windowCOMMON

Download Yara Rule

APIs

_memset.LIBCMT ref: 00E37519
GetMenuItemInfoW.USER32(?,000000FF,00000000,00000030), ref: 00E375C0
IsMenu.USER32(?), ref: 00E375D8
InsertMenuItemW.USER32(?,?,00000001,00000030), ref: 00E37620
DrawMenuBar.USER32 ref: 00E37633

Strings

0, xrefs: 00E3750D

Memory Dump Source

Source File: 00000000.00000002.2103545536.0000000000DB1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00DB0000, based on PE: true

Associated: 00000000.00000002.2103534640.0000000000DB0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103580373.0000000000E3F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103580373.0000000000E65000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103609603.0000000000E6F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103621893.0000000000E78000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_db0000_New Quotation - FE7191PO154.jbxd

Similarity

API ID: Menu$Item$DrawInfoInsert_memset
String ID: 0
API String ID: 3866635326-4108050209
Opcode ID: c2c52438bdf77fdfd1d99baddcaa2aad6e564d1529c9f1a0a895c938afb9fe3f
Instruction ID: c854f1e782cf462bb8dcdca9a9d8ccc7da3080fc90053df18a60b95a3265acbb
Opcode Fuzzy Hash: c2c52438bdf77fdfd1d99baddcaa2aad6e564d1529c9f1a0a895c938afb9fe3f
Instruction Fuzzy Hash: 394159B5A04608EFDB20CF54D889E9ABBF8FB04318F049029ED55B7261D730AD44CFA0

Function 00E3122D Relevance: 10.6, APIs: 7, Instructions: 101registryCOMMON

Download Yara Rule

APIs

RegEnumKeyExW.ADVAPI32(?,00000000,?,000000FF,00000000,00000000,00000000,?,?,?), ref: 00E3125C
RegOpenKeyExW.ADVAPI32(?,?,00000000,?,?), ref: 00E31286
FreeLibrary.KERNEL32(00000000), ref: 00E3133D

Part of subcall function 00E3122D: RegCloseKey.ADVAPI32(?), ref: 00E312A3
Part of subcall function 00E3122D: FreeLibrary.KERNEL32(?), ref: 00E312F5
Part of subcall function 00E3122D: RegEnumKeyExW.ADVAPI32(?,00000000,?,000000FF,00000000,00000000,00000000,?), ref: 00E31318

RegDeleteKeyW.ADVAPI32(?,?), ref: 00E312E0

Memory Dump Source

Source File: 00000000.00000002.2103545536.0000000000DB1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00DB0000, based on PE: true

Associated: 00000000.00000002.2103534640.0000000000DB0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103580373.0000000000E3F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103580373.0000000000E65000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103609603.0000000000E6F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103621893.0000000000E78000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_db0000_New Quotation - FE7191PO154.jbxd

Similarity

API ID: EnumFreeLibrary$CloseDeleteOpen
String ID:
API String ID: 395352322-0
Opcode ID: e2a7a1c960f18b89b6d039daff8e280577b2f445d1a62f12e3464b045a9b0f00
Instruction ID: 30fd7aaa46a5e38f0d16f98033d32c41d622effeebc57e336ef28b53be118dea
Opcode Fuzzy Hash: e2a7a1c960f18b89b6d039daff8e280577b2f445d1a62f12e3464b045a9b0f00
Instruction Fuzzy Hash: C3312BB1D0111DBFDB149B95EC89AFFBBBCEF08304F0011A9E501F2151EA749E49DAA0

Function 00E3653C Relevance: 10.6, APIs: 7, Instructions: 99windowCOMMON

Download Yara Rule

APIs

SendMessageW.USER32(00000000,000000F0,00000000,00000000), ref: 00E3655B
GetWindowLongW.USER32(00FC4B58,000000F0), ref: 00E3658E
GetWindowLongW.USER32(00FC4B58,000000F0), ref: 00E365C3
SendMessageW.USER32(00000000,000000F1,00000000,00000000), ref: 00E365F5
SendMessageW.USER32(00000000,000000F1,00000001,00000000), ref: 00E3661F
GetWindowLongW.USER32(00000000,000000F0), ref: 00E36630
SetWindowLongW.USER32(00000000,000000F0,00000000), ref: 00E3664A

Memory Dump Source

Source File: 00000000.00000002.2103545536.0000000000DB1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00DB0000, based on PE: true

Associated: 00000000.00000002.2103534640.0000000000DB0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103580373.0000000000E3F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103580373.0000000000E65000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103609603.0000000000E6F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103621893.0000000000E78000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_db0000_New Quotation - FE7191PO154.jbxd

Similarity

API ID: LongWindow$MessageSend
String ID:
API String ID: 2178440468-0
Opcode ID: 2a0d4163c788b3b78ebfe039926888ad32fef7dfe25c5d2972c7c655143fb0e8
Instruction ID: ebe8e7f7c08bb71aef254f5ff07865f39aef61edcd5071b933115f79d457cbf7
Opcode Fuzzy Hash: 2a0d4163c788b3b78ebfe039926888ad32fef7dfe25c5d2972c7c655143fb0e8
Instruction Fuzzy Hash: 80310330604114BFEB21CF2ADC89F553BE1FB4A358F1951A8F505AB2B5CB61AC88DB81

Function 00E26486 Relevance: 10.6, APIs: 7, Instructions: 94networkCOMMON

Download Yara Rule

APIs

Part of subcall function 00E280A0: inet_addr.WSOCK32(00000000,?,00000000,?,?,?,00000000), ref: 00E280CB

socket.WSOCK32(00000002,00000001,00000006,?,?,00000000), ref: 00E264D9
WSAGetLastError.WSOCK32(00000000), ref: 00E264E8
ioctlsocket.WSOCK32(00000000,8004667E,00000000), ref: 00E26521
connect.WSOCK32(00000000,?,00000010), ref: 00E2652A
WSAGetLastError.WSOCK32 ref: 00E26534
closesocket.WSOCK32(00000000), ref: 00E2655D
ioctlsocket.WSOCK32(00000000,8004667E,00000000), ref: 00E26576

Memory Dump Source

Source File: 00000000.00000002.2103545536.0000000000DB1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00DB0000, based on PE: true

Associated: 00000000.00000002.2103534640.0000000000DB0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103580373.0000000000E3F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103580373.0000000000E65000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103609603.0000000000E6F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103621893.0000000000E78000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_db0000_New Quotation - FE7191PO154.jbxd

Similarity

API ID: ErrorLastioctlsocket$closesocketconnectinet_addrsocket
String ID:
API String ID: 910771015-0
Opcode ID: 403b321bb8f46e1f739ac7165a67a1c134c69fe1ac37b70292f00ac1f2085f1c
Instruction ID: c48a0bfc3abcc61c82a70214ca9f1d10a21a93f47a490847d9fd52da814fd35c
Opcode Fuzzy Hash: 403b321bb8f46e1f739ac7165a67a1c134c69fe1ac37b70292f00ac1f2085f1c
Instruction Fuzzy Hash: 4C31B331600128AFDB14AF24DC89FBE7BA8EB44714F004169F946B7291CB74AD48CB61

Function 00E0E0B5 Relevance: 10.6, APIs: 7, Instructions: 90memoryCOMMON

Download Yara Rule

APIs

MultiByteToWideChar.KERNEL32(00000000,00000000,?,000000FF,00000000,00000000), ref: 00E0E0FA
MultiByteToWideChar.KERNEL32(00000000,00000000,?,000000FF,00000000,00000000), ref: 00E0E120
SysAllocString.OLEAUT32(00000000), ref: 00E0E123
SysAllocString.OLEAUT32 ref: 00E0E144
SysFreeString.OLEAUT32 ref: 00E0E14D
StringFromGUID2.OLE32(?,?,00000028), ref: 00E0E167
SysAllocString.OLEAUT32(?), ref: 00E0E175

Memory Dump Source

Source File: 00000000.00000002.2103545536.0000000000DB1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00DB0000, based on PE: true

Associated: 00000000.00000002.2103534640.0000000000DB0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103580373.0000000000E3F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103580373.0000000000E65000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103609603.0000000000E6F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103621893.0000000000E78000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_db0000_New Quotation - FE7191PO154.jbxd

Similarity

API ID: String$Alloc$ByteCharMultiWide$FreeFrom
String ID:
API String ID: 3761583154-0
Opcode ID: 5fadf7a2b235d597fefd4d1b3d29807f927d9e65daef889157800a7c34274be6
Instruction ID: 8d7266a22445dbb05e9967e288924c941217f62a61fe358987e6cd2c9bf44247
Opcode Fuzzy Hash: 5fadf7a2b235d597fefd4d1b3d29807f927d9e65daef889157800a7c34274be6
Instruction Fuzzy Hash: 65218335605108AFDB10AFB9DC88DAB7BECEF09760B108535F955EB3A0DA70DC858B64

Function 00E0FB6E Relevance: 10.6, APIs: 3, Strings: 3, Instructions: 90COMMON

Download Yara Rule

APIs

__wcsnicmp.LIBCMT ref: 00E0FB81
__wcsnicmp.LIBCMT ref: 00E0FBA2
__wcsnicmp.LIBCMT ref: 00E0FBBC

Strings

#OnAutoItStartRegister, xrefs: 00E0FBB6
#requireadmin, xrefs: 00E0FB9C
#notrayicon, xrefs: 00E0FB79

Memory Dump Source

Source File: 00000000.00000002.2103545536.0000000000DB1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00DB0000, based on PE: true

Associated: 00000000.00000002.2103534640.0000000000DB0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103580373.0000000000E3F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103580373.0000000000E65000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103609603.0000000000E6F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103621893.0000000000E78000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_db0000_New Quotation - FE7191PO154.jbxd

Similarity

API ID: __wcsnicmp
String ID: #OnAutoItStartRegister$#notrayicon$#requireadmin
API String ID: 1038674560-2734436370
Opcode ID: 0c04085ae3a94c8e61b03abb69d0e768675a86de6044a0113f323bc3c08b0652
Instruction ID: a9484ee32f1fa741a1a1ff368aed9c44dd8f3d87d43bf13fd81c982cd2c37e2a
Opcode Fuzzy Hash: 0c04085ae3a94c8e61b03abb69d0e768675a86de6044a0113f323bc3c08b0652
Instruction Fuzzy Hash: C2214832204211A6E330F624EC13EE7B398EF51344F10503AF886A65C1EB509DE196B9

Function 00E3783C Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 75windowCOMMON

Download Yara Rule

APIs

Part of subcall function 00DB1D35: CreateWindowExW.USER32(?,?,?,?,?,?,?,?,?,?,00000000,00000096), ref: 00DB1D73
Part of subcall function 00DB1D35: GetStockObject.GDI32(00000011), ref: 00DB1D87
Part of subcall function 00DB1D35: SendMessageW.USER32(00000000,00000030,00000000), ref: 00DB1D91

SendMessageW.USER32(00000000,00002001,00000000,FF000000), ref: 00E378A1
SendMessageW.USER32(?,00000409,00000000,FF000000), ref: 00E378AE
SendMessageW.USER32(?,00000402,00000000,00000000), ref: 00E378B9
SendMessageW.USER32(?,00000401,00000000,00640000), ref: 00E378C8
SendMessageW.USER32(?,00000404,00000001,00000000), ref: 00E378D4

Strings

Msctls_Progress32, xrefs: 00E37872

Memory Dump Source

Source File: 00000000.00000002.2103545536.0000000000DB1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00DB0000, based on PE: true

Associated: 00000000.00000002.2103534640.0000000000DB0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103580373.0000000000E3F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103580373.0000000000E65000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103609603.0000000000E6F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103621893.0000000000E78000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_db0000_New Quotation - FE7191PO154.jbxd

Similarity

API ID: MessageSend$CreateObjectStockWindow
String ID: Msctls_Progress32
API String ID: 1025951953-3636473452
Opcode ID: 118031d6e110029243692cb5589cc86084b1ab0bdd3715f7677e84fafb0c6994
Instruction ID: 30496761b1204f66e3712df19233bdb3a932d0d85fd0583be49f0e1ed2936e43
Opcode Fuzzy Hash: 118031d6e110029243692cb5589cc86084b1ab0bdd3715f7677e84fafb0c6994
Instruction Fuzzy Hash: 561190B2550219BFEF159F60CC89EE77F6DEF08798F015115FA48A2090C772AC21DBA0

Function 00DD41C9 Relevance: 10.5, APIs: 4, Strings: 2, Instructions: 24libraryloaderCOMMONLIBRARYCODE

Download Yara Rule

APIs

LoadLibraryExW.KERNEL32(combase.dll,00000000,00000800,RoInitialize,00DD4292,?), ref: 00DD41E3
GetProcAddress.KERNEL32(00000000), ref: 00DD41EA
EncodePointer.KERNEL32(00000000), ref: 00DD41F6
DecodePointer.KERNEL32(00000001,00DD4292,?), ref: 00DD4213

Strings

combase.dll, xrefs: 00DD41DE
RoInitialize, xrefs: 00DD41D2

Memory Dump Source

Source File: 00000000.00000002.2103545536.0000000000DB1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00DB0000, based on PE: true

Associated: 00000000.00000002.2103534640.0000000000DB0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103580373.0000000000E3F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103580373.0000000000E65000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103609603.0000000000E6F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103621893.0000000000E78000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_db0000_New Quotation - FE7191PO154.jbxd

Similarity

API ID: Pointer$AddressDecodeEncodeLibraryLoadProc
String ID: RoInitialize$combase.dll
API String ID: 3489934621-340411864
Opcode ID: 6b72db4b763becfb8f44c5606bf95539e36107874e81ad1d0d7e8e2eb298b788
Instruction ID: f24ede9da00f0cb9802cc82f02538e3f38dd6fc1f36f93fa8f1983d75283d7ce
Opcode Fuzzy Hash: 6b72db4b763becfb8f44c5606bf95539e36107874e81ad1d0d7e8e2eb298b788
Instruction Fuzzy Hash: E7E0E5B0A91304AFEB20BBB2EC4DB043AA4AB20B02F904428F555F51E0DBB540DD8E10

Function 00DD429E Relevance: 10.5, APIs: 4, Strings: 2, Instructions: 19libraryloaderCOMMONLIBRARYCODE

Download Yara Rule

APIs

LoadLibraryExW.KERNEL32(combase.dll,00000000,00000800,RoUninitialize,00DD41B8), ref: 00DD42B8
GetProcAddress.KERNEL32(00000000), ref: 00DD42BF
EncodePointer.KERNEL32(00000000), ref: 00DD42CA
DecodePointer.KERNEL32(00DD41B8), ref: 00DD42E5

Strings

RoUninitialize, xrefs: 00DD42A7
combase.dll, xrefs: 00DD42B3

Memory Dump Source

Source File: 00000000.00000002.2103545536.0000000000DB1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00DB0000, based on PE: true

Associated: 00000000.00000002.2103534640.0000000000DB0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103580373.0000000000E3F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103580373.0000000000E65000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103609603.0000000000E6F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103621893.0000000000E78000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_db0000_New Quotation - FE7191PO154.jbxd

Similarity

API ID: Pointer$AddressDecodeEncodeLibraryLoadProc
String ID: RoUninitialize$combase.dll
API String ID: 3489934621-2819208100
Opcode ID: df6441423caf998d258be1fbc908ceb1c3c5a2c738adc6dc2891c32a53d3799d
Instruction ID: 16321e724a6597f027f71f5b43904aefd8a234c6a7044cc120f7fa9e485f0934
Opcode Fuzzy Hash: df6441423caf998d258be1fbc908ceb1c3c5a2c738adc6dc2891c32a53d3799d
Instruction Fuzzy Hash: A2E09AB8A82315DFDB10AB62FC0DB053EA4B714746F954039F105F11E0CB7545888A18

Function 00E1675A Relevance: 9.2, APIs: 6, Instructions: 205COMMON

Download Yara Rule

APIs

_memmove.LIBCMT ref: 00E168AD
_memmove.LIBCMT ref: 00E167E8

Part of subcall function 00DB9997: __itow.LIBCMT ref: 00DB99C2
Part of subcall function 00DB9997: __swprintf.LIBCMT ref: 00DB9A0C

_memmove.LIBCMT ref: 00E1685B
_memmove.LIBCMT ref: 00E16942
_memmove.LIBCMT ref: 00E1695B
_memmove.LIBCMT ref: 00E16977

Memory Dump Source

Source File: 00000000.00000002.2103545536.0000000000DB1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00DB0000, based on PE: true

Associated: 00000000.00000002.2103534640.0000000000DB0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103580373.0000000000E3F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103580373.0000000000E65000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103609603.0000000000E6F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103621893.0000000000E78000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_db0000_New Quotation - FE7191PO154.jbxd

Similarity

API ID: _memmove$__itow__swprintf
String ID:
API String ID: 3253778849-0
Opcode ID: 9287289911a43088ddf975d8d22c8efdbbd197f9a859feec895e6f601d9d2497
Instruction ID: 9a904b53d91dfec7ade40341a4ad083348ea6e2d2082387cb3dd6391341b6781
Opcode Fuzzy Hash: 9287289911a43088ddf975d8d22c8efdbbd197f9a859feec895e6f601d9d2497
Instruction Fuzzy Hash: 80618C3050069AEBCF15FF60C892EFE77A8EF44308F044559F95A6B292DB34A985CB70

Function 00E3046F Relevance: 9.2, APIs: 6, Instructions: 167registryCOMMON

Download Yara Rule

APIs

Part of subcall function 00DB7F41: _memmove.LIBCMT ref: 00DB7F82

Part of subcall function 00E310A5: CharUpperBuffW.USER32(?,?,?,?,?,?,?,00E30038,?,?), ref: 00E310BC

RegConnectRegistryW.ADVAPI32(?,?,?), ref: 00E30548
RegOpenKeyExW.ADVAPI32(?,?,00000000,?,?), ref: 00E30588
RegCloseKey.ADVAPI32(?,00000001,00000000), ref: 00E305AB
RegEnumValueW.ADVAPI32(?,-00000001,?,?,00000000,?,00000000,00000000), ref: 00E305D4
RegCloseKey.ADVAPI32(?,?,00000000), ref: 00E30617
RegCloseKey.ADVAPI32(00000000), ref: 00E30624

Memory Dump Source

Source File: 00000000.00000002.2103545536.0000000000DB1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00DB0000, based on PE: true

Associated: 00000000.00000002.2103534640.0000000000DB0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103580373.0000000000E3F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103580373.0000000000E65000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103609603.0000000000E6F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103621893.0000000000E78000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_db0000_New Quotation - FE7191PO154.jbxd

Similarity

API ID: Close$BuffCharConnectEnumOpenRegistryUpperValue_memmove
String ID:
API String ID: 4046560759-0
Opcode ID: 44b743b2c46f57d500c793112efe1cb97c8b3fc7daf6b692d3c2e25f51c2b448
Instruction ID: f5edfb5fe447b48303b0dfdb5d02e1adda341f99e882d97580febad0fc8b8088
Opcode Fuzzy Hash: 44b743b2c46f57d500c793112efe1cb97c8b3fc7daf6b692d3c2e25f51c2b448
Instruction Fuzzy Hash: 89514B31508240AFCB14EF64D899EAEBBE8FF88714F04495DF546A72A1DB31E904CB62

Function 00E35A20 Relevance: 9.2, APIs: 6, Instructions: 160windowCOMMON

Download Yara Rule

APIs

GetMenu.USER32(?), ref: 00E35A82
GetMenuItemCount.USER32(00000000), ref: 00E35AB9
GetMenuStringW.USER32(00000000,00000000,?,00007FFF,00000400), ref: 00E35AE1
GetMenuItemID.USER32(?,?), ref: 00E35B50
GetSubMenu.USER32(?,?), ref: 00E35B5E
PostMessageW.USER32(?,00000111,?,00000000), ref: 00E35BAF

Memory Dump Source

Source File: 00000000.00000002.2103545536.0000000000DB1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00DB0000, based on PE: true

Associated: 00000000.00000002.2103534640.0000000000DB0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103580373.0000000000E3F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103580373.0000000000E65000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103609603.0000000000E6F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103621893.0000000000E78000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_db0000_New Quotation - FE7191PO154.jbxd

Similarity

API ID: Menu$Item$CountMessagePostString
String ID:
API String ID: 650687236-0
Opcode ID: d93eb921b79b2a84fb3670ae34e8847f1f9839bd1b8bf37415baaba84a285440
Instruction ID: 30e7ebf4a03b8c398f4b2aee2274b12a536265f046c148310dd4ada07186b338
Opcode Fuzzy Hash: d93eb921b79b2a84fb3670ae34e8847f1f9839bd1b8bf37415baaba84a285440
Instruction Fuzzy Hash: AC515F36A00619EFCF15EF64C849AEEBBB4EF48310F105459E952B7351CB70AE41DBA0

Function 00E0F3DD Relevance: 9.2, APIs: 6, Instructions: 159COMMON

Download Yara Rule

APIs

VariantInit.OLEAUT32(?), ref: 00E0F3F7
VariantClear.OLEAUT32(00000013), ref: 00E0F469
VariantClear.OLEAUT32(00000000), ref: 00E0F4C4
_memmove.LIBCMT ref: 00E0F4EE
VariantClear.OLEAUT32(?), ref: 00E0F53B
VariantChangeType.OLEAUT32(?,?,00000000,00000013), ref: 00E0F569

Memory Dump Source

Source File: 00000000.00000002.2103545536.0000000000DB1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00DB0000, based on PE: true

Associated: 00000000.00000002.2103534640.0000000000DB0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103580373.0000000000E3F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103580373.0000000000E65000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103609603.0000000000E6F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103621893.0000000000E78000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_db0000_New Quotation - FE7191PO154.jbxd

Similarity

API ID: Variant$Clear$ChangeInitType_memmove
String ID:
API String ID: 1101466143-0
Opcode ID: cd454cfeb54dc898569bcbdc7e4283fa9091a29173aa545e04e14cc2602f3d89
Instruction ID: 93afcba10267e82c1f2e30d4500eebfebe1330c30d7ffb63a965dab02d619661
Opcode Fuzzy Hash: cd454cfeb54dc898569bcbdc7e4283fa9091a29173aa545e04e14cc2602f3d89
Instruction Fuzzy Hash: 69516BB5A00209EFCB24CF58D884AAAB7B8FF4C314B158169ED59EB340D730E955CBA0

Function 00E126F9 Relevance: 9.1, APIs: 6, Instructions: 138windowCOMMON

Download Yara Rule

APIs

_memset.LIBCMT ref: 00E12747
GetMenuItemInfoW.USER32(?,000000FF,00000000,00000030), ref: 00E12792
IsMenu.USER32(00000000), ref: 00E127B2
CreatePopupMenu.USER32 ref: 00E127E6
GetMenuItemCount.USER32(000000FF), ref: 00E12844
InsertMenuItemW.USER32(00000000,?,00000001,00000030), ref: 00E12875

Memory Dump Source

Source File: 00000000.00000002.2103545536.0000000000DB1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00DB0000, based on PE: true

Associated: 00000000.00000002.2103534640.0000000000DB0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103580373.0000000000E3F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103580373.0000000000E65000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103609603.0000000000E6F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103621893.0000000000E78000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_db0000_New Quotation - FE7191PO154.jbxd

Similarity

API ID: Menu$Item$CountCreateInfoInsertPopup_memset
String ID:
API String ID: 3311875123-0
Opcode ID: 035ad38f139e32063f4e32b96a224780d55aea15a6fb6a9d3d7fcd9dae165498
Instruction ID: 74313d7559e80666079acdf060e5706af18e46aed3f8a6be5dedf754d8ebc0de
Opcode Fuzzy Hash: 035ad38f139e32063f4e32b96a224780d55aea15a6fb6a9d3d7fcd9dae165498
Instruction Fuzzy Hash: 19519270900249EFDF29CF68DC88AEEBBF5AF44318F10515DE621BB291D77099A4CB51

Function 00DB1765 Relevance: 9.1, APIs: 6, Instructions: 113COMMON

Download Yara Rule

APIs

Part of subcall function 00DB2612: GetWindowLongW.USER32(?,000000EB), ref: 00DB2623

BeginPaint.USER32(?,?,?,?,?,?), ref: 00DB179A
GetWindowRect.USER32(?,?), ref: 00DB17FE
ScreenToClient.USER32(?,?), ref: 00DB181B
SetViewportOrgEx.GDI32(00000000,?,?,00000000), ref: 00DB182C
EndPaint.USER32(?,?), ref: 00DB1876

Memory Dump Source

Source File: 00000000.00000002.2103545536.0000000000DB1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00DB0000, based on PE: true

Associated: 00000000.00000002.2103534640.0000000000DB0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103580373.0000000000E3F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103580373.0000000000E65000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103609603.0000000000E6F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103621893.0000000000E78000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_db0000_New Quotation - FE7191PO154.jbxd

Similarity

API ID: PaintWindow$BeginClientLongRectScreenViewport
String ID:
API String ID: 1827037458-0
Opcode ID: e517a36ed2142e226eb1c17383cba3dc48edd4f50e4edfd07043ded16125f0c9
Instruction ID: ef08b83b9bb34fc7f019990e0e0bc53d22a7cc112fbf34482fbfb0a3bae03335
Opcode Fuzzy Hash: e517a36ed2142e226eb1c17383cba3dc48edd4f50e4edfd07043ded16125f0c9
Instruction Fuzzy Hash: 0C41BF34500600EFD710DF26DC99FBA7BE8FB45724F140629F599972A1C7319849DB72

Function 00E3B958 Relevance: 9.1, APIs: 6, Instructions: 109windowCOMMON

Download Yara Rule

APIs

ShowWindow.USER32(00E767B0,00000000,00FC4B58,?,?,00E767B0,?,00E3B862,?,?), ref: 00E3B9CC
EnableWindow.USER32(00000000,00000000), ref: 00E3B9F0
ShowWindow.USER32(00E767B0,00000000,00FC4B58,?,?,00E767B0,?,00E3B862,?,?), ref: 00E3BA50
ShowWindow.USER32(00000000,00000004,?,00E3B862,?,?), ref: 00E3BA62
EnableWindow.USER32(00000000,00000001), ref: 00E3BA86
SendMessageW.USER32(?,0000130C,?,00000000), ref: 00E3BAA9

Memory Dump Source

Source File: 00000000.00000002.2103545536.0000000000DB1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00DB0000, based on PE: true

Associated: 00000000.00000002.2103534640.0000000000DB0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103580373.0000000000E3F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103580373.0000000000E65000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103609603.0000000000E6F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103621893.0000000000E78000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_db0000_New Quotation - FE7191PO154.jbxd

Similarity

API ID: Window$Show$Enable$MessageSend
String ID:
API String ID: 642888154-0
Opcode ID: e049fbdee6e2342fc72db1b558f941579b71d299d08b0ad69fc98714d93f7561
Instruction ID: d28946f45c1380056a92d2b24209559e1596e73c6be54b0a77c76b89f442e0d2
Opcode Fuzzy Hash: e049fbdee6e2342fc72db1b558f941579b71d299d08b0ad69fc98714d93f7561
Instruction Fuzzy Hash: 2A415E30600645AFDB22CF25C48DBA57FE0BF45319F1852B9EB5AAF2A2C731E845CB51

Function 00E273B1 Relevance: 9.1, APIs: 6, Instructions: 97COMMON

Download Yara Rule

APIs

GetForegroundWindow.USER32(?,?,?,?,?,?,00E25134,?,?,00000000,00000001), ref: 00E273BF

Part of subcall function 00E23C94: GetWindowRect.USER32(?,?), ref: 00E23CA7

GetDesktopWindow.USER32 ref: 00E273E9
GetWindowRect.USER32(00000000), ref: 00E273F0
mouse_event.USER32(00008001,?,?,00000001,00000001), ref: 00E27422

