Edit tour

Windows Analysis Report
Ship Docs_CI PL HBL COO_.exe

Overview

General Information

Sample name:	Ship Docs_CI PL HBL COO_.exe
Analysis ID:	1467921
MD5:	bb66e44260b8a454abcb20aeb4b13f7b
SHA1:	dd6a7662d0f2a05f00dcc80dd6baa37cdefafba6
SHA256:	d4c4ee49a5ce076550c8305fcd63fe86707a251a2ca7d47c67d0dbef66b2a1e3
Tags:	exe
Infos:

Detection

AgentTesla

Score:	100
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

Antivirus detection for URL or domain

Found malware configuration

Malicious sample detected (through community Yara rule)

Multi AV Scanner detection for submitted file

Yara detected AgentTesla

Yara detected AntiVM3

AI detected suspicious sample

Binary is likely a compiled AutoIt script file

Check if machine is in data center or colocation facility

Contains functionality to check if a debugger is running (CheckRemoteDebuggerPresent)

Contains functionality to log keystrokes (.Net Source)

Machine Learning detection for sample

Maps a DLL or memory area into another process

Queries sensitive network adapter information (via WMI, Win32_NetworkAdapter, often done to detect virtual machines)

Queries sensitive video device information (via WMI, Win32_VideoController, often done to detect virtual machines)

Switches to a custom stack to bypass stack traces

Tries to detect sandboxes and other dynamic analysis tools (process name or module or function)

Tries to harvest and steal Putty / WinSCP information (sessions, passwords, etc)

Tries to harvest and steal browser information (history, passwords, etc)

Tries to harvest and steal ftp login credentials

Tries to steal Mail credentials (via file / registry access)

Writes to foreign memory regions

Yara detected Generic Downloader

Checks if the current process is being debugged

Contains functionality for read data from the clipboard

Contains functionality to block mouse and keyboard input (often used to hinder debugging)

Contains functionality to check if a debugger is running (IsDebuggerPresent)

Contains functionality to check if a debugger is running (OutputDebugString,GetLastError)

Contains functionality to check if a window is minimized (may be used to check if an application is visible)

Contains functionality to communicate with device drivers

Contains functionality to dynamically determine API calls

Contains functionality to execute programs as a different user

Contains functionality to launch a process as a different user

Contains functionality to launch a program with higher privileges

Contains functionality to modify clipboard data

Contains functionality to open a port and listen for incoming connection (possibly a backdoor)

Contains functionality to query CPU information (cpuid)

Contains functionality to read the PEB

Contains functionality to read the clipboard data

Contains functionality to retrieve information about pressed keystrokes

Contains functionality to shutdown / reboot the system

Contains functionality to simulate keystroke presses

Contains functionality to simulate mouse events

Contains functionality which may be used to detect a debugger (GetProcessHeap)

Contains long sleeps (>= 3 min)

Creates a process in suspended mode (likely to inject code)

Creates processes with suspicious names

Detected TCP or UDP traffic on non-standard ports

Detected potential crypto function

Extensive use of GetProcAddress (often used to hide API calls)

Found a high number of Window / User specific system calls (may be a loop to detect user behavior)

Found evasive API chain (date check)

Found large amount of non-executed APIs

Found potential string decryption / allocating functions

HTTP GET or POST without a user agent

IP address seen in connection with other malware

Internet Provider seen in connection with other malware

JA3 SSL client fingerprint seen in connection with other malware

May check the online IP address of the machine

OS version to string mapping found (often used in BOTs)

Potential key logger detected (key state polling based)

Queries sensitive BIOS Information (via WMI, Win32_Bios & Win32_BaseBoard, often done to detect virtual machines)

Queries sensitive processor information (via WMI, Win32_Processor, often done to detect virtual machines)

Queries the volume information (name, serial number etc) of a device

Sample file is different than original file name gathered from version info

Sigma detected: Suspicious Outbound SMTP Connections

Uses 32bit PE files

Uses SMTP (mail sending)

Uses a known web browser user agent for HTTP communication

Uses code obfuscation techniques (call, push, ret)

Yara detected Credential Stealer

Yara signature match

Classification

Process Tree

System is w10x64

Ship Docs_CI PL HBL COO_.exe (PID: 6752 cmdline: "C:\Users\user\Desktop\Ship Docs_CI PL HBL COO_.exe" MD5: BB66E44260B8A454ABCB20AEB4B13F7B)

RegSvcs.exe (PID: 6776 cmdline: "C:\Users\user\Desktop\Ship Docs_CI PL HBL COO_.exe" MD5: 9D352BC46709F0CB5EC974633A0C3C94)

cleanup

Malware Threat Intel

Provided by

Name	Description	Attribution	Blogpost URLs	Link
Agent Tesla, AgentTesla	A .NET based information stealer readily available to actors due to leaked builders. The malware is able to log keystrokes, can access the host's clipboard and crawls the disk for credentials or other valuable information. It has the capability to send information back to its C&C via HTTP(S), SMTP, FTP, or towards a Telegram channel.	SWEED	http://blog.nsfocus.net/sweed-611/ http://l1v1ngc0d3.wordpress.com/2021/11/12/agenttesla-dropped-via-nsis-installer/ http://ropgadget.com/posts/originlogger.html http://www.secureworks.com/research/threat-profiles/gold-galleon https://0xmrmagnezi.github.io/malware%20analysis/AgentTesla/	https://malpedia.caad.fkie.fraunhofer.de/details/win.agent_tesla

Malware Configuration

Threatname: Agenttesla

{"Exfil Mode": "SMTP", "Port": "587", "Host": "mail.suplementvases.com", "Username": "username: freshner@suplementvases.com", "Password": "u2FOHNL09DdqcPx"}

Yara Signatures

Memory Dumps

Source	Rule	Description	Author	Strings
00000001.00000002.4111602006.0000000000402000.00000040.80000000.00040000.00000000.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
00000001.00000002.4111602006.0000000000402000.00000040.80000000.00040000.00000000.sdmp	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
00000001.00000002.4112584252.000000000334C000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
00000001.00000002.4112584252.000000000334C000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
00000000.00000002.1644364725.0000000003010000.00000004.00001000.00020000.00000000.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
00000000.00000002.1644364725.0000000003010000.00000004.00001000.00020000.00000000.sdmp	JoeSecurity_GenericDownloader_1	Yara detected Generic Downloader	Joe Security
00000000.00000002.1644364725.0000000003010000.00000004.00001000.00020000.00000000.sdmp	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
00000000.00000002.1644364725.0000000003010000.00000004.00001000.00020000.00000000.sdmp	INDICATOR_SUSPICIOUS_EXE_VaultSchemaGUID	Detects executables referencing Windows vault credential objects. Observed in infostealers	ditekSHen	0x34b15:$s1: 2F1A6504-0641-44CF-8BB5-3612D865F2E5 0x34b87:$s2: 3CCD5499-87A8-4B10-A215-608888DD3B55 0x34c11:$s3: 154E23D0-C644-4E6F-8CE6-5069272F999F 0x34ca3:$s4: 4BF4C442-9B8A-41A0-B380-DD4A704DDB28 0x34d0d:$s5: 77BC582B-F0A6-4E15-4E80-61736B6F3B29 0x34d7f:$s6: E69D7838-91B5-4FC9-89D5-230D4D4CC2BC 0x34e15:$s7: 3E0E35BE-1B77-43E7-B873-AED901B6275B 0x34ea5:$s8: 3C886FF3-2669-4AA2-A8FB-3F6759A77548
Process Memory Space: Ship Docs_CI PL HBL COO_.exe PID: 6752	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
Process Memory Space: Ship Docs_CI PL HBL COO_.exe PID: 6752	JoeSecurity_AntiVM_3	Yara detected AntiVM_3	Joe Security
Process Memory Space: Ship Docs_CI PL HBL COO_.exe PID: 6752	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
Process Memory Space: RegSvcs.exe PID: 6776	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
Process Memory Space: RegSvcs.exe PID: 6776	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
Click to see the 8 entries

Unpacked PEs

Source	Rule	Description	Author	Strings
0.2.Ship Docs_CI PL HBL COO_.exe.3010000.1.raw.unpack	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
0.2.Ship Docs_CI PL HBL COO_.exe.3010000.1.raw.unpack	JoeSecurity_GenericDownloader_1	Yara detected Generic Downloader	Joe Security
0.2.Ship Docs_CI PL HBL COO_.exe.3010000.1.raw.unpack	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
0.2.Ship Docs_CI PL HBL COO_.exe.3010000.1.raw.unpack	INDICATOR_SUSPICIOUS_EXE_VaultSchemaGUID	Detects executables referencing Windows vault credential objects. Observed in infostealers	ditekSHen	0x34b15:$s1: 2F1A6504-0641-44CF-8BB5-3612D865F2E5 0x34b87:$s2: 3CCD5499-87A8-4B10-A215-608888DD3B55 0x34c11:$s3: 154E23D0-C644-4E6F-8CE6-5069272F999F 0x34ca3:$s4: 4BF4C442-9B8A-41A0-B380-DD4A704DDB28 0x34d0d:$s5: 77BC582B-F0A6-4E15-4E80-61736B6F3B29 0x34d7f:$s6: E69D7838-91B5-4FC9-89D5-230D4D4CC2BC 0x34e15:$s7: 3E0E35BE-1B77-43E7-B873-AED901B6275B 0x34ea5:$s8: 3C886FF3-2669-4AA2-A8FB-3F6759A77548
1.2.RegSvcs.exe.400000.0.unpack	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
1.2.RegSvcs.exe.400000.0.unpack	JoeSecurity_GenericDownloader_1	Yara detected Generic Downloader	Joe Security
1.2.RegSvcs.exe.400000.0.unpack	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
1.2.RegSvcs.exe.400000.0.unpack	INDICATOR_SUSPICIOUS_EXE_VaultSchemaGUID	Detects executables referencing Windows vault credential objects. Observed in infostealers	ditekSHen	0x34b15:$s1: 2F1A6504-0641-44CF-8BB5-3612D865F2E5 0x34b87:$s2: 3CCD5499-87A8-4B10-A215-608888DD3B55 0x34c11:$s3: 154E23D0-C644-4E6F-8CE6-5069272F999F 0x34ca3:$s4: 4BF4C442-9B8A-41A0-B380-DD4A704DDB28 0x34d0d:$s5: 77BC582B-F0A6-4E15-4E80-61736B6F3B29 0x34d7f:$s6: E69D7838-91B5-4FC9-89D5-230D4D4CC2BC 0x34e15:$s7: 3E0E35BE-1B77-43E7-B873-AED901B6275B 0x34ea5:$s8: 3C886FF3-2669-4AA2-A8FB-3F6759A77548
0.2.Ship Docs_CI PL HBL COO_.exe.3010000.1.unpack	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
0.2.Ship Docs_CI PL HBL COO_.exe.3010000.1.unpack	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
0.2.Ship Docs_CI PL HBL COO_.exe.3010000.1.unpack	INDICATOR_SUSPICIOUS_EXE_VaultSchemaGUID	Detects executables referencing Windows vault credential objects. Observed in infostealers	ditekSHen	0x32d15:$s1: 2F1A6504-0641-44CF-8BB5-3612D865F2E5 0x32d87:$s2: 3CCD5499-87A8-4B10-A215-608888DD3B55 0x32e11:$s3: 154E23D0-C644-4E6F-8CE6-5069272F999F 0x32ea3:$s4: 4BF4C442-9B8A-41A0-B380-DD4A704DDB28 0x32f0d:$s5: 77BC582B-F0A6-4E15-4E80-61736B6F3B29 0x32f7f:$s6: E69D7838-91B5-4FC9-89D5-230D4D4CC2BC 0x33015:$s7: 3E0E35BE-1B77-43E7-B873-AED901B6275B 0x330a5:$s8: 3C886FF3-2669-4AA2-A8FB-3F6759A77548
Click to see the 6 entries

Sigma Signatures

System Summary

Sigma detected: Suspicious Outbound SMTP Connections

Source: Network Connection

Author: frack113: Data: DestinationIp: 131.226.2.151, DestinationIsIpv6: false, DestinationPort: 587, EventID: 3, Image: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe, Initiated: true, ProcessId: 6776, Protocol: tcp, SourceIp: 192.168.2.4, SourceIsIpv6: false, SourcePort: 49732

Snort Signatures

⊘No Snort rule has matched

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

AV Detection

Antivirus detection for URL or domain

Source: http://mail.suplementvases.com

Avira URL Cloud: Label: malware

Found malware configuration

Source: 1.2.RegSvcs.exe.400000.0.unpack

Malware Configuration Extractor: Agenttesla {"Exfil Mode": "SMTP", "Port": "587", "Host": "mail.suplementvases.com", "Username": "username: freshner@suplementvases.com", "Password": "u2FOHNL09DdqcPx"}

Multi AV Scanner detection for submitted file

Source: Ship Docs_CI PL HBL COO_.exe

Virustotal: Detection: 28%

Perma Link

AI detected suspicious sample

Source: Submited Sample

Integrated Neural Analysis Model: Matched 100.0% probability

Machine Learning detection for sample

Source: Ship Docs_CI PL HBL COO_.exe

Joe Sandbox ML: detected

Source: Ship Docs_CI PL HBL COO_.exe

Static PE information: EXECUTABLE_IMAGE, LARGE_ADDRESS_AWARE, 32BIT_MACHINE

Source: unknown

HTTPS traffic detected: 104.26.12.205:443 -> 192.168.2.4:49730 version: TLS 1.2

Source:	Binary string: wntdll.pdbUGP source: Ship Docs_CI PL HBL COO_.exe, 00000000.00000003.1642650112.0000000003710000.00000004.00001000.00020000.00000000.sdmp, Ship Docs_CI PL HBL COO_.exe, 00000000.00000003.1641552729.0000000003520000.00000004.00001000.00020000.00000000.sdmp
Source:	Binary string: wntdll.pdb source: Ship Docs_CI PL HBL COO_.exe, 00000000.00000003.1642650112.0000000003710000.00000004.00001000.00020000.00000000.sdmp, Ship Docs_CI PL HBL COO_.exe, 00000000.00000003.1641552729.0000000003520000.00000004.00001000.00020000.00000000.sdmp

Source: C:\Users\user\Desktop\Ship Docs_CI PL HBL COO_.exe	Code function: 0_2_00084696 GetFileAttributesW,FindFirstFileW,FindClose,	0_2_00084696
Source: C:\Users\user\Desktop\Ship Docs_CI PL HBL COO_.exe	Code function: 0_2_0008C93C FindFirstFileW,FindClose,	0_2_0008C93C
Source: C:\Users\user\Desktop\Ship Docs_CI PL HBL COO_.exe	Code function: 0_2_0008C9C7 FindFirstFileW,FindClose,FileTimeToLocalFileTime,FileTimeToLocalFileTime,FileTimeToLocalFileTime,FileTimeToSystemTime,__swprintf,__swprintf,__swprintf,__swprintf,__swprintf,__swprintf,__swprintf,	0_2_0008C9C7
Source: C:\Users\user\Desktop\Ship Docs_CI PL HBL COO_.exe	Code function: 0_2_0008F200 SetCurrentDirectoryW,FindFirstFileW,FindFirstFileW,_wcscmp,_wcscmp,GetFileAttributesW,SetFileAttributesW,FindNextFileW,FindClose,FindFirstFileW,SetCurrentDirectoryW,_wcscmp,_wcscmp,SetCurrentDirectoryW,SetCurrentDirectoryW,FindNextFileW,FindClose,FindClose,	0_2_0008F200
Source: C:\Users\user\Desktop\Ship Docs_CI PL HBL COO_.exe	Code function: 0_2_0008F35D SetCurrentDirectoryW,FindFirstFileW,FindFirstFileW,_wcscmp,_wcscmp,FindNextFileW,FindClose,FindFirstFileW,SetCurrentDirectoryW,_wcscmp,_wcscmp,SetCurrentDirectoryW,SetCurrentDirectoryW,FindNextFileW,FindClose,FindClose,	0_2_0008F35D
Source: C:\Users\user\Desktop\Ship Docs_CI PL HBL COO_.exe	Code function: 0_2_0008F65E FindFirstFileW,Sleep,_wcscmp,_wcscmp,FindNextFileW,FindClose,	0_2_0008F65E
Source: C:\Users\user\Desktop\Ship Docs_CI PL HBL COO_.exe	Code function: 0_2_00083A2B FindFirstFileW,DeleteFileW,DeleteFileW,MoveFileW,DeleteFileW,FindNextFileW,FindClose,FindClose,	0_2_00083A2B
Source: C:\Users\user\Desktop\Ship Docs_CI PL HBL COO_.exe	Code function: 0_2_00083D4E FindFirstFileW,DeleteFileW,FindNextFileW,FindClose,FindClose,	0_2_00083D4E
Source: C:\Users\user\Desktop\Ship Docs_CI PL HBL COO_.exe	Code function: 0_2_0008BF27 FindFirstFileW,_wcscmp,_wcscmp,FindNextFileW,FindClose,	0_2_0008BF27

Networking

Yara detected Generic Downloader

Source: Yara match	File source: 0.2.Ship Docs_CI PL HBL COO_.exe.3010000.1.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 1.2.RegSvcs.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000000.00000002.1644364725.0000000003010000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY

Source: global traffic

TCP traffic: 192.168.2.4:49732 -> 131.226.2.151:587

Source: global traffic

HTTP traffic detected: GET /line/?fields=hosting HTTP/1.1Host: ip-api.comConnection: Keep-Alive

Source: Joe Sandbox View	IP Address: 208.95.112.1 208.95.112.1
Source: Joe Sandbox View	IP Address: 104.26.12.205 104.26.12.205
Source: Joe Sandbox View	IP Address: 104.26.12.205 104.26.12.205

Source: Joe Sandbox View	ASN Name: TUT-ASUS TUT-ASUS
Source: Joe Sandbox View	ASN Name: UNASSIGNED UNASSIGNED

Source: Joe Sandbox View

JA3 fingerprint: 3b5074b1b5d032e5620f69f9f700ff0e

Source: unknown	DNS query: name: api.ipify.org
Source: unknown	DNS query: name: api.ipify.org
Source: unknown	DNS query: name: api.ipify.org
Source: unknown	DNS query: name: ip-api.com

Source: global traffic

TCP traffic: 192.168.2.4:49732 -> 131.226.2.151:587

Source: global traffic

HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:99.0) Gecko/20100101 Firefox/99.0Host: api.ipify.orgConnection: Keep-Alive

Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1

Source: C:\Users\user\Desktop\Ship Docs_CI PL HBL COO_.exe

Code function: 0_2_000925E2 InternetReadFile,InternetQueryDataAvailable,InternetReadFile,

0_2_000925E2

Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:99.0) Gecko/20100101 Firefox/99.0Host: api.ipify.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /line/?fields=hosting HTTP/1.1Host: ip-api.comConnection: Keep-Alive

Source: global traffic	DNS traffic detected: DNS query: api.ipify.org
Source: global traffic	DNS traffic detected: DNS query: ip-api.com
Source: global traffic	DNS traffic detected: DNS query: mail.suplementvases.com

Source: Ship Docs_CI PL HBL COO_.exe, 00000000.00000002.1644364725.0000000003010000.00000004.00001000.00020000.00000000.sdmp, RegSvcs.exe, 00000001.00000002.4111602006.0000000000402000.00000040.80000000.00040000.00000000.sdmp, RegSvcs.exe, 00000001.00000002.4112584252.000000000333A000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://ip-api.com/line/?fields=hosting
Source: RegSvcs.exe, 00000001.00000002.4112584252.00000000033F7000.00000004.00000800.00020000.00000000.sdmp, RegSvcs.exe, 00000001.00000002.4112584252.0000000003824000.00000004.00000800.00020000.00000000.sdmp, RegSvcs.exe, 00000001.00000002.4112584252.0000000003401000.00000004.00000800.00020000.00000000.sdmp, RegSvcs.exe, 00000001.00000002.4112584252.00000000036A5000.00000004.00000800.00020000.00000000.sdmp, RegSvcs.exe, 00000001.00000002.4112584252.0000000003610000.00000004.00000800.00020000.00000000.sdmp, RegSvcs.exe, 00000001.00000002.4112584252.00000000034AA000.00000004.00000800.00020000.00000000.sdmp, RegSvcs.exe, 00000001.00000002.4112584252.0000000003553000.00000004.00000800.00020000.00000000.sdmp, RegSvcs.exe, 00000001.00000002.4112584252.0000000003447000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://mail.suplementvases.com
Source: RegSvcs.exe, 00000001.00000002.4112584252.000000000334C000.00000004.00000800.00020000.00000000.sdmp, RegSvcs.exe, 00000001.00000002.4111906517.00000000014B6000.00000004.00000020.00020000.00000000.sdmp, RegSvcs.exe, 00000001.00000002.4112584252.0000000003610000.00000004.00000800.00020000.00000000.sdmp, RegSvcs.exe, 00000001.00000002.4117085657.000000000A41B000.00000004.00000020.00020000.00000000.sdmp, RegSvcs.exe, 00000001.00000002.4114399590.000000000662A000.00000004.00000020.00020000.00000000.sdmp, RegSvcs.exe, 00000001.00000002.4114088603.000000000655D000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://r10.i.lencr.org/0
Source: RegSvcs.exe, 00000001.00000002.4112584252.000000000334C000.00000004.00000800.00020000.00000000.sdmp, RegSvcs.exe, 00000001.00000002.4111906517.00000000014B6000.00000004.00000020.00020000.00000000.sdmp, RegSvcs.exe, 00000001.00000002.4112584252.0000000003610000.00000004.00000800.00020000.00000000.sdmp, RegSvcs.exe, 00000001.00000002.4117085657.000000000A41B000.00000004.00000020.00020000.00000000.sdmp, RegSvcs.exe, 00000001.00000002.4114399590.000000000662A000.00000004.00000020.00020000.00000000.sdmp, RegSvcs.exe, 00000001.00000002.4114088603.000000000655D000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://r10.o.lencr.org0#
Source: RegSvcs.exe, 00000001.00000002.4112584252.00000000032F1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name
Source: RegSvcs.exe, 00000001.00000002.4114245949.00000000065E1000.00000004.00000020.00020000.00000000.sdmp, RegSvcs.exe, 00000001.00000002.4111906517.00000000014B6000.00000004.00000020.00020000.00000000.sdmp, RegSvcs.exe, 00000001.00000002.4114305204.00000000065FD000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://x1.c.lencr.org/0
Source: RegSvcs.exe, 00000001.00000002.4114245949.00000000065E1000.00000004.00000020.00020000.00000000.sdmp, RegSvcs.exe, 00000001.00000002.4111906517.00000000014B6000.00000004.00000020.00020000.00000000.sdmp, RegSvcs.exe, 00000001.00000002.4114305204.00000000065FD000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://x1.i.lencr.org/0
Source: Ship Docs_CI PL HBL COO_.exe, 00000000.00000002.1644364725.0000000003010000.00000004.00001000.00020000.00000000.sdmp, RegSvcs.exe, 00000001.00000002.4111602006.0000000000402000.00000040.80000000.00040000.00000000.sdmp	String found in binary or memory: https://account.dyn.com/
Source: Ship Docs_CI PL HBL COO_.exe, 00000000.00000002.1644364725.0000000003010000.00000004.00001000.00020000.00000000.sdmp, RegSvcs.exe, 00000001.00000002.4111602006.0000000000402000.00000040.80000000.00040000.00000000.sdmp, RegSvcs.exe, 00000001.00000002.4112584252.00000000032F1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://api.ipify.org

Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49730
Source: unknown	Network traffic detected: HTTP traffic on port 49730 -> 443

Source: unknown

HTTPS traffic detected: 104.26.12.205:443 -> 192.168.2.4:49730 version: TLS 1.2

Key, Mouse, Clipboard, Microphone and Screen Capturing

Contains functionality to log keystrokes (.Net Source)

Source: 0.2.Ship Docs_CI PL HBL COO_.exe.3010000.1.raw.unpack, SKTzxzsJw.cs

.Net Code: hlPN

Source: C:\Users\user\Desktop\Ship Docs_CI PL HBL COO_.exe

Code function: 0_2_0009425A OpenClipboard,IsClipboardFormatAvailable,IsClipboardFormatAvailable,GetClipboardData,CloseClipboard,GlobalLock,CloseClipboard,GlobalUnlock,IsClipboardFormatAvailable,GetClipboardData,GlobalLock,GlobalUnlock,IsClipboardFormatAvailable,GetClipboardData,GlobalLock,DragQueryFileW,DragQueryFileW,DragQueryFileW,GlobalUnlock,CountClipboardFormats,CloseClipboard,

0_2_0009425A

Source: C:\Users\user\Desktop\Ship Docs_CI PL HBL COO_.exe

Code function: 0_2_00094458 OpenClipboard,EmptyClipboard,GlobalAlloc,GlobalLock,_wcscpy,GlobalUnlock,OpenClipboard,EmptyClipboard,SetClipboardData,CloseClipboard,

0_2_00094458

Source: C:\Users\user\Desktop\Ship Docs_CI PL HBL COO_.exe

0_2_0009425A

Source: C:\Users\user\Desktop\Ship Docs_CI PL HBL COO_.exe

Code function: 0_2_00080219 GetKeyboardState,GetAsyncKeyState,GetKeyState,GetKeyState,GetAsyncKeyState,GetKeyState,GetAsyncKeyState,GetKeyState,GetAsyncKeyState,GetKeyState,GetAsyncKeyState,GetKeyState,

0_2_00080219

Source: C:\Users\user\Desktop\Ship Docs_CI PL HBL COO_.exe

Code function: 0_2_000ACDAC DefDlgProcW,SendMessageW,GetWindowLongW,SendMessageW,SendMessageW,_wcsncpy,GetKeyState,GetKeyState,GetKeyState,SendMessageW,GetKeyState,SendMessageW,SendMessageW,SendMessageW,ImageList_SetDragCursorImage,ImageList_BeginDrag,SetCapture,ClientToScreen,ImageList_DragEnter,InvalidateRect,ReleaseCapture,GetCursorPos,ScreenToClient,SendMessageW,SendMessageW,SendMessageW,SendMessageW,SendMessageW,SendMessageW,SendMessageW,GetCursorPos,ScreenToClient,GetParent,SendMessageW,SendMessageW,ClientToScreen,TrackPopupMenuEx,SendMessageW,SendMessageW,ClientToScreen,TrackPopupMenuEx,GetWindowLongW,

0_2_000ACDAC

System Summary

Malicious sample detected (through community Yara rule)

Source: 0.2.Ship Docs_CI PL HBL COO_.exe.3010000.1.raw.unpack, type: UNPACKEDPE	Matched rule: Detects executables referencing Windows vault credential objects. Observed in infostealers Author: ditekSHen
Source: 1.2.RegSvcs.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: Detects executables referencing Windows vault credential objects. Observed in infostealers Author: ditekSHen
Source: 0.2.Ship Docs_CI PL HBL COO_.exe.3010000.1.unpack, type: UNPACKEDPE	Matched rule: Detects executables referencing Windows vault credential objects. Observed in infostealers Author: ditekSHen
Source: 00000000.00000002.1644364725.0000000003010000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: Detects executables referencing Windows vault credential objects. Observed in infostealers Author: ditekSHen

Binary is likely a compiled AutoIt script file

Source: C:\Users\user\Desktop\Ship Docs_CI PL HBL COO_.exe	Code function: This is a third-party compiled AutoIt script.	0_2_00023B4C
Source: Ship Docs_CI PL HBL COO_.exe	String found in binary or memory: This is a third-party compiled AutoIt script.
Source: Ship Docs_CI PL HBL COO_.exe, 00000000.00000000.1634015420.00000000000D5000.00000002.00000001.01000000.00000003.sdmp	String found in binary or memory: This is a third-party compiled AutoIt script.	memstr_11aa2567-a
Source: Ship Docs_CI PL HBL COO_.exe, 00000000.00000000.1634015420.00000000000D5000.00000002.00000001.01000000.00000003.sdmp	String found in binary or memory: SDSOFTWARE\Classes\\CLSID\\\IPC$This is a third-party compiled AutoIt script."runasError allocating memory.SeAssignPrimaryTokenPrivilegeSeIncreaseQuotaPrivilegeSeBackupPrivilegeSeRestorePrivilegewinsta0defaultwinsta0\defaultComboBoxListBox\|SHELLDLL_DefViewlargeiconsdetailssmalliconslistCLASSCLASSNNREGEXPCLASSIDNAMEXYWHINSTANCETEXT%s%u%s%dLAST[LASTACTIVE[ACTIVEHANDLE=[HANDLE:REGEXP=[REGEXPTITLE:CLASSNAME=[CLASS:ALL[ALL]HANDLEREGEXPTITLETITLEThumbnailClassAutoIt3GUIContainer	memstr_8a1c165b-c
Source: Ship Docs_CI PL HBL COO_.exe	String found in binary or memory: This is a third-party compiled AutoIt script.	memstr_83e896fc-a
Source: Ship Docs_CI PL HBL COO_.exe	String found in binary or memory: SDSOFTWARE\Classes\\CLSID\\\IPC$This is a third-party compiled AutoIt script."runasError allocating memory.SeAssignPrimaryTokenPrivilegeSeIncreaseQuotaPrivilegeSeBackupPrivilegeSeRestorePrivilegewinsta0defaultwinsta0\defaultComboBoxListBox\|SHELLDLL_DefViewlargeiconsdetailssmalliconslistCLASSCLASSNNREGEXPCLASSIDNAMEXYWHINSTANCETEXT%s%u%s%dLAST[LASTACTIVE[ACTIVEHANDLE=[HANDLE:REGEXP=[REGEXPTITLE:CLASSNAME=[CLASS:ALL[ALL]HANDLEREGEXPTITLETITLEThumbnailClassAutoIt3GUIContainer	memstr_97ba3ce0-2

Source: C:\Users\user\Desktop\Ship Docs_CI PL HBL COO_.exe

Code function: 0_2_00084021: CreateFileW,DeviceIoControl,CloseHandle,

0_2_00084021

Source: C:\Users\user\Desktop\Ship Docs_CI PL HBL COO_.exe

Code function: 0_2_00078858 _memset,DuplicateTokenEx,CloseHandle,OpenWindowStationW,GetProcessWindowStation,SetProcessWindowStation,OpenDesktopW,_wcscpy,LoadUserProfileW,CreateEnvironmentBlock,CreateProcessAsUserW,UnloadUserProfile,CloseWindowStation,CloseDesktop,SetProcessWindowStation,CloseHandle,DestroyEnvironmentBlock,

0_2_00078858

Source: C:\Users\user\Desktop\Ship Docs_CI PL HBL COO_.exe

Code function: 0_2_0008545F ExitWindowsEx,InitiateSystemShutdownExW,SetSystemPowerState,

0_2_0008545F

Source: C:\Users\user\Desktop\Ship Docs_CI PL HBL COO_.exe	Code function: 0_2_0002E800	0_2_0002E800
Source: C:\Users\user\Desktop\Ship Docs_CI PL HBL COO_.exe	Code function: 0_2_0004DBB5	0_2_0004DBB5
Source: C:\Users\user\Desktop\Ship Docs_CI PL HBL COO_.exe	Code function: 0_2_000A804A	0_2_000A804A
Source: C:\Users\user\Desktop\Ship Docs_CI PL HBL COO_.exe	Code function: 0_2_0002E060	0_2_0002E060
Source: C:\Users\user\Desktop\Ship Docs_CI PL HBL COO_.exe	Code function: 0_2_00034140	0_2_00034140
Source: C:\Users\user\Desktop\Ship Docs_CI PL HBL COO_.exe	Code function: 0_2_00042405	0_2_00042405
Source: C:\Users\user\Desktop\Ship Docs_CI PL HBL COO_.exe	Code function: 0_2_00056522	0_2_00056522
Source: C:\Users\user\Desktop\Ship Docs_CI PL HBL COO_.exe	Code function: 0_2_000A0665	0_2_000A0665
Source: C:\Users\user\Desktop\Ship Docs_CI PL HBL COO_.exe	Code function: 0_2_0005267E	0_2_0005267E
Source: C:\Users\user\Desktop\Ship Docs_CI PL HBL COO_.exe	Code function: 0_2_0004283A	0_2_0004283A
Source: C:\Users\user\Desktop\Ship Docs_CI PL HBL COO_.exe	Code function: 0_2_00036843	0_2_00036843
Source: C:\Users\user\Desktop\Ship Docs_CI PL HBL COO_.exe	Code function: 0_2_000589DF	0_2_000589DF
Source: C:\Users\user\Desktop\Ship Docs_CI PL HBL COO_.exe	Code function: 0_2_00038A0E	0_2_00038A0E
Source: C:\Users\user\Desktop\Ship Docs_CI PL HBL COO_.exe	Code function: 0_2_00056A94	0_2_00056A94
Source: C:\Users\user\Desktop\Ship Docs_CI PL HBL COO_.exe	Code function: 0_2_000A0AE2	0_2_000A0AE2
Source: C:\Users\user\Desktop\Ship Docs_CI PL HBL COO_.exe	Code function: 0_2_0007EB07	0_2_0007EB07
Source: C:\Users\user\Desktop\Ship Docs_CI PL HBL COO_.exe	Code function: 0_2_00088B13	0_2_00088B13
Source: C:\Users\user\Desktop\Ship Docs_CI PL HBL COO_.exe	Code function: 0_2_0004CD61	0_2_0004CD61
Source: C:\Users\user\Desktop\Ship Docs_CI PL HBL COO_.exe	Code function: 0_2_00057006	0_2_00057006
Source: C:\Users\user\Desktop\Ship Docs_CI PL HBL COO_.exe	Code function: 0_2_0003710E	0_2_0003710E
Source: C:\Users\user\Desktop\Ship Docs_CI PL HBL COO_.exe	Code function: 0_2_00033190	0_2_00033190
Source: C:\Users\user\Desktop\Ship Docs_CI PL HBL COO_.exe	Code function: 0_2_00021287	0_2_00021287
Source: C:\Users\user\Desktop\Ship Docs_CI PL HBL COO_.exe	Code function: 0_2_000433C7	0_2_000433C7
Source: C:\Users\user\Desktop\Ship Docs_CI PL HBL COO_.exe	Code function: 0_2_0004F419	0_2_0004F419
Source: C:\Users\user\Desktop\Ship Docs_CI PL HBL COO_.exe	Code function: 0_2_00035680	0_2_00035680
Source: C:\Users\user\Desktop\Ship Docs_CI PL HBL COO_.exe	Code function: 0_2_000416C4	0_2_000416C4
Source: C:\Users\user\Desktop\Ship Docs_CI PL HBL COO_.exe	Code function: 0_2_000358C0	0_2_000358C0
Source: C:\Users\user\Desktop\Ship Docs_CI PL HBL COO_.exe	Code function: 0_2_000478D3	0_2_000478D3
Source: C:\Users\user\Desktop\Ship Docs_CI PL HBL COO_.exe	Code function: 0_2_00041BB8	0_2_00041BB8
Source: C:\Users\user\Desktop\Ship Docs_CI PL HBL COO_.exe	Code function: 0_2_00059D05	0_2_00059D05
Source: C:\Users\user\Desktop\Ship Docs_CI PL HBL COO_.exe	Code function: 0_2_0002FE40	0_2_0002FE40
Source: C:\Users\user\Desktop\Ship Docs_CI PL HBL COO_.exe	Code function: 0_2_00041FD0	0_2_00041FD0
Source: C:\Users\user\Desktop\Ship Docs_CI PL HBL COO_.exe	Code function: 0_2_0004BFE6	0_2_0004BFE6
Source: C:\Users\user\Desktop\Ship Docs_CI PL HBL COO_.exe	Code function: 0_2_019D35F0	0_2_019D35F0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 1_2_031341F8	1_2_031341F8
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 1_2_0313AB80	1_2_0313AB80
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 1_2_03134AC8	1_2_03134AC8
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 1_2_0313B810	1_2_0313B810
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 1_2_0313EFF3	1_2_0313EFF3
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 1_2_03133EB0	1_2_03133EB0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 1_2_06D7B834	1_2_06D7B834
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 1_2_06D7CD60	1_2_06D7CD60
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 1_2_06D7EB70	1_2_06D7EB70
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 1_2_06D7B514	1_2_06D7B514
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 1_2_06D82358	1_2_06D82358
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 1_2_06D858C8	1_2_06D858C8
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 1_2_06D861D0	1_2_06D861D0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 1_2_06D851A8	1_2_06D851A8
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 1_2_06D87958	1_2_06D87958
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 1_2_06D87278	1_2_06D87278
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 1_2_06D8E370	1_2_06D8E370
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 1_2_06D80040	1_2_06D80040
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 1_2_070C39C9	1_2_070C39C9
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 1_2_070C9591	1_2_070C9591
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 1_2_070C95A0	1_2_070C95A0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 1_2_06D80007	1_2_06D80007

Source: C:\Users\user\Desktop\Ship Docs_CI PL HBL COO_.exe	Code function: String function: 00048B40 appears 42 times
Source: C:\Users\user\Desktop\Ship Docs_CI PL HBL COO_.exe	Code function: String function: 00040D27 appears 70 times
Source: C:\Users\user\Desktop\Ship Docs_CI PL HBL COO_.exe	Code function: String function: 00027F41 appears 35 times

Source: Ship Docs_CI PL HBL COO_.exe, 00000000.00000003.1643081307.0000000003693000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamentdll.dllj% vs Ship Docs_CI PL HBL COO_.exe
Source: Ship Docs_CI PL HBL COO_.exe, 00000000.00000003.1641990262.00000000037ED000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamentdll.dllj% vs Ship Docs_CI PL HBL COO_.exe
Source: Ship Docs_CI PL HBL COO_.exe, 00000000.00000002.1644364725.0000000003010000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: OriginalFilename65f6ac0a-ca04-4292-9a7c-c35a3a892697.exe4 vs Ship Docs_CI PL HBL COO_.exe

Source: Ship Docs_CI PL HBL COO_.exe

Static PE information: EXECUTABLE_IMAGE, LARGE_ADDRESS_AWARE, 32BIT_MACHINE

Source: 0.2.Ship Docs_CI PL HBL COO_.exe.3010000.1.raw.unpack, type: UNPACKEDPE	Matched rule: INDICATOR_SUSPICIOUS_EXE_VaultSchemaGUID author = ditekSHen, description = Detects executables referencing Windows vault credential objects. Observed in infostealers
Source: 1.2.RegSvcs.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: INDICATOR_SUSPICIOUS_EXE_VaultSchemaGUID author = ditekSHen, description = Detects executables referencing Windows vault credential objects. Observed in infostealers
Source: 0.2.Ship Docs_CI PL HBL COO_.exe.3010000.1.unpack, type: UNPACKEDPE	Matched rule: INDICATOR_SUSPICIOUS_EXE_VaultSchemaGUID author = ditekSHen, description = Detects executables referencing Windows vault credential objects. Observed in infostealers
Source: 00000000.00000002.1644364725.0000000003010000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: INDICATOR_SUSPICIOUS_EXE_VaultSchemaGUID author = ditekSHen, description = Detects executables referencing Windows vault credential objects. Observed in infostealers

Source: 0.2.Ship Docs_CI PL HBL COO_.exe.3010000.1.raw.unpack, 4JJG6X.cs	Cryptographic APIs: 'TransformFinalBlock'
Source: 0.2.Ship Docs_CI PL HBL COO_.exe.3010000.1.raw.unpack, 4JJG6X.cs	Cryptographic APIs: 'TransformFinalBlock'
Source: 0.2.Ship Docs_CI PL HBL COO_.exe.3010000.1.raw.unpack, 8C78isHTVco.cs	Cryptographic APIs: 'TransformFinalBlock'
Source: 0.2.Ship Docs_CI PL HBL COO_.exe.3010000.1.raw.unpack, 8C78isHTVco.cs	Cryptographic APIs: 'TransformFinalBlock'
Source: 0.2.Ship Docs_CI PL HBL COO_.exe.3010000.1.raw.unpack, 8C78isHTVco.cs	Cryptographic APIs: 'TransformFinalBlock'
Source: 0.2.Ship Docs_CI PL HBL COO_.exe.3010000.1.raw.unpack, 8C78isHTVco.cs	Cryptographic APIs: 'TransformFinalBlock'
Source: 0.2.Ship Docs_CI PL HBL COO_.exe.3010000.1.raw.unpack, CqSP68Ir.cs	Cryptographic APIs: 'TransformFinalBlock'
Source: 0.2.Ship Docs_CI PL HBL COO_.exe.3010000.1.raw.unpack, CqSP68Ir.cs	Cryptographic APIs: 'TransformFinalBlock', 'CreateDecryptor'

Source: classification engine

Classification label: mal100.troj.spyw.evad.winEXE@3/4@3/3

Source: C:\Users\user\Desktop\Ship Docs_CI PL HBL COO_.exe

Code function: 0_2_0008A2D5 GetLastError,FormatMessageW,

0_2_0008A2D5

Source: C:\Users\user\Desktop\Ship Docs_CI PL HBL COO_.exe	Code function: 0_2_00078713 AdjustTokenPrivileges,CloseHandle,		0_2_00078713
Source: C:\Users\user\Desktop\Ship Docs_CI PL HBL COO_.exe	Code function: 0_2_00078CC3 LookupPrivilegeValueW,AdjustTokenPrivileges,GetLastError,		0_2_00078CC3

Source: C:\Users\user\Desktop\Ship Docs_CI PL HBL COO_.exe

Code function: 0_2_0008B59E SetErrorMode,GetDiskFreeSpaceExW,SetErrorMode,

0_2_0008B59E

Source: C:\Users\user\Desktop\Ship Docs_CI PL HBL COO_.exe

Code function: 0_2_0009F121 CreateToolhelp32Snapshot,Process32FirstW,Process32NextW,CloseHandle,

0_2_0009F121

Source: C:\Users\user\Desktop\Ship Docs_CI PL HBL COO_.exe

Code function: 0_2_0008C602 CoInitialize,CoCreateInstance,CoUninitialize,

0_2_0008C602

Source: C:\Users\user\Desktop\Ship Docs_CI PL HBL COO_.exe

Code function: 0_2_00024FE9 CreateStreamOnHGlobal,FindResourceExW,LoadResource,SizeofResource,LockResource,

0_2_00024FE9

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe

Mutant created: NULL

Source: C:\Users\user\Desktop\Ship Docs_CI PL HBL COO_.exe

File created: C:\Users\user\AppData\Local\Temp\aut5F9C.tmp

Jump to behavior

Source: Ship Docs_CI PL HBL COO_.exe

Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_Processor
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe

File read: C:\Users\user\AppData\Roaming\Mozilla\Firefox\profiles.ini

Jump to behavior

Source: C:\Users\user\Desktop\Ship Docs_CI PL HBL COO_.exe

Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: Ship Docs_CI PL HBL COO_.exe

Virustotal: Detection: 28%

Source: unknown	Process created: C:\Users\user\Desktop\Ship Docs_CI PL HBL COO_.exe "C:\Users\user\Desktop\Ship Docs_CI PL HBL COO_.exe"
Source: C:\Users\user\Desktop\Ship Docs_CI PL HBL COO_.exe	Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe "C:\Users\user\Desktop\Ship Docs_CI PL HBL COO_.exe"
Source: C:\Users\user\Desktop\Ship Docs_CI PL HBL COO_.exe	Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe "C:\Users\user\Desktop\Ship Docs_CI PL HBL COO_.exe"	Jump to behavior

Source: C:\Users\user\Desktop\Ship Docs_CI PL HBL COO_.exe	Section loaded: wsock32.dll	Jump to behavior
Source: C:\Users\user\Desktop\Ship Docs_CI PL HBL COO_.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Users\user\Desktop\Ship Docs_CI PL HBL COO_.exe	Section loaded: winmm.dll	Jump to behavior
Source: C:\Users\user\Desktop\Ship Docs_CI PL HBL COO_.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Users\user\Desktop\Ship Docs_CI PL HBL COO_.exe	Section loaded: wininet.dll	Jump to behavior
Source: C:\Users\user\Desktop\Ship Docs_CI PL HBL COO_.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\Ship Docs_CI PL HBL COO_.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Users\user\Desktop\Ship Docs_CI PL HBL COO_.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Users\user\Desktop\Ship Docs_CI PL HBL COO_.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\Desktop\Ship Docs_CI PL HBL COO_.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Users\user\Desktop\Ship Docs_CI PL HBL COO_.exe	Section loaded: wldp.dll	Jump to behavior

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{CF4CC405-E2C5-4DDD-B3CE-5E7582D8C9FA}\InprocServer32

Jump to behavior

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe

Key opened: HKEY_CURRENT_USER\Software\Microsoft\Office\11.0\Outlook\Profiles

Jump to behavior

Source: Ship Docs_CI PL HBL COO_.exe

Static file information: File size 1059328 > 1048576

Source: Ship Docs_CI PL HBL COO_.exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_IMPORT
Source: Ship Docs_CI PL HBL COO_.exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_RESOURCE
Source: Ship Docs_CI PL HBL COO_.exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_BASERELOC
Source: Ship Docs_CI PL HBL COO_.exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_DEBUG
Source: Ship Docs_CI PL HBL COO_.exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG
Source: Ship Docs_CI PL HBL COO_.exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_IAT

Source: Ship Docs_CI PL HBL COO_.exe

Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_DEBUG

Source:	Binary string: wntdll.pdbUGP source: Ship Docs_CI PL HBL COO_.exe, 00000000.00000003.1642650112.0000000003710000.00000004.00001000.00020000.00000000.sdmp, Ship Docs_CI PL HBL COO_.exe, 00000000.00000003.1641552729.0000000003520000.00000004.00001000.00020000.00000000.sdmp
Source:	Binary string: wntdll.pdb source: Ship Docs_CI PL HBL COO_.exe, 00000000.00000003.1642650112.0000000003710000.00000004.00001000.00020000.00000000.sdmp, Ship Docs_CI PL HBL COO_.exe, 00000000.00000003.1641552729.0000000003520000.00000004.00001000.00020000.00000000.sdmp

Source: Ship Docs_CI PL HBL COO_.exe	Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_IMPORT is in: .rdata
Source: Ship Docs_CI PL HBL COO_.exe	Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_RESOURCE is in: .rsrc
Source: Ship Docs_CI PL HBL COO_.exe	Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_BASERELOC is in: .reloc
Source: Ship Docs_CI PL HBL COO_.exe	Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG is in: .rdata
Source: Ship Docs_CI PL HBL COO_.exe	Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_IAT is in: .rdata

Source: C:\Users\user\Desktop\Ship Docs_CI PL HBL COO_.exe

Code function: 0_2_0009C304 LoadLibraryA,GetProcAddress,

0_2_0009C304

Source: C:\Users\user\Desktop\Ship Docs_CI PL HBL COO_.exe	Code function: 0_2_0002C590 push eax; retn 0002h	0_2_0002C599
Source: C:\Users\user\Desktop\Ship Docs_CI PL HBL COO_.exe	Code function: 0_2_00088719 push FFFFFF8Bh; iretd	0_2_0008871B
Source: C:\Users\user\Desktop\Ship Docs_CI PL HBL COO_.exe	Code function: 0_2_0004E94F push edi; ret	0_2_0004E951
Source: C:\Users\user\Desktop\Ship Docs_CI PL HBL COO_.exe	Code function: 0_2_0004EA68 push esi; ret	0_2_0004EA6A
Source: C:\Users\user\Desktop\Ship Docs_CI PL HBL COO_.exe	Code function: 0_2_00048B85 push ecx; ret	0_2_00048B98
Source: C:\Users\user\Desktop\Ship Docs_CI PL HBL COO_.exe	Code function: 0_2_0004EC43 push esi; ret	0_2_0004EC45
Source: C:\Users\user\Desktop\Ship Docs_CI PL HBL COO_.exe	Code function: 0_2_0004ED2C push edi; ret	0_2_0004ED2E
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 1_2_06D760D8 push es; ret	1_2_06D760D0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 1_2_06D760C0 push es; ret	1_2_06D760D0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 1_2_070CA265 push FFFFFF8Bh; retf	1_2_070CA1FB
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 1_2_070C15C0 push es; ret	1_2_070C15D0

Source: C:\Users\user\Desktop\Ship Docs_CI PL HBL COO_.exe	File created: \ship docs_ci pl hbl coo_.exe
Source: C:\Users\user\Desktop\Ship Docs_CI PL HBL COO_.exe	File created: \ship docs_ci pl hbl coo_.exe			Jump to behavior

Source: C:\Users\user\Desktop\Ship Docs_CI PL HBL COO_.exe	Code function: 0_2_00024A35 GetForegroundWindow,FindWindowW,IsIconic,ShowWindow,SetForegroundWindow,GetWindowThreadProcessId,GetWindowThreadProcessId,GetCurrentThreadId,GetWindowThreadProcessId,AttachThreadInput,AttachThreadInput,AttachThreadInput,AttachThreadInput,SetForegroundWindow,MapVirtualKeyW,MapVirtualKeyW,keybd_event,keybd_event,MapVirtualKeyW,keybd_event,MapVirtualKeyW,keybd_event,MapVirtualKeyW,keybd_event,SetForegroundWindow,AttachThreadInput,AttachThreadInput,AttachThreadInput,AttachThreadInput,		0_2_00024A35
Source: C:\Users\user\Desktop\Ship Docs_CI PL HBL COO_.exe	Code function: 0_2_000A55FD IsWindowVisible,IsWindowEnabled,GetForegroundWindow,IsIconic,IsZoomed,		0_2_000A55FD

Source: C:\Users\user\Desktop\Ship Docs_CI PL HBL COO_.exe

Code function: 0_2_000433C7 EncodePointer,__initp_misc_winsig,GetModuleHandleW,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,

0_2_000433C7

Source: C:\Users\user\Desktop\Ship Docs_CI PL HBL COO_.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Ship Docs_CI PL HBL COO_.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior

Malware Analysis System Evasion

Yara detected AntiVM3

Source: Yara match

File source: Process Memory Space: Ship Docs_CI PL HBL COO_.exe PID: 6752, type: MEMORYSTR

Check if machine is in data center or colocation facility

Source: global traffic

HTTP traffic detected: GET /line/?fields=hosting HTTP/1.1Host: ip-api.comConnection: Keep-Alive

Queries sensitive network adapter information (via WMI, Win32_NetworkAdapter, often done to detect virtual machines)

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe

WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_NetworkAdapterConfiguration

Queries sensitive video device information (via WMI, Win32_VideoController, often done to detect virtual machines)

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe

WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_VideoController

Switches to a custom stack to bypass stack traces

Source: C:\Users\user\Desktop\Ship Docs_CI PL HBL COO_.exe

API/Special instruction interceptor: Address: 19D3214

Tries to detect sandboxes and other dynamic analysis tools (process name or module or function)

Source: Ship Docs_CI PL HBL COO_.exe, 00000000.00000002.1644364725.0000000003010000.00000004.00001000.00020000.00000000.sdmp, RegSvcs.exe, 00000001.00000002.4112584252.000000000334C000.00000004.00000800.00020000.00000000.sdmp, RegSvcs.exe, 00000001.00000002.4111602006.0000000000402000.00000040.80000000.00040000.00000000.sdmp

Binary or memory string: SBIEDLL.DLL

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 600000	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 599890	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 599777	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 599670	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 599560	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 599447	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 599308	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 598890	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 598750	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 598594	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 598297	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 598100	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 597984	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 595282	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 595161	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 594963	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 594857	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 594703	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 594593	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 594457	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 594328	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 594218	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 594109	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 594000	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 593890	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 593780	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 593672	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 593562	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 593453	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 593344	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 593219	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 593108	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 593000	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 592890	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 592781	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 592672	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 592562	Jump to behavior

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Window / User API: threadDelayed 3257			Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Window / User API: threadDelayed 6527			Jump to behavior

Source: C:\Users\user\Desktop\Ship Docs_CI PL HBL COO_.exe

Evasive API call chain: GetSystemTimeAsFileTime,DecisionNodes

graph_0-100533

Source: C:\Users\user\Desktop\Ship Docs_CI PL HBL COO_.exe

API coverage: 4.7 %

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe

WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_BaseBoard

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_Processor
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor

Source: C:\Users\user\Desktop\Ship Docs_CI PL HBL COO_.exe	Code function: 0_2_00084696 GetFileAttributesW,FindFirstFileW,FindClose,	0_2_00084696
Source: C:\Users\user\Desktop\Ship Docs_CI PL HBL COO_.exe	Code function: 0_2_0008C93C FindFirstFileW,FindClose,	0_2_0008C93C
Source: C:\Users\user\Desktop\Ship Docs_CI PL HBL COO_.exe	Code function: 0_2_0008C9C7 FindFirstFileW,FindClose,FileTimeToLocalFileTime,FileTimeToLocalFileTime,FileTimeToLocalFileTime,FileTimeToSystemTime,__swprintf,__swprintf,__swprintf,__swprintf,__swprintf,__swprintf,__swprintf,	0_2_0008C9C7
Source: C:\Users\user\Desktop\Ship Docs_CI PL HBL COO_.exe	Code function: 0_2_0008F200 SetCurrentDirectoryW,FindFirstFileW,FindFirstFileW,_wcscmp,_wcscmp,GetFileAttributesW,SetFileAttributesW,FindNextFileW,FindClose,FindFirstFileW,SetCurrentDirectoryW,_wcscmp,_wcscmp,SetCurrentDirectoryW,SetCurrentDirectoryW,FindNextFileW,FindClose,FindClose,	0_2_0008F200
Source: C:\Users\user\Desktop\Ship Docs_CI PL HBL COO_.exe	Code function: 0_2_0008F35D SetCurrentDirectoryW,FindFirstFileW,FindFirstFileW,_wcscmp,_wcscmp,FindNextFileW,FindClose,FindFirstFileW,SetCurrentDirectoryW,_wcscmp,_wcscmp,SetCurrentDirectoryW,SetCurrentDirectoryW,FindNextFileW,FindClose,FindClose,	0_2_0008F35D
Source: C:\Users\user\Desktop\Ship Docs_CI PL HBL COO_.exe	Code function: 0_2_0008F65E FindFirstFileW,Sleep,_wcscmp,_wcscmp,FindNextFileW,FindClose,	0_2_0008F65E
Source: C:\Users\user\Desktop\Ship Docs_CI PL HBL COO_.exe	Code function: 0_2_00083A2B FindFirstFileW,DeleteFileW,DeleteFileW,MoveFileW,DeleteFileW,FindNextFileW,FindClose,FindClose,	0_2_00083A2B
Source: C:\Users\user\Desktop\Ship Docs_CI PL HBL COO_.exe	Code function: 0_2_00083D4E FindFirstFileW,DeleteFileW,FindNextFileW,FindClose,FindClose,	0_2_00083D4E
Source: C:\Users\user\Desktop\Ship Docs_CI PL HBL COO_.exe	Code function: 0_2_0008BF27 FindFirstFileW,_wcscmp,_wcscmp,FindNextFileW,FindClose,	0_2_0008BF27

Source: C:\Users\user\Desktop\Ship Docs_CI PL HBL COO_.exe

Code function: 0_2_00024AFE GetVersionExW,GetCurrentProcess,IsWow64Process,GetNativeSystemInfo,FreeLibrary,GetSystemInfo,GetSystemInfo,

0_2_00024AFE

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 600000	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 599890	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 599777	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 599670	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 599560	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 599447	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 599308	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 598890	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 598750	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 598594	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 598297	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 598100	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 597984	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 100000	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 99875	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 99766	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 99641	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 99516	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 99406	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 99297	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 99188	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 99063	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 98938	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 98828	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 98719	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 98594	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 98484	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 98375	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 98266	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 98156	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 98017	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 97824	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 595282	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 595161	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 594963	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 594857	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 594703	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 594593	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 594457	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 594328	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 594218	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 594109	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 594000	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 593890	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 593780	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 593672	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 593562	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 593453	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 593344	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 593219	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 593108	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 593000	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 592890	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 592781	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 592672	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 592562	Jump to behavior

Source: RegSvcs.exe, 00000001.00000002.4112584252.000000000334C000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: VMware
Source: RegSvcs.exe, 00000001.00000002.4111602006.0000000000402000.00000040.80000000.00040000.00000000.sdmp	Binary or memory string: vmware
Source: RegSvcs.exe, 00000001.00000002.4111602006.0000000000402000.00000040.80000000.00040000.00000000.sdmp	Binary or memory string: VMwareVBox
Source: RegSvcs.exe, 00000001.00000002.4114088603.000000000655D000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW%SystemRoot%\system32\mswsock.dll

Source: C:\Users\user\Desktop\Ship Docs_CI PL HBL COO_.exe	API call chain: ExitProcess graph end node			graph_0-97982
Source: C:\Users\user\Desktop\Ship Docs_CI PL HBL COO_.exe	API call chain: ExitProcess graph end node			graph_0-99031

Anti Debugging

Contains functionality to check if a debugger is running (CheckRemoteDebuggerPresent)

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe

Code function: 1_2_03137EC8 CheckRemoteDebuggerPresent,

1_2_03137EC8

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe

Process queried: DebugPort

Jump to behavior

Source: C:\Users\user\Desktop\Ship Docs_CI PL HBL COO_.exe

Code function: 0_2_000941FD BlockInput,

0_2_000941FD

Source: C:\Users\user\Desktop\Ship Docs_CI PL HBL COO_.exe

Code function: 0_2_00023B4C GetCurrentDirectoryW,IsDebuggerPresent,GetFullPathNameW,SetCurrentDirectoryW,MessageBoxA,SetCurrentDirectoryW,GetForegroundWindow,ShellExecuteW,

0_2_00023B4C

Source: C:\Users\user\Desktop\Ship Docs_CI PL HBL COO_.exe

Code function: 0_2_00055CCC EncodePointer,EncodePointer,___crtIsPackagedApp,LoadLibraryExW,GetLastError,LoadLibraryExW,GetProcAddress,EncodePointer,GetProcAddress,EncodePointer,GetProcAddress,EncodePointer,GetProcAddress,EncodePointer,GetProcAddress,EncodePointer,IsDebuggerPresent,OutputDebugStringW,DecodePointer,DecodePointer,DecodePointer,DecodePointer,DecodePointer,DecodePointer,DecodePointer,

0_2_00055CCC

Source: C:\Users\user\Desktop\Ship Docs_CI PL HBL COO_.exe

Code function: 0_2_0009C304 LoadLibraryA,GetProcAddress,

0_2_0009C304

Source: C:\Users\user\Desktop\Ship Docs_CI PL HBL COO_.exe	Code function: 0_2_019D3480 mov eax, dword ptr fs:[00000030h]	0_2_019D3480
Source: C:\Users\user\Desktop\Ship Docs_CI PL HBL COO_.exe	Code function: 0_2_019D34E0 mov eax, dword ptr fs:[00000030h]	0_2_019D34E0
Source: C:\Users\user\Desktop\Ship Docs_CI PL HBL COO_.exe	Code function: 0_2_019D1E70 mov eax, dword ptr fs:[00000030h]	0_2_019D1E70

Source: C:\Users\user\Desktop\Ship Docs_CI PL HBL COO_.exe

Code function: 0_2_000781F7 GetSecurityDescriptorDacl,_memset,GetAclInformation,GetLengthSid,GetAce,AddAce,GetLengthSid,GetProcessHeap,HeapAlloc,GetLengthSid,CopySid,AddAce,SetSecurityDescriptorDacl,SetUserObjectSecurity,

0_2_000781F7

Source: C:\Users\user\Desktop\Ship Docs_CI PL HBL COO_.exe	Code function: 0_2_0004A364 SetUnhandledExceptionFilter,		0_2_0004A364
Source: C:\Users\user\Desktop\Ship Docs_CI PL HBL COO_.exe	Code function: 0_2_0004A395 SetUnhandledExceptionFilter,UnhandledExceptionFilter,		0_2_0004A395

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe

Memory allocated: page read and write | page guard

Jump to behavior

HIPS / PFW / Operating System Protection Evasion

Maps a DLL or memory area into another process

Source: C:\Users\user\Desktop\Ship Docs_CI PL HBL COO_.exe

Section loaded: NULL target: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe protection: execute and read and write

Jump to behavior

Writes to foreign memory regions

Source: C:\Users\user\Desktop\Ship Docs_CI PL HBL COO_.exe

Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe base: 11F1008

Jump to behavior

Source: C:\Users\user\Desktop\Ship Docs_CI PL HBL COO_.exe

Code function: 0_2_00078C93 LogonUserW,

0_2_00078C93

Source: C:\Users\user\Desktop\Ship Docs_CI PL HBL COO_.exe

Code function: 0_2_00023B4C GetCurrentDirectoryW,IsDebuggerPresent,GetFullPathNameW,SetCurrentDirectoryW,MessageBoxA,SetCurrentDirectoryW,GetForegroundWindow,ShellExecuteW,

0_2_00023B4C

Source: C:\Users\user\Desktop\Ship Docs_CI PL HBL COO_.exe

Code function: 0_2_00024A35 GetForegroundWindow,FindWindowW,IsIconic,ShowWindow,SetForegroundWindow,GetWindowThreadProcessId,GetWindowThreadProcessId,GetCurrentThreadId,GetWindowThreadProcessId,AttachThreadInput,AttachThreadInput,AttachThreadInput,AttachThreadInput,SetForegroundWindow,MapVirtualKeyW,MapVirtualKeyW,keybd_event,keybd_event,MapVirtualKeyW,keybd_event,MapVirtualKeyW,keybd_event,MapVirtualKeyW,keybd_event,SetForegroundWindow,AttachThreadInput,AttachThreadInput,AttachThreadInput,AttachThreadInput,

0_2_00024A35

Source: C:\Users\user\Desktop\Ship Docs_CI PL HBL COO_.exe

Code function: 0_2_00084EC9 mouse_event,

0_2_00084EC9

Source: C:\Users\user\Desktop\Ship Docs_CI PL HBL COO_.exe

Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe "C:\Users\user\Desktop\Ship Docs_CI PL HBL COO_.exe"

Jump to behavior

Source: C:\Users\user\Desktop\Ship Docs_CI PL HBL COO_.exe

0_2_000781F7

Source: C:\Users\user\Desktop\Ship Docs_CI PL HBL COO_.exe

Code function: 0_2_00084C03 AllocateAndInitializeSid,CheckTokenMembership,FreeSid,

0_2_00084C03

Source: Ship Docs_CI PL HBL COO_.exe	Binary or memory string: Run Script:AutoIt script files (.au3, .a3x).au3;.a3xAll files (.).au3#include depth exceeded. Make sure there are no recursive includesError opening the file>>>AUTOIT SCRIPT<<<Bad directive syntax errorUnterminated stringCannot parse #includeUnterminated group of commentsONOFF0%d%dShell_TrayWndREMOVEKEYSEXISTSAPPENDblankinfoquestionstopwarning
Source: Ship Docs_CI PL HBL COO_.exe	Binary or memory string: Shell_TrayWnd

Source: C:\Users\user\Desktop\Ship Docs_CI PL HBL COO_.exe

Code function: 0_2_0004886B cpuid

0_2_0004886B

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Queries volume information: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe VolumeInformation	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Windows.Forms\v4.0_4.0.0.0__b77a5c561934e089\System.Windows.Forms.dll VolumeInformation	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Security\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Security.dll VolumeInformation	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.VisualBasic\v4.0_10.0.0.0__b03f5f7f11d50a3a\Microsoft.VisualBasic.dll VolumeInformation	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Drawing\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Drawing.dll VolumeInformation	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Accessibility\v4.0_4.0.0.0__b03f5f7f11d50a3a\Accessibility.dll VolumeInformation	Jump to behavior

Source: C:\Users\user\Desktop\Ship Docs_CI PL HBL COO_.exe

Code function: 0_2_000550D7 GetSystemTimeAsFileTime,GetCurrentThreadId,GetCurrentProcessId,QueryPerformanceCounter,

0_2_000550D7

Source: C:\Users\user\Desktop\Ship Docs_CI PL HBL COO_.exe

Code function: 0_2_00062230 GetUserNameW,

0_2_00062230

Source: C:\Users\user\Desktop\Ship Docs_CI PL HBL COO_.exe

Code function: 0_2_0005418A __lock,____lc_codepage_func,__getenv_helper_nolock,_free,_strlen,__malloc_crt,_strlen,__invoke_watson,_free,GetTimeZoneInformation,WideCharToMultiByte,WideCharToMultiByte,

0_2_0005418A

Source: C:\Users\user\Desktop\Ship Docs_CI PL HBL COO_.exe

Code function: 0_2_00024AFE GetVersionExW,GetCurrentProcess,IsWow64Process,GetNativeSystemInfo,FreeLibrary,GetSystemInfo,GetSystemInfo,

0_2_00024AFE

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid

Jump to behavior

Stealing of Sensitive Information

Yara detected AgentTesla

Source: Yara match	File source: 0.2.Ship Docs_CI PL HBL COO_.exe.3010000.1.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 1.2.RegSvcs.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.Ship Docs_CI PL HBL COO_.exe.3010000.1.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000001.00000002.4111602006.0000000000402000.00000040.80000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000001.00000002.4112584252.000000000334C000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.1644364725.0000000003010000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: Ship Docs_CI PL HBL COO_.exe PID: 6752, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: RegSvcs.exe PID: 6776, type: MEMORYSTR

Tries to harvest and steal Putty / WinSCP information (sessions, passwords, etc)

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe

Key opened: HKEY_CURRENT_USER\SOFTWARE\Martin Prikryl\WinSCP 2\Sessions

Jump to behavior

Tries to harvest and steal browser information (history, passwords, etc)

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Login Data	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Login Data	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\profiles.ini	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	File opened: C:\Users\user\AppData\Roaming\8pecxstudios\Cyberfox\profiles.ini	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	File opened: C:\Users\user\AppData\Roaming\NETGATE Technologies\BlackHawk\profiles.ini	Jump to behavior

Tries to harvest and steal ftp login credentials

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe

File opened: C:\FTP Navigator\Ftplist.txt

Jump to behavior

Tries to steal Mail credentials (via file / registry access)

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	File opened: C:\Users\user\AppData\Roaming\Thunderbird\profiles.ini	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	File opened: C:\Users\user\AppData\Roaming\Thunderbird\profiles.ini	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	File opened: C:\Users\user\AppData\Roaming\Thunderbird\profiles.ini	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Key opened: HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Key opened: HKEY_CURRENT_USER\Software\IncrediMail\Identities	Jump to behavior

Source: Ship Docs_CI PL HBL COO_.exe	Binary or memory string: WIN_81
Source: Ship Docs_CI PL HBL COO_.exe	Binary or memory string: WIN_XP
Source: Ship Docs_CI PL HBL COO_.exe	Binary or memory string: WIN_XPe
Source: Ship Docs_CI PL HBL COO_.exe	Binary or memory string: WIN_VISTA
Source: Ship Docs_CI PL HBL COO_.exe	Binary or memory string: WIN_7
Source: Ship Docs_CI PL HBL COO_.exe	Binary or memory string: WIN_8
Source: Ship Docs_CI PL HBL COO_.exe	Binary or memory string: %.3d%S%M%H%m%Y%jX86IA64X64WIN32_NTWIN_10WIN_2016WIN_81WIN_2012R2WIN_2012WIN_8WIN_2008R2WIN_7WIN_2008WIN_VISTAWIN_2003WIN_XPeWIN_XPInstallLanguageSYSTEM\CurrentControlSet\Control\Nls\LanguageSchemeLangIDControl Panel\Appearance3, 3, 14, 5USERPROFILEUSERDOMAINUSERDNSDOMAINGetSystemWow64DirectoryWSeDebugPrivilege:winapistdcallubyte

Source: Yara match	File source: 0.2.Ship Docs_CI PL HBL COO_.exe.3010000.1.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 1.2.RegSvcs.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.Ship Docs_CI PL HBL COO_.exe.3010000.1.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000001.00000002.4111602006.0000000000402000.00000040.80000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000001.00000002.4112584252.000000000334C000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.1644364725.0000000003010000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: Ship Docs_CI PL HBL COO_.exe PID: 6752, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: RegSvcs.exe PID: 6776, type: MEMORYSTR

Remote Access Functionality

Yara detected AgentTesla

Source: Yara match	File source: 0.2.Ship Docs_CI PL HBL COO_.exe.3010000.1.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 1.2.RegSvcs.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.Ship Docs_CI PL HBL COO_.exe.3010000.1.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000001.00000002.4111602006.0000000000402000.00000040.80000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000001.00000002.4112584252.000000000334C000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.1644364725.0000000003010000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: Ship Docs_CI PL HBL COO_.exe PID: 6752, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: RegSvcs.exe PID: 6776, type: MEMORYSTR

Source: C:\Users\user\Desktop\Ship Docs_CI PL HBL COO_.exe	Code function: 0_2_00096596 socket,WSAGetLastError,bind,listen,WSAGetLastError,closesocket,		0_2_00096596
Source: C:\Users\user\Desktop\Ship Docs_CI PL HBL COO_.exe	Code function: 0_2_00096A5A socket,WSAGetLastError,bind,WSAGetLastError,closesocket,		0_2_00096A5A

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	Acquire Infrastructure	2 Valid Accounts	221 Windows Management Instrumentation	1 DLL Side-Loading	1 Exploitation for Privilege Escalation	11 Disable or Modify Tools	2 OS Credential Dumping	2 System Time Discovery	Remote Services	11 Archive Collected Data	2 Ingress Tool Transfer	Exfiltration Over Other Network Medium	1 System Shutdown/Reboot
Credentials	Domains	Default Accounts	2 Native API	2 Valid Accounts	1 DLL Side-Loading	11 Deobfuscate/Decode Files or Information	121 Input Capture	1 Account Discovery	Remote Desktop Protocol	2 Data from Local System	11 Encrypted Channel	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	At	Logon Script (Windows)	2 Valid Accounts	2 Obfuscated Files or Information	1 Credentials in Registry	2 File and Directory Discovery	SMB/Windows Admin Shares	1 Email Collection	1 Non-Standard Port	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	Cron	Login Hook	21 Access Token Manipulation	1 DLL Side-Loading	NTDS	138 System Information Discovery	Distributed Component Object Model	121 Input Capture	2 Non-Application Layer Protocol	Traffic Duplication	Data Destruction
Gather Victim Network Information	Server	Cloud Accounts	Launchd	Network Logon Script	212 Process Injection	2 Valid Accounts	LSA Secrets	651 Security Software Discovery	SSH	3 Clipboard Data	23 Application Layer Protocol	Scheduled Transfer	Data Encrypted for Impact
Domain Properties	Botnet	Replication Through Removable Media	Scheduled Task	RC Scripts	RC Scripts	231 Virtualization/Sandbox Evasion	Cached Domain Credentials	231 Virtualization/Sandbox Evasion	VNC	GUI Input Capture	Multiband Communication	Data Transfer Size Limits	Service Stop
DNS	Web Services	External Remote Services	Systemd Timers	Startup Items	Startup Items	21 Access Token Manipulation	DCSync	2 Process Discovery	Windows Remote Management	Web Portal Capture	Commonly Used Port	Exfiltration Over C2 Channel	Inhibit System Recovery
Network Trust Dependencies	Serverless	Drive-by Compromise	Container Orchestration Job	Scheduled Task/Job	Scheduled Task/Job	212 Process Injection	Proc Filesystem	11 Application Window Discovery	Cloud Services	Credential API Hooking	Application Layer Protocol	Exfiltration Over Alternative Protocol	Defacement
Network Topology	Malvertising	Exploit Public-Facing Application	Command and Scripting Interpreter	At	At	HTML Smuggling	/etc/passwd and /etc/shadow	1 System Owner/User Discovery	Direct Cloud VM Connections	Data Staged	Web Protocols	Exfiltration Over Symmetric Encrypted Non-C2 Protocol	Internal Defacement
IP Addresses	Compromise Infrastructure	Supply Chain Compromise	PowerShell	Cron	Cron	Dynamic API Resolution	Network Sniffing	1 System Network Configuration Discovery	Shared Webroot	Local Data Staging	File Transfer Protocols	Exfiltration Over Asymmetric Encrypted Non-C2 Protocol	External Defacement

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Source	Detection	Scanner	Label	Link
Ship Docs_CI PL HBL COO_.exe	28%	Virustotal		Browse
Ship Docs_CI PL HBL COO_.exe	100%	Joe Sandbox ML

Source	Detection	Scanner	Link
api.ipify.org	0%	Virustotal	Browse
ip-api.com	0%	Virustotal	Browse
mail.suplementvases.com	2%	Virustotal	Browse

URLs

Source	Detection	Scanner	Label	Link
https://api.ipify.org/	0%	URL Reputation	safe
https://api.ipify.org/	0%	URL Reputation	safe
https://api.ipify.org	0%	URL Reputation	safe
https://account.dyn.com/	0%	URL Reputation	safe
https://account.dyn.com/	0%	URL Reputation	safe
http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name	0%	URL Reputation	safe
http://x1.c.lencr.org/0	0%	URL Reputation	safe
http://x1.i.lencr.org/0	0%	URL Reputation	safe
http://ip-api.com/line/?fields=hosting	0%	URL Reputation	safe
http://mail.suplementvases.com	100%	Avira URL Cloud	malware
http://r10.i.lencr.org/0	0%	Avira URL Cloud	safe
http://r10.o.lencr.org0#	0%	Avira URL Cloud	safe
http://r10.i.lencr.org/0	0%	Virustotal		Browse
http://mail.suplementvases.com	2%	Virustotal		Browse

Domains and IPs

Contacted Domains

Name	IP	Active	Malicious	Antivirus Detection	Reputation
api.ipify.org	104.26.12.205	true	false	0%, Virustotal, Browse	unknown
ip-api.com	208.95.112.1	true	true	0%, Virustotal, Browse	unknown
mail.suplementvases.com	131.226.2.151	true	true	2%, Virustotal, Browse	unknown

Contacted URLs

Name	Malicious	Antivirus Detection	Reputation
https://api.ipify.org/	false	URL Reputation: safe URL Reputation: safe	unknown
http://ip-api.com/line/?fields=hosting	false	URL Reputation: safe	unknown

URLs from Memory and Binaries

Name	Source	Malicious	Antivirus Detection	Reputation
https://api.ipify.org	Ship Docs_CI PL HBL COO_.exe, 00000000.00000002.1644364725.0000000003010000.00000004.00001000.00020000.00000000.sdmp, RegSvcs.exe, 00000001.00000002.4111602006.0000000000402000.00000040.80000000.00040000.00000000.sdmp, RegSvcs.exe, 00000001.00000002.4112584252.00000000032F1000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://r10.o.lencr.org0#	RegSvcs.exe, 00000001.00000002.4112584252.000000000334C000.00000004.00000800.00020000.00000000.sdmp, RegSvcs.exe, 00000001.00000002.4111906517.00000000014B6000.00000004.00000020.00020000.00000000.sdmp, RegSvcs.exe, 00000001.00000002.4112584252.0000000003610000.00000004.00000800.00020000.00000000.sdmp, RegSvcs.exe, 00000001.00000002.4117085657.000000000A41B000.00000004.00000020.00020000.00000000.sdmp, RegSvcs.exe, 00000001.00000002.4114399590.000000000662A000.00000004.00000020.00020000.00000000.sdmp, RegSvcs.exe, 00000001.00000002.4114088603.000000000655D000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://account.dyn.com/	Ship Docs_CI PL HBL COO_.exe, 00000000.00000002.1644364725.0000000003010000.00000004.00001000.00020000.00000000.sdmp, RegSvcs.exe, 00000001.00000002.4111602006.0000000000402000.00000040.80000000.00040000.00000000.sdmp	false	URL Reputation: safe URL Reputation: safe	unknown
http://mail.suplementvases.com	RegSvcs.exe, 00000001.00000002.4112584252.00000000033F7000.00000004.00000800.00020000.00000000.sdmp, RegSvcs.exe, 00000001.00000002.4112584252.0000000003824000.00000004.00000800.00020000.00000000.sdmp, RegSvcs.exe, 00000001.00000002.4112584252.0000000003401000.00000004.00000800.00020000.00000000.sdmp, RegSvcs.exe, 00000001.00000002.4112584252.00000000036A5000.00000004.00000800.00020000.00000000.sdmp, RegSvcs.exe, 00000001.00000002.4112584252.0000000003610000.00000004.00000800.00020000.00000000.sdmp, RegSvcs.exe, 00000001.00000002.4112584252.00000000034AA000.00000004.00000800.00020000.00000000.sdmp, RegSvcs.exe, 00000001.00000002.4112584252.0000000003553000.00000004.00000800.00020000.00000000.sdmp, RegSvcs.exe, 00000001.00000002.4112584252.0000000003447000.00000004.00000800.00020000.00000000.sdmp	false	2%, Virustotal, Browse Avira URL Cloud: malware	unknown
http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name	RegSvcs.exe, 00000001.00000002.4112584252.00000000032F1000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://x1.c.lencr.org/0	RegSvcs.exe, 00000001.00000002.4114245949.00000000065E1000.00000004.00000020.00020000.00000000.sdmp, RegSvcs.exe, 00000001.00000002.4111906517.00000000014B6000.00000004.00000020.00020000.00000000.sdmp, RegSvcs.exe, 00000001.00000002.4114305204.00000000065FD000.00000004.00000020.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://x1.i.lencr.org/0	RegSvcs.exe, 00000001.00000002.4114245949.00000000065E1000.00000004.00000020.00020000.00000000.sdmp, RegSvcs.exe, 00000001.00000002.4111906517.00000000014B6000.00000004.00000020.00020000.00000000.sdmp, RegSvcs.exe, 00000001.00000002.4114305204.00000000065FD000.00000004.00000020.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://r10.i.lencr.org/0	RegSvcs.exe, 00000001.00000002.4112584252.000000000334C000.00000004.00000800.00020000.00000000.sdmp, RegSvcs.exe, 00000001.00000002.4111906517.00000000014B6000.00000004.00000020.00020000.00000000.sdmp, RegSvcs.exe, 00000001.00000002.4112584252.0000000003610000.00000004.00000800.00020000.00000000.sdmp, RegSvcs.exe, 00000001.00000002.4117085657.000000000A41B000.00000004.00000020.00020000.00000000.sdmp, RegSvcs.exe, 00000001.00000002.4114399590.000000000662A000.00000004.00000020.00020000.00000000.sdmp, RegSvcs.exe, 00000001.00000002.4114088603.000000000655D000.00000004.00000020.00020000.00000000.sdmp	false	0%, Virustotal, Browse Avira URL Cloud: safe	unknown

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	ASN	ASN Name	Malicious
208.95.112.1	ip-api.com	United States	53334	TUT-ASUS	true
104.26.12.205	api.ipify.org	United States	13335	CLOUDFLARENETUS	false
131.226.2.151	mail.suplementvases.com	United States	16797	UNASSIGNED	true

General Information

Joe Sandbox version:	40.0.0 Tourmaline
Analysis ID:	1467921
Start date and time:	2024-07-05 02:21:07 +02:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 7m 58s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	6
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Sample name:	Ship Docs_CI PL HBL COO_.exe
Detection:	MAL
Classification:	mal100.troj.spyw.evad.winEXE@3/4@3/3
EGA Information:	Successful, ratio: 100%
HCA Information:	Successful, ratio: 100% Number of executed functions: 57 Number of non-executed functions: 267
Cookbook Comments:	Found application associated with file extension: .exe Override analysis time to 240000 for current running targets taking high CPU consumption

Warnings

Exclude process from analysis (whitelisted): MpCmdRun.exe, WMIADAP.exe, SIHClient.exe, conhost.exe
Excluded domains from analysis (whitelisted): ocsp.digicert.com, slscr.update.microsoft.com, ctldl.windowsupdate.com, fe3cr.delivery.mp.microsoft.com
Not all processes where analyzed, report is missing behavior information
Report size exceeded maximum capacity and may have missing disassembly code.
Report size getting too big, too many NtOpenKeyEx calls found.
Report size getting too big, too many NtProtectVirtualMemory calls found.
Report size getting too big, too many NtQueryValueKey calls found.

Simulations

Behavior and APIs

Time	Type	Description
20:21:56	API Interceptor	9799834x Sleep call for process: RegSvcs.exe modified

Joe Sandbox View / Context

IPs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
208.95.112.1	SOA Payment for June 30th.exe	Get hash	malicious	AgentTesla	Browse	ip-api.com/line/?fields=hosting
	SecuriteInfo.com.Win32.MalwareX-gen.20684.5190.exe	Get hash	malicious	AgentTesla	Browse	ip-api.com/line/?fields=hosting
	bL1WCnC18s.exe	Get hash	malicious	AgentTesla	Browse	ip-api.com/line/?fields=hosting
	A1YOFV1abV.exe	Get hash	malicious	AgentTesla	Browse	ip-api.com/line/?fields=hosting
	main.ps1	Get hash	malicious	Unknown	Browse	ip-api.com/json
	main.ps1	Get hash	malicious	Unknown	Browse	ip-api.com/json
	Orden.xlam.xlsx	Get hash	malicious	AgentTesla	Browse	ip-api.com/line/?fields=hosting
	20240704-455.exe	Get hash	malicious	GuLoader	Browse	ip-api.com/line/?fields=hosting
	McrflHf6vg.exe	Get hash	malicious	WhiteSnake Stealer	Browse	ip-api.com/line?fields=query,country
	Order List Pdf.exe	Get hash	malicious	AgentTesla	Browse	ip-api.com/line/?fields=hosting
104.26.12.205	SecuriteInfo.com.Win64.RansomX-gen.22171.1307.exe	Get hash	malicious	Conti, PureLog Stealer, Targeted Ransomware	Browse	api.ipify.org/
	482730621.exe	Get hash	malicious	Stealit	Browse	api.ipify.org/?format=json
	482730621.exe	Get hash	malicious	Stealit	Browse	api.ipify.org/?format=json
	Sonic-Glyder.exe	Get hash	malicious	Stealit	Browse	api.ipify.org/?format=json
	Sky-Beta.exe	Get hash	malicious	Stealit	Browse	api.ipify.org/?format=json
	SecuriteInfo.com.Backdoor.Win32.Agent.myuuxz.13708.17224.exe	Get hash	malicious	Bunny Loader	Browse	api.ipify.org/
	lods.cmd	Get hash	malicious	Remcos	Browse	api.ipify.org/

Domains

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
mail.suplementvases.com	Doc_CI_PL_HBL_COO_Insu_.exe	Get hash	malicious	AgentTesla	Browse	131.226.2.151
	Vsl_MV DART TRADER_001.exe	Get hash	malicious	AgentTesla	Browse	131.226.2.151
	DHL Arrival Notice.exe	Get hash	malicious	AgentTesla	Browse	131.226.2.151
	Payroll List or Salary List.exe	Get hash	malicious	AgentTesla	Browse	131.226.2.151
	Cosco_RFQ_June_.exe	Get hash	malicious	AgentTesla	Browse	131.226.2.151
	Payroll List or Salary List.vbs	Get hash	malicious	AgentTesla, GuLoader	Browse	131.226.2.151
	STS_Bunker_00617.vbs	Get hash	malicious	AgentTesla, GuLoader	Browse	131.226.2.151
ip-api.com	SOA Payment for June 30th.exe	Get hash	malicious	AgentTesla	Browse	208.95.112.1
	SecuriteInfo.com.Win32.MalwareX-gen.20684.5190.exe	Get hash	malicious	AgentTesla	Browse	208.95.112.1
	bL1WCnC18s.exe	Get hash	malicious	AgentTesla	Browse	208.95.112.1
	A1YOFV1abV.exe	Get hash	malicious	AgentTesla	Browse	208.95.112.1
	main.ps1	Get hash	malicious	Unknown	Browse	208.95.112.1
	main.ps1	Get hash	malicious	Unknown	Browse	208.95.112.1
	Orden.xlam.xlsx	Get hash	malicious	AgentTesla	Browse	208.95.112.1
	20240704-455.exe	Get hash	malicious	GuLoader	Browse	208.95.112.1
	McrflHf6vg.exe	Get hash	malicious	WhiteSnake Stealer	Browse	208.95.112.1
	Order List Pdf.exe	Get hash	malicious	AgentTesla	Browse	208.95.112.1
api.ipify.org	M.V TBN - VESSEL'S DETAILS.docx.scr.exe	Get hash	malicious	AgentTesla	Browse	104.26.13.205
	0001.exe	Get hash	malicious	AgentTesla, PureLog Stealer	Browse	172.67.74.152
	Zz3h8cOX1E.exe	Get hash	malicious	Quasar	Browse	104.26.13.205
	Luciana Alvarez CV.exe	Get hash	malicious	AgentTesla	Browse	104.26.13.205
	Acal BFi UK - Products List 020240704.exe	Get hash	malicious	AgentTesla, RedLine, StormKitty, XWorm	Browse	172.67.74.152
	z4XlS0wTQM.exe	Get hash	malicious	Quasar	Browse	104.26.12.205
	Zz3h8cOX1E.exe	Get hash	malicious	Quasar	Browse	104.26.13.205
	5gO02Ijl9V.exe	Get hash	malicious	GuLoader	Browse	104.26.12.205
	0NJYTCJYLo.exe	Get hash	malicious	AgentTesla, PureLog Stealer	Browse	104.26.13.205
	Order 0003994887588960600000.bat.exe	Get hash	malicious	GuLoader	Browse	172.67.74.152

ASNs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
CLOUDFLARENETUS	https://rb.gy/zsqpja	Get hash	malicious	HTMLPhisher	Browse	104.17.2.184
	https://singingfiles.com/show.php?l=0&u=2156442&id=64574	Get hash	malicious	Unknown	Browse	188.114.97.3
	http://business.ifbsmetaiidentiityconfirms.com/meta-community-standard100068928266341/	Get hash	malicious	HTMLPhisher	Browse	188.114.97.3
	http://services.business-manange.com/	Get hash	malicious	HTMLPhisher	Browse	172.67.138.117
	http://pub-2e7429ed1f544f43a4684eeceb978dbb.r2.dev/home.html	Get hash	malicious	HTMLPhisher	Browse	104.18.2.35
	http://helpdesk-advertising-review-id-9865133.d3m7n55z273utf.amplifyapp.com/index.html	Get hash	malicious	Unknown	Browse	104.26.8.44
	http://www.anuihafw369.xyz/m/register/	Get hash	malicious	Unknown	Browse	104.17.24.14
	https://pub-1b634168cd404e2d8bece63d5ebb4798.r2.dev/uint.html?schweissdoors	Get hash	malicious	HTMLPhisher	Browse	104.18.2.35
	https://pub-9445ce0d74714d1c934c51ffcf83c3f2.r2.dev/slnt.html?nycsbs	Get hash	malicious	HTMLPhisher	Browse	104.18.2.35
	https://delivery.attempt.failure.ebbs.co.za/public/MY096OineFzTCVJ56qDw3aMDByE0CDQ1	Get hash	malicious	Unknown	Browse	104.17.25.14
TUT-ASUS	SOA Payment for June 30th.exe	Get hash	malicious	AgentTesla	Browse	208.95.112.1
	SecuriteInfo.com.Win32.MalwareX-gen.20684.5190.exe	Get hash	malicious	AgentTesla	Browse	208.95.112.1
	bL1WCnC18s.exe	Get hash	malicious	AgentTesla	Browse	208.95.112.1
	A1YOFV1abV.exe	Get hash	malicious	AgentTesla	Browse	208.95.112.1
	main.ps1	Get hash	malicious	Unknown	Browse	208.95.112.1
	main.ps1	Get hash	malicious	Unknown	Browse	208.95.112.1
	Orden.xlam.xlsx	Get hash	malicious	AgentTesla	Browse	208.95.112.1
	20240704-455.exe	Get hash	malicious	GuLoader	Browse	208.95.112.1
	McrflHf6vg.exe	Get hash	malicious	WhiteSnake Stealer	Browse	208.95.112.1
	Order List Pdf.exe	Get hash	malicious	AgentTesla	Browse	208.95.112.1
UNASSIGNED	95DVgihS4k.elf	Get hash	malicious	Unknown	Browse	204.76.203.63
	VeML3EnAwP.elf	Get hash	malicious	Unknown	Browse	204.76.203.19
	oR1q3XIaZu.elf	Get hash	malicious	Unknown	Browse	204.76.203.19
	q7r87KTHbc.exe	Get hash	malicious	AgentTesla	Browse	131.226.2.60
	Doc_CI_PL_HBL_COO_Insu_.exe	Get hash	malicious	AgentTesla	Browse	131.226.2.151
	roger.exe	Get hash	malicious	AgentTesla	Browse	131.226.2.60
	doc -scan file.exe	Get hash	malicious	AgentTesla	Browse	131.226.2.60
	Vsl_MV DART TRADER_001.exe	Get hash	malicious	AgentTesla	Browse	131.226.2.151
	DHL Arrival Notice.exe	Get hash	malicious	AgentTesla	Browse	131.226.2.151
	f6RyWmGZLw.elf	Get hash	malicious	Unknown	Browse	153.10.48.141

JA3 Fingerprints

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
3b5074b1b5d032e5620f69f9f700ff0e	https://singingfiles.com/show.php?l=0&u=2156442&id=64574	Get hash	malicious	Unknown	Browse	104.26.12.205
	https://sula.starladeroff.com/	Get hash	malicious	Unknown	Browse	104.26.12.205
	http://business.ifbsmetaiidentiityconfirms.com/meta-community-standard100068928266341/	Get hash	malicious	HTMLPhisher	Browse	104.26.12.205
	http://helpdesk-advertising-review-id-9865133.d3m7n55z273utf.amplifyapp.com/index.html	Get hash	malicious	Unknown	Browse	104.26.12.205
	https://pub-9445ce0d74714d1c934c51ffcf83c3f2.r2.dev/slnt.html?nycsbs	Get hash	malicious	HTMLPhisher	Browse	104.26.12.205
	https://pradeeprunner.com/auth.html	Get hash	malicious	Unknown	Browse	104.26.12.205
	https://iwahadxi.hosted.phplist.com/lists/lt.php/?tid=eU1SAFEEUlZTABhUAVAGGAZWVFsfXVQLWkkDBQIAUAwCAgcAAldPWwdaBlNRVAgYVwEEXh9QClxcSQcAUlcbWgQGAAJVVwRXBAoBSQcBAVALVA8LHwIEXVtJUg8GVxsAVVMHGA5SB1EBC1YDAQQBDA	Get hash	malicious	Unknown	Browse	104.26.12.205
	http://multichaindappsx.pages.dev/	Get hash	malicious	Unknown	Browse	104.26.12.205
	http://sp.26skins.com/steamstore/category/science_fiction/?snr=1_category_4_multiplayeronlinecompetitive_12	Get hash	malicious	Unknown	Browse	104.26.12.205
	M.V TBN - VESSEL'S DETAILS.docx.scr.exe	Get hash	malicious	AgentTesla	Browse	104.26.12.205

Process:	C:\Users\user\Desktop\Ship Docs_CI PL HBL COO_.exe
File Type:	data
Category:	dropped
Size (bytes):	246272
Entropy (8bit):	6.640227593395889
Encrypted:	false
SSDEEP:	6144:0J69qjM5Rwzm8E/eOm54OSstCArVeblhtZmwciszm1FxUgn:h8eGzm8qeOVlhuedR
MD5:	C9ECE500BCDACA2873F83E51285C31AD
SHA1:	DA6F584915C6561AF1B1E6EB726758F9962C3555
SHA-256:	8A44F053A9A40480C5AAB796BC4CDC1398720F1C74A8B0EF7FCE2F1E1E79665A
SHA-512:	7D6017052A6A343D77CB401CDE099112DBDB206EA669431735192FA71F20C8465912C4E1425B10F29A9B8D32E3CCB88992666077C7A2DD36B7E5C6F5C77CD46C
Malicious:	false
Reputation:	low
Preview:	y..X[ALJFQXO..WH.NSXJ4GP.XALJBQXOZMWHMNSXJ4GPXXALJBQXOZMWHMN.XJ4IO.VA.C.p.N..v.%' x:F(79,l)#?6 .m5-m<&6j])p...l'-5=aW@]lMNSXJ4G..XA.KAQ..2+WHMNSXJ4.PZYJMABQ.LZM_HMNSXJ..SXXaLJB.[OZM.HMnSXJ6GP\XALJBQXKZMWHMNSXj0GPZXALJBQZO..WH]NSHJ4GPHXA\JBQXOZ]WHMNSXJ4GPX..OJ.QXOZ.TH.KSXJ4GPXXALJBQXOZMWHMJSTJ4GPXXALJBQXOZMWHMNSXJ4GPXXALJBQXOZMWHMNSXJ4GPXXALJBqXORMWHMNSXJ4GPPxAL.BQXOZMWHMNSv>Q?$XXA..AQXoZMW.NNSZJ4GPXXALJBQXOZmWH-`!+8WGPX.DLJB.[OZKWHM.PXJ4GPXXALJBQX.ZM.f?+?7)4G\XXALJFQXMZMW.NNSXJ4GPXXALJB.XO.MWHMNSXJ4GPXXALJ.[OZMWH.NSXH4BP<.CL.uPXLZMWIMNUXJ4GPXXALJBQXOZMWHMNSXJ4GPXXALJBQXOZMWHMNSXJ4GPXE....q.0iB/I.~.S.S..R..;..@.X.3Y...9....k?D..O.Bg..Z...%.PD5K....u7C<@;.=.H1.E....ly;...N#.)...9b.6Gh.k...\|n....\,.l..,../%/.9?!2f./598].R.YALJB........'+...D_FlS4.....n_/....44GP<XAL8BQX.ZMW.MNS7J4G>XXA2JBQ&OZM.HMN.XJ4pPXXdLJB<XOZiWHM0SXJ.:_W..#1..OZMWHx..h.Y.....{..n>.3.u........]..E./.....C.3..P.3^b..EP^K_OPLNBnV...yZEHO@V\LVpY....y...a..;... .+HMNSXJ.GP.XAL..Q.OZM.H.N..J4G.X.L.B...Z

C:\Users\user\AppData\Local\Temp\aut5F9C.tmp

Download File

Process:	C:\Users\user\Desktop\Ship Docs_CI PL HBL COO_.exe
File Type:	data
Category:	dropped
Size (bytes):	153610
Entropy (8bit):	7.92820320555911
Encrypted:	false
SSDEEP:	3072:V7ap5kYVAWcrggE9+lUi0NkgWiTCNBawtc18xn62dw4s:VoeYVNcrgvYUi0/TIANA62dPs
MD5:	C8B8B95F44F14AF4DB491EE2E1C0C121
SHA1:	F4B821C0C62870AD893FBDCB551DFDEB19F4F6BE
SHA-256:	1E5221F3BBEE4AEB2229699B0FDF1ED0063E9E8917A5F32439F7F59758FC1C07
SHA-512:	2CE9FDD3330894AEA698B0120613BC7560C5146B213599D465F76844BC0232E61725BFE6B11DDC8174034C0D09E2FF44B407D0DEC1F96D2391041A0016AA3EFF
Malicious:	false
Reputation:	low
Preview:	EA06......x.....J.Tk....H..u.T.P.V..J...Z......\...~....I........p.S....rK'.^'TiD.U9.[%29..A...e...mj..n..J.'..g.....l.T..;X..)t..O.2..4.OP.ViT.....V....\j.5:.b...lk`..^.M....j=B..'.X.F.S.=B..+..>5..+.. ...V(5...W@4.....Q..W[T.B.`..=.T....D~.._\k.....j...2..U...?........X.....u:.Z.T.m.zD..!.....z....X.....?\|.....?.......+.....C.N..."5.\|`....a.T.."..R&...C.k......W..i.Z.....E..6Y.LB...ZhR.N:....{.UK........cu3...8d....c........V.GOgZ......f.D....l...u......{..Lu.^..-.^gq.7..#..\|......Q..;_...[.Zm...,.[7..f./......C2.G..Y....h. ...Q..z<\|..W..Fh..5..4.zx;\|.../.y........i..."\..C.4....>..&@......s.0.r...Y......i..&....u_...ZI..........Y.\|..}...[..I.2Uu..0r.3.....YV~_..B....3O3.w..).z...Qj..]~.P.S.V.....^kTZE>.V.S....g...w1.6R...w.~.F.9 .J.^...;...+.Q.~z.m;....:.z.....t{...bs)....n."...........y..C+...f.O.Q+5...O.P+.....'.Pi.....O.S..m:.&.M(.K...a.......J..u..&CP.W(vJ...R..6u....+.M(.i,....S.SI.6.L..5..<..B.....R"U.mf..^.W..2.H.3+..E{gO.

C:\Users\user\AppData\Local\Temp\aut5FCC.tmp

Download File

Process:	C:\Users\user\Desktop\Ship Docs_CI PL HBL COO_.exe
File Type:	data
Category:	dropped
Size (bytes):	9838
Entropy (8bit):	7.604572376847771
Encrypted:	false
SSDEEP:	192:ZyaFcKb+Kfp488lkVmkX64sKX16WBVoBFuCMQeWTyNM0iP:3F7b+Kfp48Eyn0s13BVoreVM0iP
MD5:	213C2E0D25E0911A5603497024F77E59
SHA1:	DDC0A581F7E0E43C0BFF2E2D31E54F831F57C7E5
SHA-256:	61330433902C3B4CA07EBF376FFF70283212B1074F92C04950F279E76EA00A34
SHA-512:	D4BF293F49799608EA762C3DFD68BCD90CF371D4E839A209D21E2331E0618EB816AB3EC207F22C0612201258E329B2F1160817E2A1BABED6462BEBB598F57F79
Malicious:	false
Reputation:	low
Preview:	EA06..pT..f.Y..4.Lf.9..D.P..I..3..h3j..s9..g3...g3..4:..E..&.i..8......D.Ph3...aB.Q..j5.q4.Pf....qb.....-..c.L...$.m5...k..c0.M....k8.X.3i...l..%.o2....A8.6,.........3k....e.N&s0.oNf.)...k.K$.eb....5..f.........6.0.o.p....l39....V0...S..$.if...6....f.I...@.....i8........X@.4.1..........$.P...0z.5..$}3Y.....=5..`d....!d..V...7f.[$..8...\|.I..W.d...\|vI..W.d...\|vK..W.d...\|vK(.W.e...\|vY..W,.O...k.`..X@..9..^.8..F.6.z..G......`......i..G../Z...zqd...l.;.........\|......7...}3{(........;^..l =..p.........3p.o....,.......x.....H<.lX.:...b.....,. ...2...f.[...K.)....b..i\|v F......X......`....,.9....5...._..l......>K.....ir.e....[4..d..f.y.....,.....S >..p...........s9.... !..Y....f...ja4....ea.h,.p.....,.a8.,..3........f.....f ....,j.0..&...J......f ....6K%.ke..f....L..;2.X...4.Y.V@.Fn.....f@....l..05.....!;3.X...c )D.g6... ...'&`....,f.6..&....r...Brh.....l...i2...B....@.......d.L.`!.....P...@X5d..lSK...9...!;5.X...cVY......'.B...,vl.!..>.a..l...M..@...X...b.M&

C:\Users\user\AppData\Local\Temp\vehiculation

Download File

Process:	C:\Users\user\Desktop\Ship Docs_CI PL HBL COO_.exe
File Type:	ASCII text, with very long lines (28756), with no line terminators
Category:	dropped
Size (bytes):	28756
Entropy (8bit):	3.5907145057364027
Encrypted:	false
SSDEEP:	768:4iTZ+2QoioGRk6ZklputwjpjBkCiw2RuJ3nXKUrvzjsNbd+IH6B34vfF3if6gyC3:4iTZ+2QoioGRk6ZklputwjpjBkCiw2Rc
MD5:	017E03654ECC18E67E47802F0D19C129
SHA1:	A4C2D19D4EA4A3AC9DB5787788370A23519AB8D7
SHA-256:	C9E0FBA21B32FC57B153ABF69B56059990C28463860378A3C05DF05374B53601
SHA-512:	563B6A9CCBDC8F117669987C6621E2B3FBF4471DCFB304F705415E54F7DB65592AFE0AB80864630EFFF8ED2EDBCDE3433E88F6BBE070465C7A7CFB7519DF14C4
Malicious:	false
Reputation:	low
Preview:	1A6E71D4810309FDFC6D43D3E9A6A999A1918E3376ACA2EEC40F44C89B681ADD6AA0260BDF66FE84DA0x558bec81eccc0200005657b86b00000066894584b96500000066894d86ba7200000066895588b86e0000006689458ab96500000066894d8cba6c0000006689558eb83300000066894590b93200000066894d92ba2e00000066895594b86400000066894596b96c00000066894d98ba6c0000006689559a33c06689459cb96e00000066898d44ffffffba7400000066899546ffffffb86400000066898548ffffffb96c00000066898d4affffffba6c0000006689954cffffffb82e0000006689854effffffb96400000066898d50ffffffba6c00000066899552ffffffb86c00000066898554ffffff33c966898d56ffffffba75000000668955d0b873000000668945d2b96500000066894dd4ba72000000668955d6b833000000668945d8b93200000066894ddaba2e000000668955dcb864000000668945deb96c00000066894de0ba6c000000668955e233c0668945e4b96100000066898d68ffffffba640000006689956affffffb8760000006689856cffffffb96100000066898d6effffffba7000000066899570ffffffb86900000066898572ffffffb93300000066898d74ffffffba3200000066899576ffffffb82e00000066898578ffffffb96400000066898d7affffff

Static File Info

General

File type:	PE32 executable (GUI) Intel 80386, for MS Windows
Entropy (8bit):	6.970108026459542
TrID:	Win32 Executable (generic) a (10002005/4) 99.96% Generic Win/DOS Executable (2004/3) 0.02% DOS Executable Generic (2002/1) 0.02% Autodesk FLIC Image File (extensions: flc, fli, cel) (7/3) 0.00%
File name:	Ship Docs_CI PL HBL COO_.exe
File size:	1'059'328 bytes
MD5:	bb66e44260b8a454abcb20aeb4b13f7b
SHA1:	dd6a7662d0f2a05f00dcc80dd6baa37cdefafba6
SHA256:	d4c4ee49a5ce076550c8305fcd63fe86707a251a2ca7d47c67d0dbef66b2a1e3
SHA512:	9677eb4607c573e2f940ebeb2005e6151241afedfe798e54776a9808eb99644821c50c65b4d4d451d07ec4dcb2767ad3fd2768bf3ef06e263522d87a0e07a8df
SSDEEP:	24576:AAHnh+eWsN3skA4RV1Hom2KXMmHajmsE+a6U27eDQVyx5:3h+ZkldoPK8YajRNn2sVI
TLSH:	0E35AD0273D1C036FFAB92739B6AF64596BC79254133852F13981DB9BD701B2223E663
File Content Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........s..R...R...R....C..P.....;.S..._@#.a..._@......_@..g...[j..[...[jo.w...R...r.............#.S..._@'.S...R.k.S.....".S...RichR..

File Icon


Icon Hash:	aaf3e3e3938382a0

Static PE Info

General

Entrypoint:	0x42800a
Entrypoint Section:	.text
Digitally signed:	false
Imagebase:	0x400000
Subsystem:	windows gui
Image File Characteristics:	EXECUTABLE_IMAGE, LARGE_ADDRESS_AWARE, 32BIT_MACHINE
DLL Characteristics:	DYNAMIC_BASE, TERMINAL_SERVER_AWARE
Time Stamp:	0x66872A57 [Thu Jul 4 23:03:51 2024 UTC]
TLS Callbacks:
CLR (.Net) Version:
OS Version Major:	5
OS Version Minor:	1
File Version Major:	5
File Version Minor:	1
Subsystem Version Major:	5
Subsystem Version Minor:	1
Import Hash:	afcdf79be1557326c854b6e20cb900a7

Entrypoint Preview

Instruction
call 00007FCBF47FACADh
jmp 00007FCBF47EDA64h
int3
int3
int3
int3
int3
int3
int3
int3
int3
int3
int3
int3
push edi
push esi
mov esi, dword ptr [esp+10h]
mov ecx, dword ptr [esp+14h]
mov edi, dword ptr [esp+0Ch]
mov eax, ecx
mov edx, ecx
add eax, esi
cmp edi, esi
jbe 00007FCBF47EDBEAh
cmp edi, eax
jc 00007FCBF47EDF4Eh
bt dword ptr [004C41FCh], 01h
jnc 00007FCBF47EDBE9h
rep movsb
jmp 00007FCBF47EDEFCh
cmp ecx, 00000080h
jc 00007FCBF47EDDB4h
mov eax, edi
xor eax, esi
test eax, 0000000Fh
jne 00007FCBF47EDBF0h
bt dword ptr [004BF324h], 01h
jc 00007FCBF47EE0C0h
bt dword ptr [004C41FCh], 00000000h
jnc 00007FCBF47EDD8Dh
test edi, 00000003h
jne 00007FCBF47EDD9Eh
test esi, 00000003h
jne 00007FCBF47EDD7Dh
bt edi, 02h
jnc 00007FCBF47EDBEFh
mov eax, dword ptr [esi]
sub ecx, 04h
lea esi, dword ptr [esi+04h]
mov dword ptr [edi], eax
lea edi, dword ptr [edi+04h]
bt edi, 03h
jnc 00007FCBF47EDBF3h
movq xmm1, qword ptr [esi]
sub ecx, 08h
lea esi, dword ptr [esi+08h]
movq qword ptr [edi], xmm1
lea edi, dword ptr [edi+08h]
test esi, 00000007h
je 00007FCBF47EDC45h
bt esi, 03h

Rich Headers

Programming Language:

[ASM] VS2013 build 21005
[ C ] VS2013 build 21005
[C++] VS2013 build 21005
[ C ] VS2008 SP1 build 30729
[IMP] VS2008 SP1 build 30729
[ASM] VS2013 UPD5 build 40629
[RES] VS2013 build 21005
[LNK] VS2013 UPD5 build 40629

Data Directories

Name	Virtual Address	Virtual Size	Is in Section
IMAGE_DIRECTORY_ENTRY_EXPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IMPORT	0xbc0cc	0x17c	.rdata
IMAGE_DIRECTORY_ENTRY_RESOURCE	0xc8000	0x383f0	.rsrc
IMAGE_DIRECTORY_ENTRY_EXCEPTION	0x0	0x0
IMAGE_DIRECTORY_ENTRY_SECURITY	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BASERELOC	0x101000	0x7134	.reloc
IMAGE_DIRECTORY_ENTRY_DEBUG	0x92bc0	0x1c	.rdata
IMAGE_DIRECTORY_ENTRY_COPYRIGHT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_GLOBALPTR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_TLS	0x0	0x0
IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG	0xa4b50	0x40	.rdata
IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IAT	0x8f000	0x884	.rdata
IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_RESERVED	0x0	0x0

Sections

Name	Virtual Address	Virtual Size	Raw Size	MD5	Xored PE	ZLIB Complexity	File Type	Entropy	Characteristics
.text	0x1000	0x8dfdd	0x8e000	310e36668512d53489c005622bb1b4a9	False	0.5735602580325704	data	6.675248351711057	IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
.rdata	0x8f000	0x2fd8e	0x2fe00	748cf1ab2605ce1fd72d53d912abb68f	False	0.32828818537859006	data	5.763244005758284	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.data	0xbf000	0x8f74	0x5200	aae9601d920f07080bdfadf43dfeff12	False	0.1017530487804878	data	1.1963819235530628	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.rsrc	0xc8000	0x383f0	0x38400	f7adc6e224ce32104b19b7736cfe977c	False	0.8838107638888889	data	7.7835613813274085	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.reloc	0x101000	0x7134	0x7200	f04128ad0f87f42830e4a6cdbc38c719	False	0.7617530153508771	data	6.783955557128661	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_READ

Resources

Name	RVA	Size	Type	Language	Country	ZLIB Complexity
RT_ICON	0xc85a8	0x128	Device independent bitmap graphic, 16 x 32 x 4, image size 192	English	Great Britain	0.7466216216216216
RT_ICON	0xc86d0	0x128	Device independent bitmap graphic, 16 x 32 x 4, image size 128, 16 important colors	English	Great Britain	0.3277027027027027
RT_ICON	0xc87f8	0x128	Device independent bitmap graphic, 16 x 32 x 4, image size 192	English	Great Britain	0.3885135135135135
RT_ICON	0xc8920	0x2e8	Device independent bitmap graphic, 32 x 64 x 4, image size 0	English	Great Britain	0.3333333333333333
RT_ICON	0xc8c08	0x128	Device independent bitmap graphic, 16 x 32 x 4, image size 0	English	Great Britain	0.5
RT_ICON	0xc8d30	0xea8	Device independent bitmap graphic, 48 x 96 x 8, image size 0	English	Great Britain	0.2835820895522388
RT_ICON	0xc9bd8	0x8a8	Device independent bitmap graphic, 32 x 64 x 8, image size 0	English	Great Britain	0.37906137184115524
RT_ICON	0xca480	0x568	Device independent bitmap graphic, 16 x 32 x 8, image size 0	English	Great Britain	0.23699421965317918
RT_ICON	0xca9e8	0x25a8	Device independent bitmap graphic, 48 x 96 x 32, image size 0	English	Great Britain	0.13858921161825727
RT_ICON	0xccf90	0x10a8	Device independent bitmap graphic, 32 x 64 x 32, image size 0	English	Great Britain	0.25070356472795496
RT_ICON	0xce038	0x468	Device independent bitmap graphic, 16 x 32 x 32, image size 0	English	Great Britain	0.3173758865248227
RT_MENU	0xce4a0	0x50	data	English	Great Britain	0.9
RT_STRING	0xce4f0	0x594	data	English	Great Britain	0.3333333333333333
RT_STRING	0xcea84	0x68a	data	English	Great Britain	0.2747909199522103
RT_STRING	0xcf110	0x490	data	English	Great Britain	0.3715753424657534
RT_STRING	0xcf5a0	0x5fc	data	English	Great Britain	0.3087467362924282
RT_STRING	0xcfb9c	0x65c	data	English	Great Britain	0.34336609336609336
RT_STRING	0xd01f8	0x466	data	English	Great Britain	0.3605683836589698
RT_STRING	0xd0660	0x158	Matlab v4 mat-file (little endian) n, numeric, rows 0, columns 0	English	Great Britain	0.502906976744186
RT_RCDATA	0xd07b8	0x2f6b6	data			1.0003398033259538
RT_GROUP_ICON	0xffe70	0x76	data	English	Great Britain	0.6610169491525424
RT_GROUP_ICON	0xffee8	0x14	data	English	Great Britain	1.25
RT_GROUP_ICON	0xffefc	0x14	data	English	Great Britain	1.15
RT_GROUP_ICON	0xfff10	0x14	data	English	Great Britain	1.25
RT_VERSION	0xfff24	0xdc	data	English	Great Britain	0.6181818181818182
RT_MANIFEST	0x100000	0x3ef	ASCII text, with CRLF line terminators	English	Great Britain	0.5074478649453823

Imports

DLL	Import
WSOCK32.dll	WSACleanup, socket, inet_ntoa, setsockopt, ntohs, recvfrom, ioctlsocket, htons, WSAStartup, __WSAFDIsSet, select, accept, listen, bind, closesocket, WSAGetLastError, recv, sendto, send, inet_addr, gethostbyname, gethostname, connect
VERSION.dll	GetFileVersionInfoW, GetFileVersionInfoSizeW, VerQueryValueW
WINMM.dll	timeGetTime, waveOutSetVolume, mciSendStringW
COMCTL32.dll	ImageList_ReplaceIcon, ImageList_Destroy, ImageList_Remove, ImageList_SetDragCursorImage, ImageList_BeginDrag, ImageList_DragEnter, ImageList_DragLeave, ImageList_EndDrag, ImageList_DragMove, InitCommonControlsEx, ImageList_Create
MPR.dll	WNetUseConnectionW, WNetCancelConnection2W, WNetGetConnectionW, WNetAddConnection2W
WININET.dll	InternetQueryDataAvailable, InternetCloseHandle, InternetOpenW, InternetSetOptionW, InternetCrackUrlW, HttpQueryInfoW, InternetQueryOptionW, HttpOpenRequestW, HttpSendRequestW, FtpOpenFileW, FtpGetFileSize, InternetOpenUrlW, InternetReadFile, InternetConnectW
PSAPI.DLL	GetProcessMemoryInfo
IPHLPAPI.DLL	IcmpCreateFile, IcmpCloseHandle, IcmpSendEcho
USERENV.dll	DestroyEnvironmentBlock, UnloadUserProfile, CreateEnvironmentBlock, LoadUserProfileW
UxTheme.dll	IsThemeActive
KERNEL32.dll	DuplicateHandle, CreateThread, WaitForSingleObject, HeapAlloc, GetProcessHeap, HeapFree, Sleep, GetCurrentThreadId, MultiByteToWideChar, MulDiv, GetVersionExW, IsWow64Process, GetSystemInfo, FreeLibrary, LoadLibraryA, GetProcAddress, SetErrorMode, GetModuleFileNameW, WideCharToMultiByte, lstrcpyW, lstrlenW, GetModuleHandleW, QueryPerformanceCounter, VirtualFreeEx, OpenProcess, VirtualAllocEx, WriteProcessMemory, ReadProcessMemory, CreateFileW, SetFilePointerEx, SetEndOfFile, ReadFile, WriteFile, FlushFileBuffers, TerminateProcess, CreateToolhelp32Snapshot, Process32FirstW, Process32NextW, SetFileTime, GetFileAttributesW, FindFirstFileW, SetCurrentDirectoryW, GetLongPathNameW, GetShortPathNameW, DeleteFileW, FindNextFileW, CopyFileExW, MoveFileW, CreateDirectoryW, RemoveDirectoryW, SetSystemPowerState, QueryPerformanceFrequency, FindResourceW, LoadResource, LockResource, SizeofResource, EnumResourceNamesW, OutputDebugStringW, GetTempPathW, GetTempFileNameW, DeviceIoControl, GetLocalTime, CompareStringW, GetCurrentProcess, EnterCriticalSection, LeaveCriticalSection, GetStdHandle, CreatePipe, InterlockedExchange, TerminateThread, LoadLibraryExW, FindResourceExW, CopyFileW, VirtualFree, FormatMessageW, GetExitCodeProcess, GetPrivateProfileStringW, WritePrivateProfileStringW, GetPrivateProfileSectionW, WritePrivateProfileSectionW, GetPrivateProfileSectionNamesW, FileTimeToLocalFileTime, FileTimeToSystemTime, SystemTimeToFileTime, LocalFileTimeToFileTime, GetDriveTypeW, GetDiskFreeSpaceExW, GetDiskFreeSpaceW, GetVolumeInformationW, SetVolumeLabelW, CreateHardLinkW, SetFileAttributesW, CreateEventW, SetEvent, GetEnvironmentVariableW, SetEnvironmentVariableW, GlobalLock, GlobalUnlock, GlobalAlloc, GetFileSize, GlobalFree, GlobalMemoryStatusEx, Beep, GetSystemDirectoryW, HeapReAlloc, HeapSize, GetComputerNameW, GetWindowsDirectoryW, GetCurrentProcessId, GetProcessIoCounters, CreateProcessW, GetProcessId, SetPriorityClass, LoadLibraryW, VirtualAlloc, IsDebuggerPresent, GetCurrentDirectoryW, lstrcmpiW, DecodePointer, GetLastError, RaiseException, InitializeCriticalSectionAndSpinCount, DeleteCriticalSection, InterlockedDecrement, InterlockedIncrement, GetCurrentThread, CloseHandle, GetFullPathNameW, EncodePointer, ExitProcess, GetModuleHandleExW, ExitThread, GetSystemTimeAsFileTime, ResumeThread, GetCommandLineW, IsProcessorFeaturePresent, IsValidCodePage, GetACP, GetOEMCP, GetCPInfo, SetLastError, UnhandledExceptionFilter, SetUnhandledExceptionFilter, TlsAlloc, TlsGetValue, TlsSetValue, TlsFree, GetStartupInfoW, GetStringTypeW, SetStdHandle, GetFileType, GetConsoleCP, GetConsoleMode, RtlUnwind, ReadConsoleW, GetTimeZoneInformation, GetDateFormatW, GetTimeFormatW, LCMapStringW, GetEnvironmentStringsW, FreeEnvironmentStringsW, WriteConsoleW, FindClose, SetEnvironmentVariableA
USER32.dll	AdjustWindowRectEx, CopyImage, SetWindowPos, GetCursorInfo, RegisterHotKey, ClientToScreen, GetKeyboardLayoutNameW, IsCharAlphaW, IsCharAlphaNumericW, IsCharLowerW, IsCharUpperW, GetMenuStringW, GetSubMenu, GetCaretPos, IsZoomed, MonitorFromPoint, GetMonitorInfoW, SetWindowLongW, SetLayeredWindowAttributes, FlashWindow, GetClassLongW, TranslateAcceleratorW, IsDialogMessageW, GetSysColor, InflateRect, DrawFocusRect, DrawTextW, FrameRect, DrawFrameControl, FillRect, PtInRect, DestroyAcceleratorTable, CreateAcceleratorTableW, SetCursor, GetWindowDC, GetSystemMetrics, GetActiveWindow, CharNextW, wsprintfW, RedrawWindow, DrawMenuBar, DestroyMenu, SetMenu, GetWindowTextLengthW, CreateMenu, IsDlgButtonChecked, DefDlgProcW, CallWindowProcW, ReleaseCapture, SetCapture, CreateIconFromResourceEx, mouse_event, ExitWindowsEx, SetActiveWindow, FindWindowExW, EnumThreadWindows, SetMenuDefaultItem, InsertMenuItemW, IsMenu, TrackPopupMenuEx, GetCursorPos, DeleteMenu, SetRect, GetMenuItemID, GetMenuItemCount, SetMenuItemInfoW, GetMenuItemInfoW, SetForegroundWindow, IsIconic, FindWindowW, MonitorFromRect, keybd_event, SendInput, GetAsyncKeyState, SetKeyboardState, GetKeyboardState, GetKeyState, VkKeyScanW, LoadStringW, DialogBoxParamW, MessageBeep, EndDialog, SendDlgItemMessageW, GetDlgItem, SetWindowTextW, CopyRect, ReleaseDC, GetDC, EndPaint, BeginPaint, GetClientRect, GetMenu, DestroyWindow, EnumWindows, GetDesktopWindow, IsWindow, IsWindowEnabled, IsWindowVisible, EnableWindow, InvalidateRect, GetWindowLongW, GetWindowThreadProcessId, AttachThreadInput, GetFocus, GetWindowTextW, ScreenToClient, SendMessageTimeoutW, EnumChildWindows, CharUpperBuffW, GetParent, GetDlgCtrlID, SendMessageW, MapVirtualKeyW, PostMessageW, GetWindowRect, SetUserObjectSecurity, CloseDesktop, CloseWindowStation, OpenDesktopW, SetProcessWindowStation, GetProcessWindowStation, OpenWindowStationW, GetUserObjectSecurity, MessageBoxW, DefWindowProcW, SetClipboardData, EmptyClipboard, CountClipboardFormats, CloseClipboard, GetClipboardData, IsClipboardFormatAvailable, OpenClipboard, BlockInput, GetMessageW, LockWindowUpdate, DispatchMessageW, TranslateMessage, PeekMessageW, UnregisterHotKey, CheckMenuRadioItem, CharLowerBuffW, MoveWindow, SetFocus, PostQuitMessage, KillTimer, CreatePopupMenu, RegisterWindowMessageW, SetTimer, ShowWindow, CreateWindowExW, RegisterClassExW, LoadIconW, LoadCursorW, GetSysColorBrush, GetForegroundWindow, MessageBoxA, DestroyIcon, SystemParametersInfoW, LoadImageW, GetClassNameW
GDI32.dll	StrokePath, DeleteObject, GetTextExtentPoint32W, ExtCreatePen, GetDeviceCaps, EndPath, SetPixel, CloseFigure, CreateCompatibleBitmap, CreateCompatibleDC, SelectObject, StretchBlt, GetDIBits, LineTo, AngleArc, MoveToEx, Ellipse, DeleteDC, GetPixel, CreateDCW, GetStockObject, GetTextFaceW, CreateFontW, SetTextColor, PolyDraw, BeginPath, Rectangle, SetViewportOrgEx, GetObjectW, SetBkMode, RoundRect, SetBkColor, CreatePen, CreateSolidBrush, StrokeAndFillPath
COMDLG32.dll	GetOpenFileNameW, GetSaveFileNameW
ADVAPI32.dll	GetAce, RegEnumValueW, RegDeleteValueW, RegDeleteKeyW, RegEnumKeyExW, RegSetValueExW, RegOpenKeyExW, RegCloseKey, RegQueryValueExW, RegConnectRegistryW, InitializeSecurityDescriptor, InitializeAcl, AdjustTokenPrivileges, OpenThreadToken, OpenProcessToken, LookupPrivilegeValueW, DuplicateTokenEx, CreateProcessAsUserW, CreateProcessWithLogonW, GetLengthSid, CopySid, LogonUserW, AllocateAndInitializeSid, CheckTokenMembership, RegCreateKeyExW, FreeSid, GetTokenInformation, GetSecurityDescriptorDacl, GetAclInformation, AddAce, SetSecurityDescriptorDacl, GetUserNameW, InitiateSystemShutdownExW
SHELL32.dll	DragQueryPoint, ShellExecuteExW, DragQueryFileW, SHEmptyRecycleBinW, SHGetPathFromIDListW, SHBrowseForFolderW, SHCreateShellItem, SHGetDesktopFolder, SHGetSpecialFolderLocation, SHGetFolderPathW, SHFileOperationW, ExtractIconExW, Shell_NotifyIconW, ShellExecuteW, DragFinish
ole32.dll	CoTaskMemAlloc, CoTaskMemFree, CLSIDFromString, ProgIDFromCLSID, CLSIDFromProgID, OleSetMenuDescriptor, MkParseDisplayName, OleSetContainedObject, CoCreateInstance, IIDFromString, StringFromGUID2, CreateStreamOnHGlobal, OleInitialize, OleUninitialize, CoInitialize, CoUninitialize, GetRunningObjectTable, CoGetInstanceFromFile, CoGetObject, CoSetProxyBlanket, CoCreateInstanceEx, CoInitializeSecurity
OLEAUT32.dll	LoadTypeLibEx, VariantCopyInd, SysReAllocString, SysFreeString, SafeArrayDestroyDescriptor, SafeArrayDestroyData, SafeArrayUnaccessData, SafeArrayAccessData, SafeArrayAllocData, SafeArrayAllocDescriptorEx, SafeArrayCreateVector, RegisterTypeLib, CreateStdDispatch, DispCallFunc, VariantChangeType, SysStringLen, VariantTimeToSystemTime, VarR8FromDec, SafeArrayGetVartype, VariantCopy, VariantClear, OleLoadPicture, QueryPathOfRegTypeLib, RegisterTypeLibForUser, UnRegisterTypeLibForUser, UnRegisterTypeLib, CreateDispTypeInfo, SysAllocString, VariantInit

Possible Origin

Language of compilation system	Country where language is spoken	Map
English	Great Britain