Part of subcall function 00E154E6: Sleep.KERNEL32(?,00000000,?,?,?,?,?,?,?,?,?,?), ref: 00E1555E

GetCursorPos.USER32(?), ref: 00E2744E
mouse_event.USER32(00008001,?,?,00000000,00000000), ref: 00E274AC

Memory Dump Source

Source File: 00000000.00000002.2103545536.0000000000DB1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00DB0000, based on PE: true

Associated: 00000000.00000002.2103534640.0000000000DB0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103580373.0000000000E3F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103580373.0000000000E65000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103609603.0000000000E6F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103621893.0000000000E78000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_db0000_New Quotation - FE7191PO154.jbxd

Similarity

API ID: Window$Rectmouse_event$CursorDesktopForegroundSleep
String ID:
API String ID: 4137160315-0
Opcode ID: ad8ee566f83dfc7e54c98cb8776c0cf2a1955001311ee45f8059746ae18ef816
Instruction ID: 37884d5cb832c433ad385757d2c90b8a57d5bb7753f4fa280e2680a19570c6e0
Opcode Fuzzy Hash: ad8ee566f83dfc7e54c98cb8776c0cf2a1955001311ee45f8059746ae18ef816
Instruction Fuzzy Hash: F831B272508319AFD720EF54D849E9BBBE9FF88314F10191AF599A7191CA30E948CB92

Function 00E08D5B Relevance: 9.1, APIs: 6, Instructions: 69memoryCOMMON

Download Yara Rule

APIs

Part of subcall function 00E085F1: GetTokenInformation.ADVAPI32(?,00000002,?,00000000,?), ref: 00E08608
Part of subcall function 00E085F1: GetLastError.KERNEL32(?,00000002,?,00000000,?), ref: 00E08612
Part of subcall function 00E085F1: GetProcessHeap.KERNEL32(00000008,?,?,00000002,?,00000000,?), ref: 00E08621
Part of subcall function 00E085F1: HeapAlloc.KERNEL32(00000000,?,00000002,?,00000000,?), ref: 00E08628
Part of subcall function 00E085F1: GetTokenInformation.ADVAPI32(?,00000002,00000000,?,?,?,00000002,?,00000000,?), ref: 00E0863E

GetLengthSid.ADVAPI32(?,00000000,00E08977), ref: 00E08DAC
GetProcessHeap.KERNEL32(00000008,00000000), ref: 00E08DB8
HeapAlloc.KERNEL32(00000000), ref: 00E08DBF
CopySid.ADVAPI32(00000000,00000000,?), ref: 00E08DD8
GetProcessHeap.KERNEL32(00000000,00000000,00E08977), ref: 00E08DEC
HeapFree.KERNEL32(00000000), ref: 00E08DF3

Memory Dump Source

Source File: 00000000.00000002.2103545536.0000000000DB1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00DB0000, based on PE: true

Associated: 00000000.00000002.2103534640.0000000000DB0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103580373.0000000000E3F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103580373.0000000000E65000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103609603.0000000000E6F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103621893.0000000000E78000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_db0000_New Quotation - FE7191PO154.jbxd

Similarity

API ID: Heap$Process$AllocInformationToken$CopyErrorFreeLastLength
String ID:
API String ID: 3008561057-0
Opcode ID: 18bdf9878add844580a546bdd1708331871432847ee56f27ac7b2929f3c7ba84
Instruction ID: e5978af51911a5b32a58c505640867ba15095752d078361992dcf0364b96838b
Opcode Fuzzy Hash: 18bdf9878add844580a546bdd1708331871432847ee56f27ac7b2929f3c7ba84
Instruction Fuzzy Hash: A811E131901608FFDB149F65DD08BAE7BBDEF50319F104229E885B3291CB329D88DB60

Function 00E08AF9 Relevance: 9.1, APIs: 6, Instructions: 65processCOMMON

Download Yara Rule

APIs

GetCurrentProcess.KERNEL32(0000000A,00000004), ref: 00E08B2A
OpenProcessToken.ADVAPI32(00000000), ref: 00E08B31
CreateEnvironmentBlock.USERENV(?,00000004,00000001), ref: 00E08B40
CloseHandle.KERNEL32(00000004), ref: 00E08B4B
CreateProcessWithLogonW.ADVAPI32(?,?,?,00000000,00000000,?,?,00000000,?,?,?), ref: 00E08B7A
DestroyEnvironmentBlock.USERENV(00000000), ref: 00E08B8E

Memory Dump Source

Source File: 00000000.00000002.2103545536.0000000000DB1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00DB0000, based on PE: true

Associated: 00000000.00000002.2103534640.0000000000DB0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103580373.0000000000E3F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103580373.0000000000E65000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103609603.0000000000E6F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103621893.0000000000E78000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_db0000_New Quotation - FE7191PO154.jbxd

Similarity

API ID: Process$BlockCreateEnvironment$CloseCurrentDestroyHandleLogonOpenTokenWith
String ID:
API String ID: 1413079979-0
Opcode ID: eb70dcc556737d48ea91fad3717093cf6bf08fe01604c6dee9eaff4fbf636976
Instruction ID: 97446293be07aaa94bfaa9d10f69304a73c8ac98bea15081fcf80e21a82a8e62
Opcode Fuzzy Hash: eb70dcc556737d48ea91fad3717093cf6bf08fe01604c6dee9eaff4fbf636976
Instruction Fuzzy Hash: 1D114AB650120DEFDF018FA9DE49FDA7BA9EB08308F045065FA44B21A0C7718D64DB60

Function 00E3C19A Relevance: 9.0, APIs: 6, Instructions: 49COMMON

Download Yara Rule

APIs

Part of subcall function 00DB12F3: ExtCreatePen.GDI32(?,?,00000000,00000000,00000000,?,00000000), ref: 00DB134D
Part of subcall function 00DB12F3: SelectObject.GDI32(?,00000000), ref: 00DB135C
Part of subcall function 00DB12F3: BeginPath.GDI32(?), ref: 00DB1373
Part of subcall function 00DB12F3: SelectObject.GDI32(?,00000000), ref: 00DB139C

MoveToEx.GDI32(00000000,-00000002,?,00000000), ref: 00E3C1C4
LineTo.GDI32(00000000,00000003,?), ref: 00E3C1D8
MoveToEx.GDI32(00000000,00000000,?,00000000), ref: 00E3C1E6
LineTo.GDI32(00000000,00000000,?), ref: 00E3C1F6
EndPath.GDI32(00000000), ref: 00E3C206
StrokePath.GDI32(00000000), ref: 00E3C216

Memory Dump Source

Source File: 00000000.00000002.2103545536.0000000000DB1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00DB0000, based on PE: true

Associated: 00000000.00000002.2103534640.0000000000DB0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103580373.0000000000E3F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103580373.0000000000E65000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103609603.0000000000E6F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103621893.0000000000E78000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_db0000_New Quotation - FE7191PO154.jbxd

Similarity

API ID: Path$LineMoveObjectSelect$BeginCreateStroke
String ID:
API String ID: 43455801-0
Opcode ID: 3a4a56005e9b9102e826ed9704f14e4f668464e58a2a66c0d0b28441ed0adedd
Instruction ID: aa66e7270731d1c600a337c3b18199b9687ddfc3ab646bc5cc465ee9d4dde793
Opcode Fuzzy Hash: 3a4a56005e9b9102e826ed9704f14e4f668464e58a2a66c0d0b28441ed0adedd
Instruction Fuzzy Hash: C2110C7640010DBFEB119F95EC88EDA7FADEB04354F048061F9196A172C7719D59DFA0

Function 00DD03A2 Relevance: 9.0, APIs: 6, Instructions: 44keyboardCOMMON

Download Yara Rule

APIs

MapVirtualKeyW.USER32(0000005B,00000000), ref: 00DD03D3
MapVirtualKeyW.USER32(00000010,00000000), ref: 00DD03DB
MapVirtualKeyW.USER32(000000A0,00000000), ref: 00DD03E6
MapVirtualKeyW.USER32(000000A1,00000000), ref: 00DD03F1
MapVirtualKeyW.USER32(00000011,00000000), ref: 00DD03F9
MapVirtualKeyW.USER32(00000012,00000000), ref: 00DD0401

Memory Dump Source

Source File: 00000000.00000002.2103545536.0000000000DB1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00DB0000, based on PE: true

Associated: 00000000.00000002.2103534640.0000000000DB0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103580373.0000000000E3F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103580373.0000000000E65000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103609603.0000000000E6F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103621893.0000000000E78000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_db0000_New Quotation - FE7191PO154.jbxd

Similarity

API ID: Virtual
String ID:
API String ID: 4278518827-0
Opcode ID: e2ba3c1c738273a2ae320eeb8133a05d1570f3891a1d45ebb43391bde5746c0c
Instruction ID: a95930b73676a4e027b5d35dbcd59c12110def406f3078c5855b024847991a64
Opcode Fuzzy Hash: e2ba3c1c738273a2ae320eeb8133a05d1570f3891a1d45ebb43391bde5746c0c
Instruction Fuzzy Hash: 4A0148B09017597DE3008F5A8C85A52FEA8FF19354F00411BE15847941C7B5A868CBE5

Function 00E1568B Relevance: 9.0, APIs: 6, Instructions: 43windowtimethreadCOMMON

Download Yara Rule

APIs

PostMessageW.USER32(?,00000010,00000000,00000000), ref: 00E1569B
SendMessageTimeoutW.USER32(?,00000010,00000000,00000000,00000002,000001F4,?), ref: 00E156B1
GetWindowThreadProcessId.USER32(?,?), ref: 00E156C0
OpenProcess.KERNEL32(001F0FFF,00000000,?,?,?,?,00000010,00000000,00000000,00000002,000001F4,?,?,00000010,00000000,00000000), ref: 00E156CF
TerminateProcess.KERNEL32(00000000,00000000,?,?,?,00000010,00000000,00000000,00000002,000001F4,?,?,00000010,00000000,00000000), ref: 00E156D9
CloseHandle.KERNEL32(00000000,?,?,?,00000010,00000000,00000000,00000002,000001F4,?,?,00000010,00000000,00000000), ref: 00E156E0

Memory Dump Source

Source File: 00000000.00000002.2103545536.0000000000DB1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00DB0000, based on PE: true

Associated: 00000000.00000002.2103534640.0000000000DB0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103580373.0000000000E3F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103580373.0000000000E65000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103609603.0000000000E6F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103621893.0000000000E78000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_db0000_New Quotation - FE7191PO154.jbxd

Similarity

API ID: Process$Message$CloseHandleOpenPostSendTerminateThreadTimeoutWindow
String ID:
API String ID: 839392675-0
Opcode ID: 3a962ecb6d4b63f5072427219527ef6823d675a50bf99ddec28da0f3fb6c69f0
Instruction ID: 99d8a4a4a9cc72c1287de603e8fd3852ea192a0278dbdf5969696c3f17b08aa3
Opcode Fuzzy Hash: 3a962ecb6d4b63f5072427219527ef6823d675a50bf99ddec28da0f3fb6c69f0
Instruction Fuzzy Hash: 76F01D32A4155CBFE7215BA3AC0EEEB7E7CEBC6B11F000169FA05E106197A15A0986F5

Function 00E174D2 Relevance: 9.0, APIs: 6, Instructions: 33synchronizationthreadCOMMONLIBRARYCODE

Download Yara Rule

APIs

InterlockedExchange.KERNEL32(?,?), ref: 00E174E5
EnterCriticalSection.KERNEL32(?,?,00DC1044,?,?), ref: 00E174F6
TerminateThread.KERNEL32(00000000,000001F6,?,00DC1044,?,?), ref: 00E17503
WaitForSingleObject.KERNEL32(00000000,000003E8,?,00DC1044,?,?), ref: 00E17510

Part of subcall function 00E16ED7: CloseHandle.KERNEL32(00000000,?,00E1751D,?,00DC1044,?,?), ref: 00E16EE1

InterlockedExchange.KERNEL32(?,000001F6), ref: 00E17523
LeaveCriticalSection.KERNEL32(?,?,00DC1044,?,?), ref: 00E1752A

Memory Dump Source

Source File: 00000000.00000002.2103545536.0000000000DB1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00DB0000, based on PE: true

Associated: 00000000.00000002.2103534640.0000000000DB0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103580373.0000000000E3F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103580373.0000000000E65000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103609603.0000000000E6F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103621893.0000000000E78000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_db0000_New Quotation - FE7191PO154.jbxd

Similarity

API ID: CriticalExchangeInterlockedSection$CloseEnterHandleLeaveObjectSingleTerminateThreadWait
String ID:
API String ID: 3495660284-0
Opcode ID: 8b3dea7b9fb05bcb9262b939806317482d5bdeddb3ca9c762e463ced9ecf650e
Instruction ID: 74cc0572477eab3f24ee9112f3ed6d4289d6afd9e6163a02e59ea4d97b6f0879
Opcode Fuzzy Hash: 8b3dea7b9fb05bcb9262b939806317482d5bdeddb3ca9c762e463ced9ecf650e
Instruction Fuzzy Hash: 1BF05E3A940616EFDB111B65FD8CDEB7B3AEF45702B011531FA42B10B2CBB65949CB50

Function 00E08E74 Relevance: 9.0, APIs: 6, Instructions: 23memorysynchronizationCOMMON

Download Yara Rule

APIs

WaitForSingleObject.KERNEL32(?,000000FF), ref: 00E08E7F
UnloadUserProfile.USERENV(?,?), ref: 00E08E8B
CloseHandle.KERNEL32(?), ref: 00E08E94
CloseHandle.KERNEL32(?), ref: 00E08E9C
GetProcessHeap.KERNEL32(00000000,?), ref: 00E08EA5
HeapFree.KERNEL32(00000000), ref: 00E08EAC

Memory Dump Source

Source File: 00000000.00000002.2103545536.0000000000DB1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00DB0000, based on PE: true

Associated: 00000000.00000002.2103534640.0000000000DB0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103580373.0000000000E3F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103580373.0000000000E65000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103609603.0000000000E6F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103621893.0000000000E78000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_db0000_New Quotation - FE7191PO154.jbxd

Similarity

API ID: CloseHandleHeap$FreeObjectProcessProfileSingleUnloadUserWait
String ID:
API String ID: 146765662-0
Opcode ID: 1054583462687a1329820c12a158d781093338881ad0cfe945d9d688f0b5eb20
Instruction ID: aa97d28eefe07e6f8fa5819faf53e5bfd0e000054742efd38c830684f064c469
Opcode Fuzzy Hash: 1054583462687a1329820c12a158d781093338881ad0cfe945d9d688f0b5eb20
Instruction Fuzzy Hash: D2E0C236804009FFDA011FE2EC0CD0ABF79FB89322B108231F219A1071CB329428DB50

Function 00E07A78 Relevance: 9.0, APIs: 4, Strings: 1, Instructions: 231COMMON

Download Yara Rule

APIs

ProgIDFromCLSID.OLE32(?,00000000,?,00000000,00000800,00000000,?,00E42C7C,?), ref: 00E07C32
CoTaskMemFree.OLE32(00000000,00000000,?,00000000,00000800,00000000,?,00E42C7C,?), ref: 00E07C4A
CLSIDFromProgID.OLE32(?,?,00000000,00E3FB80,000000FF,?,00000000,00000800,00000000,?,00E42C7C,?), ref: 00E07C6F
_memcmp.LIBCMT ref: 00E07C90

Strings

,,, xrefs: 00E07A85

Memory Dump Source

Source File: 00000000.00000002.2103545536.0000000000DB1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00DB0000, based on PE: true

Associated: 00000000.00000002.2103534640.0000000000DB0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103580373.0000000000E3F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103580373.0000000000E65000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103609603.0000000000E6F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103621893.0000000000E78000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_db0000_New Quotation - FE7191PO154.jbxd

Similarity

API ID: FromProg$FreeTask_memcmp
String ID: ,,
API String ID: 314563124-1556401989
Opcode ID: 5fa134a99610ef975518ae8a0b1d32d117d146fc22c14e7b60a097e8e8d96db8
Instruction ID: d2bc2ead0b4e845996a2f7164f39d65dc3d8bda3a02d897164093792fc1ebcba
Opcode Fuzzy Hash: 5fa134a99610ef975518ae8a0b1d32d117d146fc22c14e7b60a097e8e8d96db8
Instruction Fuzzy Hash: 2D81E775A00109EFCB04DF94C988EEEB7B9FF89315F204198E556BB290DB71AE45CB60

Function 00E28902 Relevance: 9.0, APIs: 3, Strings: 2, Instructions: 225COMMON

Download Yara Rule

APIs

VariantInit.OLEAUT32(?), ref: 00E28928
CharUpperBuffW.USER32(?,?), ref: 00E28A37
VariantClear.OLEAUT32(?), ref: 00E28BAF

Part of subcall function 00E17804: VariantInit.OLEAUT32(00000000), ref: 00E17844
Part of subcall function 00E17804: VariantCopy.OLEAUT32(00000000,?), ref: 00E1784D
Part of subcall function 00E17804: VariantClear.OLEAUT32(00000000), ref: 00E17859

Strings

Incorrect Parameter format, xrefs: 00E28960, 00E28B22
AUTOIT.ERROR, xrefs: 00E28A3D

Memory Dump Source

Source File: 00000000.00000002.2103545536.0000000000DB1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00DB0000, based on PE: true

Associated: 00000000.00000002.2103534640.0000000000DB0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103580373.0000000000E3F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103580373.0000000000E65000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103609603.0000000000E6F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103621893.0000000000E78000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_db0000_New Quotation - FE7191PO154.jbxd

Similarity

API ID: Variant$ClearInit$BuffCharCopyUpper
String ID: AUTOIT.ERROR$Incorrect Parameter format
API String ID: 4237274167-1221869570
Opcode ID: 02a052e8506dce28ba882da358d53ff1c66813ea4b1bd8e1cc592c2ed098c17e
Instruction ID: 4b7eb9a76d753c5651624b31d9ab858f989342256eda6e57955c70769b24a95d
Opcode Fuzzy Hash: 02a052e8506dce28ba882da358d53ff1c66813ea4b1bd8e1cc592c2ed098c17e
Instruction Fuzzy Hash: F7918C75608301DFC710DF24D5849AABBE4EFC9304F04996EF89AAB361DB31E945CB62

Function 00E12F86 Relevance: 8.9, APIs: 4, Strings: 1, Instructions: 195windowCOMMON

Download Yara Rule

APIs

Part of subcall function 00DCFEC6: _wcscpy.LIBCMT ref: 00DCFEE9

_memset.LIBCMT ref: 00E13077
GetMenuItemInfoW.USER32(?,?,00000000,?), ref: 00E130A6
SetMenuItemInfoW.USER32(?,?,00000000,?), ref: 00E13159
SetMenuDefaultItem.USER32(?,000000FF,00000000), ref: 00E13187

Strings

0, xrefs: 00E13063

Memory Dump Source

Source File: 00000000.00000002.2103545536.0000000000DB1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00DB0000, based on PE: true

Associated: 00000000.00000002.2103534640.0000000000DB0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103580373.0000000000E3F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103580373.0000000000E65000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103609603.0000000000E6F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103621893.0000000000E78000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_db0000_New Quotation - FE7191PO154.jbxd

Similarity

API ID: ItemMenu$Info$Default_memset_wcscpy
String ID: 0
API String ID: 4152858687-4108050209
Opcode ID: bad45474344e61cbe3976e80078a6fb304e76ebe4813758c8f55eed4e30a6a17
Instruction ID: a062966ee33f75bfbaaf915bab2a2dbbbde3a227046d8970c80d7c7c1072f558
Opcode Fuzzy Hash: bad45474344e61cbe3976e80078a6fb304e76ebe4813758c8f55eed4e30a6a17
Instruction Fuzzy Hash: F5519331609301ABD7259F38D845AEBBBE4EF49368F04592DF895F3291DB70CE848762

Function 00E12C42 Relevance: 8.9, APIs: 4, Strings: 1, Instructions: 114windowCOMMON

Download Yara Rule

APIs

_memset.LIBCMT ref: 00E12CAF
GetMenuItemInfoW.USER32(00000004,00000000,00000000,?), ref: 00E12CCB
DeleteMenu.USER32(?,00000007,00000000), ref: 00E12D11
DeleteMenu.USER32(?,00000000,00000000,?,00000000,00000000,00E76890,00000000), ref: 00E12D5A

Strings

0, xrefs: 00E12CA4

Memory Dump Source

Source File: 00000000.00000002.2103545536.0000000000DB1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00DB0000, based on PE: true

Associated: 00000000.00000002.2103534640.0000000000DB0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103580373.0000000000E3F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103580373.0000000000E65000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103609603.0000000000E6F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103621893.0000000000E78000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_db0000_New Quotation - FE7191PO154.jbxd

Similarity

API ID: Menu$Delete$InfoItem_memset
String ID: 0
API String ID: 1173514356-4108050209
Opcode ID: 6dbf3b5261051543591ad23d0da385039a2e664fa0b228ff8a74184665f712e5
Instruction ID: c52696a539beacc799fbeff1e4df2b576bf46d77c460bac64e4cc281439320a8
Opcode Fuzzy Hash: 6dbf3b5261051543591ad23d0da385039a2e664fa0b228ff8a74184665f712e5
Instruction Fuzzy Hash: 0441C170604342AFD720DF24DC44B9ABBE8EF85324F00461DFA65A72E1D770E994CBA2

Function 00E2DAB9 Relevance: 8.9, APIs: 1, Strings: 4, Instructions: 101COMMON

Download Yara Rule

APIs

CharLowerBuffW.USER32(?,?,?,?,00000000,?,?), ref: 00E2DAD9

Part of subcall function 00DB79AB: _memmove.LIBCMT ref: 00DB79F9

Strings

cdecl, xrefs: 00E2DB30
none, xrefs: 00E2DBB4
winapi, xrefs: 00E2DB4A
stdcall, xrefs: 00E2DB5B

Memory Dump Source

Source File: 00000000.00000002.2103545536.0000000000DB1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00DB0000, based on PE: true

Associated: 00000000.00000002.2103534640.0000000000DB0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103580373.0000000000E3F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103580373.0000000000E65000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103609603.0000000000E6F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103621893.0000000000E78000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_db0000_New Quotation - FE7191PO154.jbxd

Similarity

API ID: BuffCharLower_memmove
String ID: cdecl$none$stdcall$winapi
API String ID: 3425801089-567219261
Opcode ID: 814efea2535de3ffb8fcd16b22d1482949711af93eca95fd23817de6a44eb265
Instruction ID: d072fc653fc8fcb5f243743447812e903c2262710f76f20ed34f5584f9f6256d
Opcode Fuzzy Hash: 814efea2535de3ffb8fcd16b22d1482949711af93eca95fd23817de6a44eb265
Instruction Fuzzy Hash: 2D319071504219EFCF10EF64DC919EEB7B4FF45314B10862AE966B76D1CB31A905CBA0

Function 00E09372 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 94windowCOMMON

Download Yara Rule

APIs

Part of subcall function 00DB7F41: _memmove.LIBCMT ref: 00DB7F82

Part of subcall function 00E0B0C4: GetClassNameW.USER32(?,?,000000FF), ref: 00E0B0E7

SendMessageW.USER32(?,00000188,00000000,00000000), ref: 00E093F6
SendMessageW.USER32(?,0000018A,00000000,00000000), ref: 00E09409
SendMessageW.USER32(?,00000189,?,00000000), ref: 00E09439

Part of subcall function 00DB7D2C: _memmove.LIBCMT ref: 00DB7D66

Strings

ListBox, xrefs: 00E093B5
ComboBox, xrefs: 00E09380

Memory Dump Source

Source File: 00000000.00000002.2103545536.0000000000DB1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00DB0000, based on PE: true

Associated: 00000000.00000002.2103534640.0000000000DB0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103580373.0000000000E3F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103580373.0000000000E65000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103609603.0000000000E6F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103621893.0000000000E78000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_db0000_New Quotation - FE7191PO154.jbxd

Similarity

API ID: MessageSend$_memmove$ClassName
String ID: ComboBox$ListBox
API String ID: 365058703-1403004172
Opcode ID: d802713d13f0ca633dd56145f3742aa5193812b621950b4a26d0c6eb22e3c456
Instruction ID: b5a74823a7f41666d6cc8fad3a111ca59712749fcbbc0ba641347d6628f82614
Opcode Fuzzy Hash: d802713d13f0ca633dd56145f3742aa5193812b621950b4a26d0c6eb22e3c456
Instruction Fuzzy Hash: F121D071900108AFDB14AFB0DC869FEBB7CDF45360B105129F926B72E2DB350A4A9630

Function 00E21B21 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 86networkCOMMON

Download Yara Rule

APIs

InternetOpenUrlW.WININET(?,?,00000000,00000000,?,00000000), ref: 00E21B40
HttpSendRequestW.WININET(00000000,00000000,00000000,00000000,00000000), ref: 00E21B66
HttpQueryInfoW.WININET(00000000,00000005,?,?,?), ref: 00E21B96
InternetCloseHandle.WININET(00000000), ref: 00E21BDD

Part of subcall function 00E22777: GetLastError.KERNEL32(?,?,00E21B0B,00000000,00000000,00000001), ref: 00E2278C
Part of subcall function 00E22777: SetEvent.KERNEL32(?,?,00E21B0B,00000000,00000000,00000001), ref: 00E227A1

Strings

, xrefs: 00E21B87

Memory Dump Source

Source File: 00000000.00000002.2103545536.0000000000DB1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00DB0000, based on PE: true

Associated: 00000000.00000002.2103534640.0000000000DB0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103580373.0000000000E3F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103580373.0000000000E65000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103609603.0000000000E6F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103621893.0000000000E78000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_db0000_New Quotation - FE7191PO154.jbxd

Similarity

API ID: HttpInternet$CloseErrorEventHandleInfoLastOpenQueryRequestSend
String ID:
API String ID: 3113390036-3916222277
Opcode ID: 47391ea177c64638daaee35b0fcce17dcc8683618c699d1581edabed2cf821e0
Instruction ID: 181e74b17e8bbc0029096f6803d37b0faf5338e1069712d2f6669d06e4f0d35b
Opcode Fuzzy Hash: 47391ea177c64638daaee35b0fcce17dcc8683618c699d1581edabed2cf821e0
Instruction Fuzzy Hash: D021CFB1504218BFEB119F21AC85EFF76FCEB59748F10516AF505B2240EA309E089771

Function 00E36656 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 80windowlibraryCOMMON

Download Yara Rule

APIs

Part of subcall function 00DB1D35: CreateWindowExW.USER32(?,?,?,?,?,?,?,?,?,?,00000000,00000096), ref: 00DB1D73
Part of subcall function 00DB1D35: GetStockObject.GDI32(00000011), ref: 00DB1D87
Part of subcall function 00DB1D35: SendMessageW.USER32(00000000,00000030,00000000), ref: 00DB1D91

SendMessageW.USER32(00000000,00000467,00000000,?), ref: 00E366D0
LoadLibraryW.KERNEL32(?), ref: 00E366D7
SendMessageW.USER32(?,00000467,00000000,00000000), ref: 00E366EC
DestroyWindow.USER32(?), ref: 00E366F4

Strings

SysAnimate32, xrefs: 00E366AB

Memory Dump Source

Source File: 00000000.00000002.2103545536.0000000000DB1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00DB0000, based on PE: true

Associated: 00000000.00000002.2103534640.0000000000DB0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103580373.0000000000E3F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103580373.0000000000E65000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103609603.0000000000E6F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103621893.0000000000E78000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_db0000_New Quotation - FE7191PO154.jbxd