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Jul 5, 2024 02:21:56.497392893 CEST	49730	443	192.168.2.4	104.26.12.205
Jul 5, 2024 02:21:56.497422934 CEST	443	49730	104.26.12.205	192.168.2.4
Jul 5, 2024 02:21:56.497560978 CEST	49730	443	192.168.2.4	104.26.12.205
Jul 5, 2024 02:21:56.514489889 CEST	49730	443	192.168.2.4	104.26.12.205
Jul 5, 2024 02:21:56.514512062 CEST	443	49730	104.26.12.205	192.168.2.4
Jul 5, 2024 02:21:57.013860941 CEST	443	49730	104.26.12.205	192.168.2.4
Jul 5, 2024 02:21:57.013940096 CEST	49730	443	192.168.2.4	104.26.12.205
Jul 5, 2024 02:21:57.017260075 CEST	49730	443	192.168.2.4	104.26.12.205
Jul 5, 2024 02:21:57.017271996 CEST	443	49730	104.26.12.205	192.168.2.4
Jul 5, 2024 02:21:57.017668009 CEST	443	49730	104.26.12.205	192.168.2.4
Jul 5, 2024 02:21:57.064313889 CEST	49730	443	192.168.2.4	104.26.12.205
Jul 5, 2024 02:21:57.203728914 CEST	49730	443	192.168.2.4	104.26.12.205
Jul 5, 2024 02:21:57.248502970 CEST	443	49730	104.26.12.205	192.168.2.4
Jul 5, 2024 02:21:57.314038038 CEST	443	49730	104.26.12.205	192.168.2.4
Jul 5, 2024 02:21:57.314100981 CEST	443	49730	104.26.12.205	192.168.2.4
Jul 5, 2024 02:21:57.314161062 CEST	49730	443	192.168.2.4	104.26.12.205
Jul 5, 2024 02:21:57.347031116 CEST	49730	443	192.168.2.4	104.26.12.205
Jul 5, 2024 02:21:57.360893965 CEST	49731	80	192.168.2.4	208.95.112.1
Jul 5, 2024 02:21:57.365711927 CEST	80	49731	208.95.112.1	192.168.2.4
Jul 5, 2024 02:21:57.365814924 CEST	49731	80	192.168.2.4	208.95.112.1
Jul 5, 2024 02:21:57.371578932 CEST	49731	80	192.168.2.4	208.95.112.1
Jul 5, 2024 02:21:57.376343012 CEST	80	49731	208.95.112.1	192.168.2.4
Jul 5, 2024 02:21:57.856928110 CEST	80	49731	208.95.112.1	192.168.2.4
Jul 5, 2024 02:21:57.908046961 CEST	49731	80	192.168.2.4	208.95.112.1
Jul 5, 2024 02:21:59.451536894 CEST	49731	80	192.168.2.4	208.95.112.1
Jul 5, 2024 02:21:59.456717014 CEST	80	49731	208.95.112.1	192.168.2.4
Jul 5, 2024 02:21:59.456784010 CEST	49731	80	192.168.2.4	208.95.112.1
Jul 5, 2024 02:21:59.699579954 CEST	49732	587	192.168.2.4	131.226.2.151
Jul 5, 2024 02:21:59.704484940 CEST	587	49732	131.226.2.151	192.168.2.4
Jul 5, 2024 02:21:59.704579115 CEST	49732	587	192.168.2.4	131.226.2.151
Jul 5, 2024 02:22:00.249630928 CEST	587	49732	131.226.2.151	192.168.2.4
Jul 5, 2024 02:22:00.249847889 CEST	49732	587	192.168.2.4	131.226.2.151
Jul 5, 2024 02:22:00.254937887 CEST	587	49732	131.226.2.151	192.168.2.4
Jul 5, 2024 02:22:00.371959925 CEST	587	49732	131.226.2.151	192.168.2.4
Jul 5, 2024 02:22:00.373516083 CEST	49732	587	192.168.2.4	131.226.2.151
Jul 5, 2024 02:22:00.378499031 CEST	587	49732	131.226.2.151	192.168.2.4
Jul 5, 2024 02:22:00.497052908 CEST	587	49732	131.226.2.151	192.168.2.4
Jul 5, 2024 02:22:00.497600079 CEST	49732	587	192.168.2.4	131.226.2.151
Jul 5, 2024 02:22:00.502428055 CEST	587	49732	131.226.2.151	192.168.2.4
Jul 5, 2024 02:22:00.621017933 CEST	587	49732	131.226.2.151	192.168.2.4
Jul 5, 2024 02:22:00.621063948 CEST	587	49732	131.226.2.151	192.168.2.4
Jul 5, 2024 02:22:00.621074915 CEST	587	49732	131.226.2.151	192.168.2.4
Jul 5, 2024 02:22:00.621110916 CEST	49732	587	192.168.2.4	131.226.2.151
Jul 5, 2024 02:22:00.647521973 CEST	49732	587	192.168.2.4	131.226.2.151
Jul 5, 2024 02:22:00.652340889 CEST	587	49732	131.226.2.151	192.168.2.4
Jul 5, 2024 02:22:00.769954920 CEST	587	49732	131.226.2.151	192.168.2.4
Jul 5, 2024 02:22:00.773264885 CEST	49732	587	192.168.2.4	131.226.2.151
Jul 5, 2024 02:22:00.778316021 CEST	587	49732	131.226.2.151	192.168.2.4
Jul 5, 2024 02:22:00.895921946 CEST	587	49732	131.226.2.151	192.168.2.4
Jul 5, 2024 02:22:00.897100925 CEST	49732	587	192.168.2.4	131.226.2.151
Jul 5, 2024 02:22:00.902036905 CEST	587	49732	131.226.2.151	192.168.2.4
Jul 5, 2024 02:22:01.019474983 CEST	587	49732	131.226.2.151	192.168.2.4
Jul 5, 2024 02:22:01.020901918 CEST	49732	587	192.168.2.4	131.226.2.151
Jul 5, 2024 02:22:01.025729895 CEST	587	49732	131.226.2.151	192.168.2.4
Jul 5, 2024 02:22:01.143069029 CEST	587	49732	131.226.2.151	192.168.2.4
Jul 5, 2024 02:22:01.143471003 CEST	49732	587	192.168.2.4	131.226.2.151
Jul 5, 2024 02:22:01.148356915 CEST	587	49732	131.226.2.151	192.168.2.4
Jul 5, 2024 02:22:01.265486002 CEST	587	49732	131.226.2.151	192.168.2.4
Jul 5, 2024 02:22:01.265780926 CEST	49732	587	192.168.2.4	131.226.2.151
Jul 5, 2024 02:22:01.270621061 CEST	587	49732	131.226.2.151	192.168.2.4
Jul 5, 2024 02:22:01.389754057 CEST	587	49732	131.226.2.151	192.168.2.4
Jul 5, 2024 02:22:01.404336929 CEST	49732	587	192.168.2.4	131.226.2.151
Jul 5, 2024 02:22:01.409219027 CEST	587	49732	131.226.2.151	192.168.2.4
Jul 5, 2024 02:22:01.526431084 CEST	587	49732	131.226.2.151	192.168.2.4
Jul 5, 2024 02:22:01.527081966 CEST	49732	587	192.168.2.4	131.226.2.151
Jul 5, 2024 02:22:01.527172089 CEST	49732	587	192.168.2.4	131.226.2.151
Jul 5, 2024 02:22:01.527204990 CEST	49732	587	192.168.2.4	131.226.2.151
Jul 5, 2024 02:22:01.527240038 CEST	49732	587	192.168.2.4	131.226.2.151
Jul 5, 2024 02:22:01.531954050 CEST	587	49732	131.226.2.151	192.168.2.4
Jul 5, 2024 02:22:01.532053947 CEST	587	49732	131.226.2.151	192.168.2.4
Jul 5, 2024 02:22:01.532115936 CEST	587	49732	131.226.2.151	192.168.2.4
Jul 5, 2024 02:22:01.726134062 CEST	587	49732	131.226.2.151	192.168.2.4
Jul 5, 2024 02:22:01.769279003 CEST	49732	587	192.168.2.4	131.226.2.151
Jul 5, 2024 02:23:39.470957041 CEST	49732	587	192.168.2.4	131.226.2.151
Jul 5, 2024 02:23:39.476264000 CEST	587	49732	131.226.2.151	192.168.2.4
Jul 5, 2024 02:23:39.595699072 CEST	587	49732	131.226.2.151	192.168.2.4
Jul 5, 2024 02:23:39.595938921 CEST	587	49732	131.226.2.151	192.168.2.4
Jul 5, 2024 02:23:39.596004009 CEST	49732	587	192.168.2.4	131.226.2.151
Jul 5, 2024 02:23:39.596508026 CEST	587	49732	131.226.2.151	192.168.2.4
Jul 5, 2024 02:23:39.596556902 CEST	49732	587	192.168.2.4	131.226.2.151
Jul 5, 2024 02:23:39.605408907 CEST	49732	587	192.168.2.4	131.226.2.151
Jul 5, 2024 02:23:40.301357985 CEST	49740	587	192.168.2.4	131.226.2.151
Jul 5, 2024 02:23:40.306231976 CEST	587	49740	131.226.2.151	192.168.2.4
Jul 5, 2024 02:23:40.306951046 CEST	49740	587	192.168.2.4	131.226.2.151
Jul 5, 2024 02:23:40.837789059 CEST	587	49740	131.226.2.151	192.168.2.4
Jul 5, 2024 02:23:40.837984085 CEST	49740	587	192.168.2.4	131.226.2.151
Jul 5, 2024 02:23:40.842820883 CEST	587	49740	131.226.2.151	192.168.2.4
Jul 5, 2024 02:23:40.959556103 CEST	587	49740	131.226.2.151	192.168.2.4
Jul 5, 2024 02:23:40.959712982 CEST	49740	587	192.168.2.4	131.226.2.151
Jul 5, 2024 02:23:40.964528084 CEST	587	49740	131.226.2.151	192.168.2.4
Jul 5, 2024 02:23:41.081197977 CEST	587	49740	131.226.2.151	192.168.2.4
Jul 5, 2024 02:23:41.081728935 CEST	49740	587	192.168.2.4	131.226.2.151
Jul 5, 2024 02:23:41.086545944 CEST	587	49740	131.226.2.151	192.168.2.4
Jul 5, 2024 02:23:41.203874111 CEST	587	49740	131.226.2.151	192.168.2.4
Jul 5, 2024 02:23:41.204942942 CEST	49740	587	192.168.2.4	131.226.2.151
Jul 5, 2024 02:23:41.207978010 CEST	49740	587	192.168.2.4	131.226.2.151
Jul 5, 2024 02:23:41.209702015 CEST	587	49740	131.226.2.151	192.168.2.4
Jul 5, 2024 02:23:41.212711096 CEST	587	49740	131.226.2.151	192.168.2.4
Jul 5, 2024 02:23:41.393709898 CEST	587	49740	131.226.2.151	192.168.2.4
Jul 5, 2024 02:23:41.393946886 CEST	49740	587	192.168.2.4	131.226.2.151
Jul 5, 2024 02:23:41.398731947 CEST	587	49740	131.226.2.151	192.168.2.4
Jul 5, 2024 02:23:41.516202927 CEST	587	49740	131.226.2.151	192.168.2.4
Jul 5, 2024 02:23:41.516441107 CEST	49740	587	192.168.2.4	131.226.2.151
Jul 5, 2024 02:23:41.522135019 CEST	587	49740	131.226.2.151	192.168.2.4
Jul 5, 2024 02:23:41.639144897 CEST	587	49740	131.226.2.151	192.168.2.4
Jul 5, 2024 02:23:41.639305115 CEST	49740	587	192.168.2.4	131.226.2.151
Jul 5, 2024 02:23:41.644175053 CEST	587	49740	131.226.2.151	192.168.2.4
Jul 5, 2024 02:23:41.764051914 CEST	587	49740	131.226.2.151	192.168.2.4
Jul 5, 2024 02:23:41.764255047 CEST	49740	587	192.168.2.4	131.226.2.151
Jul 5, 2024 02:23:41.769126892 CEST	587	49740	131.226.2.151	192.168.2.4
Jul 5, 2024 02:23:41.886792898 CEST	587	49740	131.226.2.151	192.168.2.4
Jul 5, 2024 02:23:41.886970997 CEST	49740	587	192.168.2.4	131.226.2.151
Jul 5, 2024 02:23:41.891796112 CEST	587	49740	131.226.2.151	192.168.2.4
Jul 5, 2024 02:23:42.008642912 CEST	587	49740	131.226.2.151	192.168.2.4
Jul 5, 2024 02:23:42.010229111 CEST	49740	587	192.168.2.4	131.226.2.151
Jul 5, 2024 02:23:42.010297060 CEST	49740	587	192.168.2.4	131.226.2.151
Jul 5, 2024 02:23:42.010322094 CEST	49740	587	192.168.2.4	131.226.2.151
Jul 5, 2024 02:23:42.010462046 CEST	49740	587	192.168.2.4	131.226.2.151
Jul 5, 2024 02:23:42.011976957 CEST	49740	587	192.168.2.4	131.226.2.151
Jul 5, 2024 02:23:42.015047073 CEST	587	49740	131.226.2.151	192.168.2.4
Jul 5, 2024 02:23:42.015089035 CEST	49740	587	192.168.2.4	131.226.2.151
Jul 5, 2024 02:23:42.015173912 CEST	587	49740	131.226.2.151	192.168.2.4
Jul 5, 2024 02:23:42.015275955 CEST	587	49740	131.226.2.151	192.168.2.4
Jul 5, 2024 02:23:42.015362024 CEST	49740	587	192.168.2.4	131.226.2.151
Jul 5, 2024 02:23:42.016884089 CEST	587	49740	131.226.2.151	192.168.2.4
Jul 5, 2024 02:23:42.016927958 CEST	49740	587	192.168.2.4	131.226.2.151
Jul 5, 2024 02:23:42.016961098 CEST	587	49740	131.226.2.151	192.168.2.4
Jul 5, 2024 02:23:42.017004013 CEST	49740	587	192.168.2.4	131.226.2.151
Jul 5, 2024 02:23:42.017033100 CEST	587	49740	131.226.2.151	192.168.2.4
Jul 5, 2024 02:23:42.017086029 CEST	49740	587	192.168.2.4	131.226.2.151
Jul 5, 2024 02:23:42.019859076 CEST	587	49740	131.226.2.151	192.168.2.4
Jul 5, 2024 02:23:42.019910097 CEST	49740	587	192.168.2.4	131.226.2.151
Jul 5, 2024 02:23:42.020071983 CEST	587	49740	131.226.2.151	192.168.2.4
Jul 5, 2024 02:23:42.020118952 CEST	49740	587	192.168.2.4	131.226.2.151
Jul 5, 2024 02:23:42.021759033 CEST	587	49740	131.226.2.151	192.168.2.4
Jul 5, 2024 02:23:42.021816015 CEST	49740	587	192.168.2.4	131.226.2.151
Jul 5, 2024 02:23:42.021862984 CEST	587	49740	131.226.2.151	192.168.2.4
Jul 5, 2024 02:23:42.021893024 CEST	587	49740	131.226.2.151	192.168.2.4
Jul 5, 2024 02:23:42.021902084 CEST	587	49740	131.226.2.151	192.168.2.4
Jul 5, 2024 02:23:42.021909952 CEST	49740	587	192.168.2.4	131.226.2.151
Jul 5, 2024 02:23:42.021946907 CEST	49740	587	192.168.2.4	131.226.2.151
Jul 5, 2024 02:23:42.021971941 CEST	587	49740	131.226.2.151	192.168.2.4
Jul 5, 2024 02:23:42.022022009 CEST	49740	587	192.168.2.4	131.226.2.151
Jul 5, 2024 02:23:42.022185087 CEST	587	49740	131.226.2.151	192.168.2.4
Jul 5, 2024 02:23:42.022227049 CEST	49740	587	192.168.2.4	131.226.2.151
Jul 5, 2024 02:23:42.024914026 CEST	587	49740	131.226.2.151	192.168.2.4
Jul 5, 2024 02:23:42.024921894 CEST	587	49740	131.226.2.151	192.168.2.4
Jul 5, 2024 02:23:42.024950981 CEST	587	49740	131.226.2.151	192.168.2.4
Jul 5, 2024 02:23:42.024960995 CEST	49740	587	192.168.2.4	131.226.2.151
Jul 5, 2024 02:23:42.024986982 CEST	49740	587	192.168.2.4	131.226.2.151
Jul 5, 2024 02:23:42.025006056 CEST	49740	587	192.168.2.4	131.226.2.151
Jul 5, 2024 02:23:42.026479959 CEST	587	49740	131.226.2.151	192.168.2.4
Jul 5, 2024 02:23:42.026547909 CEST	49740	587	192.168.2.4	131.226.2.151
Jul 5, 2024 02:23:42.026906967 CEST	587	49740	131.226.2.151	192.168.2.4
Jul 5, 2024 02:23:42.026925087 CEST	587	49740	131.226.2.151	192.168.2.4
Jul 5, 2024 02:23:42.026933908 CEST	587	49740	131.226.2.151	192.168.2.4
Jul 5, 2024 02:23:42.026942015 CEST	587	49740	131.226.2.151	192.168.2.4
Jul 5, 2024 02:23:42.026951075 CEST	587	49740	131.226.2.151	192.168.2.4
Jul 5, 2024 02:23:42.026958942 CEST	587	49740	131.226.2.151	192.168.2.4
Jul 5, 2024 02:23:42.026961088 CEST	49740	587	192.168.2.4	131.226.2.151
Jul 5, 2024 02:23:42.026983023 CEST	49740	587	192.168.2.4	131.226.2.151
Jul 5, 2024 02:23:42.027012110 CEST	587	49740	131.226.2.151	192.168.2.4
Jul 5, 2024 02:23:42.027045965 CEST	587	49740	131.226.2.151	192.168.2.4
Jul 5, 2024 02:23:42.027054071 CEST	587	49740	131.226.2.151	192.168.2.4
Jul 5, 2024 02:23:42.027117014 CEST	587	49740	131.226.2.151	192.168.2.4
Jul 5, 2024 02:23:42.027168989 CEST	587	49740	131.226.2.151	192.168.2.4
Jul 5, 2024 02:23:42.027177095 CEST	587	49740	131.226.2.151	192.168.2.4
Jul 5, 2024 02:23:42.027184963 CEST	587	49740	131.226.2.151	192.168.2.4
Jul 5, 2024 02:23:42.029849052 CEST	587	49740	131.226.2.151	192.168.2.4
Jul 5, 2024 02:23:42.029856920 CEST	587	49740	131.226.2.151	192.168.2.4
Jul 5, 2024 02:23:42.029964924 CEST	587	49740	131.226.2.151	192.168.2.4
Jul 5, 2024 02:23:42.031459093 CEST	587	49740	131.226.2.151	192.168.2.4
Jul 5, 2024 02:23:42.031467915 CEST	587	49740	131.226.2.151	192.168.2.4
Jul 5, 2024 02:23:42.031471014 CEST	587	49740	131.226.2.151	192.168.2.4
Jul 5, 2024 02:23:42.031474113 CEST	587	49740	131.226.2.151	192.168.2.4
Jul 5, 2024 02:23:42.031486034 CEST	587	49740	131.226.2.151	192.168.2.4
Jul 5, 2024 02:23:42.031493902 CEST	587	49740	131.226.2.151	192.168.2.4
Jul 5, 2024 02:23:42.031501055 CEST	587	49740	131.226.2.151	192.168.2.4
Jul 5, 2024 02:23:42.031508923 CEST	587	49740	131.226.2.151	192.168.2.4
Jul 5, 2024 02:23:42.031516075 CEST	587	49740	131.226.2.151	192.168.2.4
Jul 5, 2024 02:23:42.031672955 CEST	587	49740	131.226.2.151	192.168.2.4
Jul 5, 2024 02:23:42.031682014 CEST	587	49740	131.226.2.151	192.168.2.4
Jul 5, 2024 02:23:42.031688929 CEST	587	49740	131.226.2.151	192.168.2.4
Jul 5, 2024 02:23:42.031697989 CEST	587	49740	131.226.2.151	192.168.2.4
Jul 5, 2024 02:23:42.031817913 CEST	587	49740	131.226.2.151	192.168.2.4
Jul 5, 2024 02:23:42.031826019 CEST	587	49740	131.226.2.151	192.168.2.4
Jul 5, 2024 02:23:42.031877995 CEST	587	49740	131.226.2.151	192.168.2.4
Jul 5, 2024 02:23:42.031886101 CEST	587	49740	131.226.2.151	192.168.2.4
Jul 5, 2024 02:23:42.031894922 CEST	587	49740	131.226.2.151	192.168.2.4
Jul 5, 2024 02:23:42.031903028 CEST	587	49740	131.226.2.151	192.168.2.4
Jul 5, 2024 02:23:42.031943083 CEST	587	49740	131.226.2.151	192.168.2.4
Jul 5, 2024 02:23:42.031950951 CEST	587	49740	131.226.2.151	192.168.2.4
Jul 5, 2024 02:23:42.031959057 CEST	587	49740	131.226.2.151	192.168.2.4
Jul 5, 2024 02:23:42.031970978 CEST	587	49740	131.226.2.151	192.168.2.4
Jul 5, 2024 02:23:42.032341003 CEST	587	49740	131.226.2.151	192.168.2.4
Jul 5, 2024 02:23:42.032349110 CEST	587	49740	131.226.2.151	192.168.2.4
Jul 5, 2024 02:23:42.032356024 CEST	587	49740	131.226.2.151	192.168.2.4
Jul 5, 2024 02:23:42.032365084 CEST	587	49740	131.226.2.151	192.168.2.4
Jul 5, 2024 02:23:42.032373905 CEST	587	49740	131.226.2.151	192.168.2.4
Jul 5, 2024 02:23:42.363240004 CEST	587	49740	131.226.2.151	192.168.2.4
Jul 5, 2024 02:23:42.564436913 CEST	49740	587	192.168.2.4	131.226.2.151
Jul 5, 2024 02:23:54.740856886 CEST	49740	587	192.168.2.4	131.226.2.151
Jul 5, 2024 02:23:54.745788097 CEST	587	49740	131.226.2.151	192.168.2.4
Jul 5, 2024 02:23:54.862884998 CEST	587	49740	131.226.2.151	192.168.2.4
Jul 5, 2024 02:23:54.863120079 CEST	587	49740	131.226.2.151	192.168.2.4
Jul 5, 2024 02:23:54.863176107 CEST	49740	587	192.168.2.4	131.226.2.151
Jul 5, 2024 02:23:54.863282919 CEST	587	49740	131.226.2.151	192.168.2.4
Jul 5, 2024 02:23:54.863296986 CEST	49740	587	192.168.2.4	131.226.2.151
Jul 5, 2024 02:23:54.863332033 CEST	49740	587	192.168.2.4	131.226.2.151
Jul 5, 2024 02:23:54.864214897 CEST	49741	587	192.168.2.4	131.226.2.151
Jul 5, 2024 02:23:54.869002104 CEST	587	49741	131.226.2.151	192.168.2.4
Jul 5, 2024 02:23:54.869113922 CEST	49741	587	192.168.2.4	131.226.2.151
Jul 5, 2024 02:23:54.986453056 CEST	49741	587	192.168.2.4	131.226.2.151
Jul 5, 2024 02:23:54.991292953 CEST	587	49741	131.226.2.151	192.168.2.4
Jul 5, 2024 02:23:54.991348028 CEST	49741	587	192.168.2.4	131.226.2.151
Jul 5, 2024 02:23:55.042399883 CEST	49742	587	192.168.2.4	131.226.2.151
Jul 5, 2024 02:23:55.047230005 CEST	587	49742	131.226.2.151	192.168.2.4
Jul 5, 2024 02:23:55.047317028 CEST	49742	587	192.168.2.4	131.226.2.151
Jul 5, 2024 02:23:55.577599049 CEST	587	49742	131.226.2.151	192.168.2.4
Jul 5, 2024 02:23:55.577706099 CEST	49742	587	192.168.2.4	131.226.2.151
Jul 5, 2024 02:23:55.582566023 CEST	587	49742	131.226.2.151	192.168.2.4
Jul 5, 2024 02:23:55.699306011 CEST	587	49742	131.226.2.151	192.168.2.4
Jul 5, 2024 02:23:55.699444056 CEST	49742	587	192.168.2.4	131.226.2.151
Jul 5, 2024 02:23:55.704194069 CEST	587	49742	131.226.2.151	192.168.2.4
Jul 5, 2024 02:23:55.820871115 CEST	587	49742	131.226.2.151	192.168.2.4
Jul 5, 2024 02:23:55.821588993 CEST	49742	587	192.168.2.4	131.226.2.151
Jul 5, 2024 02:23:55.826410055 CEST	587	49742	131.226.2.151	192.168.2.4
Jul 5, 2024 02:23:55.943420887 CEST	587	49742	131.226.2.151	192.168.2.4
Jul 5, 2024 02:23:55.944072962 CEST	49742	587	192.168.2.4	131.226.2.151
Jul 5, 2024 02:23:55.944369078 CEST	49742	587	192.168.2.4	131.226.2.151
Jul 5, 2024 02:23:55.948815107 CEST	587	49742	131.226.2.151	192.168.2.4
Jul 5, 2024 02:23:55.949081898 CEST	587	49742	131.226.2.151	192.168.2.4
Jul 5, 2024 02:23:56.133482933 CEST	587	49742	131.226.2.151	192.168.2.4
Jul 5, 2024 02:23:56.133928061 CEST	49742	587	192.168.2.4	131.226.2.151
Jul 5, 2024 02:23:56.138664961 CEST	587	49742	131.226.2.151	192.168.2.4
Jul 5, 2024 02:23:56.255861044 CEST	587	49742	131.226.2.151	192.168.2.4
Jul 5, 2024 02:23:56.256159067 CEST	49742	587	192.168.2.4	131.226.2.151
Jul 5, 2024 02:23:56.260911942 CEST	587	49742	131.226.2.151	192.168.2.4
Jul 5, 2024 02:23:56.379215956 CEST	587	49742	131.226.2.151	192.168.2.4
Jul 5, 2024 02:23:56.379393101 CEST	49742	587	192.168.2.4	131.226.2.151
Jul 5, 2024 02:23:56.385350943 CEST	587	49742	131.226.2.151	192.168.2.4
Jul 5, 2024 02:23:56.502298117 CEST	587	49742	131.226.2.151	192.168.2.4
Jul 5, 2024 02:23:56.504164934 CEST	49742	587	192.168.2.4	131.226.2.151
Jul 5, 2024 02:23:56.509027958 CEST	587	49742	131.226.2.151	192.168.2.4
Jul 5, 2024 02:23:56.626143932 CEST	587	49742	131.226.2.151	192.168.2.4
Jul 5, 2024 02:23:56.626297951 CEST	49742	587	192.168.2.4	131.226.2.151
Jul 5, 2024 02:23:56.631356001 CEST	587	49742	131.226.2.151	192.168.2.4
Jul 5, 2024 02:23:56.748040915 CEST	587	49742	131.226.2.151	192.168.2.4
Jul 5, 2024 02:23:56.748328924 CEST	49742	587	192.168.2.4	131.226.2.151
Jul 5, 2024 02:23:56.748383045 CEST	49742	587	192.168.2.4	131.226.2.151
Jul 5, 2024 02:23:56.748445988 CEST	49742	587	192.168.2.4	131.226.2.151
Jul 5, 2024 02:23:56.748511076 CEST	49742	587	192.168.2.4	131.226.2.151
Jul 5, 2024 02:23:56.750149012 CEST	49742	587	192.168.2.4	131.226.2.151
Jul 5, 2024 02:23:56.753304005 CEST	587	49742	131.226.2.151	192.168.2.4
Jul 5, 2024 02:23:56.753361940 CEST	49742	587	192.168.2.4	131.226.2.151
Jul 5, 2024 02:23:56.755356073 CEST	587	49742	131.226.2.151	192.168.2.4
Jul 5, 2024 02:23:56.755409002 CEST	49742	587	192.168.2.4	131.226.2.151
Jul 5, 2024 02:23:56.755590916 CEST	587	49742	131.226.2.151	192.168.2.4
Jul 5, 2024 02:23:56.755670071 CEST	49742	587	192.168.2.4	131.226.2.151
Jul 5, 2024 02:23:56.755721092 CEST	587	49742	131.226.2.151	192.168.2.4
Jul 5, 2024 02:23:56.755779982 CEST	49742	587	192.168.2.4	131.226.2.151
Jul 5, 2024 02:23:56.758196115 CEST	587	49742	131.226.2.151	192.168.2.4
Jul 5, 2024 02:23:56.758243084 CEST	49742	587	192.168.2.4	131.226.2.151
Jul 5, 2024 02:23:56.760746002 CEST	587	49742	131.226.2.151	192.168.2.4
Jul 5, 2024 02:23:56.760792971 CEST	49742	587	192.168.2.4	131.226.2.151
Jul 5, 2024 02:23:56.760812044 CEST	587	49742	131.226.2.151	192.168.2.4
Jul 5, 2024 02:23:56.760864019 CEST	49742	587	192.168.2.4	131.226.2.151
Jul 5, 2024 02:23:56.760984898 CEST	587	49742	131.226.2.151	192.168.2.4
Jul 5, 2024 02:23:56.760994911 CEST	587	49742	131.226.2.151	192.168.2.4
Jul 5, 2024 02:23:56.761043072 CEST	49742	587	192.168.2.4	131.226.2.151
Jul 5, 2024 02:23:56.761065960 CEST	49742	587	192.168.2.4	131.226.2.151
Jul 5, 2024 02:23:56.761240005 CEST	587	49742	131.226.2.151	192.168.2.4
Jul 5, 2024 02:23:56.761293888 CEST	49742	587	192.168.2.4	131.226.2.151
Jul 5, 2024 02:23:56.761327982 CEST	587	49742	131.226.2.151	192.168.2.4
Jul 5, 2024 02:23:56.761395931 CEST	49742	587	192.168.2.4	131.226.2.151
Jul 5, 2024 02:23:56.763150930 CEST	587	49742	131.226.2.151	192.168.2.4
Jul 5, 2024 02:23:56.763196945 CEST	49742	587	192.168.2.4	131.226.2.151
Jul 5, 2024 02:23:56.765517950 CEST	587	49742	131.226.2.151	192.168.2.4
Jul 5, 2024 02:23:56.765599012 CEST	49742	587	192.168.2.4	131.226.2.151
Jul 5, 2024 02:23:56.765723944 CEST	587	49742	131.226.2.151	192.168.2.4
Jul 5, 2024 02:23:56.765775919 CEST	49742	587	192.168.2.4	131.226.2.151
Jul 5, 2024 02:23:56.765815020 CEST	587	49742	131.226.2.151	192.168.2.4
Jul 5, 2024 02:23:56.765867949 CEST	49742	587	192.168.2.4	131.226.2.151
Jul 5, 2024 02:23:56.766030073 CEST	587	49742	131.226.2.151	192.168.2.4
Jul 5, 2024 02:23:56.766073942 CEST	49742	587	192.168.2.4	131.226.2.151
Jul 5, 2024 02:23:56.766077995 CEST	587	49742	131.226.2.151	192.168.2.4
Jul 5, 2024 02:23:56.766128063 CEST	49742	587	192.168.2.4	131.226.2.151
Jul 5, 2024 02:23:56.766180992 CEST	587	49742	131.226.2.151	192.168.2.4
Jul 5, 2024 02:23:56.766222954 CEST	587	49742	131.226.2.151	192.168.2.4
Jul 5, 2024 02:23:56.766408920 CEST	587	49742	131.226.2.151	192.168.2.4
Jul 5, 2024 02:23:56.766583920 CEST	587	49742	131.226.2.151	192.168.2.4
Jul 5, 2024 02:23:56.766592979 CEST	587	49742	131.226.2.151	192.168.2.4
Jul 5, 2024 02:23:56.766599894 CEST	587	49742	131.226.2.151	192.168.2.4
Jul 5, 2024 02:23:56.766789913 CEST	587	49742	131.226.2.151	192.168.2.4
Jul 5, 2024 02:23:56.768021107 CEST	587	49742	131.226.2.151	192.168.2.4
Jul 5, 2024 02:23:56.768054962 CEST	587	49742	131.226.2.151	192.168.2.4
Jul 5, 2024 02:23:56.768071890 CEST	587	49742	131.226.2.151	192.168.2.4
Jul 5, 2024 02:23:56.768183947 CEST	587	49742	131.226.2.151	192.168.2.4
Jul 5, 2024 02:23:56.768193007 CEST	587	49742	131.226.2.151	192.168.2.4
Jul 5, 2024 02:23:56.768315077 CEST	587	49742	131.226.2.151	192.168.2.4
Jul 5, 2024 02:23:56.768323898 CEST	587	49742	131.226.2.151	192.168.2.4
Jul 5, 2024 02:23:56.768326998 CEST	587	49742	131.226.2.151	192.168.2.4
Jul 5, 2024 02:23:56.768413067 CEST	587	49742	131.226.2.151	192.168.2.4
Jul 5, 2024 02:23:56.770720959 CEST	587	49742	131.226.2.151	192.168.2.4
Jul 5, 2024 02:23:56.771095037 CEST	587	49742	131.226.2.151	192.168.2.4
Jul 5, 2024 02:23:56.771296978 CEST	587	49742	131.226.2.151	192.168.2.4
Jul 5, 2024 02:23:56.771307945 CEST	587	49742	131.226.2.151	192.168.2.4
Jul 5, 2024 02:23:56.771317005 CEST	587	49742	131.226.2.151	192.168.2.4
Jul 5, 2024 02:23:56.771401882 CEST	587	49742	131.226.2.151	192.168.2.4
Jul 5, 2024 02:23:56.771409988 CEST	587	49742	131.226.2.151	192.168.2.4
Jul 5, 2024 02:23:56.771539927 CEST	587	49742	131.226.2.151	192.168.2.4
Jul 5, 2024 02:23:56.771583080 CEST	587	49742	131.226.2.151	192.168.2.4
Jul 5, 2024 02:23:56.771591902 CEST	587	49742	131.226.2.151	192.168.2.4
Jul 5, 2024 02:23:56.771600008 CEST	587	49742	131.226.2.151	192.168.2.4
Jul 5, 2024 02:23:56.771639109 CEST	587	49742	131.226.2.151	192.168.2.4
Jul 5, 2024 02:23:56.771684885 CEST	587	49742	131.226.2.151	192.168.2.4
Jul 5, 2024 02:23:56.771692991 CEST	587	49742	131.226.2.151	192.168.2.4
Jul 5, 2024 02:23:56.771852970 CEST	587	49742	131.226.2.151	192.168.2.4
Jul 5, 2024 02:23:56.771899939 CEST	587	49742	131.226.2.151	192.168.2.4
Jul 5, 2024 02:23:56.771949053 CEST	587	49742	131.226.2.151	192.168.2.4
Jul 5, 2024 02:23:56.771958113 CEST	587	49742	131.226.2.151	192.168.2.4
Jul 5, 2024 02:23:56.772025108 CEST	587	49742	131.226.2.151	192.168.2.4
Jul 5, 2024 02:23:56.772072077 CEST	587	49742	131.226.2.151	192.168.2.4
Jul 5, 2024 02:23:56.772080898 CEST	587	49742	131.226.2.151	192.168.2.4
Jul 5, 2024 02:23:56.772089958 CEST	587	49742	131.226.2.151	192.168.2.4
Jul 5, 2024 02:23:56.772206068 CEST	587	49742	131.226.2.151	192.168.2.4
Jul 5, 2024 02:23:57.118098974 CEST	587	49742	131.226.2.151	192.168.2.4
Jul 5, 2024 02:23:57.173810959 CEST	49742	587	192.168.2.4	131.226.2.151
Jul 5, 2024 02:23:59.881380081 CEST	49742	587	192.168.2.4	131.226.2.151
Jul 5, 2024 02:23:59.886234045 CEST	587	49742	131.226.2.151	192.168.2.4
Jul 5, 2024 02:24:00.002564907 CEST	587	49742	131.226.2.151	192.168.2.4
Jul 5, 2024 02:24:00.002968073 CEST	49742	587	192.168.2.4	131.226.2.151
Jul 5, 2024 02:24:00.003026962 CEST	587	49742	131.226.2.151	192.168.2.4
Jul 5, 2024 02:24:00.003101110 CEST	49742	587	192.168.2.4	131.226.2.151
Jul 5, 2024 02:24:00.003613949 CEST	587	49742	131.226.2.151	192.168.2.4
Jul 5, 2024 02:24:00.004034996 CEST	49743	587	192.168.2.4	131.226.2.151
Jul 5, 2024 02:24:00.004091024 CEST	49742	587	192.168.2.4	131.226.2.151
Jul 5, 2024 02:24:00.008117914 CEST	587	49742	131.226.2.151	192.168.2.4
Jul 5, 2024 02:24:00.008797884 CEST	587	49743	131.226.2.151	192.168.2.4
Jul 5, 2024 02:24:00.008877993 CEST	49742	587	192.168.2.4	131.226.2.151
Jul 5, 2024 02:24:00.008878946 CEST	49743	587	192.168.2.4	131.226.2.151
Jul 5, 2024 02:24:00.538870096 CEST	587	49743	131.226.2.151	192.168.2.4
Jul 5, 2024 02:24:00.539062977 CEST	49743	587	192.168.2.4	131.226.2.151
Jul 5, 2024 02:24:00.543960094 CEST	587	49743	131.226.2.151	192.168.2.4
Jul 5, 2024 02:24:00.659504890 CEST	587	49743	131.226.2.151	192.168.2.4
Jul 5, 2024 02:24:00.659665108 CEST	49743	587	192.168.2.4	131.226.2.151
Jul 5, 2024 02:24:00.664532900 CEST	587	49743	131.226.2.151	192.168.2.4
Jul 5, 2024 02:24:00.780388117 CEST	587	49743	131.226.2.151	192.168.2.4
Jul 5, 2024 02:24:00.780688047 CEST	49743	587	192.168.2.4	131.226.2.151
Jul 5, 2024 02:24:00.785617113 CEST	587	49743	131.226.2.151	192.168.2.4
Jul 5, 2024 02:24:00.901523113 CEST	587	49743	131.226.2.151	192.168.2.4
Jul 5, 2024 02:24:00.902390957 CEST	49743	587	192.168.2.4	131.226.2.151
Jul 5, 2024 02:24:00.902909040 CEST	49743	587	192.168.2.4	131.226.2.151
Jul 5, 2024 02:24:00.907742023 CEST	587	49743	131.226.2.151	192.168.2.4
Jul 5, 2024 02:24:00.907752037 CEST	587	49743	131.226.2.151	192.168.2.4
Jul 5, 2024 02:24:01.023160934 CEST	587	49743	131.226.2.151	192.168.2.4
Jul 5, 2024 02:24:01.023426056 CEST	49743	587	192.168.2.4	131.226.2.151
Jul 5, 2024 02:24:01.028270960 CEST	587	49743	131.226.2.151	192.168.2.4
Jul 5, 2024 02:24:01.143728018 CEST	587	49743	131.226.2.151	192.168.2.4
Jul 5, 2024 02:24:01.143913984 CEST	49743	587	192.168.2.4	131.226.2.151
Jul 5, 2024 02:24:01.148694038 CEST	587	49743	131.226.2.151	192.168.2.4
Jul 5, 2024 02:24:01.264615059 CEST	587	49743	131.226.2.151	192.168.2.4
Jul 5, 2024 02:24:01.269364119 CEST	49743	587	192.168.2.4	131.226.2.151
Jul 5, 2024 02:24:01.274162054 CEST	587	49743	131.226.2.151	192.168.2.4
Jul 5, 2024 02:24:01.390203953 CEST	587	49743	131.226.2.151	192.168.2.4
Jul 5, 2024 02:24:01.393506050 CEST	49743	587	192.168.2.4	131.226.2.151
Jul 5, 2024 02:24:01.398380041 CEST	587	49743	131.226.2.151	192.168.2.4
Jul 5, 2024 02:24:01.516614914 CEST	587	49743	131.226.2.151	192.168.2.4
Jul 5, 2024 02:24:01.517510891 CEST	49743	587	192.168.2.4	131.226.2.151
Jul 5, 2024 02:24:01.522496939 CEST	587	49743	131.226.2.151	192.168.2.4
Jul 5, 2024 02:24:01.637729883 CEST	587	49743	131.226.2.151	192.168.2.4
Jul 5, 2024 02:24:01.641836882 CEST	49743	587	192.168.2.4	131.226.2.151
Jul 5, 2024 02:24:01.642112017 CEST	49743	587	192.168.2.4	131.226.2.151
Jul 5, 2024 02:24:01.642112017 CEST	49743	587	192.168.2.4	131.226.2.151
Jul 5, 2024 02:24:01.642270088 CEST	49743	587	192.168.2.4	131.226.2.151
Jul 5, 2024 02:24:01.645386934 CEST	49743	587	192.168.2.4	131.226.2.151
Jul 5, 2024 02:24:01.646588087 CEST	587	49743	131.226.2.151	192.168.2.4
Jul 5, 2024 02:24:01.646848917 CEST	587	49743	131.226.2.151	192.168.2.4
Jul 5, 2024 02:24:01.646976948 CEST	49743	587	192.168.2.4	131.226.2.151
Jul 5, 2024 02:24:01.647017956 CEST	587	49743	131.226.2.151	192.168.2.4
Jul 5, 2024 02:24:01.649490118 CEST	49743	587	192.168.2.4	131.226.2.151
Jul 5, 2024 02:24:01.650234938 CEST	587	49743	131.226.2.151	192.168.2.4
Jul 5, 2024 02:24:01.650414944 CEST	587	49743	131.226.2.151	192.168.2.4
Jul 5, 2024 02:24:01.650548935 CEST	49743	587	192.168.2.4	131.226.2.151
Jul 5, 2024 02:24:01.651561022 CEST	587	49743	131.226.2.151	192.168.2.4
Jul 5, 2024 02:24:01.651675940 CEST	587	49743	131.226.2.151	192.168.2.4
Jul 5, 2024 02:24:01.651860952 CEST	49743	587	192.168.2.4	131.226.2.151
Jul 5, 2024 02:24:01.654335976 CEST	587	49743	131.226.2.151	192.168.2.4
Jul 5, 2024 02:24:01.655718088 CEST	587	49743	131.226.2.151	192.168.2.4
Jul 5, 2024 02:24:01.656671047 CEST	587	49743	131.226.2.151	192.168.2.4
Jul 5, 2024 02:24:01.656744957 CEST	587	49743	131.226.2.151	192.168.2.4
Jul 5, 2024 02:24:01.656754017 CEST	587	49743	131.226.2.151	192.168.2.4
Jul 5, 2024 02:24:01.656816959 CEST	49743	587	192.168.2.4	131.226.2.151
Jul 5, 2024 02:24:01.656934023 CEST	49743	587	192.168.2.4	131.226.2.151
Jul 5, 2024 02:24:01.661700010 CEST	587	49743	131.226.2.151	192.168.2.4
Jul 5, 2024 02:24:01.661834002 CEST	587	49743	131.226.2.151	192.168.2.4
Jul 5, 2024 02:24:01.661900043 CEST	587	49743	131.226.2.151	192.168.2.4
Jul 5, 2024 02:24:01.661990881 CEST	587	49743	131.226.2.151	192.168.2.4
Jul 5, 2024 02:24:01.662058115 CEST	49743	587	192.168.2.4	131.226.2.151
Jul 5, 2024 02:24:01.662125111 CEST	587	49743	131.226.2.151	192.168.2.4
Jul 5, 2024 02:24:01.662133932 CEST	587	49743	131.226.2.151	192.168.2.4
Jul 5, 2024 02:24:01.662137985 CEST	587	49743	131.226.2.151	192.168.2.4
Jul 5, 2024 02:24:01.662157059 CEST	587	49743	131.226.2.151	192.168.2.4
Jul 5, 2024 02:24:01.662200928 CEST	587	49743	131.226.2.151	192.168.2.4
Jul 5, 2024 02:24:01.662209988 CEST	587	49743	131.226.2.151	192.168.2.4
Jul 5, 2024 02:24:01.662225962 CEST	49743	587	192.168.2.4	131.226.2.151
Jul 5, 2024 02:24:01.662235022 CEST	587	49743	131.226.2.151	192.168.2.4
Jul 5, 2024 02:24:01.666321993 CEST	587	49743	131.226.2.151	192.168.2.4
Jul 5, 2024 02:24:01.666398048 CEST	587	49743	131.226.2.151	192.168.2.4
Jul 5, 2024 02:24:01.666405916 CEST	587	49743	131.226.2.151	192.168.2.4
Jul 5, 2024 02:24:01.666414976 CEST	587	49743	131.226.2.151	192.168.2.4
Jul 5, 2024 02:24:01.666488886 CEST	587	49743	131.226.2.151	192.168.2.4
Jul 5, 2024 02:24:01.666897058 CEST	587	49743	131.226.2.151	192.168.2.4
Jul 5, 2024 02:24:01.666904926 CEST	587	49743	131.226.2.151	192.168.2.4
Jul 5, 2024 02:24:01.666951895 CEST	587	49743	131.226.2.151	192.168.2.4
Jul 5, 2024 02:24:01.666960955 CEST	587	49743	131.226.2.151	192.168.2.4
Jul 5, 2024 02:24:01.666977882 CEST	587	49743	131.226.2.151	192.168.2.4
Jul 5, 2024 02:24:01.667057991 CEST	587	49743	131.226.2.151	192.168.2.4
Jul 5, 2024 02:24:01.667067051 CEST	587	49743	131.226.2.151	192.168.2.4
Jul 5, 2024 02:24:01.667076111 CEST	587	49743	131.226.2.151	192.168.2.4
Jul 5, 2024 02:24:01.667114973 CEST	587	49743	131.226.2.151	192.168.2.4
Jul 5, 2024 02:24:01.667176008 CEST	587	49743	131.226.2.151	192.168.2.4
Jul 5, 2024 02:24:01.667185068 CEST	587	49743	131.226.2.151	192.168.2.4
Jul 5, 2024 02:24:01.667248011 CEST	587	49743	131.226.2.151	192.168.2.4
Jul 5, 2024 02:24:01.667257071 CEST	587	49743	131.226.2.151	192.168.2.4
Jul 5, 2024 02:24:01.667294025 CEST	587	49743	131.226.2.151	192.168.2.4
Jul 5, 2024 02:24:01.667301893 CEST	587	49743	131.226.2.151	192.168.2.4
Jul 5, 2024 02:24:01.667331934 CEST	587	49743	131.226.2.151	192.168.2.4
Jul 5, 2024 02:24:01.667340994 CEST	587	49743	131.226.2.151	192.168.2.4
Jul 5, 2024 02:24:01.667347908 CEST	587	49743	131.226.2.151	192.168.2.4
Jul 5, 2024 02:24:01.667363882 CEST	587	49743	131.226.2.151	192.168.2.4
Jul 5, 2024 02:24:01.667372942 CEST	587	49743	131.226.2.151	192.168.2.4
Jul 5, 2024 02:24:01.667376041 CEST	587	49743	131.226.2.151	192.168.2.4
Jul 5, 2024 02:24:01.667428970 CEST	587	49743	131.226.2.151	192.168.2.4
Jul 5, 2024 02:24:01.992937088 CEST	587	49743	131.226.2.151	192.168.2.4
Jul 5, 2024 02:24:02.173872948 CEST	49743	587	192.168.2.4	131.226.2.151
Jul 5, 2024 02:24:02.982029915 CEST	49743	587	192.168.2.4	131.226.2.151
Jul 5, 2024 02:24:02.986943960 CEST	587	49743	131.226.2.151	192.168.2.4
Jul 5, 2024 02:24:03.102305889 CEST	587	49743	131.226.2.151	192.168.2.4
Jul 5, 2024 02:24:03.102399111 CEST	587	49743	131.226.2.151	192.168.2.4
Jul 5, 2024 02:24:03.102443933 CEST	49743	587	192.168.2.4	131.226.2.151
Jul 5, 2024 02:24:03.102561951 CEST	587	49743	131.226.2.151	192.168.2.4
Jul 5, 2024 02:24:03.102602005 CEST	49743	587	192.168.2.4	131.226.2.151
Jul 5, 2024 02:24:03.104650021 CEST	49743	587	192.168.2.4	131.226.2.151
Jul 5, 2024 02:24:03.126080990 CEST	49744	587	192.168.2.4	131.226.2.151
Jul 5, 2024 02:24:03.134736061 CEST	587	49744	131.226.2.151	192.168.2.4
Jul 5, 2024 02:24:03.134800911 CEST	49744	587	192.168.2.4	131.226.2.151
Jul 5, 2024 02:24:03.671472073 CEST	587	49744	131.226.2.151	192.168.2.4
Jul 5, 2024 02:24:03.673885107 CEST	49744	587	192.168.2.4	131.226.2.151
Jul 5, 2024 02:24:03.679081917 CEST	587	49744	131.226.2.151	192.168.2.4
Jul 5, 2024 02:24:03.797261953 CEST	587	49744	131.226.2.151	192.168.2.4
Jul 5, 2024 02:24:03.798535109 CEST	49744	587	192.168.2.4	131.226.2.151
Jul 5, 2024 02:24:03.803491116 CEST	587	49744	131.226.2.151	192.168.2.4
Jul 5, 2024 02:24:03.922094107 CEST	587	49744	131.226.2.151	192.168.2.4
Jul 5, 2024 02:24:03.922462940 CEST	49744	587	192.168.2.4	131.226.2.151
Jul 5, 2024 02:24:03.927309990 CEST	587	49744	131.226.2.151	192.168.2.4
Jul 5, 2024 02:24:04.045672894 CEST	587	49744	131.226.2.151	192.168.2.4
Jul 5, 2024 02:24:04.046264887 CEST	49744	587	192.168.2.4	131.226.2.151
Jul 5, 2024 02:24:04.046534061 CEST	49744	587	192.168.2.4	131.226.2.151
Jul 5, 2024 02:24:04.051115036 CEST	587	49744	131.226.2.151	192.168.2.4
Jul 5, 2024 02:24:04.051271915 CEST	587	49744	131.226.2.151	192.168.2.4
Jul 5, 2024 02:24:04.239314079 CEST	587	49744	131.226.2.151	192.168.2.4
Jul 5, 2024 02:24:04.239521027 CEST	49744	587	192.168.2.4	131.226.2.151
Jul 5, 2024 02:24:04.244529009 CEST	587	49744	131.226.2.151	192.168.2.4
Jul 5, 2024 02:24:04.526622057 CEST	587	49744	131.226.2.151	192.168.2.4
Jul 5, 2024 02:24:04.526875973 CEST	49744	587	192.168.2.4	131.226.2.151
Jul 5, 2024 02:24:04.531652927 CEST	587	49744	131.226.2.151	192.168.2.4
Jul 5, 2024 02:24:04.650324106 CEST	587	49744	131.226.2.151	192.168.2.4
Jul 5, 2024 02:24:04.650532007 CEST	49744	587	192.168.2.4	131.226.2.151
Jul 5, 2024 02:24:04.656321049 CEST	587	49744	131.226.2.151	192.168.2.4
Jul 5, 2024 02:24:04.775459051 CEST	587	49744	131.226.2.151	192.168.2.4
Jul 5, 2024 02:24:04.775669098 CEST	49744	587	192.168.2.4	131.226.2.151
Jul 5, 2024 02:24:04.780555964 CEST	587	49744	131.226.2.151	192.168.2.4
Jul 5, 2024 02:24:04.899427891 CEST	587	49744	131.226.2.151	192.168.2.4
Jul 5, 2024 02:24:04.899611950 CEST	49744	587	192.168.2.4	131.226.2.151
Jul 5, 2024 02:24:04.904421091 CEST	587	49744	131.226.2.151	192.168.2.4
Jul 5, 2024 02:24:05.032126904 CEST	587	49744	131.226.2.151	192.168.2.4
Jul 5, 2024 02:24:05.032589912 CEST	49744	587	192.168.2.4	131.226.2.151
Jul 5, 2024 02:24:05.032706976 CEST	49744	587	192.168.2.4	131.226.2.151
Jul 5, 2024 02:24:05.032738924 CEST	49744	587	192.168.2.4	131.226.2.151
Jul 5, 2024 02:24:05.032788992 CEST	49744	587	192.168.2.4	131.226.2.151
Jul 5, 2024 02:24:05.034099102 CEST	49744	587	192.168.2.4	131.226.2.151
Jul 5, 2024 02:24:05.037600040 CEST	587	49744	131.226.2.151	192.168.2.4
Jul 5, 2024 02:24:05.037611008 CEST	587	49744	131.226.2.151	192.168.2.4
Jul 5, 2024 02:24:05.037623882 CEST	587	49744	131.226.2.151	192.168.2.4
Jul 5, 2024 02:24:05.037678957 CEST	49744	587	192.168.2.4	131.226.2.151
Jul 5, 2024 02:24:05.037775040 CEST	587	49744	131.226.2.151	192.168.2.4
Jul 5, 2024 02:24:05.037947893 CEST	49744	587	192.168.2.4	131.226.2.151
Jul 5, 2024 02:24:05.038974047 CEST	587	49744	131.226.2.151	192.168.2.4
Jul 5, 2024 02:24:05.038990974 CEST	587	49744	131.226.2.151	192.168.2.4
Jul 5, 2024 02:24:05.039032936 CEST	49744	587	192.168.2.4	131.226.2.151
Jul 5, 2024 02:24:05.039073944 CEST	49744	587	192.168.2.4	131.226.2.151
Jul 5, 2024 02:24:05.039091110 CEST	587	49744	131.226.2.151	192.168.2.4
Jul 5, 2024 02:24:05.039099932 CEST	587	49744	131.226.2.151	192.168.2.4
Jul 5, 2024 02:24:05.039150953 CEST	49744	587	192.168.2.4	131.226.2.151
Jul 5, 2024 02:24:05.039809942 CEST	587	49744	131.226.2.151	192.168.2.4
Jul 5, 2024 02:24:05.039868116 CEST	49744	587	192.168.2.4	131.226.2.151
Jul 5, 2024 02:24:05.042283058 CEST	587	49744	131.226.2.151	192.168.2.4
Jul 5, 2024 02:24:05.042349100 CEST	49744	587	192.168.2.4	131.226.2.151
Jul 5, 2024 02:24:05.042798996 CEST	587	49744	131.226.2.151	192.168.2.4
Jul 5, 2024 02:24:05.042856932 CEST	49744	587	192.168.2.4	131.226.2.151
Jul 5, 2024 02:24:05.043972969 CEST	587	49744	131.226.2.151	192.168.2.4
Jul 5, 2024 02:24:05.044045925 CEST	49744	587	192.168.2.4	131.226.2.151
Jul 5, 2024 02:24:05.044162035 CEST	587	49744	131.226.2.151	192.168.2.4
Jul 5, 2024 02:24:05.044172049 CEST	587	49744	131.226.2.151	192.168.2.4
Jul 5, 2024 02:24:05.044255972 CEST	49744	587	192.168.2.4	131.226.2.151
Jul 5, 2024 02:24:05.044734955 CEST	587	49744	131.226.2.151	192.168.2.4
Jul 5, 2024 02:24:05.044810057 CEST	49744	587	192.168.2.4	131.226.2.151
Jul 5, 2024 02:24:05.044842958 CEST	587	49744	131.226.2.151	192.168.2.4
Jul 5, 2024 02:24:05.044918060 CEST	49744	587	192.168.2.4	131.226.2.151
Jul 5, 2024 02:24:05.047296047 CEST	587	49744	131.226.2.151	192.168.2.4
Jul 5, 2024 02:24:05.047380924 CEST	49744	587	192.168.2.4	131.226.2.151
Jul 5, 2024 02:24:05.047884941 CEST	587	49744	131.226.2.151	192.168.2.4
Jul 5, 2024 02:24:05.048181057 CEST	587	49744	131.226.2.151	192.168.2.4
Jul 5, 2024 02:24:05.048191071 CEST	587	49744	131.226.2.151	192.168.2.4
Jul 5, 2024 02:24:05.048280954 CEST	49744	587	192.168.2.4	131.226.2.151
Jul 5, 2024 02:24:05.048877001 CEST	587	49744	131.226.2.151	192.168.2.4
Jul 5, 2024 02:24:05.049030066 CEST	587	49744	131.226.2.151	192.168.2.4
Jul 5, 2024 02:24:05.049104929 CEST	49744	587	192.168.2.4	131.226.2.151
Jul 5, 2024 02:24:05.049144983 CEST	587	49744	131.226.2.151	192.168.2.4
Jul 5, 2024 02:24:05.049460888 CEST	587	49744	131.226.2.151	192.168.2.4
Jul 5, 2024 02:24:05.049493074 CEST	587	49744	131.226.2.151	192.168.2.4
Jul 5, 2024 02:24:05.049500942 CEST	587	49744	131.226.2.151	192.168.2.4
Jul 5, 2024 02:24:05.049524069 CEST	49744	587	192.168.2.4	131.226.2.151
Jul 5, 2024 02:24:05.049601078 CEST	587	49744	131.226.2.151	192.168.2.4
Jul 5, 2024 02:24:05.049729109 CEST	587	49744	131.226.2.151	192.168.2.4
Jul 5, 2024 02:24:05.049756050 CEST	587	49744	131.226.2.151	192.168.2.4
Jul 5, 2024 02:24:05.049763918 CEST	587	49744	131.226.2.151	192.168.2.4
Jul 5, 2024 02:24:05.049990892 CEST	587	49744	131.226.2.151	192.168.2.4
Jul 5, 2024 02:24:05.050061941 CEST	587	49744	131.226.2.151	192.168.2.4
Jul 5, 2024 02:24:05.052197933 CEST	587	49744	131.226.2.151	192.168.2.4
Jul 5, 2024 02:24:05.052645922 CEST	587	49744	131.226.2.151	192.168.2.4
Jul 5, 2024 02:24:05.052654982 CEST	587	49744	131.226.2.151	192.168.2.4
Jul 5, 2024 02:24:05.052663088 CEST	587	49744	131.226.2.151	192.168.2.4
Jul 5, 2024 02:24:05.053200960 CEST	587	49744	131.226.2.151	192.168.2.4
Jul 5, 2024 02:24:05.053735018 CEST	587	49744	131.226.2.151	192.168.2.4
Jul 5, 2024 02:24:05.053755045 CEST	587	49744	131.226.2.151	192.168.2.4
Jul 5, 2024 02:24:05.053764105 CEST	587	49744	131.226.2.151	192.168.2.4
Jul 5, 2024 02:24:05.053879976 CEST	587	49744	131.226.2.151	192.168.2.4
Jul 5, 2024 02:24:05.053888083 CEST	587	49744	131.226.2.151	192.168.2.4
Jul 5, 2024 02:24:05.053895950 CEST	587	49744	131.226.2.151	192.168.2.4
Jul 5, 2024 02:24:05.053905010 CEST	587	49744	131.226.2.151	192.168.2.4
Jul 5, 2024 02:24:05.053913116 CEST	587	49744	131.226.2.151	192.168.2.4
Jul 5, 2024 02:24:05.053926945 CEST	587	49744	131.226.2.151	192.168.2.4
Jul 5, 2024 02:24:05.053936005 CEST	587	49744	131.226.2.151	192.168.2.4
Jul 5, 2024 02:24:05.053972960 CEST	587	49744	131.226.2.151	192.168.2.4
Jul 5, 2024 02:24:05.053981066 CEST	587	49744	131.226.2.151	192.168.2.4
Jul 5, 2024 02:24:05.053991079 CEST	587	49744	131.226.2.151	192.168.2.4
Jul 5, 2024 02:24:05.053999901 CEST	587	49744	131.226.2.151	192.168.2.4
Jul 5, 2024 02:24:05.054007053 CEST	587	49744	131.226.2.151	192.168.2.4
Jul 5, 2024 02:24:05.054112911 CEST	587	49744	131.226.2.151	192.168.2.4
Jul 5, 2024 02:24:05.054121017 CEST	587	49744	131.226.2.151	192.168.2.4
Jul 5, 2024 02:24:05.054128885 CEST	587	49744	131.226.2.151	192.168.2.4
Jul 5, 2024 02:24:05.054250956 CEST	587	49744	131.226.2.151	192.168.2.4
Jul 5, 2024 02:24:05.054367065 CEST	587	49744	131.226.2.151	192.168.2.4
Jul 5, 2024 02:24:05.054433107 CEST	587	49744	131.226.2.151	192.168.2.4
Jul 5, 2024 02:24:05.054441929 CEST	587	49744	131.226.2.151	192.168.2.4
Jul 5, 2024 02:24:05.054486990 CEST	587	49744	131.226.2.151	192.168.2.4
Jul 5, 2024 02:24:05.054496050 CEST	587	49744	131.226.2.151	192.168.2.4
Jul 5, 2024 02:24:05.396497011 CEST	587	49744	131.226.2.151	192.168.2.4
Jul 5, 2024 02:24:05.536838055 CEST	49744	587	192.168.2.4	131.226.2.151
Jul 5, 2024 02:24:08.443231106 CEST	49744	587	192.168.2.4	131.226.2.151
Jul 5, 2024 02:24:08.448262930 CEST	587	49744	131.226.2.151	192.168.2.4
Jul 5, 2024 02:24:08.566541910 CEST	587	49744	131.226.2.151	192.168.2.4
Jul 5, 2024 02:24:08.567543030 CEST	587	49744	131.226.2.151	192.168.2.4
Jul 5, 2024 02:24:08.567657948 CEST	587	49744	131.226.2.151	192.168.2.4
Jul 5, 2024 02:24:08.567805052 CEST	49744	587	192.168.2.4	131.226.2.151
Jul 5, 2024 02:24:08.567868948 CEST	49744	587	192.168.2.4	131.226.2.151
Jul 5, 2024 02:24:08.567868948 CEST	49744	587	192.168.2.4	131.226.2.151
Jul 5, 2024 02:24:08.568675041 CEST	49745	587	192.168.2.4	131.226.2.151
Jul 5, 2024 02:24:08.572746038 CEST	587	49744	131.226.2.151	192.168.2.4
Jul 5, 2024 02:24:08.572839975 CEST	49744	587	192.168.2.4	131.226.2.151
Jul 5, 2024 02:24:08.573487043 CEST	587	49745	131.226.2.151	192.168.2.4
Jul 5, 2024 02:24:08.573585987 CEST	49745	587	192.168.2.4	131.226.2.151
Jul 5, 2024 02:24:08.658276081 CEST	49745	587	192.168.2.4	131.226.2.151
Jul 5, 2024 02:24:08.663209915 CEST	587	49745	131.226.2.151	192.168.2.4
Jul 5, 2024 02:24:08.663297892 CEST	49745	587	192.168.2.4	131.226.2.151
Jul 5, 2024 02:24:08.725732088 CEST	49746	587	192.168.2.4	131.226.2.151
Jul 5, 2024 02:24:08.733666897 CEST	587	49746	131.226.2.151	192.168.2.4
Jul 5, 2024 02:24:08.733782053 CEST	49746	587	192.168.2.4	131.226.2.151
Jul 5, 2024 02:24:28.127078056 CEST	49746	587	192.168.2.4	131.226.2.151
Jul 5, 2024 02:24:28.131897926 CEST	587	49746	131.226.2.151	192.168.2.4
Jul 5, 2024 02:24:28.131948948 CEST	49746	587	192.168.2.4	131.226.2.151
Jul 5, 2024 02:24:28.187252045 CEST	49747	587	192.168.2.4	131.226.2.151
Jul 5, 2024 02:24:28.192162991 CEST	587	49747	131.226.2.151	192.168.2.4
Jul 5, 2024 02:24:28.192236900 CEST	49747	587	192.168.2.4	131.226.2.151
Jul 5, 2024 02:24:28.379682064 CEST	49747	587	192.168.2.4	131.226.2.151
Jul 5, 2024 02:24:28.384747028 CEST	587	49747	131.226.2.151	192.168.2.4
Jul 5, 2024 02:24:28.391561031 CEST	49747	587	192.168.2.4	131.226.2.151
Jul 5, 2024 02:24:28.427588940 CEST	49748	587	192.168.2.4	131.226.2.151
Jul 5, 2024 02:24:28.433001995 CEST	587	49748	131.226.2.151	192.168.2.4
Jul 5, 2024 02:24:28.435514927 CEST	49748	587	192.168.2.4	131.226.2.151
Jul 5, 2024 02:24:32.455173016 CEST	49748	587	192.168.2.4	131.226.2.151
Jul 5, 2024 02:24:32.464772940 CEST	587	49748	131.226.2.151	192.168.2.4
Jul 5, 2024 02:24:32.465431929 CEST	49748	587	192.168.2.4	131.226.2.151
Jul 5, 2024 02:24:32.510380983 CEST	49749	587	192.168.2.4	131.226.2.151
Jul 5, 2024 02:24:32.515311003 CEST	587	49749	131.226.2.151	192.168.2.4
Jul 5, 2024 02:24:32.515434980 CEST	49749	587	192.168.2.4	131.226.2.151
Jul 5, 2024 02:24:36.142688990 CEST	49749	587	192.168.2.4	131.226.2.151
Jul 5, 2024 02:24:36.147790909 CEST	587	49749	131.226.2.151	192.168.2.4
Jul 5, 2024 02:24:36.147855043 CEST	49749	587	192.168.2.4	131.226.2.151
Jul 5, 2024 02:24:36.203234911 CEST	49750	587	192.168.2.4	131.226.2.151
Jul 5, 2024 02:24:36.208434105 CEST	587	49750	131.226.2.151	192.168.2.4
Jul 5, 2024 02:24:36.208533049 CEST	49750	587	192.168.2.4	131.226.2.151
Jul 5, 2024 02:24:37.424046040 CEST	49750	587	192.168.2.4	131.226.2.151
Jul 5, 2024 02:24:37.429052114 CEST	587	49750	131.226.2.151	192.168.2.4
Jul 5, 2024 02:24:37.429251909 CEST	49750	587	192.168.2.4	131.226.2.151
Jul 5, 2024 02:24:37.475545883 CEST	49751	587	192.168.2.4	131.226.2.151
Jul 5, 2024 02:24:37.480334044 CEST	587	49751	131.226.2.151	192.168.2.4
Jul 5, 2024 02:24:37.480415106 CEST	49751	587	192.168.2.4	131.226.2.151
Jul 5, 2024 02:24:48.502096891 CEST	49751	587	192.168.2.4	131.226.2.151
Jul 5, 2024 02:24:48.508300066 CEST	587	49751	131.226.2.151	192.168.2.4
Jul 5, 2024 02:24:48.508543015 CEST	49751	587	192.168.2.4	131.226.2.151
Jul 5, 2024 02:24:48.571562052 CEST	49752	587	192.168.2.4	131.226.2.151
Jul 5, 2024 02:24:48.576278925 CEST	587	49752	131.226.2.151	192.168.2.4
Jul 5, 2024 02:24:48.576447964 CEST	49752	587	192.168.2.4	131.226.2.151
Jul 5, 2024 02:24:53.017705917 CEST	49752	587	192.168.2.4	131.226.2.151
Jul 5, 2024 02:24:53.022696972 CEST	587	49752	131.226.2.151	192.168.2.4
Jul 5, 2024 02:24:53.022778988 CEST	49752	587	192.168.2.4	131.226.2.151
Jul 5, 2024 02:24:53.066487074 CEST	49753	587	192.168.2.4	131.226.2.151
Jul 5, 2024 02:24:53.071497917 CEST	587	49753	131.226.2.151	192.168.2.4
Jul 5, 2024 02:24:53.071592093 CEST	49753	587	192.168.2.4	131.226.2.151
Jul 5, 2024 02:25:00.783390999 CEST	49753	587	192.168.2.4	131.226.2.151
Jul 5, 2024 02:25:00.788610935 CEST	587	49753	131.226.2.151	192.168.2.4
Jul 5, 2024 02:25:00.788724899 CEST	49753	587	192.168.2.4	131.226.2.151
Jul 5, 2024 02:25:00.831300020 CEST	49754	587	192.168.2.4	131.226.2.151
Jul 5, 2024 02:25:00.836195946 CEST	587	49754	131.226.2.151	192.168.2.4
Jul 5, 2024 02:25:00.836302996 CEST	49754	587	192.168.2.4	131.226.2.151
Jul 5, 2024 02:25:03.064594030 CEST	49754	587	192.168.2.4	131.226.2.151
Jul 5, 2024 02:25:03.069626093 CEST	587	49754	131.226.2.151	192.168.2.4
Jul 5, 2024 02:25:03.073548079 CEST	49754	587	192.168.2.4	131.226.2.151
Jul 5, 2024 02:25:03.117235899 CEST	49755	587	192.168.2.4	131.226.2.151
Jul 5, 2024 02:25:03.122021914 CEST	587	49755	131.226.2.151	192.168.2.4
Jul 5, 2024 02:25:03.122178078 CEST	49755	587	192.168.2.4	131.226.2.151
Jul 5, 2024 02:25:24.504904032 CEST	587	49755	131.226.2.151	192.168.2.4
Jul 5, 2024 02:25:24.504966021 CEST	49755	587	192.168.2.4	131.226.2.151
Jul 5, 2024 02:25:24.506220102 CEST	49755	587	192.168.2.4	131.226.2.151
Jul 5, 2024 02:25:24.511116028 CEST	587	49755	131.226.2.151	192.168.2.4
Jul 5, 2024 02:25:30.647989035 CEST	49756	587	192.168.2.4	131.226.2.151
Jul 5, 2024 02:25:30.653048992 CEST	587	49756	131.226.2.151	192.168.2.4
Jul 5, 2024 02:25:30.653158903 CEST	49756	587	192.168.2.4	131.226.2.151
Jul 5, 2024 02:25:37.377155066 CEST	49756	587	192.168.2.4	131.226.2.151
Jul 5, 2024 02:25:37.382425070 CEST	587	49756	131.226.2.151	192.168.2.4
Jul 5, 2024 02:25:37.382502079 CEST	49756	587	192.168.2.4	131.226.2.151
Jul 5, 2024 02:25:37.428232908 CEST	49757	587	192.168.2.4	131.226.2.151
Jul 5, 2024 02:25:37.433024883 CEST	587	49757	131.226.2.151	192.168.2.4
Jul 5, 2024 02:25:37.433177948 CEST	49757	587	192.168.2.4	131.226.2.151
Jul 5, 2024 02:25:56.830503941 CEST	49757	587	192.168.2.4	131.226.2.151
Jul 5, 2024 02:25:56.835423946 CEST	587	49757	131.226.2.151	192.168.2.4
Jul 5, 2024 02:25:56.835478067 CEST	49757	587	192.168.2.4	131.226.2.151
Jul 5, 2024 02:25:56.892865896 CEST	49758	587	192.168.2.4	131.226.2.151
Jul 5, 2024 02:25:56.897640944 CEST	587	49758	131.226.2.151	192.168.2.4
Jul 5, 2024 02:25:56.897715092 CEST	49758	587	192.168.2.4	131.226.2.151
Jul 5, 2024 02:26:03.727293968 CEST	49758	587	192.168.2.4	131.226.2.151
Jul 5, 2024 02:26:03.733074903 CEST	587	49758	131.226.2.151	192.168.2.4
Jul 5, 2024 02:26:03.733186007 CEST	49758	587	192.168.2.4	131.226.2.151
Jul 5, 2024 02:26:03.781629086 CEST	49759	587	192.168.2.4	131.226.2.151
Jul 5, 2024 02:26:03.786504030 CEST	587	49759	131.226.2.151	192.168.2.4
Jul 5, 2024 02:26:03.786616087 CEST	49759	587	192.168.2.4	131.226.2.151

UDP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Jul 5, 2024 02:21:56.482822895 CEST	59006	53	192.168.2.4	1.1.1.1
Jul 5, 2024 02:21:56.492985964 CEST	53	59006	1.1.1.1	192.168.2.4
Jul 5, 2024 02:21:57.352618933 CEST	50662	53	192.168.2.4	1.1.1.1
Jul 5, 2024 02:21:57.360333920 CEST	53	50662	1.1.1.1	192.168.2.4
Jul 5, 2024 02:21:59.452305079 CEST	50164	53	192.168.2.4	1.1.1.1
Jul 5, 2024 02:21:59.698926926 CEST	53	50164	1.1.1.1	192.168.2.4

DNS Queries

Timestamp	Source IP	Dest IP	Trans ID	OP Code	Name	Type	Class	DNS over HTTPS
Jul 5, 2024 02:21:56.482822895 CEST	192.168.2.4	1.1.1.1	0x9852	Standard query (0)	api.ipify.org	A (IP address)	IN (0x0001)	false
Jul 5, 2024 02:21:57.352618933 CEST	192.168.2.4	1.1.1.1	0xfdb4	Standard query (0)	ip-api.com	A (IP address)	IN (0x0001)	false
Jul 5, 2024 02:21:59.452305079 CEST	192.168.2.4	1.1.1.1	0x8802	Standard query (0)	mail.suplementvases.com	A (IP address)	IN (0x0001)	false

DNS Answers

Timestamp	Source IP	Dest IP	Trans ID	Reply Code	Name	Address	Type	Class	DNS over HTTPS
Jul 5, 2024 02:21:56.492985964 CEST	1.1.1.1	192.168.2.4	0x9852	No error (0)	api.ipify.org	104.26.12.205	A (IP address)	IN (0x0001)	false
Jul 5, 2024 02:21:56.492985964 CEST	1.1.1.1	192.168.2.4	0x9852	No error (0)	api.ipify.org	172.67.74.152	A (IP address)	IN (0x0001)	false
Jul 5, 2024 02:21:56.492985964 CEST	1.1.1.1	192.168.2.4	0x9852	No error (0)	api.ipify.org	104.26.13.205	A (IP address)	IN (0x0001)	false
Jul 5, 2024 02:21:57.360333920 CEST	1.1.1.1	192.168.2.4	0xfdb4	No error (0)	ip-api.com	208.95.112.1	A (IP address)	IN (0x0001)	false
Jul 5, 2024 02:21:59.698926926 CEST	1.1.1.1	192.168.2.4	0x8802	No error (0)	mail.suplementvases.com	131.226.2.151	A (IP address)	IN (0x0001)	false

HTTP Request Dependency Graph

api.ipify.org

ip-api.com

HTTP Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
0	192.168.2.4	49731	208.95.112.1	80	6776	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe

Timestamp	Bytes transferred	Direction	Data
Jul 5, 2024 02:21:57.371578932 CEST	80	OUT	GET /line/?fields=hosting HTTP/1.1 Host: ip-api.com Connection: Keep-Alive
Jul 5, 2024 02:21:57.856928110 CEST	175	IN	HTTP/1.1 200 OK Date: Fri, 05 Jul 2024 00:21:57 GMT Content-Type: text/plain; charset=utf-8 Content-Length: 6 Access-Control-Allow-Origin: * X-Ttl: 60 X-Rl: 44 Data Raw: 66 61 6c 73 65 0a Data Ascii: false

HTTPS Proxied Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
0	192.168.2.4	49730	104.26.12.205	443	6776	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe

Timestamp	Bytes transferred	Direction	Data
2024-07-05 00:21:57 UTC	155	OUT	GET / HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:99.0) Gecko/20100101 Firefox/99.0 Host: api.ipify.org Connection: Keep-Alive
2024-07-05 00:21:57 UTC	211	IN	HTTP/1.1 200 OK Date: Fri, 05 Jul 2024 00:21:57 GMT Content-Type: text/plain Content-Length: 11 Connection: close Vary: Origin CF-Cache-Status: DYNAMIC Server: cloudflare CF-RAY: 89e332a8da6c726f-EWR
2024-07-05 00:21:57 UTC	11	IN	Data Raw: 38 2e 34 36 2e 31 32 33 2e 33 33 Data Ascii: 8.46.123.33

SMTP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP	Commands
Jul 5, 2024 02:22:00.249630928 CEST	587	49732	131.226.2.151	192.168.2.4	220 ns1.suplementvases.com ESMTP Postfix (Ubuntu)
Jul 5, 2024 02:22:00.249847889 CEST	49732	587	192.168.2.4	131.226.2.151	EHLO 445817
Jul 5, 2024 02:22:00.371959925 CEST	587	49732	131.226.2.151	192.168.2.4	250-ns1.suplementvases.com 250-PIPELINING 250-SIZE 10240000 250-VRFY 250-ETRN 250-STARTTLS 250-AUTH PLAIN LOGIN 250-AUTH=PLAIN LOGIN 250-ENHANCEDSTATUSCODES 250-8BITMIME 250-DSN 250-SMTPUTF8 250 CHUNKING
Jul 5, 2024 02:22:00.373516083 CEST	49732	587	192.168.2.4	131.226.2.151	STARTTLS
Jul 5, 2024 02:22:00.497052908 CEST	587	49732	131.226.2.151	192.168.2.4	220 2.0.0 Ready to start TLS
Jul 5, 2024 02:23:40.837789059 CEST	587	49740	131.226.2.151	192.168.2.4	220 ns1.suplementvases.com ESMTP Postfix (Ubuntu)
Jul 5, 2024 02:23:40.837984085 CEST	49740	587	192.168.2.4	131.226.2.151	EHLO 445817
Jul 5, 2024 02:23:40.959556103 CEST	587	49740	131.226.2.151	192.168.2.4	250-ns1.suplementvases.com 250-PIPELINING 250-SIZE 10240000 250-VRFY 250-ETRN 250-STARTTLS 250-AUTH PLAIN LOGIN 250-AUTH=PLAIN LOGIN 250-ENHANCEDSTATUSCODES 250-8BITMIME 250-DSN 250-SMTPUTF8 250 CHUNKING
Jul 5, 2024 02:23:40.959712982 CEST	49740	587	192.168.2.4	131.226.2.151	STARTTLS
Jul 5, 2024 02:23:41.081197977 CEST	587	49740	131.226.2.151	192.168.2.4	220 2.0.0 Ready to start TLS
Jul 5, 2024 02:23:55.577599049 CEST	587	49742	131.226.2.151	192.168.2.4	220 ns1.suplementvases.com ESMTP Postfix (Ubuntu)
Jul 5, 2024 02:23:55.577706099 CEST	49742	587	192.168.2.4	131.226.2.151	EHLO 445817
Jul 5, 2024 02:23:55.699306011 CEST	587	49742	131.226.2.151	192.168.2.4	250-ns1.suplementvases.com 250-PIPELINING 250-SIZE 10240000 250-VRFY 250-ETRN 250-STARTTLS 250-AUTH PLAIN LOGIN 250-AUTH=PLAIN LOGIN 250-ENHANCEDSTATUSCODES 250-8BITMIME 250-DSN 250-SMTPUTF8 250 CHUNKING
Jul 5, 2024 02:23:55.699444056 CEST	49742	587	192.168.2.4	131.226.2.151	STARTTLS
Jul 5, 2024 02:23:55.820871115 CEST	587	49742	131.226.2.151	192.168.2.4	220 2.0.0 Ready to start TLS
Jul 5, 2024 02:24:00.538870096 CEST	587	49743	131.226.2.151	192.168.2.4	220 ns1.suplementvases.com ESMTP Postfix (Ubuntu)
Jul 5, 2024 02:24:00.539062977 CEST	49743	587	192.168.2.4	131.226.2.151	EHLO 445817
Jul 5, 2024 02:24:00.659504890 CEST	587	49743	131.226.2.151	192.168.2.4	250-ns1.suplementvases.com 250-PIPELINING 250-SIZE 10240000 250-VRFY 250-ETRN 250-STARTTLS 250-AUTH PLAIN LOGIN 250-AUTH=PLAIN LOGIN 250-ENHANCEDSTATUSCODES 250-8BITMIME 250-DSN 250-SMTPUTF8 250 CHUNKING
Jul 5, 2024 02:24:00.659665108 CEST	49743	587	192.168.2.4	131.226.2.151	STARTTLS
Jul 5, 2024 02:24:00.780388117 CEST	587	49743	131.226.2.151	192.168.2.4	220 2.0.0 Ready to start TLS
Jul 5, 2024 02:24:03.671472073 CEST	587	49744	131.226.2.151	192.168.2.4	220 ns1.suplementvases.com ESMTP Postfix (Ubuntu)
Jul 5, 2024 02:24:03.673885107 CEST	49744	587	192.168.2.4	131.226.2.151	EHLO 445817
Jul 5, 2024 02:24:03.797261953 CEST	587	49744	131.226.2.151	192.168.2.4	250-ns1.suplementvases.com 250-PIPELINING 250-SIZE 10240000 250-VRFY 250-ETRN 250-STARTTLS 250-AUTH PLAIN LOGIN 250-AUTH=PLAIN LOGIN 250-ENHANCEDSTATUSCODES 250-8BITMIME 250-DSN 250-SMTPUTF8 250 CHUNKING
Jul 5, 2024 02:24:03.798535109 CEST	49744	587	192.168.2.4	131.226.2.151	STARTTLS
Jul 5, 2024 02:24:03.922094107 CEST	587	49744	131.226.2.151	192.168.2.4	220 2.0.0 Ready to start TLS

Target ID:	0
Start time:	20:21:54
Start date:	04/07/2024
Path:	C:\Users\user\Desktop\Ship Docs_CI PL HBL COO_.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\Desktop\Ship Docs_CI PL HBL COO_.exe"
Imagebase:	0x20000
File size:	1'059'328 bytes
MD5 hash:	BB66E44260B8A454ABCB20AEB4B13F7B
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 00000000.00000002.1644364725.0000000003010000.00000004.00001000.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_GenericDownloader_1, Description: Yara detected Generic Downloader, Source: 00000000.00000002.1644364725.0000000003010000.00000004.00001000.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_AgentTesla_1, Description: Yara detected AgentTesla, Source: 00000000.00000002.1644364725.0000000003010000.00000004.00001000.00020000.00000000.sdmp, Author: Joe Security Rule: INDICATOR_SUSPICIOUS_EXE_VaultSchemaGUID, Description: Detects executables referencing Windows vault credential objects. Observed in infostealers, Source: 00000000.00000002.1644364725.0000000003010000.00000004.00001000.00020000.00000000.sdmp, Author: ditekSHen
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	1
Start time:	20:21:55
Start date:	04/07/2024
Path:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\Desktop\Ship Docs_CI PL HBL COO_.exe"
Imagebase:	0xf10000
File size:	45'984 bytes
MD5 hash:	9D352BC46709F0CB5EC974633A0C3C94
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 00000001.00000002.4111602006.0000000000402000.00000040.80000000.00040000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_AgentTesla_1, Description: Yara detected AgentTesla, Source: 00000001.00000002.4111602006.0000000000402000.00000040.80000000.00040000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 00000001.00000002.4112584252.000000000334C000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_AgentTesla_1, Description: Yara detected AgentTesla, Source: 00000001.00000002.4112584252.000000000334C000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security
Reputation:	high
Has exited:	false

Show Windows behavior

Execution Graph

Execution Coverage:	4%
Dynamic/Decrypted Code Coverage:	1.3%
Signature Coverage:	2.7%
Total number of Nodes:	2000
Total number of Limit Nodes:	53

Executed Functions

Function 00023B4C Relevance: 17.7, APIs: 8, Strings: 2, Instructions: 153
windowCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetCurrentDirectoryW.KERNEL32(00007FFF,?), ref: 00023B7A
IsDebuggerPresent.KERNEL32 ref: 00023B8C
GetFullPathNameW.KERNEL32(00007FFF,?,?,000E62F8,000E62E0,?,?), ref: 00023BFD

Part of subcall function 00027D2C: _memmove.LIBCMT ref: 00027D66

Part of subcall function 00030A8D: GetFullPathNameW.KERNEL32(?,00007FFF,?,?,?,00023C26,000E62F8,?,?,?), ref: 00030ACE

SetCurrentDirectoryW.KERNEL32(?), ref: 00023C81
MessageBoxA.USER32(00000000,This is a third-party compiled AutoIt script.,000D93F0,00000010), ref: 0005D4BC
SetCurrentDirectoryW.KERNEL32(?,000E62F8,?,?,?), ref: 0005D4F4
GetForegroundWindow.USER32(runas,?,?,?,00000001,?,000D5D40,000E62F8,?,?,?), ref: 0005D57A
ShellExecuteW.SHELL32(00000000,?,?), ref: 0005D581

Part of subcall function 00023A58: GetSysColorBrush.USER32(0000000F), ref: 00023A62
Part of subcall function 00023A58: LoadCursorW.USER32(00000000,00007F00), ref: 00023A71
Part of subcall function 00023A58: LoadIconW.USER32(00000063), ref: 00023A88
Part of subcall function 00023A58: LoadIconW.USER32(000000A4), ref: 00023A9A
Part of subcall function 00023A58: LoadIconW.USER32(000000A2), ref: 00023AAC
Part of subcall function 00023A58: LoadImageW.USER32(00000063,00000001,00000010,00000010,00000000), ref: 00023AD2
Part of subcall function 00023A58: RegisterClassExW.USER32(?), ref: 00023B28

Part of subcall function 000239E7: CreateWindowExW.USER32(00000000,AutoIt v3,AutoIt v3,00CF0000,80000000,80000000,0000012C,00000064,00000000,00000000,00000000,00000001), ref: 00023A15
Part of subcall function 000239E7: CreateWindowExW.USER32(00000000,edit,00000000,50B008C4,00000000,00000000,00000000,00000000,00000000,00000001,00000000), ref: 00023A36
Part of subcall function 000239E7: ShowWindow.USER32(00000000,?,?), ref: 00023A4A
Part of subcall function 000239E7: ShowWindow.USER32(00000000,?,?), ref: 00023A53

Part of subcall function 000243DB: _memset.LIBCMT ref: 00024401
Part of subcall function 000243DB: Shell_NotifyIconW.SHELL32(00000000,?), ref: 000244A6

Strings

This is a third-party compiled AutoIt script., xrefs: 0005D4B4
runas, xrefs: 0005D575

Memory Dump Source

Source File: 00000000.00000002.1643917647.0000000000021000.00000020.00000001.01000000.00000003.sdmp, Offset: 00020000, based on PE: true

Associated: 00000000.00000002.1643904003.0000000000020000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1643958107.00000000000AF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1643958107.00000000000D5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1643993044.00000000000DF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1644007204.00000000000E8000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_20000_Ship Docs_CI PL HBL COO_.jbxd

Similarity

API ID: LoadWindow$Icon$CurrentDirectory$CreateFullNamePathShow$BrushClassColorCursorDebuggerExecuteForegroundImageMessageNotifyPresentRegisterShellShell__memmove_memset
String ID: This is a third-party compiled AutoIt script.$runas
API String ID: 529118366-3287110873
Opcode ID: a2b372761bd9e46104b734c910b22a69c87d5356d0a3fafb041da7309b9850db
Instruction ID: 59495b6d71ac02a001ae0aadc255618a257d9aa499bcb827c34bbd84f844366d
Opcode Fuzzy Hash: a2b372761bd9e46104b734c910b22a69c87d5356d0a3fafb041da7309b9850db
Instruction Fuzzy Hash: A0515830D08699AEDF21EBB0FC45EFE7B78AF15740F00416AFA157A1A3DA394605CB21

Function 00024AFE Relevance: 10.7, APIs: 7, Instructions: 223
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetVersionExW.KERNEL32(?), ref: 00024B2B

Part of subcall function 00027D2C: _memmove.LIBCMT ref: 00027D66

GetCurrentProcess.KERNEL32(?,000AFAEC,00000000,00000000,?), ref: 00024BF8
IsWow64Process.KERNEL32(00000000), ref: 00024BFF
GetNativeSystemInfo.KERNELBASE(00000000), ref: 00024C45
FreeLibrary.KERNEL32(00000000), ref: 00024C50
GetSystemInfo.KERNEL32(00000000), ref: 00024C81
GetSystemInfo.KERNEL32(00000000), ref: 00024C8D

Memory Dump Source

Source File: 00000000.00000002.1643917647.0000000000021000.00000020.00000001.01000000.00000003.sdmp, Offset: 00020000, based on PE: true

Associated: 00000000.00000002.1643904003.0000000000020000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1643958107.00000000000AF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1643958107.00000000000D5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1643993044.00000000000DF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1644007204.00000000000E8000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_20000_Ship Docs_CI PL HBL COO_.jbxd

Similarity

API ID: InfoSystem$Process$CurrentFreeLibraryNativeVersionWow64_memmove
String ID:
API String ID: 1986165174-0
Opcode ID: 46deadc8d893287a7924d8d0ab2da59761642693fb6273df0820bdd5227818d6
Instruction ID: 0c1ebfa1ad7318c9b30df4ddeb522eaa95cde16ac6bffa48f5c12955a800260a
Opcode Fuzzy Hash: 46deadc8d893287a7924d8d0ab2da59761642693fb6273df0820bdd5227818d6
Instruction Fuzzy Hash: F591E53154ABD1DEC772CB6894611ABFFE4AF2A300B544D9EE4CB93A01D224F90CC759

Function 00024FE9 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 62
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateStreamOnHGlobal.OLE32(00000000,00000001,?,?,?,?,?,00024EEE,?,?,00000000,00000000), ref: 00024FF9
FindResourceExW.KERNEL32(?,0000000A,SCRIPT,00000000,?,?,00024EEE,?,?,00000000,00000000), ref: 00025010
LoadResource.KERNEL32(?,00000000,?,?,00024EEE,?,?,00000000,00000000,?,?,?,?,?,?,00024F8F), ref: 0005DD60
SizeofResource.KERNEL32(?,00000000,?,?,00024EEE,?,?,00000000,00000000,?,?,?,?,?,?,00024F8F), ref: 0005DD75
LockResource.KERNEL32(00024EEE,?,?,00024EEE,?,?,00000000,00000000,?,?,?,?,?,?,00024F8F,00000000), ref: 0005DD88

Strings

SCRIPT, xrefs: 00025006

Memory Dump Source

Source File: 00000000.00000002.1643917647.0000000000021000.00000020.00000001.01000000.00000003.sdmp, Offset: 00020000, based on PE: true

Associated: 00000000.00000002.1643904003.0000000000020000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1643958107.00000000000AF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1643958107.00000000000D5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1643993044.00000000000DF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1644007204.00000000000E8000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_20000_Ship Docs_CI PL HBL COO_.jbxd

Similarity

API ID: Resource$CreateFindGlobalLoadLockSizeofStream
String ID: SCRIPT
API String ID: 3051347437-3967369404
Opcode ID: 99752618041d6cf41ba63375118349edd80ef8add2ca3e8d3364232aff0589f5
Instruction ID: 18680caa990782d191ccce07ef4d5461bae001782b58da9c93d04a1eb58047c5
Opcode Fuzzy Hash: 99752618041d6cf41ba63375118349edd80ef8add2ca3e8d3364232aff0589f5
Instruction Fuzzy Hash: 2B115E75240B01AFE7218BA5EC98F777BB9EBCAB52F104168F805CA260DB75EC008660