Similarity

API ID: MessageSend$Window$CreateDestroyLibraryLoadObjectStock
String ID: SysAnimate32
API String ID: 4146253029-1011021900
Opcode ID: d7f1298435db06099b59b0a762cf36e2e3472c24d961336f3d792ee9883afa70
Instruction ID: c3a8a9866dec21ef8b31c652c38efacfe63f25dbb7b81b45773bb7eeb5450279
Opcode Fuzzy Hash: d7f1298435db06099b59b0a762cf36e2e3472c24d961336f3d792ee9883afa70
Instruction Fuzzy Hash: 7721BE71200209BFEF104F74EC8AEBB3BADEF193A8F50A229F911A6090C7718C50D760

Function 00E1703E Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 79filepipeCOMMON

Download Yara Rule

APIs

GetStdHandle.KERNEL32(0000000C), ref: 00E1705E
CreatePipe.KERNEL32(?,?,0000000C,00000000), ref: 00E17091
GetStdHandle.KERNEL32(0000000C), ref: 00E170A3
CreateFileW.KERNEL32(nul,40000000,00000002,0000000C,00000003,00000080,00000000), ref: 00E170DD

Strings

nul, xrefs: 00E170D8

Memory Dump Source

Source File: 00000000.00000002.2103545536.0000000000DB1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00DB0000, based on PE: true

Associated: 00000000.00000002.2103534640.0000000000DB0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103580373.0000000000E3F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103580373.0000000000E65000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103609603.0000000000E6F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103621893.0000000000E78000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_db0000_New Quotation - FE7191PO154.jbxd

Similarity

API ID: CreateHandle$FilePipe
String ID: nul
API String ID: 4209266947-2873401336
Opcode ID: 652cee2b02f8785122f1940f8593ae3cf57a4afbae560ceb3c9d626380897c1c
Instruction ID: c3530fa326cd7aa1ac84a03305c69f65602613c5f65fb7d0730c30b24dc9c089
Opcode Fuzzy Hash: 652cee2b02f8785122f1940f8593ae3cf57a4afbae560ceb3c9d626380897c1c
Instruction Fuzzy Hash: DC214F74604309ABDB209F29DC09ADA7BF8AF48B24F205619F8E1F72D0D77199948B50

Function 00E1710C Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 79filepipeCOMMON

Download Yara Rule

APIs

GetStdHandle.KERNEL32(000000F6), ref: 00E1712B
CreatePipe.KERNEL32(?,?,0000000C,00000000), ref: 00E1715D
GetStdHandle.KERNEL32(000000F6), ref: 00E1716E
CreateFileW.KERNEL32(nul,80000000,00000001,0000000C,00000003,00000080,00000000), ref: 00E171A8

Strings

nul, xrefs: 00E171A3

Memory Dump Source

Source File: 00000000.00000002.2103545536.0000000000DB1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00DB0000, based on PE: true

Associated: 00000000.00000002.2103534640.0000000000DB0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103580373.0000000000E3F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103580373.0000000000E65000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103609603.0000000000E6F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103621893.0000000000E78000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_db0000_New Quotation - FE7191PO154.jbxd

Similarity

API ID: CreateHandle$FilePipe
String ID: nul
API String ID: 4209266947-2873401336
Opcode ID: 941214b30c5a5a6e7f3d71f30ff51147b745eaa90421a9ed428453f7c570e938
Instruction ID: 5460727dc43fcf0c5af02868c7dedfd2e9d173dea58514842cfdac8156a227ca
Opcode Fuzzy Hash: 941214b30c5a5a6e7f3d71f30ff51147b745eaa90421a9ed428453f7c570e938
Instruction Fuzzy Hash: C9219075A09209ABDB209F699C04AEAB7F8AF55B34F201619FCE1F32D0D77098818B50

Function 00E1AEAB Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 73COMMON

Download Yara Rule

APIs

SetErrorMode.KERNEL32(00000001), ref: 00E1AEBF
GetVolumeInformationW.KERNEL32(?,?,00007FFF,?,00000000,00000000,00000000,00000000), ref: 00E1AF13
__swprintf.LIBCMT ref: 00E1AF2C
SetErrorMode.KERNEL32(00000000,00000001,00000000,00E3F910), ref: 00E1AF6A

Strings

%lu, xrefs: 00E1AF26

Memory Dump Source

Source File: 00000000.00000002.2103545536.0000000000DB1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00DB0000, based on PE: true

Associated: 00000000.00000002.2103534640.0000000000DB0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103580373.0000000000E3F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103580373.0000000000E65000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103609603.0000000000E6F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103621893.0000000000E78000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_db0000_New Quotation - FE7191PO154.jbxd

Similarity

API ID: ErrorMode$InformationVolume__swprintf
String ID: %lu
API String ID: 3164766367-685833217
Opcode ID: e2dd44da3219996a3e70f92a21d4deb72e045db4c8da8682f38f19ec13c774f1
Instruction ID: 59c72ee6afde988918eb2990b10b9102438ceaebbc6e1f2965b882eb6b77c625
Opcode Fuzzy Hash: e2dd44da3219996a3e70f92a21d4deb72e045db4c8da8682f38f19ec13c774f1
Instruction Fuzzy Hash: 57216530A00249AFCB10EF65D885EEE7BB8EF49704B044069F509E7251DB31EA45DB31

Function 00E0A52F Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 68windowCOMMON

Download Yara Rule

APIs

Part of subcall function 00DB7D2C: _memmove.LIBCMT ref: 00DB7D66

Part of subcall function 00E0A37C: SendMessageTimeoutW.USER32(?,00000000,00000000,00000000,00000002,00001388,00000001), ref: 00E0A399
Part of subcall function 00E0A37C: GetWindowThreadProcessId.USER32(?,00000000), ref: 00E0A3AC
Part of subcall function 00E0A37C: GetCurrentThreadId.KERNEL32 ref: 00E0A3B3
Part of subcall function 00E0A37C: AttachThreadInput.USER32(00000000), ref: 00E0A3BA

GetFocus.USER32 ref: 00E0A554

Part of subcall function 00E0A3C5: GetParent.USER32(?), ref: 00E0A3D3

GetClassNameW.USER32(?,?,00000100), ref: 00E0A59D
EnumChildWindows.USER32(?,00E0A615), ref: 00E0A5C5
__swprintf.LIBCMT ref: 00E0A5DF

Strings

%s%d, xrefs: 00E0A5D9

Memory Dump Source

Source File: 00000000.00000002.2103545536.0000000000DB1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00DB0000, based on PE: true

Associated: 00000000.00000002.2103534640.0000000000DB0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103580373.0000000000E3F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103580373.0000000000E65000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103609603.0000000000E6F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103621893.0000000000E78000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_db0000_New Quotation - FE7191PO154.jbxd

Similarity

API ID: Thread$AttachChildClassCurrentEnumFocusInputMessageNameParentProcessSendTimeoutWindowWindows__swprintf_memmove
String ID: %s%d
API String ID: 1941087503-1110647743
Opcode ID: 1d24343818494aff498100dd8c78040ee1332bd59e2469b27cadcd4e1976d448
Instruction ID: 79b3b5920437dc024d2d8fbbf0c0787ce48e1d35be986f6ccd3c9fd18ff0ed75
Opcode Fuzzy Hash: 1d24343818494aff498100dd8c78040ee1332bd59e2469b27cadcd4e1976d448
Instruction Fuzzy Hash: 53118E71600308ABDF10BBA0EC8AFEE37B89F88700F085075F909BA192CA7559858B75

Function 00E12017 Relevance: 8.8, APIs: 1, Strings: 4, Instructions: 49COMMON

Download Yara Rule

APIs

CharUpperBuffW.USER32(?,?), ref: 00E12048

Strings

EXISTS, xrefs: 00E12070
APPEND, xrefs: 00E12081
REMOVE, xrefs: 00E1204E
KEYS, xrefs: 00E1205F

Memory Dump Source

Source File: 00000000.00000002.2103545536.0000000000DB1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00DB0000, based on PE: true

Associated: 00000000.00000002.2103534640.0000000000DB0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103580373.0000000000E3F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103580373.0000000000E65000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103609603.0000000000E6F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103621893.0000000000E78000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_db0000_New Quotation - FE7191PO154.jbxd

Similarity

API ID: BuffCharUpper
String ID: APPEND$EXISTS$KEYS$REMOVE
API String ID: 3964851224-769500911
Opcode ID: f6202d022f754d3f928231d3a98f8b35137ea4a6d2adeb7fbb0fd9ad5ed25c4b
Instruction ID: dbb4deab89b66f54991285a9f6f06faa60c636b22f8d1ed64a3a97bed46ca8c6
Opcode Fuzzy Hash: f6202d022f754d3f928231d3a98f8b35137ea4a6d2adeb7fbb0fd9ad5ed25c4b
Instruction Fuzzy Hash: F8112770940119CF8F00EFA4DD419EEB7B5FF5A304F10956AD856B7252EB32691ACB60

Function 00E2EE69 Relevance: 7.7, APIs: 5, Instructions: 247COMMON

Download Yara Rule

APIs

OpenProcess.KERNEL32(00000410,00000000,00000000), ref: 00E2EF1B
GetProcessIoCounters.KERNEL32(00000000,?), ref: 00E2EF4B
GetProcessMemoryInfo.PSAPI(00000000,?,00000028), ref: 00E2F07E
CloseHandle.KERNEL32(?), ref: 00E2F0FF

Memory Dump Source

Source File: 00000000.00000002.2103545536.0000000000DB1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00DB0000, based on PE: true

Associated: 00000000.00000002.2103534640.0000000000DB0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103580373.0000000000E3F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103580373.0000000000E65000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103609603.0000000000E6F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103621893.0000000000E78000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_db0000_New Quotation - FE7191PO154.jbxd

Similarity

API ID: Process$CloseCountersHandleInfoMemoryOpen
String ID:
API String ID: 2364364464-0
Opcode ID: cd06eaa0656cdc3b0677d48444f23817800358c001b9aaed5438d2835928a13e
Instruction ID: cb0583a790ecb8b26d11b7e7d72c52d027834e0766e913bfe8ab10249dacd838
Opcode Fuzzy Hash: cd06eaa0656cdc3b0677d48444f23817800358c001b9aaed5438d2835928a13e
Instruction Fuzzy Hash: 44815171604310DFD720DF28D856F6AB7E5EF48710F14882DF596EB292DBB1AC408B61

Function 00E302C2 Relevance: 7.6, APIs: 5, Instructions: 144registryCOMMON

Download Yara Rule

APIs

Part of subcall function 00DB7F41: _memmove.LIBCMT ref: 00DB7F82

Part of subcall function 00E310A5: CharUpperBuffW.USER32(?,?,?,?,?,?,?,00E30038,?,?), ref: 00E310BC

RegConnectRegistryW.ADVAPI32(?,?,?), ref: 00E30388
RegOpenKeyExW.ADVAPI32(?,?,00000000,?,?), ref: 00E303C7
RegEnumKeyExW.ADVAPI32(?,-00000001,?,?,00000000,00000000,00000000,?), ref: 00E3040E
RegCloseKey.ADVAPI32(?,?), ref: 00E3043A
RegCloseKey.ADVAPI32(00000000), ref: 00E30447

Memory Dump Source

Source File: 00000000.00000002.2103545536.0000000000DB1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00DB0000, based on PE: true

Associated: 00000000.00000002.2103534640.0000000000DB0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103580373.0000000000E3F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103580373.0000000000E65000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103609603.0000000000E6F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103621893.0000000000E78000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_db0000_New Quotation - FE7191PO154.jbxd

Similarity

API ID: Close$BuffCharConnectEnumOpenRegistryUpper_memmove
String ID:
API String ID: 3440857362-0
Opcode ID: e9bded1af784b00abf719518ac896ee102574e14ab79c7db7cb4cc746498d156
Instruction ID: e1dbd8230a210defa85309eaabd1ddd82fa289cd674f93b5af555031a47b787e
Opcode Fuzzy Hash: e9bded1af784b00abf719518ac896ee102574e14ab79c7db7cb4cc746498d156
Instruction Fuzzy Hash: DE512B31208204AFD704EF64D895FAEBBE8FF84714F44996DF596A71A1DB30E904CB62

Function 00E2DBDC Relevance: 7.6, APIs: 5, Instructions: 139libraryloaderCOMMON

Download Yara Rule

APIs

Part of subcall function 00DB9997: __itow.LIBCMT ref: 00DB99C2
Part of subcall function 00DB9997: __swprintf.LIBCMT ref: 00DB9A0C

LoadLibraryW.KERNEL32(?,?,?,00000000,?,?,?,?,?,?,?,?), ref: 00E2DC3B
GetProcAddress.KERNEL32(00000000,?), ref: 00E2DCBE
GetProcAddress.KERNEL32(00000000,00000000), ref: 00E2DCDA
GetProcAddress.KERNEL32(00000000,?), ref: 00E2DD1B
FreeLibrary.KERNEL32(00000000,?,?,00000000,?,?,?,?,?,?,?,?), ref: 00E2DD35

Part of subcall function 00DB5B75: WideCharToMultiByte.KERNEL32(00000000,00000000,?,00000001,00000000,00000000,00000000,00000000,00000000,00000000,?,00E17B20,?,?,00000000), ref: 00DB5B8C
Part of subcall function 00DB5B75: WideCharToMultiByte.KERNEL32(00000000,00000000,?,00000001,00000000,?,00000000,00000000,?,?,00E17B20,?,?,00000000,?,?), ref: 00DB5BB0

Memory Dump Source

Source File: 00000000.00000002.2103545536.0000000000DB1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00DB0000, based on PE: true

Associated: 00000000.00000002.2103534640.0000000000DB0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103580373.0000000000E3F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103580373.0000000000E65000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103609603.0000000000E6F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103621893.0000000000E78000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_db0000_New Quotation - FE7191PO154.jbxd

Similarity

API ID: AddressProc$ByteCharLibraryMultiWide$FreeLoad__itow__swprintf
String ID:
API String ID: 327935632-0
Opcode ID: ffd405278647ca30f2dd99b536e0260ae3d89b666eb47ca1dfc366254819d35e
Instruction ID: 7b894b0973fd10abfc4ac990a1056841686c87f6ec808f7b7917f3884e3a4962
Opcode Fuzzy Hash: ffd405278647ca30f2dd99b536e0260ae3d89b666eb47ca1dfc366254819d35e
Instruction Fuzzy Hash: 49514A35A04619DFCB01EF68D8859DDFBF4FF08314B058055E916AB322DB30AD45CB61

Function 00E1E7DC Relevance: 7.6, APIs: 5, Instructions: 135COMMON

Download Yara Rule

APIs

GetPrivateProfileSectionW.KERNEL32(00000003,?,00007FFF,?), ref: 00E1E88A
GetPrivateProfileSectionW.KERNEL32(?,00000001,00000003,?), ref: 00E1E8B3
WritePrivateProfileSectionW.KERNEL32(?,?,?), ref: 00E1E8F2

Part of subcall function 00DB9997: __itow.LIBCMT ref: 00DB99C2
Part of subcall function 00DB9997: __swprintf.LIBCMT ref: 00DB9A0C

WritePrivateProfileStringW.KERNEL32(00000003,00000000,00000000,?), ref: 00E1E917
WritePrivateProfileStringW.KERNEL32(00000000,00000000,00000000,?), ref: 00E1E91F

Memory Dump Source

Source File: 00000000.00000002.2103545536.0000000000DB1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00DB0000, based on PE: true

Associated: 00000000.00000002.2103534640.0000000000DB0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103580373.0000000000E3F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103580373.0000000000E65000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103609603.0000000000E6F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103621893.0000000000E78000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_db0000_New Quotation - FE7191PO154.jbxd

Similarity

API ID: PrivateProfile$SectionWrite$String$__itow__swprintf
String ID:
API String ID: 1389676194-0
Opcode ID: 12e0ff4781679362e73a7f3398209bf66bdac09d9d9b72b683cd34b5b59978f7
Instruction ID: b466473257e1797a9f359e3027505953f4757f57d9fdd34cc3538d8d36484ad5
Opcode Fuzzy Hash: 12e0ff4781679362e73a7f3398209bf66bdac09d9d9b72b683cd34b5b59978f7
Instruction Fuzzy Hash: 92512C35A00205EFCF01EF64C991AAEBBF5EF08314B148099E90AAB361CB31ED51CF60

Function 00E3A2C5 Relevance: 7.6, APIs: 5, Instructions: 130COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2103545536.0000000000DB1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00DB0000, based on PE: true

Associated: 00000000.00000002.2103534640.0000000000DB0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103580373.0000000000E3F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103580373.0000000000E65000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103609603.0000000000E6F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103621893.0000000000E78000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_db0000_New Quotation - FE7191PO154.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9f2833a5bf7595430d5c91c021c9a8cdb47993e3afaed416f8234b1ce2b978d7
Instruction ID: 95077dcc18c1acab92651da464bc7f70426c608b0f8070d85f3dd692f2ea9fcf
Opcode Fuzzy Hash: 9f2833a5bf7595430d5c91c021c9a8cdb47993e3afaed416f8234b1ce2b978d7
Instruction Fuzzy Hash: E541EF35900208AFD724DB28CC4CFA9BFA9EB09314F181175E8A6B72E1C770AD81CA52

Function 00DB2344 Relevance: 7.6, APIs: 5, Instructions: 111keyboardCOMMON

Download Yara Rule

APIs

GetCursorPos.USER32(?), ref: 00DB2357
ScreenToClient.USER32(00E767B0,?), ref: 00DB2374
GetAsyncKeyState.USER32(00000001), ref: 00DB2399
GetAsyncKeyState.USER32(00000002), ref: 00DB23A7

Memory Dump Source

Source File: 00000000.00000002.2103545536.0000000000DB1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00DB0000, based on PE: true

Associated: 00000000.00000002.2103534640.0000000000DB0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103580373.0000000000E3F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103580373.0000000000E65000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103609603.0000000000E6F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103621893.0000000000E78000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_db0000_New Quotation - FE7191PO154.jbxd

Similarity

API ID: AsyncState$ClientCursorScreen
String ID:
API String ID: 4210589936-0
Opcode ID: 3270af895d9e2275ac30ffcec59ca27499aa10f5611479ddde64900b4f61a898
Instruction ID: 0933e746374b67cdf132fc3b0b180567ebd5283f5da4836b6790d4486c605b9e
Opcode Fuzzy Hash: 3270af895d9e2275ac30ffcec59ca27499aa10f5611479ddde64900b4f61a898
Instruction Fuzzy Hash: 55419E32904159FFCF159F69CC48AEDBBB4FB05320F20431AF829A22A0C7349994DBB1

Function 00E06920 Relevance: 7.6, APIs: 5, Instructions: 97windowCOMMON

Download Yara Rule

APIs

PeekMessageW.USER32(?,00000000,00000000,00000000,00000001), ref: 00E0695D
TranslateAcceleratorW.USER32(?,?,?), ref: 00E069A9
TranslateMessage.USER32(?), ref: 00E069D2
DispatchMessageW.USER32(?), ref: 00E069DC
PeekMessageW.USER32(?,00000000,00000000,00000000,00000001), ref: 00E069EB

Memory Dump Source

Source File: 00000000.00000002.2103545536.0000000000DB1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00DB0000, based on PE: true

Associated: 00000000.00000002.2103534640.0000000000DB0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103580373.0000000000E3F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103580373.0000000000E65000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103609603.0000000000E6F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103621893.0000000000E78000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_db0000_New Quotation - FE7191PO154.jbxd

Similarity

API ID: Message$PeekTranslate$AcceleratorDispatch
String ID:
API String ID: 2108273632-0
Opcode ID: 5cbc751be9bbca2e2e05e3f81890818e8243a859f821a02a231fc7c8ac33c57e
Instruction ID: 072466f90f0ce8453633c820fdff90539f9710a08bad91d6144e6497b3c975e3
Opcode Fuzzy Hash: 5cbc751be9bbca2e2e05e3f81890818e8243a859f821a02a231fc7c8ac33c57e
Instruction Fuzzy Hash: 4D31E231A00646AFDB64DFB5CC48FB67BBCAB41308F505169E425F24E1D73098E9D7A0

Function 00E08F01 Relevance: 7.6, APIs: 5, Instructions: 89sleepwindowCOMMON

Download Yara Rule

APIs

GetWindowRect.USER32(?,?), ref: 00E08F12
PostMessageW.USER32(?,00000201,00000001), ref: 00E08FBC
Sleep.KERNEL32(00000000,?,00000201,00000001,?,?,?), ref: 00E08FC4
PostMessageW.USER32(?,00000202,00000000), ref: 00E08FD2
Sleep.KERNEL32(00000000,?,00000202,00000000,?,?,00000201,00000001,?,?,?), ref: 00E08FDA

Memory Dump Source

Source File: 00000000.00000002.2103545536.0000000000DB1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00DB0000, based on PE: true

Associated: 00000000.00000002.2103534640.0000000000DB0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103580373.0000000000E3F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103580373.0000000000E65000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103609603.0000000000E6F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103621893.0000000000E78000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_db0000_New Quotation - FE7191PO154.jbxd

Similarity

API ID: MessagePostSleep$RectWindow
String ID:
API String ID: 3382505437-0
Opcode ID: 0c788482f4ba80a8a138db9ef83201392f1f0842cb41eb4c38870379f10b11ce
Instruction ID: 5c637152fcd0d7e4ea2d2eb97d3bcad4c5fd43030d2ef1f704c13a54c64484d5
Opcode Fuzzy Hash: 0c788482f4ba80a8a138db9ef83201392f1f0842cb41eb4c38870379f10b11ce
Instruction Fuzzy Hash: 0231E071A0021EEFDB14CF78DA4DA9E7BB6EB04315F104229F964E61D0C7B09954CB91

Function 00E0B6AF Relevance: 7.6, APIs: 5, Instructions: 88windowCOMMON

Download Yara Rule

APIs

IsWindowVisible.USER32(?), ref: 00E0B6C7
SendMessageW.USER32(?,0000000E,00000000,00000000), ref: 00E0B6E4
SendMessageW.USER32(?,0000000D,00000001,00000000), ref: 00E0B71C
CharUpperBuffW.USER32(00000000,00000000,?,?,?,?), ref: 00E0B742
_wcsstr.LIBCMT ref: 00E0B74C

Memory Dump Source

Source File: 00000000.00000002.2103545536.0000000000DB1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00DB0000, based on PE: true

Associated: 00000000.00000002.2103534640.0000000000DB0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103580373.0000000000E3F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103580373.0000000000E65000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103609603.0000000000E6F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103621893.0000000000E78000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_db0000_New Quotation - FE7191PO154.jbxd

Similarity

API ID: MessageSend$BuffCharUpperVisibleWindow_wcsstr
String ID:
API String ID: 3902887630-0
Opcode ID: 4ea6ccaf20474a810be3c067f0e19b359b1dd249204db34162d727da5af3d7d1
Instruction ID: 72e7ca973c432eb0bda57e1b7803a76436821ab85f43e656c10e7527315aee65
Opcode Fuzzy Hash: 4ea6ccaf20474a810be3c067f0e19b359b1dd249204db34162d727da5af3d7d1
Instruction Fuzzy Hash: CD21DA31604204BBEB155B35AC4AE7B7F9CEF45710F14512BF805EA2A1EB61DC8096B0

Function 00E3B405 Relevance: 7.6, APIs: 5, Instructions: 85COMMON

Download Yara Rule

APIs

Part of subcall function 00DB2612: GetWindowLongW.USER32(?,000000EB), ref: 00DB2623

GetWindowLongW.USER32(?,000000F0), ref: 00E3B44C
SetWindowLongW.USER32(00000000,000000F0,00000001), ref: 00E3B471
SetWindowLongW.USER32(00000000,000000EC,000000FF), ref: 00E3B489
GetSystemMetrics.USER32(00000004), ref: 00E3B4B2
SetWindowPos.USER32(00000000,00000000,00000000,00000000,00000000,00000000,00000047,?,?,?,?,?,?,?,00E21184,00000000), ref: 00E3B4D0

Memory Dump Source

Source File: 00000000.00000002.2103545536.0000000000DB1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00DB0000, based on PE: true

Associated: 00000000.00000002.2103534640.0000000000DB0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103580373.0000000000E3F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103580373.0000000000E65000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103609603.0000000000E6F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103621893.0000000000E78000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_db0000_New Quotation - FE7191PO154.jbxd

Similarity

API ID: Window$Long$MetricsSystem
String ID:
API String ID: 2294984445-0
Opcode ID: 6d1cb27f67bee57425d53c66b6a70441d73226ac8b61edf903f6a58d36dd4440
Instruction ID: 224e3a020364a5d4b30eff8770a1501d3ac80e86f9c1e1aa5a512cb54f384a14
Opcode Fuzzy Hash: 6d1cb27f67bee57425d53c66b6a70441d73226ac8b61edf903f6a58d36dd4440
Instruction Fuzzy Hash: 4B218031910655AFCB249F39DC0CA6A3FA4EB05729F105728FA37E61E2F7309854DB94

Function 00E097E9 Relevance: 7.6, APIs: 5, Instructions: 84windowCOMMON

Download Yara Rule

APIs

SendMessageW.USER32(?,00001004,00000000,00000000), ref: 00E09802

Part of subcall function 00DB7D2C: _memmove.LIBCMT ref: 00DB7D66

SendMessageW.USER32(?,0000102C,00000000,00000002), ref: 00E09834
__itow.LIBCMT ref: 00E0984C
SendMessageW.USER32(?,0000102C,00000000,00000002), ref: 00E09874
__itow.LIBCMT ref: 00E09885

Memory Dump Source

Source File: 00000000.00000002.2103545536.0000000000DB1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00DB0000, based on PE: true

Associated: 00000000.00000002.2103534640.0000000000DB0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103580373.0000000000E3F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103580373.0000000000E65000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103609603.0000000000E6F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103621893.0000000000E78000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_db0000_New Quotation - FE7191PO154.jbxd

Similarity

API ID: MessageSend$__itow$_memmove
String ID:
API String ID: 2983881199-0
Opcode ID: a50c306ab2f0dea50c78315b1c1d5ea091f9f7e328c2ae6c51621ce8194b215e
Instruction ID: 59c68c0d144264ec7ce570c32e19d2b94c015c6364f84f3862f38c7314997892
Opcode Fuzzy Hash: a50c306ab2f0dea50c78315b1c1d5ea091f9f7e328c2ae6c51621ce8194b215e
Instruction Fuzzy Hash: A0218631A00208ABDB149E659C8AEEE7BA9DF49714F045029F905BB393D6708D8597F1

Function 00DB12F3 Relevance: 7.6, APIs: 5, Instructions: 67COMMON

Download Yara Rule

APIs

ExtCreatePen.GDI32(?,?,00000000,00000000,00000000,?,00000000), ref: 00DB134D
SelectObject.GDI32(?,00000000), ref: 00DB135C
BeginPath.GDI32(?), ref: 00DB1373
SelectObject.GDI32(?,00000000), ref: 00DB139C

Memory Dump Source

Source File: 00000000.00000002.2103545536.0000000000DB1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00DB0000, based on PE: true

Associated: 00000000.00000002.2103534640.0000000000DB0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103580373.0000000000E3F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103580373.0000000000E65000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103609603.0000000000E6F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103621893.0000000000E78000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_db0000_New Quotation - FE7191PO154.jbxd

Similarity

API ID: ObjectSelect$BeginCreatePath
String ID:
API String ID: 3225163088-0
Opcode ID: 9c293d6bfd63072123d18f64ba3f7c94736701e2782ab1ffe9f6abdc75ed5904
Instruction ID: a3f37b7ccc084a091346e08493deae95aa727fca87d50e3dfcd199e53f124290
Opcode Fuzzy Hash: 9c293d6bfd63072123d18f64ba3f7c94736701e2782ab1ffe9f6abdc75ed5904
Instruction Fuzzy Hash: 4521A770800608DFEB14DF56EC497A93BF8F700325F584226F419A62A1D37198D9CFA1

Function 00E0C161 Relevance: 7.6, APIs: 5, Instructions: 61COMMON

Download Yara Rule

APIs

_memcmp.LIBCMT ref: 00E0C176
_memcmp.LIBCMT ref: 00E0C194
_memcmp.LIBCMT ref: 00E0C1A7
_memcmp.LIBCMT ref: 00E0C1BF
_memcmp.LIBCMT ref: 00E0C1D7

Memory Dump Source

Source File: 00000000.00000002.2103545536.0000000000DB1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00DB0000, based on PE: true

Associated: 00000000.00000002.2103534640.0000000000DB0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103580373.0000000000E3F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103580373.0000000000E65000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103609603.0000000000E6F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103621893.0000000000E78000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_db0000_New Quotation - FE7191PO154.jbxd

Similarity

API ID: _memcmp
String ID:
API String ID: 2931989736-0
Opcode ID: c72bffc031eb43c009dd575f54b34cde08bd880ef37948043590fe51bd5bfaa6
Instruction ID: 42fd04fdbc49850e2ade7c2d423d54f0a3a552adffd3d49746ddeb8d0504c7c1
Opcode Fuzzy Hash: c72bffc031eb43c009dd575f54b34cde08bd880ef37948043590fe51bd5bfaa6
Instruction Fuzzy Hash: 6B01B5B16062067BE204BB206C42FAB776DDF21398F645225FE04B73C3E661DE5582F0

Function 00E14D35 Relevance: 7.6, APIs: 5, Instructions: 56synchronizationthreadwindowCOMMON

Download Yara Rule

APIs

GetCurrentThreadId.KERNEL32 ref: 00E14D5C
__beginthreadex.LIBCMT ref: 00E14D7A
MessageBoxW.USER32(?,?,?,?), ref: 00E14D8F
WaitForSingleObject.KERNEL32(00000000,000000FF,?,?,?,?), ref: 00E14DA5
CloseHandle.KERNEL32(00000000,?,?,?,?), ref: 00E14DAC

Memory Dump Source

Source File: 00000000.00000002.2103545536.0000000000DB1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00DB0000, based on PE: true

Associated: 00000000.00000002.2103534640.0000000000DB0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103580373.0000000000E3F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103580373.0000000000E65000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103609603.0000000000E6F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103621893.0000000000E78000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_db0000_New Quotation - FE7191PO154.jbxd

Similarity

API ID: CloseCurrentHandleMessageObjectSingleThreadWait__beginthreadex
String ID:
API String ID: 3824534824-0
Opcode ID: a24aa4a890436130fd8ec079737fd2c675c60c2304faed2a8c9490ca7cafb7fb
Instruction ID: 80f0c8c37e3c823e83386e72f91a53ce767d338e2889cf8609f095140e88d257
Opcode Fuzzy Hash: a24aa4a890436130fd8ec079737fd2c675c60c2304faed2a8c9490ca7cafb7fb
Instruction Fuzzy Hash: B31100B2D04648BFC701DB69AC08ADA7FACEB45314F144269F918F33A1D6718D8887A0

Function 00E0874A Relevance: 7.5, APIs: 5, Instructions: 49memoryCOMMON

Download Yara Rule

APIs

GetUserObjectSecurity.USER32(?,00000004,?,00000000,?), ref: 00E08766
GetLastError.KERNEL32(?,00E0822A,?,?,?), ref: 00E08770
GetProcessHeap.KERNEL32(00000008,?,?,00E0822A,?,?,?), ref: 00E0877F
HeapAlloc.KERNEL32(00000000,?,00E0822A,?,?,?), ref: 00E08786
GetUserObjectSecurity.USER32(?,00000004,00000000,?,?), ref: 00E0879D

Memory Dump Source

Source File: 00000000.00000002.2103545536.0000000000DB1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00DB0000, based on PE: true

Associated: 00000000.00000002.2103534640.0000000000DB0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103580373.0000000000E3F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103580373.0000000000E65000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103609603.0000000000E6F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103621893.0000000000E78000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_db0000_New Quotation - FE7191PO154.jbxd

Similarity

API ID: HeapObjectSecurityUser$AllocErrorLastProcess
String ID:
API String ID: 842720411-0
Opcode ID: 38005135557878f4d9447a2c5f4d8a648086f32f42d214bcf0cbaf7e6484cb81
Instruction ID: c29f5841da7fcdd79582df4bcbd4d46be5fb4914e0493b200c9dbe2cfad49cdf
Opcode Fuzzy Hash: 38005135557878f4d9447a2c5f4d8a648086f32f42d214bcf0cbaf7e6484cb81
Instruction Fuzzy Hash: 8E014F71A01218EFDB104FA6DD4CD677F6CEF853557200429F849E2160DA318C44CA60

Function 00E154E6 Relevance: 7.5, APIs: 5, Instructions: 48sleepCOMMON

Download Yara Rule

APIs

QueryPerformanceCounter.KERNEL32(?,00000000,?,?,?,?,?,?,?,?,?,?), ref: 00E15502
QueryPerformanceFrequency.KERNEL32(?,?,?,?,?,?,?,?,?,?,?), ref: 00E15510
Sleep.KERNEL32(00000000,?,?,?,?,?,?,?,?,?,?), ref: 00E15518
QueryPerformanceCounter.KERNEL32(?,?,?,?,?,?,?,?,?,?,?), ref: 00E15522
Sleep.KERNEL32(?,00000000,?,?,?,?,?,?,?,?,?,?), ref: 00E1555E

Memory Dump Source

Source File: 00000000.00000002.2103545536.0000000000DB1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00DB0000, based on PE: true

Associated: 00000000.00000002.2103534640.0000000000DB0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103580373.0000000000E3F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103580373.0000000000E65000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103609603.0000000000E6F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103621893.0000000000E78000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_db0000_New Quotation - FE7191PO154.jbxd

Similarity

API ID: PerformanceQuery$CounterSleep$Frequency
String ID:
API String ID: 2833360925-0
Opcode ID: d5c8725a7483e7f9e3fadc8bc64430b47eb576b1462d61ebc158c2b40eef26d4
Instruction ID: 2d70082c8cc162652331a027405680f71340d9a3bfa966d7b1f6434f08d80e4a
Opcode Fuzzy Hash: d5c8725a7483e7f9e3fadc8bc64430b47eb576b1462d61ebc158c2b40eef26d4
Instruction Fuzzy Hash: 06015B76C01A1DDBCF00EFE9E8885EDBB7AFB49711F000056E841B2150DB305598C7A1

Function 00E07652 Relevance: 7.5, APIs: 5, Instructions: 48stringCOMMON

Download Yara Rule

APIs

CLSIDFromProgID.OLE32(?,?,00000000,?,00000000,?,?,-C0000018,00000001,?,00E0758C,80070057,?,?,?,00E0799D), ref: 00E0766F
ProgIDFromCLSID.OLE32(?,00000000,?,?,00000000,?,00000000,?,?,-C0000018,00000001,?,00E0758C,80070057,?,?), ref: 00E0768A
lstrcmpiW.KERNEL32(?,00000000,?,?,00000000,?,00000000,?,?,-C0000018,00000001,?,00E0758C,80070057,?,?), ref: 00E07698
CoTaskMemFree.OLE32(00000000,?,00000000,?,?,00000000,?,00000000,?,?,-C0000018,00000001,?,00E0758C,80070057,?), ref: 00E076A8
CLSIDFromString.OLE32(?,?,?,?,00000000,?,00000000,?,?,-C0000018,00000001,?,00E0758C,80070057,?,?), ref: 00E076B4

Memory Dump Source

Source File: 00000000.00000002.2103545536.0000000000DB1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00DB0000, based on PE: true

Associated: 00000000.00000002.2103534640.0000000000DB0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103580373.0000000000E3F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103580373.0000000000E65000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103609603.0000000000E6F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103621893.0000000000E78000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_db0000_New Quotation - FE7191PO154.jbxd

Similarity

API ID: From$Prog$FreeStringTasklstrcmpi
String ID:
API String ID: 3897988419-0
Opcode ID: 02b64753237f0acf5458f2337c9ef2119dfc527e4478a2431ecdf5694b95283e
Instruction ID: 68ad4f0dbf272d1dcd31799c22e37b5da5d8f1ce70c95c4aa0195b4fad0134e5
Opcode Fuzzy Hash: 02b64753237f0acf5458f2337c9ef2119dfc527e4478a2431ecdf5694b95283e
Instruction Fuzzy Hash: 2201D876E00608BFDB144F19EC08B9A7FACEB44751F100025FD45E2251EB32ED8087B0

Function 00E085F1 Relevance: 7.5, APIs: 5, Instructions: 45memoryCOMMON

Download Yara Rule

APIs

GetTokenInformation.ADVAPI32(?,00000002,?,00000000,?), ref: 00E08608
GetLastError.KERNEL32(?,00000002,?,00000000,?), ref: 00E08612
GetProcessHeap.KERNEL32(00000008,?,?,00000002,?,00000000,?), ref: 00E08621
HeapAlloc.KERNEL32(00000000,?,00000002,?,00000000,?), ref: 00E08628
GetTokenInformation.ADVAPI32(?,00000002,00000000,?,?,?,00000002,?,00000000,?), ref: 00E0863E

Memory Dump Source

Source File: 00000000.00000002.2103545536.0000000000DB1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00DB0000, based on PE: true

Associated: 00000000.00000002.2103534640.0000000000DB0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103580373.0000000000E3F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103580373.0000000000E65000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103609603.0000000000E6F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103621893.0000000000E78000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_db0000_New Quotation - FE7191PO154.jbxd

Similarity

API ID: HeapInformationToken$AllocErrorLastProcess
String ID:
API String ID: 44706859-0
Opcode ID: 85a5c3b49db48e78a4530b99cc8f293ee8f20f8b3bb310b2e9b2b079279a0ac4
Instruction ID: 9b7fbd8be16bbfa5e8de1109c20dbdf568638747eab93aa22adb740bd588deeb
Opcode Fuzzy Hash: 85a5c3b49db48e78a4530b99cc8f293ee8f20f8b3bb310b2e9b2b079279a0ac4
Instruction Fuzzy Hash: 7FF06831601208AFDB100FA5ED8DE6B3FACEF45758B011425F545E6190CB72DC49DA60

Function 00E08652 Relevance: 7.5, APIs: 5, Instructions: 45memoryCOMMON

Download Yara Rule

APIs

GetTokenInformation.ADVAPI32(?,00000003(TokenIntegrityLevel),?,00000000,?), ref: 00E08669
GetLastError.KERNEL32(?,TokenIntegrityLevel,?,00000000,?), ref: 00E08673
GetProcessHeap.KERNEL32(00000008,?,?,TokenIntegrityLevel,?,00000000,?), ref: 00E08682
HeapAlloc.KERNEL32(00000000,?,TokenIntegrityLevel,?,00000000,?), ref: 00E08689
GetTokenInformation.ADVAPI32(?,00000003(TokenIntegrityLevel),00000000,?,?,?,TokenIntegrityLevel,?,00000000,?), ref: 00E0869F

Memory Dump Source

Source File: 00000000.00000002.2103545536.0000000000DB1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00DB0000, based on PE: true

Associated: 00000000.00000002.2103534640.0000000000DB0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103580373.0000000000E3F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103580373.0000000000E65000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103609603.0000000000E6F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103621893.0000000000E78000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_db0000_New Quotation - FE7191PO154.jbxd

Similarity

API ID: HeapInformationToken$AllocErrorLastProcess
String ID:
API String ID: 44706859-0
Opcode ID: c49aacbc82066b828830e8a19a55e2e880ba1483506d36b4f7c35d54cbf92a23
Instruction ID: cecea835658f839b70193882a1fe2f12c9cdf962371b3a535bb481e0406b3adc
Opcode Fuzzy Hash: c49aacbc82066b828830e8a19a55e2e880ba1483506d36b4f7c35d54cbf92a23
Instruction Fuzzy Hash: 6AF04F71601208AFEB111FA6EC8CE673FACEF89758B110035F985E61A0CA72D949DE60

Function 00E0C6A6 Relevance: 7.5, APIs: 5, Instructions: 41windowtimeCOMMON

Download Yara Rule

APIs

GetDlgItem.USER32(?,000003E9), ref: 00E0C6BA
GetWindowTextW.USER32(00000000,?,00000100), ref: 00E0C6D1
MessageBeep.USER32(00000000), ref: 00E0C6E9
KillTimer.USER32(?,0000040A), ref: 00E0C705
EndDialog.USER32(?,00000001), ref: 00E0C71F

Memory Dump Source

Source File: 00000000.00000002.2103545536.0000000000DB1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00DB0000, based on PE: true

Associated: 00000000.00000002.2103534640.0000000000DB0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103580373.0000000000E3F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103580373.0000000000E65000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103609603.0000000000E6F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103621893.0000000000E78000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_db0000_New Quotation - FE7191PO154.jbxd

Similarity

API ID: BeepDialogItemKillMessageTextTimerWindow
String ID:
API String ID: 3741023627-0
Opcode ID: 85c4781cddf77d67a8932fbfc23746c6603ff34104a97956c9487bf5574a5577
Instruction ID: b5bad943b301aa43b133b0645ea225ab2b08046772320c197d7992ae179e1c51
Opcode Fuzzy Hash: 85c4781cddf77d67a8932fbfc23746c6603ff34104a97956c9487bf5574a5577
Instruction Fuzzy Hash: 0801A230800708EBEB305B21ED4EF967BB8FF04B05F14166AF542B10E0DBE0A9988F90

Function 00DB13B0 Relevance: 7.5, APIs: 5, Instructions: 29COMMON

Download Yara Rule

APIs

EndPath.GDI32(?), ref: 00DB13BF
StrokeAndFillPath.GDI32(?,?,00DEBAD8,00000000,?), ref: 00DB13DB
SelectObject.GDI32(?,00000000), ref: 00DB13EE
DeleteObject.GDI32 ref: 00DB1401
StrokePath.GDI32(?), ref: 00DB141C

Memory Dump Source

Source File: 00000000.00000002.2103545536.0000000000DB1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00DB0000, based on PE: true

Associated: 00000000.00000002.2103534640.0000000000DB0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103580373.0000000000E3F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103580373.0000000000E65000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103609603.0000000000E6F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103621893.0000000000E78000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_db0000_New Quotation - FE7191PO154.jbxd

Similarity

API ID: Path$ObjectStroke$DeleteFillSelect
String ID:
API String ID: 2625713937-0
Opcode ID: 16e6b1fa69fd1f6691f1b2ccde067634f2a265b915da4799e09c23943e812113
Instruction ID: a50289fd986c533b9749722dd4957c22ac63264684434ea238ce31de910e6e99
Opcode Fuzzy Hash: 16e6b1fa69fd1f6691f1b2ccde067634f2a265b915da4799e09c23943e812113
Instruction Fuzzy Hash: 30F01D34000A08DFEB199F1BED4C7943FA4A70132AF488224E42A680F6C73145ADDF21

Function 00E1C602 Relevance: 7.3, APIs: 3, Strings: 1, Instructions: 279comCOMMON

Download Yara Rule

APIs

CoInitialize.OLE32(00000000), ref: 00E1C69D
CoCreateInstance.OLE32(00E42D6C,00000000,00000001,00E42BDC,?), ref: 00E1C6B5

Part of subcall function 00DB7F41: _memmove.LIBCMT ref: 00DB7F82

CoUninitialize.OLE32 ref: 00E1C922

Strings

.lnk, xrefs: 00E1C631, 00E1C659, 00E1C663

Memory Dump Source

Source File: 00000000.00000002.2103545536.0000000000DB1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00DB0000, based on PE: true

Associated: 00000000.00000002.2103534640.0000000000DB0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103580373.0000000000E3F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103580373.0000000000E65000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103609603.0000000000E6F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103621893.0000000000E78000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_db0000_New Quotation - FE7191PO154.jbxd

Similarity

API ID: CreateInitializeInstanceUninitialize_memmove
String ID: .lnk
API String ID: 2683427295-24824748
Opcode ID: 3e165451ad55f94af9805407f122630c565dea04c932604baf8131bd1b92001c
Instruction ID: 56f6c4de30d27339d12c60a2bdda9b997d14bb4de48f197b4eae920dbb93c490
Opcode Fuzzy Hash: 3e165451ad55f94af9805407f122630c565dea04c932604baf8131bd1b92001c
Instruction Fuzzy Hash: 95A12B71104245AFD704EF54C891EABB7ECEF99704F00491CF296A72A2DB70EA49CB72

Function 00DC2E5B Relevance: 7.3, APIs: 3, Strings: 1, Instructions: 265COMMON

Download Yara Rule

APIs

Part of subcall function 00DD0FF6: std::exception::exception.LIBCMT ref: 00DD102C
Part of subcall function 00DD0FF6: __CxxThrowException@8.LIBCMT ref: 00DD1041

Part of subcall function 00DB7F41: _memmove.LIBCMT ref: 00DB7F82

Part of subcall function 00DB7BB1: _memmove.LIBCMT ref: 00DB7C0B

__swprintf.LIBCMT ref: 00DC302D

Strings

\\[\\nrt]|%%|%[-+ 0#]?([0-9]*|\*)?(\.[0-9]*|\.\*)?[hlL]?[diouxXeEfgGs], xrefs: 00DC2EC6

Memory Dump Source

Source File: 00000000.00000002.2103545536.0000000000DB1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00DB0000, based on PE: true

Associated: 00000000.00000002.2103534640.0000000000DB0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103580373.0000000000E3F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103580373.0000000000E65000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103609603.0000000000E6F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103621893.0000000000E78000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_db0000_New Quotation - FE7191PO154.jbxd

Similarity

API ID: _memmove$Exception@8Throw__swprintfstd::exception::exception
String ID: \\[\\nrt]|%%|%[-+ 0#]?([0-9]*|\*)?(\.[0-9]*|\.\*)?[hlL]?[diouxXeEfgGs]
API String ID: 1943609520-557222456
Opcode ID: ba04162ff07be62e49add61eb7223e1f8705052ff2cc0110d32d221fb3790812
Instruction ID: 8a6b2ecee27a5b8877f1d5da2ed0266fb7efbddc99dba9c662eaf9bb6fc5cfd8
Opcode Fuzzy Hash: ba04162ff07be62e49add61eb7223e1f8705052ff2cc0110d32d221fb3790812
Instruction Fuzzy Hash: 65917F72108306DFCB18EF24D895DBEB7A4EF95740F04891EF586972A1DA20EE44DB72

Function 00E1BBA6 Relevance: 7.3, APIs: 3, Strings: 1, Instructions: 261comCOMMON

Download Yara Rule

APIs

Part of subcall function 00DB48AE: GetFullPathNameW.KERNEL32(?,00007FFF,?,00000000,?,?,00DB48A1,?,?,00DB37C0,?), ref: 00DB48CE

CoInitialize.OLE32(00000000), ref: 00E1BC26
CoCreateInstance.OLE32(00E42D6C,00000000,00000001,00E42BDC,?), ref: 00E1BC3F
CoUninitialize.OLE32 ref: 00E1BC5C

Part of subcall function 00DB9997: __itow.LIBCMT ref: 00DB99C2
Part of subcall function 00DB9997: __swprintf.LIBCMT ref: 00DB9A0C

Strings

.lnk, xrefs: 00E1BC08, 00E1BC16

Memory Dump Source

Source File: 00000000.00000002.2103545536.0000000000DB1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00DB0000, based on PE: true

Associated: 00000000.00000002.2103534640.0000000000DB0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103580373.0000000000E3F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103580373.0000000000E65000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103609603.0000000000E6F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103621893.0000000000E78000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_db0000_New Quotation - FE7191PO154.jbxd

Similarity

API ID: CreateFullInitializeInstanceNamePathUninitialize__itow__swprintf
String ID: .lnk
API String ID: 2126378814-24824748
Opcode ID: 8ee184025ccb94ad33eea76cfe28427b479a8e454e634ec21c745fd67b86a3c5
Instruction ID: 0fa6253004dada0500417722474353a2616405512516fdd674cfefd58770e3fc
Opcode Fuzzy Hash: 8ee184025ccb94ad33eea76cfe28427b479a8e454e634ec21c745fd67b86a3c5
Instruction Fuzzy Hash: 69A155756043419FCB04DF24C494DAABBE5FF88314F048998F99AAB3A1CB31ED45CBA1

Function 00E0B7B6 Relevance: 7.2, APIs: 1, Strings: 3, Instructions: 241comCOMMON

Download Yara Rule

APIs

OleSetContainedObject.OLE32(?,00000001), ref: 00E0B981

Strings

%, xrefs: 00E0BA24
AutoIt3GUI, xrefs: 00E0B8F9
Container, xrefs: 00E0B8FE

Memory Dump Source

Source File: 00000000.00000002.2103545536.0000000000DB1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00DB0000, based on PE: true

Associated: 00000000.00000002.2103534640.0000000000DB0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103580373.0000000000E3F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103580373.0000000000E65000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103609603.0000000000E6F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103621893.0000000000E78000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_db0000_New Quotation - FE7191PO154.jbxd

Similarity

API ID: ContainedObject
String ID: AutoIt3GUI$Container$%
API String ID: 3565006973-1286912533
Opcode ID: 91a89f171ca516a5df012497785ae2bdcd914c566340e78e53d0dac18bf24c3c
Instruction ID: a614f0d06f40200a5a3fa0f1b1e0bc18edc7671142a051a18cf68eddac18d2ae
Opcode Fuzzy Hash: 91a89f171ca516a5df012497785ae2bdcd914c566340e78e53d0dac18bf24c3c
Instruction Fuzzy Hash: 22914D706006019FDB14CF68C885A66BBF9FF48714F14956EF946EB7A1DB70E884CB60

Function 00DD524D Relevance: 7.2, APIs: 3, Strings: 1, Instructions: 180COMMON

Download Yara Rule

APIs

__startOneArgErrorHandling.LIBCMT ref: 00DD52DD

Part of subcall function 00DE0340: __87except.LIBCMT ref: 00DE037B

Strings

pow, xrefs: 00DD52B5, 00DD52D2

Memory Dump Source

Source File: 00000000.00000002.2103545536.0000000000DB1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00DB0000, based on PE: true

Associated: 00000000.00000002.2103534640.0000000000DB0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103580373.0000000000E3F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103580373.0000000000E65000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103609603.0000000000E6F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103621893.0000000000E78000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_db0000_New Quotation - FE7191PO154.jbxd

Similarity

API ID: ErrorHandling__87except__start
String ID: pow
API String ID: 2905807303-2276729525
Opcode ID: c3afb6c6d015775e78520b4753481723b86bd3f346b0425dde08973f10223620
Instruction ID: 67293acdf230238e62dcc676d524aab9bedcc7872982a9be5133b58091bd5969
Opcode Fuzzy Hash: c3afb6c6d015775e78520b4753481723b86bd3f346b0425dde08973f10223620
Instruction Fuzzy Hash: 68516A61A0CA418BC711B726EA4137E6F94DB40750F284D5AE0D5823EDEFB4CCD8DAB6

Function 00DD023B Relevance: 7.2, APIs: 2, Strings: 2, Instructions: 163COMMON

Download Yara Rule

Strings

#, xrefs: 00DD0280
+, xrefs: 00DD0277

Memory Dump Source

Source File: 00000000.00000002.2103545536.0000000000DB1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00DB0000, based on PE: true

Associated: 00000000.00000002.2103534640.0000000000DB0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103580373.0000000000E3F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103580373.0000000000E65000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103609603.0000000000E6F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103621893.0000000000E78000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_db0000_New Quotation - FE7191PO154.jbxd

Similarity

API ID:
String ID: #$+
API String ID: 0-2552117581
Opcode ID: 2b5bc97389c27a16f5b4f8c0884378c9b9c93af3c9f05a4637d7c8a4bcf7a182
Instruction ID: 5f34d983f8bf0dfc812edae2e844e1258d9fb1868665536670dbd9f1ca620373
Opcode Fuzzy Hash: 2b5bc97389c27a16f5b4f8c0884378c9b9c93af3c9f05a4637d7c8a4bcf7a182
Instruction Fuzzy Hash: 4F511176504646DFDF159F28C4886FB7BA8EF95314F184056E891AB2E0D7309C86CB71

Function 00DC62F2 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 143COMMON

Download Yara Rule

APIs

_memset.LIBCMT ref: 00DC63A8
_memmove.LIBCMT ref: 00DC6446
_memset.LIBCMT ref: 00DC646A

Strings

ERCP, xrefs: 00DC6313

Memory Dump Source

Source File: 00000000.00000002.2103545536.0000000000DB1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00DB0000, based on PE: true

Associated: 00000000.00000002.2103534640.0000000000DB0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103580373.0000000000E3F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103580373.0000000000E65000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103609603.0000000000E6F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103621893.0000000000E78000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_db0000_New Quotation - FE7191PO154.jbxd

Similarity

API ID: _memset$_memmove
String ID: ERCP
API String ID: 2532777613-1384759551
Opcode ID: 3c739e1e50850b31d5e3f5e16891ff6fd6ca0dd112556299824bb9951e0da131
Instruction ID: 23153239b309fae3f60a968778b770a1075f2cc71a9835bdd44f7a7202fef203
Opcode Fuzzy Hash: 3c739e1e50850b31d5e3f5e16891ff6fd6ca0dd112556299824bb9951e0da131
Instruction Fuzzy Hash: 4651D57190430ADFCB28CF65C881BAABBF4EF44314F24856EE54ADB281E771D584CB60

Function 00E37BB5 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 110COMMON

Download Yara Rule

APIs

SetWindowPos.USER32(00000000,00000000,00000000,00000000,00000000,00000000,00000013,?,?,SysTreeView32,00E3F910,00000000,?,?,?,?), ref: 00E37C4E
GetWindowLongW.USER32 ref: 00E37C6B
SetWindowLongW.USER32(?,000000F0,00000000), ref: 00E37C7B

Strings

SysTreeView32, xrefs: 00E37C20

Memory Dump Source

Source File: 00000000.00000002.2103545536.0000000000DB1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00DB0000, based on PE: true

Associated: 00000000.00000002.2103534640.0000000000DB0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103580373.0000000000E3F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103580373.0000000000E65000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103609603.0000000000E6F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103621893.0000000000E78000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_db0000_New Quotation - FE7191PO154.jbxd

Similarity

API ID: Window$Long
String ID: SysTreeView32
API String ID: 847901565-1698111956
Opcode ID: 39aec043e9a5594ee14a56636f8a268721d871ac7854f46427ae8601bc80f7b9
Instruction ID: 30b5adcf8690f07dca61d10de27a5173f40c5a4b8bdc66d2fc788a024aab931e
Opcode Fuzzy Hash: 39aec043e9a5594ee14a56636f8a268721d871ac7854f46427ae8601bc80f7b9
Instruction Fuzzy Hash: E631A271604205AFDB258E34DC49BE6BBA9EB49328F205725F8B5A32E0D731E850DB60

Function 00E37648 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 90windowCOMMON

Download Yara Rule

APIs

SendMessageW.USER32(00000000,00001009,00000000,?), ref: 00E376D0
SetWindowPos.USER32(?,00000000,?,?,?,?,00000004), ref: 00E376E4
SendMessageW.USER32(?,00001002,00000000,?), ref: 00E37708

Strings

SysMonthCal32, xrefs: 00E3769B

Memory Dump Source

Source File: 00000000.00000002.2103545536.0000000000DB1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00DB0000, based on PE: true

Associated: 00000000.00000002.2103534640.0000000000DB0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103580373.0000000000E3F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103580373.0000000000E65000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103609603.0000000000E6F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103621893.0000000000E78000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_db0000_New Quotation - FE7191PO154.jbxd