Function 00084696 Relevance: 4.5, APIs: 3, Instructions: 25fileCOMMON

Download Yara Rule

APIs

GetFileAttributesW.KERNELBASE(?,0005E7C1), ref: 000846A6
FindFirstFileW.KERNELBASE(?,?), ref: 000846B7
FindClose.KERNEL32(00000000), ref: 000846C7

Memory Dump Source

Source File: 00000000.00000002.1643917647.0000000000021000.00000020.00000001.01000000.00000003.sdmp, Offset: 00020000, based on PE: true

Associated: 00000000.00000002.1643904003.0000000000020000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1643958107.00000000000AF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1643958107.00000000000D5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1643993044.00000000000DF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1644007204.00000000000E8000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_20000_Ship Docs_CI PL HBL COO_.jbxd

Similarity

API ID: FileFind$AttributesCloseFirst
String ID:
API String ID: 48322524-0
Opcode ID: 8d455b3c7ab02936f2144ba0d8a6b5884688bb0f266583a6441bcd006af5db49
Instruction ID: 29fc1ba1ae33f3ce3f24b5192fb83bfd32589e3ca2edf0d72a094197f5302e39
Opcode Fuzzy Hash: 8d455b3c7ab02936f2144ba0d8a6b5884688bb0f266583a6441bcd006af5db49
Instruction Fuzzy Hash: DEE0D8329108025B56107778EC4D4FA779CAF07335F100715F8B5C10E0FBB45D608796

Function 0002E800 Relevance: 2.4, Strings: 1, Instructions: 1102COMMON

Download Yara Rule

Strings

Variable must be of type 'Object'., xrefs: 0006428C

Memory Dump Source

Source File: 00000000.00000002.1643917647.0000000000021000.00000020.00000001.01000000.00000003.sdmp, Offset: 00020000, based on PE: true

Associated: 00000000.00000002.1643904003.0000000000020000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1643958107.00000000000AF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1643958107.00000000000D5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1643993044.00000000000DF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1644007204.00000000000E8000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_20000_Ship Docs_CI PL HBL COO_.jbxd

Similarity

API ID:
String ID: Variable must be of type 'Object'.
API String ID: 0-109567571
Opcode ID: 3a7c8c5686bafab0c44408aaa0b68868ac727114439143b465363a3471319f73
Instruction ID: 80903c9ed852d550bdbe776e39b48f9f3ab19a8766e1d4869dc4dfff17ab9a7b
Opcode Fuzzy Hash: 3a7c8c5686bafab0c44408aaa0b68868ac727114439143b465363a3471319f73
Instruction Fuzzy Hash: C9A29174A04265CFDB64CF54E480AAEB7F2FF59300F64806AE906AB351D735ED42CB91

Function 00030B30 Relevance: 57.3, APIs: 27, Strings: 5, Instructions: 1300windowsleeptimeCOMMON

Download Yara Rule

APIs

PeekMessageW.USER32(?,00000000,00000000,00000000,00000001), ref: 00030BBB
timeGetTime.WINMM ref: 00030E76
PeekMessageW.USER32(?,00000000,00000000,00000000,00000001), ref: 00030FB3
TranslateMessage.USER32(?), ref: 00030FC7
DispatchMessageW.USER32(?), ref: 00030FD5
Sleep.KERNEL32(0000000A), ref: 00030FDF
LockWindowUpdate.USER32(00000000,?,?), ref: 0003105A
DestroyWindow.USER32 ref: 00031066
GetMessageW.USER32(?,00000000,00000000,00000000), ref: 00031080
Sleep.KERNEL32(0000000A,?,?), ref: 000652AD
TranslateMessage.USER32(?), ref: 0006608A
DispatchMessageW.USER32(?), ref: 00066098
GetMessageW.USER32(?,00000000,00000000,00000000), ref: 000660AC

Strings

@GUI_WINHANDLE, xrefs: 000653B9
@COM_EVENTOBJ, xrefs: 0006591A
@TRAY_ID, xrefs: 00065BB9
@GUI_CTRLID, xrefs: 00065364
@GUI_CTRLHANDLE, xrefs: 0006540E

Memory Dump Source

Source File: 00000000.00000002.1643917647.0000000000021000.00000020.00000001.01000000.00000003.sdmp, Offset: 00020000, based on PE: true

Associated: 00000000.00000002.1643904003.0000000000020000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1643958107.00000000000AF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1643958107.00000000000D5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1643993044.00000000000DF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1644007204.00000000000E8000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_20000_Ship Docs_CI PL HBL COO_.jbxd

Similarity

API ID: Message$DispatchPeekSleepTranslateWindow$DestroyLockTimeUpdatetime
String ID: @COM_EVENTOBJ$@GUI_CTRLHANDLE$@GUI_CTRLID$@GUI_WINHANDLE$@TRAY_ID
API String ID: 4003667617-3242690629
Opcode ID: 5c57d7d29b32d13e2bd2b8610fdf4a197b5bea4bff38a77763b27554b19f3a3e
Instruction ID: c76b51f1b3127b59e6805af7abd8e5ef147b757a13131a24ccef1c68e3ed5914
Opcode Fuzzy Hash: 5c57d7d29b32d13e2bd2b8610fdf4a197b5bea4bff38a77763b27554b19f3a3e
Instruction Fuzzy Hash: E2B2D170608741DFD729DF24C894BAEB7E5BF84304F14492DF58A972A2DB75E884CB82

Function 000893DF Relevance: 19.8, APIs: 13, Instructions: 322
fileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 000891E9: __time64.LIBCMT ref: 000891F3

Part of subcall function 00025045: _fseek.LIBCMT ref: 0002505D

__wsplitpath.LIBCMT ref: 000894BE

Part of subcall function 0004432E: __wsplitpath_helper.LIBCMT ref: 0004436E

_wcscpy.LIBCMT ref: 000894D1
_wcscat.LIBCMT ref: 000894E4
__wsplitpath.LIBCMT ref: 00089509
_wcscat.LIBCMT ref: 0008951F
_wcscat.LIBCMT ref: 00089532

Part of subcall function 0008922F: _memmove.LIBCMT ref: 00089268
Part of subcall function 0008922F: _memmove.LIBCMT ref: 00089277

_wcscmp.LIBCMT ref: 00089479

Part of subcall function 000899BE: _wcscmp.LIBCMT ref: 00089AAE
Part of subcall function 000899BE: _wcscmp.LIBCMT ref: 00089AC1

DeleteFileW.KERNEL32(?,?,?,?,00000004,00000001,?,?,00000004,00000001,?,?,00000004,00000001,?,?), ref: 000896DC
_wcsncpy.LIBCMT ref: 0008974F
DeleteFileW.KERNEL32(?,?), ref: 00089785
CopyFileW.KERNEL32(?,?,00000000,?,?,?,00000004,00000001,?,?,00000004,00000001,?,?,00000004,00000001), ref: 0008979B
DeleteFileW.KERNEL32(?,?,?,00000004,00000001,?,?,00000004,00000001,?,?,00000004,00000001,?,?,00000004), ref: 000897AC
DeleteFileW.KERNELBASE(?,?,?,00000004,00000001,?,?,00000004,00000001,?,?,00000004,00000001,?,?,00000004), ref: 000897BE

Memory Dump Source

Source File: 00000000.00000002.1643917647.0000000000021000.00000020.00000001.01000000.00000003.sdmp, Offset: 00020000, based on PE: true

Associated: 00000000.00000002.1643904003.0000000000020000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1643958107.00000000000AF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1643958107.00000000000D5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1643993044.00000000000DF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1644007204.00000000000E8000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_20000_Ship Docs_CI PL HBL COO_.jbxd

Similarity

API ID: File$Delete$_wcscat_wcscmp$__wsplitpath_memmove$Copy__time64__wsplitpath_helper_fseek_wcscpy_wcsncpy
String ID:
API String ID: 1500180987-0
Opcode ID: 7b15023be6d4240b5b69dab16c318821b521d01c8181c87b569ba4027920e3c1
Instruction ID: 006f3ee1412282465246aaad555513eca089c6182abbeda6504033001056c7d4
Opcode Fuzzy Hash: 7b15023be6d4240b5b69dab16c318821b521d01c8181c87b569ba4027920e3c1
Instruction Fuzzy Hash: 4AC13FB1D00229AEDF21EF95CC85AEEB7BDFF45310F0440AAF609E6152DB709A448F65

Function 00023015 Relevance: 19.3, APIs: 7, Strings: 4, Instructions: 71
windowregistryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetSysColorBrush.USER32(0000000F), ref: 00023074
RegisterClassExW.USER32(00000030), ref: 0002309E
RegisterWindowMessageW.USER32(TaskbarCreated), ref: 000230AF
InitCommonControlsEx.COMCTL32(?), ref: 000230CC
ImageList_Create.COMCTL32(00000010,00000010,00000021,00000001,00000001), ref: 000230DC
LoadIconW.USER32(000000A9), ref: 000230F2
ImageList_ReplaceIcon.COMCTL32(000000FF,00000000), ref: 00023101

Strings

TaskbarCreated, xrefs: 000230A4
0, xrefs: 00023056
AutoIt v3 GUI, xrefs: 00023090
+, xrefs: 0002305D

Memory Dump Source

Source File: 00000000.00000002.1643917647.0000000000021000.00000020.00000001.01000000.00000003.sdmp, Offset: 00020000, based on PE: true

Associated: 00000000.00000002.1643904003.0000000000020000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1643958107.00000000000AF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1643958107.00000000000D5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1643993044.00000000000DF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1644007204.00000000000E8000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_20000_Ship Docs_CI PL HBL COO_.jbxd

Similarity

API ID: IconImageList_Register$BrushClassColorCommonControlsCreateInitLoadMessageReplaceWindow
String ID: +$0$AutoIt v3 GUI$TaskbarCreated
API String ID: 2914291525-1005189915
Opcode ID: c6ccf895a836d0b55b38754ad21977232b74c74347c39fdddec6731eac22863f
Instruction ID: 618288bf6938e5a7cb6efaf90db4af8acc37dfd9c81cb266490edf5d297ff01e
Opcode Fuzzy Hash: c6ccf895a836d0b55b38754ad21977232b74c74347c39fdddec6731eac22863f
Instruction Fuzzy Hash: 13313AB1844346EFEB508FE4E885ADDBBF0FB1A750F10452AE580EA2A1D7BA0585CF51

Function 00023041 Relevance: 19.3, APIs: 7, Strings: 4, Instructions: 54
windowregistryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetSysColorBrush.USER32(0000000F), ref: 00023074
RegisterClassExW.USER32(00000030), ref: 0002309E
RegisterWindowMessageW.USER32(TaskbarCreated), ref: 000230AF
InitCommonControlsEx.COMCTL32(?), ref: 000230CC
ImageList_Create.COMCTL32(00000010,00000010,00000021,00000001,00000001), ref: 000230DC
LoadIconW.USER32(000000A9), ref: 000230F2
ImageList_ReplaceIcon.COMCTL32(000000FF,00000000), ref: 00023101

Strings

TaskbarCreated, xrefs: 000230A4
0, xrefs: 00023056
AutoIt v3 GUI, xrefs: 00023090
+, xrefs: 0002305D

Memory Dump Source

Source File: 00000000.00000002.1643917647.0000000000021000.00000020.00000001.01000000.00000003.sdmp, Offset: 00020000, based on PE: true

Associated: 00000000.00000002.1643904003.0000000000020000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1643958107.00000000000AF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1643958107.00000000000D5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1643993044.00000000000DF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1644007204.00000000000E8000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_20000_Ship Docs_CI PL HBL COO_.jbxd

Similarity

API ID: IconImageList_Register$BrushClassColorCommonControlsCreateInitLoadMessageReplaceWindow
String ID: +$0$AutoIt v3 GUI$TaskbarCreated
API String ID: 2914291525-1005189915
Opcode ID: a2a8bf035f1ed4ec8b80263fca5217c7ca29ca544eec2248f24856f3104dc725
Instruction ID: 4d6ee1e5ff8111a5306236483820098305a95ce6db0817ff8d69137afa3a4ffa
Opcode Fuzzy Hash: a2a8bf035f1ed4ec8b80263fca5217c7ca29ca544eec2248f24856f3104dc725
Instruction Fuzzy Hash: 7821E8B1900259AFEB00DFD4E988BEDBBF4FB19750F00422AF511AA2A0D7BA45448F91

Function 000271EB Relevance: 17.7, APIs: 6, Strings: 4, Instructions: 201
registryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 00024864: GetModuleFileNameW.KERNEL32(00000000,?,00007FFF,000E62F8,?,000237C0,?), ref: 00024882

Part of subcall function 0004074F: GetFullPathNameW.KERNEL32(?,00007FFF,?,?,?,?,000272C5), ref: 00040771

RegOpenKeyExW.KERNELBASE(80000001,Software\AutoIt v3\AutoIt,00000000,00000001,?,?,\Include\), ref: 00027308
RegQueryValueExW.ADVAPI32(?,Include,00000000,00000000,00000000,?), ref: 0005ECF1
RegQueryValueExW.ADVAPI32(?,Include,00000000,00000000,?,?,00000000), ref: 0005ED32
RegCloseKey.ADVAPI32(?), ref: 0005ED70
_wcscat.LIBCMT ref: 0005EDC9

Strings

Include, xrefs: 0005ECE8, 0005ED29
\Include\, xrefs: 000272C5
Software\AutoIt v3\AutoIt, xrefs: 000272FE
\, xrefs: 0005EDEC

Memory Dump Source

Source File: 00000000.00000002.1643917647.0000000000021000.00000020.00000001.01000000.00000003.sdmp, Offset: 00020000, based on PE: true

Associated: 00000000.00000002.1643904003.0000000000020000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1643958107.00000000000AF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1643958107.00000000000D5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1643993044.00000000000DF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1644007204.00000000000E8000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_20000_Ship Docs_CI PL HBL COO_.jbxd

Similarity

API ID: NameQueryValue$CloseFileFullModuleOpenPath_wcscat
String ID: Include$Software\AutoIt v3\AutoIt$\$\Include\
API String ID: 2673923337-2727554177
Opcode ID: c1b5742260e84403bc5335c241275acd8f5713f25e723b90d2dd97ce40ad644c
Instruction ID: ba47e932e369705ecefdab4b37ca134c119a0dcdfa7f88c39df606791807bbd5
Opcode Fuzzy Hash: c1b5742260e84403bc5335c241275acd8f5713f25e723b90d2dd97ce40ad644c
Instruction Fuzzy Hash: 6F71A0715083419ED314DF65EC819AFB7F8FF94700F80052EF689AB1A1EB349949CB66

Function 00023A58 Relevance: 17.6, APIs: 7, Strings: 3, Instructions: 71
windowregistryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetSysColorBrush.USER32(0000000F), ref: 00023A62
LoadCursorW.USER32(00000000,00007F00), ref: 00023A71
LoadIconW.USER32(00000063), ref: 00023A88
LoadIconW.USER32(000000A4), ref: 00023A9A
LoadIconW.USER32(000000A2), ref: 00023AAC
LoadImageW.USER32(00000063,00000001,00000010,00000010,00000000), ref: 00023AD2
RegisterClassExW.USER32(?), ref: 00023B28

Part of subcall function 00023041: GetSysColorBrush.USER32(0000000F), ref: 00023074
Part of subcall function 00023041: RegisterClassExW.USER32(00000030), ref: 0002309E
Part of subcall function 00023041: RegisterWindowMessageW.USER32(TaskbarCreated), ref: 000230AF
Part of subcall function 00023041: InitCommonControlsEx.COMCTL32(?), ref: 000230CC
Part of subcall function 00023041: ImageList_Create.COMCTL32(00000010,00000010,00000021,00000001,00000001), ref: 000230DC
Part of subcall function 00023041: LoadIconW.USER32(000000A9), ref: 000230F2
Part of subcall function 00023041: ImageList_ReplaceIcon.COMCTL32(000000FF,00000000), ref: 00023101

Strings

#, xrefs: 00023B0D
0, xrefs: 00023B06
AutoIt v3, xrefs: 00023B17

Memory Dump Source

Source File: 00000000.00000002.1643917647.0000000000021000.00000020.00000001.01000000.00000003.sdmp, Offset: 00020000, based on PE: true

Associated: 00000000.00000002.1643904003.0000000000020000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1643958107.00000000000AF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1643958107.00000000000D5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1643993044.00000000000DF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1644007204.00000000000E8000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_20000_Ship Docs_CI PL HBL COO_.jbxd

Similarity

API ID: Load$Icon$ImageRegister$BrushClassColorList_$CommonControlsCreateCursorInitMessageReplaceWindow
String ID: #$0$AutoIt v3
API String ID: 423443420-4155596026
Opcode ID: adbc8df17e2879580e9867f1df8fbbd0432f3ee02132fa26ced523ec8b53b9f0
Instruction ID: 8ab886a87e3952ec2fcf9e84a20736c82eccba5d94fbd4287528034bc8fb4c5d
Opcode Fuzzy Hash: adbc8df17e2879580e9867f1df8fbbd0432f3ee02132fa26ced523ec8b53b9f0
Instruction Fuzzy Hash: CB213C71D00755AFFB109FA4FC89BAD7BB4EB18B51F00412AE604BA2A0D3BE55548F54

Function 00023633 Relevance: 15.9, APIs: 8, Strings: 1, Instructions: 151
windowtimeregistryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

DefWindowProcW.USER32(?,?,?,?), ref: 000236D2
KillTimer.USER32(?,00000001), ref: 000236FC
SetTimer.USER32(?,00000001,000002EE,00000000), ref: 0002371F
RegisterWindowMessageW.USER32(TaskbarCreated), ref: 0002372A
CreatePopupMenu.USER32 ref: 0002373E
PostQuitMessage.USER32(00000000), ref: 0002375F

Strings

TaskbarCreated, xrefs: 00023725

Memory Dump Source

Source File: 00000000.00000002.1643917647.0000000000021000.00000020.00000001.01000000.00000003.sdmp, Offset: 00020000, based on PE: true

Associated: 00000000.00000002.1643904003.0000000000020000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1643958107.00000000000AF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1643958107.00000000000D5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1643993044.00000000000DF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1644007204.00000000000E8000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_20000_Ship Docs_CI PL HBL COO_.jbxd

Similarity

API ID: MessageTimerWindow$CreateKillMenuPopupPostProcQuitRegister
String ID: TaskbarCreated
API String ID: 129472671-2362178303
Opcode ID: 77e8308d5380870c6e8d1151ad76acb68400eab1a63035e2e88f00c7d82546e0
Instruction ID: ac42ddb67cebc12b090bfa027d105c7a48dd91558ab7a3437d3dab0cd32b0228
Opcode Fuzzy Hash: 77e8308d5380870c6e8d1151ad76acb68400eab1a63035e2e88f00c7d82546e0
Instruction Fuzzy Hash: 7A4160B1208555BBEF345F64FC4DBBE379CE711740F04012AFA46E62A2CE6E9E019761

Function 00023778 Relevance: 14.3, APIs: 1, Strings: 7, Instructions: 267
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

/AutoIt3OutputDebug, xrefs: 000238A4
/ErrorStdOut, xrefs: 0002388F
/AutoIt3ExecuteLine, xrefs: 000238B9
CMDLINERAW, xrefs: 0002380D
>>>AUTOIT NO CMDEXECUTE<<<, xrefs: 000237C0
/AutoIt3ExecuteScript, xrefs: 000238CE
CMDLINE, xrefs: 00023834

Memory Dump Source

Source File: 00000000.00000002.1643917647.0000000000021000.00000020.00000001.01000000.00000003.sdmp, Offset: 00020000, based on PE: true

Associated: 00000000.00000002.1643904003.0000000000020000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1643958107.00000000000AF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1643958107.00000000000D5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1643993044.00000000000DF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1644007204.00000000000E8000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_20000_Ship Docs_CI PL HBL COO_.jbxd

Similarity

API ID: FileLibraryLoadModuleName__wcsicmp_l_memmove
String ID: /AutoIt3ExecuteLine$/AutoIt3ExecuteScript$/AutoIt3OutputDebug$/ErrorStdOut$>>>AUTOIT NO CMDEXECUTE<<<$CMDLINE$CMDLINERAW
API String ID: 1825951767-3513169116
Opcode ID: 4cf1c365ce8195e35f5f77244736477694b8409786bfc58968080c9e3674ebfe
Instruction ID: cef09aba2ebe461b09369c2d66eca130cd9e8d788d5290e02f2c800bd8df27b8
Opcode Fuzzy Hash: 4cf1c365ce8195e35f5f77244736477694b8409786bfc58968080c9e3674ebfe
Instruction Fuzzy Hash: 0BA15E71D102799ADF14EBA0EC96EEEB778BF14300F04042AF516B7192DF799A09CB61

Function 019D25D0 Relevance: 10.7, APIs: 7, Instructions: 239
fileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateFileW.KERNELBASE(00000000,?,80000000,00000007,00000000,00000003,00000080,00000000,?,00000000), ref: 019D26A1
VirtualFree.KERNELBASE(00000000,00000000,00008000,00000000,00000000,00000000,00000000,?,?,00000000), ref: 019D28C7

Memory Dump Source

Source File: 00000000.00000002.1644337710.00000000019D0000.00000040.00001000.00020000.00000000.sdmp, Offset: 019D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_19d0000_Ship Docs_CI PL HBL COO_.jbxd

Similarity

API ID: CreateFileFreeVirtual
String ID:
API String ID: 204039940-0
Opcode ID: e364f936384ad5a75a3e6820b612275e2b186d73597ef444eab7978b091760cf
Instruction ID: 21d0df3078cc3d79e22831d5fe516a849b728ebd8bcc7ff5798da1de2db890fc
Opcode Fuzzy Hash: e364f936384ad5a75a3e6820b612275e2b186d73597ef444eab7978b091760cf
Instruction Fuzzy Hash: 79A13874E00209EBDB14CFA4C895BEEBBB5FF48305F208559E605BB280D775AA81CF51

Function 000239E7 Relevance: 10.5, APIs: 4, Strings: 2, Instructions: 44
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateWindowExW.USER32(00000000,AutoIt v3,AutoIt v3,00CF0000,80000000,80000000,0000012C,00000064,00000000,00000000,00000000,00000001), ref: 00023A15
CreateWindowExW.USER32(00000000,edit,00000000,50B008C4,00000000,00000000,00000000,00000000,00000000,00000001,00000000), ref: 00023A36
ShowWindow.USER32(00000000,?,?), ref: 00023A4A
ShowWindow.USER32(00000000,?,?), ref: 00023A53

Strings

edit, xrefs: 00023A30
AutoIt v3, xrefs: 00023A0D, 00023A12, 00023A13

Memory Dump Source

Source File: 00000000.00000002.1643917647.0000000000021000.00000020.00000001.01000000.00000003.sdmp, Offset: 00020000, based on PE: true

Associated: 00000000.00000002.1643904003.0000000000020000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1643958107.00000000000AF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1643958107.00000000000D5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1643993044.00000000000DF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1644007204.00000000000E8000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_20000_Ship Docs_CI PL HBL COO_.jbxd

Similarity

API ID: Window$CreateShow
String ID: AutoIt v3$edit
API String ID: 1584632944-3779509399
Opcode ID: f7799cbaf064ef9e6801f7dc914553efcbdbb1bc8113f7755a016c1ab4c652db
Instruction ID: 5001c0861a0648eb570f7e28e490c3215e54672a0a12617a26d0894e23bdcac4
Opcode Fuzzy Hash: f7799cbaf064ef9e6801f7dc914553efcbdbb1bc8113f7755a016c1ab4c652db
Instruction Fuzzy Hash: F6F0DA716416D07EFA3117A7BC89E773E7DD7D7FA0B00412EBA04BA170C6AA1851DAB0

Function 019D23B0 Relevance: 8.9, APIs: 4, Strings: 1, Instructions: 141
fileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 019D22A0: Sleep.KERNELBASE(000001F4), ref: 019D22B1

CreateFileW.KERNELBASE(?,80000000,00000007,00000000,00000003,00000080,00000000), ref: 019D24C1

Strings

4GPXXALJBQXOZMWHMNSXJ, xrefs: 019D2524, 019D2527

Memory Dump Source

Source File: 00000000.00000002.1644337710.00000000019D0000.00000040.00001000.00020000.00000000.sdmp, Offset: 019D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_19d0000_Ship Docs_CI PL HBL COO_.jbxd

Similarity

API ID: CreateFileSleep
String ID: 4GPXXALJBQXOZMWHMNSXJ
API String ID: 2694422964-1622066102
Opcode ID: 2c067320126bdffff9c87dece9f6c52309a74a7e89ba9c5bcfda8271da0f040d
Instruction ID: 4422aebfec36812809deb7cd7186cf928f6c47674686398b17b931cb0fb704dd
Opcode Fuzzy Hash: 2c067320126bdffff9c87dece9f6c52309a74a7e89ba9c5bcfda8271da0f040d
Instruction Fuzzy Hash: 8C518571D04289DAEF11D7A4C814BEEBB78AF55304F048198E609BB2C1D7B91B48CB65

Function 0002410D Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 88
windowCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

LoadStringW.USER32(00000065,?,0000007F,00000104), ref: 0005D5EC

Part of subcall function 00027D2C: _memmove.LIBCMT ref: 00027D66

_memset.LIBCMT ref: 0002418D
_wcscpy.LIBCMT ref: 000241E1
Shell_NotifyIconW.SHELL32(00000001,000003A8), ref: 000241F1

Strings

Line: , xrefs: 0005D615

Memory Dump Source

Source File: 00000000.00000002.1643917647.0000000000021000.00000020.00000001.01000000.00000003.sdmp, Offset: 00020000, based on PE: true

Associated: 00000000.00000002.1643904003.0000000000020000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1643958107.00000000000AF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1643958107.00000000000D5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1643993044.00000000000DF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1644007204.00000000000E8000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_20000_Ship Docs_CI PL HBL COO_.jbxd

Similarity

API ID: IconLoadNotifyShell_String_memmove_memset_wcscpy
String ID: Line:
API String ID: 3942752672-1585850449
Opcode ID: 2e2b42614179a5630e71f8063c51c40f405ba240da6b9e13c601e036aaf91d21
Instruction ID: d56f45ef2e1a46c69d82ba6606571794de6a0c560714a60588180d9a2910a470
Opcode Fuzzy Hash: 2e2b42614179a5630e71f8063c51c40f405ba240da6b9e13c601e036aaf91d21
Instruction Fuzzy Hash: 3631E7710087649AE771EB60FC46FDB77ECAF54700F10451EF688A6092EB749648C793

Function 0004564D Relevance: 7.7, APIs: 5, Instructions: 163
COMMONLIBRARYCODE

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

_memset.LIBCMT ref: 000456AB
_memcpy_s.LIBCMT ref: 0004571D
__read_nolock.LIBCMT ref: 0004577B
__filbuf.LIBCMT ref: 0004579E
_memset.LIBCMT ref: 000457E2

Part of subcall function 00048D68: __getptd_noexit.LIBCMT ref: 00048D68

Memory Dump Source

Source File: 00000000.00000002.1643917647.0000000000021000.00000020.00000001.01000000.00000003.sdmp, Offset: 00020000, based on PE: true

Associated: 00000000.00000002.1643904003.0000000000020000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1643958107.00000000000AF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1643958107.00000000000D5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1643993044.00000000000DF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1644007204.00000000000E8000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_20000_Ship Docs_CI PL HBL COO_.jbxd

Similarity

API ID: _memset$__filbuf__getptd_noexit__read_nolock_memcpy_s
String ID:
API String ID: 1559183368-0
Opcode ID: cbc132a2d90f1fa170c901e77712e707e3c45fd9b9f6dd10e42efcbbdaed9f46
Instruction ID: 62a3a678b0562c79db2853142902857f38e424ac4f1a7ed5f0e35176c70e1c81
Opcode Fuzzy Hash: cbc132a2d90f1fa170c901e77712e707e3c45fd9b9f6dd10e42efcbbdaed9f46
Instruction Fuzzy Hash: 8851E2B0A04B05DBDB249FB9DC846AE77F1AF40322F248739F825972D2D7709D548B48

Function 000269CA Relevance: 7.3, APIs: 2, Strings: 2, Instructions: 260COMMON

Download Yara Rule

APIs

Part of subcall function 00024F3D: LoadLibraryExW.KERNELBASE(?,00000000,00000002,?,000E62F8,00000001,>>>AUTOIT NO CMDEXECUTE<<<,?), ref: 00024F6F

_free.LIBCMT ref: 0005E68C
_free.LIBCMT ref: 0005E6D3

Part of subcall function 00026BEC: SetCurrentDirectoryW.KERNEL32(?,?,?,?,00000000), ref: 00026D0D

Strings

Bad directive syntax error, xrefs: 0005E6BB
>>>AUTOIT SCRIPT<<<, xrefs: 0005E462

Memory Dump Source

Source File: 00000000.00000002.1643917647.0000000000021000.00000020.00000001.01000000.00000003.sdmp, Offset: 00020000, based on PE: true

Associated: 00000000.00000002.1643904003.0000000000020000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1643958107.00000000000AF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1643958107.00000000000D5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1643993044.00000000000DF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1644007204.00000000000E8000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_20000_Ship Docs_CI PL HBL COO_.jbxd

Similarity

API ID: _free$CurrentDirectoryLibraryLoad
String ID: >>>AUTOIT SCRIPT<<<$Bad directive syntax error
API String ID: 2861923089-1757145024
Opcode ID: 21a6dcb5e6cf501f5a746cdb3351622ce5955d91a5bd8b1a4ca845fb2277c4e5
Instruction ID: 2fc4b74c3b20a350c3dc7777fef10cd1990e52237e1a8354c086ccaab2d747f3
Opcode Fuzzy Hash: 21a6dcb5e6cf501f5a746cdb3351622ce5955d91a5bd8b1a4ca845fb2277c4e5
Instruction Fuzzy Hash: F791B171910269DFCF18EFA4DC919EEB7B4FF14341F14446AF855AB292EB309A08CB50

Function 000235B0 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 59registryCOMMON

Download Yara Rule

APIs

RegOpenKeyExW.KERNELBASE(80000001,Control Panel\Mouse,00000000,00000001,00000000,00000003,00000000,80000001,80000001,?,000235A1,SwapMouseButtons,00000004,?), ref: 000235D4
RegQueryValueExW.KERNELBASE(00000000,00000000,00000000,00000000,?,?,?,?,000235A1,SwapMouseButtons,00000004,?,?,?,?,00022754), ref: 000235F5
RegCloseKey.KERNELBASE(00000000,?,?,000235A1,SwapMouseButtons,00000004,?,?,?,?,00022754), ref: 00023617

Strings

Control Panel\Mouse, xrefs: 000235D2

Memory Dump Source

Source File: 00000000.00000002.1643917647.0000000000021000.00000020.00000001.01000000.00000003.sdmp, Offset: 00020000, based on PE: true

Associated: 00000000.00000002.1643904003.0000000000020000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1643958107.00000000000AF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1643958107.00000000000D5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1643993044.00000000000DF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1644007204.00000000000E8000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_20000_Ship Docs_CI PL HBL COO_.jbxd

Similarity

API ID: CloseOpenQueryValue
String ID: Control Panel\Mouse
API String ID: 3677997916-824357125
Opcode ID: 60ab174540a16fe49397fc72fc2c66fb50e00f91c29c2cdf9218df420558102a
Instruction ID: 2a3ce3604dea90835735dd5e1ef2260aded0f389bc41fd8f90bcc676488f8170
Opcode Fuzzy Hash: 60ab174540a16fe49397fc72fc2c66fb50e00f91c29c2cdf9218df420558102a
Instruction Fuzzy Hash: 59111875611228BFDB208FA4EC48EBFB7BCEF05740F118569E805D7210E6759E509B64

Function 019D12A0 Relevance: 6.7, APIs: 4, Instructions: 720processthreadCOMMON

Download Yara Rule

APIs

CreateProcessW.KERNELBASE(?,00000000), ref: 019D1ACD
Wow64GetThreadContext.KERNEL32(?,00010007), ref: 019D1AF1
ReadProcessMemory.KERNELBASE(?,?,?,00000004,00000000), ref: 019D1B13

Memory Dump Source

Source File: 00000000.00000002.1644337710.00000000019D0000.00000040.00001000.00020000.00000000.sdmp, Offset: 019D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_19d0000_Ship Docs_CI PL HBL COO_.jbxd

Similarity

API ID: Process$ContextCreateMemoryReadThreadWow64
String ID:
API String ID: 2438371351-0
Opcode ID: a5f8eca76df1c4d60a387bf050efe929c827b8bdc82418feca4108ede207e1c1
Instruction ID: 72fffca5cbc701ea7d581e42fe9d743de2e260a9932123e3c02b71e0329868cb
Opcode Fuzzy Hash: a5f8eca76df1c4d60a387bf050efe929c827b8bdc82418feca4108ede207e1c1
Instruction Fuzzy Hash: BA621B30A14258DBEB24CFA4C840BDEB776EF58301F1095A9D20DEB394E7799E81CB59

Function 000897E5 Relevance: 6.2, APIs: 4, Instructions: 155COMMON

Download Yara Rule

APIs

Part of subcall function 00025045: _fseek.LIBCMT ref: 0002505D

Part of subcall function 000899BE: _wcscmp.LIBCMT ref: 00089AAE
Part of subcall function 000899BE: _wcscmp.LIBCMT ref: 00089AC1

_free.LIBCMT ref: 0008992C
_free.LIBCMT ref: 00089933
_free.LIBCMT ref: 0008999E

Part of subcall function 00042F95: RtlFreeHeap.NTDLL(00000000,00000000,?,00049C64), ref: 00042FA9
Part of subcall function 00042F95: GetLastError.KERNEL32(00000000,?,00049C64), ref: 00042FBB

_free.LIBCMT ref: 000899A6

Memory Dump Source

Source File: 00000000.00000002.1643917647.0000000000021000.00000020.00000001.01000000.00000003.sdmp, Offset: 00020000, based on PE: true

Associated: 00000000.00000002.1643904003.0000000000020000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1643958107.00000000000AF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1643958107.00000000000D5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1643993044.00000000000DF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1644007204.00000000000E8000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_20000_Ship Docs_CI PL HBL COO_.jbxd

Similarity

API ID: _free$_wcscmp$ErrorFreeHeapLast_fseek
String ID:
API String ID: 1552873950-0
Opcode ID: c040f5d591410a8d3afab51092a26b6f5939c84b98243336257d617f1f09bfd3
Instruction ID: 8c593ef4fb99951ba123fb449e8a44f0d00410e353378d04e9272da64c0c1e7e
Opcode Fuzzy Hash: c040f5d591410a8d3afab51092a26b6f5939c84b98243336257d617f1f09bfd3
Instruction Fuzzy Hash: D2513FF1904218AFDF249F64DC81AEEBBB9FF48310F1444AEF649A7242DB7159908F58

Function 0004493A Relevance: 6.1, APIs: 4, Instructions: 136COMMON

Download Yara Rule

APIs

_memmove.LIBCMT ref: 000449D0
__flush.LIBCMT ref: 000449F0
__write.LIBCMT ref: 00044A23
__flsbuf.LIBCMT ref: 00044A51

Part of subcall function 00048D68: __getptd_noexit.LIBCMT ref: 00048D68

Memory Dump Source

Source File: 00000000.00000002.1643917647.0000000000021000.00000020.00000001.01000000.00000003.sdmp, Offset: 00020000, based on PE: true

Associated: 00000000.00000002.1643904003.0000000000020000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1643958107.00000000000AF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1643958107.00000000000D5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1643993044.00000000000DF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1644007204.00000000000E8000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_20000_Ship Docs_CI PL HBL COO_.jbxd

Similarity

API ID: __flsbuf__flush__getptd_noexit__write_memmove
String ID:
API String ID: 2782032738-0
Opcode ID: 6b900c82ae833c016f0ad4fafe5841f230cacf6ecaddb2f96621bb99e00bcb06
Instruction ID: e12ee50f043c9e9a44681a69de29f68d42b45efa3ffa5f5ffaf9ff0b2a848e73
Opcode Fuzzy Hash: 6b900c82ae833c016f0ad4fafe5841f230cacf6ecaddb2f96621bb99e00bcb06
Instruction Fuzzy Hash: DB41D3F1A00606ABDF28CEA9C884BAF77E6EF80360B24853DE855C7680D770DD509B4D

Function 000273E5 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 65COMMON

Download Yara Rule

APIs

_memset.LIBCMT ref: 0005EE62
GetOpenFileNameW.COMDLG32(?), ref: 0005EEAC

Part of subcall function 000248AE: GetFullPathNameW.KERNEL32(?,00007FFF,?,00000000,?,?,000248A1,?,?,000237C0,?), ref: 000248CE

Part of subcall function 000409D5: GetLongPathNameW.KERNELBASE(?,?,00007FFF), ref: 000409F4

Strings

X, xrefs: 0005EE7A

Memory Dump Source

Source File: 00000000.00000002.1643917647.0000000000021000.00000020.00000001.01000000.00000003.sdmp, Offset: 00020000, based on PE: true

Associated: 00000000.00000002.1643904003.0000000000020000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1643958107.00000000000AF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1643958107.00000000000D5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1643993044.00000000000DF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1644007204.00000000000E8000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_20000_Ship Docs_CI PL HBL COO_.jbxd

Similarity

API ID: Name$Path$FileFullLongOpen_memset
String ID: X
API String ID: 3777226403-3081909835
Opcode ID: e8c96d8ea31d0f5d4acdc7c0e1c059b85391df8a04d17eaac3868e3f91c2dcc0
Instruction ID: 02e556ca10aeaaae3fb07c1ccf0eedfc05cdfdb6954dddc74ea3283f2fb3e2ee
Opcode Fuzzy Hash: e8c96d8ea31d0f5d4acdc7c0e1c059b85391df8a04d17eaac3868e3f91c2dcc0
Instruction Fuzzy Hash: C221C371A102989BDB55DF94D845BEE7BFC9F49300F00405AE908F7282DBB85A898BA1

Function 0008901B Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 51COMMON

Download Yara Rule

APIs

_memmove.LIBCMT ref: 00089036
__fread_nolock.LIBCMT ref: 0008904B

Strings

EA06, xrefs: 0008907D

Memory Dump Source

Source File: 00000000.00000002.1643917647.0000000000021000.00000020.00000001.01000000.00000003.sdmp, Offset: 00020000, based on PE: true

Associated: 00000000.00000002.1643904003.0000000000020000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1643958107.00000000000AF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1643958107.00000000000D5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1643993044.00000000000DF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1644007204.00000000000E8000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_20000_Ship Docs_CI PL HBL COO_.jbxd

Similarity

API ID: __fread_nolock_memmove
String ID: EA06
API String ID: 1988441806-3962188686
Opcode ID: 254d2bdf3e9bf87b477a30e76ade45ec2894836563825223bdce9475969bac85
Instruction ID: f5fb6d1418874d31f2b3de37a0b9c171e8def88431bb96997b8c9f98f85060e2
Opcode Fuzzy Hash: 254d2bdf3e9bf87b477a30e76ade45ec2894836563825223bdce9475969bac85
Instruction Fuzzy Hash: 3801F9719042186EDB28D6A8CC16EFE7BF89B01301F00419EF592D2182E9B5A604CB60

Function 00089B6D Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 16COMMON

Download Yara Rule

APIs

GetTempPathW.KERNEL32(00000104,?), ref: 00089B82
GetTempFileNameW.KERNELBASE(?,aut,00000000,?), ref: 00089B99

Strings

aut, xrefs: 00089B93

Memory Dump Source

Source File: 00000000.00000002.1643917647.0000000000021000.00000020.00000001.01000000.00000003.sdmp, Offset: 00020000, based on PE: true

Associated: 00000000.00000002.1643904003.0000000000020000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1643958107.00000000000AF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1643958107.00000000000D5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1643993044.00000000000DF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1644007204.00000000000E8000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_20000_Ship Docs_CI PL HBL COO_.jbxd

Similarity

API ID: Temp$FileNamePath
String ID: aut
API String ID: 3285503233-3010740371
Opcode ID: 880c391208979aa3ba5b5ca3a82d5e2d9c0c898186bfa4f7fa4238b01f47bf79
Instruction ID: c71dd691fc4de41933d8e580dbb6fc8d9ea24c0b57a8bd144be16adc8777a3de
Opcode Fuzzy Hash: 880c391208979aa3ba5b5ca3a82d5e2d9c0c898186bfa4f7fa4238b01f47bf79
Instruction Fuzzy Hash: DFD05E7954030EABEB109BD0DC0EFEA772CEB45701F0042A1BF94951A1DEB855988BA1

Function 0009CDF1 Relevance: 4.9, APIs: 3, Instructions: 392COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1643917647.0000000000021000.00000020.00000001.01000000.00000003.sdmp, Offset: 00020000, based on PE: true

Associated: 00000000.00000002.1643904003.0000000000020000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1643958107.00000000000AF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1643958107.00000000000D5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1643993044.00000000000DF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1644007204.00000000000E8000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_20000_Ship Docs_CI PL HBL COO_.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: bc4a300089c8c9b0555250ed79b00feeddd1f7ff509c4dba5b8f5f319e77763e
Instruction ID: 26fbcd88bd33700271bec33531e56c0b70d0f60f9d154bcc900a28bfdef079a0
Opcode Fuzzy Hash: bc4a300089c8c9b0555250ed79b00feeddd1f7ff509c4dba5b8f5f319e77763e
Instruction Fuzzy Hash: CFF13971A083019FCB14DF28C485A6ABBE5FF88314F54892EF8999B352D731E945CF82

Function 0002F8CF Relevance: 4.7, APIs: 3, Instructions: 168comCOMMON

Download Yara Rule

APIs

Part of subcall function 000403A2: MapVirtualKeyW.USER32(0000005B,00000000), ref: 000403D3
Part of subcall function 000403A2: MapVirtualKeyW.USER32(00000010,00000000), ref: 000403DB
Part of subcall function 000403A2: MapVirtualKeyW.USER32(000000A0,00000000), ref: 000403E6
Part of subcall function 000403A2: MapVirtualKeyW.USER32(000000A1,00000000), ref: 000403F1
Part of subcall function 000403A2: MapVirtualKeyW.USER32(00000011,00000000), ref: 000403F9
Part of subcall function 000403A2: MapVirtualKeyW.USER32(00000012,00000000), ref: 00040401

Part of subcall function 00036259: RegisterWindowMessageW.USER32(WM_GETCONTROLNAME,?,0002FA90), ref: 000362B4

GetStdHandle.KERNEL32(000000F6,00000000,00000000), ref: 0002FB2D
OleInitialize.OLE32(00000000), ref: 0002FBAA
CloseHandle.KERNEL32(00000000), ref: 000649F2

Memory Dump Source

Source File: 00000000.00000002.1643917647.0000000000021000.00000020.00000001.01000000.00000003.sdmp, Offset: 00020000, based on PE: true

Associated: 00000000.00000002.1643904003.0000000000020000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1643958107.00000000000AF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1643958107.00000000000D5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1643993044.00000000000DF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1644007204.00000000000E8000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_20000_Ship Docs_CI PL HBL COO_.jbxd

Similarity

API ID: Virtual$Handle$CloseInitializeMessageRegisterWindow
String ID:
API String ID: 1986988660-0
Opcode ID: 3f8bdb2257285280c295ef3f1aad704040a95c522cb92188e1bab6f925c6f4bf
Instruction ID: 32ab0b072173ded55667d691266c08d45d0ffb2de63607f14b40a8bd9148ef59
Opcode Fuzzy Hash: 3f8bdb2257285280c295ef3f1aad704040a95c522cb92188e1bab6f925c6f4bf
Instruction Fuzzy Hash: C481DBF09052D18EE385DF7AF8906957AE4FBB8B94710813AD019EB2A2EB3F4504CF51

Function 000243DB Relevance: 4.6, APIs: 3, Instructions: 77windowCOMMON

Download Yara Rule

APIs

_memset.LIBCMT ref: 00024401
Shell_NotifyIconW.SHELL32(00000000,?), ref: 000244A6
Shell_NotifyIconW.SHELL32(00000001,?), ref: 000244C3

Memory Dump Source

Source File: 00000000.00000002.1643917647.0000000000021000.00000020.00000001.01000000.00000003.sdmp, Offset: 00020000, based on PE: true

Associated: 00000000.00000002.1643904003.0000000000020000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1643958107.00000000000AF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1643958107.00000000000D5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1643993044.00000000000DF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1644007204.00000000000E8000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_20000_Ship Docs_CI PL HBL COO_.jbxd

Similarity

API ID: IconNotifyShell_$_memset
String ID:
API String ID: 1505330794-0
Opcode ID: 42887fa617d3d146dbea65977506490b502c681ff78640f9f20c9ed766e3d43c
Instruction ID: 6561a473293567855f7a92b5776ec27ded136e4046681df77e7c85c7be53f9c0
Opcode Fuzzy Hash: 42887fa617d3d146dbea65977506490b502c681ff78640f9f20c9ed766e3d43c
Instruction Fuzzy Hash: DA31A2B05047518FD760EF34E88479BBBF8FB59708F00092EF69A97241D7B5A948CB92

Function 0004594C Relevance: 4.6, APIs: 3, Instructions: 59memoryCOMMONLIBRARYCODE

Download Yara Rule

APIs

__FF_MSGBANNER.LIBCMT ref: 00045963

Part of subcall function 0004A3AB: __NMSG_WRITE.LIBCMT ref: 0004A3D2
Part of subcall function 0004A3AB: __NMSG_WRITE.LIBCMT ref: 0004A3DC

__NMSG_WRITE.LIBCMT ref: 0004596A

Part of subcall function 0004A408: GetModuleFileNameW.KERNEL32(00000000,000E43BA,00000104,?,00000001,00000000), ref: 0004A49A
Part of subcall function 0004A408: ___crtMessageBoxW.LIBCMT ref: 0004A548

Part of subcall function 000432DF: ___crtCorExitProcess.LIBCMT ref: 000432E5
Part of subcall function 000432DF: ExitProcess.KERNEL32 ref: 000432EE

Part of subcall function 00048D68: __getptd_noexit.LIBCMT ref: 00048D68

RtlAllocateHeap.NTDLL(00C20000,00000000,00000001,00000000,?,?,?,00041013,?), ref: 0004598F

Memory Dump Source

Source File: 00000000.00000002.1643917647.0000000000021000.00000020.00000001.01000000.00000003.sdmp, Offset: 00020000, based on PE: true

Associated: 00000000.00000002.1643904003.0000000000020000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1643958107.00000000000AF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1643958107.00000000000D5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1643993044.00000000000DF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1644007204.00000000000E8000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_20000_Ship Docs_CI PL HBL COO_.jbxd

Similarity

API ID: ExitProcess___crt$AllocateFileHeapMessageModuleName__getptd_noexit
String ID:
API String ID: 1372826849-0
Opcode ID: ac9c1c99020ad6e4aaebe3e892c3b3289d1262d82e5b315503fe8404252c274f
Instruction ID: 40a85d6e2f264524537eaa79ed0b49c66f188ba51f2a66a7dbbb5aeb6baa0fb1
Opcode Fuzzy Hash: ac9c1c99020ad6e4aaebe3e892c3b3289d1262d82e5b315503fe8404252c274f
Instruction Fuzzy Hash: 1101F5B1741B15EFE6213B65EC42AAE73889F42B72F10003AF500AA1C3EE709D01876C

Function 00089B2C Relevance: 4.5, APIs: 3, Instructions: 24filetimeCOMMON

Download Yara Rule

APIs

CreateFileW.KERNELBASE(?,40000000,00000001,00000000,00000003,00000080,00000000,?,?,000897D2,?,?,?,?,?,00000004), ref: 00089B45
SetFileTime.KERNELBASE(00000000,?,00000000,?,?,000897D2,?,?,?,?,?,00000004,00000001,?,?,00000004), ref: 00089B5B
CloseHandle.KERNEL32(00000000,?,000897D2,?,?,?,?,?,00000004,00000001,?,?,00000004,00000001,?,?), ref: 00089B62

Memory Dump Source

Source File: 00000000.00000002.1643917647.0000000000021000.00000020.00000001.01000000.00000003.sdmp, Offset: 00020000, based on PE: true

Associated: 00000000.00000002.1643904003.0000000000020000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1643958107.00000000000AF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1643958107.00000000000D5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1643993044.00000000000DF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1644007204.00000000000E8000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_20000_Ship Docs_CI PL HBL COO_.jbxd

Similarity

API ID: File$CloseCreateHandleTime
String ID:
API String ID: 3397143404-0
Opcode ID: 1eb6199764db9ca3ee88c54aad16e40df1a57ec20438aa024c2ea35fd48f62f0
Instruction ID: 7ab24c73deee24441b275d1e452b6ddda1fe9ba6c4d22d2738be51329290402d
Opcode Fuzzy Hash: 1eb6199764db9ca3ee88c54aad16e40df1a57ec20438aa024c2ea35fd48f62f0
Instruction Fuzzy Hash: 6CE08632280615BBEB312B94EC09FEA7B58AB06761F144120FB54690E087B566119798

Function 00088F97 Relevance: 4.5, APIs: 3, Instructions: 22COMMON

Download Yara Rule

APIs

_free.LIBCMT ref: 00088FA5

Part of subcall function 00042F95: RtlFreeHeap.NTDLL(00000000,00000000,?,00049C64), ref: 00042FA9
Part of subcall function 00042F95: GetLastError.KERNEL32(00000000,?,00049C64), ref: 00042FBB

_free.LIBCMT ref: 00088FB6
_free.LIBCMT ref: 00088FC8

Memory Dump Source

Source File: 00000000.00000002.1643917647.0000000000021000.00000020.00000001.01000000.00000003.sdmp, Offset: 00020000, based on PE: true

Associated: 00000000.00000002.1643904003.0000000000020000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1643958107.00000000000AF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1643958107.00000000000D5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1643993044.00000000000DF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1644007204.00000000000E8000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_20000_Ship Docs_CI PL HBL COO_.jbxd

Similarity

API ID: _free$ErrorFreeHeapLast
String ID:
API String ID: 776569668-0
Opcode ID: 358057a8cee776a4634d1da6a11f7167cf7af4a4bc472a0de26b354d0d310ced
Instruction ID: d736c901bb6f7e37f689c77202147aeb030f0280d9fbfcd8b94b5e7b2cba55c2
Opcode Fuzzy Hash: 358057a8cee776a4634d1da6a11f7167cf7af4a4bc472a0de26b354d0d310ced
Instruction Fuzzy Hash: 61E012E17097114ACA64B578AD40BD35BEE6F483A07D8083DB549DB143DE24F8858728

Function 0002AB23 Relevance: 4.0, APIs: 1, Strings: 1, Instructions: 534COMMON

Download Yara Rule

Strings

CALL, xrefs: 0006002B

Memory Dump Source

Source File: 00000000.00000002.1643917647.0000000000021000.00000020.00000001.01000000.00000003.sdmp, Offset: 00020000, based on PE: true

Associated: 00000000.00000002.1643904003.0000000000020000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1643958107.00000000000AF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1643958107.00000000000D5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1643993044.00000000000DF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1644007204.00000000000E8000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_20000_Ship Docs_CI PL HBL COO_.jbxd

Similarity

API ID:
String ID: CALL
API String ID: 0-4196123274
Opcode ID: 049dbab4a8d7d7aaa7ba6857160d7ff219e2ea6c119d5685f74e183771ea807d
Instruction ID: 0e126c309daba177ad1ec42b7c76e4fb1d5347b0fefc591a437cb813fe891145
Opcode Fuzzy Hash: 049dbab4a8d7d7aaa7ba6857160d7ff219e2ea6c119d5685f74e183771ea807d
Instruction Fuzzy Hash: DF225B70608351CFDB24DF14D494B6ABBE1BF85300F15896DE88A9B362DB35ED85CB82

Function 00024DD0 Relevance: 3.6, APIs: 1, Strings: 1, Instructions: 141COMMON

Download Yara Rule

APIs

_memmove.LIBCMT ref: 00024E1A

Strings

EA06, xrefs: 0005DCF5

Memory Dump Source

Source File: 00000000.00000002.1643917647.0000000000021000.00000020.00000001.01000000.00000003.sdmp, Offset: 00020000, based on PE: true

Associated: 00000000.00000002.1643904003.0000000000020000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1643958107.00000000000AF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1643958107.00000000000D5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1643993044.00000000000DF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1644007204.00000000000E8000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_20000_Ship Docs_CI PL HBL COO_.jbxd

Similarity

API ID: _memmove
String ID: EA06
API String ID: 4104443479-3962188686
Opcode ID: 15d52919bc02baf68a7f3742adddabf4ee6c9fd2da86ac2f1d366466366c5b01
Instruction ID: ed06e0fbca534421f62c7a27046e8a159b06602bd0f175e9a1603cbb5a6a97b5
Opcode Fuzzy Hash: 15d52919bc02baf68a7f3742adddabf4ee6c9fd2da86ac2f1d366466366c5b01
Instruction Fuzzy Hash: 15417A71A041745BEF319B64EC917FE7FA6AB45300F694075EC829B283C6719D8487A1

Function 0002492E Relevance: 3.1, APIs: 2, Instructions: 59COMMON

Download Yara Rule

APIs

IsThemeActive.UXTHEME ref: 00024992

Part of subcall function 000435AC: __lock.LIBCMT ref: 000435B2
Part of subcall function 000435AC: DecodePointer.KERNEL32(00000001,?,000249A7,000781BC), ref: 000435BE
Part of subcall function 000435AC: EncodePointer.KERNEL32(?,?,000249A7,000781BC), ref: 000435C9

Part of subcall function 00024A5B: SystemParametersInfoW.USER32(00002000,00000000,?,00000000), ref: 00024A73
Part of subcall function 00024A5B: SystemParametersInfoW.USER32(00002001,00000000,00000000,00000002), ref: 00024A88

Part of subcall function 00023B4C: GetCurrentDirectoryW.KERNEL32(00007FFF,?), ref: 00023B7A
Part of subcall function 00023B4C: IsDebuggerPresent.KERNEL32 ref: 00023B8C
Part of subcall function 00023B4C: GetFullPathNameW.KERNEL32(00007FFF,?,?,000E62F8,000E62E0,?,?), ref: 00023BFD
Part of subcall function 00023B4C: SetCurrentDirectoryW.KERNEL32(?), ref: 00023C81

SystemParametersInfoW.USER32(00002001,00000000,00000000,00000002), ref: 000249D2

Memory Dump Source

Source File: 00000000.00000002.1643917647.0000000000021000.00000020.00000001.01000000.00000003.sdmp, Offset: 00020000, based on PE: true

Associated: 00000000.00000002.1643904003.0000000000020000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1643958107.00000000000AF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1643958107.00000000000D5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1643993044.00000000000DF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1644007204.00000000000E8000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_20000_Ship Docs_CI PL HBL COO_.jbxd

Similarity

API ID: InfoParametersSystem$CurrentDirectoryPointer$ActiveDebuggerDecodeEncodeFullNamePathPresentTheme__lock
String ID:
API String ID: 1438897964-0
Opcode ID: 6bdec02011c0928c1eb40ff61d92b0193f559ee406c98d0b6c8a1f3f272e363b
Instruction ID: dc19a1e4d2c49ecf8f6a205274cdeec5e30e14de58dd3c342a9901f83155f0ca
Opcode Fuzzy Hash: 6bdec02011c0928c1eb40ff61d92b0193f559ee406c98d0b6c8a1f3f272e363b
Instruction Fuzzy Hash: 3311CDB19083619BD300EF28EC8594AFFF8EB94B50F00851EF5449B2B2DB759544CB96

Function 00025DF9 Relevance: 3.1, APIs: 2, Instructions: 57fileCOMMON

Download Yara Rule

APIs

CreateFileW.KERNELBASE(?,80000000,00000007,00000000,00000003,00000080,00000000,?,00000000,?,00025981,?,?,?,?), ref: 00025E27
CreateFileW.KERNEL32(?,C0000000,00000007,00000000,00000004,00000080,00000000,?,00000000,?,00025981,?,?,?,?), ref: 0005E19C

Memory Dump Source

Source File: 00000000.00000002.1643917647.0000000000021000.00000020.00000001.01000000.00000003.sdmp, Offset: 00020000, based on PE: true

Associated: 00000000.00000002.1643904003.0000000000020000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1643958107.00000000000AF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1643958107.00000000000D5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1643993044.00000000000DF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1644007204.00000000000E8000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_20000_Ship Docs_CI PL HBL COO_.jbxd

Similarity

API ID: CreateFile
String ID:
API String ID: 823142352-0
Opcode ID: 10df8d0295379612b80bc253892bcbcfbe6adfe2a309bf545e829540192812a3
Instruction ID: 35dd566cbc2ccee96e7f4918cd16c242557073fba6dd88f69aaa6c25913f6146
Opcode Fuzzy Hash: 10df8d0295379612b80bc253892bcbcfbe6adfe2a309bf545e829540192812a3
Instruction Fuzzy Hash: 2301B570244718BEF7780E24DC8AF763BDCEB01769F108318BEE55A1E0C6B45E498B58

Function 00040FF6 Relevance: 3.0, APIs: 2, Instructions: 44COMMONLIBRARYCODE

Download Yara Rule

APIs

Part of subcall function 0004594C: __FF_MSGBANNER.LIBCMT ref: 00045963
Part of subcall function 0004594C: __NMSG_WRITE.LIBCMT ref: 0004596A
Part of subcall function 0004594C: RtlAllocateHeap.NTDLL(00C20000,00000000,00000001,00000000,?,?,?,00041013,?), ref: 0004598F

std::exception::exception.LIBCMT ref: 0004102C
__CxxThrowException@8.LIBCMT ref: 00041041

Part of subcall function 000487DB: RaiseException.KERNEL32(?,?,?,000DBAF8,00000000,?,?,?,?,00041046,?,000DBAF8,?,00000001), ref: 00048830

Memory Dump Source

Source File: 00000000.00000002.1643917647.0000000000021000.00000020.00000001.01000000.00000003.sdmp, Offset: 00020000, based on PE: true

Associated: 00000000.00000002.1643904003.0000000000020000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1643958107.00000000000AF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1643958107.00000000000D5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1643993044.00000000000DF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1644007204.00000000000E8000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_20000_Ship Docs_CI PL HBL COO_.jbxd

Similarity

API ID: AllocateExceptionException@8HeapRaiseThrowstd::exception::exception
String ID:
API String ID: 3902256705-0
Opcode ID: 52f2a1ad6c4a21fb0246a9b76b5c717d342c535820f37182bd029f463e2bf5ff
Instruction ID: cdea33f764125e8bad43f57dc884dca6850ddd28be75fa450b6fea1209c3a8ec
Opcode Fuzzy Hash: 52f2a1ad6c4a21fb0246a9b76b5c717d342c535820f37182bd029f463e2bf5ff
Instruction Fuzzy Hash: 76F0A4B5504219A6CB20BA58EC159DF7BE89F01351F104836F904A6693DFB1CAD082A9

Function 0004582D Relevance: 3.0, APIs: 2, Instructions: 42COMMONLIBRARYCODE

Download Yara Rule

APIs

_memset.LIBCMT ref: 0004585C
__lock_file.LIBCMT ref: 0004587D

Memory Dump Source

Source File: 00000000.00000002.1643917647.0000000000021000.00000020.00000001.01000000.00000003.sdmp, Offset: 00020000, based on PE: true

Associated: 00000000.00000002.1643904003.0000000000020000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1643958107.00000000000AF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1643958107.00000000000D5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1643993044.00000000000DF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1644007204.00000000000E8000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_20000_Ship Docs_CI PL HBL COO_.jbxd

Similarity

API ID: __lock_file_memset
String ID:
API String ID: 26237723-0
Opcode ID: 711f06b039057e10f3e73c39641f26b83c8f1c77ce958a8fcb8cb7cfcdaf36b1
Instruction ID: 32ac9f1535a8619cd9ce4248ccb2bfd0c60e4dd41a9183b73582265bbea134ea
Opcode Fuzzy Hash: 711f06b039057e10f3e73c39641f26b83c8f1c77ce958a8fcb8cb7cfcdaf36b1
Instruction Fuzzy Hash: 8101A7F1C00608EBCF22AF698C065DF7BA1AF45361F148239F8146B1A3DF318A11DB99

Function 000455D6 Relevance: 3.0, APIs: 2, Instructions: 33COMMONLIBRARYCODE

Download Yara Rule

APIs

Part of subcall function 00048D68: __getptd_noexit.LIBCMT ref: 00048D68

__lock_file.LIBCMT ref: 0004561B

Part of subcall function 00046E4E: __lock.LIBCMT ref: 00046E71

__fclose_nolock.LIBCMT ref: 00045626

Memory Dump Source

Source File: 00000000.00000002.1643917647.0000000000021000.00000020.00000001.01000000.00000003.sdmp, Offset: 00020000, based on PE: true

Associated: 00000000.00000002.1643904003.0000000000020000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1643958107.00000000000AF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1643958107.00000000000D5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1643993044.00000000000DF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1644007204.00000000000E8000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_20000_Ship Docs_CI PL HBL COO_.jbxd

Similarity

API ID: __fclose_nolock__getptd_noexit__lock__lock_file
String ID:
API String ID: 2800547568-0
Opcode ID: e9b99a39175f8ef581ac9388580d97e33a7b356bc6b7f129e94c93986b5ba567
Instruction ID: f381c4fd21ba481f6cd3f21596a2b2107950b429ad9c5552fb7bc7e9e391e9d1
Opcode Fuzzy Hash: e9b99a39175f8ef581ac9388580d97e33a7b356bc6b7f129e94c93986b5ba567
Instruction Fuzzy Hash: FAF090F1801A049BDB20BB758C027AE77E16F41736F568629A414AB1C3CF7C89019B9D

Function 019D129D Relevance: 1.9, APIs: 1, Instructions: 400processthreadCOMMON

Download Yara Rule

APIs

CreateProcessW.KERNELBASE(?,00000000), ref: 019D1ACD
Wow64GetThreadContext.KERNEL32(?,00010007), ref: 019D1AF1
ReadProcessMemory.KERNELBASE(?,?,?,00000004,00000000), ref: 019D1B13

Memory Dump Source

Source File: 00000000.00000002.1644337710.00000000019D0000.00000040.00001000.00020000.00000000.sdmp, Offset: 019D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_19d0000_Ship Docs_CI PL HBL COO_.jbxd

Similarity

API ID: Process$ContextCreateMemoryReadThreadWow64
String ID:
API String ID: 2438371351-0
Opcode ID: 6ff7500a3617197a005732162d507dd4d37460c8dcbf147a4ae2be43d63b6423
Instruction ID: 48de49d331c03a124325469c9b81798736bdd9b11436806bc038f3cff0401b86
Opcode Fuzzy Hash: 6ff7500a3617197a005732162d507dd4d37460c8dcbf147a4ae2be43d63b6423
Instruction Fuzzy Hash: 7512DE24E24658C6EB24DF64D8507DEB232EF68300F1094E9910DEB7A5E77A4F81CB5A

Function 00032123 Relevance: 1.7, APIs: 1, Instructions: 171COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1643917647.0000000000021000.00000020.00000001.01000000.00000003.sdmp, Offset: 00020000, based on PE: true

Associated: 00000000.00000002.1643904003.0000000000020000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1643958107.00000000000AF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1643958107.00000000000D5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1643993044.00000000000DF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1644007204.00000000000E8000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_20000_Ship Docs_CI PL HBL COO_.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 21a507151cf5eb0eef120083b262194b3b12adc85d8695d17d95972d084ad095
Instruction ID: 26e842c3c0d9cb6337b304d63b4ecebbf59a5e58262e8c5c20849554f2831b0a
Opcode Fuzzy Hash: 21a507151cf5eb0eef120083b262194b3b12adc85d8695d17d95972d084ad095
Instruction Fuzzy Hash: 0B517035600614AFCF15EBA4DD92EBE77EAAF45310F148168F946AB293CB31ED00CB55

Function 00025C4E Relevance: 1.6, APIs: 1, Instructions: 97COMMON

Download Yara Rule

APIs

SetFilePointerEx.KERNELBASE(?,?,00000001,00000000,00000000,?,?,00000000), ref: 00025CF6

Memory Dump Source

Source File: 00000000.00000002.1643917647.0000000000021000.00000020.00000001.01000000.00000003.sdmp, Offset: 00020000, based on PE: true

Associated: 00000000.00000002.1643904003.0000000000020000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1643958107.00000000000AF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1643958107.00000000000D5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1643993044.00000000000DF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1644007204.00000000000E8000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_20000_Ship Docs_CI PL HBL COO_.jbxd

Similarity

API ID: FilePointer
String ID:
API String ID: 973152223-0
Opcode ID: 8e2a7be4822e8276d8d9566bf89b691cee0910a9ba7054b668bc5c58e4691169
Instruction ID: 756d94ade12aa60c8aab54fe40feec9ff2f19e31a07a32465804a023b7511dcd
Opcode Fuzzy Hash: 8e2a7be4822e8276d8d9566bf89b691cee0910a9ba7054b668bc5c58e4691169
Instruction Fuzzy Hash: 45316E71A00B29AFCB18CF2DD8846ADB7B5FF48311F248629D81993710E731BD50DB94

Function 000600D6 Relevance: 1.6, APIs: 1, Instructions: 88COMMON

Download Yara Rule

APIs

VariantClear.OLEAUT32 ref: 000600E1

Memory Dump Source

Source File: 00000000.00000002.1643917647.0000000000021000.00000020.00000001.01000000.00000003.sdmp, Offset: 00020000, based on PE: true

Associated: 00000000.00000002.1643904003.0000000000020000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1643958107.00000000000AF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1643958107.00000000000D5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1643993044.00000000000DF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1644007204.00000000000E8000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_20000_Ship Docs_CI PL HBL COO_.jbxd

Similarity

API ID: ClearVariant
String ID:
API String ID: 1473721057-0
Opcode ID: 8c9b10ce512e31cdb1c3e2bd4210dacc05d63f489cd288033dd3fcfa812d8579
Instruction ID: 2e2c600c177a78dbaab6f0ba2389bd1ab84d5dadefad3ad3daee7772dc442785
Opcode Fuzzy Hash: 8c9b10ce512e31cdb1c3e2bd4210dacc05d63f489cd288033dd3fcfa812d8579
Instruction Fuzzy Hash: 0B412C74604351CFDB24DF14C484B5ABBE1BF45314F1988ACE8898B762C776EC85CB52

Function 000280D7 Relevance: 1.6, APIs: 1, Instructions: 64COMMON

Download Yara Rule

APIs

_memmove.LIBCMT ref: 00028109

Memory Dump Source

Source File: 00000000.00000002.1643917647.0000000000021000.00000020.00000001.01000000.00000003.sdmp, Offset: 00020000, based on PE: true

Associated: 00000000.00000002.1643904003.0000000000020000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1643958107.00000000000AF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1643958107.00000000000D5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1643993044.00000000000DF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1644007204.00000000000E8000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_20000_Ship Docs_CI PL HBL COO_.jbxd

Similarity

API ID: _memmove
String ID:
API String ID: 4104443479-0
Opcode ID: 46acc021f7701719685bd31058d1bf319928b5265fe0d6ec76a5632e42df60c5
Instruction ID: a0845e8a4efa97620768c69cc371120e5141c2fdd3b06eaf004501e9d665a7bf
Opcode Fuzzy Hash: 46acc021f7701719685bd31058d1bf319928b5265fe0d6ec76a5632e42df60c5
Instruction Fuzzy Hash: 38114C79201605DFC724DF28E481A56B7E9FF48314720C82EE98ACB662DB32E891CB54

Function 00024F3D Relevance: 1.6, APIs: 1, Instructions: 64libraryCOMMON

Download Yara Rule

APIs

Part of subcall function 00024D13: FreeLibrary.KERNEL32(00000000,?), ref: 00024D4D

Part of subcall function 0004548B: __wfsopen.LIBCMT ref: 00045496

LoadLibraryExW.KERNELBASE(?,00000000,00000002,?,000E62F8,00000001,>>>AUTOIT NO CMDEXECUTE<<<,?), ref: 00024F6F

Part of subcall function 00024CC8: FreeLibrary.KERNEL32(00000000), ref: 00024D02

Part of subcall function 00024DD0: _memmove.LIBCMT ref: 00024E1A

Memory Dump Source

Source File: 00000000.00000002.1643917647.0000000000021000.00000020.00000001.01000000.00000003.sdmp, Offset: 00020000, based on PE: true

Associated: 00000000.00000002.1643904003.0000000000020000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1643958107.00000000000AF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1643958107.00000000000D5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1643993044.00000000000DF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1644007204.00000000000E8000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_20000_Ship Docs_CI PL HBL COO_.jbxd

Similarity

API ID: Library$Free$Load__wfsopen_memmove
String ID:
API String ID: 1396898556-0
Opcode ID: ba5577efc39ea01e241ae8013bdd7b08fe6337354c2ed853683138c5dcf61cf2
Instruction ID: ae5227e719b415c37c1c018a911d4a6941e00b7491a96a055de152962293cc08
Opcode Fuzzy Hash: ba5577efc39ea01e241ae8013bdd7b08fe6337354c2ed853683138c5dcf61cf2
Instruction Fuzzy Hash: AA110A31600725ABCF20FF74EC46FEE77A89F80701F20843AF945AA1C3DA719A159B60

Function 000601AF Relevance: 1.6, APIs: 1, Instructions: 63COMMON

Download Yara Rule

APIs

VariantClear.OLEAUT32(?), ref: 000601BB

Memory Dump Source

Source File: 00000000.00000002.1643917647.0000000000021000.00000020.00000001.01000000.00000003.sdmp, Offset: 00020000, based on PE: true

Associated: 00000000.00000002.1643904003.0000000000020000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1643958107.00000000000AF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1643958107.00000000000D5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1643993044.00000000000DF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1644007204.00000000000E8000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_20000_Ship Docs_CI PL HBL COO_.jbxd

Similarity

API ID: ClearVariant
String ID:
API String ID: 1473721057-0
Opcode ID: f7bc39333603c9ca03a805099979f04de13a9b1081834560a0b0bca5258f1974
Instruction ID: 4323a775309fdb89a46099a4a58bf2c2339a7c60fe4f49fb393ccc16f16361fd
Opcode Fuzzy Hash: f7bc39333603c9ca03a805099979f04de13a9b1081834560a0b0bca5258f1974
Instruction Fuzzy Hash: 4A2122B4608351CFCB24DF64D444A5BBBE1BF89314F058968E88A87722DB31E895CB93

Function 00025D20 Relevance: 1.6, APIs: 1, Instructions: 53fileCOMMON

Download Yara Rule

APIs

ReadFile.KERNELBASE(?,?,00010000,?,00000000,00000000,?,00010000,?,00025807,00000000,00010000,00000000,00000000,00000000,00000000), ref: 00025D76

Memory Dump Source

Source File: 00000000.00000002.1643917647.0000000000021000.00000020.00000001.01000000.00000003.sdmp, Offset: 00020000, based on PE: true

Associated: 00000000.00000002.1643904003.0000000000020000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1643958107.00000000000AF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1643958107.00000000000D5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1643993044.00000000000DF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1644007204.00000000000E8000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_20000_Ship Docs_CI PL HBL COO_.jbxd

Similarity

API ID: FileRead
String ID:
API String ID: 2738559852-0
Opcode ID: 0f4ea8731ec7d55a40a3adc89a8b99bcd5c1db2ae12a68aa59578016cc6b8702
Instruction ID: 0d11cfe3a7f5fa8b7ee7b3aba082649e12c9a7d46f69c1463f1c78a5c3b173ea
Opcode Fuzzy Hash: 0f4ea8731ec7d55a40a3adc89a8b99bcd5c1db2ae12a68aa59578016cc6b8702
Instruction Fuzzy Hash: 34113635200B11AFD3708F15E888B66B7E9EF45761F10C92EE8AA86A50D7B0E945CF64

Function 00044A93 Relevance: 1.5, APIs: 1, Instructions: 36COMMON

Download Yara Rule

APIs

__lock_file.LIBCMT ref: 00044AD6

Part of subcall function 00048D68: __getptd_noexit.LIBCMT ref: 00048D68

Memory Dump Source

Source File: 00000000.00000002.1643917647.0000000000021000.00000020.00000001.01000000.00000003.sdmp, Offset: 00020000, based on PE: true

Associated: 00000000.00000002.1643904003.0000000000020000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1643958107.00000000000AF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1643958107.00000000000D5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1643993044.00000000000DF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1644007204.00000000000E8000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_20000_Ship Docs_CI PL HBL COO_.jbxd

Similarity

API ID: __getptd_noexit__lock_file
String ID:
API String ID: 2597487223-0
Opcode ID: 0fe976e352a3e43c5ff88b4b914461821c3add4b6ca49c620ee62584acb61267
Instruction ID: c699034296d7640d6fb96ddfbf01c2220438ce6a8b9326608f092e2519c97620
Opcode Fuzzy Hash: 0fe976e352a3e43c5ff88b4b914461821c3add4b6ca49c620ee62584acb61267
Instruction Fuzzy Hash: FAF0A4B19402099BDF61BF648C063DF36A1AF00325F048535B414AA1D3DB788960DF9A

Function 00024FAA Relevance: 1.5, APIs: 1, Instructions: 28COMMON

Download Yara Rule

APIs

FreeLibrary.KERNEL32(?,?,000E62F8,00000001,>>>AUTOIT NO CMDEXECUTE<<<,?), ref: 00024FDE

Memory Dump Source

Source File: 00000000.00000002.1643917647.0000000000021000.00000020.00000001.01000000.00000003.sdmp, Offset: 00020000, based on PE: true

Associated: 00000000.00000002.1643904003.0000000000020000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1643958107.00000000000AF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1643958107.00000000000D5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1643993044.00000000000DF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1644007204.00000000000E8000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_20000_Ship Docs_CI PL HBL COO_.jbxd

Similarity

API ID: FreeLibrary
String ID:
API String ID: 3664257935-0
Opcode ID: 0aefe5898e7cd187d03d73978cde31cb0bf901365052c61b36113a09805c48fc
Instruction ID: efba7f84e8ece1f4337762a9779c595e63be56e593df0486c81ec32d1302bbfb
Opcode Fuzzy Hash: 0aefe5898e7cd187d03d73978cde31cb0bf901365052c61b36113a09805c48fc
Instruction Fuzzy Hash: 85F03971505B22CFCBB49F64E9D4826BBF1FF443293208A3EE1D682A11C771A844DF40

Function 000409D5 Relevance: 1.5, APIs: 1, Instructions: 24COMMON

Download Yara Rule

APIs

GetLongPathNameW.KERNELBASE(?,?,00007FFF), ref: 000409F4

Part of subcall function 00027D2C: _memmove.LIBCMT ref: 00027D66

Memory Dump Source

Source File: 00000000.00000002.1643917647.0000000000021000.00000020.00000001.01000000.00000003.sdmp, Offset: 00020000, based on PE: true

Associated: 00000000.00000002.1643904003.0000000000020000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1643958107.00000000000AF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1643958107.00000000000D5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1643993044.00000000000DF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1644007204.00000000000E8000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_20000_Ship Docs_CI PL HBL COO_.jbxd

Similarity

API ID: LongNamePath_memmove
String ID:
API String ID: 2514874351-0
Opcode ID: ecf38dced8a388b151f7878efeaa9758f322f9e27027ebfc3d3339e280e2b522
Instruction ID: e01241b4e75189e3d3d8b193b0f8b928f1d7ce388d419a66e988fe82077a2fe6
Opcode Fuzzy Hash: ecf38dced8a388b151f7878efeaa9758f322f9e27027ebfc3d3339e280e2b522
Instruction Fuzzy Hash: 95E0CD3690522857D720D6989C05FFA77EDDFC9791F0401B5FD4CD7206DD649C818690

Function 00089129 Relevance: 1.5, APIs: 1, Instructions: 22COMMON

Download Yara Rule

APIs

__fread_nolock.LIBCMT ref: 0008914B

Memory Dump Source

Source File: 00000000.00000002.1643917647.0000000000021000.00000020.00000001.01000000.00000003.sdmp, Offset: 00020000, based on PE: true

Associated: 00000000.00000002.1643904003.0000000000020000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1643958107.00000000000AF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1643958107.00000000000D5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1643993044.00000000000DF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1644007204.00000000000E8000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_20000_Ship Docs_CI PL HBL COO_.jbxd

Similarity

API ID: __fread_nolock
String ID:
API String ID: 2638373210-0
Opcode ID: 7603a7e23398706fbe611478ecf9e3358d47b441acc83f726054c373298f7434
Instruction ID: c61b45d1247f7dc00cb35705892de14a139bd2c1daba7137bc0f844e163f0849
Opcode Fuzzy Hash: 7603a7e23398706fbe611478ecf9e3358d47b441acc83f726054c373298f7434
Instruction Fuzzy Hash: 28E092B0118B005FDB749A24D8147E373E0BB06315F04081CF2DA93342EF6378418759

Function 00025DAE Relevance: 1.5, APIs: 1, Instructions: 16COMMON

Download Yara Rule

APIs

SetFilePointerEx.KERNELBASE(?,00000000,00000000,?,00000001,?,?,?,0005E16B,?,?,00000000), ref: 00025DBF

Memory Dump Source

Source File: 00000000.00000002.1643917647.0000000000021000.00000020.00000001.01000000.00000003.sdmp, Offset: 00020000, based on PE: true

Associated: 00000000.00000002.1643904003.0000000000020000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1643958107.00000000000AF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1643958107.00000000000D5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1643993044.00000000000DF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1644007204.00000000000E8000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_20000_Ship Docs_CI PL HBL COO_.jbxd

Similarity

API ID: FilePointer
String ID:
API String ID: 973152223-0
Opcode ID: 9bbf94906ba4847260756282487f30e2f5f22cf22487ee7bd97b90c7b8ce1b57
Instruction ID: 7d2585062367221c3fc5ca4078409e71d61c0e4737a16b4185925a4a58b1f58b
Opcode Fuzzy Hash: 9bbf94906ba4847260756282487f30e2f5f22cf22487ee7bd97b90c7b8ce1b57
Instruction Fuzzy Hash: D8D0C77464020CBFE710DB80DC46FA9777CD705710F100194FD0456290D6B27D508795

Function 0004548B Relevance: 1.5, APIs: 1, Instructions: 9COMMON

Download Yara Rule

APIs

__wfsopen.LIBCMT ref: 00045496

Memory Dump Source

Source File: 00000000.00000002.1643917647.0000000000021000.00000020.00000001.01000000.00000003.sdmp, Offset: 00020000, based on PE: true

Associated: 00000000.00000002.1643904003.0000000000020000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1643958107.00000000000AF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1643958107.00000000000D5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1643993044.00000000000DF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1644007204.00000000000E8000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_20000_Ship Docs_CI PL HBL COO_.jbxd

Similarity

API ID: __wfsopen
String ID:
API String ID: 197181222-0
Opcode ID: 6ddf6e1ab81d7b85eaff3423c11cf18e9f26fa56f97d638f5b10e7f164e3c6f3
Instruction ID: e4171871104fbfd64784cb47b57fd0d88e9267d9ad3cdb70c67bfcb74de66a89
Opcode Fuzzy Hash: 6ddf6e1ab81d7b85eaff3423c11cf18e9f26fa56f97d638f5b10e7f164e3c6f3
Instruction Fuzzy Hash: E7B092B688020C77DE012E82EC02A993B199B80679F808020FB0C1C163A673AAA09689

Function 0008D2E6 Relevance: 1.4, APIs: 1, Instructions: 198COMMON

Download Yara Rule

APIs

GetLastError.KERNEL32(00000002,00000000), ref: 0008D46A

Memory Dump Source

Source File: 00000000.00000002.1643917647.0000000000021000.00000020.00000001.01000000.00000003.sdmp, Offset: 00020000, based on PE: true

Associated: 00000000.00000002.1643904003.0000000000020000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1643958107.00000000000AF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1643958107.00000000000D5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1643993044.00000000000DF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1644007204.00000000000E8000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_20000_Ship Docs_CI PL HBL COO_.jbxd

Similarity

API ID: ErrorLast
String ID:
API String ID: 1452528299-0
Opcode ID: 37a155552ace7a7d435256d3f47ebe0df1f955b011a9c1976c8a9a8e08d1f74f
Instruction ID: 83345b0fe4fa3aff7f3cb6b2a7e61b4a418194ca3d3a0d2075fd416b57272c1b
Opcode Fuzzy Hash: 37a155552ace7a7d435256d3f47ebe0df1f955b011a9c1976c8a9a8e08d1f74f
Instruction Fuzzy Hash: 177165302087128FCB54EF24D491AAEB7E4BF88314F04466EF59697292DB30ED49CB56

Function 00040E48 Relevance: 1.3, APIs: 1, Instructions: 94memoryCOMMON

Download Yara Rule

APIs

VirtualAlloc.KERNELBASE ref: 00040EF7

Memory Dump Source

Source File: 00000000.00000002.1643917647.0000000000021000.00000020.00000001.01000000.00000003.sdmp, Offset: 00020000, based on PE: true

Associated: 00000000.00000002.1643904003.0000000000020000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1643958107.00000000000AF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1643958107.00000000000D5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1643993044.00000000000DF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1644007204.00000000000E8000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_20000_Ship Docs_CI PL HBL COO_.jbxd

Similarity

API ID: AllocVirtual
String ID:
API String ID: 4275171209-0
Opcode ID: 160be14eaa7db79452b6aeb530136e2f2731e3e0b6e758b09a27e7bca35b483d
Instruction ID: 13463da374d3229c46ff72b3a43bd0f5d249c660f7a73c37c52d4dca8350bf16
Opcode Fuzzy Hash: 160be14eaa7db79452b6aeb530136e2f2731e3e0b6e758b09a27e7bca35b483d
Instruction Fuzzy Hash: 393127B1A00106DFC768DF49C480969F7A2FF99300B248AB5E609EB651D731EDD1CBC8

Function 019D229C Relevance: 1.3, APIs: 1, Instructions: 21sleepCOMMON

Download Yara Rule

APIs

Sleep.KERNELBASE(000001F4), ref: 019D22B1

Memory Dump Source

Source File: 00000000.00000002.1644337710.00000000019D0000.00000040.00001000.00020000.00000000.sdmp, Offset: 019D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_19d0000_Ship Docs_CI PL HBL COO_.jbxd

Similarity

API ID: Sleep
String ID:
API String ID: 3472027048-0
Opcode ID: 647f186050b41918f79179839cbc1a488579cc5f77474145a25b6e124dddc6ea
Instruction ID: a5f95e29d01722a620f4a0ee0e2acf895cbfbdb9ea102d837112e5cb79daabf3
Opcode Fuzzy Hash: 647f186050b41918f79179839cbc1a488579cc5f77474145a25b6e124dddc6ea
Instruction Fuzzy Hash: 80E0BF7494010EEFDB00EFA4D5496DE7BB4EF04311F1045A1FD05D7681DB309E549A72

Function 019D22A0 Relevance: 1.3, APIs: 1, Instructions: 18sleepCOMMON

Download Yara Rule

APIs

Sleep.KERNELBASE(000001F4), ref: 019D22B1

Memory Dump Source

Source File: 00000000.00000002.1644337710.00000000019D0000.00000040.00001000.00020000.00000000.sdmp, Offset: 019D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_19d0000_Ship Docs_CI PL HBL COO_.jbxd

Similarity

API ID: Sleep
String ID:
API String ID: 3472027048-0
Opcode ID: 368835ae2f5fba710e6c01549c2017e46dd928bc4d187f44ede00cceab054826
Instruction ID: 0b5b2ec88b5c4549644fe99d0cf4123fd4a44eb24de67f15fd6eefcd88f4c5a7
Opcode Fuzzy Hash: 368835ae2f5fba710e6c01549c2017e46dd928bc4d187f44ede00cceab054826
Instruction Fuzzy Hash: 6FE0E67494010EDFDB00EFB4D54969E7FB4EF04301F104161FD05D2281D6309D509A72

Non-executed Functions

Function 000ACDAC Relevance: 74.1, APIs: 40, Strings: 2, Instructions: 637windowkeyboardCOMMON

Download Yara Rule

APIs

Part of subcall function 00022612: GetWindowLongW.USER32(?,000000EB), ref: 00022623

DefDlgProcW.USER32(?,0000004E,?,?,?,?,?,?), ref: 000ACE50
SendMessageW.USER32(?,0000130B,00000000,00000000), ref: 000ACE91
GetWindowLongW.USER32(FFFFFDD9,000000F0), ref: 000ACED6
SendMessageW.USER32(?,0000110A,00000009,00000000), ref: 000ACF00
SendMessageW.USER32 ref: 000ACF29
_wcsncpy.LIBCMT ref: 000ACFA1
GetKeyState.USER32(00000011), ref: 000ACFC2
GetKeyState.USER32(00000009), ref: 000ACFCF
SendMessageW.USER32(?,0000130B,00000000,00000000), ref: 000ACFE5
GetKeyState.USER32(00000010), ref: 000ACFEF
SendMessageW.USER32(?,0000110A,00000009,00000000), ref: 000AD018
SendMessageW.USER32 ref: 000AD03F
SendMessageW.USER32(?,00001030,?,000AB602), ref: 000AD145
ImageList_SetDragCursorImage.COMCTL32(00000000,00000000,00000000,?,?,?), ref: 000AD15B
ImageList_BeginDrag.COMCTL32(00000000,000000F8,000000F0), ref: 000AD16E
SetCapture.USER32(?), ref: 000AD177
ClientToScreen.USER32(?,?), ref: 000AD1DC
ImageList_DragEnter.COMCTL32(00000000,?,?), ref: 000AD1E9
InvalidateRect.USER32(?,00000000,00000001,?,?,?), ref: 000AD203
ReleaseCapture.USER32 ref: 000AD20E
GetCursorPos.USER32(?), ref: 000AD248
ScreenToClient.USER32(?,?), ref: 000AD255
SendMessageW.USER32(?,00001012,00000000,?), ref: 000AD2B1
SendMessageW.USER32 ref: 000AD2DF
SendMessageW.USER32(?,00001111,00000000,?), ref: 000AD31C
SendMessageW.USER32 ref: 000AD34B
SendMessageW.USER32(?,0000110B,00000009,00000000), ref: 000AD36C
SendMessageW.USER32(?,0000110B,00000009,?), ref: 000AD37B
GetCursorPos.USER32(?), ref: 000AD39B
ScreenToClient.USER32(?,?), ref: 000AD3A8
GetParent.USER32(?), ref: 000AD3C8
SendMessageW.USER32(?,00001012,00000000,?), ref: 000AD431
SendMessageW.USER32 ref: 000AD462
ClientToScreen.USER32(?,?), ref: 000AD4C0
TrackPopupMenuEx.USER32(?,00000000,?,?,?,00000000), ref: 000AD4F0
SendMessageW.USER32(?,00001111,00000000,?), ref: 000AD51A
SendMessageW.USER32 ref: 000AD53D
ClientToScreen.USER32(?,?), ref: 000AD58F
TrackPopupMenuEx.USER32(?,00000080,?,?,?,00000000), ref: 000AD5C3

Part of subcall function 000225DB: GetWindowLongW.USER32(?,000000EB), ref: 000225EC

GetWindowLongW.USER32(?,000000F0), ref: 000AD65F

Strings

F, xrefs: 000AD543
@GUI_DRAGID, xrefs: 000AD1AA

Memory Dump Source

Source File: 00000000.00000002.1643917647.0000000000021000.00000020.00000001.01000000.00000003.sdmp, Offset: 00020000, based on PE: true

Associated: 00000000.00000002.1643904003.0000000000020000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1643958107.00000000000AF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1643958107.00000000000D5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1643993044.00000000000DF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1644007204.00000000000E8000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_20000_Ship Docs_CI PL HBL COO_.jbxd

Similarity

API ID: MessageSend$ClientScreen$ImageLongWindow$CursorDragList_State$CaptureMenuPopupTrack$BeginEnterInvalidateParentProcRectRelease_wcsncpy
String ID: @GUI_DRAGID$F
API String ID: 3977979337-4164748364
Opcode ID: c3e9c1235fc89244c637d5ee956cd56c9b3fdb7aa031ddce9693305c710515cc
Instruction ID: 116e3375dac4f7c13c8c8dc741c4c32b04b1cb0c518c3fc8d3bb7a22c84fbe9c
Opcode Fuzzy Hash: c3e9c1235fc89244c637d5ee956cd56c9b3fdb7aa031ddce9693305c710515cc
Instruction Fuzzy Hash: BE42BF30204641EFE724CFA8C984FAABBE5FF4A754F15061DF696972A1C732D840CB92

Function 000A804A Relevance: 60.1, APIs: 33, Strings: 1, Instructions: 571windowCOMMON

Download Yara Rule

APIs

SendMessageW.USER32(?,00000400,00000000,00000000), ref: 000A873F

Strings

%d/%02d/%02d, xrefs: 000A8478

Memory Dump Source

Source File: 00000000.00000002.1643917647.0000000000021000.00000020.00000001.01000000.00000003.sdmp, Offset: 00020000, based on PE: true

Associated: 00000000.00000002.1643904003.0000000000020000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1643958107.00000000000AF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1643958107.00000000000D5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1643993044.00000000000DF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1644007204.00000000000E8000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_20000_Ship Docs_CI PL HBL COO_.jbxd

Similarity

API ID: MessageSend
String ID: %d/%02d/%02d
API String ID: 3850602802-328681919
Opcode ID: 42f3f7ada493b201eeb8fdfc3686369256bce28285550aab96d682c749bb5491
Instruction ID: 5568d5ca8d1c7ab9aaf14bc578f9b8e1e1dd7991d69f53459b1c05a4c866f860
Opcode Fuzzy Hash: 42f3f7ada493b201eeb8fdfc3686369256bce28285550aab96d682c749bb5491
Instruction Fuzzy Hash: 3712E171500605AFEB648FA4CC49FAE7BF8EF4A350F248129F915EA2E1DF748941CB50

Function 0003710E Relevance: 50.6, APIs: 19, Strings: 7, Instructions: 5093COMMON

Download Yara Rule

APIs

_memmove.LIBCMT ref: 000375C2
_memset.LIBCMT ref: 000376B1
_memmove.LIBCMT ref: 00037C4B
_memmove.LIBCMT ref: 00037E4F

Strings

\b(?=\w), xrefs: 00073C34
Q\E, xrefs: 000381C1
\b(?<=\w), xrefs: 00073C41
[:>:]], xrefs: 0003760A
DEFINE, xrefs: 000725AF
0w, xrefs: 00071F5B
[:<:]], xrefs: 000375F1

Memory Dump Source

Source File: 00000000.00000002.1643917647.0000000000021000.00000020.00000001.01000000.00000003.sdmp, Offset: 00020000, based on PE: true

Associated: 00000000.00000002.1643904003.0000000000020000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1643958107.00000000000AF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1643958107.00000000000D5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1643993044.00000000000DF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1644007204.00000000000E8000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_20000_Ship Docs_CI PL HBL COO_.jbxd

Similarity

API ID: _memmove$_memset
String ID: 0w$DEFINE$Q\E$[:<:]]$[:>:]]$\b(?<=\w)$\b(?=\w)
API String ID: 1357608183-1077906630
Opcode ID: 4a6e3e9b6e78baf29540baa1d8a348412567b82eedb5320e27d9380fa892ecf0
Instruction ID: 162a3bf8cbfadd9967c4887a84650a218fe7be319508b55a29141df3a11a2ba4
Opcode Fuzzy Hash: 4a6e3e9b6e78baf29540baa1d8a348412567b82eedb5320e27d9380fa892ecf0
Instruction Fuzzy Hash: 1E93AF71E04219DBDB25CF98C881BADB7F1FF48310F24C16AE949AB281E7749E81DB54

Function 00024A35 Relevance: 43.9, APIs: 24, Strings: 1, Instructions: 131keyboardthreadwindowCOMMON

Download Yara Rule

APIs

GetForegroundWindow.USER32(00000000,?), ref: 00024A3D
FindWindowW.USER32(Shell_TrayWnd,00000000), ref: 0005DA8E
IsIconic.USER32(?), ref: 0005DA97
ShowWindow.USER32(?,00000009), ref: 0005DAA4
SetForegroundWindow.USER32(?), ref: 0005DAAE
GetWindowThreadProcessId.USER32(00000000,00000000), ref: 0005DAC4
GetCurrentThreadId.KERNEL32 ref: 0005DACB
GetWindowThreadProcessId.USER32(?,00000000), ref: 0005DAD7
AttachThreadInput.USER32(?,00000000,00000001), ref: 0005DAE8
AttachThreadInput.USER32(?,00000000,00000001), ref: 0005DAF0
AttachThreadInput.USER32(00000000,?,00000001), ref: 0005DAF8
SetForegroundWindow.USER32(?), ref: 0005DAFB
MapVirtualKeyW.USER32(00000012,00000000), ref: 0005DB10
keybd_event.USER32(00000012,00000000), ref: 0005DB1B
MapVirtualKeyW.USER32(00000012,00000000), ref: 0005DB25
keybd_event.USER32(00000012,00000000), ref: 0005DB2A
MapVirtualKeyW.USER32(00000012,00000000), ref: 0005DB33
keybd_event.USER32(00000012,00000000), ref: 0005DB38
MapVirtualKeyW.USER32(00000012,00000000), ref: 0005DB42
keybd_event.USER32(00000012,00000000), ref: 0005DB47
SetForegroundWindow.USER32(?), ref: 0005DB4A
AttachThreadInput.USER32(?,?,00000000), ref: 0005DB71

Strings

Shell_TrayWnd, xrefs: 0005DA89

Memory Dump Source

Source File: 00000000.00000002.1643917647.0000000000021000.00000020.00000001.01000000.00000003.sdmp, Offset: 00020000, based on PE: true

Associated: 00000000.00000002.1643904003.0000000000020000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1643958107.00000000000AF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1643958107.00000000000D5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1643993044.00000000000DF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1644007204.00000000000E8000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_20000_Ship Docs_CI PL HBL COO_.jbxd

Similarity

API ID: Window$Thread$AttachForegroundInputVirtualkeybd_event$Process$CurrentFindIconicShow
String ID: Shell_TrayWnd
API String ID: 4125248594-2988720461
Opcode ID: c175ee1701fbae0d835879c6be26fee6c684eca05566f7249bccf4f2e5bd4c91
Instruction ID: 4401df5492c8b13d78bb980850dbec69606405fb2c58cae80ad9a3a1f8223fbe
Opcode Fuzzy Hash: c175ee1701fbae0d835879c6be26fee6c684eca05566f7249bccf4f2e5bd4c91
Instruction Fuzzy Hash: 19315071A80719BBFB316FB19C49F7F3EACEB45B51F114026FE04EA1D0D6B45900AAA1

Function 00078858 Relevance: 35.2, APIs: 17, Strings: 3, Instructions: 224COMMON

Download Yara Rule

APIs

Part of subcall function 00078CC3: LookupPrivilegeValueW.ADVAPI32(00000000,00000000,00000004), ref: 00078D0D
Part of subcall function 00078CC3: AdjustTokenPrivileges.ADVAPI32(?,00000000,00000000,?,00000000,?), ref: 00078D3A
Part of subcall function 00078CC3: GetLastError.KERNEL32 ref: 00078D47

_memset.LIBCMT ref: 0007889B
DuplicateTokenEx.ADVAPI32(?,00000000,00000000,00000002,00000001,?,?,?,?,00000001,?,?), ref: 000788ED
CloseHandle.KERNEL32(?), ref: 000788FE
OpenWindowStationW.USER32(winsta0,00000000,00060000), ref: 00078915
GetProcessWindowStation.USER32 ref: 0007892E
SetProcessWindowStation.USER32(00000000), ref: 00078938
OpenDesktopW.USER32(default,00000000,00000000,00060081), ref: 00078952

Part of subcall function 00078713: AdjustTokenPrivileges.ADVAPI32(?,00000000,?,00000000,00000000,00000000,?,00078851), ref: 00078728
Part of subcall function 00078713: CloseHandle.KERNEL32(?,?,00078851), ref: 0007873A

Strings

default, xrefs: 0007894D
, xrefs: 000788AA
winsta0, xrefs: 00078910

Memory Dump Source

Source File: 00000000.00000002.1643917647.0000000000021000.00000020.00000001.01000000.00000003.sdmp, Offset: 00020000, based on PE: true

Associated: 00000000.00000002.1643904003.0000000000020000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1643958107.00000000000AF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1643958107.00000000000D5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1643993044.00000000000DF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1644007204.00000000000E8000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_20000_Ship Docs_CI PL HBL COO_.jbxd

Similarity

API ID: StationTokenWindow$AdjustCloseHandleOpenPrivilegesProcess$DesktopDuplicateErrorLastLookupPrivilegeValue_memset
String ID: $default$winsta0
API String ID: 2063423040-1027155976
Opcode ID: 2bc9bd4be08da84c7d6a1dfe89ee6de12d60c8f14c256d4aaa2e68c115b4dcbf
Instruction ID: eaa0e90e8c9c6e2195ee4e9bbec4313cdd0101a6d548a39a2ea9f628c81fa242
Opcode Fuzzy Hash: 2bc9bd4be08da84c7d6a1dfe89ee6de12d60c8f14c256d4aaa2e68c115b4dcbf
Instruction Fuzzy Hash: 3E815A71D40209BFEF11DFA4DC49AEE7BB8EF04304F18C16AF918A6161DB398E149B65

Function 0009425A Relevance: 30.2, APIs: 20, Instructions: 167clipboardCOMMON

Download Yara Rule

APIs

OpenClipboard.USER32(000AF910), ref: 00094284
IsClipboardFormatAvailable.USER32(0000000D), ref: 00094292
GetClipboardData.USER32(0000000D), ref: 0009429A
CloseClipboard.USER32 ref: 000942A6
GlobalLock.KERNEL32(00000000), ref: 000942C2
CloseClipboard.USER32 ref: 000942CC
GlobalUnlock.KERNEL32(00000000,00000000), ref: 000942E1
IsClipboardFormatAvailable.USER32(00000001), ref: 000942EE
GetClipboardData.USER32(00000001), ref: 000942F6
GlobalLock.KERNEL32(00000000), ref: 00094303
GlobalUnlock.KERNEL32(00000000,00000000,?), ref: 00094337
CloseClipboard.USER32 ref: 00094447

Memory Dump Source

Source File: 00000000.00000002.1643917647.0000000000021000.00000020.00000001.01000000.00000003.sdmp, Offset: 00020000, based on PE: true

Associated: 00000000.00000002.1643904003.0000000000020000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1643958107.00000000000AF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1643958107.00000000000D5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1643993044.00000000000DF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1644007204.00000000000E8000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_20000_Ship Docs_CI PL HBL COO_.jbxd

Similarity

API ID: Clipboard$Global$Close$AvailableDataFormatLockUnlock$Open
String ID:
API String ID: 3222323430-0
Opcode ID: 51f3dd652b5fa893c1e362e996a1aa48b67e6585a0a9b2805edd53ef61530026
Instruction ID: 22ba8b0e8c0e8b3aea1cd8bc23d3b86195b28e3f3aff900b85d6100d33743093
Opcode Fuzzy Hash: 51f3dd652b5fa893c1e362e996a1aa48b67e6585a0a9b2805edd53ef61530026
Instruction Fuzzy Hash: 8E519531204702ABEB11AFA0EC85FBF77A8AF45B01F104529F595D21E2DF74D9059B62

Function 0008C9C7 Relevance: 28.3, APIs: 13, Strings: 3, Instructions: 280timefileCOMMON

Download Yara Rule

APIs

FindFirstFileW.KERNEL32(?,?), ref: 0008C9F8
FindClose.KERNEL32(00000000), ref: 0008CA4C
FileTimeToLocalFileTime.KERNEL32(?,?), ref: 0008CA71
FileTimeToLocalFileTime.KERNEL32(?,?), ref: 0008CA88
FileTimeToSystemTime.KERNEL32(?,?), ref: 0008CAAF
__swprintf.LIBCMT ref: 0008CAFB
__swprintf.LIBCMT ref: 0008CB3E

Part of subcall function 00027F41: _memmove.LIBCMT ref: 00027F82

__swprintf.LIBCMT ref: 0008CB92

Part of subcall function 000438D8: __woutput_l.LIBCMT ref: 00043931

__swprintf.LIBCMT ref: 0008CBE0

Part of subcall function 000438D8: __flsbuf.LIBCMT ref: 00043953
Part of subcall function 000438D8: __flsbuf.LIBCMT ref: 0004396B

__swprintf.LIBCMT ref: 0008CC2F
__swprintf.LIBCMT ref: 0008CC7E
__swprintf.LIBCMT ref: 0008CCCD

Strings

%02d, xrefs: 0008CB86, 0008CB90, 0008CBDE, 0008CC2D, 0008CC7C, 0008CCCB
%4d, xrefs: 0008CB38
%4d%02d%02d%02d%02d%02d, xrefs: 0008CAF5

Memory Dump Source

Source File: 00000000.00000002.1643917647.0000000000021000.00000020.00000001.01000000.00000003.sdmp, Offset: 00020000, based on PE: true

Associated: 00000000.00000002.1643904003.0000000000020000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1643958107.00000000000AF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1643958107.00000000000D5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1643993044.00000000000DF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1644007204.00000000000E8000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_20000_Ship Docs_CI PL HBL COO_.jbxd

Similarity

API ID: __swprintf$FileTime$FindLocal__flsbuf$CloseFirstSystem__woutput_l_memmove
String ID: %02d$%4d$%4d%02d%02d%02d%02d%02d
API String ID: 3953360268-2428617273
Opcode ID: 1d4b7c139c8f0e704c9f91eb61362c6c1602c159b0eb076a3f121b4fe01e1daa
Instruction ID: 7fa58151bf9a264378d9207a5ca1c344b3e22fe810fce2b397eb3ae191be12fc
Opcode Fuzzy Hash: 1d4b7c139c8f0e704c9f91eb61362c6c1602c159b0eb076a3f121b4fe01e1daa
Instruction Fuzzy Hash: E3A13EB1508315ABD710FBA4D986DEFB7ECBF94700F404929F585D6192EA34DA08CB62

Function 0008F200 Relevance: 28.1, APIs: 15, Strings: 1, Instructions: 119fileCOMMON

Download Yara Rule

APIs

FindFirstFileW.KERNEL32(?,?,74DE8FB0,?,00000000), ref: 0008F221
_wcscmp.LIBCMT ref: 0008F236
_wcscmp.LIBCMT ref: 0008F24D
GetFileAttributesW.KERNEL32(?), ref: 0008F25F
SetFileAttributesW.KERNEL32(?,?), ref: 0008F279
FindNextFileW.KERNEL32(00000000,?), ref: 0008F291
FindClose.KERNEL32(00000000), ref: 0008F29C
FindFirstFileW.KERNEL32(*.*,?), ref: 0008F2B8
_wcscmp.LIBCMT ref: 0008F2DF
_wcscmp.LIBCMT ref: 0008F2F6
SetCurrentDirectoryW.KERNEL32(?), ref: 0008F308
SetCurrentDirectoryW.KERNEL32(000DA5A0), ref: 0008F326
FindNextFileW.KERNEL32(00000000,00000010), ref: 0008F330
FindClose.KERNEL32(00000000), ref: 0008F33D
FindClose.KERNEL32(00000000), ref: 0008F34F

Strings

*.*, xrefs: 0008F2B3

Memory Dump Source

Source File: 00000000.00000002.1643917647.0000000000021000.00000020.00000001.01000000.00000003.sdmp, Offset: 00020000, based on PE: true

Associated: 00000000.00000002.1643904003.0000000000020000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1643958107.00000000000AF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1643958107.00000000000D5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1643993044.00000000000DF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1644007204.00000000000E8000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_20000_Ship Docs_CI PL HBL COO_.jbxd

Similarity

API ID: Find$File$_wcscmp$Close$AttributesCurrentDirectoryFirstNext
String ID: *.*
API String ID: 1803514871-438819550
Opcode ID: d2242fc374754e6ea6ba01650c17a2a23cc0295e9e75e2ab347eec9574180b5d
Instruction ID: 2f2c5ea25de13dde9969195671b6b5e21dbc883803182061516c08d668b974a6
Opcode Fuzzy Hash: d2242fc374754e6ea6ba01650c17a2a23cc0295e9e75e2ab347eec9574180b5d
Instruction Fuzzy Hash: 2431C77660061A6ADB20EBB4EC48AFE77ECAF09361F100276E980D3190DB34DB45CB64

Function 000A0AE2 Relevance: 26.7, APIs: 9, Strings: 6, Instructions: 477registryCOMMON

Download Yara Rule

APIs

RegConnectRegistryW.ADVAPI32(?,?,?), ref: 000A0BDE
RegCreateKeyExW.ADVAPI32(?,?,00000000,000AF910,00000000,?,00000000,?,?), ref: 000A0C4C
RegCloseKey.ADVAPI32(00000000,00000001,00000000,00000000,00000000), ref: 000A0C94
RegSetValueExW.ADVAPI32(00000001,?,00000000,00000002,?), ref: 000A0D1D
RegCloseKey.ADVAPI32(?), ref: 000A103D
RegCloseKey.ADVAPI32(00000000), ref: 000A104A

Strings

REG_QWORD, xrefs: 000A0F8B
REG_EXPAND_SZ, xrefs: 000A0CBA
REG_MULTI_SZ, xrefs: 000A0E05
REG_BINARY, xrefs: 000A0FD8
REG_SZ, xrefs: 000A0D5B
REG_DWORD, xrefs: 000A0F0E

Memory Dump Source

Source File: 00000000.00000002.1643917647.0000000000021000.00000020.00000001.01000000.00000003.sdmp, Offset: 00020000, based on PE: true

Associated: 00000000.00000002.1643904003.0000000000020000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1643958107.00000000000AF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1643958107.00000000000D5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1643993044.00000000000DF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1644007204.00000000000E8000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_20000_Ship Docs_CI PL HBL COO_.jbxd

Similarity

API ID: Close$ConnectCreateRegistryValue
String ID: REG_BINARY$REG_DWORD$REG_EXPAND_SZ$REG_MULTI_SZ$REG_QWORD$REG_SZ
API String ID: 536824911-966354055
Opcode ID: d5ffbdcca445b7a0696f0abed853979b1c9f7a5c19839346b9556fea71f573c4
Instruction ID: d270395988bd91e7e56e2face432b673ca88ff4c3107cfe329b52f158f53afd5
Opcode Fuzzy Hash: d5ffbdcca445b7a0696f0abed853979b1c9f7a5c19839346b9556fea71f573c4
Instruction Fuzzy Hash: CC0290756006119FDB14EF54D881E6AB7E5FF89720F04886DF98A9B362CB31ED41CB81

Function 0008F35D Relevance: 24.6, APIs: 13, Strings: 1, Instructions: 112fileCOMMON

Download Yara Rule

APIs

FindFirstFileW.KERNEL32(?,?,74DE8FB0,?,00000000), ref: 0008F37E
_wcscmp.LIBCMT ref: 0008F393
_wcscmp.LIBCMT ref: 0008F3AA

Part of subcall function 000845C1: CreateFileW.KERNEL32(?,40000000,00000001,00000000,00000003,02000080,00000000), ref: 000845DC

FindNextFileW.KERNEL32(00000000,?), ref: 0008F3D9
FindClose.KERNEL32(00000000), ref: 0008F3E4
FindFirstFileW.KERNEL32(*.*,?), ref: 0008F400
_wcscmp.LIBCMT ref: 0008F427
_wcscmp.LIBCMT ref: 0008F43E
SetCurrentDirectoryW.KERNEL32(?), ref: 0008F450
SetCurrentDirectoryW.KERNEL32(000DA5A0), ref: 0008F46E
FindNextFileW.KERNEL32(00000000,00000010), ref: 0008F478
FindClose.KERNEL32(00000000), ref: 0008F485
FindClose.KERNEL32(00000000), ref: 0008F497

Strings

*.*, xrefs: 0008F3FB

Memory Dump Source

Source File: 00000000.00000002.1643917647.0000000000021000.00000020.00000001.01000000.00000003.sdmp, Offset: 00020000, based on PE: true

Associated: 00000000.00000002.1643904003.0000000000020000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1643958107.00000000000AF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1643958107.00000000000D5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1643993044.00000000000DF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1644007204.00000000000E8000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_20000_Ship Docs_CI PL HBL COO_.jbxd

Similarity

API ID: Find$File$_wcscmp$Close$CurrentDirectoryFirstNext$Create
String ID: *.*
API String ID: 1824444939-438819550
Opcode ID: 2dd7860034e4ec4a1273c93a290f3f03da8e3afc02297715a11d388f187fb8e5
Instruction ID: 53ce67be7a769ec7ac630dec84bbeefa000bc35f089f237fe50da188d7139198
Opcode Fuzzy Hash: 2dd7860034e4ec4a1273c93a290f3f03da8e3afc02297715a11d388f187fb8e5
Instruction Fuzzy Hash: 3631B97150161B6ADF20BBB4EC88AFE77ECAF45360F100276E990931A1D774DE44CB64

Function 000781F7 Relevance: 21.2, APIs: 14, Instructions: 179memoryCOMMON

Download Yara Rule

APIs

Part of subcall function 0007874A: GetUserObjectSecurity.USER32(?,00000004,?,00000000,?), ref: 00078766
Part of subcall function 0007874A: GetLastError.KERNEL32(?,0007822A,?,?,?), ref: 00078770
Part of subcall function 0007874A: GetProcessHeap.KERNEL32(00000008,?,?,0007822A,?,?,?), ref: 0007877F
Part of subcall function 0007874A: HeapAlloc.KERNEL32(00000000,?,0007822A,?,?,?), ref: 00078786
Part of subcall function 0007874A: GetUserObjectSecurity.USER32(?,00000004,00000000,?,?), ref: 0007879D

Part of subcall function 000787E7: GetProcessHeap.KERNEL32(00000008,00078240,00000000,00000000,?,00078240,?), ref: 000787F3
Part of subcall function 000787E7: HeapAlloc.KERNEL32(00000000,?,00078240,?), ref: 000787FA
Part of subcall function 000787E7: InitializeSecurityDescriptor.ADVAPI32(00000000,00000001,?,00078240,?), ref: 0007880B

GetSecurityDescriptorDacl.ADVAPI32(?,?,?,?), ref: 0007825B
_memset.LIBCMT ref: 00078270
GetAclInformation.ADVAPI32(?,?,0000000C,00000002), ref: 0007828F
GetLengthSid.ADVAPI32(?), ref: 000782A0
GetAce.ADVAPI32(?,00000000,?), ref: 000782DD
AddAce.ADVAPI32(?,00000002,000000FF,?,?), ref: 000782F9
GetLengthSid.ADVAPI32(?), ref: 00078316
GetProcessHeap.KERNEL32(00000008,-00000008), ref: 00078325
HeapAlloc.KERNEL32(00000000), ref: 0007832C
GetLengthSid.ADVAPI32(?,00000008,?), ref: 0007834D
CopySid.ADVAPI32(00000000), ref: 00078354
AddAce.ADVAPI32(?,00000002,000000FF,00000000,?), ref: 00078385
SetSecurityDescriptorDacl.ADVAPI32(?,00000001,?,00000000), ref: 000783AB
SetUserObjectSecurity.USER32(?,00000004,?), ref: 000783BF

Memory Dump Source

Source File: 00000000.00000002.1643917647.0000000000021000.00000020.00000001.01000000.00000003.sdmp, Offset: 00020000, based on PE: true

Associated: 00000000.00000002.1643904003.0000000000020000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1643958107.00000000000AF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1643958107.00000000000D5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1643993044.00000000000DF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1644007204.00000000000E8000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_20000_Ship Docs_CI PL HBL COO_.jbxd

Similarity

API ID: HeapSecurity$AllocDescriptorLengthObjectProcessUser$Dacl$CopyErrorInformationInitializeLast_memset
String ID:
API String ID: 3996160137-0
Opcode ID: 8076a299490017258e9dc849de0897ee0084a83123bafd44f96c9ad3a8091db2
Instruction ID: ccbf356f144325235a0a89d4d6ee439b1738598c95797b0c4802c5382a93a39d
Opcode Fuzzy Hash: 8076a299490017258e9dc849de0897ee0084a83123bafd44f96c9ad3a8091db2
Instruction Fuzzy Hash: 48615C71D4060AABDF109F94DC48EEEBBB9FF04700F14C169E919A6291DB399A05CB64

Function 00036843 Relevance: 18.4, Strings: 14, Instructions: 883COMMON

Download Yara Rule

Strings

CRLF), xrefs: 000716FA
ANY), xrefs: 00071717
BSR_UNICODE), xrefs: 00071771
UTF), xrefs: 00071533
NO_AUTO_POSSESS), xrefs: 00071567
UCP), xrefs: 00071546
BSR_ANYCRLF), xrefs: 00071757
NO_START_OPT), xrefs: 00071588
CR), xrefs: 000716C0
UTF16), xrefs: 00071508
LF), xrefs: 000716DD
ANYCRLF), xrefs: 00071734
LIMIT_MATCH=, xrefs: 000715A9
LIMIT_RECURSION=, xrefs: 00071635

Memory Dump Source

Source File: 00000000.00000002.1643917647.0000000000021000.00000020.00000001.01000000.00000003.sdmp, Offset: 00020000, based on PE: true

Associated: 00000000.00000002.1643904003.0000000000020000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1643958107.00000000000AF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1643958107.00000000000D5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1643993044.00000000000DF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1644007204.00000000000E8000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_20000_Ship Docs_CI PL HBL COO_.jbxd

Similarity

API ID:
String ID: ANY)$ANYCRLF)$BSR_ANYCRLF)$BSR_UNICODE)$CR)$CRLF)$LF)$LIMIT_MATCH=$LIMIT_RECURSION=$NO_AUTO_POSSESS)$NO_START_OPT)$UCP)$UTF)$UTF16)
API String ID: 0-4052911093
Opcode ID: 8a29528383c35a063b63f40de9907d0b3c69e4331c4a6c08c4fb00712dc241fc
Instruction ID: 0e7c9d49b003f25de9c20a6f1cec72928a6779960f990cde2a062f37ac64b074
Opcode Fuzzy Hash: 8a29528383c35a063b63f40de9907d0b3c69e4331c4a6c08c4fb00712dc241fc
Instruction Fuzzy Hash: 1F727D71E002199BDB65CF58C8907EEB7F9FF48310F14C16AE949EB280DB759A81CB94

Function 000A0665 Relevance: 16.9, APIs: 11, Instructions: 397registryCOMMON

Download Yara Rule

APIs

Part of subcall function 000A10A5: CharUpperBuffW.USER32(?,?,?,?,?,?,?,000A0038,?,?), ref: 000A10BC

RegConnectRegistryW.ADVAPI32(?,?,?), ref: 000A0737

Part of subcall function 00029997: __itow.LIBCMT ref: 000299C2
Part of subcall function 00029997: __swprintf.LIBCMT ref: 00029A0C

RegQueryValueExW.ADVAPI32(?,?,00000000,?,00000000,?), ref: 000A07D6
RegQueryValueExW.ADVAPI32(?,?,00000000,00000000,?,00000008), ref: 000A086E
RegCloseKey.ADVAPI32(000000FE,000000FE,00000000,?,00000000), ref: 000A0AAD
RegCloseKey.ADVAPI32(00000000), ref: 000A0ABA

Memory Dump Source

Source File: 00000000.00000002.1643917647.0000000000021000.00000020.00000001.01000000.00000003.sdmp, Offset: 00020000, based on PE: true

Associated: 00000000.00000002.1643904003.0000000000020000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1643958107.00000000000AF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1643958107.00000000000D5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1643993044.00000000000DF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1644007204.00000000000E8000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_20000_Ship Docs_CI PL HBL COO_.jbxd

Similarity

API ID: CloseQueryValue$BuffCharConnectRegistryUpper__itow__swprintf
String ID:
API String ID: 1240663315-0
Opcode ID: 2dfb50051fdfc27c2b0d6c04b8430ad889264964b866dae82c44df85a0ea260e
Instruction ID: 3f3fa37779b0022b4a7d61e9823cb9e51bd95ed865c0ad9b7eb077cd13902554
Opcode Fuzzy Hash: 2dfb50051fdfc27c2b0d6c04b8430ad889264964b866dae82c44df85a0ea260e
Instruction Fuzzy Hash: 9CE15E31604315AFCB14DF68C895E6ABBE4EF89714F04896DF44ADB262DA31E901CB52

Function 00080219 Relevance: 16.6, APIs: 11, Instructions: 120keyboardCOMMON

Download Yara Rule

APIs

GetKeyboardState.USER32(?), ref: 00080241
GetAsyncKeyState.USER32(000000A0), ref: 000802C2
GetKeyState.USER32(000000A0), ref: 000802DD
GetAsyncKeyState.USER32(000000A1), ref: 000802F7
GetKeyState.USER32(000000A1), ref: 0008030C
GetAsyncKeyState.USER32(00000011), ref: 00080324
GetKeyState.USER32(00000011), ref: 00080336
GetAsyncKeyState.USER32(00000012), ref: 0008034E
GetKeyState.USER32(00000012), ref: 00080360
GetAsyncKeyState.USER32(0000005B), ref: 00080378
GetKeyState.USER32(0000005B), ref: 0008038A

Memory Dump Source

Source File: 00000000.00000002.1643917647.0000000000021000.00000020.00000001.01000000.00000003.sdmp, Offset: 00020000, based on PE: true

Associated: 00000000.00000002.1643904003.0000000000020000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1643958107.00000000000AF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1643958107.00000000000D5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1643993044.00000000000DF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1644007204.00000000000E8000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_20000_Ship Docs_CI PL HBL COO_.jbxd

Similarity

API ID: State$Async$Keyboard
String ID:
API String ID: 541375521-0
Opcode ID: 367b55c698236e9deb9517e2c3b1e21a2c944fee657e51ed8773b8fc4707bbd4
Instruction ID: 7cf7e3e09dd4f7e25684a203b93d6af4a330451b1e34795c1fc658f15db33277
Opcode Fuzzy Hash: 367b55c698236e9deb9517e2c3b1e21a2c944fee657e51ed8773b8fc4707bbd4
Instruction Fuzzy Hash: 5F419C34904BCA6EFFF1AAA488083B5BEE47F12344F08409DD5C5561C2DBD55ECC8792

Function 00094458 Relevance: 15.1, APIs: 10, Instructions: 83clipboardmemoryCOMMON

Download Yara Rule

APIs

OpenClipboard.USER32 ref: 0009447F
EmptyClipboard.USER32 ref: 00094485
GlobalAlloc.KERNEL32(00000002,?), ref: 0009449A
CloseClipboard.USER32 ref: 00094539

Memory Dump Source

Source File: 00000000.00000002.1643917647.0000000000021000.00000020.00000001.01000000.00000003.sdmp, Offset: 00020000, based on PE: true

Associated: 00000000.00000002.1643904003.0000000000020000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1643958107.00000000000AF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1643958107.00000000000D5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1643993044.00000000000DF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1644007204.00000000000E8000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_20000_Ship Docs_CI PL HBL COO_.jbxd

Similarity

API ID: Clipboard$AllocCloseEmptyGlobalOpen
String ID:
API String ID: 1737998785-0
Opcode ID: f671718eca3ab529f0d70b71340ac228bc0735b8816d5d7a4974671abe26fcbd
Instruction ID: db1b5f0fe93956a83404785903f9d300ddca717cce503121d43b8902446b636d
Opcode Fuzzy Hash: f671718eca3ab529f0d70b71340ac228bc0735b8816d5d7a4974671abe26fcbd
Instruction Fuzzy Hash: 8721A335700A219FEB109FA4EC49F7D7BA8EF05711F10802AF946DB262DB39AC01DB95

Function 00083A2B Relevance: 14.2, APIs: 7, Strings: 1, Instructions: 167fileCOMMON

Download Yara Rule

APIs

Part of subcall function 000248AE: GetFullPathNameW.KERNEL32(?,00007FFF,?,00000000,?,?,000248A1,?,?,000237C0,?), ref: 000248CE

Part of subcall function 00084CD3: GetFileAttributesW.KERNEL32(?,00083947), ref: 00084CD4

FindFirstFileW.KERNEL32(?,?), ref: 00083ADF
DeleteFileW.KERNEL32(?,?,00000000,?,?,?,?), ref: 00083B87
MoveFileW.KERNEL32(?,?), ref: 00083B9A
DeleteFileW.KERNEL32(?,?,?,?,?), ref: 00083BB7
FindNextFileW.KERNEL32(00000000,00000010), ref: 00083BD9
FindClose.KERNEL32(00000000,?,?,?,?), ref: 00083BF5

Strings

\*.*, xrefs: 00083A8A, 00083A93, 00083AA8

Memory Dump Source

Source File: 00000000.00000002.1643917647.0000000000021000.00000020.00000001.01000000.00000003.sdmp, Offset: 00020000, based on PE: true

Associated: 00000000.00000002.1643904003.0000000000020000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1643958107.00000000000AF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1643958107.00000000000D5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1643993044.00000000000DF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1644007204.00000000000E8000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_20000_Ship Docs_CI PL HBL COO_.jbxd

Similarity

API ID: File$Find$Delete$AttributesCloseFirstFullMoveNameNextPath
String ID: \*.*
API String ID: 4002782344-1173974218
Opcode ID: 84d6c8da5105fbced3fc998e6933ca73de90351a24b1c1bd4c53e40b0cc43d76
Instruction ID: 5e5d2f1b9f6192c98e6de39a5dc5b6b31b46917bff5e6ccedd9e488837a97bc9
Opcode Fuzzy Hash: 84d6c8da5105fbced3fc998e6933ca73de90351a24b1c1bd4c53e40b0cc43d76
Instruction Fuzzy Hash: CE51803180515D9ACF15FBA0DE929EDB7B8AF54700F6441A9E48677092EF306F09CBA1

Function 0008F65E Relevance: 12.4, APIs: 6, Strings: 1, Instructions: 120filesleepCOMMON

Download Yara Rule

APIs

Part of subcall function 00027F41: _memmove.LIBCMT ref: 00027F82

FindFirstFileW.KERNEL32(?,?,*.*,?,?,00000000,00000000), ref: 0008F6AB
Sleep.KERNEL32(0000000A), ref: 0008F6DB
_wcscmp.LIBCMT ref: 0008F6EF
_wcscmp.LIBCMT ref: 0008F70A
FindNextFileW.KERNEL32(?,?), ref: 0008F7A8
FindClose.KERNEL32(00000000), ref: 0008F7BE

Strings

*.*, xrefs: 0008F690

Memory Dump Source

Source File: 00000000.00000002.1643917647.0000000000021000.00000020.00000001.01000000.00000003.sdmp, Offset: 00020000, based on PE: true

Associated: 00000000.00000002.1643904003.0000000000020000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1643958107.00000000000AF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1643958107.00000000000D5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1643993044.00000000000DF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1644007204.00000000000E8000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_20000_Ship Docs_CI PL HBL COO_.jbxd

Similarity

API ID: Find$File_wcscmp$CloseFirstNextSleep_memmove
String ID: *.*
API String ID: 713712311-438819550
Opcode ID: 3a68b8dee70ff696f85c3b707364cdca550303d9a5b07f2510bbad5172bbae23
Instruction ID: 7a47762ed609786abdfc700aad65049356948844c03a7ae39d8cfd312fc280a1
Opcode Fuzzy Hash: 3a68b8dee70ff696f85c3b707364cdca550303d9a5b07f2510bbad5172bbae23
Instruction Fuzzy Hash: D1419D7190421A9BDF50EFB4CC85AFEBBB8FF05310F144566E854A21A1EB309E54CBA0

Function 00034140 Relevance: 11.6, APIs: 1, Strings: 5, Instructions: 1132COMMON

Download Yara Rule

Strings

ERCP, xrefs: 0003421F
VUUU, xrefs: 00034520
VUUU, xrefs: 000344DB
VUUU, xrefs: 000344ED
VUUU, xrefs: 00067B0C

Memory Dump Source

Source File: 00000000.00000002.1643917647.0000000000021000.00000020.00000001.01000000.00000003.sdmp, Offset: 00020000, based on PE: true

Associated: 00000000.00000002.1643904003.0000000000020000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1643958107.00000000000AF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1643958107.00000000000D5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1643993044.00000000000DF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1644007204.00000000000E8000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_20000_Ship Docs_CI PL HBL COO_.jbxd

Similarity

API ID:
String ID: ERCP$VUUU$VUUU$VUUU$VUUU
API String ID: 0-1546025612
Opcode ID: 23bace0aade576b1f8ff356b7d1e3eb97c4f38fc9385c4ba82da8244f07b6f78
Instruction ID: e05d5e8fc59ad0c3cbffedf2c9b1cf7c6cd4f98708da7e1215a150686a896922
Opcode Fuzzy Hash: 23bace0aade576b1f8ff356b7d1e3eb97c4f38fc9385c4ba82da8244f07b6f78
Instruction Fuzzy Hash: 8BA29F70E0421ACBDF75CF58C9807ADB7F6BF54314F2485AAD859AB280E770AE81CB51

Function 000358C0 Relevance: 11.0, APIs: 7, Instructions: 532COMMON

Download Yara Rule

APIs

_memmove.LIBCMT ref: 00035A05
_memmove.LIBCMT ref: 00035A55
_memmove.LIBCMT ref: 00035ABB

Memory Dump Source

Source File: 00000000.00000002.1643917647.0000000000021000.00000020.00000001.01000000.00000003.sdmp, Offset: 00020000, based on PE: true

Associated: 00000000.00000002.1643904003.0000000000020000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1643958107.00000000000AF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1643958107.00000000000D5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1643993044.00000000000DF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1644007204.00000000000E8000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_20000_Ship Docs_CI PL HBL COO_.jbxd

Similarity

API ID: _memmove
String ID:
API String ID: 4104443479-0
Opcode ID: 69dd07173d4170340f3cdd3cc299b206bd9996f4bf5c1118de102eafb541236f
Instruction ID: 758877df815134e4d7f32b9d961e1439ffb3acd80dcece2b5f056b06a3c74b21
Opcode Fuzzy Hash: 69dd07173d4170340f3cdd3cc299b206bd9996f4bf5c1118de102eafb541236f
Instruction Fuzzy Hash: 10128E70A00609DFDF14DFA5D981AEEB7F9FF48300F108669E406A7261EB39AD11CB55

Function 0008545F Relevance: 10.6, APIs: 3, Strings: 3, Instructions: 59shutdownCOMMON

Download Yara Rule

APIs

Part of subcall function 00078CC3: LookupPrivilegeValueW.ADVAPI32(00000000,00000000,00000004), ref: 00078D0D
Part of subcall function 00078CC3: AdjustTokenPrivileges.ADVAPI32(?,00000000,00000000,?,00000000,?), ref: 00078D3A
Part of subcall function 00078CC3: GetLastError.KERNEL32 ref: 00078D47

ExitWindowsEx.USER32(?,00000000), ref: 0008549B

Strings

, xrefs: 00085489
SeShutdownPrivilege, xrefs: 0008546B
@, xrefs: 0008548E

Memory Dump Source

Source File: 00000000.00000002.1643917647.0000000000021000.00000020.00000001.01000000.00000003.sdmp, Offset: 00020000, based on PE: true

Associated: 00000000.00000002.1643904003.0000000000020000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1643958107.00000000000AF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1643958107.00000000000D5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1643993044.00000000000DF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1644007204.00000000000E8000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_20000_Ship Docs_CI PL HBL COO_.jbxd

Similarity

API ID: AdjustErrorExitLastLookupPrivilegePrivilegesTokenValueWindows
String ID: $@$SeShutdownPrivilege
API String ID: 2234035333-194228
Opcode ID: a669b63139d06d448e19a53fa0d1d5ff2153efed4cd6e1e25d63966b7a518385
Instruction ID: 6932bb854e7364009a856104d16ebc72a811f00a957959fb701effbb204e5a77
Opcode Fuzzy Hash: a669b63139d06d448e19a53fa0d1d5ff2153efed4cd6e1e25d63966b7a518385
Instruction Fuzzy Hash: AB014C31A95B115AF77872B4DC4ABBA7298FB01757F201031FD87D20C3D5644C8083A0

Function 00096596 Relevance: 9.1, APIs: 6, Instructions: 84networkCOMMON

Download Yara Rule

APIs

socket.WSOCK32(00000002,00000001,00000006,?,00000002,00000000), ref: 000965EF
WSAGetLastError.WSOCK32(00000000), ref: 000965FE
bind.WSOCK32(00000000,?,00000010), ref: 0009661A
listen.WSOCK32(00000000,00000005), ref: 00096629
WSAGetLastError.WSOCK32(00000000), ref: 00096643
closesocket.WSOCK32(00000000,00000000), ref: 00096657

Memory Dump Source

Source File: 00000000.00000002.1643917647.0000000000021000.00000020.00000001.01000000.00000003.sdmp, Offset: 00020000, based on PE: true

Associated: 00000000.00000002.1643904003.0000000000020000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1643958107.00000000000AF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1643958107.00000000000D5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1643993044.00000000000DF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1644007204.00000000000E8000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_20000_Ship Docs_CI PL HBL COO_.jbxd

Similarity

API ID: ErrorLast$bindclosesocketlistensocket
String ID:
API String ID: 1279440585-0
Opcode ID: 99273aa7a041762dcf1074bb6e0e64c1214b8e35e1c82db754e7b3b2ae4187dc
Instruction ID: 4ed8fa9d5b28e63c45f22834c0c7b959bc616b53332e85286c56b877d9b15bb2
Opcode Fuzzy Hash: 99273aa7a041762dcf1074bb6e0e64c1214b8e35e1c82db754e7b3b2ae4187dc
Instruction Fuzzy Hash: 9621CE30600610AFDF10AF64D845A7EB7E9EF45720F108159F95AA73D2CB34AD01DB51

Function 00035680 Relevance: 8.0, APIs: 5, Instructions: 516COMMON

Download Yara Rule

APIs

Part of subcall function 00040FF6: std::exception::exception.LIBCMT ref: 0004102C
Part of subcall function 00040FF6: __CxxThrowException@8.LIBCMT ref: 00041041

_memmove.LIBCMT ref: 0007062F
_memmove.LIBCMT ref: 00070744
_memmove.LIBCMT ref: 000707EB

Memory Dump Source

Source File: 00000000.00000002.1643917647.0000000000021000.00000020.00000001.01000000.00000003.sdmp, Offset: 00020000, based on PE: true

Associated: 00000000.00000002.1643904003.0000000000020000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1643958107.00000000000AF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1643958107.00000000000D5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1643993044.00000000000DF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1644007204.00000000000E8000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_20000_Ship Docs_CI PL HBL COO_.jbxd

Similarity

API ID: _memmove$Exception@8Throwstd::exception::exception
String ID:
API String ID: 1300846289-0
Opcode ID: 8a0f2de50501da513a848d633cca4f78cea639647fdb98892478bf22ebf971a7
Instruction ID: 304bfeaafc2ae5ba20971461eb10eb152718e41bf612aacead6d402313df0657
Opcode Fuzzy Hash: 8a0f2de50501da513a848d633cca4f78cea639647fdb98892478bf22ebf971a7
Instruction Fuzzy Hash: 9F029FB0E00205DBDF15DF64D981AAEBBF5EF44300F14C069E80AEB296EB35DA54CB95

Function 00021287 Relevance: 7.9, APIs: 5, Instructions: 379COMMON

Download Yara Rule

APIs

Part of subcall function 00022612: GetWindowLongW.USER32(?,000000EB), ref: 00022623

DefDlgProcW.USER32(?,?,?,?,?), ref: 000219FA
GetSysColor.USER32(0000000F), ref: 00021A4E
SetBkColor.GDI32(?,00000000), ref: 00021A61

Part of subcall function 00021290: DefDlgProcW.USER32(?,00000020,?), ref: 000212D8

Memory Dump Source

Source File: 00000000.00000002.1643917647.0000000000021000.00000020.00000001.01000000.00000003.sdmp, Offset: 00020000, based on PE: true

Associated: 00000000.00000002.1643904003.0000000000020000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1643958107.00000000000AF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1643958107.00000000000D5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1643993044.00000000000DF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1644007204.00000000000E8000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_20000_Ship Docs_CI PL HBL COO_.jbxd

Similarity

API ID: ColorProc$LongWindow
String ID:
API String ID: 3744519093-0
Opcode ID: 149555587d2ece5f9f3553890e99fbe6fadcd9d4f55d617ed54537f74f7a8e86
Instruction ID: 5b9996ea693029a6699284b0244ace42b3e4c03fe66945d33c641213cdd8b4d4
Opcode Fuzzy Hash: 149555587d2ece5f9f3553890e99fbe6fadcd9d4f55d617ed54537f74f7a8e86
Instruction Fuzzy Hash: E1A17B711054A4BEF638AB687C49EFF35DCDB66382F14011AF802D6192CF279D0192B7

Function 00096A5A Relevance: 7.6, APIs: 5, Instructions: 141networkCOMMON

Download Yara Rule

APIs

Part of subcall function 000980A0: inet_addr.WSOCK32(00000000,?,00000000,?,?,?,00000000), ref: 000980CB

socket.WSOCK32(00000002,00000002,00000011,?,?,00000000), ref: 00096AB1
WSAGetLastError.WSOCK32(00000000), ref: 00096ADA
bind.WSOCK32(00000000,?,00000010), ref: 00096B13
WSAGetLastError.WSOCK32(00000000), ref: 00096B20
closesocket.WSOCK32(00000000,00000000), ref: 00096B34

Memory Dump Source

Source File: 00000000.00000002.1643917647.0000000000021000.00000020.00000001.01000000.00000003.sdmp, Offset: 00020000, based on PE: true

Associated: 00000000.00000002.1643904003.0000000000020000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1643958107.00000000000AF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1643958107.00000000000D5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1643993044.00000000000DF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1644007204.00000000000E8000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_20000_Ship Docs_CI PL HBL COO_.jbxd

Similarity

API ID: ErrorLast$bindclosesocketinet_addrsocket
String ID:
API String ID: 99427753-0
Opcode ID: e45db4ae28b01a52a6397c87e616497ee449fbcd1d9fcb0be647fef8b6764eb6
Instruction ID: d54d9bd88aaba754d4991a53ed0ea02037245384304897e549ac3cd300f19c14
Opcode Fuzzy Hash: e45db4ae28b01a52a6397c87e616497ee449fbcd1d9fcb0be647fef8b6764eb6
Instruction Fuzzy Hash: 8C41A575A00620AFEF10AF64EC86FBE77A59B49710F04805CF95AAB3D3DA755D008B91

Function 000A55FD Relevance: 7.6, APIs: 5, Instructions: 69windowCOMMON

Download Yara Rule

APIs

IsWindowVisible.USER32 ref: 000A564C
IsWindowEnabled.USER32 ref: 000A565A
GetForegroundWindow.USER32(?,?,00000001), ref: 000A5667
IsIconic.USER32 ref: 000A5675
IsZoomed.USER32 ref: 000A5683

Memory Dump Source

Source File: 00000000.00000002.1643917647.0000000000021000.00000020.00000001.01000000.00000003.sdmp, Offset: 00020000, based on PE: true

Associated: 00000000.00000002.1643904003.0000000000020000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1643958107.00000000000AF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1643958107.00000000000D5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1643993044.00000000000DF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1644007204.00000000000E8000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_20000_Ship Docs_CI PL HBL COO_.jbxd

Similarity

API ID: Window$EnabledForegroundIconicVisibleZoomed
String ID:
API String ID: 292994002-0
Opcode ID: 7fbca9ee00aba455a273311925bfd40b3a7b01510d9246d657959d7ae2303823
Instruction ID: 78c1f75075e48b9ff63ed4fb6492e021d426538a877ec2a62155a051aca6b35f
Opcode Fuzzy Hash: 7fbca9ee00aba455a273311925bfd40b3a7b01510d9246d657959d7ae2303823
Instruction Fuzzy Hash: 3211C431B00A216FE7215FA6DC44AAF77D9FF46722F444029F846D7241CB349901CAA5

Function 0008C602 Relevance: 7.3, APIs: 3, Strings: 1, Instructions: 279comCOMMON

Download Yara Rule

APIs

CoInitialize.OLE32(00000000), ref: 0008C69D
CoCreateInstance.OLE32(000B2D6C,00000000,00000001,000B2BDC,?), ref: 0008C6B5

Part of subcall function 00027F41: _memmove.LIBCMT ref: 00027F82

CoUninitialize.OLE32 ref: 0008C922

Strings

.lnk, xrefs: 0008C631, 0008C659, 0008C663

Memory Dump Source

Source File: 00000000.00000002.1643917647.0000000000021000.00000020.00000001.01000000.00000003.sdmp, Offset: 00020000, based on PE: true

Associated: 00000000.00000002.1643904003.0000000000020000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1643958107.00000000000AF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1643958107.00000000000D5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1643993044.00000000000DF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1644007204.00000000000E8000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_20000_Ship Docs_CI PL HBL COO_.jbxd

Similarity

API ID: CreateInitializeInstanceUninitialize_memmove
String ID: .lnk
API String ID: 2683427295-24824748
Opcode ID: 01d756b1f721d1df0392052e72836f22e63691c743a2cd3e10034f71020ec1c5
Instruction ID: 968c7611e86a7a8eace6c6db154ef2bed30072366f3211ecf8b0fbd727dfc759
Opcode Fuzzy Hash: 01d756b1f721d1df0392052e72836f22e63691c743a2cd3e10034f71020ec1c5
Instruction Fuzzy Hash: 86A13B71108215AFD700EF54D892EABB7E8EF84704F04496CF59697192EB71AA09CBA2

Function 0009C304 Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 19libraryloaderCOMMON

Download Yara Rule

APIs

LoadLibraryA.KERNEL32(kernel32.dll,?,00061D88,?), ref: 0009C312
GetProcAddress.KERNEL32(00000000,GetSystemWow64DirectoryW), ref: 0009C324

Strings

GetSystemWow64DirectoryW, xrefs: 0009C31E
kernel32.dll, xrefs: 0009C30D

Memory Dump Source

Source File: 00000000.00000002.1643917647.0000000000021000.00000020.00000001.01000000.00000003.sdmp, Offset: 00020000, based on PE: true

Associated: 00000000.00000002.1643904003.0000000000020000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1643958107.00000000000AF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1643958107.00000000000D5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1643993044.00000000000DF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1644007204.00000000000E8000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_20000_Ship Docs_CI PL HBL COO_.jbxd

Similarity

API ID: AddressLibraryLoadProc
String ID: GetSystemWow64DirectoryW$kernel32.dll
API String ID: 2574300362-1816364905
Opcode ID: 558901d82c30cb6f26452cde43987b183f9a165d87c43259fa733721bae922c8
Instruction ID: 770c2beecbd7dd0e3d39841d12e2aa404553b5775b4d294a892dd8fdce506242
Opcode Fuzzy Hash: 558901d82c30cb6f26452cde43987b183f9a165d87c43259fa733721bae922c8
Instruction Fuzzy Hash: 4FE0C270A10B03CFFF304FA9C814E9676E4EF09745B80C439E8A5C6210E774D840CB60

Function 00033190 Relevance: 6.6, APIs: 4, Instructions: 587COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1643917647.0000000000021000.00000020.00000001.01000000.00000003.sdmp, Offset: 00020000, based on PE: true

Associated: 00000000.00000002.1643904003.0000000000020000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1643958107.00000000000AF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1643958107.00000000000D5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1643993044.00000000000DF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1644007204.00000000000E8000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_20000_Ship Docs_CI PL HBL COO_.jbxd

Similarity

API ID: __itow__swprintf
String ID:
API String ID: 674341424-0
Opcode ID: 8cb46668ec8e75aa8b215e9dbeb0a416a008fb93655d4a34e794216270c9df0a
Instruction ID: 9695c5d4c978edc46c3384dcc90581b2a1abec775aaa63abbd88c00ea3e6f3a1
Opcode Fuzzy Hash: 8cb46668ec8e75aa8b215e9dbeb0a416a008fb93655d4a34e794216270c9df0a
Instruction Fuzzy Hash: 9122C0716083119FD725DF24C891BAFB7E9BF84704F10492DF89A97292DB31EA44CB92

Function 0009F121 Relevance: 6.2, APIs: 4, Instructions: 164processCOMMON

Download Yara Rule

APIs

CreateToolhelp32Snapshot.KERNEL32 ref: 0009F151
Process32FirstW.KERNEL32(00000000,?), ref: 0009F15F

Part of subcall function 00027F41: _memmove.LIBCMT ref: 00027F82

Process32NextW.KERNEL32(00000000,?), ref: 0009F21F
CloseHandle.KERNEL32(00000000,?,?,?), ref: 0009F22E

Memory Dump Source

Source File: 00000000.00000002.1643917647.0000000000021000.00000020.00000001.01000000.00000003.sdmp, Offset: 00020000, based on PE: true

Associated: 00000000.00000002.1643904003.0000000000020000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1643958107.00000000000AF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1643958107.00000000000D5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1643993044.00000000000DF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1644007204.00000000000E8000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_20000_Ship Docs_CI PL HBL COO_.jbxd

Similarity

API ID: Process32$CloseCreateFirstHandleNextSnapshotToolhelp32_memmove
String ID:
API String ID: 2576544623-0
Opcode ID: e33db532adaa2b1271beadfa0af9bcf7749515cb381a49eee7467a96c0262065
Instruction ID: a4e7c892a6c4c33417a618b82d78fa18a9d2bf7fad4c12080fe2088b786f5c62
Opcode Fuzzy Hash: e33db532adaa2b1271beadfa0af9bcf7749515cb381a49eee7467a96c0262065
Instruction Fuzzy Hash: 9F515E715087119FD710EF24EC86EABBBE8FF98710F14482DF59597252EB709904CB92

Function 0007EB07 Relevance: 5.1, APIs: 1, Strings: 2, Instructions: 561stringCOMMON

Download Yara Rule

APIs

lstrlenW.KERNEL32(?,?,?,00000000), ref: 0007EB19

Strings

|, xrefs: 0007EB49
(, xrefs: 0007EB5F

Memory Dump Source

Source File: 00000000.00000002.1643917647.0000000000021000.00000020.00000001.01000000.00000003.sdmp, Offset: 00020000, based on PE: true