Similarity

API ID: MessageSend$Window
String ID: SysMonthCal32
API String ID: 2326795674-1439706946
Opcode ID: ec76e7e593aedffe6f258319746f9bbfec6b4005dc7bd5e31719e0a7f68d9b6a
Instruction ID: 5407188ad50c91866dd9059aec73d21d248e9aeef569af2cf2f995776e982818
Opcode Fuzzy Hash: ec76e7e593aedffe6f258319746f9bbfec6b4005dc7bd5e31719e0a7f68d9b6a
Instruction Fuzzy Hash: EE21B132500219ABDF25CE54CC46FEA3FA9EB48754F111214FE557B1D0D6B1A854CBA0

Function 00E36F1F Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 84windowCOMMON

Download Yara Rule

APIs

SendMessageW.USER32(00000000,00000180,00000000,?), ref: 00E36FAA
SendMessageW.USER32(?,00000186,00000000,00000000), ref: 00E36FBA
MoveWindow.USER32(?,?,?,?,?,00000000,?,?,Listbox,00000000,00000000,?,?,?,?,?), ref: 00E36FDF

Strings

Listbox, xrefs: 00E36F77

Memory Dump Source

Source File: 00000000.00000002.2103545536.0000000000DB1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00DB0000, based on PE: true

Associated: 00000000.00000002.2103534640.0000000000DB0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103580373.0000000000E3F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103580373.0000000000E65000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103609603.0000000000E6F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103621893.0000000000E78000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_db0000_New Quotation - FE7191PO154.jbxd

Similarity

API ID: MessageSend$MoveWindow
String ID: Listbox
API String ID: 3315199576-2633736733
Opcode ID: 06a70e7ed64e634be158ac8c3659d247a515609446fff475971c0ad98e8cfc73
Instruction ID: b1ffe0e0d87b47ffabbad8cf0d167ccc2c48665661dd58c1adc82985020f22ed
Opcode Fuzzy Hash: 06a70e7ed64e634be158ac8c3659d247a515609446fff475971c0ad98e8cfc73
Instruction Fuzzy Hash: A4219532710118BFDF158F64DC89EEB3BAAEF89758F119124F915A7190C671AC51C7A0

Function 00E3797D Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 66windowCOMMON

Download Yara Rule

APIs

SendMessageW.USER32(00000000,00000405,00000000,00000000), ref: 00E379E1
SendMessageW.USER32(?,00000406,00000000,00640000), ref: 00E379F6
SendMessageW.USER32(?,00000414,0000000A,00000000), ref: 00E37A03

Strings

msctls_trackbar32, xrefs: 00E379B8

Memory Dump Source

Source File: 00000000.00000002.2103545536.0000000000DB1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00DB0000, based on PE: true

Associated: 00000000.00000002.2103534640.0000000000DB0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103580373.0000000000E3F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103580373.0000000000E65000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103609603.0000000000E6F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103621893.0000000000E78000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_db0000_New Quotation - FE7191PO154.jbxd

Similarity

API ID: MessageSend
String ID: msctls_trackbar32
API String ID: 3850602802-1010561917
Opcode ID: a4f888693ed35bda8a9ee7ee5f7663a38a1a02bd115e407e871d393ae119e697
Instruction ID: 4e8181424f9761b12b04a0c354f4c67ec9fc408fff219ecd72cb33cfced29049
Opcode Fuzzy Hash: a4f888693ed35bda8a9ee7ee5f7663a38a1a02bd115e407e871d393ae119e697
Instruction Fuzzy Hash: 7811E772244208BFDF249F65CC09FEB3BA9EF89768F021619F645B6090D2719851DB60

Function 00DB4C95 Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 18libraryloaderCOMMON

Download Yara Rule

APIs

LoadLibraryA.KERNEL32(kernel32.dll,?,00DB4C2E), ref: 00DB4CA3
GetProcAddress.KERNEL32(00000000,GetNativeSystemInfo), ref: 00DB4CB5

Strings

GetNativeSystemInfo, xrefs: 00DB4CAF
kernel32.dll, xrefs: 00DB4C9E

Memory Dump Source

Source File: 00000000.00000002.2103545536.0000000000DB1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00DB0000, based on PE: true

Associated: 00000000.00000002.2103534640.0000000000DB0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103580373.0000000000E3F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103580373.0000000000E65000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103609603.0000000000E6F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103621893.0000000000E78000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_db0000_New Quotation - FE7191PO154.jbxd

Similarity

API ID: AddressLibraryLoadProc
String ID: GetNativeSystemInfo$kernel32.dll
API String ID: 2574300362-192647395
Opcode ID: 5c472c6848a3d7196948614f5c32314c745c3fa319a70cc0c7d68673d4fe195d
Instruction ID: fb7b67a936d708b5342fbcadce09d475040837655c6d139253e4031404844068
Opcode Fuzzy Hash: 5c472c6848a3d7196948614f5c32314c745c3fa319a70cc0c7d68673d4fe195d
Instruction Fuzzy Hash: 28D0127091172BDFD7209F31D91C646BED5AF05B51F158839D886E6161DB70D480C660

Function 00DB4D94 Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 18libraryloaderCOMMON

Download Yara Rule

APIs

LoadLibraryA.KERNEL32(kernel32.dll,?,00DB4CE1,?), ref: 00DB4DA2
GetProcAddress.KERNEL32(00000000,Wow64RevertWow64FsRedirection), ref: 00DB4DB4

Strings

kernel32.dll, xrefs: 00DB4D9D
Wow64RevertWow64FsRedirection, xrefs: 00DB4DAE

Memory Dump Source

Source File: 00000000.00000002.2103545536.0000000000DB1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00DB0000, based on PE: true

Associated: 00000000.00000002.2103534640.0000000000DB0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103580373.0000000000E3F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103580373.0000000000E65000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103609603.0000000000E6F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103621893.0000000000E78000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_db0000_New Quotation - FE7191PO154.jbxd

Similarity

API ID: AddressLibraryLoadProc
String ID: Wow64RevertWow64FsRedirection$kernel32.dll
API String ID: 2574300362-1355242751
Opcode ID: d4e2bd49982a3676211bfa130d782291ceea5158571429a2fbf87ff8f8c5512d
Instruction ID: 30a31a7d4d73eb7f94c2fa8b5dde500da58623d9dd94056c6e809ea247973159
Opcode Fuzzy Hash: d4e2bd49982a3676211bfa130d782291ceea5158571429a2fbf87ff8f8c5512d
Instruction Fuzzy Hash: 92D05E71950713CFDB209F32E80CA86BAE4AF053A5F15C83ED8D6E6161EB70D880CA60

Function 00DB4D61 Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 18libraryloaderCOMMON

Download Yara Rule

APIs

LoadLibraryA.KERNEL32(kernel32.dll,?,00DB4D2E,?,00DB4F4F,?,00E762F8,00000001,>>>AUTOIT NO CMDEXECUTE<<<,?), ref: 00DB4D6F
GetProcAddress.KERNEL32(00000000,Wow64DisableWow64FsRedirection), ref: 00DB4D81

Strings

kernel32.dll, xrefs: 00DB4D6A
Wow64DisableWow64FsRedirection, xrefs: 00DB4D7B

Memory Dump Source

Source File: 00000000.00000002.2103545536.0000000000DB1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00DB0000, based on PE: true

Associated: 00000000.00000002.2103534640.0000000000DB0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103580373.0000000000E3F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103580373.0000000000E65000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103609603.0000000000E6F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103621893.0000000000E78000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_db0000_New Quotation - FE7191PO154.jbxd

Similarity

API ID: AddressLibraryLoadProc
String ID: Wow64DisableWow64FsRedirection$kernel32.dll
API String ID: 2574300362-3689287502
Opcode ID: 44ca4c90df0c48dae321e3103f53e6d2e13cac8a938d2bb5dbe65bd937ff990a
Instruction ID: 23ae7c6acf7d6cde27ca5d995446e426b8fe276a08bdbb46fc786c88791ab16b
Opcode Fuzzy Hash: 44ca4c90df0c48dae321e3103f53e6d2e13cac8a938d2bb5dbe65bd937ff990a
Instruction Fuzzy Hash: F9D01770910713CFDB209F32E80C656BAE8AF15392B19893AD487E6261E670D880CA60

Function 00E31072 Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 18libraryloaderCOMMON

Download Yara Rule

APIs

LoadLibraryA.KERNEL32(advapi32.dll,?,00E312C1), ref: 00E31080
GetProcAddress.KERNEL32(00000000,RegDeleteKeyExW), ref: 00E31092

Strings

advapi32.dll, xrefs: 00E3107B
RegDeleteKeyExW, xrefs: 00E3108C

Memory Dump Source

Source File: 00000000.00000002.2103545536.0000000000DB1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00DB0000, based on PE: true

Associated: 00000000.00000002.2103534640.0000000000DB0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103580373.0000000000E3F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103580373.0000000000E65000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103609603.0000000000E6F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103621893.0000000000E78000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_db0000_New Quotation - FE7191PO154.jbxd

Similarity

API ID: AddressLibraryLoadProc
String ID: RegDeleteKeyExW$advapi32.dll
API String ID: 2574300362-4033151799
Opcode ID: 9ba8bfd20c66c26ac0a1028da666b105965be15835d8a22bdfb46fe04620d3e0
Instruction ID: 621ebe4d5f9b82f83797cdd26804929e1f91b15c7cd84fc65b2f58b3e35f25e8
Opcode Fuzzy Hash: 9ba8bfd20c66c26ac0a1028da666b105965be15835d8a22bdfb46fe04620d3e0
Instruction Fuzzy Hash: 81D0E230950712CFD7209B36E82CA1A7AE4AF153A5B11986EE48AEA160E770C8C0CA50

Function 00E293F5 Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 18libraryloaderCOMMON

Download Yara Rule

APIs

LoadLibraryA.KERNEL32(kernel32.dll,00000001,00E29009,?,00E3F910), ref: 00E29403
GetProcAddress.KERNEL32(00000000,GetModuleHandleExW), ref: 00E29415

Strings

kernel32.dll, xrefs: 00E293FE
GetModuleHandleExW, xrefs: 00E2940F

Memory Dump Source

Source File: 00000000.00000002.2103545536.0000000000DB1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00DB0000, based on PE: true

Associated: 00000000.00000002.2103534640.0000000000DB0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103580373.0000000000E3F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103580373.0000000000E65000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103609603.0000000000E6F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103621893.0000000000E78000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_db0000_New Quotation - FE7191PO154.jbxd

Similarity

API ID: AddressLibraryLoadProc
String ID: GetModuleHandleExW$kernel32.dll
API String ID: 2574300362-199464113
Opcode ID: d4a90f286c280548f6182e431376c88c66c2136b12caedd788cd76e230970bb9
Instruction ID: d40437bffbfa0ada83dad84910f8e2c8379c3fa9246e151d0b441c974bd08b73
Opcode Fuzzy Hash: d4a90f286c280548f6182e431376c88c66c2136b12caedd788cd76e230970bb9
Instruction Fuzzy Hash: 4DD0C230910327CFC7206F31E94C503BAD4AF01341F04E839D491F2552D6B0C480CA50

Function 00DF1B3E Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 17timeCOMMON

Download Yara Rule

APIs

GetLocalTime.KERNEL32(?), ref: 00DF1B42
__swprintf.LIBCMT ref: 00DF1B73

Strings

%.3d, xrefs: 00DF1B4D
WIN_XPe, xrefs: 00DF1BB2

Memory Dump Source

Source File: 00000000.00000002.2103545536.0000000000DB1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00DB0000, based on PE: true

Associated: 00000000.00000002.2103534640.0000000000DB0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103580373.0000000000E3F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103580373.0000000000E65000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103609603.0000000000E6F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103621893.0000000000E78000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_db0000_New Quotation - FE7191PO154.jbxd

Similarity

API ID: LocalTime__swprintf
String ID: %.3d$WIN_XPe
API String ID: 2070861257-2409531811
Opcode ID: a8b8abf0a2e325e40c4ef852144f67f211972c4ab41cbef5da7ad5b892b76bc0
Instruction ID: 0cdeffd117b0b6de657a060fd09e697539449a12378e1e63c1ce653d54d6d287
Opcode Fuzzy Hash: a8b8abf0a2e325e40c4ef852144f67f211972c4ab41cbef5da7ad5b892b76bc0
Instruction Fuzzy Hash: A4D01279C0411CEACB04DA90DC449FA777CA705311F5545D2FA46A1000F274DB84AB31

Function 00E076C5 Relevance: 6.3, APIs: 4, Instructions: 333COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2103545536.0000000000DB1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00DB0000, based on PE: true

Associated: 00000000.00000002.2103534640.0000000000DB0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103580373.0000000000E3F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103580373.0000000000E65000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103609603.0000000000E6F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103621893.0000000000E78000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_db0000_New Quotation - FE7191PO154.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c91f1fd45d31cb9359e52011b2f3b91833762f77e8c16e55149277680868106a
Instruction ID: f238834ef978982f4ee2ab1868b003f6e836c8b053f5be87fd44fa37a0c25b04
Opcode Fuzzy Hash: c91f1fd45d31cb9359e52011b2f3b91833762f77e8c16e55149277680868106a
Instruction Fuzzy Hash: 73C16E74E04216EFCB14CF94C884EAEBBB5FF88714B159599E885EB291D730ED81CB90

Function 00E2E33E Relevance: 6.3, APIs: 4, Instructions: 307memoryCOMMON

Download Yara Rule

APIs

CharLowerBuffW.USER32(?,?), ref: 00E2E3D2
CharLowerBuffW.USER32(?,?), ref: 00E2E415

Part of subcall function 00E2DAB9: CharLowerBuffW.USER32(?,?,?,?,00000000,?,?), ref: 00E2DAD9

VirtualAlloc.KERNEL32(00000000,00000077,00003000,00000040), ref: 00E2E615
_memmove.LIBCMT ref: 00E2E628

Memory Dump Source

Source File: 00000000.00000002.2103545536.0000000000DB1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00DB0000, based on PE: true

Associated: 00000000.00000002.2103534640.0000000000DB0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103580373.0000000000E3F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103580373.0000000000E65000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103609603.0000000000E6F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103621893.0000000000E78000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_db0000_New Quotation - FE7191PO154.jbxd

Similarity

API ID: BuffCharLower$AllocVirtual_memmove
String ID:
API String ID: 3659485706-0
Opcode ID: e188eee74adc73a1420653ebb7767afaf6f020f7a4cd31e39e6055e7a0b949de
Instruction ID: 658196751a86c98a35efbb10fc7e6649835a9a858270e4a1349cc3eeea4ca281
Opcode Fuzzy Hash: e188eee74adc73a1420653ebb7767afaf6f020f7a4cd31e39e6055e7a0b949de
Instruction Fuzzy Hash: 7DC14C71608321DFC714DF28C48095ABBE4FF89718F14896EF89AAB351D731E945CB92

Function 00E283A8 Relevance: 6.3, APIs: 4, Instructions: 267COMMON

Download Yara Rule

APIs

CoInitialize.OLE32(00000000), ref: 00E283D8
CoUninitialize.OLE32 ref: 00E283E3

Part of subcall function 00E0DA5D: CoCreateInstance.OLE32(?,00000000,00000005,?,?,?,?,?,?,?,?,?,?,?), ref: 00E0DAC5

VariantInit.OLEAUT32(?), ref: 00E283EE
VariantClear.OLEAUT32(?), ref: 00E286BF

Memory Dump Source

Source File: 00000000.00000002.2103545536.0000000000DB1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00DB0000, based on PE: true

Associated: 00000000.00000002.2103534640.0000000000DB0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103580373.0000000000E3F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103580373.0000000000E65000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103609603.0000000000E6F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103621893.0000000000E78000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_db0000_New Quotation - FE7191PO154.jbxd

Similarity

API ID: Variant$ClearCreateInitInitializeInstanceUninitialize
String ID:
API String ID: 780911581-0
Opcode ID: 0d4747b23d165a7bc4855cf71a64a2249aa225f1cb74d3f603be41d10c6a3544
Instruction ID: 133b42c868a97997fa04f3282a655c1ffa473ec32cef39789b1a8a9714545700
Opcode Fuzzy Hash: 0d4747b23d165a7bc4855cf71a64a2249aa225f1cb74d3f603be41d10c6a3544
Instruction Fuzzy Hash: 27A13875204751DFCB10DF24D995A5ABBE4FF88314F149449FA9AAB3A2CB30ED04CB62

Function 00E06DF3 Relevance: 6.2, APIs: 4, Instructions: 202memoryCOMMON

Download Yara Rule

APIs

VariantInit.OLEAUT32(?), ref: 00E06E04
SysAllocString.OLEAUT32(00000000), ref: 00E06EAD
VariantCopy.OLEAUT32 ref: 00E06EDC
VariantClear.OLEAUT32(?), ref: 00E06F03

Memory Dump Source

Source File: 00000000.00000002.2103545536.0000000000DB1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00DB0000, based on PE: true

Associated: 00000000.00000002.2103534640.0000000000DB0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103580373.0000000000E3F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103580373.0000000000E65000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103609603.0000000000E6F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103621893.0000000000E78000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_db0000_New Quotation - FE7191PO154.jbxd

Similarity

API ID: Variant$AllocClearCopyInitString
String ID:
API String ID: 2808897238-0
Opcode ID: 4eb31ddbc4062b55e0f2c9712ec2e99b1b94c9e2b2bf968ce235b1e6af3dc7ef
Instruction ID: 881a956cfb78729bf7a73ffcd6518eaa1b8f46725b6d4fb1ab4e1a2f9db582b6
Opcode Fuzzy Hash: 4eb31ddbc4062b55e0f2c9712ec2e99b1b94c9e2b2bf968ce235b1e6af3dc7ef
Instruction Fuzzy Hash: EE51A970B043029ADB20AF75D495B69F7E5EF48310F20A81FE5D6EB2D1DB70A8D49B11

Function 00E39A63 Relevance: 6.1, APIs: 4, Instructions: 140COMMON

Download Yara Rule

APIs

GetWindowRect.USER32(00FCE540,?), ref: 00E39AD2
ScreenToClient.USER32(00000002,00000002), ref: 00E39B05
MoveWindow.USER32(?,?,?,?,000000FF,00000001,?,?,00000002,?,?), ref: 00E39B72

Memory Dump Source

Source File: 00000000.00000002.2103545536.0000000000DB1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00DB0000, based on PE: true

Associated: 00000000.00000002.2103534640.0000000000DB0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103580373.0000000000E3F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103580373.0000000000E65000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103609603.0000000000E6F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103621893.0000000000E78000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_db0000_New Quotation - FE7191PO154.jbxd

Similarity

API ID: Window$ClientMoveRectScreen
String ID:
API String ID: 3880355969-0
Opcode ID: 0becff191817faf69ed0a9fd3c3d59426ec89316518b4980b4001f314cb99124
Instruction ID: 1edb52bdd5267014c9554481c721682210b38492fa4d0fb7cb8e7594702c6672
Opcode Fuzzy Hash: 0becff191817faf69ed0a9fd3c3d59426ec89316518b4980b4001f314cb99124
Instruction Fuzzy Hash: 9B514C34A00609EFCF14CF68E8859AEBFB5FF44324F148259F815AB2A1D770AD81CB90

Function 00E26CBD Relevance: 6.1, APIs: 4, Instructions: 127networkCOMMON

Download Yara Rule

APIs

socket.WSOCK32(00000002,00000002,00000011), ref: 00E26CE4
WSAGetLastError.WSOCK32(00000000), ref: 00E26CF4

Part of subcall function 00DB9997: __itow.LIBCMT ref: 00DB99C2
Part of subcall function 00DB9997: __swprintf.LIBCMT ref: 00DB9A0C

#21.WSOCK32(?,0000FFFF,00000020,00000002,00000004), ref: 00E26D58
WSAGetLastError.WSOCK32(00000000), ref: 00E26D64

Memory Dump Source

Source File: 00000000.00000002.2103545536.0000000000DB1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00DB0000, based on PE: true

Associated: 00000000.00000002.2103534640.0000000000DB0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103580373.0000000000E3F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103580373.0000000000E65000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103609603.0000000000E6F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103621893.0000000000E78000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_db0000_New Quotation - FE7191PO154.jbxd

Similarity

API ID: ErrorLast$__itow__swprintfsocket
String ID:
API String ID: 2214342067-0
Opcode ID: c83d512c584ba7c54481afbf41ea336fb4f210a89b876f1d503e81a677dc4b90
Instruction ID: 18d4fd86350b4500071a6598102ea0d015711951c705dbfa858d073ac7b5b1b0
Opcode Fuzzy Hash: c83d512c584ba7c54481afbf41ea336fb4f210a89b876f1d503e81a677dc4b90
Instruction Fuzzy Hash: 6341C374740214EFEB10BF24DC86F7A77E9DB04B14F448518FA1AAF2D2DA719C008BA1

Function 00E2672D Relevance: 6.1, APIs: 4, Instructions: 116COMMON

Download Yara Rule

APIs

#16.WSOCK32(?,?,00000000,00000000,00000000,00000000,?,?,00000000,00E3F910), ref: 00E267BA
_strlen.LIBCMT ref: 00E267EC

Memory Dump Source

Source File: 00000000.00000002.2103545536.0000000000DB1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00DB0000, based on PE: true

Associated: 00000000.00000002.2103534640.0000000000DB0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103580373.0000000000E3F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103580373.0000000000E65000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103609603.0000000000E6F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103621893.0000000000E78000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_db0000_New Quotation - FE7191PO154.jbxd

Similarity

API ID: _strlen
String ID:
API String ID: 4218353326-0
Opcode ID: 2b42332dd4a05bfe69d515b47d5ee0051441e9cef4a567b35a708f9a2df27835
Instruction ID: 710c17995afa23e58d16cda39de3766521ffe30509c0530a8c37fe16e5af82a6
Opcode Fuzzy Hash: 2b42332dd4a05bfe69d515b47d5ee0051441e9cef4a567b35a708f9a2df27835
Instruction Fuzzy Hash: 4E419531A00114ABCB18EBA4ECD5FEEB7E9EF48314F149265F916A7292DB30AD44C770

Function 00E1BA5F Relevance: 6.1, APIs: 4, Instructions: 111fileCOMMON

Download Yara Rule

APIs

CreateHardLinkW.KERNEL32(00000002,?,00000000), ref: 00E1BB09
GetLastError.KERNEL32(?,00000000), ref: 00E1BB2F
DeleteFileW.KERNEL32(00000002,?,00000000), ref: 00E1BB54
CreateHardLinkW.KERNEL32(00000002,?,00000000,?,00000000), ref: 00E1BB80

Memory Dump Source

Source File: 00000000.00000002.2103545536.0000000000DB1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00DB0000, based on PE: true

Associated: 00000000.00000002.2103534640.0000000000DB0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103580373.0000000000E3F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103580373.0000000000E65000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103609603.0000000000E6F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103621893.0000000000E78000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_db0000_New Quotation - FE7191PO154.jbxd

Similarity

API ID: CreateHardLink$DeleteErrorFileLast
String ID:
API String ID: 3321077145-0
Opcode ID: 1ea9a13a59b52401ab8896e40b0f9922a4be424b2c8cdf16eb6f0c4d58cd0264
Instruction ID: 0c47ac155772935c4427982dea244489263b8b10202d3f9cf11354d692df4c24
Opcode Fuzzy Hash: 1ea9a13a59b52401ab8896e40b0f9922a4be424b2c8cdf16eb6f0c4d58cd0264
Instruction Fuzzy Hash: 1D413639600650DFCF11EF25C594A9DBBE1EF89314B099498F94AAB762CB30FD41CBA1

Function 00E38AC0 Relevance: 6.1, APIs: 4, Instructions: 109COMMON

Download Yara Rule

APIs

InvalidateRect.USER32(?,00000000,00000001,?,?,?), ref: 00E38B4D

Memory Dump Source

Source File: 00000000.00000002.2103545536.0000000000DB1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00DB0000, based on PE: true

Associated: 00000000.00000002.2103534640.0000000000DB0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103580373.0000000000E3F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103580373.0000000000E65000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103609603.0000000000E6F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103621893.0000000000E78000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_db0000_New Quotation - FE7191PO154.jbxd

Similarity

API ID: InvalidateRect
String ID:
API String ID: 634782764-0
Opcode ID: 09dca374a8243c892f1426f16cfc2025d1dcd7837036dee933dcc0b109b655a0
Instruction ID: cfb04d24ca72c692c82fc910bbb1636ebd41ae77277709e82983fee48c3853bc
Opcode Fuzzy Hash: 09dca374a8243c892f1426f16cfc2025d1dcd7837036dee933dcc0b109b655a0
Instruction Fuzzy Hash: CD31F678600309BFEF248E28CE4DFE9BFA4EB45314F246612F655F62A0CE31AD44C651

Function 00E3ADF1 Relevance: 6.1, APIs: 4, Instructions: 106windowCOMMON

Download Yara Rule

APIs

ClientToScreen.USER32(?,?), ref: 00E3AE1A
GetWindowRect.USER32(?,?), ref: 00E3AE90
PtInRect.USER32(?,?,00E3C304), ref: 00E3AEA0
MessageBeep.USER32(00000000), ref: 00E3AF11

Memory Dump Source

Source File: 00000000.00000002.2103545536.0000000000DB1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00DB0000, based on PE: true

Associated: 00000000.00000002.2103534640.0000000000DB0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103580373.0000000000E3F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103580373.0000000000E65000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103609603.0000000000E6F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103621893.0000000000E78000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_db0000_New Quotation - FE7191PO154.jbxd

Similarity

API ID: Rect$BeepClientMessageScreenWindow
String ID:
API String ID: 1352109105-0
Opcode ID: 50b1c39bf848a1d46722e5d9a279dedb11c747afaa51ecee5db644dff556df0f
Instruction ID: 90ca07dc5f4b3f04d7be5a8a0efff5fa2ae308b9dd2fdfb0f80ac5be67d58ab8
Opcode Fuzzy Hash: 50b1c39bf848a1d46722e5d9a279dedb11c747afaa51ecee5db644dff556df0f
Instruction Fuzzy Hash: E2418070A00119DFDB15CF5AC888AA97FF5FB48344F1C91B9E498AB251D730A8C5CF92

Function 00E10FE6 Relevance: 6.1, APIs: 4, Instructions: 105keyboardwindowCOMMON

Download Yara Rule

APIs

GetKeyboardState.USER32(?,00000000,?,00000001), ref: 00E11037
SetKeyboardState.USER32(00000080,?,00000001), ref: 00E11053
PostMessageW.USER32(00000000,00000102,00000001,00000001), ref: 00E110B9
SendInput.USER32(00000001,00000000,0000001C,00000000,?,00000001), ref: 00E1110B

Memory Dump Source

Source File: 00000000.00000002.2103545536.0000000000DB1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00DB0000, based on PE: true

Associated: 00000000.00000002.2103534640.0000000000DB0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103580373.0000000000E3F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103580373.0000000000E65000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103609603.0000000000E6F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103621893.0000000000E78000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_db0000_New Quotation - FE7191PO154.jbxd

Similarity

API ID: KeyboardState$InputMessagePostSend
String ID:
API String ID: 432972143-0
Opcode ID: b688f57ed502c81dea16fe1163ba5f8e6d088c92a0946100691d8a3ae22fb844
Instruction ID: cd5aa180fc5ac54b0b46de8d08e78eae66d31ebd4d20bb766fb55f3b7e21b9b4
Opcode Fuzzy Hash: b688f57ed502c81dea16fe1163ba5f8e6d088c92a0946100691d8a3ae22fb844
Instruction Fuzzy Hash: 68315A30E44698AEFF308B668C09BFEBBA9AF4D314F04529AE690721D1C3748DC49751