Associated: 00000000.00000002.1643904003.0000000000020000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1643958107.00000000000AF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1643958107.00000000000D5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1643993044.00000000000DF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1644007204.00000000000E8000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_20000_Ship Docs_CI PL HBL COO_.jbxd

Similarity

API ID: lstrlen
String ID: ($|
API String ID: 1659193697-1631851259
Opcode ID: 64db8027c85aa1915a7459f64e01bc0ab9d4f4bc5cef5b2b43e967fdafb5bcc8
Instruction ID: ffbcacf0bb34d1dbcf7408763f5bc841a4f554bc082e36f7a8dfa77c04d7e78a
Opcode Fuzzy Hash: 64db8027c85aa1915a7459f64e01bc0ab9d4f4bc5cef5b2b43e967fdafb5bcc8
Instruction Fuzzy Hash: 3E323675A007059FD728CF29C481A6AB7F1FF48310B15C5AEE89ADB7A2E770E941CB44

Function 000925E2 Relevance: 4.7, APIs: 3, Instructions: 164networkfileCOMMON

Download Yara Rule

APIs

InternetQueryDataAvailable.WININET(00000001,?,00000000,00000000), ref: 000926D5
InternetReadFile.WININET(00000001,00000000,00000001,00000001), ref: 0009270C

Memory Dump Source

Source File: 00000000.00000002.1643917647.0000000000021000.00000020.00000001.01000000.00000003.sdmp, Offset: 00020000, based on PE: true

Associated: 00000000.00000002.1643904003.0000000000020000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1643958107.00000000000AF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1643958107.00000000000D5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1643993044.00000000000DF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1644007204.00000000000E8000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_20000_Ship Docs_CI PL HBL COO_.jbxd

Similarity

API ID: Internet$AvailableDataFileQueryRead
String ID:
API String ID: 599397726-0
Opcode ID: adcaa93bbab766719a40da939c76a904c9cc422970e88de5444361f18b8fca4a
Instruction ID: 72d7bdf71d9fd01ffda5623c49df968d37ace2b499edfd2f0d8aaa021ca07de4
Opcode Fuzzy Hash: adcaa93bbab766719a40da939c76a904c9cc422970e88de5444361f18b8fca4a
Instruction Fuzzy Hash: D941E4B5604709BFEF20DE94DC85EFFB7FCEB40724F10406AF601A6541EA719E81A664

Function 0008B59E Relevance: 4.6, APIs: 3, Instructions: 73COMMON

Download Yara Rule

APIs

SetErrorMode.KERNEL32(00000001), ref: 0008B5AE
GetDiskFreeSpaceExW.KERNEL32(?,?,?,?), ref: 0008B608
SetErrorMode.KERNEL32(00000000,00000001,00000000), ref: 0008B655

Memory Dump Source

Source File: 00000000.00000002.1643917647.0000000000021000.00000020.00000001.01000000.00000003.sdmp, Offset: 00020000, based on PE: true

Associated: 00000000.00000002.1643904003.0000000000020000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1643958107.00000000000AF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1643958107.00000000000D5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1643993044.00000000000DF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1644007204.00000000000E8000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_20000_Ship Docs_CI PL HBL COO_.jbxd

Similarity

API ID: ErrorMode$DiskFreeSpace
String ID:
API String ID: 1682464887-0
Opcode ID: e0d4f4f365e76f61b1390dc1b3a42577db2f21edf0f0e9d6190184281e7da6e4
Instruction ID: 4128373ec557c415f75661aaab8f9377e76308564fbd991832f9aaf53eb054e0
Opcode Fuzzy Hash: e0d4f4f365e76f61b1390dc1b3a42577db2f21edf0f0e9d6190184281e7da6e4
Instruction Fuzzy Hash: 9C219035A00618EFDB00EFA5D881AEDBBB8FF49310F0480A9E845AB352DB359915CB51

Function 00078CC3 Relevance: 4.6, APIs: 3, Instructions: 67COMMON

Download Yara Rule

APIs

Part of subcall function 00040FF6: std::exception::exception.LIBCMT ref: 0004102C
Part of subcall function 00040FF6: __CxxThrowException@8.LIBCMT ref: 00041041

LookupPrivilegeValueW.ADVAPI32(00000000,00000000,00000004), ref: 00078D0D
AdjustTokenPrivileges.ADVAPI32(?,00000000,00000000,?,00000000,?), ref: 00078D3A
GetLastError.KERNEL32 ref: 00078D47

Memory Dump Source

Source File: 00000000.00000002.1643917647.0000000000021000.00000020.00000001.01000000.00000003.sdmp, Offset: 00020000, based on PE: true

Associated: 00000000.00000002.1643904003.0000000000020000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1643958107.00000000000AF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1643958107.00000000000D5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1643993044.00000000000DF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1644007204.00000000000E8000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_20000_Ship Docs_CI PL HBL COO_.jbxd

Similarity

API ID: AdjustErrorException@8LastLookupPrivilegePrivilegesThrowTokenValuestd::exception::exception
String ID:
API String ID: 1922334811-0
Opcode ID: 49223bed83b0373f1ed5351d0f33f06bc08a22d3bca1c66c0bb8f8eb576f91d7
Instruction ID: df1f308de4baf4272538ed3044616cb91409d55e751a1881e41b45982e5ed218
Opcode Fuzzy Hash: 49223bed83b0373f1ed5351d0f33f06bc08a22d3bca1c66c0bb8f8eb576f91d7
Instruction Fuzzy Hash: D811B2B1814205AFE7289F64DC89D6BB7FCFB04710B10C52EF44597641DB34AC408B24

Function 00084021 Relevance: 4.6, APIs: 3, Instructions: 61fileCOMMON

Download Yara Rule

APIs

CreateFileW.KERNEL32(?,00000080,00000003,00000000,00000003,00000080,00000000), ref: 0008404B
DeviceIoControl.KERNEL32(00000000,002D1400,00000007,0000000C,?,0000000C,?,00000000), ref: 00084088
CloseHandle.KERNEL32(00000000,?,?,00000080,00000003,00000000,00000003,00000080,00000000), ref: 00084091

Memory Dump Source

Source File: 00000000.00000002.1643917647.0000000000021000.00000020.00000001.01000000.00000003.sdmp, Offset: 00020000, based on PE: true

Associated: 00000000.00000002.1643904003.0000000000020000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1643958107.00000000000AF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1643958107.00000000000D5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1643993044.00000000000DF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1644007204.00000000000E8000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_20000_Ship Docs_CI PL HBL COO_.jbxd

Similarity

API ID: CloseControlCreateDeviceFileHandle
String ID:
API String ID: 33631002-0
Opcode ID: 18ffa93fc303170159a4986c20c7a216660c99fbdd7049c71e3071c9974ba6fa
Instruction ID: 0cb0986772b590f9c90a3a65bd469c17f9faf9c0c95ef6cdcf60a33acef74eb9
Opcode Fuzzy Hash: 18ffa93fc303170159a4986c20c7a216660c99fbdd7049c71e3071c9974ba6fa
Instruction Fuzzy Hash: F61152B1D04229BEE720DBE8DC44FBFBBBCEB09750F100656BA44E7191D2785D458BA1

Function 00084C03 Relevance: 4.5, APIs: 3, Instructions: 43memoryCOMMON

Download Yara Rule

APIs

AllocateAndInitializeSid.ADVAPI32(?,00000002,00000020,00000220,00000000,00000000,00000000,00000000,00000000,00000000,?), ref: 00084C2C
CheckTokenMembership.ADVAPI32(00000000,?,?), ref: 00084C43
FreeSid.ADVAPI32(?), ref: 00084C53

Memory Dump Source

Source File: 00000000.00000002.1643917647.0000000000021000.00000020.00000001.01000000.00000003.sdmp, Offset: 00020000, based on PE: true

Associated: 00000000.00000002.1643904003.0000000000020000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1643958107.00000000000AF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1643958107.00000000000D5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1643993044.00000000000DF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1644007204.00000000000E8000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_20000_Ship Docs_CI PL HBL COO_.jbxd

Similarity

API ID: AllocateCheckFreeInitializeMembershipToken
String ID:
API String ID: 3429775523-0
Opcode ID: a0722ab54917a20cfa07e1e4a95b63b5e5a3cec17763dd8736f468535abd2f0b
Instruction ID: 81205d09fcd23289719d49d791c20b1161e7d013c202b959bc0faf44e7774009
Opcode Fuzzy Hash: a0722ab54917a20cfa07e1e4a95b63b5e5a3cec17763dd8736f468535abd2f0b
Instruction Fuzzy Hash: 20F03775A11209BBEB04DFE09C89EBEBBBCEB08201F0044A9A901E2181E6746A048B50

Function 0002E060 Relevance: 3.5, APIs: 2, Instructions: 539COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1643917647.0000000000021000.00000020.00000001.01000000.00000003.sdmp, Offset: 00020000, based on PE: true

Associated: 00000000.00000002.1643904003.0000000000020000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1643958107.00000000000AF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1643958107.00000000000D5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1643993044.00000000000DF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1644007204.00000000000E8000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_20000_Ship Docs_CI PL HBL COO_.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ea125c0918c6cf0ce2798f761ab16795c46a311613e0d93ac1c38fb19d562ab9
Instruction ID: 2ac166cdca09dbd41cf73655a071ddedbaae90b847ae1748e62b7f7f3afe3e58
Opcode Fuzzy Hash: ea125c0918c6cf0ce2798f761ab16795c46a311613e0d93ac1c38fb19d562ab9
Instruction Fuzzy Hash: 1522D070A40266CFDB24DF54E484ABEB7F1FF08310F148169E956AB342E774AE85CB91

Function 0008C93C Relevance: 3.1, APIs: 2, Instructions: 52fileCOMMON

Download Yara Rule

APIs

FindFirstFileW.KERNEL32(?,?), ref: 0008C966
FindClose.KERNEL32(00000000), ref: 0008C996

Memory Dump Source

Source File: 00000000.00000002.1643917647.0000000000021000.00000020.00000001.01000000.00000003.sdmp, Offset: 00020000, based on PE: true

Associated: 00000000.00000002.1643904003.0000000000020000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1643958107.00000000000AF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1643958107.00000000000D5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1643993044.00000000000DF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1644007204.00000000000E8000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_20000_Ship Docs_CI PL HBL COO_.jbxd

Similarity

API ID: Find$CloseFileFirst
String ID:
API String ID: 2295610775-0
Opcode ID: d80ae8ceeab444ac2a6ef3d2f42258412bb5ef6cdb7505a2e990d77440466da8
Instruction ID: 38a8914bfd27ed7703c27f840f61abab5f2bfd01a51e146cb66a76859769caa5
Opcode Fuzzy Hash: d80ae8ceeab444ac2a6ef3d2f42258412bb5ef6cdb7505a2e990d77440466da8
Instruction Fuzzy Hash: EC11A5326006109FD710EF29D845A6AF7E5FF45320F00895EF8A9D7291DB34AC00CB91

Function 0008A2D5 Relevance: 3.0, APIs: 2, Instructions: 31windowCOMMON

Download Yara Rule

APIs

GetLastError.KERNEL32(00000000,?,00000FFF,00000000,00000016,?,0009977D,?,000AFB84,?), ref: 0008A302
FormatMessageW.KERNEL32(00001000,00000000,000000FF,00000000,?,00000FFF,00000000,00000016,?,0009977D,?,000AFB84,?), ref: 0008A314

Memory Dump Source

Source File: 00000000.00000002.1643917647.0000000000021000.00000020.00000001.01000000.00000003.sdmp, Offset: 00020000, based on PE: true

Associated: 00000000.00000002.1643904003.0000000000020000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1643958107.00000000000AF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1643958107.00000000000D5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1643993044.00000000000DF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1644007204.00000000000E8000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_20000_Ship Docs_CI PL HBL COO_.jbxd

Similarity

API ID: ErrorFormatLastMessage
String ID:
API String ID: 3479602957-0
Opcode ID: 3f7afcbb39e49d66203385d49d2ed76a73ac5b6c1f324b305ac37bc6a6afa669
Instruction ID: 2e819b905cf25382be291918d73f8075f3764f9cea3dd123bc967ecfb32038ee
Opcode Fuzzy Hash: 3f7afcbb39e49d66203385d49d2ed76a73ac5b6c1f324b305ac37bc6a6afa669
Instruction Fuzzy Hash: FCF0823564422DBBEB20AFA4CC48FEA776DBF09762F004166B948D6181D6309A44CBE1

Function 00078713 Relevance: 3.0, APIs: 2, Instructions: 22COMMON

Download Yara Rule

APIs

AdjustTokenPrivileges.ADVAPI32(?,00000000,?,00000000,00000000,00000000,?,00078851), ref: 00078728
CloseHandle.KERNEL32(?,?,00078851), ref: 0007873A

Memory Dump Source

Source File: 00000000.00000002.1643917647.0000000000021000.00000020.00000001.01000000.00000003.sdmp, Offset: 00020000, based on PE: true

Associated: 00000000.00000002.1643904003.0000000000020000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1643958107.00000000000AF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1643958107.00000000000D5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1643993044.00000000000DF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1644007204.00000000000E8000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_20000_Ship Docs_CI PL HBL COO_.jbxd

Similarity

API ID: AdjustCloseHandlePrivilegesToken
String ID:
API String ID: 81990902-0
Opcode ID: fc51eeacaedf3a53d82060f90b1d3cc0c9cc6f9e86e75413d88763a4642cb5f8
Instruction ID: 934bd15e194a8ee619c020e0f51444cc93725645dd99674e9cfb785028c241f8
Opcode Fuzzy Hash: fc51eeacaedf3a53d82060f90b1d3cc0c9cc6f9e86e75413d88763a4642cb5f8
Instruction Fuzzy Hash: 61E04672000A01EEEB252B60EC08DB37BE9EB003507208839B49680431CB62ACE0DB10

Function 0004A395 Relevance: 3.0, APIs: 2, Instructions: 8COMMONLIBRARYCODE

Download Yara Rule

APIs

SetUnhandledExceptionFilter.KERNEL32(00000000,?,00048F97,?,?,?,00000001), ref: 0004A39A
UnhandledExceptionFilter.KERNEL32(?,?,?,00000001), ref: 0004A3A3

Memory Dump Source

Source File: 00000000.00000002.1643917647.0000000000021000.00000020.00000001.01000000.00000003.sdmp, Offset: 00020000, based on PE: true

Associated: 00000000.00000002.1643904003.0000000000020000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1643958107.00000000000AF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1643958107.00000000000D5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1643993044.00000000000DF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1644007204.00000000000E8000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_20000_Ship Docs_CI PL HBL COO_.jbxd

Similarity

API ID: ExceptionFilterUnhandled
String ID:
API String ID: 3192549508-0
Opcode ID: b0dc7734f3bc00b3aad154c24d373d23a4fcfde39065b05d78ea1b097cc91fd5
Instruction ID: 8eb26ffcfb958aed445ca6e6b707e421638f24306f76202c051f4e7373a61562
Opcode Fuzzy Hash: b0dc7734f3bc00b3aad154c24d373d23a4fcfde39065b05d78ea1b097cc91fd5
Instruction Fuzzy Hash: 54B0923205460AABEF002BD1EC59BA83F68EB46AA2F404020F60D84060CBE656508A91

Function 0004F419 Relevance: 2.1, APIs: 1, Instructions: 645COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1643917647.0000000000021000.00000020.00000001.01000000.00000003.sdmp, Offset: 00020000, based on PE: true

Associated: 00000000.00000002.1643904003.0000000000020000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1643958107.00000000000AF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1643958107.00000000000D5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1643993044.00000000000DF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1644007204.00000000000E8000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_20000_Ship Docs_CI PL HBL COO_.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b1a05da662e97d70db29166ec363e4228a43aeb62d956b8b368dea606a04f578
Instruction ID: d2bf8c326c1dbaa3a822b533bbe4d6fa34f1d2d13dd07ddc025e12de07a2e377
Opcode Fuzzy Hash: b1a05da662e97d70db29166ec363e4228a43aeb62d956b8b368dea606a04f578
Instruction Fuzzy Hash: 6C322661D69F024DEB639634DC72335A288EFB73C4F15D737E819B5AA6EB28C4834104

Function 0005267E Relevance: 1.8, APIs: 1, Instructions: 294COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1643917647.0000000000021000.00000020.00000001.01000000.00000003.sdmp, Offset: 00020000, based on PE: true

Associated: 00000000.00000002.1643904003.0000000000020000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1643958107.00000000000AF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1643958107.00000000000D5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1643993044.00000000000DF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1644007204.00000000000E8000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_20000_Ship Docs_CI PL HBL COO_.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 26e56efa24915c3821e3d2c1245e37eb3c34e25c70ef4d231ea3487f2f1bcb40
Instruction ID: 4af3f52b1f99cb0e9be554e98cd873ca6ca3bdd1908291c8f6626f055663cf7d
Opcode Fuzzy Hash: 26e56efa24915c3821e3d2c1245e37eb3c34e25c70ef4d231ea3487f2f1bcb40
Instruction Fuzzy Hash: 37B10120E2AF414DE72396398835336BB8CAFBB6C5F51D71BFC2674D22EB2585834241

Function 00088B13 Relevance: 1.6, APIs: 1, Instructions: 68COMMON

Download Yara Rule

APIs

__time64.LIBCMT ref: 00088B25

Part of subcall function 0004543A: GetSystemTimeAsFileTime.KERNEL32(00000000,?,?,?,000891F8,00000000,?,?,?,?,000893A9,00000000,?), ref: 00045443
Part of subcall function 0004543A: __aulldiv.LIBCMT ref: 00045463

Memory Dump Source

Source File: 00000000.00000002.1643917647.0000000000021000.00000020.00000001.01000000.00000003.sdmp, Offset: 00020000, based on PE: true

Associated: 00000000.00000002.1643904003.0000000000020000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1643958107.00000000000AF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1643958107.00000000000D5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1643993044.00000000000DF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1644007204.00000000000E8000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_20000_Ship Docs_CI PL HBL COO_.jbxd

Similarity

API ID: Time$FileSystem__aulldiv__time64
String ID:
API String ID: 2893107130-0
Opcode ID: c861c6dfa021452ff5ba5dee3d8c328cc7a49ce03266da40b8ec2ef5c1513037
Instruction ID: b2c157183f4e1700615efe1372b1f8536bb34ae229639697ef0e10d7c5e01714
Opcode Fuzzy Hash: c861c6dfa021452ff5ba5dee3d8c328cc7a49ce03266da40b8ec2ef5c1513037
Instruction Fuzzy Hash: 6021E4726356108FD729CF25D841A52B3E1EFA4311B688E6CD0E9CF2D0CA74BD05CB94

Function 000941FD Relevance: 1.5, APIs: 1, Instructions: 25keyboardCOMMON

Download Yara Rule

APIs

BlockInput.USER32(00000001), ref: 00094218

Memory Dump Source

Source File: 00000000.00000002.1643917647.0000000000021000.00000020.00000001.01000000.00000003.sdmp, Offset: 00020000, based on PE: true

Associated: 00000000.00000002.1643904003.0000000000020000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1643958107.00000000000AF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1643958107.00000000000D5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1643993044.00000000000DF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1644007204.00000000000E8000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_20000_Ship Docs_CI PL HBL COO_.jbxd

Similarity

API ID: BlockInput
String ID:
API String ID: 3456056419-0
Opcode ID: cfb20d26386464b543d252ffc221d976486ae073a10ccbfcdc3b9f3417a9661e
Instruction ID: 533e650673cd890328e4a45fac536ab98dcd550bbcf39565ae1fbc018a67de93
Opcode Fuzzy Hash: cfb20d26386464b543d252ffc221d976486ae073a10ccbfcdc3b9f3417a9661e
Instruction Fuzzy Hash: 87E04F312442149FDB10EF59E845E9AF7E8AF98760F008026FC49C7352DA70E8418BA1

Function 00084EC9 Relevance: 1.5, APIs: 1, Instructions: 24COMMON

Download Yara Rule

APIs

mouse_event.USER32(00000002,00000000,00000000,00000000,00000000), ref: 00084EEC

Memory Dump Source

Source File: 00000000.00000002.1643917647.0000000000021000.00000020.00000001.01000000.00000003.sdmp, Offset: 00020000, based on PE: true

Associated: 00000000.00000002.1643904003.0000000000020000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1643958107.00000000000AF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1643958107.00000000000D5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1643993044.00000000000DF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1644007204.00000000000E8000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_20000_Ship Docs_CI PL HBL COO_.jbxd

Similarity

API ID: mouse_event
String ID:
API String ID: 2434400541-0
Opcode ID: 12b139488363ee047c0270769aa6b64c491aa26a2e7c3ca64e532383d28f3154
Instruction ID: c906b816188a35d86bca43fa4f4c0326521d9dc40f19b45a2a25b470846a4659
Opcode Fuzzy Hash: 12b139488363ee047c0270769aa6b64c491aa26a2e7c3ca64e532383d28f3154
Instruction Fuzzy Hash: 04D05E98560B0779FCA86B249C5FF7B1148F300782FD0414AB182894C2E8D46C505230

Function 00078C93 Relevance: 1.5, APIs: 1, Instructions: 19COMMON

Download Yara Rule

APIs

LogonUserW.ADVAPI32(?,00000001,?,?,00000000,000788D1), ref: 00078CB3

Memory Dump Source

Source File: 00000000.00000002.1643917647.0000000000021000.00000020.00000001.01000000.00000003.sdmp, Offset: 00020000, based on PE: true

Associated: 00000000.00000002.1643904003.0000000000020000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1643958107.00000000000AF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1643958107.00000000000D5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1643993044.00000000000DF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1644007204.00000000000E8000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_20000_Ship Docs_CI PL HBL COO_.jbxd

Similarity

API ID: LogonUser
String ID:
API String ID: 1244722697-0
Opcode ID: 3a5463da9a0227678c840ae311c0b8bf845fe028d2e3d3f80935487788226c36
Instruction ID: e18e4c36d1f743d5186b0e1ead8d6fbbdcb94de6c1fe4f1fdd30bb5488b639af
Opcode Fuzzy Hash: 3a5463da9a0227678c840ae311c0b8bf845fe028d2e3d3f80935487788226c36
Instruction Fuzzy Hash: 49D05E322A090EABEF018EA4DC01EBE3B69EB04B01F408111FE15C50A1C775D835AF60

Function 00062230 Relevance: 1.5, APIs: 1, Instructions: 7COMMON

Download Yara Rule

APIs

GetUserNameW.ADVAPI32(?,?), ref: 00062242

Memory Dump Source

Source File: 00000000.00000002.1643917647.0000000000021000.00000020.00000001.01000000.00000003.sdmp, Offset: 00020000, based on PE: true

Associated: 00000000.00000002.1643904003.0000000000020000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1643958107.00000000000AF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1643958107.00000000000D5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1643993044.00000000000DF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1644007204.00000000000E8000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_20000_Ship Docs_CI PL HBL COO_.jbxd

Similarity

API ID: NameUser
String ID:
API String ID: 2645101109-0
Opcode ID: 9a983c11dad0175610b219bd6a15976c462777aab2d9cc076736aa8821ed42f5
Instruction ID: 462de1c136c305e4da2285551dd380f07527a222feb70c70b7e3f0fcec939941
Opcode Fuzzy Hash: 9a983c11dad0175610b219bd6a15976c462777aab2d9cc076736aa8821ed42f5
Instruction Fuzzy Hash: A5C04CF1800509DBDB15DB90D988DFE77BCAB04304F144055A141F2100D7749B448A71

Function 0004A364 Relevance: 1.5, APIs: 1, Instructions: 6COMMON

Download Yara Rule

APIs

SetUnhandledExceptionFilter.KERNEL32(?), ref: 0004A36A

Memory Dump Source

Source File: 00000000.00000002.1643917647.0000000000021000.00000020.00000001.01000000.00000003.sdmp, Offset: 00020000, based on PE: true

Associated: 00000000.00000002.1643904003.0000000000020000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1643958107.00000000000AF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1643958107.00000000000D5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1643993044.00000000000DF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1644007204.00000000000E8000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_20000_Ship Docs_CI PL HBL COO_.jbxd

Similarity

API ID: ExceptionFilterUnhandled
String ID:
API String ID: 3192549508-0
Opcode ID: 0bb39d376d1f8ef43fcbe03ac48761fadad4f7302f9007889786d5d61363de59
Instruction ID: 1b875fd39ac93c63c5ac2bdcce6490b8030891be5f9fdd52e8e2afb2f633c5fe
Opcode Fuzzy Hash: 0bb39d376d1f8ef43fcbe03ac48761fadad4f7302f9007889786d5d61363de59
Instruction Fuzzy Hash: 38A0123100010DA78F001B81EC044547F5CD7011907004020F40C4002187B255104580

Function 00038A0E Relevance: .6, Instructions: 608COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1643917647.0000000000021000.00000020.00000001.01000000.00000003.sdmp, Offset: 00020000, based on PE: true

Associated: 00000000.00000002.1643904003.0000000000020000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1643958107.00000000000AF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1643958107.00000000000D5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1643993044.00000000000DF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1644007204.00000000000E8000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_20000_Ship Docs_CI PL HBL COO_.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 689e8ea8154284cb4c9deacbb10cc0e4bb8e60c7fad3288210c62a44febdaa9e
Instruction ID: 82aadfde6812fc2c55fc957eb6fb1bd59904894ea9b2f79e4b80617ea561474b
Opcode Fuzzy Hash: 689e8ea8154284cb4c9deacbb10cc0e4bb8e60c7fad3288210c62a44febdaa9e
Instruction Fuzzy Hash: F0226B30A15716CBDF798B14C8846BDB7F5FB01301F64C4AAF84A8B191EB789D82CB65

Function 00042405 Relevance: .3, Instructions: 345COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1643917647.0000000000021000.00000020.00000001.01000000.00000003.sdmp, Offset: 00020000, based on PE: true

Associated: 00000000.00000002.1643904003.0000000000020000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1643958107.00000000000AF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1643958107.00000000000D5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1643993044.00000000000DF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1644007204.00000000000E8000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_20000_Ship Docs_CI PL HBL COO_.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: bf6ffcbe3773841c348058a39a16573d3b2338b254e5945c46ce03dce2746f28
Instruction ID: cc6b09288ee43faaa0e013c6bca19d707b08ab7ba306ba87009fe5ceab873f5c
Opcode Fuzzy Hash: bf6ffcbe3773841c348058a39a16573d3b2338b254e5945c46ce03dce2746f28
Instruction Fuzzy Hash: D3C1A4B230509309EBAD4639943417EBAE16BA27B139A077DF4B3CB4C4FF20D569D624

Function 0004283A Relevance: .3, Instructions: 341COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1643917647.0000000000021000.00000020.00000001.01000000.00000003.sdmp, Offset: 00020000, based on PE: true

Associated: 00000000.00000002.1643904003.0000000000020000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1643958107.00000000000AF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1643958107.00000000000D5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1643993044.00000000000DF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1644007204.00000000000E8000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_20000_Ship Docs_CI PL HBL COO_.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a635e2a33a60bcf8d734eac2a911e111534612f0cd64c6a362f1e57f4f360174
Instruction ID: 3ea8159766f592d1e98463ff4166845e8fa4f2f007035fa5654d0e7e7038ed7b
Opcode Fuzzy Hash: a635e2a33a60bcf8d734eac2a911e111534612f0cd64c6a362f1e57f4f360174
Instruction Fuzzy Hash: 69C1B6B220519309EBAD4639843407EBBE16B927B139A077DF4B2DB5C4FF20D568D624

Function 00041BB8 Relevance: .3, Instructions: 323COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1643917647.0000000000021000.00000020.00000001.01000000.00000003.sdmp, Offset: 00020000, based on PE: true

Associated: 00000000.00000002.1643904003.0000000000020000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1643958107.00000000000AF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1643958107.00000000000D5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1643993044.00000000000DF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1644007204.00000000000E8000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_20000_Ship Docs_CI PL HBL COO_.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b18fb967447e529c76739499a87999de3f08bdf72590393fa5476362680146d7
Instruction ID: bcd7f92e71f6db39c3ad7804a2937a47abcef2d107e5d894e628ec4f48217b22
Opcode Fuzzy Hash: b18fb967447e529c76739499a87999de3f08bdf72590393fa5476362680146d7
Instruction Fuzzy Hash: E1C1C4B220515309EFAD463AD4340BEBBE16BA27B135A077DE4B2CB4C4FF20D5A9D614

Function 00097B1B Relevance: 77.5, APIs: 40, Strings: 4, Instructions: 491filecommemoryCOMMON

Download Yara Rule

APIs

DeleteObject.GDI32(00000000), ref: 00097B70
DeleteObject.GDI32(00000000), ref: 00097B82
DestroyWindow.USER32 ref: 00097B90
GetDesktopWindow.USER32 ref: 00097BAA
GetWindowRect.USER32(00000000), ref: 00097BB1
SetRect.USER32(?,00000000,00000000,000001F4,00000190), ref: 00097CF2
AdjustWindowRectEx.USER32(?,88C00000,00000000,00000002), ref: 00097D02
CreateWindowExW.USER32(00000002,AutoIt v3,?,88C00000,000000FF,000000FF,?,?,00000000,00000000,00000000), ref: 00097D4A
GetClientRect.USER32(00000000,?), ref: 00097D56
CreateWindowExW.USER32(00000000,static,00000000,5000000E,00000000,00000000,?,?,00000000,00000000,00000000), ref: 00097D90
CreateFileW.KERNEL32(?,80000000,00000000,00000000,00000003,00000000,00000000,?,88C00000,000000FF,000000FF,?,?,00000000,00000000,00000000), ref: 00097DB2
GetFileSize.KERNEL32(00000000,00000000,?,88C00000,000000FF,000000FF,?,?,00000000,00000000,00000000), ref: 00097DC5
GlobalAlloc.KERNEL32(00000002,00000000,?,88C00000,000000FF,000000FF,?,?,00000000,00000000,00000000), ref: 00097DD0
GlobalLock.KERNEL32(00000000,?,88C00000,000000FF,000000FF,?,?,00000000,00000000,00000000), ref: 00097DD9
ReadFile.KERNEL32(00000000,00000000,00000000,00000190,00000000,?,88C00000,000000FF,000000FF,?,?,00000000,00000000,00000000), ref: 00097DE8
GlobalUnlock.KERNEL32(00000000,?,88C00000,000000FF,000000FF,?,?,00000000,00000000,00000000), ref: 00097DF1
CloseHandle.KERNEL32(00000000,?,88C00000,000000FF,000000FF,?,?,00000000,00000000,00000000), ref: 00097DF8
GlobalFree.KERNEL32(00000000), ref: 00097E03
CreateStreamOnHGlobal.OLE32(00000000,00000001,88C00000,?,88C00000,000000FF,000000FF,?,?,00000000,00000000,00000000), ref: 00097E15
OleLoadPicture.OLEAUT32(88C00000,00000000,00000000,000B2CAC,00000000), ref: 00097E2B
GlobalFree.KERNEL32(00000000), ref: 00097E3B
CopyImage.USER32(000001F4,00000000,00000000,00000000,00002000), ref: 00097E61
SendMessageW.USER32(?,00000172,00000000,000001F4), ref: 00097E80
SetWindowPos.USER32(?,00000000,00000000,00000000,?,?,00000020,?,88C00000,000000FF,000000FF,?,?,00000000,00000000,00000000), ref: 00097EA2
ShowWindow.USER32(00000004,?,88C00000,000000FF,000000FF,?,?,00000000,00000000,00000000), ref: 0009808F

Strings

, xrefs: 00098015
static, xrefs: 00097D8A, 00097EE1
DISPLAY, xrefs: 00097EF2
AutoIt v3, xrefs: 00097D42

Memory Dump Source

Source File: 00000000.00000002.1643917647.0000000000021000.00000020.00000001.01000000.00000003.sdmp, Offset: 00020000, based on PE: true

Associated: 00000000.00000002.1643904003.0000000000020000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1643958107.00000000000AF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1643958107.00000000000D5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1643993044.00000000000DF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1644007204.00000000000E8000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_20000_Ship Docs_CI PL HBL COO_.jbxd

Similarity

API ID: Window$Global$CreateRect$File$DeleteFreeObject$AdjustAllocClientCloseCopyDesktopDestroyHandleImageLoadLockMessagePictureReadSendShowSizeStreamUnlock
String ID: $AutoIt v3$DISPLAY$static
API String ID: 2211948467-2373415609
Opcode ID: 8f1bdf2fa610b7deb06b716ced0b0fa113194a9548ba9028933f1726dd411d69
Instruction ID: 083f5f188e8529779afc97137a753925172f101a1368107d6ae83f47e5d06d67
Opcode Fuzzy Hash: 8f1bdf2fa610b7deb06b716ced0b0fa113194a9548ba9028933f1726dd411d69
Instruction Fuzzy Hash: D9027C71910115EFEF14DFA4DC89EAE7BB9EF49310F148168F909AB2A1CB35AD01CB60

Function 000A37F3 Relevance: 51.1, APIs: 6, Strings: 23, Instructions: 365windowCOMMON

Download Yara Rule

APIs

CharUpperBuffW.USER32(?,?,000AF910), ref: 000A38AF
IsWindowVisible.USER32(?), ref: 000A38D3

Strings

TABLEFT, xrefs: 000A390F
CHECK, xrefs: 000A3AF5
GETSELECTED, xrefs: 000A3B2B
GETLINECOUNT, xrefs: 000A3B4E
ISCHECKED, xrefs: 000A3AC1
ISENABLED, xrefs: 000A38F3
SETCURRENTSELECTION, xrefs: 000A3A3E
GETCURRENTLINE, xrefs: 000A3B75
UNCHECK, xrefs: 000A3B0B
EDITPASTE, xrefs: 000A3BE7
HIDEDROPDOWN, xrefs: 000A3988
DELSTRING, xrefs: 000A39D1
SELECTSTRING, xrefs: 000A3A8E
SENDCOMMANDID, xrefs: 000A3C62
GETCURRENTCOL, xrefs: 000A3BB0
SHOWDROPDOWN, xrefs: 000A3968
ISVISIBLE, xrefs: 000A38BF
GETCURRENTSELECTION, xrefs: 000A3A6B
ADDSTRING, xrefs: 000A399E
TABRIGHT, xrefs: 000A3925
FINDSTRING, xrefs: 000A39FE
GETLINE, xrefs: 000A3C23
CURRENTTAB, xrefs: 000A3945

Memory Dump Source

Source File: 00000000.00000002.1643917647.0000000000021000.00000020.00000001.01000000.00000003.sdmp, Offset: 00020000, based on PE: true

Associated: 00000000.00000002.1643904003.0000000000020000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1643958107.00000000000AF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1643958107.00000000000D5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1643993044.00000000000DF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1644007204.00000000000E8000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_20000_Ship Docs_CI PL HBL COO_.jbxd

Similarity

API ID: BuffCharUpperVisibleWindow
String ID: ADDSTRING$CHECK$CURRENTTAB$DELSTRING$EDITPASTE$FINDSTRING$GETCURRENTCOL$GETCURRENTLINE$GETCURRENTSELECTION$GETLINE$GETLINECOUNT$GETSELECTED$HIDEDROPDOWN$ISCHECKED$ISENABLED$ISVISIBLE$SELECTSTRING$SENDCOMMANDID$SETCURRENTSELECTION$SHOWDROPDOWN$TABLEFT$TABRIGHT$UNCHECK
API String ID: 4105515805-45149045
Opcode ID: 5b9e21f075fabca15999bca5877be8dbf20498d07149aef81a1f3476dcbebebb
Instruction ID: 860f231b65a2c74f2550d6b5d3397550a66566fe7336d9d91a258515897cc349
Opcode Fuzzy Hash: 5b9e21f075fabca15999bca5877be8dbf20498d07149aef81a1f3476dcbebebb
Instruction Fuzzy Hash: 5CD1A230604315DBCB24EF50C851EAEB7E1AF55354F11846DB8866B3A3CB35EE0ACB96

Function 000AA849 Relevance: 49.8, APIs: 33, Instructions: 274COMMON

Download Yara Rule

APIs

SetTextColor.GDI32(?,00000000), ref: 000AA89F
GetSysColorBrush.USER32(0000000F), ref: 000AA8D0
GetSysColor.USER32(0000000F), ref: 000AA8DC
SetBkColor.GDI32(?,000000FF), ref: 000AA8F6
SelectObject.GDI32(?,?), ref: 000AA905
InflateRect.USER32(?,000000FF,000000FF), ref: 000AA930
GetSysColor.USER32(00000010), ref: 000AA938
CreateSolidBrush.GDI32(00000000), ref: 000AA93F
FrameRect.USER32(?,?,00000000), ref: 000AA94E
DeleteObject.GDI32(00000000), ref: 000AA955
InflateRect.USER32(?,000000FE,000000FE), ref: 000AA9A0
FillRect.USER32(?,?,?), ref: 000AA9D2
GetWindowLongW.USER32(?,000000F0), ref: 000AA9FD

Part of subcall function 000AAB60: GetSysColor.USER32(00000012), ref: 000AAB99
Part of subcall function 000AAB60: SetTextColor.GDI32(?,?), ref: 000AAB9D
Part of subcall function 000AAB60: GetSysColorBrush.USER32(0000000F), ref: 000AABB3
Part of subcall function 000AAB60: GetSysColor.USER32(0000000F), ref: 000AABBE
Part of subcall function 000AAB60: GetSysColor.USER32(00000011), ref: 000AABDB
Part of subcall function 000AAB60: CreatePen.GDI32(00000000,00000001,00743C00), ref: 000AABE9
Part of subcall function 000AAB60: SelectObject.GDI32(?,00000000), ref: 000AABFA
Part of subcall function 000AAB60: SetBkColor.GDI32(?,00000000), ref: 000AAC03
Part of subcall function 000AAB60: SelectObject.GDI32(?,?), ref: 000AAC10
Part of subcall function 000AAB60: InflateRect.USER32(?,000000FF,000000FF), ref: 000AAC2F
Part of subcall function 000AAB60: RoundRect.GDI32(?,?,?,?,?,00000005,00000005), ref: 000AAC46
Part of subcall function 000AAB60: GetWindowLongW.USER32(00000000,000000F0), ref: 000AAC5B

Memory Dump Source

Source File: 00000000.00000002.1643917647.0000000000021000.00000020.00000001.01000000.00000003.sdmp, Offset: 00020000, based on PE: true

Associated: 00000000.00000002.1643904003.0000000000020000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1643958107.00000000000AF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1643958107.00000000000D5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1643993044.00000000000DF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1644007204.00000000000E8000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_20000_Ship Docs_CI PL HBL COO_.jbxd

Similarity

API ID: Color$Rect$Object$BrushInflateSelect$CreateLongTextWindow$DeleteFillFrameRoundSolid
String ID:
API String ID: 4124339563-0
Opcode ID: 6ed427be710231eaa18a205dcb70e2d6b207f018db084514f64234a090ab01d7
Instruction ID: 9c023b59c5781348ab7d9755574f26fdbce02f914caa49d79f8e7da625908da1
Opcode Fuzzy Hash: 6ed427be710231eaa18a205dcb70e2d6b207f018db084514f64234a090ab01d7
Instruction Fuzzy Hash: 54A1A271508702AFE7109FA4DC08E6B7BE9FF8A321F104B29F562961E1D738D844CB52

Function 00022C18 Relevance: 49.5, APIs: 27, Strings: 1, Instructions: 486windowCOMMON

Download Yara Rule

APIs

DestroyWindow.USER32(?,?,?), ref: 00022CA2
DeleteObject.GDI32(00000000), ref: 00022CE8
DeleteObject.GDI32(00000000), ref: 00022CF3
DestroyIcon.USER32(00000000,?,?,?), ref: 00022CFE
DestroyWindow.USER32(00000000,?,?,?), ref: 00022D09
SendMessageW.USER32(?,00001308,?,00000000), ref: 0005C68B
ImageList_Remove.COMCTL32(?,000000FF,?), ref: 0005C6C4
MoveWindow.USER32(?,?,?,?,?,00000000), ref: 0005CAED

Part of subcall function 00021B41: InvalidateRect.USER32(?,00000000,00000001,?,?,?,00022036,?,00000000,?,?,?,?,000216CB,00000000,?), ref: 00021B9A

SendMessageW.USER32(?,00001053), ref: 0005CB2A
SendMessageW.USER32(?,00001008,000000FF,00000000), ref: 0005CB41
ImageList_Destroy.COMCTL32(00000000,?,?), ref: 0005CB57
ImageList_Destroy.COMCTL32(00000000,?,?), ref: 0005CB62

Strings

0, xrefs: 0005C981

Memory Dump Source

Source File: 00000000.00000002.1643917647.0000000000021000.00000020.00000001.01000000.00000003.sdmp, Offset: 00020000, based on PE: true

Associated: 00000000.00000002.1643904003.0000000000020000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1643958107.00000000000AF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1643958107.00000000000D5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1643993044.00000000000DF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1644007204.00000000000E8000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_20000_Ship Docs_CI PL HBL COO_.jbxd

Similarity

API ID: Destroy$ImageList_MessageSendWindow$DeleteObject$IconInvalidateMoveRectRemove
String ID: 0
API String ID: 464785882-4108050209
Opcode ID: 0fb6ca54442d59681d990b37a01fd5b937cb2bdc2b303041c5eb2a9157746e7c
Instruction ID: 80e72c2f23d5ca30b4a69373fbd3b891eecd0a64392a9e8703b1dba64cd7e284
Opcode Fuzzy Hash: 0fb6ca54442d59681d990b37a01fd5b937cb2bdc2b303041c5eb2a9157746e7c
Instruction Fuzzy Hash: 3312BE30604715EFEB60CF24C888FAABBE5BF09311F544569E886DB662C731EC46CB91

Function 000977BE Relevance: 45.8, APIs: 22, Strings: 4, Instructions: 284windowCOMMON

Download Yara Rule

APIs

DestroyWindow.USER32(00000000), ref: 000977F1
SystemParametersInfoW.USER32(00000030,00000000,?,00000000), ref: 000978B0
SetRect.USER32(?,00000000,00000000,0000012C,00000064), ref: 000978EE
AdjustWindowRectEx.USER32(?,88C00000,00000000,00000006), ref: 00097900
CreateWindowExW.USER32(00000006,AutoIt v3,?,88C00000,?,?,?,?,00000000,00000000,00000000), ref: 00097946
GetClientRect.USER32(00000000,?), ref: 00097952
CreateWindowExW.USER32(00000000,static,?,50000000,?,00000004,00000500,00000018,00000000,00000000,00000000), ref: 00097996
CreateDCW.GDI32(DISPLAY,00000000,00000000,00000000), ref: 000979A5
GetStockObject.GDI32(00000011), ref: 000979B5
SelectObject.GDI32(00000000,00000000), ref: 000979B9
GetTextFaceW.GDI32(00000000,00000040,?,?,50000000,?,00000004,00000500,00000018,00000000,00000000,00000000,?,88C00000,?), ref: 000979C9
GetDeviceCaps.GDI32(00000000,0000005A), ref: 000979D2
DeleteDC.GDI32(00000000), ref: 000979DB
CreateFontW.GDI32(00000000,00000000,00000000,00000000,00000258,00000000,00000000,00000000,00000001,00000004,00000000,00000002,00000000,?), ref: 00097A07
SendMessageW.USER32(00000030,00000000,00000001), ref: 00097A1E
CreateWindowExW.USER32(00000200,msctls_progress32,00000000,50000001,?,0000001E,00000104,00000014,00000000,00000000,00000000), ref: 00097A59
SendMessageW.USER32(00000000,00000401,00000000,00640000), ref: 00097A6D
SendMessageW.USER32(00000404,00000001,00000000), ref: 00097A7E
CreateWindowExW.USER32(00000000,static,?,50000000,?,00000037,00000500,00000032,00000000,00000000,00000000), ref: 00097AAE
GetStockObject.GDI32(00000011), ref: 00097AB9
SendMessageW.USER32(00000030,00000000,?,50000000), ref: 00097AC4
ShowWindow.USER32(00000004,?,50000000,?,00000004,00000500,00000018,00000000,00000000,00000000,?,88C00000,?,?,?,?), ref: 00097ACE

Strings

static, xrefs: 00097990, 00097AA8
msctls_progress32, xrefs: 00097A4F
DISPLAY, xrefs: 0009799B
AutoIt v3, xrefs: 0009793E

Memory Dump Source

Source File: 00000000.00000002.1643917647.0000000000021000.00000020.00000001.01000000.00000003.sdmp, Offset: 00020000, based on PE: true

Associated: 00000000.00000002.1643904003.0000000000020000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1643958107.00000000000AF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1643958107.00000000000D5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1643993044.00000000000DF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1644007204.00000000000E8000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_20000_Ship Docs_CI PL HBL COO_.jbxd

Similarity

API ID: Window$Create$MessageSend$ObjectRect$Stock$AdjustCapsClientDeleteDestroyDeviceFaceFontInfoParametersSelectShowSystemText
String ID: AutoIt v3$DISPLAY$msctls_progress32$static
API String ID: 2910397461-517079104
Opcode ID: 49f0f68c5e9f8e40bbfca02ba49f265a459e8fc34d0752f8d54edd6b238bdf48
Instruction ID: 51017950bff24cf81f43db6780fe6c0fdbe0f5128bd6d99808bdced6323edf89
Opcode Fuzzy Hash: 49f0f68c5e9f8e40bbfca02ba49f265a459e8fc34d0752f8d54edd6b238bdf48
Instruction Fuzzy Hash: 89A18E71A40615BFEB149BA4DC8AFBF7BB9EB45710F004118FA14AB2E0CB74AD00CB64

Function 0008AF7B Relevance: 45.7, APIs: 3, Strings: 23, Instructions: 186COMMON

Download Yara Rule

APIs

SetErrorMode.KERNEL32(00000001), ref: 0008AF89
GetDriveTypeW.KERNEL32(?,000AFAC0,?,\\.\,000AF910), ref: 0008B066
SetErrorMode.KERNEL32(00000000,000AFAC0,?,\\.\,000AF910), ref: 0008B1C4

Strings

1394, xrefs: 0008B146
USB, xrefs: 0008B15B
PhysicalDrive, xrefs: 0008B012
Virtual, xrefs: 0008B18C
RAMDisk, xrefs: 0008B090
MMC, xrefs: 0008B185
ATAPI, xrefs: 0008B138
Fibre, xrefs: 0008B154
RAID, xrefs: 0008B162
Unknown, xrefs: 0008B086, 0008B12A
CDROM, xrefs: 0008B09A
iSCSI, xrefs: 0008B169
Fixed, xrefs: 0008B0AE
Removable, xrefs: 0008B0B8
SAS, xrefs: 0008B170
SATA, xrefs: 0008B177
Network, xrefs: 0008B0A4
SCSI, xrefs: 0008B131
SSD, xrefs: 0008B0F1
SSA, xrefs: 0008B14D
FileBackedVirtual, xrefs: 0008B193
\\.\, xrefs: 0008AFDB
ATA, xrefs: 0008B13F

Memory Dump Source

Source File: 00000000.00000002.1643917647.0000000000021000.00000020.00000001.01000000.00000003.sdmp, Offset: 00020000, based on PE: true

Associated: 00000000.00000002.1643904003.0000000000020000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1643958107.00000000000AF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1643958107.00000000000D5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1643993044.00000000000DF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1644007204.00000000000E8000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_20000_Ship Docs_CI PL HBL COO_.jbxd

Similarity

API ID: ErrorMode$DriveType
String ID: 1394$ATA$ATAPI$CDROM$Fibre$FileBackedVirtual$Fixed$MMC$Network$PhysicalDrive$RAID$RAMDisk$Removable$SAS$SATA$SCSI$SSA$SSD$USB$Unknown$Virtual$\\.\$iSCSI
API String ID: 2907320926-4222207086
Opcode ID: ace2fe440a295516c6f3408d8fce500b5d266a5cbd0e98552b11060a208ed02d
Instruction ID: ac1eb617138c5f295237129d1c23124c0c27db149e7f394af476a17a4c4fe346
Opcode Fuzzy Hash: ace2fe440a295516c6f3408d8fce500b5d266a5cbd0e98552b11060a208ed02d
Instruction Fuzzy Hash: 0151A130788305ABCF20FB50CDA69BD77B0BB16351BA04016E58AAF392CB759D41DB62

Function 00026A3C Relevance: 44.0, APIs: 12, Strings: 13, Instructions: 275COMMON

Download Yara Rule

APIs

__wcsnicmp.LIBCMT ref: 00026A91
__wcsnicmp.LIBCMT ref: 00026AA9
__wcsnicmp.LIBCMT ref: 00026AC1
__wcsnicmp.LIBCMT ref: 00026AD9
__wcsnicmp.LIBCMT ref: 00026AF1
__wcsnicmp.LIBCMT ref: 00026B09
__wcsnicmp.LIBCMT ref: 00026B21
__wcsnicmp.LIBCMT ref: 00026B35
__wcsnicmp.LIBCMT ref: 00026B76
__wcsnicmp.LIBCMT ref: 00026B8A
__wcsnicmp.LIBCMT ref: 00026B9E
__wcsnicmp.LIBCMT ref: 00026BB2

Strings

#include-once, xrefs: 00026AEB
#comments-start, xrefs: 00026B1B, 00026B70
Unterminated group of comments, xrefs: 0005E82C
#pragma compile, xrefs: 00026A8B
Bad directive syntax error, xrefs: 0005E743
#include, xrefs: 00026B03
#ce, xrefs: 00026BAC
#comments-end, xrefs: 00026B98
#requireadmin, xrefs: 00026ABB
#OnAutoItStartRegister, xrefs: 00026AD3
#cs, xrefs: 00026B2F, 00026B84
Cannot parse #include, xrefs: 0005E819
#notrayicon, xrefs: 00026AA3

Memory Dump Source

Source File: 00000000.00000002.1643917647.0000000000021000.00000020.00000001.01000000.00000003.sdmp, Offset: 00020000, based on PE: true

Associated: 00000000.00000002.1643904003.0000000000020000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1643958107.00000000000AF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1643958107.00000000000D5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1643993044.00000000000DF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1644007204.00000000000E8000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_20000_Ship Docs_CI PL HBL COO_.jbxd

Similarity

API ID: __wcsnicmp
String ID: #OnAutoItStartRegister$#ce$#comments-end$#comments-start$#cs$#include$#include-once$#notrayicon$#pragma compile$#requireadmin$Bad directive syntax error$Cannot parse #include$Unterminated group of comments
API String ID: 1038674560-86951937
Opcode ID: 223d1bbf2d555b579d62761b66bfb24b7b9e6284121605288138140d124cf838
Instruction ID: 8c61cea39673c5c2fd79af7d44b1de5f80b301dc8bc8e111b9b6a8e05edf39d4
Opcode Fuzzy Hash: 223d1bbf2d555b579d62761b66bfb24b7b9e6284121605288138140d124cf838
Instruction Fuzzy Hash: 95814CB0640265BACB25AF60DC82FFF77A8AF15301F044035FD45AA1C3EB61DB99C666

Function 000AAB60 Relevance: 39.2, APIs: 26, Instructions: 201windowCOMMON

Download Yara Rule

APIs

GetSysColor.USER32(00000012), ref: 000AAB99
SetTextColor.GDI32(?,?), ref: 000AAB9D
GetSysColorBrush.USER32(0000000F), ref: 000AABB3
GetSysColor.USER32(0000000F), ref: 000AABBE
CreateSolidBrush.GDI32(?), ref: 000AABC3
GetSysColor.USER32(00000011), ref: 000AABDB
CreatePen.GDI32(00000000,00000001,00743C00), ref: 000AABE9
SelectObject.GDI32(?,00000000), ref: 000AABFA
SetBkColor.GDI32(?,00000000), ref: 000AAC03
SelectObject.GDI32(?,?), ref: 000AAC10
InflateRect.USER32(?,000000FF,000000FF), ref: 000AAC2F
RoundRect.GDI32(?,?,?,?,?,00000005,00000005), ref: 000AAC46
GetWindowLongW.USER32(00000000,000000F0), ref: 000AAC5B
SendMessageW.USER32(00000000,0000000E,00000000,00000000), ref: 000AACA7
GetWindowTextW.USER32(00000000,00000000,00000001), ref: 000AACCE
InflateRect.USER32(?,000000FD,000000FD), ref: 000AACEC
DrawFocusRect.USER32(?,?), ref: 000AACF7
GetSysColor.USER32(00000011), ref: 000AAD05
SetTextColor.GDI32(?,00000000), ref: 000AAD0D
DrawTextW.USER32(?,00000000,000000FF,?,?), ref: 000AAD21
SelectObject.GDI32(?,000AA869), ref: 000AAD38
DeleteObject.GDI32(?), ref: 000AAD43
SelectObject.GDI32(?,?), ref: 000AAD49
DeleteObject.GDI32(?), ref: 000AAD4E
SetTextColor.GDI32(?,?), ref: 000AAD54
SetBkColor.GDI32(?,?), ref: 000AAD5E

Memory Dump Source

Source File: 00000000.00000002.1643917647.0000000000021000.00000020.00000001.01000000.00000003.sdmp, Offset: 00020000, based on PE: true

Associated: 00000000.00000002.1643904003.0000000000020000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1643958107.00000000000AF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1643958107.00000000000D5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1643993044.00000000000DF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1644007204.00000000000E8000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_20000_Ship Docs_CI PL HBL COO_.jbxd

Similarity

API ID: Color$Object$Text$RectSelect$BrushCreateDeleteDrawInflateWindow$FocusLongMessageRoundSendSolid
String ID:
API String ID: 1996641542-0
Opcode ID: 1eb9faa200c390ade5afb23fda04d07f095061a26fd295316544cbde13a958d8
Instruction ID: f562e5fc15b44cec67857e01e69fd756360b6d29d0e54364f595a06769548ffb
Opcode Fuzzy Hash: 1eb9faa200c390ade5afb23fda04d07f095061a26fd295316544cbde13a958d8
Instruction Fuzzy Hash: C1615E71900619EFEB119FE4DC48EEE7BB9EB0A320F104225F915AB2E1D7759D40DB90

Function 000A8C44 Relevance: 38.9, APIs: 21, Strings: 1, Instructions: 401windowCOMMON

Download Yara Rule

APIs

SendMessageW.USER32(?,00000158,000000FF,0000014E), ref: 000A8D34
SendMessageW.USER32(?,0000014E,00000000,00000000), ref: 000A8D45
CharNextW.USER32(0000014E), ref: 000A8D74
SendMessageW.USER32(?,0000014B,00000000,00000000), ref: 000A8DB5
SendMessageW.USER32(?,00000158,000000FF,00000158), ref: 000A8DCB
SendMessageW.USER32(?,0000014E,00000000,00000000), ref: 000A8DDC
SendMessageW.USER32(?,000000C2,00000001,0000014E), ref: 000A8DF9
SetWindowTextW.USER32(?,0000014E), ref: 000A8E45
SendMessageW.USER32(?,000000B1,000F4240,000F423F), ref: 000A8E5B
SendMessageW.USER32(?,00001002,00000000,?), ref: 000A8E8C
_memset.LIBCMT ref: 000A8EB1
SendMessageW.USER32(00000000,00001060,00000001,00000004), ref: 000A8EFA
_memset.LIBCMT ref: 000A8F59
SendMessageW.USER32(?,00001053,000000FF,?), ref: 000A8F83
SendMessageW.USER32(?,00001074,?,00000001), ref: 000A8FDB
SendMessageW.USER32(?,0000133D,?,?), ref: 000A9088
InvalidateRect.USER32(?,00000000,00000001), ref: 000A90AA
GetMenuItemInfoW.USER32(?,?,00000000,00000030), ref: 000A90F4
SetMenuItemInfoW.USER32(?,?,00000000,00000030), ref: 000A9121
DrawMenuBar.USER32(?), ref: 000A9130
SetWindowTextW.USER32(?,0000014E), ref: 000A9158

Strings

0, xrefs: 000A90C2

Memory Dump Source

Source File: 00000000.00000002.1643917647.0000000000021000.00000020.00000001.01000000.00000003.sdmp, Offset: 00020000, based on PE: true

Associated: 00000000.00000002.1643904003.0000000000020000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1643958107.00000000000AF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1643958107.00000000000D5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1643993044.00000000000DF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1644007204.00000000000E8000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_20000_Ship Docs_CI PL HBL COO_.jbxd

Similarity

API ID: MessageSend$Menu$InfoItemTextWindow_memset$CharDrawInvalidateNextRect
String ID: 0
API String ID: 1073566785-4108050209
Opcode ID: 90e1d82cdc06a66a7c47942108a17e518c6b864138d5e73ed530b99a06c78ea2
Instruction ID: 363b36afc10a8012dc18c66b0e63c0149ede8271a9d4e6f6b1b84659064ae6dc
Opcode Fuzzy Hash: 90e1d82cdc06a66a7c47942108a17e518c6b864138d5e73ed530b99a06c78ea2
Instruction Fuzzy Hash: 54E17070900219AFDF20DFE1CC88EEE7BB9EF06750F148165F915AA291DB748A85DF60

Function 000A4B16 Relevance: 37.0, APIs: 18, Strings: 3, Instructions: 290windowCOMMON

Download Yara Rule

APIs

GetCursorPos.USER32(?), ref: 000A4C51
GetDesktopWindow.USER32 ref: 000A4C66
GetWindowRect.USER32(00000000), ref: 000A4C6D
GetWindowLongW.USER32(?,000000F0), ref: 000A4CCF
DestroyWindow.USER32(?), ref: 000A4CFB
CreateWindowExW.USER32(00000008,tooltips_class32,00000000,00000003,80000000,80000000,80000000,80000000,00000000,00000000,00000000,00000000), ref: 000A4D24
SendMessageW.USER32(00000000,00000432,00000000,00000030), ref: 000A4D42
SendMessageW.USER32(?,00000439,00000000,00000030), ref: 000A4D68
SendMessageW.USER32(?,00000421,?,?), ref: 000A4D7D
SendMessageW.USER32(?,0000041D,00000000,00000000), ref: 000A4D90
IsWindowVisible.USER32(?), ref: 000A4DB0
SendMessageW.USER32(?,00000412,00000000,D8F0D8F0), ref: 000A4DCB
SendMessageW.USER32(?,00000411,00000001,00000030), ref: 000A4DDF
GetWindowRect.USER32(?,?), ref: 000A4DF7
MonitorFromPoint.USER32(?,?,00000002), ref: 000A4E1D
GetMonitorInfoW.USER32(00000000,?), ref: 000A4E37
CopyRect.USER32(?,?), ref: 000A4E4E
SendMessageW.USER32(?,00000412,00000000), ref: 000A4EB9

Strings

tooltips_class32, xrefs: 000A4D1D
0, xrefs: 000A4BFC
(, xrefs: 000A4E2A

Memory Dump Source

Source File: 00000000.00000002.1643917647.0000000000021000.00000020.00000001.01000000.00000003.sdmp, Offset: 00020000, based on PE: true

Associated: 00000000.00000002.1643904003.0000000000020000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1643958107.00000000000AF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1643958107.00000000000D5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1643993044.00000000000DF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1644007204.00000000000E8000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_20000_Ship Docs_CI PL HBL COO_.jbxd

Similarity

API ID: MessageSendWindow$Rect$Monitor$CopyCreateCursorDesktopDestroyFromInfoLongPointVisible
String ID: ($0$tooltips_class32
API String ID: 698492251-4156429822
Opcode ID: 06420279adce1bb92e17b5ad9a9a6647a209a6cdd6dea164ab4cbe228df36ab8
Instruction ID: 2627da897fbe4089a327474559901a184336615195a947ea4786819fc21756d9
Opcode Fuzzy Hash: 06420279adce1bb92e17b5ad9a9a6647a209a6cdd6dea164ab4cbe228df36ab8
Instruction Fuzzy Hash: B5B18D75604351AFDB44DFA4D848B6ABBE4FF85310F00891CF5999B2A2D7B5EC04CB91

Function 000227D9 Relevance: 33.5, APIs: 18, Strings: 1, Instructions: 286windowtimeCOMMON

Download Yara Rule

APIs

SystemParametersInfoW.USER32(00000030,00000000,000000FF,00000000), ref: 000228BC
GetSystemMetrics.USER32(00000007), ref: 000228C4
SystemParametersInfoW.USER32(00000030,00000000,000000FF,00000000), ref: 000228EF
GetSystemMetrics.USER32(00000008), ref: 000228F7
GetSystemMetrics.USER32(00000004), ref: 0002291C
SetRect.USER32(000000FF,00000000,00000000,000000FF,000000FF), ref: 00022939
AdjustWindowRectEx.USER32(000000FF,?,00000000,?), ref: 00022949
CreateWindowExW.USER32(?,AutoIt v3 GUI,?,?,?,000000FF,000000FF,000000FF,?,00000000,00000000), ref: 0002297C
SetWindowLongW.USER32(00000000,000000EB,00000000), ref: 00022990
GetClientRect.USER32(00000000,000000FF), ref: 000229AE
GetStockObject.GDI32(00000011), ref: 000229CA
SendMessageW.USER32(00000000,00000030,00000000), ref: 000229D5

Part of subcall function 00022344: GetCursorPos.USER32(?), ref: 00022357
Part of subcall function 00022344: ScreenToClient.USER32(000E67B0,?), ref: 00022374
Part of subcall function 00022344: GetAsyncKeyState.USER32(00000001), ref: 00022399
Part of subcall function 00022344: GetAsyncKeyState.USER32(00000002), ref: 000223A7

SetTimer.USER32(00000000,00000000,00000028,00021256), ref: 000229FC

Strings

AutoIt v3 GUI, xrefs: 00022974

Memory Dump Source

Source File: 00000000.00000002.1643917647.0000000000021000.00000020.00000001.01000000.00000003.sdmp, Offset: 00020000, based on PE: true

Associated: 00000000.00000002.1643904003.0000000000020000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1643958107.00000000000AF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1643958107.00000000000D5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1643993044.00000000000DF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1644007204.00000000000E8000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_20000_Ship Docs_CI PL HBL COO_.jbxd

Similarity

API ID: System$MetricsRectWindow$AsyncClientInfoParametersState$AdjustCreateCursorLongMessageObjectScreenSendStockTimer
String ID: AutoIt v3 GUI
API String ID: 1458621304-248962490
Opcode ID: 244746997ea22244e52ade8ef539e9c413cd7c7e2f0f9a353cdcfaa7ddb52a4c
Instruction ID: e11e9d5adff84dd328f9f74fb7f3ad2292280eac6c0370c998da3234dc449978
Opcode Fuzzy Hash: 244746997ea22244e52ade8ef539e9c413cd7c7e2f0f9a353cdcfaa7ddb52a4c
Instruction Fuzzy Hash: 42B17071A0021AEFEB14DFA8EC85BAE7BB4FB08711F104229FA15A7290DB74D941CB50

Function 000A4069 Relevance: 28.3, APIs: 3, Strings: 13, Instructions: 283windowCOMMON

Download Yara Rule

APIs

CharUpperBuffW.USER32(?,?), ref: 000A40F6
SendMessageW.USER32(?,00001032,00000000,00000000), ref: 000A41B6

Strings

GETSUBITEMCOUNT, xrefs: 000A4141
GETTEXT, xrefs: 000A415F
GETSELECTED, xrefs: 000A42E4
VIEWCHANGE, xrefs: 000A4375
SELECTINVERT, xrefs: 000A4286
SELECTALL, xrefs: 000A421D
GETITEMCOUNT, xrefs: 000A4128
ISSELECTED, xrefs: 000A41C1
SELECTCLEAR, xrefs: 000A4235
SELECT, xrefs: 000A4250
GETSELECTEDCOUNT, xrefs: 000A4199
DESELECT, xrefs: 000A42A4
FINDITEM, xrefs: 000A4329

Memory Dump Source

Source File: 00000000.00000002.1643917647.0000000000021000.00000020.00000001.01000000.00000003.sdmp, Offset: 00020000, based on PE: true

Associated: 00000000.00000002.1643904003.0000000000020000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1643958107.00000000000AF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1643958107.00000000000D5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1643993044.00000000000DF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1644007204.00000000000E8000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_20000_Ship Docs_CI PL HBL COO_.jbxd

Similarity

API ID: BuffCharMessageSendUpper
String ID: DESELECT$FINDITEM$GETITEMCOUNT$GETSELECTED$GETSELECTEDCOUNT$GETSUBITEMCOUNT$GETTEXT$ISSELECTED$SELECT$SELECTALL$SELECTCLEAR$SELECTINVERT$VIEWCHANGE
API String ID: 3974292440-719923060
Opcode ID: 0d11c1dfed3c039e2504960b129bcd90b0805741183c4932706f68b610d01e0d
Instruction ID: 67b05e96bb872e65b71f3d441a937ca921125b062011d520fce051f05fe9f485
Opcode Fuzzy Hash: 0d11c1dfed3c039e2504960b129bcd90b0805741183c4932706f68b610d01e0d
Instruction Fuzzy Hash: ACA1BC34614311DBCB14EF60C842AAEB3E5AF85314F14896DB89AAB393DB74ED09CB51

Function 000952F0 Relevance: 27.1, APIs: 18, Instructions: 124COMMON

Download Yara Rule

APIs

LoadCursorW.USER32(00000000,00007F89), ref: 00095309
LoadCursorW.USER32(00000000,00007F8A), ref: 00095314
LoadCursorW.USER32(00000000,00007F00), ref: 0009531F
LoadCursorW.USER32(00000000,00007F03), ref: 0009532A
LoadCursorW.USER32(00000000,00007F8B), ref: 00095335
LoadCursorW.USER32(00000000,00007F01), ref: 00095340
LoadCursorW.USER32(00000000,00007F81), ref: 0009534B
LoadCursorW.USER32(00000000,00007F88), ref: 00095356
LoadCursorW.USER32(00000000,00007F80), ref: 00095361
LoadCursorW.USER32(00000000,00007F86), ref: 0009536C
LoadCursorW.USER32(00000000,00007F83), ref: 00095377
LoadCursorW.USER32(00000000,00007F85), ref: 00095382
LoadCursorW.USER32(00000000,00007F82), ref: 0009538D
LoadCursorW.USER32(00000000,00007F84), ref: 00095398
LoadCursorW.USER32(00000000,00007F04), ref: 000953A3
LoadCursorW.USER32(00000000,00007F02), ref: 000953AE
GetCursorInfo.USER32(?), ref: 000953BE
GetLastError.KERNEL32(00000001,00000000), ref: 000953E9

Memory Dump Source

Source File: 00000000.00000002.1643917647.0000000000021000.00000020.00000001.01000000.00000003.sdmp, Offset: 00020000, based on PE: true

Associated: 00000000.00000002.1643904003.0000000000020000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1643958107.00000000000AF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1643958107.00000000000D5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1643993044.00000000000DF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1644007204.00000000000E8000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_20000_Ship Docs_CI PL HBL COO_.jbxd

Similarity

API ID: Cursor$Load$ErrorInfoLast
String ID:
API String ID: 3215588206-0
Opcode ID: 97bd6693ca5a25280fdad8dfd9fb97ca17c73804906cc9064fdfbaba6d17519a
Instruction ID: 56a2e2d4c009e96954616a4ad18e01b603b0a3aa482763d5afde265559b40195
Opcode Fuzzy Hash: 97bd6693ca5a25280fdad8dfd9fb97ca17c73804906cc9064fdfbaba6d17519a
Instruction Fuzzy Hash: 66417370E083196ADF509FBA8C4986EFFF8EF51B10F10452FA519E7291DAB89500CF51

Function 0007AA64 Relevance: 26.5, APIs: 14, Strings: 1, Instructions: 273windowtimeCOMMON

Download Yara Rule

APIs

GetClassNameW.USER32(?,?,00000100), ref: 0007AAA5
__swprintf.LIBCMT ref: 0007AB46
_wcscmp.LIBCMT ref: 0007AB59
SendMessageTimeoutW.USER32(?,?,00000101,00000000,00000002,00001388,?), ref: 0007ABAE
_wcscmp.LIBCMT ref: 0007ABEA
GetClassNameW.USER32(?,?,00000400), ref: 0007AC21
GetDlgCtrlID.USER32(?), ref: 0007AC73
GetWindowRect.USER32(?,?), ref: 0007ACA9
GetParent.USER32(?), ref: 0007ACC7
ScreenToClient.USER32(00000000), ref: 0007ACCE
GetClassNameW.USER32(?,?,00000100), ref: 0007AD48
_wcscmp.LIBCMT ref: 0007AD5C
GetWindowTextW.USER32(?,?,00000400), ref: 0007AD82
_wcscmp.LIBCMT ref: 0007AD96

Part of subcall function 0004386C: _iswctype.LIBCMT ref: 00043874

Strings

%s%u, xrefs: 0007AB40

Memory Dump Source

Source File: 00000000.00000002.1643917647.0000000000021000.00000020.00000001.01000000.00000003.sdmp, Offset: 00020000, based on PE: true

Associated: 00000000.00000002.1643904003.0000000000020000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1643958107.00000000000AF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1643958107.00000000000D5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1643993044.00000000000DF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1644007204.00000000000E8000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_20000_Ship Docs_CI PL HBL COO_.jbxd

Similarity

API ID: _wcscmp$ClassName$Window$ClientCtrlMessageParentRectScreenSendTextTimeout__swprintf_iswctype
String ID: %s%u
API String ID: 3744389584-679674701
Opcode ID: 8db46bb3878784f6e72db9b44c150596519c6593c2bb07d40c49399c9877a6c6
Instruction ID: b9ed06e2ebd4f30c9c870b7480449782f0749346d66e0223575b7a7049849202
Opcode Fuzzy Hash: 8db46bb3878784f6e72db9b44c150596519c6593c2bb07d40c49399c9877a6c6
Instruction Fuzzy Hash: DFA1F071B04606AFD724DF60C884BEEB7E8FF85315F008529F99E82151DB38E945CB96

Function 0007B397 Relevance: 26.5, APIs: 13, Strings: 2, Instructions: 249COMMON

Download Yara Rule

APIs

GetClassNameW.USER32(00000008,?,00000400), ref: 0007B3DB
_wcscmp.LIBCMT ref: 0007B3EC
GetWindowTextW.USER32(00000001,?,00000400), ref: 0007B414
CharUpperBuffW.USER32(?,00000000), ref: 0007B431
_wcscmp.LIBCMT ref: 0007B44F
_wcsstr.LIBCMT ref: 0007B460
GetClassNameW.USER32(00000018,?,00000400), ref: 0007B498
_wcscmp.LIBCMT ref: 0007B4A8
GetWindowTextW.USER32(00000002,?,00000400), ref: 0007B4CF
GetClassNameW.USER32(00000018,?,00000400), ref: 0007B518
_wcscmp.LIBCMT ref: 0007B528
GetClassNameW.USER32(00000010,?,00000400), ref: 0007B550
GetWindowRect.USER32(00000004,?), ref: 0007B5B9

Strings

@, xrefs: 0007B3BC
ThumbnailClass, xrefs: 0007B4A3, 0007B523

Memory Dump Source

Source File: 00000000.00000002.1643917647.0000000000021000.00000020.00000001.01000000.00000003.sdmp, Offset: 00020000, based on PE: true

Associated: 00000000.00000002.1643904003.0000000000020000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1643958107.00000000000AF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1643958107.00000000000D5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1643993044.00000000000DF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1644007204.00000000000E8000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_20000_Ship Docs_CI PL HBL COO_.jbxd