Function 00E11121 Relevance: 6.1, APIs: 4, Instructions: 101keyboardwindowCOMMON

Download Yara Rule

APIs

GetKeyboardState.USER32(?,7694C0D0,?,00008000), ref: 00E11176
SetKeyboardState.USER32(00000080,?,00008000), ref: 00E11192
PostMessageW.USER32(00000000,00000101,00000000), ref: 00E111F1
SendInput.USER32(00000001,?,0000001C,7694C0D0,?,00008000), ref: 00E11243

Memory Dump Source

Source File: 00000000.00000002.2103545536.0000000000DB1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00DB0000, based on PE: true

Associated: 00000000.00000002.2103534640.0000000000DB0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103580373.0000000000E3F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103580373.0000000000E65000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103609603.0000000000E6F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103621893.0000000000E78000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_db0000_New Quotation - FE7191PO154.jbxd

Similarity

API ID: KeyboardState$InputMessagePostSend
String ID:
API String ID: 432972143-0
Opcode ID: 78604af4f47266963ebe19b11cde539fffb941f65fa7ef056d6269d6eaf9bd77
Instruction ID: b66eb3098b39a94cdd0004d770cd3a5d38e55cca3481615518ec5f21b55155c0
Opcode Fuzzy Hash: 78604af4f47266963ebe19b11cde539fffb941f65fa7ef056d6269d6eaf9bd77
Instruction Fuzzy Hash: 7E314830F4165CBEEF318A658C08BFEBBAAAB49314F04639AE790B21E1D37449D4D751

Function 00DE6415 Relevance: 6.1, APIs: 4, Instructions: 97COMMONLIBRARYCODE

Download Yara Rule

APIs

_LocaleUpdate::_LocaleUpdate.LIBCMT ref: 00DE644B
__isleadbyte_l.LIBCMT ref: 00DE6479
MultiByteToWideChar.KERNEL32(00000080,00000009,00000002,00000001,00000000,00000000,?,00000000,00000000,?,?), ref: 00DE64A7
MultiByteToWideChar.KERNEL32(00000080,00000009,00000002,00000001,00000000,00000000,?,00000000,00000000,?,?), ref: 00DE64DD

Memory Dump Source

Source File: 00000000.00000002.2103545536.0000000000DB1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00DB0000, based on PE: true

Associated: 00000000.00000002.2103534640.0000000000DB0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103580373.0000000000E3F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103580373.0000000000E65000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103609603.0000000000E6F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103621893.0000000000E78000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_db0000_New Quotation - FE7191PO154.jbxd

Similarity

API ID: ByteCharLocaleMultiWide$UpdateUpdate::___isleadbyte_l
String ID:
API String ID: 3058430110-0
Opcode ID: acae6e0e8064b57dff9651b1919e3b9f144fff48043962a10819b3baf2081c13
Instruction ID: 0b97e46bb0fc2cdd5414d854bec2b59b1975539812bd7104879f9c656aef220a
Opcode Fuzzy Hash: acae6e0e8064b57dff9651b1919e3b9f144fff48043962a10819b3baf2081c13
Instruction Fuzzy Hash: CC31C13160828AAFDB22AF76C845BBA7FA5FF50390F194469E854871D1D731D850DBB0

Function 00E35175 Relevance: 6.1, APIs: 4, Instructions: 95COMMON

Download Yara Rule

APIs

GetForegroundWindow.USER32 ref: 00E35189

Part of subcall function 00E1387D: GetWindowThreadProcessId.USER32(00000000,00000000), ref: 00E13897
Part of subcall function 00E1387D: GetCurrentThreadId.KERNEL32 ref: 00E1389E
Part of subcall function 00E1387D: AttachThreadInput.USER32(00000000,?,00E152A7), ref: 00E138A5

GetCaretPos.USER32(?), ref: 00E3519A
ClientToScreen.USER32(00000000,?), ref: 00E351D5
GetForegroundWindow.USER32 ref: 00E351DB

Memory Dump Source

Source File: 00000000.00000002.2103545536.0000000000DB1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00DB0000, based on PE: true

Associated: 00000000.00000002.2103534640.0000000000DB0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103580373.0000000000E3F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103580373.0000000000E65000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103609603.0000000000E6F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103621893.0000000000E78000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_db0000_New Quotation - FE7191PO154.jbxd

Similarity

API ID: ThreadWindow$Foreground$AttachCaretClientCurrentInputProcessScreen
String ID:
API String ID: 2759813231-0
Opcode ID: a684fedaf08e7664f0f3acb2416d0967a2dcbf88f070fb1b7f9426e11d859ef1
Instruction ID: 7d6ed3a902316f506bc590b3dce629c51be2d7b0c904c9a46026b9598bda8d7e
Opcode Fuzzy Hash: a684fedaf08e7664f0f3acb2416d0967a2dcbf88f070fb1b7f9426e11d859ef1
Instruction Fuzzy Hash: C2311A72900108AFDB00EFA5C8859EFF7F9EF99300F10406AE516F7251EA759E45CBA0

Function 00E3C788 Relevance: 6.1, APIs: 4, Instructions: 83windowCOMMON

Download Yara Rule

APIs

Part of subcall function 00DB2612: GetWindowLongW.USER32(?,000000EB), ref: 00DB2623

GetCursorPos.USER32(?), ref: 00E3C7C2
TrackPopupMenuEx.USER32(?,00000000,?,?,?,00000000,?,00DEBBFB,?,?,?,?,?), ref: 00E3C7D7
GetCursorPos.USER32(?), ref: 00E3C824
DefDlgProcW.USER32(?,0000007B,?,?,?,?,?,?,?,?,?,?,00DEBBFB,?,?,?), ref: 00E3C85E

Memory Dump Source

Source File: 00000000.00000002.2103545536.0000000000DB1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00DB0000, based on PE: true

Associated: 00000000.00000002.2103534640.0000000000DB0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103580373.0000000000E3F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103580373.0000000000E65000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103609603.0000000000E6F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103621893.0000000000E78000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_db0000_New Quotation - FE7191PO154.jbxd

Similarity

API ID: Cursor$LongMenuPopupProcTrackWindow
String ID:
API String ID: 2864067406-0
Opcode ID: bb38fb4ded178303d904d0aa44a90dc903504413f0c72993aa8678335021f715
Instruction ID: 3ee56e5d38744da4791e09949f52e83629148e55b6dd69dcbfe1b45f3eccc912
Opcode Fuzzy Hash: bb38fb4ded178303d904d0aa44a90dc903504413f0c72993aa8678335021f715
Instruction Fuzzy Hash: 13318035600018AFDB19CF59C89CEEA7FB6EB49314F144069F909BB261C731AE54DFA0

Function 00DD0BD0 Relevance: 6.1, APIs: 4, Instructions: 79COMMON

Download Yara Rule

APIs

__setmode.LIBCMT ref: 00DD0BF2

Part of subcall function 00DB5B75: WideCharToMultiByte.KERNEL32(00000000,00000000,?,00000001,00000000,00000000,00000000,00000000,00000000,00000000,?,00E17B20,?,?,00000000), ref: 00DB5B8C
Part of subcall function 00DB5B75: WideCharToMultiByte.KERNEL32(00000000,00000000,?,00000001,00000000,?,00000000,00000000,?,?,00E17B20,?,?,00000000,?,?), ref: 00DB5BB0

_fprintf.LIBCMT ref: 00DD0C29
OutputDebugStringW.KERNEL32(?), ref: 00E06331

Part of subcall function 00DD4CDA: _flsall.LIBCMT ref: 00DD4CF3

__setmode.LIBCMT ref: 00DD0C5E

Memory Dump Source

Source File: 00000000.00000002.2103545536.0000000000DB1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00DB0000, based on PE: true

Associated: 00000000.00000002.2103534640.0000000000DB0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103580373.0000000000E3F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103580373.0000000000E65000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103609603.0000000000E6F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103621893.0000000000E78000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_db0000_New Quotation - FE7191PO154.jbxd

Similarity

API ID: ByteCharMultiWide__setmode$DebugOutputString_flsall_fprintf
String ID:
API String ID: 521402451-0
Opcode ID: 309f11fe5522bad2710d629bd0c900325b09b41d51351082f9811770d0a84701
Instruction ID: f89e08c712bf67288f89df682eb9ff9ff33d37647cfe4407125f453b9bc8d3b3
Opcode Fuzzy Hash: 309f11fe5522bad2710d629bd0c900325b09b41d51351082f9811770d0a84701
Instruction Fuzzy Hash: 01110531904204BBCB04B7B9AC46AFE7B6DDF85320F14015BF109A7292DE30598587B5

Function 00E08B9E Relevance: 6.1, APIs: 4, Instructions: 79memoryCOMMON

Download Yara Rule

APIs

Part of subcall function 00E08652: GetTokenInformation.ADVAPI32(?,00000003(TokenIntegrityLevel),?,00000000,?), ref: 00E08669
Part of subcall function 00E08652: GetLastError.KERNEL32(?,TokenIntegrityLevel,?,00000000,?), ref: 00E08673
Part of subcall function 00E08652: GetProcessHeap.KERNEL32(00000008,?,?,TokenIntegrityLevel,?,00000000,?), ref: 00E08682
Part of subcall function 00E08652: HeapAlloc.KERNEL32(00000000,?,TokenIntegrityLevel,?,00000000,?), ref: 00E08689
Part of subcall function 00E08652: GetTokenInformation.ADVAPI32(?,00000003(TokenIntegrityLevel),00000000,?,?,?,TokenIntegrityLevel,?,00000000,?), ref: 00E0869F

LookupPrivilegeValueW.ADVAPI32(00000000,?,?), ref: 00E08BEB
_memcmp.LIBCMT ref: 00E08C0E
GetProcessHeap.KERNEL32(00000000,00000000), ref: 00E08C44
HeapFree.KERNEL32(00000000), ref: 00E08C4B

Memory Dump Source

Source File: 00000000.00000002.2103545536.0000000000DB1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00DB0000, based on PE: true

Associated: 00000000.00000002.2103534640.0000000000DB0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103580373.0000000000E3F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103580373.0000000000E65000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103609603.0000000000E6F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103621893.0000000000E78000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_db0000_New Quotation - FE7191PO154.jbxd

Similarity

API ID: Heap$InformationProcessToken$AllocErrorFreeLastLookupPrivilegeValue_memcmp
String ID:
API String ID: 1592001646-0
Opcode ID: 6c6e9ac887ea4b92469dd4b0368807d3bd143b4147d23c19e47e5f3c7ac62274
Instruction ID: 070a1d7533d34ff7ffe836522c4e13927fc420d8302448da8de1125a69e9ef0b
Opcode Fuzzy Hash: 6c6e9ac887ea4b92469dd4b0368807d3bd143b4147d23c19e47e5f3c7ac62274
Instruction Fuzzy Hash: 94219F71E01208EFDB00DF94CA88BEEF7B8EF50344F044059E495B7281DB31AA45CB61

Function 00E21A5B Relevance: 6.1, APIs: 4, Instructions: 78networkCOMMON

Download Yara Rule

APIs

InternetConnectW.WININET(?,?,?,?,?,?,00000000,00000000), ref: 00E21A97

Part of subcall function 00E21B21: InternetOpenUrlW.WININET(?,?,00000000,00000000,?,00000000), ref: 00E21B40
Part of subcall function 00E21B21: InternetCloseHandle.WININET(00000000), ref: 00E21BDD

Memory Dump Source

Source File: 00000000.00000002.2103545536.0000000000DB1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00DB0000, based on PE: true

Associated: 00000000.00000002.2103534640.0000000000DB0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103580373.0000000000E3F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103580373.0000000000E65000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103609603.0000000000E6F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103621893.0000000000E78000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_db0000_New Quotation - FE7191PO154.jbxd

Similarity

API ID: Internet$CloseConnectHandleOpen
String ID:
API String ID: 1463438336-0
Opcode ID: 5a85a2e1a3b6a086df81e89eaa006a93921a526e76358c37bed0a7806bdc5d6c
Instruction ID: 7f3b9467ef8eb5f2a3243f592e3b1e2abdfd86e8d62b3dc4810b62b051cddeba
Opcode Fuzzy Hash: 5a85a2e1a3b6a086df81e89eaa006a93921a526e76358c37bed0a7806bdc5d6c
Instruction Fuzzy Hash: 8621D131200614BFDB219F60EC05FBABBBDFF64701F14101EFA01A6660EB71DA159BA0

Function 00E0E1AF Relevance: 6.1, APIs: 3, Strings: 1, Instructions: 68stringCOMMON

Download Yara Rule

APIs

Part of subcall function 00E0F5AD: lstrlenW.KERNEL32(?,00000002,?,?,000000EF,?,00E0E1C4,?,?,?,00E0EFB7,00000000,000000EF,00000119,?,?), ref: 00E0F5BC
Part of subcall function 00E0F5AD: lstrcpyW.KERNEL32(00000000,?), ref: 00E0F5E2
Part of subcall function 00E0F5AD: lstrcmpiW.KERNEL32(00000000,?,00E0E1C4,?,?,?,00E0EFB7,00000000,000000EF,00000119,?,?), ref: 00E0F613

lstrlenW.KERNEL32(?,00000002,?,?,?,?,00E0EFB7,00000000,000000EF,00000119,?,?,00000000), ref: 00E0E1DD
lstrcpyW.KERNEL32(00000000,?), ref: 00E0E203
lstrcmpiW.KERNEL32(00000002,cdecl,?,00E0EFB7,00000000,000000EF,00000119,?,?,00000000), ref: 00E0E237

Strings

cdecl, xrefs: 00E0E22E

Memory Dump Source

Source File: 00000000.00000002.2103545536.0000000000DB1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00DB0000, based on PE: true

Associated: 00000000.00000002.2103534640.0000000000DB0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103580373.0000000000E3F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103580373.0000000000E65000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103609603.0000000000E6F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103621893.0000000000E78000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_db0000_New Quotation - FE7191PO154.jbxd

Similarity

API ID: lstrcmpilstrcpylstrlen
String ID: cdecl
API String ID: 4031866154-3896280584
Opcode ID: 3c29ec30bb63ee0fa5a64d96159f2e5309bad635d0cfef013475e4f6c2e01bfd
Instruction ID: 41ac8e17bad0c48969b12ea50d9f86132662ec13713365a5a911b82a8c49664e
Opcode Fuzzy Hash: 3c29ec30bb63ee0fa5a64d96159f2e5309bad635d0cfef013475e4f6c2e01bfd
Instruction Fuzzy Hash: 1A118136100345EFCB25AF64DC49D7A7BB8FF85354B40543AE806DB2A0EB71989597A0

Function 00DE5332 Relevance: 6.1, APIs: 4, Instructions: 67COMMONLIBRARYCODE

Download Yara Rule

APIs

_free.LIBCMT ref: 00DE5351

Part of subcall function 00DD594C: __FF_MSGBANNER.LIBCMT ref: 00DD5963
Part of subcall function 00DD594C: __NMSG_WRITE.LIBCMT ref: 00DD596A
Part of subcall function 00DD594C: RtlAllocateHeap.NTDLL(00FB0000,00000000,00000001,00000000,?,?,?,00DD1013,?), ref: 00DD598F

Memory Dump Source

Source File: 00000000.00000002.2103545536.0000000000DB1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00DB0000, based on PE: true

Associated: 00000000.00000002.2103534640.0000000000DB0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103580373.0000000000E3F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103580373.0000000000E65000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103609603.0000000000E6F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103621893.0000000000E78000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_db0000_New Quotation - FE7191PO154.jbxd

Similarity

API ID: AllocateHeap_free
String ID:
API String ID: 614378929-0
Opcode ID: 08e78a56697c1bee7c7f4650ed76e654e37a16b608a260ca7bf2ea32e6758179
Instruction ID: a95a8a01e980363e08d7365ea249d615e84a140c15d95f7c9a6351d7002ca907
Opcode Fuzzy Hash: 08e78a56697c1bee7c7f4650ed76e654e37a16b608a260ca7bf2ea32e6758179
Instruction Fuzzy Hash: 9E11E332904A19AFCB223F72BC0565D3B99DF103E4F24042BF946AA2E1DFB1C94197B0

Function 00DB4531 Relevance: 6.1, APIs: 4, Instructions: 66timewindowCOMMON

Download Yara Rule

APIs

_memset.LIBCMT ref: 00DB4560

Part of subcall function 00DB410D: _memset.LIBCMT ref: 00DB418D
Part of subcall function 00DB410D: _wcscpy.LIBCMT ref: 00DB41E1
Part of subcall function 00DB410D: Shell_NotifyIconW.SHELL32(00000001,000003A8), ref: 00DB41F1

KillTimer.USER32(?,00000001,?,?), ref: 00DB45B5
SetTimer.USER32(?,00000001,000002EE,00000000), ref: 00DB45C4
Shell_NotifyIconW.SHELL32(00000001,000003A8), ref: 00DED6CE

Memory Dump Source

Source File: 00000000.00000002.2103545536.0000000000DB1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00DB0000, based on PE: true

Associated: 00000000.00000002.2103534640.0000000000DB0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103580373.0000000000E3F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103580373.0000000000E65000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103609603.0000000000E6F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103621893.0000000000E78000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_db0000_New Quotation - FE7191PO154.jbxd

Similarity

API ID: IconNotifyShell_Timer_memset$Kill_wcscpy
String ID:
API String ID: 1378193009-0
Opcode ID: c9510868c6735d302697b7cbda7138c056c5c2bee5db047b9720aea4de62a685
Instruction ID: ff57d1bb69654c16d62299a2f12ada965cf3d6a046845bf3f3bd61f90ef9ac60
Opcode Fuzzy Hash: c9510868c6735d302697b7cbda7138c056c5c2bee5db047b9720aea4de62a685
Instruction Fuzzy Hash: FD21AA709047C89FEB32DB25D859BE7BFED9F01308F04009EE69E56242CB745A888B61

Function 00E2667C Relevance: 6.1, APIs: 4, Instructions: 61networkCOMMON

Download Yara Rule

APIs

Part of subcall function 00DB5B75: WideCharToMultiByte.KERNEL32(00000000,00000000,?,00000001,00000000,00000000,00000000,00000000,00000000,00000000,?,00E17B20,?,?,00000000), ref: 00DB5B8C
Part of subcall function 00DB5B75: WideCharToMultiByte.KERNEL32(00000000,00000000,?,00000001,00000000,?,00000000,00000000,?,?,00E17B20,?,?,00000000,?,?), ref: 00DB5BB0

gethostbyname.WSOCK32(?,?,?), ref: 00E266AC
WSAGetLastError.WSOCK32(00000000), ref: 00E266B7
_memmove.LIBCMT ref: 00E266E4
inet_ntoa.WSOCK32(?), ref: 00E266EF

Memory Dump Source

Source File: 00000000.00000002.2103545536.0000000000DB1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00DB0000, based on PE: true

Associated: 00000000.00000002.2103534640.0000000000DB0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103580373.0000000000E3F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103580373.0000000000E65000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103609603.0000000000E6F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103621893.0000000000E78000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_db0000_New Quotation - FE7191PO154.jbxd

Similarity

API ID: ByteCharMultiWide$ErrorLast_memmovegethostbynameinet_ntoa
String ID:
API String ID: 1504782959-0
Opcode ID: 2340f7c24dfdba818f3b8885b0be6add6f4d8847b1a223d7101554aad01a7f3d
Instruction ID: ca4b7078f348cdad17239e14b249bdba7ecf2cc5e7f7de3bb84fb6aad30c366d
Opcode Fuzzy Hash: 2340f7c24dfdba818f3b8885b0be6add6f4d8847b1a223d7101554aad01a7f3d
Instruction Fuzzy Hash: AB110736900509EFCB04FBA5E996EEEBBB8EF54310B144165F506B72A1DB30AE14CB71

Function 00E09023 Relevance: 6.1, APIs: 4, Instructions: 59windowCOMMON

Download Yara Rule

APIs

SendMessageW.USER32(?,000000B0,?,?), ref: 00E09043
SendMessageW.USER32(?,000000C9,?,00000000), ref: 00E09055
SendMessageW.USER32(?,000000C9,?,00000000), ref: 00E0906B
SendMessageW.USER32(?,000000C9,?,00000000), ref: 00E09086

Memory Dump Source

Source File: 00000000.00000002.2103545536.0000000000DB1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00DB0000, based on PE: true

Associated: 00000000.00000002.2103534640.0000000000DB0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103580373.0000000000E3F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103580373.0000000000E65000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103609603.0000000000E6F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103621893.0000000000E78000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_db0000_New Quotation - FE7191PO154.jbxd

Similarity

API ID: MessageSend
String ID:
API String ID: 3850602802-0
Opcode ID: e6d996be43e29ef7d4eec65ad67d3619181494256ef518f85feb082323ecd628
Instruction ID: 5cf91ea12c4db9a48ce07c90424697502c7e82ec35bcdaf0b2f29b3b5aa04c6f
Opcode Fuzzy Hash: e6d996be43e29ef7d4eec65ad67d3619181494256ef518f85feb082323ecd628
Instruction Fuzzy Hash: E6115E79900218FFDB10DFA5CD85EADFBB4FB48310F204095E904B7291D6716E50DB90

Function 00DB1290 Relevance: 6.1, APIs: 4, Instructions: 59COMMON

Download Yara Rule

APIs

Part of subcall function 00DB2612: GetWindowLongW.USER32(?,000000EB), ref: 00DB2623

DefDlgProcW.USER32(?,00000020,?), ref: 00DB12D8
GetClientRect.USER32(?,?), ref: 00DEB84B
GetCursorPos.USER32(?), ref: 00DEB855
ScreenToClient.USER32(?,?), ref: 00DEB860

Memory Dump Source

Source File: 00000000.00000002.2103545536.0000000000DB1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00DB0000, based on PE: true

Associated: 00000000.00000002.2103534640.0000000000DB0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103580373.0000000000E3F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103580373.0000000000E65000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103609603.0000000000E6F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103621893.0000000000E78000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_db0000_New Quotation - FE7191PO154.jbxd

Similarity

API ID: Client$CursorLongProcRectScreenWindow
String ID:
API String ID: 4127811313-0
Opcode ID: f9fdeffd4d1a1be1f595ad36013e5115621066aef97f7cd524ada0901cc7570f
Instruction ID: fcf853d73db5fb8c43efd310484751aae4db968482d6273eb9a0c1a30e5f3b79
Opcode Fuzzy Hash: f9fdeffd4d1a1be1f595ad36013e5115621066aef97f7cd524ada0901cc7570f
Instruction Fuzzy Hash: F4112B39900119EFCB04DF95D89A9FE7BB8FB05301F500456F952E7250CB30BA558BB9

Function 00E11652 Relevance: 6.1, APIs: 4, Instructions: 51sleepCOMMON

Download Yara Rule

APIs

QueryPerformanceCounter.KERNEL32(?,?,?,?,?,?,?,00E101FD,?,00E11250,?,00008000), ref: 00E1166F
Sleep.KERNEL32(00000000,?,?,?,?,?,?,00E101FD,?,00E11250,?,00008000), ref: 00E11694
QueryPerformanceCounter.KERNEL32(?,?,?,?,?,?,?,00E101FD,?,00E11250,?,00008000), ref: 00E1169E
Sleep.KERNEL32(?,?,?,?,?,?,?,00E101FD,?,00E11250,?,00008000), ref: 00E116D1

Memory Dump Source

Source File: 00000000.00000002.2103545536.0000000000DB1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00DB0000, based on PE: true

Associated: 00000000.00000002.2103534640.0000000000DB0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103580373.0000000000E3F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103580373.0000000000E65000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103609603.0000000000E6F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103621893.0000000000E78000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_db0000_New Quotation - FE7191PO154.jbxd

Similarity

API ID: CounterPerformanceQuerySleep
String ID:
API String ID: 2875609808-0
Opcode ID: 6f09cfdeda34718392be73c9e0eb745a2bbeb9f978da00668e4ebe1b363ddfe0
Instruction ID: 7dd266ce20d452454d89e45689832042b1d6d72f98efb46ed6318f66ce0b91ec
Opcode Fuzzy Hash: 6f09cfdeda34718392be73c9e0eb745a2bbeb9f978da00668e4ebe1b363ddfe0
Instruction Fuzzy Hash: BC115E31C0151DEBCF009FA6E948AEEBF78FF09751F054099EA81B6240CB3255A4CBE6

Function 00DE7207 Relevance: 6.0, APIs: 4, Instructions: 48COMMONLIBRARYCODE

Download Yara Rule

APIs

__cftof_l.LIBCMT ref: 00DE722B

Part of subcall function 00DE7912: __fltout2.LIBCMT ref: 00DE793B

__cftog_l.LIBCMT ref: 00DE7251
__cftoe_l.LIBCMT ref: 00DE7283

Memory Dump Source

Source File: 00000000.00000002.2103545536.0000000000DB1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00DB0000, based on PE: true

Associated: 00000000.00000002.2103534640.0000000000DB0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103580373.0000000000E3F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103580373.0000000000E65000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103609603.0000000000E6F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103621893.0000000000E78000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_db0000_New Quotation - FE7191PO154.jbxd

Similarity

API ID: __cftoe_l__cftof_l__cftog_l__fltout2
String ID:
API String ID: 3016257755-0
Opcode ID: a65d1881d29c7e947f5b32dbcea64912f89e558cad637ae539af3f1adf23f7b4
Instruction ID: 61b43b2220cc5ca3b9f91e7a12bb4cb7ef42fe8b057597afa64582be0933081a
Opcode Fuzzy Hash: a65d1881d29c7e947f5b32dbcea64912f89e558cad637ae539af3f1adf23f7b4
Instruction Fuzzy Hash: C501803204418ABBCF926E85DC018EE3F22BF19344B088515FB1858031C237C9B1ABA5

Function 00E3B57F Relevance: 6.0, APIs: 4, Instructions: 47COMMON

Download Yara Rule

APIs

GetWindowRect.USER32(?,?), ref: 00E3B59E
ScreenToClient.USER32(?,?), ref: 00E3B5B6
ScreenToClient.USER32(?,?), ref: 00E3B5DA
InvalidateRect.USER32(?,?,?,?,?,?,?,?,?,?,?,?), ref: 00E3B5F5

Memory Dump Source

Source File: 00000000.00000002.2103545536.0000000000DB1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00DB0000, based on PE: true

Associated: 00000000.00000002.2103534640.0000000000DB0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103580373.0000000000E3F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103580373.0000000000E65000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103609603.0000000000E6F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103621893.0000000000E78000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_db0000_New Quotation - FE7191PO154.jbxd

Similarity

API ID: ClientRectScreen$InvalidateWindow
String ID:
API String ID: 357397906-0
Opcode ID: 1d47292fef46f66a49fe161ea3e8ed6a34caa89acc15607f9ee0165b9c20b0f3
Instruction ID: c71b833e5c5cbf3dc40b11b3193b54c6e83bcbfb26bcc81c86a4a02ab52a1ebf
Opcode Fuzzy Hash: 1d47292fef46f66a49fe161ea3e8ed6a34caa89acc15607f9ee0165b9c20b0f3
Instruction Fuzzy Hash: 011132B9D0020DEFDB41CFA9C8859EEBBB9FF08310F108166E915E2220D735AA558F91

Function 00E3B8EF Relevance: 6.0, APIs: 4, Instructions: 40processCOMMON

Download Yara Rule

APIs

_memset.LIBCMT ref: 00E3B8FE
_memset.LIBCMT ref: 00E3B90D
CreateProcessW.KERNEL32(00000000,?,00000000,00000000,00000000,00000020,00000000,00000000,00E77F20,00E77F64), ref: 00E3B93C
CloseHandle.KERNEL32 ref: 00E3B94E