Similarity

API ID: ClassName_wcscmp$Window$Text$BuffCharRectUpper_wcsstr
String ID: @$ThumbnailClass
API String ID: 1788623398-1539354611
Opcode ID: de2a6732c7a9386d5a1aade01eb1623d8d6d81174177bda0fb6ccb19c0abaab4
Instruction ID: f08ec036b5cc439c1e3230c47848758f50220cfc6a561f77f5601959d10e536d
Opcode Fuzzy Hash: de2a6732c7a9386d5a1aade01eb1623d8d6d81174177bda0fb6ccb19c0abaab4
Instruction Fuzzy Hash: 5F81AF7140830A9FDB54DF14C885FAA7BE8EF44314F08C569FD899A092DB38DE49CB65

Function 0007B1E0 Relevance: 26.4, APIs: 3, Strings: 12, Instructions: 105COMMON

Download Yara Rule

APIs

__wcsnicmp.LIBCMT ref: 0007B23F

Strings

ACTIVE, xrefs: 0007B21A
[HANDLE:, xrefs: 0007B24B
ALL, xrefs: 0007B2D3
[REGEXPTITLE:, xrefs: 0007B267
REGEXP=, xrefs: 0007B254
HANDLE=, xrefs: 0007B238
LAST, xrefs: 0007B204
CLASSNAME=, xrefs: 0007B27C
[ACTIVE, xrefs: 0007B22C
[CLASS:, xrefs: 0007B28F
[LAST, xrefs: 0007B2EC
[ALL, xrefs: 0007B2E5

Memory Dump Source

Source File: 00000000.00000002.1643917647.0000000000021000.00000020.00000001.01000000.00000003.sdmp, Offset: 00020000, based on PE: true

Associated: 00000000.00000002.1643904003.0000000000020000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1643958107.00000000000AF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1643958107.00000000000D5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1643993044.00000000000DF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1644007204.00000000000E8000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_20000_Ship Docs_CI PL HBL COO_.jbxd

Similarity

API ID: __wcsnicmp
String ID: ACTIVE$ALL$CLASSNAME=$HANDLE=$LAST$REGEXP=$[ACTIVE$[ALL$[CLASS:$[HANDLE:$[LAST$[REGEXPTITLE:
API String ID: 1038674560-1810252412
Opcode ID: 7cf5214f6f4a68872309f66ba7428cc2cbaa5dc71f6a7d3246a16b273239cfb1
Instruction ID: 5c86f6bbb72855a63da11d174ab1e9a366efabc5bc1f5fd17759cda9b0d80f40
Opcode Fuzzy Hash: 7cf5214f6f4a68872309f66ba7428cc2cbaa5dc71f6a7d3246a16b273239cfb1
Instruction Fuzzy Hash: C431F030A49315A6DB14FA60DD43FEE77B89F20750F20402AF909B51E3EF65AF05C669

Function 0007C4C1 Relevance: 25.7, APIs: 17, Instructions: 169windowtimeCOMMON

Download Yara Rule

APIs

LoadIconW.USER32(00000063), ref: 0007C4D4
SendMessageW.USER32(?,00000080,00000000,00000000), ref: 0007C4E6
SetWindowTextW.USER32(?,?), ref: 0007C4FD
GetDlgItem.USER32(?,000003EA), ref: 0007C512
SetWindowTextW.USER32(00000000,?), ref: 0007C518
GetDlgItem.USER32(?,000003E9), ref: 0007C528
SetWindowTextW.USER32(00000000,?), ref: 0007C52E
SendDlgItemMessageW.USER32(?,000003E9,000000CC,?,00000000), ref: 0007C54F
SendDlgItemMessageW.USER32(?,000003E9,000000C5,00000000,00000000), ref: 0007C569
GetWindowRect.USER32(?,?), ref: 0007C572
SetWindowTextW.USER32(?,?), ref: 0007C5DD
GetDesktopWindow.USER32 ref: 0007C5E3
GetWindowRect.USER32(00000000), ref: 0007C5EA
MoveWindow.USER32(?,?,?,?,00000000,00000000), ref: 0007C636
GetClientRect.USER32(?,?), ref: 0007C643
PostMessageW.USER32(?,00000005,00000000,00000000), ref: 0007C668
SetTimer.USER32(?,0000040A,00000000,00000000), ref: 0007C693

Memory Dump Source

Source File: 00000000.00000002.1643917647.0000000000021000.00000020.00000001.01000000.00000003.sdmp, Offset: 00020000, based on PE: true

Associated: 00000000.00000002.1643904003.0000000000020000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1643958107.00000000000AF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1643958107.00000000000D5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1643993044.00000000000DF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1644007204.00000000000E8000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_20000_Ship Docs_CI PL HBL COO_.jbxd

Similarity

API ID: Window$ItemMessageText$RectSend$ClientDesktopIconLoadMovePostTimer
String ID:
API String ID: 3869813825-0
Opcode ID: 33b3de1d16d43a607bd82c08ccebd738e2aacee0ea136d82c3734a6e319c6791
Instruction ID: 84d64b94fbed1835c5671d3685536482a8c43fd7211d53c3462a7373b2dc78d4
Opcode Fuzzy Hash: 33b3de1d16d43a607bd82c08ccebd738e2aacee0ea136d82c3734a6e319c6791
Instruction Fuzzy Hash: 49513F71900B0AAFEB209FA8DD85F6EBBF5FF04705F00452CE686A25A0D779E944CB54

Function 000AA428 Relevance: 24.7, APIs: 12, Strings: 2, Instructions: 205windowCOMMON

Download Yara Rule

APIs

_memset.LIBCMT ref: 000AA4C8
DestroyWindow.USER32(?,?), ref: 000AA542

Part of subcall function 00027D2C: _memmove.LIBCMT ref: 00027D66

CreateWindowExW.USER32(00000008,tooltips_class32,00000000,?,80000000,80000000,80000000,80000000,?,00000000,00000000,?), ref: 000AA5BC
SendMessageW.USER32(00000000,00000433,00000000,00000030), ref: 000AA5DE
SendMessageW.USER32(00000000,00000432,00000000,00000030), ref: 000AA5F1
DestroyWindow.USER32(00000000), ref: 000AA613
CreateWindowExW.USER32(00000008,tooltips_class32,00000000,?,80000000,80000000,80000000,80000000,?,00000000,00020000,00000000), ref: 000AA64A
SendMessageW.USER32(00000000,00000432,00000000,00000030), ref: 000AA663
GetDesktopWindow.USER32 ref: 000AA67C
GetWindowRect.USER32(00000000), ref: 000AA683
SendMessageW.USER32(00000000,00000418,00000000,?), ref: 000AA69B
SendMessageW.USER32(00000000,00000421,?,00000000), ref: 000AA6B3

Part of subcall function 000225DB: GetWindowLongW.USER32(?,000000EB), ref: 000225EC

Strings

0, xrefs: 000AA4DE
tooltips_class32, xrefs: 000AA5B5, 000AA643

Memory Dump Source

Source File: 00000000.00000002.1643917647.0000000000021000.00000020.00000001.01000000.00000003.sdmp, Offset: 00020000, based on PE: true

Associated: 00000000.00000002.1643904003.0000000000020000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1643958107.00000000000AF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1643958107.00000000000D5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1643993044.00000000000DF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1644007204.00000000000E8000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_20000_Ship Docs_CI PL HBL COO_.jbxd

Similarity

API ID: Window$MessageSend$CreateDestroy$DesktopLongRect_memmove_memset
String ID: 0$tooltips_class32
API String ID: 1297703922-3619404913
Opcode ID: d3504bba0d2ab624ce71b5597b0810a13f1da7700e1e49aa71bb4324cac69a46
Instruction ID: 09402e10381059f44603e29a26fa0127927d4b36bf6a36e77583a02e4e4b4a55
Opcode Fuzzy Hash: d3504bba0d2ab624ce71b5597b0810a13f1da7700e1e49aa71bb4324cac69a46
Instruction Fuzzy Hash: 4371BE70240245AFE720CF68DC45F6A77E5FB9A700F08452DF9859B2A1DB75E901CF62

Function 000AC8EE Relevance: 24.7, APIs: 11, Strings: 3, Instructions: 181windowfileCOMMON

Download Yara Rule

APIs

Part of subcall function 00022612: GetWindowLongW.USER32(?,000000EB), ref: 00022623

DragQueryPoint.SHELL32(?,?), ref: 000AC917

Part of subcall function 000AADF1: ClientToScreen.USER32(?,?), ref: 000AAE1A
Part of subcall function 000AADF1: GetWindowRect.USER32(?,?), ref: 000AAE90
Part of subcall function 000AADF1: PtInRect.USER32(?,?,000AC304), ref: 000AAEA0

SendMessageW.USER32(?,000000B0,?,?), ref: 000AC980
DragQueryFileW.SHELL32(?,000000FF,00000000,00000000), ref: 000AC98B
DragQueryFileW.SHELL32(?,00000000,?,00000104), ref: 000AC9AE
_wcscat.LIBCMT ref: 000AC9DE
SendMessageW.USER32(?,000000C2,00000001,?), ref: 000AC9F5
SendMessageW.USER32(?,000000B0,?,?), ref: 000ACA0E
SendMessageW.USER32(?,000000B1,?,?), ref: 000ACA25
SendMessageW.USER32(?,000000B1,?,?), ref: 000ACA47
DragFinish.SHELL32(?), ref: 000ACA4E
DefDlgProcW.USER32(?,00000233,?,00000000,?,?,?), ref: 000ACB41

Strings

@GUI_DRAGFILE, xrefs: 000ACAF0
@GUI_DROPID, xrefs: 000ACA6E
@GUI_DRAGID, xrefs: 000ACAB9

Memory Dump Source

Source File: 00000000.00000002.1643917647.0000000000021000.00000020.00000001.01000000.00000003.sdmp, Offset: 00020000, based on PE: true

Associated: 00000000.00000002.1643904003.0000000000020000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1643958107.00000000000AF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1643958107.00000000000D5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1643993044.00000000000DF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1644007204.00000000000E8000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_20000_Ship Docs_CI PL HBL COO_.jbxd

Similarity

API ID: MessageSend$Drag$Query$FileRectWindow$ClientFinishLongPointProcScreen_wcscat
String ID: @GUI_DRAGFILE$@GUI_DRAGID$@GUI_DROPID
API String ID: 169749273-3440237614
Opcode ID: 028840f76c059f273b026b332d2302462cc651323205b0b180606a38726feca2
Instruction ID: 8e98dcf53476ea983894b9d009bf6dacddaac286f5c6d6211c105d3187e826ba
Opcode Fuzzy Hash: 028840f76c059f273b026b332d2302462cc651323205b0b180606a38726feca2
Instruction Fuzzy Hash: 9E619F71108301AFD711DFA0DC85DAFBBE8EF89750F04092EF595961A2DB709A09CBA2

Function 000A4619 Relevance: 23.0, APIs: 2, Strings: 11, Instructions: 251windowCOMMON

Download Yara Rule

APIs

CharUpperBuffW.USER32(?,?), ref: 000A46AB
SendMessageW.USER32(?,00001105,00000000,00000000), ref: 000A46F6

Strings

GETTEXT, xrefs: 000A4849
CHECK, xrefs: 000A4716
GETSELECTED, xrefs: 000A4806
SELECT, xrefs: 000A48A7
GETTOTALCOUNT, xrefs: 000A46DD
COLLAPSE, xrefs: 000A473C
ISCHECKED, xrefs: 000A4879
EXPAND, xrefs: 000A47A8
UNCHECK, xrefs: 000A48D2
GETITEMCOUNT, xrefs: 000A47D8
EXISTS, xrefs: 000A475F

Memory Dump Source

Source File: 00000000.00000002.1643917647.0000000000021000.00000020.00000001.01000000.00000003.sdmp, Offset: 00020000, based on PE: true

Associated: 00000000.00000002.1643904003.0000000000020000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1643958107.00000000000AF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1643958107.00000000000D5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1643993044.00000000000DF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1644007204.00000000000E8000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_20000_Ship Docs_CI PL HBL COO_.jbxd

Similarity

API ID: BuffCharMessageSendUpper
String ID: CHECK$COLLAPSE$EXISTS$EXPAND$GETITEMCOUNT$GETSELECTED$GETTEXT$GETTOTALCOUNT$ISCHECKED$SELECT$UNCHECK
API String ID: 3974292440-4258414348
Opcode ID: 7c7848499a8449b86bb84c3a3c1266b6dd4fb8fdb8733ef0668076fbf8983b20
Instruction ID: 657f969552849b8064a224c38e0e97769c2d4c987afc66111ff66b84727f1696
Opcode Fuzzy Hash: 7c7848499a8449b86bb84c3a3c1266b6dd4fb8fdb8733ef0668076fbf8983b20
Instruction Fuzzy Hash: 7591BF786047119FCB14EF54D441AAEB7E1AF85310F00886DF8966B3A3CB75ED4ACB86

Function 000ABAB8 Relevance: 22.9, APIs: 10, Strings: 3, Instructions: 197windowlibraryCOMMON

Download Yara Rule

APIs

LoadImageW.USER32(00000000,?,00000001,?,?,00002010), ref: 000ABB6E
LoadLibraryExW.KERNEL32(?,00000000,00000032,?,?,00000001,?,?,?,000A6D80,?), ref: 000ABBCA
LoadImageW.USER32(?,?,00000001,?,?,00000000), ref: 000ABC03
LoadImageW.USER32(00000000,?,00000001,?,?,00000000), ref: 000ABC46
LoadImageW.USER32(?,?,00000001,?,?,00000000), ref: 000ABC7D
FreeLibrary.KERNEL32(?), ref: 000ABC89
ExtractIconExW.SHELL32(?,00000000,00000000,00000000,00000001), ref: 000ABC99
DestroyIcon.USER32(?), ref: 000ABCA8
SendMessageW.USER32(?,00000170,00000000,00000000), ref: 000ABCC5
SendMessageW.USER32(?,00000064,00000172,00000001), ref: 000ABCD1

Part of subcall function 0004313D: __wcsicmp_l.LIBCMT ref: 000431C6

Strings

.dll, xrefs: 000ABB27
.icl, xrefs: 000ABAE4
.exe, xrefs: 000ABB04

Memory Dump Source

Source File: 00000000.00000002.1643917647.0000000000021000.00000020.00000001.01000000.00000003.sdmp, Offset: 00020000, based on PE: true

Associated: 00000000.00000002.1643904003.0000000000020000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1643958107.00000000000AF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1643958107.00000000000D5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1643993044.00000000000DF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1644007204.00000000000E8000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_20000_Ship Docs_CI PL HBL COO_.jbxd

Similarity

API ID: Load$Image$IconLibraryMessageSend$DestroyExtractFree__wcsicmp_l
String ID: .dll$.exe$.icl
API String ID: 1212759294-1154884017
Opcode ID: f3d587733db523549341494509353ca40a0274dbe7798e27f40b4b36e3deeda4
Instruction ID: 951fb11b016f05636080624ad83e9989dff6e337a61dc4e7cbc3727b6c69dcb0
Opcode Fuzzy Hash: f3d587733db523549341494509353ca40a0274dbe7798e27f40b4b36e3deeda4
Instruction Fuzzy Hash: D061DF71600619BAEB24DFA4CC41FFE77A8EF09721F104219F915D61D2DBB4A990DBA0

Function 0008A5BD Relevance: 22.9, APIs: 5, Strings: 8, Instructions: 138COMMON

Download Yara Rule

APIs

Part of subcall function 00029997: __itow.LIBCMT ref: 000299C2
Part of subcall function 00029997: __swprintf.LIBCMT ref: 00029A0C

CharLowerBuffW.USER32(?,?), ref: 0008A636
GetDriveTypeW.KERNEL32 ref: 0008A683
mciSendStringW.WINMM(?,00000000,00000000,00000000), ref: 0008A6CB
mciSendStringW.WINMM(?,00000000,00000000,00000000), ref: 0008A702
mciSendStringW.WINMM(?,00000000,00000000,00000000), ref: 0008A730

Part of subcall function 00027D2C: _memmove.LIBCMT ref: 00027D66

Strings

open, xrefs: 0008A65D
close, xrefs: 0008A63C
closed, xrefs: 0008A64A, 0008A653
close cd wait, xrefs: 0008A71B
open , xrefs: 0008A692
set cd door , xrefs: 0008A6D1
wait, xrefs: 0008A6ED
type cdaudio alias cd wait, xrefs: 0008A6AE

Memory Dump Source

Source File: 00000000.00000002.1643917647.0000000000021000.00000020.00000001.01000000.00000003.sdmp, Offset: 00020000, based on PE: true

Associated: 00000000.00000002.1643904003.0000000000020000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1643958107.00000000000AF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1643958107.00000000000D5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1643993044.00000000000DF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1644007204.00000000000E8000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_20000_Ship Docs_CI PL HBL COO_.jbxd

Similarity

API ID: SendString$BuffCharDriveLowerType__itow__swprintf_memmove
String ID: type cdaudio alias cd wait$ wait$close$close cd wait$closed$open$open $set cd door
API String ID: 2698844021-4113822522
Opcode ID: bc7d36c18d4696b1210440d2d4761446fa04d6aaab85f430d9fd09cd971d2c13
Instruction ID: 4f311d29e46be7be052f4b4cc0254bd21320ab67218a1d2dc4cee1b60bbb68f3
Opcode Fuzzy Hash: bc7d36c18d4696b1210440d2d4761446fa04d6aaab85f430d9fd09cd971d2c13
Instruction Fuzzy Hash: F9515E716083159FD700EF20D8819AAB7F4FF85718F14496DF89957252DB31EE09CB52

Function 0008A45A Relevance: 22.9, APIs: 10, Strings: 3, Instructions: 102fileCOMMON

Download Yara Rule

APIs

GetFullPathNameW.KERNEL32(?,00007FFF,?,?), ref: 0008A47A
__swprintf.LIBCMT ref: 0008A49C
CreateDirectoryW.KERNEL32(?,00000000), ref: 0008A4D9
CreateFileW.KERNEL32(?,40000000,00000000,00000000,00000003,02200000,00000000), ref: 0008A4FE
_memset.LIBCMT ref: 0008A51D
_wcsncpy.LIBCMT ref: 0008A559
DeviceIoControl.KERNEL32(00000000,000900A4,?,?,00000000,00000000,?,00000000), ref: 0008A58E
CloseHandle.KERNEL32(00000000), ref: 0008A599
RemoveDirectoryW.KERNEL32(?), ref: 0008A5A2
CloseHandle.KERNEL32(00000000), ref: 0008A5AC

Strings

\, xrefs: 0008A4B2
:, xrefs: 0008A4BD
\??\%s, xrefs: 0008A496

Memory Dump Source

Source File: 00000000.00000002.1643917647.0000000000021000.00000020.00000001.01000000.00000003.sdmp, Offset: 00020000, based on PE: true

Associated: 00000000.00000002.1643904003.0000000000020000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1643958107.00000000000AF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1643958107.00000000000D5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1643993044.00000000000DF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1644007204.00000000000E8000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_20000_Ship Docs_CI PL HBL COO_.jbxd

Similarity

API ID: CloseCreateDirectoryHandle$ControlDeviceFileFullNamePathRemove__swprintf_memset_wcsncpy
String ID: :$\$\??\%s
API String ID: 2733774712-3457252023
Opcode ID: 2dfa2d66d838c5a7a990784ae6c7124701c06e216cb633dc4f2a39c751b000a3
Instruction ID: 76bbddb9af226b9e73a24892c340e1f751afa5c115df7ba475bc13e24288921c
Opcode Fuzzy Hash: 2dfa2d66d838c5a7a990784ae6c7124701c06e216cb633dc4f2a39c751b000a3
Instruction Fuzzy Hash: D031A2B260011AABEB209FA0DC48FFB73BCEF8A701F1041B6FA48D2150E77497448B25

Function 0005AB1B Relevance: 22.7, APIs: 15, Instructions: 211COMMONLIBRARYCODE

Download Yara Rule

APIs

_copy_environ.LIBCMT ref: 0005AB7B
___wtomb_environ.LIBCMT ref: 0005AB9D

Part of subcall function 00048D68: __getptd_noexit.LIBCMT ref: 00048D68

__malloc_crt.LIBCMT ref: 0005ABC5
__malloc_crt.LIBCMT ref: 0005ABE2
_free.LIBCMT ref: 0005AC19
__recalloc_crt.LIBCMT ref: 0005AC52
__recalloc_crt.LIBCMT ref: 0005AC97
_strlen.LIBCMT ref: 0005ACC3
__calloc_crt.LIBCMT ref: 0005ACCD
_strlen.LIBCMT ref: 0005ACDC
SetEnvironmentVariableA.KERNEL32(00000000,00000000,?,?,?,?,00000000,00000000), ref: 0005AD0A
_free.LIBCMT ref: 0005AD24
_free.LIBCMT ref: 0005AD31
_free.LIBCMT ref: 0005AD43
__invoke_watson.LIBCMT ref: 0005AD5D

Memory Dump Source

Source File: 00000000.00000002.1643917647.0000000000021000.00000020.00000001.01000000.00000003.sdmp, Offset: 00020000, based on PE: true

Associated: 00000000.00000002.1643904003.0000000000020000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1643958107.00000000000AF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1643958107.00000000000D5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1643993044.00000000000DF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1644007204.00000000000E8000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_20000_Ship Docs_CI PL HBL COO_.jbxd

Similarity

API ID: _free$__malloc_crt__recalloc_crt_strlen$EnvironmentVariable___wtomb_environ__calloc_crt__getptd_noexit__invoke_watson_copy_environ
String ID:
API String ID: 884005220-0
Opcode ID: b715c4b16dc4e7c9cd22eac47efc5989703b17e7751d67a6ce78b30c0bea3ee7
Instruction ID: 2d3c2fdd722e31e39a048f36cfcbb655d7926bc6b035c43b660547761a025b92
Opcode Fuzzy Hash: b715c4b16dc4e7c9cd22eac47efc5989703b17e7751d67a6ce78b30c0bea3ee7
Instruction Fuzzy Hash: C461C9B1A00205EFFB205F24D8417AF7BE5EF12723F144769EC019B192DB799944C7A6

Function 0008DB04 Relevance: 21.2, APIs: 11, Strings: 1, Instructions: 230COMMON

Download Yara Rule

APIs

__wsplitpath.LIBCMT ref: 0008DC7B
_wcscat.LIBCMT ref: 0008DC93
_wcscat.LIBCMT ref: 0008DCA5
GetCurrentDirectoryW.KERNEL32(00007FFF,?), ref: 0008DCBA
SetCurrentDirectoryW.KERNEL32(?), ref: 0008DCCE
GetFileAttributesW.KERNEL32(?), ref: 0008DCE6
SetFileAttributesW.KERNEL32(?,00000000), ref: 0008DD00
SetCurrentDirectoryW.KERNEL32(?), ref: 0008DD12

Strings

*.*, xrefs: 0008DD51

Memory Dump Source

Source File: 00000000.00000002.1643917647.0000000000021000.00000020.00000001.01000000.00000003.sdmp, Offset: 00020000, based on PE: true

Associated: 00000000.00000002.1643904003.0000000000020000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1643958107.00000000000AF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1643958107.00000000000D5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1643993044.00000000000DF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1644007204.00000000000E8000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_20000_Ship Docs_CI PL HBL COO_.jbxd

Similarity

API ID: CurrentDirectory$AttributesFile_wcscat$__wsplitpath
String ID: *.*
API String ID: 34673085-438819550
Opcode ID: b190622eee4b48f37519aef505fb83a13d3534599679136de5741813732e812e
Instruction ID: 3812d5a9a2a58dc91a922241a7d01d1eab92d047c77949ffd320c8f83dd0f6aa
Opcode Fuzzy Hash: b190622eee4b48f37519aef505fb83a13d3534599679136de5741813732e812e
Instruction Fuzzy Hash: A4814C71504341DBDB64EF64C8459AEB7E8BB89310F19892BF8C9CB291EB34DD44CB52

Function 000AC49C Relevance: 21.2, APIs: 11, Strings: 1, Instructions: 229windowCOMMON

Download Yara Rule

APIs

Part of subcall function 00022612: GetWindowLongW.USER32(?,000000EB), ref: 00022623

PostMessageW.USER32(?,00000111,00000000,00000000), ref: 000AC4EC
GetFocus.USER32 ref: 000AC4FC
GetDlgCtrlID.USER32(00000000), ref: 000AC507
_memset.LIBCMT ref: 000AC632
GetMenuItemInfoW.USER32(?,00000000,00000000,?), ref: 000AC65D
GetMenuItemCount.USER32(?), ref: 000AC67D
GetMenuItemID.USER32(?,00000000), ref: 000AC690
GetMenuItemInfoW.USER32(?,-00000001,00000001,?), ref: 000AC6C4
GetMenuItemInfoW.USER32(?,?,00000001,?), ref: 000AC70C
CheckMenuRadioItem.USER32(?,00000000,?,00000000,00000400), ref: 000AC744
DefDlgProcW.USER32(?,00000111,?,?,?,?,?,?,?), ref: 000AC779

Strings

0, xrefs: 000AC62A

Memory Dump Source

Source File: 00000000.00000002.1643917647.0000000000021000.00000020.00000001.01000000.00000003.sdmp, Offset: 00020000, based on PE: true

Associated: 00000000.00000002.1643904003.0000000000020000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1643958107.00000000000AF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1643958107.00000000000D5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1643993044.00000000000DF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1644007204.00000000000E8000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_20000_Ship Docs_CI PL HBL COO_.jbxd

Similarity

API ID: ItemMenu$Info$CheckCountCtrlFocusLongMessagePostProcRadioWindow_memset
String ID: 0
API String ID: 1296962147-4108050209
Opcode ID: 055644bf7de32b82964abe731989be46bf2ffe7d8c533ee75188efc8a9094215
Instruction ID: 6efc564351d145154e9e6d6054d57f06f5bd661e757add818b72d3c7501cf586
Opcode Fuzzy Hash: 055644bf7de32b82964abe731989be46bf2ffe7d8c533ee75188efc8a9094215
Instruction Fuzzy Hash: 7C81AD70608301AFE720CFA4D984EAFBBE8FB8A354F01452DF99597291D731D945CBA2

Function 000783F4 Relevance: 21.2, APIs: 14, Instructions: 179memoryCOMMON

Download Yara Rule

APIs

Part of subcall function 0007874A: GetUserObjectSecurity.USER32(?,00000004,?,00000000,?), ref: 00078766
Part of subcall function 0007874A: GetLastError.KERNEL32(?,0007822A,?,?,?), ref: 00078770
Part of subcall function 0007874A: GetProcessHeap.KERNEL32(00000008,?,?,0007822A,?,?,?), ref: 0007877F
Part of subcall function 0007874A: HeapAlloc.KERNEL32(00000000,?,0007822A,?,?,?), ref: 00078786
Part of subcall function 0007874A: GetUserObjectSecurity.USER32(?,00000004,00000000,?,?), ref: 0007879D

Part of subcall function 000787E7: GetProcessHeap.KERNEL32(00000008,00078240,00000000,00000000,?,00078240,?), ref: 000787F3
Part of subcall function 000787E7: HeapAlloc.KERNEL32(00000000,?,00078240,?), ref: 000787FA
Part of subcall function 000787E7: InitializeSecurityDescriptor.ADVAPI32(00000000,00000001,?,00078240,?), ref: 0007880B

GetSecurityDescriptorDacl.ADVAPI32(?,?,?,?), ref: 00078458
_memset.LIBCMT ref: 0007846D
GetAclInformation.ADVAPI32(?,?,0000000C,00000002), ref: 0007848C
GetLengthSid.ADVAPI32(?), ref: 0007849D
GetAce.ADVAPI32(?,00000000,?), ref: 000784DA
AddAce.ADVAPI32(?,00000002,000000FF,?,?), ref: 000784F6
GetLengthSid.ADVAPI32(?), ref: 00078513
GetProcessHeap.KERNEL32(00000008,-00000008), ref: 00078522
HeapAlloc.KERNEL32(00000000), ref: 00078529
GetLengthSid.ADVAPI32(?,00000008,?), ref: 0007854A
CopySid.ADVAPI32(00000000), ref: 00078551
AddAce.ADVAPI32(?,00000002,000000FF,00000000,?), ref: 00078582
SetSecurityDescriptorDacl.ADVAPI32(?,00000001,?,00000000), ref: 000785A8
SetUserObjectSecurity.USER32(?,00000004,?), ref: 000785BC

Memory Dump Source

Source File: 00000000.00000002.1643917647.0000000000021000.00000020.00000001.01000000.00000003.sdmp, Offset: 00020000, based on PE: true

Associated: 00000000.00000002.1643904003.0000000000020000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1643958107.00000000000AF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1643958107.00000000000D5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1643993044.00000000000DF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1644007204.00000000000E8000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_20000_Ship Docs_CI PL HBL COO_.jbxd

Similarity

API ID: HeapSecurity$AllocDescriptorLengthObjectProcessUser$Dacl$CopyErrorInformationInitializeLast_memset
String ID:
API String ID: 3996160137-0
Opcode ID: 5c6760b80ef37035af3c97c39f61fb95fb41415f2b61700bcb5482ee8dac7272
Instruction ID: e072a7dc4f1cb87662eea1c8e3a8942bee609025f54ec7ef49213d526044dd66
Opcode Fuzzy Hash: 5c6760b80ef37035af3c97c39f61fb95fb41415f2b61700bcb5482ee8dac7272
Instruction Fuzzy Hash: B0615871D4060AABDF10DFA0DC48EEEBBB9FF05300F14C169E919A6291DB389A04CF64

Function 0009762D Relevance: 21.2, APIs: 11, Strings: 1, Instructions: 160windowCOMMON

Download Yara Rule

APIs

GetDC.USER32(00000000), ref: 000976A2
CreateCompatibleBitmap.GDI32(00000000,00000007,?), ref: 000976AE
CreateCompatibleDC.GDI32(?), ref: 000976BA
SelectObject.GDI32(00000000,?), ref: 000976C7
StretchBlt.GDI32(00000006,00000000,00000000,00000007,?,?,?,?,00000007,?,00CC0020), ref: 0009771B
GetDIBits.GDI32(00000006,?,00000000,00000000,00000000,00000028,00000000), ref: 00097757
GetDIBits.GDI32(00000006,?,00000000,?,00000000,00000028,00000000), ref: 0009777B
SelectObject.GDI32(00000006,?), ref: 00097783
DeleteObject.GDI32(?), ref: 0009778C
DeleteDC.GDI32(00000006), ref: 00097793
ReleaseDC.USER32(00000000,?), ref: 0009779E

Strings

(, xrefs: 00097723

Memory Dump Source

Source File: 00000000.00000002.1643917647.0000000000021000.00000020.00000001.01000000.00000003.sdmp, Offset: 00020000, based on PE: true

Associated: 00000000.00000002.1643904003.0000000000020000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1643958107.00000000000AF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1643958107.00000000000D5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1643993044.00000000000DF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1644007204.00000000000E8000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_20000_Ship Docs_CI PL HBL COO_.jbxd

Similarity

API ID: Object$BitsCompatibleCreateDeleteSelect$BitmapReleaseStretch
String ID: (
API String ID: 2598888154-3887548279
Opcode ID: eaeda27c4e8666a12bd03e1cad4e511b4922aea17df855aee8e8365fabdb52c9
Instruction ID: 63f795637867e7a851212694b22bbe3068cd8667544681cc2150727e98ae3072
Opcode Fuzzy Hash: eaeda27c4e8666a12bd03e1cad4e511b4922aea17df855aee8e8365fabdb52c9
Instruction Fuzzy Hash: B0515A76904609EFDB25CFA8CC85EAEBBB9EF49310F14852DF949A7211D735A840CB60

Function 0008A0B5 Relevance: 21.2, APIs: 7, Strings: 5, Instructions: 156COMMON

Download Yara Rule

APIs

LoadStringW.USER32(00000066,?,00000FFF,000AFB78), ref: 0008A0FC

Part of subcall function 00027F41: _memmove.LIBCMT ref: 00027F82

LoadStringW.USER32(?,?,00000FFF,?), ref: 0008A11E
__swprintf.LIBCMT ref: 0008A177
__swprintf.LIBCMT ref: 0008A190
_wprintf.LIBCMT ref: 0008A246
_wprintf.LIBCMT ref: 0008A264

Strings

Line %d (File "%s"):, xrefs: 0008A171, 0008A18A
"%s" (%d) : ==> %s:%s%s, xrefs: 0008A241
^ ERROR, xrefs: 0008A1E8
Error: , xrefs: 0008A20E
"%s" (%d) : ==> %s:, xrefs: 0008A25F

Memory Dump Source

Source File: 00000000.00000002.1643917647.0000000000021000.00000020.00000001.01000000.00000003.sdmp, Offset: 00020000, based on PE: true

Associated: 00000000.00000002.1643904003.0000000000020000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1643958107.00000000000AF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1643958107.00000000000D5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1643993044.00000000000DF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1644007204.00000000000E8000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_20000_Ship Docs_CI PL HBL COO_.jbxd

Similarity

API ID: LoadString__swprintf_wprintf$_memmove
String ID: Error: $"%s" (%d) : ==> %s:$"%s" (%d) : ==> %s:%s%s$Line %d (File "%s"):$^ ERROR
API String ID: 311963372-2391861430
Opcode ID: ed1fe87f98b1e23eb07801a8c04facdaca4448f3c6f1576e72ce865ce69c9c39
Instruction ID: 5e4cf9fea3140d6981361e17857c2d8b2832352cb31fb8cb1f1afca0d92959f6
Opcode Fuzzy Hash: ed1fe87f98b1e23eb07801a8c04facdaca4448f3c6f1576e72ce865ce69c9c39
Instruction Fuzzy Hash: FB51B171900219AADF15FBE0DD86EEEB778AF09300F100166F509761A2EB352F48DB61

Function 00026BEC Relevance: 19.7, APIs: 4, Strings: 7, Instructions: 478COMMON

Download Yara Rule

APIs

Part of subcall function 00040B9B: GetCurrentDirectoryW.KERNEL32(00007FFF,?,?,?,00026C6C,?,00008000), ref: 00040BB7

Part of subcall function 000248AE: GetFullPathNameW.KERNEL32(?,00007FFF,?,00000000,?,?,000248A1,?,?,000237C0,?), ref: 000248CE

SetCurrentDirectoryW.KERNEL32(?,?,?,?,00000000), ref: 00026D0D
SetCurrentDirectoryW.KERNEL32(?), ref: 00026E5A

Part of subcall function 000259CD: _wcscpy.LIBCMT ref: 00025A05

Part of subcall function 0004387D: _iswctype.LIBCMT ref: 00043885

Strings

EA06, xrefs: 0005E87B
Error opening the file, xrefs: 0005E866, 0005E8E1
AU3!, xrefs: 00026CC1
Bad directive syntax error, xrefs: 0005EBC6
#include depth exceeded. Make sure there are no recursive includes, xrefs: 0005E84A
>>>AUTOIT SCRIPT<<<, xrefs: 0005E8BF
Unterminated string, xrefs: 0005EC0D

Memory Dump Source

Source File: 00000000.00000002.1643917647.0000000000021000.00000020.00000001.01000000.00000003.sdmp, Offset: 00020000, based on PE: true

Associated: 00000000.00000002.1643904003.0000000000020000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1643958107.00000000000AF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1643958107.00000000000D5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1643993044.00000000000DF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1644007204.00000000000E8000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_20000_Ship Docs_CI PL HBL COO_.jbxd

Similarity

API ID: CurrentDirectory$FullNamePath_iswctype_wcscpy
String ID: #include depth exceeded. Make sure there are no recursive includes$>>>AUTOIT SCRIPT<<<$AU3!$Bad directive syntax error$EA06$Error opening the file$Unterminated string
API String ID: 537147316-1018226102
Opcode ID: 2df30d9588e31f84e9bc575914ca68cf395f0e4bf5bb6778f3bd57045361a048
Instruction ID: 6c5dd86409c62b9fe7633bfc1f57bdc8264e7a473d65cca2e7aa850ebd1e13ad
Opcode Fuzzy Hash: 2df30d9588e31f84e9bc575914ca68cf395f0e4bf5bb6778f3bd57045361a048
Instruction Fuzzy Hash: F002A1711083919FCB24EF24D8819AFBBE5BF85314F04492DF8C9972A2DB31DA49CB46

Function 000245DF Relevance: 19.7, APIs: 13, Instructions: 215windowCOMMON

Download Yara Rule

APIs

_memset.LIBCMT ref: 000245F9
GetMenuItemCount.USER32(000E6890), ref: 0005D7CD
GetMenuItemCount.USER32(000E6890), ref: 0005D87D
GetCursorPos.USER32(?), ref: 0005D8C1
SetForegroundWindow.USER32(00000000), ref: 0005D8CA
TrackPopupMenuEx.USER32(000E6890,00000000,?,00000000,00000000,00000000), ref: 0005D8DD
PostMessageW.USER32(00000000,00000000,00000000,00000000), ref: 0005D8E9

Memory Dump Source

Source File: 00000000.00000002.1643917647.0000000000021000.00000020.00000001.01000000.00000003.sdmp, Offset: 00020000, based on PE: true

Associated: 00000000.00000002.1643904003.0000000000020000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1643958107.00000000000AF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1643958107.00000000000D5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1643993044.00000000000DF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1644007204.00000000000E8000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_20000_Ship Docs_CI PL HBL COO_.jbxd

Similarity

API ID: Menu$CountItem$CursorForegroundMessagePopupPostTrackWindow_memset
String ID:
API String ID: 2751501086-0
Opcode ID: 8c0901ca41fcf77ea6d7c64f76d046445d2b1828cfe19c665fceca0a71c6245a
Instruction ID: 15023bfb40b12adbaa0db600f0cec436adbc41b2c405a10ebed19d8a4cf2f1ef
Opcode Fuzzy Hash: 8c0901ca41fcf77ea6d7c64f76d046445d2b1828cfe19c665fceca0a71c6245a
Instruction Fuzzy Hash: 5E71053060561ABAFB309F64DC89FAABFA4FF05355F200217F914661D1DBB15814DB91

Function 000A10A5 Relevance: 19.4, APIs: 1, Strings: 10, Instructions: 120COMMON

Download Yara Rule

APIs

CharUpperBuffW.USER32(?,?,?,?,?,?,?,000A0038,?,?), ref: 000A10BC

Strings

HKEY_LOCAL_MACHINE, xrefs: 000A1125
HKEY_CLASSES_ROOT, xrefs: 000A114F
HKCC, xrefs: 000A118A
HKCU, xrefs: 000A11AC
HKU, xrefs: 000A11CE
HKCR, xrefs: 000A1164
HKEY_CURRENT_USER, xrefs: 000A119B
HKEY_CURRENT_CONFIG, xrefs: 000A1179
HKEY_USERS, xrefs: 000A11BD
HKLM, xrefs: 000A113A

Memory Dump Source

Source File: 00000000.00000002.1643917647.0000000000021000.00000020.00000001.01000000.00000003.sdmp, Offset: 00020000, based on PE: true

Associated: 00000000.00000002.1643904003.0000000000020000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1643958107.00000000000AF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1643958107.00000000000D5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1643993044.00000000000DF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1644007204.00000000000E8000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_20000_Ship Docs_CI PL HBL COO_.jbxd

Similarity

API ID: BuffCharUpper
String ID: HKCC$HKCR$HKCU$HKEY_CLASSES_ROOT$HKEY_CURRENT_CONFIG$HKEY_CURRENT_USER$HKEY_LOCAL_MACHINE$HKEY_USERS$HKLM$HKU
API String ID: 3964851224-909552448
Opcode ID: bcac27f178873a39a37ccf985fb8c33de45db931eebdd8b9ceb61af6fa4d95af
Instruction ID: 57f176657c022e167966ed0220e453b8888d706d32d78f566daa5bd921d51c09
Opcode Fuzzy Hash: bcac27f178873a39a37ccf985fb8c33de45db931eebdd8b9ceb61af6fa4d95af
Instruction Fuzzy Hash: 0E41477054025ADBCF20EFD0E891AEE3764AF16340F504569FD916B292DB34AD2ACBA0

Function 00085569 Relevance: 19.3, APIs: 5, Strings: 6, Instructions: 74COMMON

Download Yara Rule

APIs

Part of subcall function 00027D2C: _memmove.LIBCMT ref: 00027D66

Part of subcall function 00027A84: _memmove.LIBCMT ref: 00027B0D

mciSendStringW.WINMM(status PlayMe mode,?,00000100,00000000), ref: 000855D2
mciSendStringW.WINMM(close PlayMe,00000000,00000000,00000000), ref: 000855E8
mciSendStringW.WINMM(?,00000000,00000000,00000000), ref: 000855F9
mciSendStringW.WINMM(play PlayMe wait,00000000,00000000,00000000), ref: 0008560B
mciSendStringW.WINMM(play PlayMe,00000000,00000000,00000000), ref: 0008561C

Strings

alias PlayMe, xrefs: 000855AB
play PlayMe, xrefs: 00085617
open , xrefs: 00085581
play PlayMe wait, xrefs: 00085606
status PlayMe mode, xrefs: 000855CD
close PlayMe, xrefs: 000855E3, 00085610

Memory Dump Source

Source File: 00000000.00000002.1643917647.0000000000021000.00000020.00000001.01000000.00000003.sdmp, Offset: 00020000, based on PE: true

Associated: 00000000.00000002.1643904003.0000000000020000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1643958107.00000000000AF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1643958107.00000000000D5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1643993044.00000000000DF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1644007204.00000000000E8000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_20000_Ship Docs_CI PL HBL COO_.jbxd

Similarity

API ID: SendString$_memmove
String ID: alias PlayMe$close PlayMe$open $play PlayMe$play PlayMe wait$status PlayMe mode
API String ID: 2279737902-1007645807
Opcode ID: 19f091a84127973a4134a447bbacb59d72d44c6c2aa3115af4dce235232095a4
Instruction ID: 09f585bb325f97c9feb4d630c8faaf5d31cd226890a9e05388e399062c45e4b8
Opcode Fuzzy Hash: 19f091a84127973a4134a447bbacb59d72d44c6c2aa3115af4dce235232095a4
Instruction Fuzzy Hash: EB11C420A9066979D720B661DC4ADFF7B7DFF96B00F40042AB545A70D2EEA00E05C6B2

Function 000848F3 Relevance: 19.3, APIs: 10, Strings: 1, Instructions: 73networkCOMMON

Download Yara Rule

APIs

WSAStartup.WSOCK32(00000101,?), ref: 0008490E
gethostname.WSOCK32(?,00000100), ref: 00084928
gethostbyname.WSOCK32(?), ref: 00084935
_wcscpy.LIBCMT ref: 0008495D
_memmove.LIBCMT ref: 00084970
inet_ntoa.WSOCK32(?), ref: 0008497B
_strcat.LIBCMT ref: 00084989
_wcscpy.LIBCMT ref: 000849A0
WSACleanup.WSOCK32 ref: 000849AE
_wcscpy.LIBCMT ref: 000849BC

Strings

0.0.0.0, xrefs: 00084957

Memory Dump Source

Source File: 00000000.00000002.1643917647.0000000000021000.00000020.00000001.01000000.00000003.sdmp, Offset: 00020000, based on PE: true

Associated: 00000000.00000002.1643904003.0000000000020000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1643958107.00000000000AF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1643958107.00000000000D5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1643993044.00000000000DF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1644007204.00000000000E8000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_20000_Ship Docs_CI PL HBL COO_.jbxd

Similarity

API ID: _wcscpy$CleanupStartup_memmove_strcatgethostbynamegethostnameinet_ntoa
String ID: 0.0.0.0
API String ID: 208665112-3771769585
Opcode ID: b2ad6bd528915e44e52f647a3e76a4c1da2df9557803aedffed4fee87153bcf5
Instruction ID: 5bdefe54e220f3650d3bdfa79e07e5383fa8660202cc025b780b1a995f40fde5
Opcode Fuzzy Hash: b2ad6bd528915e44e52f647a3e76a4c1da2df9557803aedffed4fee87153bcf5
Instruction Fuzzy Hash: B0110571904116ABDB30FB64EC06EEF77ACEF01720F0001B6F48896052EFB49A818765

Function 00085217 Relevance: 19.3, APIs: 10, Strings: 1, Instructions: 72sleepwindowtimeCOMMON

Download Yara Rule

APIs

timeGetTime.WINMM ref: 0008521C

Part of subcall function 00040719: timeGetTime.WINMM(?,75C0B400,00030FF9), ref: 0004071D

Sleep.KERNEL32(0000000A), ref: 00085248
EnumThreadWindows.USER32(?,Function_000651CA,00000000), ref: 0008526C
FindWindowExW.USER32(00000000,00000000,BUTTON,00000000), ref: 0008528E
SetActiveWindow.USER32 ref: 000852AD
SendMessageW.USER32(00000000,000000F5,00000000,00000000), ref: 000852BB
SendMessageW.USER32(00000010,00000000,00000000), ref: 000852DA
Sleep.KERNEL32(000000FA), ref: 000852E5
IsWindow.USER32 ref: 000852F1
EndDialog.USER32(00000000), ref: 00085302

Strings

BUTTON, xrefs: 00085280

Memory Dump Source

Source File: 00000000.00000002.1643917647.0000000000021000.00000020.00000001.01000000.00000003.sdmp, Offset: 00020000, based on PE: true

Associated: 00000000.00000002.1643904003.0000000000020000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1643958107.00000000000AF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1643958107.00000000000D5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1643993044.00000000000DF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1644007204.00000000000E8000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_20000_Ship Docs_CI PL HBL COO_.jbxd

Similarity

API ID: Window$MessageSendSleepTimetime$ActiveDialogEnumFindThreadWindows
String ID: BUTTON
API String ID: 1194449130-3405671355
Opcode ID: a30ecae5d53d42181bae134f115cbe4316fca279011132b83555987546d2e13c
Instruction ID: 63e6c26294751d1e1a0f89c2a9d289cba6773d768166d1fc761c6753265f47e1
Opcode Fuzzy Hash: a30ecae5d53d42181bae134f115cbe4316fca279011132b83555987546d2e13c
Instruction Fuzzy Hash: 1A21CF71205F45AFF7007BB0ECC8B3A3BA9FB56B87B440028F145A91B1DBA99D018B21

Function 0008D7F8 Relevance: 18.3, APIs: 12, Instructions: 283comCOMMON

Download Yara Rule

APIs

Part of subcall function 00029997: __itow.LIBCMT ref: 000299C2
Part of subcall function 00029997: __swprintf.LIBCMT ref: 00029A0C

CoInitialize.OLE32(00000000), ref: 0008D855
SHGetSpecialFolderLocation.SHELL32(00000000,00000000,?), ref: 0008D8E8
SHGetDesktopFolder.SHELL32(?), ref: 0008D8FC
CoCreateInstance.OLE32(000B2D7C,00000000,00000001,000DA89C,?), ref: 0008D948
SHCreateShellItem.SHELL32(00000000,00000000,?,00000003), ref: 0008D9B7
CoTaskMemFree.OLE32(?,?), ref: 0008DA0F
_memset.LIBCMT ref: 0008DA4C
SHBrowseForFolderW.SHELL32(?), ref: 0008DA88
SHGetPathFromIDListW.SHELL32(00000000,?), ref: 0008DAAB
CoTaskMemFree.OLE32(00000000), ref: 0008DAB2
CoTaskMemFree.OLE32(00000000,00000001,00000000), ref: 0008DAE9
CoUninitialize.OLE32(00000001,00000000), ref: 0008DAEB

Memory Dump Source

Source File: 00000000.00000002.1643917647.0000000000021000.00000020.00000001.01000000.00000003.sdmp, Offset: 00020000, based on PE: true

Associated: 00000000.00000002.1643904003.0000000000020000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1643958107.00000000000AF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1643958107.00000000000D5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1643993044.00000000000DF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1644007204.00000000000E8000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_20000_Ship Docs_CI PL HBL COO_.jbxd

Similarity

API ID: FolderFreeTask$Create$BrowseDesktopFromInitializeInstanceItemListLocationPathShellSpecialUninitialize__itow__swprintf_memset
String ID:
API String ID: 1246142700-0
Opcode ID: 4269b8cd1a1a913627bfa78f52140255394f053adb33a2c1bb06e27256afaabb
Instruction ID: 1cf929c8f505d86a91ca2e913d61d5fd9c114a7f5ca870bec3976c0eccd678c3
Opcode Fuzzy Hash: 4269b8cd1a1a913627bfa78f52140255394f053adb33a2c1bb06e27256afaabb
Instruction Fuzzy Hash: BCB10975A00119AFDB04EFA4C888DAEBBF9FF49310B148569F94AEB251DB30AD41CB50

Function 0008052C Relevance: 18.2, APIs: 12, Instructions: 186keyboardCOMMON

Download Yara Rule

APIs

GetKeyboardState.USER32(?), ref: 000805A7
SetKeyboardState.USER32(?), ref: 00080612
GetAsyncKeyState.USER32(000000A0), ref: 00080632
GetKeyState.USER32(000000A0), ref: 00080649
GetAsyncKeyState.USER32(000000A1), ref: 00080678
GetKeyState.USER32(000000A1), ref: 00080689
GetAsyncKeyState.USER32(00000011), ref: 000806B5
GetKeyState.USER32(00000011), ref: 000806C3
GetAsyncKeyState.USER32(00000012), ref: 000806EC
GetKeyState.USER32(00000012), ref: 000806FA
GetAsyncKeyState.USER32(0000005B), ref: 00080723
GetKeyState.USER32(0000005B), ref: 00080731

Memory Dump Source

Source File: 00000000.00000002.1643917647.0000000000021000.00000020.00000001.01000000.00000003.sdmp, Offset: 00020000, based on PE: true

Associated: 00000000.00000002.1643904003.0000000000020000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1643958107.00000000000AF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1643958107.00000000000D5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1643993044.00000000000DF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1644007204.00000000000E8000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_20000_Ship Docs_CI PL HBL COO_.jbxd

Similarity

API ID: State$Async$Keyboard
String ID:
API String ID: 541375521-0
Opcode ID: 26efe4285debbdf49ef9ee242acd2dd64c11e45062a781a55cd1aef6d355aaec
Instruction ID: ca1c0bf7797dfbf6da8bdfcd1f919245cd7d198612bc67375a9e41db3d37bb01
Opcode Fuzzy Hash: 26efe4285debbdf49ef9ee242acd2dd64c11e45062a781a55cd1aef6d355aaec
Instruction Fuzzy Hash: 7451BB70A04B8419FBB5FBB088557EBBFF4AF11380F088599D5C2561C3EA649B4CCB61

Function 0007C72A Relevance: 18.2, APIs: 12, Instructions: 174COMMON

Download Yara Rule

APIs

GetDlgItem.USER32(?,00000001), ref: 0007C746
GetWindowRect.USER32(00000000,?), ref: 0007C758
MoveWindow.USER32(00000001,0000000A,?,00000001,?,00000000), ref: 0007C7B6
GetDlgItem.USER32(?,00000002), ref: 0007C7C1
GetWindowRect.USER32(00000000,?), ref: 0007C7D3
MoveWindow.USER32(00000001,?,00000000,00000001,?,00000000), ref: 0007C827
GetDlgItem.USER32(?,000003E9), ref: 0007C835
GetWindowRect.USER32(00000000,?), ref: 0007C846
MoveWindow.USER32(00000000,0000000A,00000000,?,?,00000000), ref: 0007C889
GetDlgItem.USER32(?,000003EA), ref: 0007C897
MoveWindow.USER32(00000000,0000000A,0000000A,?,-00000005,00000000), ref: 0007C8B4
InvalidateRect.USER32(?,00000000,00000001), ref: 0007C8C1

Memory Dump Source

Source File: 00000000.00000002.1643917647.0000000000021000.00000020.00000001.01000000.00000003.sdmp, Offset: 00020000, based on PE: true

Associated: 00000000.00000002.1643904003.0000000000020000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1643958107.00000000000AF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1643958107.00000000000D5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1643993044.00000000000DF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1644007204.00000000000E8000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_20000_Ship Docs_CI PL HBL COO_.jbxd

Similarity

API ID: Window$ItemMoveRect$Invalidate
String ID:
API String ID: 3096461208-0
Opcode ID: 6b8922353f0d8f855916892e2d87fc932c2c7af81a2f60954fe3818d758a6a13
Instruction ID: 57ea33fa8d04342c8b443ed01f237534e4e2f72104635e03bc50d3ea4501bb81
Opcode Fuzzy Hash: 6b8922353f0d8f855916892e2d87fc932c2c7af81a2f60954fe3818d758a6a13
Instruction Fuzzy Hash: C2512271B00605ABEB18CFA9DD85E7DBBB5EB89310F14812DF519D7290DB749D00CB54

Function 0002201B Relevance: 18.2, APIs: 12, Instructions: 170timeCOMMON

Download Yara Rule

APIs

Part of subcall function 00021B41: InvalidateRect.USER32(?,00000000,00000001,?,?,?,00022036,?,00000000,?,?,?,?,000216CB,00000000,?), ref: 00021B9A

DestroyWindow.USER32(?,?,?,?,?,?,?,?,?,?,?,00000000,?,?), ref: 000220D3
KillTimer.USER32(-00000001,?,?,?,?,000216CB,00000000,?,?,00021AE2,?,?), ref: 0002216E
DestroyAcceleratorTable.USER32(00000000), ref: 0005BEF6
ImageList_Destroy.COMCTL32(00000000,?,00000000,?,?,?,?,000216CB,00000000,?,?,00021AE2,?,?), ref: 0005BF27
ImageList_Destroy.COMCTL32(00000000,?,00000000,?,?,?,?,000216CB,00000000,?,?,00021AE2,?,?), ref: 0005BF3E
ImageList_Destroy.COMCTL32(00000000,?,00000000,?,?,?,?,000216CB,00000000,?,?,00021AE2,?,?), ref: 0005BF5A
DeleteObject.GDI32(00000000), ref: 0005BF6C

Memory Dump Source

Source File: 00000000.00000002.1643917647.0000000000021000.00000020.00000001.01000000.00000003.sdmp, Offset: 00020000, based on PE: true

Associated: 00000000.00000002.1643904003.0000000000020000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1643958107.00000000000AF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1643958107.00000000000D5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1643993044.00000000000DF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1644007204.00000000000E8000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_20000_Ship Docs_CI PL HBL COO_.jbxd

Similarity

API ID: Destroy$ImageList_$AcceleratorDeleteInvalidateKillObjectRectTableTimerWindow
String ID:
API String ID: 641708696-0
Opcode ID: 4d7614ae3d7b482c9ae29a06a509549e9591609ec8f9f1540b92c5575569e75b
Instruction ID: bd00a85b9f01495a77294b5a7b5a65ac69beaf289752ca7957963abba4ddfc0f
Opcode Fuzzy Hash: 4d7614ae3d7b482c9ae29a06a509549e9591609ec8f9f1540b92c5575569e75b
Instruction Fuzzy Hash: 2861C030104661EFEB359F54ED88B2A77F1FF61712F104528E5825A571CB7AA891DF40

Function 000221A5 Relevance: 18.1, APIs: 12, Instructions: 132COMMON

Download Yara Rule

APIs

Part of subcall function 000225DB: GetWindowLongW.USER32(?,000000EB), ref: 000225EC

GetSysColor.USER32(0000000F), ref: 000221D3

Memory Dump Source

Source File: 00000000.00000002.1643917647.0000000000021000.00000020.00000001.01000000.00000003.sdmp, Offset: 00020000, based on PE: true

Associated: 00000000.00000002.1643904003.0000000000020000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1643958107.00000000000AF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1643958107.00000000000D5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1643993044.00000000000DF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1644007204.00000000000E8000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_20000_Ship Docs_CI PL HBL COO_.jbxd

Similarity

API ID: ColorLongWindow
String ID:
API String ID: 259745315-0
Opcode ID: 26c8c3a34f48b5fbafc9a3e2a6378ada983654d7c855f8fe57c324f4df8a1494
Instruction ID: 69e99349198c31990ca7e54afad387ec6bb8fd434bd4b67ba02d5992f62a76f2
Opcode Fuzzy Hash: 26c8c3a34f48b5fbafc9a3e2a6378ada983654d7c855f8fe57c324f4df8a1494
Instruction Fuzzy Hash: C9419131100A50FEEB255FA8EC88BB93BA5EB07331F144365FD659A1E2C7368C46DB21

Function 0008AB12 Relevance: 17.7, APIs: 3, Strings: 7, Instructions: 183COMMON

Download Yara Rule

APIs

CharLowerBuffW.USER32(?,?,000AF910), ref: 0008AB76
GetDriveTypeW.KERNEL32(00000061,000DA620,00000061), ref: 0008AC40
_wcscpy.LIBCMT ref: 0008AC6A

Strings

unknown, xrefs: 0008AC01
network, xrefs: 0008ABD4
removable, xrefs: 0008ABA8
fixed, xrefs: 0008ABBE
all, xrefs: 0008AB7C
cdrom, xrefs: 0008AB92
ramdisk, xrefs: 0008ABEA

Memory Dump Source

Source File: 00000000.00000002.1643917647.0000000000021000.00000020.00000001.01000000.00000003.sdmp, Offset: 00020000, based on PE: true

Associated: 00000000.00000002.1643904003.0000000000020000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1643958107.00000000000AF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1643958107.00000000000D5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1643993044.00000000000DF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1644007204.00000000000E8000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_20000_Ship Docs_CI PL HBL COO_.jbxd

Similarity

API ID: BuffCharDriveLowerType_wcscpy
String ID: all$cdrom$fixed$network$ramdisk$removable$unknown
API String ID: 2820617543-1000479233
Opcode ID: a4abd8a34f3f86b8d46b6c22fa086f5e088e00514b6db532f7a2b7ad16d649de
Instruction ID: 6804e3f413bd0f2604e1f713239e6efc2365cce7ec1a5c406d86c7dd17951730
Opcode Fuzzy Hash: a4abd8a34f3f86b8d46b6c22fa086f5e088e00514b6db532f7a2b7ad16d649de
Instruction Fuzzy Hash: 95517B306083119BD720EF14D891AAEB7E5FF86300F54482EF5D6976A3EB319949CB53

Function 00029997 Relevance: 17.6, APIs: 6, Strings: 4, Instructions: 146COMMON

Download Yara Rule

APIs

__itow.LIBCMT ref: 000299C2
__swprintf.LIBCMT ref: 00029A0C
__i64tow.LIBCMT ref: 0005FA0F

Strings

True, xrefs: 0005F9D0
False, xrefs: 0005F9D7
%.15g, xrefs: 00029A06
0x%p, xrefs: 0005F9F1

Memory Dump Source

Source File: 00000000.00000002.1643917647.0000000000021000.00000020.00000001.01000000.00000003.sdmp, Offset: 00020000, based on PE: true

Associated: 00000000.00000002.1643904003.0000000000020000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1643958107.00000000000AF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1643958107.00000000000D5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1643993044.00000000000DF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1644007204.00000000000E8000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_20000_Ship Docs_CI PL HBL COO_.jbxd

Similarity

API ID: __i64tow__itow__swprintf
String ID: %.15g$0x%p$False$True
API String ID: 421087845-2263619337
Opcode ID: 4549dc2609491dd7de2710dd8969dced3b82729a0366830ee11ab4644be531ff
Instruction ID: 4471d6a8ef294b4a1cc244731bb2517de9c501e7ceb083b09d468527891a6b53
Opcode Fuzzy Hash: 4549dc2609491dd7de2710dd8969dced3b82729a0366830ee11ab4644be531ff
Instruction Fuzzy Hash: 97410671604616ABDB34EB38EC42EBB73E8EF48310F20447FE549D7282EA3199458B11

Function 000A73C1 Relevance: 17.6, APIs: 8, Strings: 2, Instructions: 103windowCOMMON

Download Yara Rule

APIs

_memset.LIBCMT ref: 000A73D9
CreateMenu.USER32 ref: 000A73F4
SetMenu.USER32(?,00000000), ref: 000A7403
GetMenuItemInfoW.USER32(?,000000FF,00000000,00000030), ref: 000A7490
IsMenu.USER32(?), ref: 000A74A6
CreatePopupMenu.USER32 ref: 000A74B0
InsertMenuItemW.USER32(?,?,00000001,00000030), ref: 000A74DD
DrawMenuBar.USER32 ref: 000A74E5

Strings

0, xrefs: 000A73CF
F, xrefs: 000A74D1

Memory Dump Source

Source File: 00000000.00000002.1643917647.0000000000021000.00000020.00000001.01000000.00000003.sdmp, Offset: 00020000, based on PE: true

Associated: 00000000.00000002.1643904003.0000000000020000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1643958107.00000000000AF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1643958107.00000000000D5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1643993044.00000000000DF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1644007204.00000000000E8000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_20000_Ship Docs_CI PL HBL COO_.jbxd

Similarity

API ID: Menu$CreateItem$DrawInfoInsertPopup_memset
String ID: 0$F
API String ID: 176399719-3044882817
Opcode ID: 70d617a3bf54c8e2e96cba610a4778eb31a9b27f5d326474892d1937fac2181d
Instruction ID: 821af40560cddd45ca41b547d6c51f435a2dee82bacd756af8a85c9f2865c21e
Opcode Fuzzy Hash: 70d617a3bf54c8e2e96cba610a4778eb31a9b27f5d326474892d1937fac2181d
Instruction Fuzzy Hash: 31415B74A00605EFDB20DFA4DD84AAABBF5FF4A340F144128FA59A7360D735A910CB50

Function 000A772A Relevance: 17.6, APIs: 9, Strings: 1, Instructions: 101windowCOMMON

Download Yara Rule

APIs

MoveWindow.USER32(?,?,?,000000FF,000000FF,00000000,?,?,000000FF,000000FF,?,?,static,00000000,00000000,?), ref: 000A77CD
CreateCompatibleDC.GDI32(00000000), ref: 000A77D4
SendMessageW.USER32(?,00000173,00000000,00000000), ref: 000A77E7
SelectObject.GDI32(00000000,00000000), ref: 000A77EF
GetPixel.GDI32(00000000,00000000,00000000), ref: 000A77FA
DeleteDC.GDI32(00000000), ref: 000A7803
GetWindowLongW.USER32(?,000000EC), ref: 000A780D
SetLayeredWindowAttributes.USER32(?,00000000,00000000,00000001), ref: 000A7821
DestroyWindow.USER32(?,?,?,000000FF,000000FF,?,?,static,00000000,00000000,?,?,00000000,00000000,?,?), ref: 000A782D

Strings

static, xrefs: 000A7765

Memory Dump Source

Source File: 00000000.00000002.1643917647.0000000000021000.00000020.00000001.01000000.00000003.sdmp, Offset: 00020000, based on PE: true

Associated: 00000000.00000002.1643904003.0000000000020000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1643958107.00000000000AF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1643958107.00000000000D5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1643993044.00000000000DF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1644007204.00000000000E8000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_20000_Ship Docs_CI PL HBL COO_.jbxd

Similarity

API ID: Window$AttributesCompatibleCreateDeleteDestroyLayeredLongMessageMoveObjectPixelSelectSend
String ID: static
API String ID: 2559357485-2160076837
Opcode ID: b8a2e7c23d992b12cc92de11c80fe1b0ea213488d0b2953840feb1bb7a2556ba
Instruction ID: 78fcd4c65df5dd302a16431ba885eccc9ecb55ed579f937e3d38f1faf26beeb7
Opcode Fuzzy Hash: b8a2e7c23d992b12cc92de11c80fe1b0ea213488d0b2953840feb1bb7a2556ba
Instruction Fuzzy Hash: 03318F32104115ABEF115FE4DC08FEB3BA9FF0A760F114224FA59A60A1CB39D811DBA4

Function 00047040 Relevance: 16.8, APIs: 11, Instructions: 258COMMON

Download Yara Rule

APIs

_memset.LIBCMT ref: 0004707B

Part of subcall function 00048D68: __getptd_noexit.LIBCMT ref: 00048D68

__gmtime64_s.LIBCMT ref: 00047114
__gmtime64_s.LIBCMT ref: 0004714A
__gmtime64_s.LIBCMT ref: 00047167
__allrem.LIBCMT ref: 000471BD
__ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z.LIBCMT ref: 000471D9
__allrem.LIBCMT ref: 000471F0
__ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z.LIBCMT ref: 0004720E
__allrem.LIBCMT ref: 00047225
__ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z.LIBCMT ref: 00047243
__invoke_watson.LIBCMT ref: 000472B4

Memory Dump Source

Source File: 00000000.00000002.1643917647.0000000000021000.00000020.00000001.01000000.00000003.sdmp, Offset: 00020000, based on PE: true

Associated: 00000000.00000002.1643904003.0000000000020000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1643958107.00000000000AF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1643958107.00000000000D5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1643993044.00000000000DF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1644007204.00000000000E8000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_20000_Ship Docs_CI PL HBL COO_.jbxd

Similarity

API ID: Unothrow_t@std@@@__allrem__ehfuncinfo$??2@__gmtime64_s$__getptd_noexit__invoke_watson_memset
String ID:
API String ID: 384356119-0
Opcode ID: 85949ae18b549cd2d12431497598bef6b028e5a4746e3945652a320069ef6a5a
Instruction ID: ecdfa2bf63e58e07d486f1c4d72b86d3f75f67bc46fba109d39f05fe6e1f69db
Opcode Fuzzy Hash: 85949ae18b549cd2d12431497598bef6b028e5a4746e3945652a320069ef6a5a
Instruction Fuzzy Hash: 117128F1A05717EBD7149E79CC41B9BB7E8AF10364F14423AF918E7282E770E9448794

Function 00082A16 Relevance: 16.7, APIs: 11, Instructions: 190windowsleepCOMMON

Download Yara Rule

APIs

_memset.LIBCMT ref: 00082A31
GetMenuItemInfoW.USER32(000E6890,000000FF,00000000,00000030), ref: 00082A92
SetMenuItemInfoW.USER32(000E6890,00000004,00000000,00000030), ref: 00082AC8
Sleep.KERNEL32(000001F4), ref: 00082ADA
GetMenuItemCount.USER32(?), ref: 00082B1E
GetMenuItemID.USER32(?,00000000), ref: 00082B3A
GetMenuItemID.USER32(?,-00000001), ref: 00082B64
GetMenuItemID.USER32(?,?), ref: 00082BA9
CheckMenuRadioItem.USER32(?,00000000,?,00000000,00000400), ref: 00082BEF
GetMenuItemInfoW.USER32(?,000000FF,00000000,00000030), ref: 00082C03
SetMenuItemInfoW.USER32(?,000000FF,00000000,00000030), ref: 00082C24

Memory Dump Source

Source File: 00000000.00000002.1643917647.0000000000021000.00000020.00000001.01000000.00000003.sdmp, Offset: 00020000, based on PE: true

Associated: 00000000.00000002.1643904003.0000000000020000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1643958107.00000000000AF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1643958107.00000000000D5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1643993044.00000000000DF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1644007204.00000000000E8000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_20000_Ship Docs_CI PL HBL COO_.jbxd

Similarity

API ID: ItemMenu$Info$CheckCountRadioSleep_memset
String ID:
API String ID: 4176008265-0
Opcode ID: 4f03ef94c34cdf1bcd4c746c755d81220883d947cd97204923bd4aa3dd32274d
Instruction ID: 27ecc27f24cb4b7dd8290e9b6c57410548faca408e8862f6303b1d16f14bc688
Opcode Fuzzy Hash: 4f03ef94c34cdf1bcd4c746c755d81220883d947cd97204923bd4aa3dd32274d
Instruction Fuzzy Hash: 0661C1B090164AAFEB21EFA4DC88DBE7BB8FF01304F144469E981A7251D735AD45DB21

Function 000A7192 Relevance: 16.7, APIs: 11, Instructions: 184windowCOMMON

Download Yara Rule

APIs

SendMessageW.USER32(?,0000101F,00000000,00000000), ref: 000A7214
SendMessageW.USER32(00000000,?,0000101F,00000000), ref: 000A7217
GetWindowLongW.USER32(?,000000F0), ref: 000A723B
_memset.LIBCMT ref: 000A724C
SendMessageW.USER32(?,00001004,00000000,00000000), ref: 000A725E
SendMessageW.USER32(?,0000104D,00000000,00000007), ref: 000A72D6

Memory Dump Source

Source File: 00000000.00000002.1643917647.0000000000021000.00000020.00000001.01000000.00000003.sdmp, Offset: 00020000, based on PE: true

Associated: 00000000.00000002.1643904003.0000000000020000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1643958107.00000000000AF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1643958107.00000000000D5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1643993044.00000000000DF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1644007204.00000000000E8000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_20000_Ship Docs_CI PL HBL COO_.jbxd

Similarity

API ID: MessageSend$LongWindow_memset
String ID:
API String ID: 830647256-0
Opcode ID: 93b583e76150559b88bc97d5adbe953703ea4049111c6e467c7ffa8815d8c2fe
Instruction ID: ff7efc8862b293b3ba707dd7b4ae2d0f973792dcff975ac6d50aae62e17aff24
Opcode Fuzzy Hash: 93b583e76150559b88bc97d5adbe953703ea4049111c6e467c7ffa8815d8c2fe
Instruction Fuzzy Hash: D5616E75A00248AFDB10DFA4CC81EEE77F8EF0A710F144159FA14AB2A1D775AE45DB60

Function 0007710E Relevance: 16.6, APIs: 11, Instructions: 123memoryCOMMON

Download Yara Rule

APIs

SafeArrayAllocDescriptorEx.OLEAUT32(0000000C,?,?), ref: 00077135
SafeArrayAllocData.OLEAUT32(?), ref: 0007718E
VariantInit.OLEAUT32(?), ref: 000771A0
SafeArrayAccessData.OLEAUT32(?,?), ref: 000771C0
VariantCopy.OLEAUT32(?,?), ref: 00077213
SafeArrayUnaccessData.OLEAUT32(?), ref: 00077227
VariantClear.OLEAUT32(?), ref: 0007723C
SafeArrayDestroyData.OLEAUT32(?), ref: 00077249
SafeArrayDestroyDescriptor.OLEAUT32(?), ref: 00077252
VariantClear.OLEAUT32(?), ref: 00077264
SafeArrayDestroyDescriptor.OLEAUT32(?), ref: 0007726F

Memory Dump Source

Source File: 00000000.00000002.1643917647.0000000000021000.00000020.00000001.01000000.00000003.sdmp, Offset: 00020000, based on PE: true

Associated: 00000000.00000002.1643904003.0000000000020000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1643958107.00000000000AF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1643958107.00000000000D5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1643993044.00000000000DF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1644007204.00000000000E8000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_20000_Ship Docs_CI PL HBL COO_.jbxd

Similarity

API ID: ArraySafe$DataVariant$DescriptorDestroy$AllocClear$AccessCopyInitUnaccess
String ID:
API String ID: 2706829360-0
Opcode ID: 44a1851d1309c54e1de4965222ad7350027b739b0036faa99b9e96939c6135a5
Instruction ID: 433744af0450c9cda1d60b08132d52f608d7f8a5ba355454c51875234d50b8d0
Opcode Fuzzy Hash: 44a1851d1309c54e1de4965222ad7350027b739b0036faa99b9e96939c6135a5
Instruction Fuzzy Hash: 23415435E042199FDF04DFA8D8449EEBBB8FF08354F00C065F959A7262DB34A945CB94

Function 000986D0 Relevance: 15.9, APIs: 6, Strings: 3, Instructions: 197comCOMMON

Download Yara Rule

APIs

Part of subcall function 00029997: __itow.LIBCMT ref: 000299C2
Part of subcall function 00029997: __swprintf.LIBCMT ref: 00029A0C

CoInitialize.OLE32 ref: 00098718
CoUninitialize.OLE32 ref: 00098723
CoCreateInstance.OLE32(?,00000000,00000017,000B2BEC,?), ref: 00098783
IIDFromString.OLE32(?,?), ref: 000987F6
VariantInit.OLEAUT32(?), ref: 00098890
VariantClear.OLEAUT32(?), ref: 000988F1

Strings

Failed to create object, xrefs: 0009878E, 00098844
NULL Pointer assignment, xrefs: 000987C8
Invalid parameter, xrefs: 0009880F

Memory Dump Source

Source File: 00000000.00000002.1643917647.0000000000021000.00000020.00000001.01000000.00000003.sdmp, Offset: 00020000, based on PE: true

Associated: 00000000.00000002.1643904003.0000000000020000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1643958107.00000000000AF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1643958107.00000000000D5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1643993044.00000000000DF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1644007204.00000000000E8000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_20000_Ship Docs_CI PL HBL COO_.jbxd

Similarity

API ID: Variant$ClearCreateFromInitInitializeInstanceStringUninitialize__itow__swprintf
String ID: Failed to create object$Invalid parameter$NULL Pointer assignment
API String ID: 834269672-1287834457
Opcode ID: 0a149f730a08e7698798e4abc491513b36009d787386948e5c12011e5e2baef1
Instruction ID: 56ac4bd59408ca22a0f398900281be3f77dee9358ede3a7154be99d549b8bab0
Opcode Fuzzy Hash: 0a149f730a08e7698798e4abc491513b36009d787386948e5c12011e5e2baef1
Instruction Fuzzy Hash: 7D618C706087119FDB10DF64C848A6BB7E4AF4A714F10881DF9859B391CF74ED44DBA2

Function 00095A45 Relevance: 15.9, APIs: 8, Strings: 1, Instructions: 163networkfileCOMMON

Download Yara Rule

APIs

WSAStartup.WSOCK32(00000101,?), ref: 00095AA6
inet_addr.WSOCK32(?,?,?), ref: 00095AEB
gethostbyname.WSOCK32(?), ref: 00095AF7
IcmpCreateFile.IPHLPAPI ref: 00095B05
IcmpSendEcho.IPHLPAPI(?,?,?,00000005,00000000,?,00000029,00000FA0), ref: 00095B75
IcmpSendEcho.IPHLPAPI(00000000,00000000,?,00000005,00000000,?,00000029,00000FA0), ref: 00095B8B
IcmpCloseHandle.IPHLPAPI(00000000), ref: 00095C00
WSACleanup.WSOCK32 ref: 00095C06

Strings

Ping, xrefs: 00095B29

Memory Dump Source

Source File: 00000000.00000002.1643917647.0000000000021000.00000020.00000001.01000000.00000003.sdmp, Offset: 00020000, based on PE: true

Associated: 00000000.00000002.1643904003.0000000000020000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1643958107.00000000000AF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1643958107.00000000000D5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1643993044.00000000000DF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1644007204.00000000000E8000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_20000_Ship Docs_CI PL HBL COO_.jbxd

Similarity

API ID: Icmp$EchoSend$CleanupCloseCreateFileHandleStartupgethostbynameinet_addr
String ID: Ping
API String ID: 1028309954-2246546115
Opcode ID: 737ed7eef189e647e4892312b9ed62ddc403244f047b70b073ace08a039b4a55
Instruction ID: 196d97d7ff6435169047116abe26db0dbb2b5d478664a52697e5018c7d451f49
Opcode Fuzzy Hash: 737ed7eef189e647e4892312b9ed62ddc403244f047b70b073ace08a039b4a55
Instruction Fuzzy Hash: C051C231604B019FDB21EF25DC45B6EB7E0EF48311F148929F996DB2A1DB34E800DB46

Function 0008B72E Relevance: 15.8, APIs: 4, Strings: 5, Instructions: 98COMMON

Download Yara Rule

APIs

SetErrorMode.KERNEL32(00000001), ref: 0008B73B
GetDiskFreeSpaceW.KERNEL32(?,?,?,?,?,00000002,00000001), ref: 0008B7B1
GetLastError.KERNEL32 ref: 0008B7BB
SetErrorMode.KERNEL32(00000000,READY), ref: 0008B828

Strings

READY, xrefs: 0008B801
INVALID, xrefs: 0008B7FA
NOTREADY, xrefs: 0008B7E7
READONLY, xrefs: 0008B7F3
UNKNOWN, xrefs: 0008B7E0

Memory Dump Source

Source File: 00000000.00000002.1643917647.0000000000021000.00000020.00000001.01000000.00000003.sdmp, Offset: 00020000, based on PE: true

Associated: 00000000.00000002.1643904003.0000000000020000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1643958107.00000000000AF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1643958107.00000000000D5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1643993044.00000000000DF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1644007204.00000000000E8000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_20000_Ship Docs_CI PL HBL COO_.jbxd

Similarity

API ID: Error$Mode$DiskFreeLastSpace
String ID: INVALID$NOTREADY$READONLY$READY$UNKNOWN
API String ID: 4194297153-14809454
Opcode ID: 6b61bad0d39e852a763c5cbd4b0c4f678115005732fa194bb73600b7092536c2
Instruction ID: f709a887523e85b4f2a5192505b784649334fe94675f952c86138c99e6a5512e
Opcode Fuzzy Hash: 6b61bad0d39e852a763c5cbd4b0c4f678115005732fa194bb73600b7092536c2
Instruction Fuzzy Hash: A2318F35A003099FDB10FF68D885AFE7BB8FF45700F14806AE946DB292DB719946CB51

Function 00079471 Relevance: 15.8, APIs: 7, Strings: 2, Instructions: 82windowCOMMON

Download Yara Rule

APIs

Part of subcall function 00027F41: _memmove.LIBCMT ref: 00027F82

Part of subcall function 0007B0C4: GetClassNameW.USER32(?,?,000000FF), ref: 0007B0E7

SendMessageW.USER32(?,0000018C,000000FF,00000002), ref: 000794F6
GetDlgCtrlID.USER32 ref: 00079501
GetParent.USER32 ref: 0007951D
SendMessageW.USER32(00000000,?,00000111,?), ref: 00079520
GetDlgCtrlID.USER32(?), ref: 00079529
GetParent.USER32(?), ref: 00079545
SendMessageW.USER32(00000000,?,?,00000111), ref: 00079548

Strings

ComboBox, xrefs: 0007947E
ListBox, xrefs: 000794B3

Memory Dump Source

Source File: 00000000.00000002.1643917647.0000000000021000.00000020.00000001.01000000.00000003.sdmp, Offset: 00020000, based on PE: true

Associated: 00000000.00000002.1643904003.0000000000020000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1643958107.00000000000AF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1643958107.00000000000D5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1643993044.00000000000DF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1644007204.00000000000E8000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_20000_Ship Docs_CI PL HBL COO_.jbxd

Similarity

API ID: MessageSend$CtrlParent$ClassName_memmove
String ID: ComboBox$ListBox
API String ID: 1536045017-1403004172
Opcode ID: 32e6d47670e5f0a02a3fe3811ee521c75f7dc5bdeff8c7aec420483ba696d258
Instruction ID: 29a31dd7cbe7d28f2695349f853fd4a1c9fe402c9520db6c78d598848458d0d6
Opcode Fuzzy Hash: 32e6d47670e5f0a02a3fe3811ee521c75f7dc5bdeff8c7aec420483ba696d258
Instruction Fuzzy Hash: BA210670D00204BBDF00ABA0CC85EFEBBB9EF45300F104125B521972E2DB795919DB60

Function 0007955C Relevance: 15.8, APIs: 7, Strings: 2, Instructions: 81windowCOMMON

Download Yara Rule

APIs

Part of subcall function 00027F41: _memmove.LIBCMT ref: 00027F82

Part of subcall function 0007B0C4: GetClassNameW.USER32(?,?,000000FF), ref: 0007B0E7

SendMessageW.USER32(?,00000186,00000002,00000000), ref: 000795DF
GetDlgCtrlID.USER32 ref: 000795EA
GetParent.USER32 ref: 00079606
SendMessageW.USER32(00000000,?,00000111,?), ref: 00079609
GetDlgCtrlID.USER32(?), ref: 00079612
GetParent.USER32(?), ref: 0007962E
SendMessageW.USER32(00000000,?,?,00000111), ref: 00079631

Strings

ComboBox, xrefs: 00079569
ListBox, xrefs: 0007959E

Memory Dump Source

Source File: 00000000.00000002.1643917647.0000000000021000.00000020.00000001.01000000.00000003.sdmp, Offset: 00020000, based on PE: true

Associated: 00000000.00000002.1643904003.0000000000020000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1643958107.00000000000AF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1643958107.00000000000D5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1643993044.00000000000DF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1644007204.00000000000E8000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_20000_Ship Docs_CI PL HBL COO_.jbxd

Similarity

API ID: MessageSend$CtrlParent$ClassName_memmove
String ID: ComboBox$ListBox
API String ID: 1536045017-1403004172
Opcode ID: d13bf07976e0f461d774b17b144280faf97534f732a5b9c8607f79ea4a657472
Instruction ID: 959a0687bf46ec2f7444af493a97622217b55882a59dd84741a2adcd0594d43e
Opcode Fuzzy Hash: d13bf07976e0f461d774b17b144280faf97534f732a5b9c8607f79ea4a657472
Instruction Fuzzy Hash: 8A21C574E00204BBDF01ABA0CCC5EFEBBB9EF49300F144165FA11972A6DB799919DB64

Function 00079645 Relevance: 15.8, APIs: 4, Strings: 5, Instructions: 72windowCOMMON

Download Yara Rule

APIs

GetParent.USER32 ref: 00079651
GetClassNameW.USER32(00000000,?,00000100), ref: 00079666
_wcscmp.LIBCMT ref: 00079678
SendMessageW.USER32(00000000,00000111,0000702B,00000000), ref: 000796F3

Strings

list, xrefs: 000796D5
SHELLDLL_DefView, xrefs: 00079672
details, xrefs: 000796A1
largeicons, xrefs: 00079687
smallicons, xrefs: 000796BB

Memory Dump Source

Source File: 00000000.00000002.1643917647.0000000000021000.00000020.00000001.01000000.00000003.sdmp, Offset: 00020000, based on PE: true

Associated: 00000000.00000002.1643904003.0000000000020000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1643958107.00000000000AF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1643958107.00000000000D5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1643993044.00000000000DF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1644007204.00000000000E8000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_20000_Ship Docs_CI PL HBL COO_.jbxd

Similarity

API ID: ClassMessageNameParentSend_wcscmp
String ID: SHELLDLL_DefView$details$largeicons$list$smallicons
API String ID: 1704125052-3381328864
Opcode ID: 0e53b15beed7f7d36b201d1eedccbde89acd0726a10088a404621eb398254bd9
Instruction ID: f0a9535edf4abfdec3281d40c00621554120deeb22a180ba1dd14140143c2358
Opcode Fuzzy Hash: 0e53b15beed7f7d36b201d1eedccbde89acd0726a10088a404621eb398254bd9
Instruction Fuzzy Hash: C4112CBA648707BAFA112620EC07DE677DCDB05360F204237FE04E50E6FE655910475C

Function 00098BC0 Relevance: 15.3, APIs: 10, Instructions: 324fileCOMMON

Download Yara Rule

APIs

VariantInit.OLEAUT32(?), ref: 00098BEC
CoInitialize.OLE32(00000000), ref: 00098C19
CoUninitialize.OLE32 ref: 00098C23
GetRunningObjectTable.OLE32(00000000,?), ref: 00098D23
SetErrorMode.KERNEL32(00000001,00000029), ref: 00098E50
CoGetInstanceFromFile.OLE32(00000000,?,00000000,00000015,00000002,?,00000001,000B2C0C), ref: 00098E84
CoGetObject.OLE32(?,00000000,000B2C0C,?), ref: 00098EA7
SetErrorMode.KERNEL32(00000000), ref: 00098EBA
SetErrorMode.KERNEL32(00000000,00000000,00000000,00000000,00000000), ref: 00098F3A
VariantClear.OLEAUT32(?), ref: 00098F4A

Memory Dump Source

Source File: 00000000.00000002.1643917647.0000000000021000.00000020.00000001.01000000.00000003.sdmp, Offset: 00020000, based on PE: true

Associated: 00000000.00000002.1643904003.0000000000020000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1643958107.00000000000AF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1643958107.00000000000D5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1643993044.00000000000DF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1644007204.00000000000E8000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_20000_Ship Docs_CI PL HBL COO_.jbxd

Similarity

API ID: ErrorMode$ObjectVariant$ClearFileFromInitInitializeInstanceRunningTableUninitialize
String ID:
API String ID: 2395222682-0
Opcode ID: 045ced22a7243a792c4e5fb1b1456cd7f4b2eff4dc510a6a46de9a4972f2600d
Instruction ID: aa8372014169c80120c55d5217d6f813be6f8f5f6d67ffb72ab256ccf37d9d31
Opcode Fuzzy Hash: 045ced22a7243a792c4e5fb1b1456cd7f4b2eff4dc510a6a46de9a4972f2600d
Instruction Fuzzy Hash: AAC124B1208305AFDB00DF64C88496BB7E9BF8A348F10896DF58ADB251DB71ED05CB52

Function 00084189 Relevance: 15.1, APIs: 10, Instructions: 108windowCOMMON

Download Yara Rule

APIs

__swprintf.LIBCMT ref: 0008419D
__swprintf.LIBCMT ref: 000841AA

Part of subcall function 000438D8: __woutput_l.LIBCMT ref: 00043931

FindResourceW.KERNEL32(?,?,0000000E), ref: 000841D4
LoadResource.KERNEL32(?,00000000), ref: 000841E0
LockResource.KERNEL32(00000000), ref: 000841ED
FindResourceW.KERNEL32(?,?,00000003), ref: 0008420D
LoadResource.KERNEL32(?,00000000), ref: 0008421F
SizeofResource.KERNEL32(?,00000000), ref: 0008422E
LockResource.KERNEL32(?), ref: 0008423A
CreateIconFromResourceEx.USER32(?,?,00000001,00030000,00000000,00000000,00000000), ref: 0008429B

Memory Dump Source

Source File: 00000000.00000002.1643917647.0000000000021000.00000020.00000001.01000000.00000003.sdmp, Offset: 00020000, based on PE: true

Associated: 00000000.00000002.1643904003.0000000000020000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1643958107.00000000000AF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1643958107.00000000000D5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1643993044.00000000000DF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1644007204.00000000000E8000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_20000_Ship Docs_CI PL HBL COO_.jbxd

Similarity

API ID: Resource$FindLoadLock__swprintf$CreateFromIconSizeof__woutput_l
String ID:
API String ID: 1433390588-0
Opcode ID: f447a4da4c4de02593626e52bb55a9a4801fb0443852a81643e7561ee3450381
Instruction ID: 7b58755620d573e0f52f8f631315e0586fd9114ebc4a9dff90fb81f671b11c86
Opcode Fuzzy Hash: f447a4da4c4de02593626e52bb55a9a4801fb0443852a81643e7561ee3450381
Instruction Fuzzy Hash: 0431B0B160561BABEB11AFA0EC88EBF7BACFF09301F004525F945D6150D778DA518BA0

Function 000816DE Relevance: 15.1, APIs: 10, Instructions: 89threadCOMMON

Download Yara Rule

APIs

GetCurrentThreadId.KERNEL32 ref: 00081700
GetForegroundWindow.USER32(00000000,?,?,?,?,?,00080778,?,00000001), ref: 00081714
GetWindowThreadProcessId.USER32(00000000), ref: 0008171B
AttachThreadInput.USER32(00000000,00000000,00000001,?,?,?,?,?,00080778,?,00000001), ref: 0008172A
GetWindowThreadProcessId.USER32(?,00000000), ref: 0008173C
AttachThreadInput.USER32(00000000,00000000,00000001,?,?,?,?,?,00080778,?,00000001), ref: 00081755
AttachThreadInput.USER32(00000000,00000000,00000001,?,?,?,?,?,00080778,?,00000001), ref: 00081767
AttachThreadInput.USER32(00000000,00000000,?,?,?,?,?,00080778,?,00000001), ref: 000817AC
AttachThreadInput.USER32(00000000,00000000,00000000,?,?,?,?,?,00080778,?,00000001), ref: 000817C1
AttachThreadInput.USER32(00000000,00000000,00000000,?,?,?,?,?,00080778,?,00000001), ref: 000817CC

Memory Dump Source

Source File: 00000000.00000002.1643917647.0000000000021000.00000020.00000001.01000000.00000003.sdmp, Offset: 00020000, based on PE: true

Associated: 00000000.00000002.1643904003.0000000000020000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1643958107.00000000000AF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1643958107.00000000000D5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1643993044.00000000000DF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1644007204.00000000000E8000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_20000_Ship Docs_CI PL HBL COO_.jbxd

Similarity

API ID: Thread$AttachInput$Window$Process$CurrentForeground
String ID:
API String ID: 2156557900-0
Opcode ID: 23315fd334cf757c057279aa0a710f517f874d7a5ca7698dc683caa4c8ce1752
Instruction ID: 9b32e4dad74dfceeaaec0afd316578dcd8914fb39907ea16eec735854b8eed6f
Opcode Fuzzy Hash: 23315fd334cf757c057279aa0a710f517f874d7a5ca7698dc683caa4c8ce1752
Instruction Fuzzy Hash: 2C318175608604BBFB61AF54DC84FB97BFDBF56B11F104029F848DA2A0D7B89D418B90

Function 0002FBBD Relevance: 14.3, APIs: 7, Strings: 1, Instructions: 264comCOMMON

Download Yara Rule

APIs

mciSendStringW.WINMM(close all,00000000,00000000,00000000), ref: 0002FC06
OleUninitialize.OLE32(?,00000000), ref: 0002FCA5
UnregisterHotKey.USER32(?), ref: 0002FDFC
DestroyWindow.USER32(?), ref: 00064A00
FreeLibrary.KERNEL32(?), ref: 00064A65
VirtualFree.KERNEL32(?,00000000,00008000), ref: 00064A92

Strings

close all, xrefs: 0002FC01

Memory Dump Source

Source File: 00000000.00000002.1643917647.0000000000021000.00000020.00000001.01000000.00000003.sdmp, Offset: 00020000, based on PE: true

Associated: 00000000.00000002.1643904003.0000000000020000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1643958107.00000000000AF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1643958107.00000000000D5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1643993044.00000000000DF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1644007204.00000000000E8000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_20000_Ship Docs_CI PL HBL COO_.jbxd

Similarity

API ID: Free$DestroyLibrarySendStringUninitializeUnregisterVirtualWindow
String ID: close all
API String ID: 469580280-3243417748
Opcode ID: 4d7f29bc0e33da04a5e929cc88ffb298a6cd5966fb26eed9f73cabfd10341cbe
Instruction ID: 5079d3f5884517e219c8fefd8b9fa416be930986edb8accb045f54f22c26f025
Opcode Fuzzy Hash: 4d7f29bc0e33da04a5e929cc88ffb298a6cd5966fb26eed9f73cabfd10341cbe
Instruction Fuzzy Hash: 49A18D30701222DFCB69EF50D995AB9F7A5BF04740F1442BDE80AAB262CB30AD16CF55

Function 0007A693 Relevance: 14.2, APIs: 2, Strings: 6, Instructions: 241COMMON

Download Yara Rule

APIs

EnumChildWindows.USER32(?,0007AA64), ref: 0007A9A2

Strings

INSTANCE, xrefs: 0007A8B0
CLASSNN, xrefs: 0007A744
CLASS, xrefs: 0007A721
NAME, xrefs: 0007A7D4
REGEXPCLASS, xrefs: 0007A767
TEXT, xrefs: 0007A8D9

Memory Dump Source

Source File: 00000000.00000002.1643917647.0000000000021000.00000020.00000001.01000000.00000003.sdmp, Offset: 00020000, based on PE: true

Associated: 00000000.00000002.1643904003.0000000000020000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1643958107.00000000000AF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1643958107.00000000000D5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1643993044.00000000000DF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1644007204.00000000000E8000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_20000_Ship Docs_CI PL HBL COO_.jbxd

Similarity

API ID: ChildEnumWindows
String ID: CLASS$CLASSNN$INSTANCE$NAME$REGEXPCLASS$TEXT
API String ID: 3555792229-1603158881
Opcode ID: ce17bdd4119047f897d7d89e7c23ce2701abe85e91e2a9d0e6ae5de26ca12d7d
Instruction ID: bb5c533007341c79e14377c137d2c20c2c789afc47f5c3c5c621d7bef28caf22
Opcode Fuzzy Hash: ce17bdd4119047f897d7d89e7c23ce2701abe85e91e2a9d0e6ae5de26ca12d7d
Instruction Fuzzy Hash: C791A370F04606AADB58DF60C481BEDFBB4BF45304F10C129E98EA7152DF34AA59CBA5

Function 00022E26 Relevance: 14.2, APIs: 7, Strings: 1, Instructions: 186windowCOMMON

Download Yara Rule

APIs

SetWindowLongW.USER32(?,000000EB), ref: 00022EAE

Part of subcall function 00021DB3: GetClientRect.USER32(?,?), ref: 00021DDC
Part of subcall function 00021DB3: GetWindowRect.USER32(?,?), ref: 00021E1D
Part of subcall function 00021DB3: ScreenToClient.USER32(?,?), ref: 00021E45

GetDC.USER32 ref: 0005CF82
SendMessageW.USER32(?,00000031,00000000,00000000), ref: 0005CF95
SelectObject.GDI32(00000000,00000000), ref: 0005CFA3
SelectObject.GDI32(00000000,00000000), ref: 0005CFB8
ReleaseDC.USER32(?,00000000), ref: 0005CFC0
MoveWindow.USER32(?,?,?,?,?,?,?,00000031,00000000,00000000), ref: 0005D04B

Strings

U, xrefs: 0005CF20

Memory Dump Source

Source File: 00000000.00000002.1643917647.0000000000021000.00000020.00000001.01000000.00000003.sdmp, Offset: 00020000, based on PE: true

Associated: 00000000.00000002.1643904003.0000000000020000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1643958107.00000000000AF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1643958107.00000000000D5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1643993044.00000000000DF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1644007204.00000000000E8000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_20000_Ship Docs_CI PL HBL COO_.jbxd

Similarity

API ID: Window$ClientObjectRectSelect$LongMessageMoveReleaseScreenSend
String ID: U
API String ID: 4009187628-3372436214
Opcode ID: f44d4448350ee49ae4915c9c6b8db4b4e6106d90caeb226034658a1fddafe563
Instruction ID: 676df0689602716c59e8ebc479bc50ef293980b9608f1c83f2c5af752849ecd6
Opcode Fuzzy Hash: f44d4448350ee49ae4915c9c6b8db4b4e6106d90caeb226034658a1fddafe563
Instruction Fuzzy Hash: 6971BF30400205EFDF718FA4D884AFB7BF6FF49361F14426AED555A2A6C7318885EB60

Function 000AC27C Relevance: 14.1, APIs: 6, Strings: 2, Instructions: 149windowCOMMON

Download Yara Rule

APIs

Part of subcall function 00022612: GetWindowLongW.USER32(?,000000EB), ref: 00022623

Part of subcall function 00022344: GetCursorPos.USER32(?), ref: 00022357
Part of subcall function 00022344: ScreenToClient.USER32(000E67B0,?), ref: 00022374
Part of subcall function 00022344: GetAsyncKeyState.USER32(00000001), ref: 00022399
Part of subcall function 00022344: GetAsyncKeyState.USER32(00000002), ref: 000223A7

ImageList_DragLeave.COMCTL32(00000000,00000000,00000001,?,?), ref: 000AC2E4
ImageList_EndDrag.COMCTL32 ref: 000AC2EA
ReleaseCapture.USER32 ref: 000AC2F0
SetWindowTextW.USER32(?,00000000), ref: 000AC39A
SendMessageW.USER32(?,000000B1,00000000,000000FF), ref: 000AC3AD
DefDlgProcW.USER32(?,00000202,?,?,00000000,00000001,?,?), ref: 000AC48F

Strings

@GUI_DRAGFILE, xrefs: 000AC424
@GUI_DROPID, xrefs: 000AC3E1

Memory Dump Source

Source File: 00000000.00000002.1643917647.0000000000021000.00000020.00000001.01000000.00000003.sdmp, Offset: 00020000, based on PE: true

Associated: 00000000.00000002.1643904003.0000000000020000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1643958107.00000000000AF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1643958107.00000000000D5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1643993044.00000000000DF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1644007204.00000000000E8000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_20000_Ship Docs_CI PL HBL COO_.jbxd

Similarity

API ID: AsyncDragImageList_StateWindow$CaptureClientCursorLeaveLongMessageProcReleaseScreenSendText
String ID: @GUI_DRAGFILE$@GUI_DROPID
API String ID: 1924731296-2107944366
Opcode ID: 76c833ecf9865ffc5f4e1e7060bad10bc57943a8f41cd521f9c32dca48025026
Instruction ID: 4b46ee58528d614321d29aa61793d3b404c998a21dff0be4ec63cb8ae235ec18
Opcode Fuzzy Hash: 76c833ecf9865ffc5f4e1e7060bad10bc57943a8f41cd521f9c32dca48025026
Instruction Fuzzy Hash: 1051CF70204301EFEB10EF60DC96FAA7BE5EB89710F00862DF5959B2E2CB759944CB52

Function 00098F5B Relevance: 13.9, APIs: 9, Instructions: 438COMMON

Download Yara Rule

APIs

GetModuleFileNameW.KERNEL32(?,?,00000104,?,000AF910), ref: 0009903D
FreeLibrary.KERNEL32(00000000,00000001,00000000,?,000AF910), ref: 00099071
QueryPathOfRegTypeLib.OLEAUT32(?,?,?,?,?), ref: 000991EB
SysFreeString.OLEAUT32(?), ref: 00099215

Memory Dump Source

Source File: 00000000.00000002.1643917647.0000000000021000.00000020.00000001.01000000.00000003.sdmp, Offset: 00020000, based on PE: true

Associated: 00000000.00000002.1643904003.0000000000020000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1643958107.00000000000AF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1643958107.00000000000D5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1643993044.00000000000DF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1644007204.00000000000E8000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_20000_Ship Docs_CI PL HBL COO_.jbxd

Similarity

API ID: Free$FileLibraryModuleNamePathQueryStringType
String ID:
API String ID: 560350794-0
Opcode ID: ee5c5f1f708ff38ba340f1e656beaf7cdeeda244807687bcac9101fbc037d58a
Instruction ID: 94acc45deb408ff7801f5a6ca942ae6d3a5f8e2494986ef24fa8f1770b3be07c
Opcode Fuzzy Hash: ee5c5f1f708ff38ba340f1e656beaf7cdeeda244807687bcac9101fbc037d58a
Instruction Fuzzy Hash: FFF13A71A00109EFDF14DF98C888EAEB7B9FF89315F108059F516AB291DB31AE45DB50

Function 0009F9A8 Relevance: 13.9, APIs: 9, Instructions: 386processCOMMON

Download Yara Rule

APIs

_memset.LIBCMT ref: 0009F9C9
GetSystemDirectoryW.KERNEL32(00000000,00000000), ref: 0009FB5C
GetSystemDirectoryW.KERNEL32(00000000,00000000), ref: 0009FB80
GetCurrentDirectoryW.KERNEL32(00000000,00000000), ref: 0009FBC0
GetCurrentDirectoryW.KERNEL32(00000000,00000000), ref: 0009FBE2
CreateProcessW.KERNEL32(00000000,?,00000000,00000000,?,?,00000000,?,?,?), ref: 0009FD5E
GetLastError.KERNEL32(00000000,00000001,00000000), ref: 0009FD90
CloseHandle.KERNEL32(?), ref: 0009FDBF
CloseHandle.KERNEL32(?), ref: 0009FE36

Memory Dump Source

Source File: 00000000.00000002.1643917647.0000000000021000.00000020.00000001.01000000.00000003.sdmp, Offset: 00020000, based on PE: true

Associated: 00000000.00000002.1643904003.0000000000020000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1643958107.00000000000AF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1643958107.00000000000D5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1643993044.00000000000DF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1644007204.00000000000E8000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_20000_Ship Docs_CI PL HBL COO_.jbxd

Similarity

API ID: Directory$CloseCurrentHandleSystem$CreateErrorLastProcess_memset
String ID:
API String ID: 4090791747-0
Opcode ID: 3c9f3c4821f089dee91f9c587a6f8317c258e2c8d3e5311e616f6d58c1e185aa
Instruction ID: 83ce250db852f4f416b212295afba10f81259c4b6811fbe0ff5061cfce7bd316
Opcode Fuzzy Hash: 3c9f3c4821f089dee91f9c587a6f8317c258e2c8d3e5311e616f6d58c1e185aa
Instruction Fuzzy Hash: 3EE1B271604302DFDB14EF24D891ABABBE1AF85354F14896DF8998B2A2CB31DC44DB52

Function 00084F63 Relevance: 13.7, APIs: 9, Instructions: 170filestringCOMMON

Download Yara Rule

APIs

Part of subcall function 000848AA: GetFullPathNameW.KERNEL32(00000000,00007FFF,?,?,?,?,?,?,000838D3,?), ref: 000848C7

Part of subcall function 000848AA: GetFullPathNameW.KERNEL32(?,00007FFF,?,?,?,?,?,000838D3,?), ref: 000848E0

Part of subcall function 00084CD3: GetFileAttributesW.KERNEL32(?,00083947), ref: 00084CD4

lstrcmpiW.KERNEL32(?,?), ref: 00084FE2
_wcscmp.LIBCMT ref: 00084FFC
MoveFileW.KERNEL32(?,?), ref: 00085017

Memory Dump Source

Source File: 00000000.00000002.1643917647.0000000000021000.00000020.00000001.01000000.00000003.sdmp, Offset: 00020000, based on PE: true

Associated: 00000000.00000002.1643904003.0000000000020000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1643958107.00000000000AF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1643958107.00000000000D5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1643993044.00000000000DF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1644007204.00000000000E8000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_20000_Ship Docs_CI PL HBL COO_.jbxd

Similarity

API ID: FileFullNamePath$AttributesMove_wcscmplstrcmpi
String ID:
API String ID: 793581249-0
Opcode ID: 8a33e3892949a116e4543f5317f9f69d5be4d9cdb40b7a219db8924638859a18
Instruction ID: 8f3d462276dec940a59cbd92e4525d315b024c5dc47150657163c84010ffb019
Opcode Fuzzy Hash: 8a33e3892949a116e4543f5317f9f69d5be4d9cdb40b7a219db8924638859a18
Instruction Fuzzy Hash: F45164B20087859BC764EB90DC859DFB7ECAF85341F40092EB2C9D3152EF74A6888766

Function 000A88B4 Relevance: 13.7, APIs: 9, Instructions: 168COMMON

Download Yara Rule

APIs

InvalidateRect.USER32(?,00000000,00000001,?,00000001), ref: 000A896E

Memory Dump Source

Source File: 00000000.00000002.1643917647.0000000000021000.00000020.00000001.01000000.00000003.sdmp, Offset: 00020000, based on PE: true

Associated: 00000000.00000002.1643904003.0000000000020000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1643958107.00000000000AF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1643958107.00000000000D5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1643993044.00000000000DF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1644007204.00000000000E8000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_20000_Ship Docs_CI PL HBL COO_.jbxd

Similarity

API ID: InvalidateRect
String ID:
API String ID: 634782764-0
Opcode ID: 5a4faea4b1fde509ff24f78879bc2b933e22e4cc23590bb603c5b879590e41fb
Instruction ID: d2a424ca2de0f65c241b3ac7797157ab3dc6afa1dcf191772b15c698e7c10ce3
Opcode Fuzzy Hash: 5a4faea4b1fde509ff24f78879bc2b933e22e4cc23590bb603c5b879590e41fb
Instruction Fuzzy Hash: 3B51A130600209BFEF349FA4DC89BAE7BA5BB17350F648112F511E61E1DF75A980CB82

Function 00022B72 Relevance: 13.7, APIs: 9, Instructions: 161windowCOMMON

Download Yara Rule

APIs

LoadImageW.USER32(00000000,?,00000001,00000010,00000010,00000010), ref: 0005C547
ExtractIconExW.SHELL32(?,00000000,00000000,00000000,00000001), ref: 0005C569
LoadImageW.USER32(00000000,?,00000001,00000000,00000000,00000050), ref: 0005C581
ExtractIconExW.SHELL32(?,00000000,?,00000000,00000001), ref: 0005C59F
SendMessageW.USER32(00000000,00000080,00000000,00000000), ref: 0005C5C0
DestroyIcon.USER32(00000000), ref: 0005C5CF
SendMessageW.USER32(00000000,00000080,00000001,00000000), ref: 0005C5EC
DestroyIcon.USER32(?), ref: 0005C5FB

Part of subcall function 000AA71E: DeleteObject.GDI32(00000000), ref: 000AA757

Memory Dump Source

Source File: 00000000.00000002.1643917647.0000000000021000.00000020.00000001.01000000.00000003.sdmp, Offset: 00020000, based on PE: true

Associated: 00000000.00000002.1643904003.0000000000020000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1643958107.00000000000AF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1643958107.00000000000D5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1643993044.00000000000DF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1644007204.00000000000E8000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_20000_Ship Docs_CI PL HBL COO_.jbxd

Similarity

API ID: Icon$DestroyExtractImageLoadMessageSend$DeleteObject
String ID:
API String ID: 2819616528-0
Opcode ID: 71281ee855a5002cee2c68761458590bc979a463af9403695e364da4f7161228
Instruction ID: e585ce6831dd5c20dbf426ba9150104f1252c1039592892876ccd4436420fa50
Opcode Fuzzy Hash: 71281ee855a5002cee2c68761458590bc979a463af9403695e364da4f7161228
Instruction Fuzzy Hash: AE515870600709AFEB20DFA4EC45FAA37F5EB59751F100528F942A72A0DB75ED90DB50

Function 00079B50 Relevance: 13.6, APIs: 9, Instructions: 66sleepkeyboardwindowCOMMON

Download Yara Rule

APIs

Part of subcall function 0007AE57: GetWindowThreadProcessId.USER32(?,00000000), ref: 0007AE77
Part of subcall function 0007AE57: GetCurrentThreadId.KERNEL32 ref: 0007AE7E
Part of subcall function 0007AE57: AttachThreadInput.USER32(00000000,?,00079B65,?,00000001), ref: 0007AE85

MapVirtualKeyW.USER32(00000025,00000000), ref: 00079B70
PostMessageW.USER32(?,00000100,00000025,00000000), ref: 00079B8D
Sleep.KERNEL32(00000000,?,00000100,00000025,00000000,?,00000001), ref: 00079B90
MapVirtualKeyW.USER32(00000025,00000000), ref: 00079B99
PostMessageW.USER32(?,00000100,00000027,00000000), ref: 00079BB7
Sleep.KERNEL32(00000000,?,00000100,00000027,00000000,?,00000001), ref: 00079BBA
MapVirtualKeyW.USER32(00000025,00000000), ref: 00079BC3
PostMessageW.USER32(?,00000101,00000027,00000000), ref: 00079BDA
Sleep.KERNEL32(00000000,?,00000100,00000027,00000000,?,00000001), ref: 00079BDD

Memory Dump Source

Source File: 00000000.00000002.1643917647.0000000000021000.00000020.00000001.01000000.00000003.sdmp, Offset: 00020000, based on PE: true

Associated: 00000000.00000002.1643904003.0000000000020000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1643958107.00000000000AF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1643958107.00000000000D5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1643993044.00000000000DF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1644007204.00000000000E8000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_20000_Ship Docs_CI PL HBL COO_.jbxd

Similarity

API ID: MessagePostSleepThreadVirtual$AttachCurrentInputProcessWindow
String ID:
API String ID: 2014098862-0
Opcode ID: dcdd59f51560e334daa59d75c5e9fd556cdec185ecdfafa42b498dce4ae31a55
Instruction ID: b380532c5a361d95adad9f14804dbc8dd440e8fcd3dbca50bbb09e8588fb97ba
Opcode Fuzzy Hash: dcdd59f51560e334daa59d75c5e9fd556cdec185ecdfafa42b498dce4ae31a55
Instruction Fuzzy Hash: 39110471A50A18BEF6106FA0DC89FBA3F2DEB4D755F104425F248AB0A1CAF75C10DEA4

Function 00078E03 Relevance: 13.5, APIs: 9, Instructions: 49memorythreadCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32(00000008,0000000C,00000000,00000000,?,00078A84,00000B00,?,?), ref: 00078E0C
HeapAlloc.KERNEL32(00000000,?,00078A84,00000B00,?,?), ref: 00078E13
GetCurrentProcess.KERNEL32(00000000,00000000,00000000,00000002,?,00078A84,00000B00,?,?), ref: 00078E28
GetCurrentProcess.KERNEL32(?,00000000,?,00078A84,00000B00,?,?), ref: 00078E30
DuplicateHandle.KERNEL32(00000000,?,00078A84,00000B00,?,?), ref: 00078E33
GetCurrentProcess.KERNEL32(00000008,00000000,00000000,00000002,?,00078A84,00000B00,?,?), ref: 00078E43
GetCurrentProcess.KERNEL32(00078A84,00000000,?,00078A84,00000B00,?,?), ref: 00078E4B
DuplicateHandle.KERNEL32(00000000,?,00078A84,00000B00,?,?), ref: 00078E4E
CreateThread.KERNEL32(00000000,00000000,00078E74,00000000,00000000,00000000), ref: 00078E68

Memory Dump Source

Source File: 00000000.00000002.1643917647.0000000000021000.00000020.00000001.01000000.00000003.sdmp, Offset: 00020000, based on PE: true

Associated: 00000000.00000002.1643904003.0000000000020000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1643958107.00000000000AF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1643958107.00000000000D5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1643993044.00000000000DF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1644007204.00000000000E8000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_20000_Ship Docs_CI PL HBL COO_.jbxd

Similarity

API ID: Process$Current$DuplicateHandleHeap$AllocCreateThread
String ID:
API String ID: 1957940570-0
Opcode ID: d6a446af8176334b51d60c9f3eae54f40080b6d9651e511a4c9d82b1fae6ece8
Instruction ID: 5b63c9a5bd77e1a78b3050121e5b6fd9dba8666ef1bd58746f354583e4a566b5
Opcode Fuzzy Hash: d6a446af8176334b51d60c9f3eae54f40080b6d9651e511a4c9d82b1fae6ece8
Instruction Fuzzy Hash: 4301BBB5640709FFF760ABA5DC4DF6B3BACEB89711F008421FA05DB1A1DA749800CB20

Function 00099428 Relevance: 12.5, APIs: 5, Strings: 2, Instructions: 263COMMON

Download Yara Rule

APIs

_memset.LIBCMT ref: 0009947C
VariantInit.OLEAUT32(?), ref: 0009954D
VariantInit.OLEAUT32(?), ref: 0009964E
VariantClear.OLEAUT32(?), ref: 00099658
VariantClear.OLEAUT32(?), ref: 000996B5

Strings

Null Object assignment in FOR..IN loop, xrefs: 000994DD, 0009960B, 000996C3
Incorrect Object type in FOR..IN loop, xrefs: 00099631

Memory Dump Source

Source File: 00000000.00000002.1643917647.0000000000021000.00000020.00000001.01000000.00000003.sdmp, Offset: 00020000, based on PE: true

Associated: 00000000.00000002.1643904003.0000000000020000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1643958107.00000000000AF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1643958107.00000000000D5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1643993044.00000000000DF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1644007204.00000000000E8000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_20000_Ship Docs_CI PL HBL COO_.jbxd

Similarity

API ID: Variant$ClearInit$_memset
String ID: Incorrect Object type in FOR..IN loop$Null Object assignment in FOR..IN loop
API String ID: 2862541840-625585964
Opcode ID: 0bcd769d57674db59f1ef37c08c176d5ddafdf598577a166131f2de8005e8fbd
Instruction ID: 55fd085b2a5e074689e9b5f555710096bb1b0407accf57f56e8ca8556f8e4f34
Opcode Fuzzy Hash: 0bcd769d57674db59f1ef37c08c176d5ddafdf598577a166131f2de8005e8fbd
Instruction Fuzzy Hash: E191AD71A00219ABDF24DFA9C848FAFBBB8EF85710F10815EF515AB281D7709905CFA0

Function 00099A72 Relevance: 12.5, APIs: 6, Strings: 1, Instructions: 242COMMON

Download Yara Rule

APIs

Part of subcall function 00077652: CLSIDFromProgID.OLE32(?,?,00000000,?,00000000,?,?,-C0000018,00000001,?,0007758C,80070057,?,?,?,0007799D), ref: 0007766F
Part of subcall function 00077652: ProgIDFromCLSID.OLE32(?,00000000,?,?,00000000,?,00000000,?,?,-C0000018,00000001,?,0007758C,80070057,?,?), ref: 0007768A
Part of subcall function 00077652: lstrcmpiW.KERNEL32(?,00000000,?,?,00000000,?,00000000,?,?,-C0000018,00000001,?,0007758C,80070057,?,?), ref: 00077698
Part of subcall function 00077652: CoTaskMemFree.OLE32(00000000,?,00000000,?,?,00000000,?,00000000,?,?,-C0000018,00000001,?,0007758C,80070057,?), ref: 000776A8

CoInitializeSecurity.OLE32(00000000,000000FF,00000000,00000000,00000002,00000003,00000000,00000000,00000000,?,?,?), ref: 00099B1B
_memset.LIBCMT ref: 00099B28
_memset.LIBCMT ref: 00099C6B
CoCreateInstanceEx.OLE32(?,00000000,00000015,?,00000001,00000000), ref: 00099C97
CoTaskMemFree.OLE32(?), ref: 00099CA2

Strings

NULL Pointer assignment, xrefs: 00099CF0

Memory Dump Source

Source File: 00000000.00000002.1643917647.0000000000021000.00000020.00000001.01000000.00000003.sdmp, Offset: 00020000, based on PE: true

Associated: 00000000.00000002.1643904003.0000000000020000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1643958107.00000000000AF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1643958107.00000000000D5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1643993044.00000000000DF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1644007204.00000000000E8000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_20000_Ship Docs_CI PL HBL COO_.jbxd

Similarity

API ID: FreeFromProgTask_memset$CreateInitializeInstanceSecuritylstrcmpi
String ID: NULL Pointer assignment
API String ID: 1300414916-2785691316
Opcode ID: dafeb4730b77dc6d9b12f86dbabd9c064e11bff967542349eee3d4e29abee209
Instruction ID: 5cb7c247c8a2574f51c16fe5c717162bfc4bf56a7a2b13cebb7e7f9f896f4fea
Opcode Fuzzy Hash: dafeb4730b77dc6d9b12f86dbabd9c064e11bff967542349eee3d4e29abee209
Instruction Fuzzy Hash: 13911A71D01229ABDF20DFA5DC85ADEBBB9BF08710F20415AF519A7281DB715A44CFA0

Function 000A6FEF Relevance: 12.4, APIs: 6, Strings: 1, Instructions: 143windowCOMMON

Download Yara Rule

APIs

SendMessageW.USER32(00000000,00001036,00000010,00000010), ref: 000A7093
SendMessageW.USER32(?,00001036,00000000,?), ref: 000A70A7
SetWindowPos.USER32(?,00000000,00000000,00000000,00000000,00000000,00000013), ref: 000A70C1
_wcscat.LIBCMT ref: 000A711C
SendMessageW.USER32(?,00001057,00000000,?), ref: 000A7133
SendMessageW.USER32(?,00001061,?,0000000F), ref: 000A7161

Strings

SysListView32, xrefs: 000A7065

Memory Dump Source

Source File: 00000000.00000002.1643917647.0000000000021000.00000020.00000001.01000000.00000003.sdmp, Offset: 00020000, based on PE: true

Associated: 00000000.00000002.1643904003.0000000000020000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1643958107.00000000000AF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1643958107.00000000000D5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1643993044.00000000000DF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1644007204.00000000000E8000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_20000_Ship Docs_CI PL HBL COO_.jbxd

Similarity

API ID: MessageSend$Window_wcscat
String ID: SysListView32
API String ID: 307300125-78025650
Opcode ID: c237cd667c6e71ad7cad1c930eef3d8d816e14cc1a0d83597755c748d7b65122
Instruction ID: 739800b65a919152685bb58b7bd0178eba72034f3e3c0e990b707557061d9f15
Opcode Fuzzy Hash: c237cd667c6e71ad7cad1c930eef3d8d816e14cc1a0d83597755c748d7b65122
Instruction Fuzzy Hash: B1418271A04309EFEB219FA4CC85FEE77E8EF09350F10452AF588A7192D6759D848B60

Function 0009EC47 Relevance: 12.4, APIs: 6, Strings: 1, Instructions: 136COMMON

Download Yara Rule

APIs

Part of subcall function 00083E91: CreateToolhelp32Snapshot.KERNEL32 ref: 00083EB6
Part of subcall function 00083E91: Process32FirstW.KERNEL32(00000000,?), ref: 00083EC4
Part of subcall function 00083E91: CloseHandle.KERNEL32(00000000), ref: 00083F8E

OpenProcess.KERNEL32(00000001,00000000,?), ref: 0009ECB8
GetLastError.KERNEL32 ref: 0009ECCB
OpenProcess.KERNEL32(00000001,00000000,?), ref: 0009ECFA
TerminateProcess.KERNEL32(00000000,00000000), ref: 0009ED77
GetLastError.KERNEL32(00000000), ref: 0009ED82
CloseHandle.KERNEL32(00000000), ref: 0009EDB7

Strings

SeDebugPrivilege, xrefs: 0009ECD6

Memory Dump Source

Source File: 00000000.00000002.1643917647.0000000000021000.00000020.00000001.01000000.00000003.sdmp, Offset: 00020000, based on PE: true

Associated: 00000000.00000002.1643904003.0000000000020000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1643958107.00000000000AF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1643958107.00000000000D5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1643993044.00000000000DF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1644007204.00000000000E8000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_20000_Ship Docs_CI PL HBL COO_.jbxd

Similarity

API ID: Process$CloseErrorHandleLastOpen$CreateFirstProcess32SnapshotTerminateToolhelp32
String ID: SeDebugPrivilege
API String ID: 2533919879-2896544425
Opcode ID: 37e2781bc32477b7d2b0bad13c7c8f9431745b2cc594e3a54f6dd46ddb077bc8
Instruction ID: 08c3a62a4c53532fd9846911b851a0a1e51692f127065bf18331632581b44e87
Opcode Fuzzy Hash: 37e2781bc32477b7d2b0bad13c7c8f9431745b2cc594e3a54f6dd46ddb077bc8
Instruction Fuzzy Hash: 3141CE71A002019FDB25EF24CC95FBDB7A4AF81714F088459F8469B2C3DB79AC04CB96

Function 00083226 Relevance: 12.3, APIs: 2, Strings: 5, Instructions: 82windowCOMMON

Download Yara Rule

APIs

LoadIconW.USER32(00000000,00007F03), ref: 000832C5

Strings

warning, xrefs: 000832AE
stop, xrefs: 00083296
question, xrefs: 0008327E
blank, xrefs: 00083247
info, xrefs: 00083266

Memory Dump Source

Source File: 00000000.00000002.1643917647.0000000000021000.00000020.00000001.01000000.00000003.sdmp, Offset: 00020000, based on PE: true

Associated: 00000000.00000002.1643904003.0000000000020000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1643958107.00000000000AF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1643958107.00000000000D5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1643993044.00000000000DF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1644007204.00000000000E8000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_20000_Ship Docs_CI PL HBL COO_.jbxd

Similarity

API ID: IconLoad
String ID: blank$info$question$stop$warning
API String ID: 2457776203-404129466
Opcode ID: 465a9151f168f99a3ffdf7bcd65d0e1488e50a66504e513edc5b31d699ee0b82
Instruction ID: 26e00b1c3fc46f1e73f1a8b036a18d7cd43601bb7e513f204851383ed72a26e5
Opcode Fuzzy Hash: 465a9151f168f99a3ffdf7bcd65d0e1488e50a66504e513edc5b31d699ee0b82
Instruction Fuzzy Hash: 84112731308346BAA7116B55DC43DAEB3DCFF5AB70F20002AF940AA2C2E6655B4147B9

Function 00084534 Relevance: 12.3, APIs: 6, Strings: 1, Instructions: 47windowCOMMON

Download Yara Rule

APIs

GetModuleHandleW.KERNEL32(00000000,?,?,00000100,00000000), ref: 0008454E
LoadStringW.USER32(00000000), ref: 00084555
GetModuleHandleW.KERNEL32(00000000,00001389,?,00000100), ref: 0008456B
LoadStringW.USER32(00000000), ref: 00084572
_wprintf.LIBCMT ref: 00084598
MessageBoxW.USER32(00000000,?,?,00011010), ref: 000845B6

Strings

%s (%d) : ==> %s: %s %s, xrefs: 00084593

Memory Dump Source

Source File: 00000000.00000002.1643917647.0000000000021000.00000020.00000001.01000000.00000003.sdmp, Offset: 00020000, based on PE: true

Associated: 00000000.00000002.1643904003.0000000000020000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1643958107.00000000000AF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1643958107.00000000000D5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1643993044.00000000000DF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1644007204.00000000000E8000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_20000_Ship Docs_CI PL HBL COO_.jbxd

Similarity

API ID: HandleLoadModuleString$Message_wprintf
String ID: %s (%d) : ==> %s: %s %s
API String ID: 3648134473-3128320259
Opcode ID: 9d222b38a44101b480540e7c811cdb81765afc9ef366f172c48d00dad65beb92
Instruction ID: 26d3010dad9bd8a38f7899f0df9ba29d0e5dbb57b93e9fe1297884d5f4b8529f
Opcode Fuzzy Hash: 9d222b38a44101b480540e7c811cdb81765afc9ef366f172c48d00dad65beb92
Instruction Fuzzy Hash: 150162F2900209BFE760E7E0DD89EFB776CE709311F0005A5BB45D2052EA789E858B74

Function 000AD74C Relevance: 12.3, APIs: 8, Instructions: 257windowCOMMON

Download Yara Rule

APIs

Part of subcall function 00022612: GetWindowLongW.USER32(?,000000EB), ref: 00022623

GetSystemMetrics.USER32(0000000F), ref: 000AD78A
GetSystemMetrics.USER32(0000000F), ref: 000AD7AA
MoveWindow.USER32(00000003,?,?,?,?,00000000,?,?,?), ref: 000AD9E5
SendMessageW.USER32(00000003,00000142,00000000,0000FFFF), ref: 000ADA03
SendMessageW.USER32(00000003,00000469,?,00000000), ref: 000ADA24
ShowWindow.USER32(00000003,00000000), ref: 000ADA43
InvalidateRect.USER32(?,00000000,00000001), ref: 000ADA68
DefDlgProcW.USER32(?,00000005,?,?), ref: 000ADA8B

Memory Dump Source

Source File: 00000000.00000002.1643917647.0000000000021000.00000020.00000001.01000000.00000003.sdmp, Offset: 00020000, based on PE: true

Associated: 00000000.00000002.1643904003.0000000000020000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1643958107.00000000000AF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1643958107.00000000000D5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1643993044.00000000000DF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1644007204.00000000000E8000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_20000_Ship Docs_CI PL HBL COO_.jbxd

Similarity

API ID: Window$MessageMetricsSendSystem$InvalidateLongMoveProcRectShow
String ID:
API String ID: 1211466189-0
Opcode ID: 876048b1c42ef53fdf8ee7df2e391407c05e48987b86283730e85031a0e295e3
Instruction ID: f3a407a37e4d4351a730d65912f190ff1b75d21bdbf77379e3d28a2aa5a7702d
Opcode Fuzzy Hash: 876048b1c42ef53fdf8ee7df2e391407c05e48987b86283730e85031a0e295e3
Instruction Fuzzy Hash: D2B17A71600216EFDF54CFA8C9C57BE7BF1BF06701F08816AEC4A9A695DB34A950CB90

Function 00022A5B Relevance: 12.1, APIs: 8, Instructions: 129COMMON

Download Yara Rule

APIs

ShowWindow.USER32(FFFFFFFF,?,00000000,00000000,?,0005C417,00000004,00000000,00000000,00000000), ref: 00022ACF
ShowWindow.USER32(FFFFFFFF,00000000,00000000,00000000,?,0005C417,00000004,00000000,00000000,00000000,000000FF), ref: 00022B17
ShowWindow.USER32(FFFFFFFF,00000006,00000000,00000000,?,0005C417,00000004,00000000,00000000,00000000), ref: 0005C46A
ShowWindow.USER32(FFFFFFFF,?,00000000,00000000,?,0005C417,00000004,00000000,00000000,00000000), ref: 0005C4D6

Memory Dump Source

Source File: 00000000.00000002.1643917647.0000000000021000.00000020.00000001.01000000.00000003.sdmp, Offset: 00020000, based on PE: true

Associated: 00000000.00000002.1643904003.0000000000020000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1643958107.00000000000AF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1643958107.00000000000D5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1643993044.00000000000DF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1644007204.00000000000E8000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_20000_Ship Docs_CI PL HBL COO_.jbxd

Similarity

API ID: ShowWindow
String ID:
API String ID: 1268545403-0
Opcode ID: 40c30cbe7b0a08422061e9534addbb8271a8bb28b61230f5e6b7be048ad88306
Instruction ID: 0cd93b26cb207bf22ad0ca2e7cd2f241f623c5944b9e116f706756d76c943c6b
Opcode Fuzzy Hash: 40c30cbe7b0a08422061e9534addbb8271a8bb28b61230f5e6b7be048ad88306
Instruction Fuzzy Hash: 37412B30208790BFE7758FA8FC98F7F7BD2AB46300F19892DE44746961C6799885D712

Function 00087368 Relevance: 12.1, APIs: 8, Instructions: 101fileCOMMON

Download Yara Rule

APIs

InterlockedExchange.KERNEL32(?,000001F5), ref: 0008737F

Part of subcall function 00040FF6: std::exception::exception.LIBCMT ref: 0004102C
Part of subcall function 00040FF6: __CxxThrowException@8.LIBCMT ref: 00041041

ReadFile.KERNEL32(0000FFFF,00000000,0000FFFF,?,00000000), ref: 000873B6
EnterCriticalSection.KERNEL32(?), ref: 000873D2
_memmove.LIBCMT ref: 00087420
_memmove.LIBCMT ref: 0008743D
LeaveCriticalSection.KERNEL32(?), ref: 0008744C
ReadFile.KERNEL32(0000FFFF,00000000,0000FFFF,00000000,00000000), ref: 00087461
InterlockedExchange.KERNEL32(?,000001F6), ref: 00087480

Memory Dump Source

Source File: 00000000.00000002.1643917647.0000000000021000.00000020.00000001.01000000.00000003.sdmp, Offset: 00020000, based on PE: true

Associated: 00000000.00000002.1643904003.0000000000020000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1643958107.00000000000AF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1643958107.00000000000D5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1643993044.00000000000DF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1644007204.00000000000E8000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_20000_Ship Docs_CI PL HBL COO_.jbxd

Similarity

API ID: CriticalExchangeFileInterlockedReadSection_memmove$EnterException@8LeaveThrowstd::exception::exception
String ID:
API String ID: 256516436-0
Opcode ID: e8677b57fd08625facb8a134cc2d97bd118cd07c6aac25f3e553b4e87534f339
Instruction ID: e3b887b19b277415326a400a2cbb11558e855d4ceb8e5665b260d018aff43328
Opcode Fuzzy Hash: e8677b57fd08625facb8a134cc2d97bd118cd07c6aac25f3e553b4e87534f339
Instruction Fuzzy Hash: 45319E71904206EBDF10EFA4DC85AAE7BB8FF45310B2440B5FD04AB246DB74DA54CBA4

Function 000A6442 Relevance: 12.1, APIs: 8, Instructions: 95windowCOMMON

Download Yara Rule

APIs

DeleteObject.GDI32(00000000), ref: 000A645A
GetDC.USER32(00000000), ref: 000A6462
GetDeviceCaps.GDI32(00000000,0000005A), ref: 000A646D
ReleaseDC.USER32(00000000,00000000), ref: 000A6479
CreateFontW.GDI32(?,00000000,00000000,00000000,?,00000000,00000000,00000000,00000001,00000004,00000000,?,00000000,?), ref: 000A64B5
SendMessageW.USER32(?,00000030,00000000,00000001), ref: 000A64C6
MoveWindow.USER32(?,?,?,?,?,00000000,?,?,000A9299,?,?,000000FF,00000000,?,000000FF,?), ref: 000A6500
SendMessageW.USER32(?,00000142,00000000,00000000), ref: 000A6520

Memory Dump Source

Source File: 00000000.00000002.1643917647.0000000000021000.00000020.00000001.01000000.00000003.sdmp, Offset: 00020000, based on PE: true

Associated: 00000000.00000002.1643904003.0000000000020000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1643958107.00000000000AF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1643958107.00000000000D5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1643993044.00000000000DF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1644007204.00000000000E8000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_20000_Ship Docs_CI PL HBL COO_.jbxd

Similarity

API ID: MessageSend$CapsCreateDeleteDeviceFontMoveObjectReleaseWindow
String ID:
API String ID: 3864802216-0
Opcode ID: 6c7e9cc34e443ca07441b2bf5ff4eee7fc8807bcf99c817f9ca5179576ec6a6c
Instruction ID: a811c035ad496a9f56e3220e482a60c58bedeb9e78f265ac27ad815b3e502ef9
Opcode Fuzzy Hash: 6c7e9cc34e443ca07441b2bf5ff4eee7fc8807bcf99c817f9ca5179576ec6a6c
Instruction Fuzzy Hash: 4B317F72601614BFEB118FA0CC4AFFB3FA9EF0A761F084065FE089A191D6799C41CB64

Function 0007C072 Relevance: 12.1, APIs: 8, Instructions: 92COMMON

Download Yara Rule

APIs

_memcmp.LIBCMT ref: 0007C087
_memcmp.LIBCMT ref: 0007C0A9
_memcmp.LIBCMT ref: 0007C0C1
_memcmp.LIBCMT ref: 0007C0D4
_memcmp.LIBCMT ref: 0007C0EE
_memcmp.LIBCMT ref: 0007C101
_memcmp.LIBCMT ref: 0007C119
_memcmp.LIBCMT ref: 0007C134

Memory Dump Source

Source File: 00000000.00000002.1643917647.0000000000021000.00000020.00000001.01000000.00000003.sdmp, Offset: 00020000, based on PE: true

Associated: 00000000.00000002.1643904003.0000000000020000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1643958107.00000000000AF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1643958107.00000000000D5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1643993044.00000000000DF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1644007204.00000000000E8000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_20000_Ship Docs_CI PL HBL COO_.jbxd

Similarity

API ID: _memcmp
String ID:
API String ID: 2931989736-0
Opcode ID: 275d9d0ded6c1723acb4a8bf8af52b63f01492e2ec06043afb3737c01284be6b
Instruction ID: fe773ff415cd5b5e678ce9290dca0ee9030e83e32a89a6735a97a1ce48688503
Opcode Fuzzy Hash: 275d9d0ded6c1723acb4a8bf8af52b63f01492e2ec06043afb3737c01284be6b
Instruction Fuzzy Hash: DA2195B1E00205B7F664A5219D42FFF279CAF61394B458038FE0D9A287F769ED1182ED

Function 0008ED8E Relevance: 10.8, APIs: 5, Strings: 1, Instructions: 323COMMON

Download Yara Rule

APIs

Part of subcall function 00029997: __itow.LIBCMT ref: 000299C2
Part of subcall function 00029997: __swprintf.LIBCMT ref: 00029A0C

Part of subcall function 0003FEC6: _wcscpy.LIBCMT ref: 0003FEE9

_wcstok.LIBCMT ref: 0008EEFF
_wcscpy.LIBCMT ref: 0008EF8E
_memset.LIBCMT ref: 0008EFC1

Strings

X, xrefs: 0008EFFE

Memory Dump Source

Source File: 00000000.00000002.1643917647.0000000000021000.00000020.00000001.01000000.00000003.sdmp, Offset: 00020000, based on PE: true

Associated: 00000000.00000002.1643904003.0000000000020000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1643958107.00000000000AF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1643958107.00000000000D5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1643993044.00000000000DF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1644007204.00000000000E8000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_20000_Ship Docs_CI PL HBL COO_.jbxd

Similarity

API ID: _wcscpy$__itow__swprintf_memset_wcstok
String ID: X
API String ID: 774024439-3081909835
Opcode ID: d70232715b8635254667214f43cdbb76ec498a672187737f4c9f09137942628e
Instruction ID: bb9b56d0a1efc702215fb29181f8cee9ec7f2b8279ec9ef8f416949e0091f658
Opcode Fuzzy Hash: d70232715b8635254667214f43cdbb76ec498a672187737f4c9f09137942628e
Instruction Fuzzy Hash: A5C19D715083519FCB24EF24D885AAAB7E4BF84310F14492DF8999B2A3DB70ED45CB82

Function 00021424 Relevance: 10.7, APIs: 7, Instructions: 219COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1643917647.0000000000021000.00000020.00000001.01000000.00000003.sdmp, Offset: 00020000, based on PE: true

Associated: 00000000.00000002.1643904003.0000000000020000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1643958107.00000000000AF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1643958107.00000000000D5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1643993044.00000000000DF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1644007204.00000000000E8000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_20000_Ship Docs_CI PL HBL COO_.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 555e289b25466fce52dc6aeda9f6803ff56dbaa726a3fab37e177f206d068c55
Instruction ID: beac7d5f365a12311c7a23d698f12f62b58042a2ce5b2ad817c9ad231cd4dff9
Opcode Fuzzy Hash: 555e289b25466fce52dc6aeda9f6803ff56dbaa726a3fab37e177f206d068c55
Instruction Fuzzy Hash: 05718A30900529EFDB14DF98DC89EFEBBB9FF86314F108159F915AA251C734AA51CBA0

Function 00096E8A Relevance: 10.7, APIs: 7, Instructions: 212COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1643917647.0000000000021000.00000020.00000001.01000000.00000003.sdmp, Offset: 00020000, based on PE: true

Associated: 00000000.00000002.1643904003.0000000000020000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1643958107.00000000000AF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1643958107.00000000000D5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1643993044.00000000000DF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1644007204.00000000000E8000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_20000_Ship Docs_CI PL HBL COO_.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1e2a2b6694a2d8c669393c0d53d13d50ff25fadbd8f56cb18c3443587a28a45f
Instruction ID: 8a0c6d83e7302392536825880e90d79914baf712dcfd92d9a60fb21826e5956f
Opcode Fuzzy Hash: 1e2a2b6694a2d8c669393c0d53d13d50ff25fadbd8f56cb18c3443587a28a45f
Instruction Fuzzy Hash: C861E172508310ABDB20EB24DC86EAFB7E9AFC4714F14891DF54A97293DB719D04CB92

Function 000AB60B Relevance: 10.7, APIs: 7, Instructions: 199windowCOMMON

Download Yara Rule

APIs

IsWindow.USER32(00C37C00), ref: 000AB6A5
IsWindowEnabled.USER32(00C37C00), ref: 000AB6B1
SendMessageW.USER32(?,0000041C,00000000,00000000), ref: 000AB795
SendMessageW.USER32(00C37C00,000000B0,?,?), ref: 000AB7CC
IsDlgButtonChecked.USER32(?,?), ref: 000AB809
GetWindowLongW.USER32(00C37C00,000000EC), ref: 000AB82B
SendMessageW.USER32(?,000000A1,00000002,00000000), ref: 000AB843

Memory Dump Source

Source File: 00000000.00000002.1643917647.0000000000021000.00000020.00000001.01000000.00000003.sdmp, Offset: 00020000, based on PE: true

Associated: 00000000.00000002.1643904003.0000000000020000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1643958107.00000000000AF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1643958107.00000000000D5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1643993044.00000000000DF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1644007204.00000000000E8000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_20000_Ship Docs_CI PL HBL COO_.jbxd

Similarity

API ID: MessageSendWindow$ButtonCheckedEnabledLong
String ID:
API String ID: 4072528602-0
Opcode ID: 9266a3f9c9495dd9ff3ff866b0a3d5cd15be1ecf027b25edcf29c1a08fe05f89
Instruction ID: 8546fdc8a6ffcded27b0d1a3fd22386433e317f08c2655793da842df7d7e96c3
Opcode Fuzzy Hash: 9266a3f9c9495dd9ff3ff866b0a3d5cd15be1ecf027b25edcf29c1a08fe05f89
Instruction Fuzzy Hash: B071AD34604204AFEB609FE4C8A4FBE7BF9FF5B340F144069E945A7262CB76A941CB50

Function 0009F732 Relevance: 10.7, APIs: 5, Strings: 1, Instructions: 177COMMON

Download Yara Rule

APIs

_memset.LIBCMT ref: 0009F75C
_memset.LIBCMT ref: 0009F825
ShellExecuteExW.SHELL32(?), ref: 0009F86A

Part of subcall function 00029997: __itow.LIBCMT ref: 000299C2
Part of subcall function 00029997: __swprintf.LIBCMT ref: 00029A0C

Part of subcall function 0003FEC6: _wcscpy.LIBCMT ref: 0003FEE9

GetProcessId.KERNEL32(00000000), ref: 0009F8E1
CloseHandle.KERNEL32(00000000), ref: 0009F910

Strings

@, xrefs: 0009F839

Memory Dump Source

Source File: 00000000.00000002.1643917647.0000000000021000.00000020.00000001.01000000.00000003.sdmp, Offset: 00020000, based on PE: true

Associated: 00000000.00000002.1643904003.0000000000020000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1643958107.00000000000AF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1643958107.00000000000D5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1643993044.00000000000DF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1644007204.00000000000E8000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_20000_Ship Docs_CI PL HBL COO_.jbxd

Similarity

API ID: _memset$CloseExecuteHandleProcessShell__itow__swprintf_wcscpy
String ID: @
API String ID: 3522835683-2766056989
Opcode ID: 9565cbd128390214693e913b12e39d9d040f7331b76a5308e6298d73c040e66d
Instruction ID: 68ba5b0354f33eef43f8f51b7f8439c09e798e778fac48adb848a3055aece15c
Opcode Fuzzy Hash: 9565cbd128390214693e913b12e39d9d040f7331b76a5308e6298d73c040e66d
Instruction Fuzzy Hash: D5619D75A0062ADFCF14EF94D4859AEBBF4FF48310F148469E84AAB352CB31AD40CB90

Function 0008145D Relevance: 10.7, APIs: 7, Instructions: 166windowCOMMON

Download Yara Rule

APIs

GetParent.USER32(?), ref: 0008149C
GetKeyboardState.USER32(?), ref: 000814B1
SetKeyboardState.USER32(?), ref: 00081512
PostMessageW.USER32(?,00000101,00000010,?), ref: 00081540
PostMessageW.USER32(?,00000101,00000011,?), ref: 0008155F
PostMessageW.USER32(?,00000101,00000012,?), ref: 000815A5
PostMessageW.USER32(?,00000101,0000005B,?), ref: 000815C8

Memory Dump Source

Source File: 00000000.00000002.1643917647.0000000000021000.00000020.00000001.01000000.00000003.sdmp, Offset: 00020000, based on PE: true

Associated: 00000000.00000002.1643904003.0000000000020000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1643958107.00000000000AF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1643958107.00000000000D5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1643993044.00000000000DF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1644007204.00000000000E8000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_20000_Ship Docs_CI PL HBL COO_.jbxd

Similarity

API ID: MessagePost$KeyboardState$Parent
String ID:
API String ID: 87235514-0
Opcode ID: fbb03ba71472f444ce31a486ff4325635c2b2385d2774868967fc2c75035740d
Instruction ID: 27c36da7fa422995680e7ee36d4a3cfd1ec9c2d1df70d91b2ecd415bcdc3a9a2
Opcode Fuzzy Hash: fbb03ba71472f444ce31a486ff4325635c2b2385d2774868967fc2c75035740d
Instruction Fuzzy Hash: 3451F0B0A08BD57EFB3262348C45BFA7EED7F46304F088589E1D5868C3D298AC96D750

Function 00081276 Relevance: 10.7, APIs: 7, Instructions: 165windowCOMMON

Download Yara Rule

APIs

GetParent.USER32(00000000), ref: 000812B5
GetKeyboardState.USER32(?), ref: 000812CA
SetKeyboardState.USER32(?), ref: 0008132B
PostMessageW.USER32(00000000,00000100,00000010,?), ref: 00081357
PostMessageW.USER32(00000000,00000100,00000011,?), ref: 00081374
PostMessageW.USER32(00000000,00000100,00000012,?), ref: 000813B8
PostMessageW.USER32(00000000,00000100,0000005B,?), ref: 000813D9

Memory Dump Source

Source File: 00000000.00000002.1643917647.0000000000021000.00000020.00000001.01000000.00000003.sdmp, Offset: 00020000, based on PE: true

Associated: 00000000.00000002.1643904003.0000000000020000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1643958107.00000000000AF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1643958107.00000000000D5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1643993044.00000000000DF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1644007204.00000000000E8000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_20000_Ship Docs_CI PL HBL COO_.jbxd

Similarity

API ID: MessagePost$KeyboardState$Parent
String ID:
API String ID: 87235514-0
Opcode ID: 273162ca3bb3da2b8212c5dc1a72b12f02673b132e386e0d01fcc2e11811d75d
Instruction ID: 3d67ab266f8a859f83821abb2c36f03eaceb1b52214a3988d3e0cb85f404870c
Opcode Fuzzy Hash: 273162ca3bb3da2b8212c5dc1a72b12f02673b132e386e0d01fcc2e11811d75d
Instruction Fuzzy Hash: 6B51D1B09086D53DFB32A6248C45BFABFED7F06300F088589E1D4968C2D395AD9AD760

Function 0008589F Relevance: 10.6, APIs: 7, Instructions: 138timeCOMMON

Download Yara Rule

APIs

GetLocalTime.KERNEL32 ref: 000858AC
_wcsncpy.LIBCMT ref: 000858E1
_wcsncpy.LIBCMT ref: 00085913
_wcsncpy.LIBCMT ref: 00085946
_wcsncpy.LIBCMT ref: 00085988
_wcsncpy.LIBCMT ref: 000859C2
_wcsncpy.LIBCMT ref: 000859F1

Memory Dump Source

Source File: 00000000.00000002.1643917647.0000000000021000.00000020.00000001.01000000.00000003.sdmp, Offset: 00020000, based on PE: true

Associated: 00000000.00000002.1643904003.0000000000020000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1643958107.00000000000AF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1643958107.00000000000D5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1643993044.00000000000DF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1644007204.00000000000E8000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_20000_Ship Docs_CI PL HBL COO_.jbxd

Similarity

API ID: _wcsncpy$LocalTime
String ID:
API String ID: 2945705084-0
Opcode ID: f9b7a2cd9fd79f01