Memory Dump Source

Source File: 00000000.00000002.2103545536.0000000000DB1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00DB0000, based on PE: true

Associated: 00000000.00000002.2103534640.0000000000DB0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103580373.0000000000E3F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103580373.0000000000E65000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103609603.0000000000E6F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103621893.0000000000E78000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_db0000_New Quotation - FE7191PO154.jbxd

Similarity

API ID: _memset$CloseCreateHandleProcess
String ID:
API String ID: 3277943733-0
Opcode ID: b787c98b1956d9317d9f8db201b123e3c3a92017730d5ccbb78ba4615dfeac70
Instruction ID: 1b84fb92b07f76697ccb3a6fb78892603f95f376499086c55a649abcbca398f7
Opcode Fuzzy Hash: b787c98b1956d9317d9f8db201b123e3c3a92017730d5ccbb78ba4615dfeac70
Instruction Fuzzy Hash: D0F05EB2648304BFE2106B62AD0AFBB3A5CEB08355F005021FB4CF6292D771494487B9

Function 00E16E7C Relevance: 6.0, APIs: 4, Instructions: 33COMMON

Download Yara Rule

APIs

EnterCriticalSection.KERNEL32(?), ref: 00E16E88

Part of subcall function 00E1794E: _memset.LIBCMT ref: 00E17983

_memmove.LIBCMT ref: 00E16EAB
_memset.LIBCMT ref: 00E16EB8
LeaveCriticalSection.KERNEL32(?), ref: 00E16EC8

Memory Dump Source

Source File: 00000000.00000002.2103545536.0000000000DB1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00DB0000, based on PE: true

Associated: 00000000.00000002.2103534640.0000000000DB0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103580373.0000000000E3F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103580373.0000000000E65000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103609603.0000000000E6F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103621893.0000000000E78000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_db0000_New Quotation - FE7191PO154.jbxd

Similarity

API ID: CriticalSection_memset$EnterLeave_memmove
String ID:
API String ID: 48991266-0
Opcode ID: 5269aea4874c69c78b49e2c1509082d9492ee8c2c6831a7e08bc04f4ca54d7b7
Instruction ID: f407d23869c421914ee7f0a8f7e0481439f4822948a6780ad9f9f15f279307fa
Opcode Fuzzy Hash: 5269aea4874c69c78b49e2c1509082d9492ee8c2c6831a7e08bc04f4ca54d7b7
Instruction Fuzzy Hash: 1FF0543A504204BBCF016F55DC85E9ABB69EF49320B04C061FE096E226C771E955CBB5

Function 00E3C00C Relevance: 6.0, APIs: 4, Instructions: 31COMMON

Download Yara Rule

APIs

Part of subcall function 00DB12F3: ExtCreatePen.GDI32(?,?,00000000,00000000,00000000,?,00000000), ref: 00DB134D
Part of subcall function 00DB12F3: SelectObject.GDI32(?,00000000), ref: 00DB135C
Part of subcall function 00DB12F3: BeginPath.GDI32(?), ref: 00DB1373
Part of subcall function 00DB12F3: SelectObject.GDI32(?,00000000), ref: 00DB139C

MoveToEx.GDI32(00000000,00000000,?,00000000), ref: 00E3C030
LineTo.GDI32(00000000,?,?), ref: 00E3C03D
EndPath.GDI32(00000000), ref: 00E3C04D
StrokePath.GDI32(00000000), ref: 00E3C05B

Memory Dump Source

Source File: 00000000.00000002.2103545536.0000000000DB1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00DB0000, based on PE: true

Associated: 00000000.00000002.2103534640.0000000000DB0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103580373.0000000000E3F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103580373.0000000000E65000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103609603.0000000000E6F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103621893.0000000000E78000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_db0000_New Quotation - FE7191PO154.jbxd

Similarity

API ID: Path$ObjectSelect$BeginCreateLineMoveStroke
String ID:
API String ID: 1539411459-0
Opcode ID: acd9bac7010808488e61a044eaad10a5bd6a6285dfc130b569244148f2c9b5b7
Instruction ID: e5b543e6e54ed7d487e82dc1b60857d1ecf00325fcbd13d2a8e443d0e27a5abf
Opcode Fuzzy Hash: acd9bac7010808488e61a044eaad10a5bd6a6285dfc130b569244148f2c9b5b7
Instruction Fuzzy Hash: 31F09A31401259FADB166F56AC0EFCA3F98AF05314F144000FA11310E287655668CFA5

Function 00E0A37C Relevance: 6.0, APIs: 4, Instructions: 30threadwindowtimeCOMMON

Download Yara Rule

APIs

SendMessageTimeoutW.USER32(?,00000000,00000000,00000000,00000002,00001388,00000001), ref: 00E0A399
GetWindowThreadProcessId.USER32(?,00000000), ref: 00E0A3AC
GetCurrentThreadId.KERNEL32 ref: 00E0A3B3
AttachThreadInput.USER32(00000000), ref: 00E0A3BA

Memory Dump Source

Source File: 00000000.00000002.2103545536.0000000000DB1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00DB0000, based on PE: true

Associated: 00000000.00000002.2103534640.0000000000DB0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103580373.0000000000E3F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103580373.0000000000E65000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103609603.0000000000E6F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103621893.0000000000E78000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_db0000_New Quotation - FE7191PO154.jbxd

Similarity

API ID: Thread$AttachCurrentInputMessageProcessSendTimeoutWindow
String ID:
API String ID: 2710830443-0
Opcode ID: 8a6998f2c124ac3f4979826e372a57ca0c3a0d7ef8386124c09cd82abb1bc531
Instruction ID: 9c05a80b5511196d3dcae643a415f1c1bef881aadc4f67c544c275d02a373b6c
Opcode Fuzzy Hash: 8a6998f2c124ac3f4979826e372a57ca0c3a0d7ef8386124c09cd82abb1bc531
Instruction Fuzzy Hash: B9E0A57194532CBADB205FA2DC0DEEB7E5CEF267A1F048035F509A50A0C675C5849BE1

Function 00DB2218 Relevance: 6.0, APIs: 4, Instructions: 23COMMON

Download Yara Rule

APIs

GetSysColor.USER32(00000008), ref: 00DB2231
SetTextColor.GDI32(?,000000FF), ref: 00DB223B
SetBkMode.GDI32(?,00000001), ref: 00DB2250
GetStockObject.GDI32(00000005), ref: 00DB2258
GetWindowDC.USER32(?,00000000), ref: 00DEC0D3
GetPixel.GDI32(00000000,00000000,00000000), ref: 00DEC0E0
GetPixel.GDI32(00000000,?,00000000), ref: 00DEC0F9
GetPixel.GDI32(00000000,00000000,?), ref: 00DEC112
GetPixel.GDI32(00000000,?,?), ref: 00DEC132
ReleaseDC.USER32(?,00000000), ref: 00DEC13D

Memory Dump Source

Source File: 00000000.00000002.2103545536.0000000000DB1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00DB0000, based on PE: true

Associated: 00000000.00000002.2103534640.0000000000DB0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103580373.0000000000E3F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103580373.0000000000E65000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103609603.0000000000E6F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103621893.0000000000E78000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_db0000_New Quotation - FE7191PO154.jbxd

Similarity

API ID: Pixel$Color$ModeObjectReleaseStockTextWindow
String ID:
API String ID: 1946975507-0
Opcode ID: bc1812e51a0169f7041ec2da504db93272f781c64475a6708c44d21c2ed2e86e
Instruction ID: 508570743d6e33110c53294c6d6e542cb79fef4e3dedeba00fd177733fbe49d9
Opcode Fuzzy Hash: bc1812e51a0169f7041ec2da504db93272f781c64475a6708c44d21c2ed2e86e
Instruction Fuzzy Hash: A7E06D32900288FEDF215FA6FC0DBD83F10EB05332F048366FA69A80E287714985DB21

Function 00E08C5A Relevance: 6.0, APIs: 4, Instructions: 23threadCOMMON

Download Yara Rule

APIs

GetCurrentThread.KERNEL32 ref: 00E08C63
OpenThreadToken.ADVAPI32(00000000,?,?,?,00E0882E), ref: 00E08C6A
GetCurrentProcess.KERNEL32(00000028,?,?,?,?,00E0882E), ref: 00E08C77
OpenProcessToken.ADVAPI32(00000000,?,?,?,00E0882E), ref: 00E08C7E

Memory Dump Source

Source File: 00000000.00000002.2103545536.0000000000DB1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00DB0000, based on PE: true

Associated: 00000000.00000002.2103534640.0000000000DB0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103580373.0000000000E3F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103580373.0000000000E65000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103609603.0000000000E6F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103621893.0000000000E78000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_db0000_New Quotation - FE7191PO154.jbxd

Similarity

API ID: CurrentOpenProcessThreadToken
String ID:
API String ID: 3974789173-0
Opcode ID: aa16cf04ab82e17947d996e04f99a50f9294d5666fcffd0b6fca5db7ae196772
Instruction ID: 021ccaed20dd4b90958c003e9c3501ce0d506cead3efd625b2a39830e897ddea
Opcode Fuzzy Hash: aa16cf04ab82e17947d996e04f99a50f9294d5666fcffd0b6fca5db7ae196772
Instruction Fuzzy Hash: 72E08636A42225DFE7205FB66E0CB577FBCEF50796F054829F285E9090DA348489CF61

Function 00DF2187 Relevance: 6.0, APIs: 4, Instructions: 20COMMON

Download Yara Rule

APIs

GetDesktopWindow.USER32 ref: 00DF2187
GetDC.USER32(00000000), ref: 00DF2191
GetDeviceCaps.GDI32(00000000,0000000C), ref: 00DF21B1
ReleaseDC.USER32(?), ref: 00DF21D2

Memory Dump Source

Source File: 00000000.00000002.2103545536.0000000000DB1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00DB0000, based on PE: true

Associated: 00000000.00000002.2103534640.0000000000DB0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103580373.0000000000E3F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103580373.0000000000E65000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103609603.0000000000E6F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103621893.0000000000E78000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_db0000_New Quotation - FE7191PO154.jbxd

Similarity

API ID: CapsDesktopDeviceReleaseWindow
String ID:
API String ID: 2889604237-0
Opcode ID: 1db1429b00690cf8ab974356dea21a3e5c736de35d9bafef4ab64c0949a1d502
Instruction ID: b47e1ad6d55afabc65ed01d3d965ee641eaddc554e761ca9f925535dc13560c7
Opcode Fuzzy Hash: 1db1429b00690cf8ab974356dea21a3e5c736de35d9bafef4ab64c0949a1d502
Instruction Fuzzy Hash: 61E0E575800208EFDB019FA1C80DAADBFF1EB4C350F118425F95AA7220CB7881459F90

Function 00DF219B Relevance: 6.0, APIs: 4, Instructions: 19COMMON

Download Yara Rule

APIs

GetDesktopWindow.USER32 ref: 00DF219B
GetDC.USER32(00000000), ref: 00DF21A5
GetDeviceCaps.GDI32(00000000,0000000C), ref: 00DF21B1
ReleaseDC.USER32(?), ref: 00DF21D2

Memory Dump Source

Source File: 00000000.00000002.2103545536.0000000000DB1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00DB0000, based on PE: true

Associated: 00000000.00000002.2103534640.0000000000DB0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103580373.0000000000E3F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103580373.0000000000E65000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103609603.0000000000E6F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103621893.0000000000E78000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_db0000_New Quotation - FE7191PO154.jbxd

Similarity

API ID: CapsDesktopDeviceReleaseWindow
String ID:
API String ID: 2889604237-0
Opcode ID: e67058f60765f64bf71c7a79c78348274a0d13490766e4fa45b9aad1a68fffe6
Instruction ID: e417f29245f2777c8c34b6bf122bd941ba4808f957d00abb70801d25fbbcfe6c
Opcode Fuzzy Hash: e67058f60765f64bf71c7a79c78348274a0d13490766e4fa45b9aad1a68fffe6
Instruction Fuzzy Hash: A4E0EEB5C00208EFCB019FA2C80DA9DBFE1EB4C310F108029F95AA7220CB7891459F90

Function 00DB63A0 Relevance: 5.6, APIs: 2, Strings: 1, Instructions: 317COMMON

Download Yara Rule

Strings

%, xrefs: 00DB63AE

Memory Dump Source

Source File: 00000000.00000002.2103545536.0000000000DB1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00DB0000, based on PE: true

Associated: 00000000.00000002.2103534640.0000000000DB0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103580373.0000000000E3F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103580373.0000000000E65000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103609603.0000000000E6F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103621893.0000000000E78000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_db0000_New Quotation - FE7191PO154.jbxd

Similarity

API ID:
String ID: %
API String ID: 0-2291192146
Opcode ID: 49ef516d1b0dc094e01223dd133aa5287fb76e848bf17fab446ae1a634a17943
Instruction ID: d7fd99efd9f08839e253d6fa9795a3a733d9fe66dc7959abc1378b81b39e0238
Opcode Fuzzy Hash: 49ef516d1b0dc094e01223dd133aa5287fb76e848bf17fab446ae1a634a17943
Instruction Fuzzy Hash: 67B18D75904209DBCF24EF98C481AFEBBB4EF44310F544026E947A7295EA38DE95CBB1

Function 00E2B1B7 Relevance: 5.6, APIs: 1, Strings: 2, Instructions: 313COMMON

Download Yara Rule

APIs

__itow_s.LIBCMT ref: 00E2B2C3

Strings

xr, xrefs: 00E2B325
xr, xrefs: 00E2B2F9

Memory Dump Source

Source File: 00000000.00000002.2103545536.0000000000DB1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00DB0000, based on PE: true

Associated: 00000000.00000002.2103534640.0000000000DB0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103580373.0000000000E3F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103580373.0000000000E65000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103609603.0000000000E6F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103621893.0000000000E78000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_db0000_New Quotation - FE7191PO154.jbxd

Similarity

API ID: __itow_s
String ID: xr$xr
API String ID: 3653519197-2528877900
Opcode ID: 001c9f88ae3a6640c7826f8977994124dbf3d36f074ac876543d75874aa2eb53
Instruction ID: 23ac8503663f88b55ae8d823fbaeca1285c7ee5065658802b52faf33a0d508e5
Opcode Fuzzy Hash: 001c9f88ae3a6640c7826f8977994124dbf3d36f074ac876543d75874aa2eb53
Instruction Fuzzy Hash: BCB1AF71A00219EFCB14EF54D891EEEB7B9FF58300F149459F946AB252EB70E981CB60

Function 00E1B217 Relevance: 5.5, APIs: 2, Strings: 1, Instructions: 201shareCOMMON

Download Yara Rule

APIs

Part of subcall function 00DCFEC6: _wcscpy.LIBCMT ref: 00DCFEE9

Part of subcall function 00DB9997: __itow.LIBCMT ref: 00DB99C2
Part of subcall function 00DB9997: __swprintf.LIBCMT ref: 00DB9A0C

__wcsnicmp.LIBCMT ref: 00E1B298
WNetUseConnectionW.MPR(00000000,?,?,00000000,?,?,00000100,?), ref: 00E1B361

Strings

LPT, xrefs: 00E1B292

Memory Dump Source

Source File: 00000000.00000002.2103545536.0000000000DB1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00DB0000, based on PE: true

Associated: 00000000.00000002.2103534640.0000000000DB0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103580373.0000000000E3F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103580373.0000000000E65000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103609603.0000000000E6F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103621893.0000000000E78000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_db0000_New Quotation - FE7191PO154.jbxd

Similarity

API ID: Connection__itow__swprintf__wcsnicmp_wcscpy
String ID: LPT
API String ID: 3222508074-1350329615
Opcode ID: 82f44be88b1f909e57aab4da6f75668ab885cd16010e82de3fbd59dfbe9a55f4
Instruction ID: 690d3d6f3243d1bbfe22d1969579358e8a5e865029e8fa2adec942d54c45decf
Opcode Fuzzy Hash: 82f44be88b1f909e57aab4da6f75668ab885cd16010e82de3fbd59dfbe9a55f4
Instruction Fuzzy Hash: AC616075A00215EFCB14EF94C895EEEB7B4EF08310F11506AF556BB2A1DB70AE84CB60

Function 00DC2AB7 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 144sleepCOMMON

Download Yara Rule

APIs

Sleep.KERNEL32(00000000), ref: 00DC2AC8
GlobalMemoryStatusEx.KERNEL32(?), ref: 00DC2AE1

Strings

@, xrefs: 00DC2AD5

Memory Dump Source

Source File: 00000000.00000002.2103545536.0000000000DB1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00DB0000, based on PE: true

Associated: 00000000.00000002.2103534640.0000000000DB0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103580373.0000000000E3F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103580373.0000000000E65000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103609603.0000000000E6F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103621893.0000000000E78000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_db0000_New Quotation - FE7191PO154.jbxd

Similarity

API ID: GlobalMemorySleepStatus
String ID: @
API String ID: 2783356886-2766056989
Opcode ID: 401e1c7029b41c5f4f938072e9ec8783625d28a1d527a5a05b90d408206a67c0
Instruction ID: e077850352c330eac4a208e6f104e6fb9039dad5ef191dce5fc8e5415558894a
Opcode Fuzzy Hash: 401e1c7029b41c5f4f938072e9ec8783625d28a1d527a5a05b90d408206a67c0
Instruction Fuzzy Hash: B6515872418784DBD320AF10D896BABBBF8FF85314F42485DF2DA511A1DB308569CB26

Function 00E199BE Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 138COMMON

Download Yara Rule

APIs

Part of subcall function 00DB506B: __fread_nolock.LIBCMT ref: 00DB5089

_wcscmp.LIBCMT ref: 00E19AAE
_wcscmp.LIBCMT ref: 00E19AC1

Strings

FILE, xrefs: 00E199FA

Memory Dump Source

Source File: 00000000.00000002.2103545536.0000000000DB1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00DB0000, based on PE: true

Associated: 00000000.00000002.2103534640.0000000000DB0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103580373.0000000000E3F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103580373.0000000000E65000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103609603.0000000000E6F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103621893.0000000000E78000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_db0000_New Quotation - FE7191PO154.jbxd

Similarity

API ID: _wcscmp$__fread_nolock
String ID: FILE
API String ID: 4029003684-3121273764
Opcode ID: 38627a8ba750cdae1ff98a3d8f6a614b808c7278ea434537f4b769e60eb8ed3f
Instruction ID: 305cc4735f80d1960bce472d525e8823cb7f0f2b31ef4aaabd69da6691ec02c7
Opcode Fuzzy Hash: 38627a8ba750cdae1ff98a3d8f6a614b808c7278ea434537f4b769e60eb8ed3f
Instruction Fuzzy Hash: 1F41F771A00609BADF20AAA0DC46FEFBBFDDF45714F00007AFA01B7185DA75AA4487B1

Function 00DF099E Relevance: 5.4, APIs: 1, Strings: 2, Instructions: 115COMMON

Download Yara Rule

APIs

VariantClear.OLEAUT32 ref: 00DF09A9

Strings

Dt, xrefs: 00DBA2B1
Dt, xrefs: 00DBA477

Memory Dump Source

Source File: 00000000.00000002.2103545536.0000000000DB1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00DB0000, based on PE: true

Associated: 00000000.00000002.2103534640.0000000000DB0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103580373.0000000000E3F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103580373.0000000000E65000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103609603.0000000000E6F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103621893.0000000000E78000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_db0000_New Quotation - FE7191PO154.jbxd

Similarity

API ID: ClearVariant
String ID: Dt$Dt
API String ID: 1473721057-4168040075
Opcode ID: 8aba312a8eb60ef5f4cfe0b9473e41cb8b0c6089b387a67ea562d56a59d4f887
Instruction ID: 8d383924d27fe99d6165bbabcff8d98cdaa76f4dd0117cdb36cec0cbb43e95a2
Opcode Fuzzy Hash: 8aba312a8eb60ef5f4cfe0b9473e41cb8b0c6089b387a67ea562d56a59d4f887
Instruction Fuzzy Hash: 0F510574608341DFC754CF19C480A6ABBF1BB99344F58885DE9968B321E731EC85CF62

Function 00E22882 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 97networkCOMMON

Download Yara Rule

APIs

_memset.LIBCMT ref: 00E22892
InternetCrackUrlW.WININET(?,00000000,00000000,0000007C), ref: 00E228C8

Strings

|, xrefs: 00E22899

Memory Dump Source

Source File: 00000000.00000002.2103545536.0000000000DB1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00DB0000, based on PE: true

Associated: 00000000.00000002.2103534640.0000000000DB0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103580373.0000000000E3F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103580373.0000000000E65000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103609603.0000000000E6F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103621893.0000000000E78000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_db0000_New Quotation - FE7191PO154.jbxd

Similarity

API ID: CrackInternet_memset
String ID: |
API String ID: 1413715105-2343686810
Opcode ID: 8b639eb1c252e7fe5361e863e6730b3f50ac04eb4ad6f59b51465400ac8e19fc
Instruction ID: 4f38ada1f7f5110345ee4d778b753e859961b133c804f4e4e9797a6b9718bd1f
Opcode Fuzzy Hash: 8b639eb1c252e7fe5361e863e6730b3f50ac04eb4ad6f59b51465400ac8e19fc
Instruction Fuzzy Hash: 88310571800119AFCF11AFA1DC85EEEBFB9FF48300F104029E915A6266DA315A56DBB0

Function 00E36CD2 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 95COMMON

Download Yara Rule

APIs

DestroyWindow.USER32(?,?,?,?), ref: 00E36D86
MoveWindow.USER32(?,?,?,?,?,00000001,?,?,?), ref: 00E36DC2

Strings

static, xrefs: 00E36D22

Memory Dump Source

Source File: 00000000.00000002.2103545536.0000000000DB1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00DB0000, based on PE: true

Associated: 00000000.00000002.2103534640.0000000000DB0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103580373.0000000000E3F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103580373.0000000000E65000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103609603.0000000000E6F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103621893.0000000000E78000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_db0000_New Quotation - FE7191PO154.jbxd

Similarity

API ID: Window$DestroyMove
String ID: static
API String ID: 2139405536-2160076837
Opcode ID: effb87b5be17830cd396b655d154f3fa22b019018a504b24aaf05057bf90e322
Instruction ID: 8484ac40c3ed984598d3921f8e1e8dcfe27a9ca22f292211da7da38e73b209d1
Opcode Fuzzy Hash: effb87b5be17830cd396b655d154f3fa22b019018a504b24aaf05057bf90e322
Instruction Fuzzy Hash: 35319071200604AEDB109F74CC44AFB7BB8FF88724F509519F996A7190CA31AC91CB60

Function 00E12D91 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 88windowCOMMON

Download Yara Rule

APIs

_memset.LIBCMT ref: 00E12E00
GetMenuItemInfoW.USER32(?,?,00000000,00000030), ref: 00E12E3B

Strings

0, xrefs: 00E12DF9

Memory Dump Source

Source File: 00000000.00000002.2103545536.0000000000DB1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00DB0000, based on PE: true

Associated: 00000000.00000002.2103534640.0000000000DB0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103580373.0000000000E3F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103580373.0000000000E65000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103609603.0000000000E6F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103621893.0000000000E78000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_db0000_New Quotation - FE7191PO154.jbxd

Similarity

API ID: InfoItemMenu_memset
String ID: 0
API String ID: 2223754486-4108050209
Opcode ID: 108d2a110893f08ba8b87464d25e4b84dffb7e0e3dba21612111f72c4251d895
Instruction ID: 1b50aab3f4f4935842f45ad68899bb71ea0c2fa88a4702dfc002808f78a8bc5f
Opcode Fuzzy Hash: 108d2a110893f08ba8b87464d25e4b84dffb7e0e3dba21612111f72c4251d895
Instruction Fuzzy Hash: 5131C531A00309ABEF268F58DC45BEEBBB5EF05354F14502EEA86B61A0E77099D4CB50

Function 00E36943 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 72windowCOMMON

Download Yara Rule

APIs

SendMessageW.USER32(00000000,00000143,00000000,?), ref: 00E369D0
SendMessageW.USER32(?,0000014E,00000000,00000000), ref: 00E369DB

Strings

Combobox, xrefs: 00E3699D

Memory Dump Source

Source File: 00000000.00000002.2103545536.0000000000DB1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00DB0000, based on PE: true

Associated: 00000000.00000002.2103534640.0000000000DB0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103580373.0000000000E3F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103580373.0000000000E65000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103609603.0000000000E6F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103621893.0000000000E78000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_db0000_New Quotation - FE7191PO154.jbxd

Similarity

API ID: MessageSend
String ID: Combobox
API String ID: 3850602802-2096851135
Opcode ID: df42529e513e53c4c741f1e7c981447d2f8bbfcc4263f05390d6c3897ef5a940
Instruction ID: 96a342e316baafab0730ec8424ad9dad74eadbc5d86e66dba687777a30547809
Opcode Fuzzy Hash: df42529e513e53c4c741f1e7c981447d2f8bbfcc4263f05390d6c3897ef5a940
Instruction Fuzzy Hash: A411B6716002087FEF159E24CC94FFB3F6AEB993A8F115125F958AB290D6719C51C7A0

Function 00E36E76 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 68COMMON

Download Yara Rule

APIs

Part of subcall function 00DB1D35: CreateWindowExW.USER32(?,?,?,?,?,?,?,?,?,?,00000000,00000096), ref: 00DB1D73
Part of subcall function 00DB1D35: GetStockObject.GDI32(00000011), ref: 00DB1D87
Part of subcall function 00DB1D35: SendMessageW.USER32(00000000,00000030,00000000), ref: 00DB1D91

GetWindowRect.USER32(00000000,?), ref: 00E36EE0
GetSysColor.USER32(00000012), ref: 00E36EFA

Strings

static, xrefs: 00E36EBD

Memory Dump Source

Source File: 00000000.00000002.2103545536.0000000000DB1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00DB0000, based on PE: true

Associated: 00000000.00000002.2103534640.0000000000DB0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103580373.0000000000E3F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103580373.0000000000E65000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103609603.0000000000E6F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103621893.0000000000E78000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_db0000_New Quotation - FE7191PO154.jbxd

Similarity

API ID: Window$ColorCreateMessageObjectRectSendStock
String ID: static
API String ID: 1983116058-2160076837
Opcode ID: 93639377d24e325c51f2077db985bdd78de914963776e08d29d6263988b34b7d
Instruction ID: f93b63b3acc32ba7ce3ad9808384fcc7098605253dcc290baa6fba423bc344c7
Opcode Fuzzy Hash: 93639377d24e325c51f2077db985bdd78de914963776e08d29d6263988b34b7d
Instruction Fuzzy Hash: 2C211772A1020AAFDB04DFB8DD49AEA7BB8EB08314F015629F955E2250D634A865DB60

Function 00E36B8F Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 64windowCOMMON

Download Yara Rule

APIs

GetWindowTextLengthW.USER32(00000000), ref: 00E36C11
SendMessageW.USER32(?,000000B1,00000000,00000000), ref: 00E36C20

Strings

edit, xrefs: 00E36BF5

Memory Dump Source

Source File: 00000000.00000002.2103545536.0000000000DB1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00DB0000, based on PE: true

Associated: 00000000.00000002.2103534640.0000000000DB0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103580373.0000000000E3F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103580373.0000000000E65000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103609603.0000000000E6F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103621893.0000000000E78000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_db0000_New Quotation - FE7191PO154.jbxd

Similarity

API ID: LengthMessageSendTextWindow
String ID: edit
API String ID: 2978978980-2167791130
Opcode ID: a39f40703b070b7ca96d959629ab35479f65b362db6d4f63270781d8ed93e68b
Instruction ID: d5d65b05124c27e7ddda745ad4dd3d960102988f2f54b04a90afb303232cff3f
Opcode Fuzzy Hash: a39f40703b070b7ca96d959629ab35479f65b362db6d4f63270781d8ed93e68b
Instruction Fuzzy Hash: 8D119A71500208BFEB108E74DC49AEA7FA9EB04368F20A724F965E31E0C735DC90DB60

Function 00E12E9E Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 63windowCOMMON

Download Yara Rule

APIs

_memset.LIBCMT ref: 00E12F11
GetMenuItemInfoW.USER32(00000030,?,00000000,00000030), ref: 00E12F30

Strings

0, xrefs: 00E12F07

Memory Dump Source

Source File: 00000000.00000002.2103545536.0000000000DB1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00DB0000, based on PE: true

Associated: 00000000.00000002.2103534640.0000000000DB0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103580373.0000000000E3F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103580373.0000000000E65000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103609603.0000000000E6F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103621893.0000000000E78000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_db0000_New Quotation - FE7191PO154.jbxd

Similarity

API ID: InfoItemMenu_memset
String ID: 0
API String ID: 2223754486-4108050209
Opcode ID: 005e5cb2ac963a8e5cc787f743c98f37a367979d2735acbfc149e0eb2f917735
Instruction ID: 3caf8e604dc6a237e104b2d0da9d80fdfb82aba83b2d95bf02bab735ce5af59f
Opcode Fuzzy Hash: 005e5cb2ac963a8e5cc787f743c98f37a367979d2735acbfc149e0eb2f917735
Instruction Fuzzy Hash: 5C112635E00214ABDB31DB58DC04BD977B9EB09308F0410A9EA14B72A0D770ED99C791

Function 00E224CA Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 62networkCOMMON

Download Yara Rule

APIs

InternetOpenW.WININET(?,00000000,00000000,00000000,00000000), ref: 00E22520
InternetSetOptionW.WININET(00000000,00000032,?,00000008), ref: 00E22549

Strings

<local>, xrefs: 00E22511

Memory Dump Source

Source File: 00000000.00000002.2103545536.0000000000DB1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00DB0000, based on PE: true

Associated: 00000000.00000002.2103534640.0000000000DB0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103580373.0000000000E3F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103580373.0000000000E65000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103609603.0000000000E6F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103621893.0000000000E78000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_db0000_New Quotation - FE7191PO154.jbxd

Similarity

API ID: Internet$OpenOption
String ID: <local>
API String ID: 942729171-4266983199
Opcode ID: 161daec1fae8f4a56a5163af327c4b97057d9c764e7bdf318b49796724364058
Instruction ID: c2ef3dc47be3a7dde5d37ab6d5355300f87ad5b4090b6f8993d451ddbf74dab6
Opcode Fuzzy Hash: 161daec1fae8f4a56a5163af327c4b97057d9c764e7bdf318b49796724364058
Instruction Fuzzy Hash: 7D11E070580235BEDB249F61AC99EFBFF68FB06355F10912EFA0566040D6706944DAE1

Function 00E280A0 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 55networkCOMMON

Download Yara Rule

APIs

Part of subcall function 00E2830B: WideCharToMultiByte.KERNEL32(00000000,00000000,?,?,00000000,00000000,00000000,00000000,?,?,?,00E280C8,?,00000000,?,?), ref: 00E28322

inet_addr.WSOCK32(00000000,?,00000000,?,?,?,00000000), ref: 00E280CB
htons.WSOCK32(00000000,?,00000000), ref: 00E28108

Strings

255.255.255.255, xrefs: 00E280E3

Memory Dump Source

Source File: 00000000.00000002.2103545536.0000000000DB1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00DB0000, based on PE: true

Associated: 00000000.00000002.2103534640.0000000000DB0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103580373.0000000000E3F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103580373.0000000000E65000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103609603.0000000000E6F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103621893.0000000000E78000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_db0000_New Quotation - FE7191PO154.jbxd

Similarity

API ID: ByteCharMultiWidehtonsinet_addr
String ID: 255.255.255.255
API String ID: 2496851823-2422070025
Opcode ID: 67c707b8e204c510c0c1123c6b6d7e997131edf4fbb002d4b7998f378760cc48
Instruction ID: 589a5342cd8b586a7f28203f869ae2c1dab0428ca901d53b2418b9078a301f6c
Opcode Fuzzy Hash: 67c707b8e204c510c0c1123c6b6d7e997131edf4fbb002d4b7998f378760cc48
Instruction Fuzzy Hash: DD112130600219ABDB20AF64EC46FEEB774FF50320F108527E911B72D1DB32A815C7A1

Function 00DC0A8D Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 52COMMON

Download Yara Rule

APIs

GetFullPathNameW.KERNEL32(?,00007FFF,?,?,?,00DB3C26,00E762F8,?,?,?), ref: 00DC0ACE

Part of subcall function 00DB7D2C: _memmove.LIBCMT ref: 00DB7D66

_wcscat.LIBCMT ref: 00DF50E1

Strings

c, xrefs: 00DC0B0E

Memory Dump Source

Source File: 00000000.00000002.2103545536.0000000000DB1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00DB0000, based on PE: true

Associated: 00000000.00000002.2103534640.0000000000DB0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103580373.0000000000E3F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103580373.0000000000E65000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103609603.0000000000E6F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103621893.0000000000E78000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_db0000_New Quotation - FE7191PO154.jbxd

Similarity

API ID: FullNamePath_memmove_wcscat
String ID: c
API String ID: 257928180-921687731
Opcode ID: 2cbab6fa3a0c8462395f219479f249f05b25826c0f0b659b8aa7c97d574930da
Instruction ID: be63b4695a2c65158214c75aadf6267bf978041308038d0be4f2fa0b9aaf345c
Opcode Fuzzy Hash: 2cbab6fa3a0c8462395f219479f249f05b25826c0f0b659b8aa7c97d574930da
Instruction Fuzzy Hash: 3A11653590421DEB8B41EB64DC42FDD77B9EF48354B0040A9B99DE7291EA70DA889B31

Function 00E092E7 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 52windowCOMMON

Download Yara Rule

APIs

Part of subcall function 00DB7F41: _memmove.LIBCMT ref: 00DB7F82

Part of subcall function 00E0B0C4: GetClassNameW.USER32(?,?,000000FF), ref: 00E0B0E7

SendMessageW.USER32(?,000001A2,000000FF,?), ref: 00E09355

Strings

ListBox, xrefs: 00E0931F
ComboBox, xrefs: 00E092F4

Memory Dump Source

Source File: 00000000.00000002.2103545536.0000000000DB1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00DB0000, based on PE: true

Associated: 00000000.00000002.2103534640.0000000000DB0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103580373.0000000000E3F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103580373.0000000000E65000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103609603.0000000000E6F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103621893.0000000000E78000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_db0000_New Quotation - FE7191PO154.jbxd

Similarity

API ID: ClassMessageNameSend_memmove
String ID: ComboBox$ListBox
API String ID: 372448540-1403004172
Opcode ID: f1fd2fc2b88603c2bd2aa874e68ab21bac31202d8c2a396e9c95f6f517c82529
Instruction ID: 2a3ee264534ac5be9114ccb6b3b4d33e8beefa44813fdba51bad03b759a89d5e
Opcode Fuzzy Hash: f1fd2fc2b88603c2bd2aa874e68ab21bac31202d8c2a396e9c95f6f517c82529
Instruction Fuzzy Hash: 30018C71A45219ABCB04AFA4CC928FE77ADFF46320B141619F822772D2DA3569488A60

Function 00E091DF Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 50windowCOMMON

Download Yara Rule

APIs

Part of subcall function 00DB7F41: _memmove.LIBCMT ref: 00DB7F82

Part of subcall function 00E0B0C4: GetClassNameW.USER32(?,?,000000FF), ref: 00E0B0E7

SendMessageW.USER32(?,00000180,00000000,?), ref: 00E0924D

Strings

ListBox, xrefs: 00E09217
ComboBox, xrefs: 00E091EC

Memory Dump Source

Source File: 00000000.00000002.2103545536.0000000000DB1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00DB0000, based on PE: true

Associated: 00000000.00000002.2103534640.0000000000DB0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103580373.0000000000E3F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103580373.0000000000E65000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103609603.0000000000E6F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103621893.0000000000E78000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_db0000_New Quotation - FE7191PO154.jbxd

Similarity

API ID: ClassMessageNameSend_memmove
String ID: ComboBox$ListBox
API String ID: 372448540-1403004172
Opcode ID: 83df19e61639775bfc130c2f4d0ab551e8c2311ad1bd128f4b10754f8787c083
Instruction ID: 52eb667d1b3a4069f36888cf2f7ffb3f8b0aebe4ebeba900bdfa7821d380cfc2
Opcode Fuzzy Hash: 83df19e61639775bfc130c2f4d0ab551e8c2311ad1bd128f4b10754f8787c083
Instruction Fuzzy Hash: 3F018471A41208BBCB04EBA0D992EFF77ACEF45340F141119B913772D3EA216E4C96B1

Function 00E09264 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 49windowCOMMON

Download Yara Rule

APIs

Part of subcall function 00DB7F41: _memmove.LIBCMT ref: 00DB7F82

Part of subcall function 00E0B0C4: GetClassNameW.USER32(?,?,000000FF), ref: 00E0B0E7

SendMessageW.USER32(?,00000182,?,00000000), ref: 00E092D0

Strings

ListBox, xrefs: 00E0929C
ComboBox, xrefs: 00E09271

Memory Dump Source

Source File: 00000000.00000002.2103545536.0000000000DB1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00DB0000, based on PE: true

Associated: 00000000.00000002.2103534640.0000000000DB0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103580373.0000000000E3F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103580373.0000000000E65000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103609603.0000000000E6F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103621893.0000000000E78000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_db0000_New Quotation - FE7191PO154.jbxd

Similarity

API ID: ClassMessageNameSend_memmove
String ID: ComboBox$ListBox
API String ID: 372448540-1403004172
Opcode ID: 9f6ede590507b1f729b3f08e2d026d13beb8204f60f8aee1eb88fa0bd71257ac
Instruction ID: ffc49ba8f8ade57584b37e197972f8b2b7b9a672c35465bbf692d6bb035171a7
Opcode Fuzzy Hash: 9f6ede590507b1f729b3f08e2d026d13beb8204f60f8aee1eb88fa0bd71257ac
Instruction Fuzzy Hash: C301A271A81208BBCB04EBA0D992EFF77ACEF15340F242115B853732D3DA215E4C9275

Function 00DD6DAE Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 45COMMON

Download Yara Rule

APIs

__calloc_crt.LIBCMT ref: 00DD6DD0
__calloc_crt.LIBCMT ref: 00DD6DE9

Strings

@R, xrefs: 00DD6E00

Memory Dump Source

Source File: 00000000.00000002.2103545536.0000000000DB1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00DB0000, based on PE: true

Associated: 00000000.00000002.2103534640.0000000000DB0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103580373.0000000000E3F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103580373.0000000000E65000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103609603.0000000000E6F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103621893.0000000000E78000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_db0000_New Quotation - FE7191PO154.jbxd

Similarity

API ID: __calloc_crt
String ID: @R
API String ID: 3494438863-2347139750
Opcode ID: 19df63f6ad182dd363e0ca1c29b88de031592d0a9810f67d9b5fdb73aeff4fa5
Instruction ID: 75d356fef272f302466778961efd5eb31e5f1cd36837046aa1756f8310176ed7
Opcode Fuzzy Hash: 19df63f6ad182dd363e0ca1c29b88de031592d0a9810f67d9b5fdb73aeff4fa5
Instruction Fuzzy Hash: 7AF06271348A56DFF764CF2ABD116653B96EB44724B154427F108EA3A2EB30CCCA96F0

Function 00E151CA Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 29COMMON

Download Yara Rule

APIs

GetClassNameW.USER32(?,?,00000100), ref: 00E151E8
_wcscmp.LIBCMT ref: 00E151FA

Strings

#32770, xrefs: 00E151F4

Memory Dump Source

Source File: 00000000.00000002.2103545536.0000000000DB1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00DB0000, based on PE: true

Associated: 00000000.00000002.2103534640.0000000000DB0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103580373.0000000000E3F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103580373.0000000000E65000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103609603.0000000000E6F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103621893.0000000000E78000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_db0000_New Quotation - FE7191PO154.jbxd

Similarity

API ID: ClassName_wcscmp
String ID: #32770
API String ID: 2292705959-463685578
Opcode ID: e4a833d5db0b916653c853e52366a526b1b13072767951b3a55919afde9c00e4
Instruction ID: 34d65d8f9704133bca601501ca2f91cc674a0abaed5aad23a2cf69de5b624560
Opcode Fuzzy Hash: e4a833d5db0b916653c853e52366a526b1b13072767951b3a55919afde9c00e4
Instruction Fuzzy Hash: ABE02B3390032C2BD7109795AC09A97F7ACEB40761F000067F914E3050E56099448BE1

Function 00E081BC Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 22windowCOMMON

Download Yara Rule

APIs

MessageBoxW.USER32(00000000,Error allocating memory.,AutoIt,00000010), ref: 00E081CA

Part of subcall function 00DD3598: _doexit.LIBCMT ref: 00DD35A2

Strings

Error allocating memory., xrefs: 00E081C3
AutoIt, xrefs: 00E081BE

Memory Dump Source

Source File: 00000000.00000002.2103545536.0000000000DB1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00DB0000, based on PE: true

Associated: 00000000.00000002.2103534640.0000000000DB0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103580373.0000000000E3F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103580373.0000000000E65000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103609603.0000000000E6F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103621893.0000000000E78000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_db0000_New Quotation - FE7191PO154.jbxd

Similarity

API ID: Message_doexit
String ID: AutoIt$Error allocating memory.
API String ID: 1993061046-4017498283
Opcode ID: 35e76ef494f3870b80806e50313cba05d84b0fe3255dffea13baec5adc423982
Instruction ID: 91bb3be9af26c1c833a14b461240c933ead732c04ac40ce34890ee775662505d
Opcode Fuzzy Hash: 35e76ef494f3870b80806e50313cba05d84b0fe3255dffea13baec5adc423982
Instruction Fuzzy Hash: E2D05B323C531836D21432A57D0BFC57A48CF15B56F005056FB08755D38DD299C142F9

Function 00DEB511 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 22COMMON

Download Yara Rule

APIs

Part of subcall function 00DEB564: _memset.LIBCMT ref: 00DEB571

Part of subcall function 00DD0B84: InitializeCriticalSectionAndSpinCount.KERNEL32(?,00000000,?,00DEB540,?,?,?,00DB100A), ref: 00DD0B89

IsDebuggerPresent.KERNEL32(?,?,?,00DB100A), ref: 00DEB544
OutputDebugStringW.KERNEL32(ERROR : Unable to initialize critical section in CAtlBaseModule,?,?,?,00DB100A), ref: 00DEB553

Strings

ERROR : Unable to initialize critical section in CAtlBaseModule, xrefs: 00DEB54E

Memory Dump Source

Source File: 00000000.00000002.2103545536.0000000000DB1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00DB0000, based on PE: true

Associated: 00000000.00000002.2103534640.0000000000DB0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103580373.0000000000E3F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103580373.0000000000E65000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103609603.0000000000E6F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103621893.0000000000E78000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_db0000_New Quotation - FE7191PO154.jbxd

Similarity

API ID: CountCriticalDebugDebuggerInitializeOutputPresentSectionSpinString_memset
String ID: ERROR : Unable to initialize critical section in CAtlBaseModule
API String ID: 3158253471-631824599
Opcode ID: 92b2c8dc471d0e9669f9780a4589a6a9286501cb34e5ec9dbea05e03b3291a63
Instruction ID: f7b2f666b64504ae30bbad7ac2d80fdff8c2c775fa5f6adaf2d6910b23699ecf
Opcode Fuzzy Hash: 92b2c8dc471d0e9669f9780a4589a6a9286501cb34e5ec9dbea05e03b3291a63
Instruction Fuzzy Hash: C0E06D70600755CFD721EF2AD5093437BE0AB04715F04892EE886D2761EBB4E448CB71

Function 00E35BEB Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 15windowCOMMON

Download Yara Rule

APIs

FindWindowW.USER32(Shell_TrayWnd,00000000), ref: 00E35BF5
PostMessageW.USER32(00000000,00000111,00000197,00000000), ref: 00E35C08

Part of subcall function 00E154E6: Sleep.KERNEL32(?,00000000,?,?,?,?,?,?,?,?,?,?), ref: 00E1555E

Strings

Shell_TrayWnd, xrefs: 00E35BEE

Memory Dump Source

Source File: 00000000.00000002.2103545536.0000000000DB1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00DB0000, based on PE: true

Associated: 00000000.00000002.2103534640.0000000000DB0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103580373.0000000000E3F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103580373.0000000000E65000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103609603.0000000000E6F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2103621893.0000000000E78000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_db0000_New Quotation - FE7191PO154.jbxd

Similarity

API ID: FindMessagePostSleepWindow
String ID: Shell_TrayWnd
API String ID: 529655941-2988720461
Opcode ID: f1ce7eeb9f1b9803587b7af3bee0c2eeab7f9a403a91fe172619899e57b7751b
Instruction ID: 2666d4452d5d985a37c402767f3ecc1a2804152d5f6ba5a07629130ba83ccc49
Opcode Fuzzy Hash: f1ce7eeb9f1b9803587b7af3bee0c2eeab7f9a403a91fe172619899e57b7751b
Instruction Fuzzy Hash: F8D0A932B88300BAE334AB30AC0FFD32A10AB40B40F000834B216BA0E0C8E45800C640

Description:	Adversaries may obtain and abuse credentials of existing accounts as a means of gaining Initial Access, Persistence, Privilege Escalation, or Defense Evasion. Compromised credentials may be used to bypass access controls placed on various resources on systems within the network and may even be used for persistent access to remote systems and externally available services, such as VPNs, Outlook Web Access, network devices, and remote desktop.Compromised credentials may also grant an adversary increased privilege to specific systems or access to restricted areas of the network. Adversaries may choose not to use malware or tools in conjunction with the legitimate access those credentials provide to make it harder to detect their presence.
Tactics:	Defense Evasion, Initial Access, Persistence, Privilege Escalation
Data Sources:	Logon Session: Logon Session Creation, Logon Session: Logon Session Metadata, User Account: User Account Authentication
Platforms:	Azure AD, Containers, Google Workspace, IaaS, Linux, macOS, Network, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may interact with the native OS application programming interface (API) to execute behaviors. Native APIs provide a controlled means of calling low-level OS services within the kernel, such as those involving hardware/devices, memory, and processes.These native APIs are leveraged by the OS during system boot (when other system components are not yet initialized) as well as carrying out tasks and requests during routine operations.
Tactics:	Execution
Data Sources:	Module: Module Load, Process: OS API Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may execute their own malicious payloads by side-loading DLLs. Similar to DLL Search Order Hijacking , side-loading involves hijacking which DLL a program loads. But rather than just planting the DLL within the search order of a program then waiting for the victim application to be invoked, adversaries may directly side-load their payloads by planting then invoking a legitimate application that executes their payload(s).
Tactics:	Defense Evasion, Persistence, Privilege Escalation
Data Sources:	File: File Creation, File: File Modification, Module: Module Load, Process: Process Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may exploit software vulnerabilities in an attempt to elevate privileges. Exploitation of a software vulnerability occurs when an adversary takes advantage of a programming error in a program, service, or within the operating system software or kernel itself to execute adversary-controlled code. Security constructs such as permission levels will often hinder access to information and use of certain techniques, so adversaries will likely need to perform privilege escalation to include use of software exploitation to circumvent those restrictions.
Tactics:	Privilege Escalation
Data Sources:	Driver: Driver Load, Process: Process Creation
Platforms:	Containers, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may modify access tokens to operate under a different user or system security context to perform actions and bypass access controls. Windows uses access tokens to determine the ownership of a running process. A user can manipulate access tokens to make a running process appear as though it is the child of a different process or belongs to someone other than the user that started the process. When this occurs, the process also takes on the security context associated with the new token.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	Active Directory: Active Directory Object Modification, Command: Command Execution, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, User Account: User Account Metadata
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	File: File Metadata, File: File Modification, Module: Module Load, Process: OS API Execution, Process: Process Access, Process: Process Metadata, Process: Process Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may modify and/or disable security tools to avoid possible detection of their malware/tools and activities. This may take many forms, such as killing security software processes or services, modifying / deleting Registry keys or configuration files so that tools do not operate properly, or other methods to interfere with security tools scanning or reporting information. Adversaries may also disable updates to prevent the latest security patches from reaching tools on victim systems.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, Driver: Driver Load, Process: Process Creation, Process: Process Termination, Sensor Health: Host Status, Service: Service Metadata, Windows Registry: Windows Registry Key Deletion, Windows Registry: Windows Registry Key Modification
Platforms:	Containers, IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ various means to detect and avoid virtualization and analysis environments. This may include changing behaviors based on the results of checks for the presence of artifacts indicative of a virtual machine environment (VME) or sandbox. If the adversary detects a VME, they may alter their malware to disengage from the victim or conceal the core functions of the implant. They may also search for VME artifacts before dropping secondary or additional payloads. Adversaries may use the information learned from [Virtualization/Sandbox Evasion](https://attack.mitre.org/techniques/T1497) during automated discovery to shape follow-on behaviors.
Tactics:	Defense Evasion, Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use Obfuscated Files or Information to hide artifacts of an intrusion from analysis. They may require separate mechanisms to decode or deobfuscate that information depending on how they intend to use it. Methods for doing that include built-in functionality of malware or by using utilities present on the system.
Tactics:	Defense Evasion
Data Sources:	File: File Modification, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit. This is common behavior that can be used across different platforms and the network to evade defenses.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Creation, File: File Metadata, Module: Module Load, Process: OS API Execution, Process: Process Creation, Script: Script Execution, WMI: WMI Creation, Windows Registry: Windows Registry Key Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use methods of capturing user input to obtain credentials or collect information. During normal system usage, users often provide credentials to various different locations, such as login pages/portals or system dialog boxes. Input capture mechanisms may be transparent to the user (e.g. Credential API Hooking ) or rely on deceiving the user into providing input into what they believe to be a genuine service (e.g. Web Portal Capture ).
Tactics:	Collection, Credential Access
Data Sources:	Driver: Driver Load, File: File Modification, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, Windows Registry: Windows Registry Key Modification
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may gather the system time and/or time zone from a local or remote system. The system time is set and stored by the Windows Time Service within a domain to maintain time synchronization between systems and services in an enterprise network.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of security software, configurations, defensive tools, and sensors that are installed on a system or in a cloud environment. This may include things such as firewall rules and anti-virus. Adversaries may use the information from Security Software Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Firewall: Firewall Enumeration, Firewall: Firewall Metadata, Process: OS API Execution, Process: Process Creation
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get information about running processes on a system. Information obtained could be used to gain an understanding of common software/applications running on systems within the network. Adversaries may use the information from Process Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to identify the primary user, currently logged in user, set of users that commonly uses a system, or whether a user is actively using the system. They may do this, for example, by retrieving account usernames or by using OS Credential Dumping . The information may be collected in a number of different ways using other Discovery techniques, because user and username details are prevalent throughout a system and include running process ownership, file/directory ownership, session information, and system logs. Adversaries may use the information from [System Owner/User Discovery](https://attack.mitre.org/techniques/T1033) during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Active Directory: Active Directory Object Access, Command: Command Execution, File: File Access, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow, Process: OS API Execution, Process: Process Access, Process: Process Creation, Windows Registry: Windows Registry Key Access
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may enumerate files and directories or may search in specific locations of a host or network share for certain information within a file system. Adversaries may use the information from File and Directory Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may compress and/or encrypt data that is collected prior to exfiltration. Compressing the data can help to obfuscate the collected data and minimize the amount of data sent over the network. Encryption can be used to hide information that is being exfiltrated from detection or make exfiltration less conspicuous upon inspection by a defender.
Tactics:	Collection
Data Sources:	Command: Command Execution, File: File Creation, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may collect data stored in the clipboard from users copying information within or between applications.
Tactics:	Collection
Data Sources:	Command: Command Execution, Process: OS API Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ a known encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Despite the use of a secure algorithm, these implementations may be vulnerable to reverse engineering if secret keys are encoded and/or generated within malware samples/configuration files.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may transfer tools or other files from an external system into a compromised environment. Tools or files may be copied from an external adversary-controlled system to the victim network through the command and control channel or through alternate protocols such as ftp . Once present, adversaries may also transfer/spread tools between victim devices within a compromised environment (i.e. Lateral Tool Transfer ).
Tactics:	Command and Control
Data Sources:	Command: Command Execution, File: File Creation, Network Traffic: Network Connection Creation, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report New Quotation - FE7191PO154.exe

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Threat Intel

Malware Configuration

Yara Signatures

Memory Dumps

Unpacked PEs

Sigma Signatures

System Summary

Snort Signatures

Joe Sandbox Signatures

AV Detection

Compliance

Spreading

Networking

Key, Mouse, Clipboard, Microphone and Screen Capturing

E-Banking Fraud

System Summary

Data Obfuscation

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

Anti Debugging

HIPS / PFW / Operating System Protection Evasion

Language, Device and Operating System Detection

Stealing of Sensitive Information

Remote Access Functionality

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

World Map of Contacted IPs

General Information

Warnings

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

C:\Users\user\AppData\Local\Temp\aut10C0.tmp

C:\Users\user\AppData\Local\Temp\aut10E0.tmp

C:\Users\user\AppData\Local\Temp\derogates

C:\Users\user\AppData\Local\Temp\nonagglutinant

Static File Info

General

File Icon

Static PE Info

General

Entrypoint Preview

Rich Headers

Data Directories

Sections

Resources

Imports

Possible Origin

Network Behavior

Statistics

Windows Analysis Report
New Quotation - FE7191PO154.exe

Function 00DB3B4C Relevance: 19.4, APIs: 8, Strings: 3, Instructions: 153
windowCOMMON

Function 00DB4AFE Relevance: 10.7, APIs: 7, Instructions: 223
COMMON

Function 00DB4FE9 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 62
COMMON

Function 00E193DF Relevance: 19.8, APIs: 13, Instructions: 322
fileCOMMON

Function 00DB3015 Relevance: 19.3, APIs: 7, Strings: 4, Instructions: 73
windowregistryCOMMON

Function 00DB3041 Relevance: 19.3, APIs: 7, Strings: 4, Instructions: 54
windowregistryCOMMON

Function 00DB71EB Relevance: 17.7, APIs: 6, Strings: 4, Instructions: 201
registryCOMMON

Function 00DB3633 Relevance: 17.7, APIs: 8, Strings: 2, Instructions: 151
windowtimeregistryCOMMON

Function 00DB3A58 Relevance: 17.6, APIs: 7, Strings: 3, Instructions: 71
windowregistryCOMMON

Function 00DB3778 Relevance: 16.0, APIs: 1, Strings: 8, Instructions: 267
COMMON

Function 00DBF8CF Relevance: 12.4, APIs: 3, Strings: 4, Instructions: 168
comCOMMON

Function 03042600 Relevance: 10.7, APIs: 7, Instructions: 239
fileCOMMON

Function 00DB39E7 Relevance: 10.5, APIs: 4, Strings: 2, Instructions: 44
COMMON

Function 030423B0 Relevance: 8.9, APIs: 4, Strings: 1, Instructions: 152
fileCOMMON

Function 00DB410D Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 88
windowCOMMON

Description:	Adversaries may shutdown/reboot systems to interrupt access to, or aid in the destruction of, those systems. Operating systems may contain commands to initiate a shutdown/reboot of a machine or network device. In some cases, these commands may also be used to initiate a shutdown/reboot of a remote computer or network device via Network Device CLI (e.g. `reload` ).
Tactics:	Impact
Data Sources:	Command: Command Execution, Process: Process Creation, Sensor Health: Host Status
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre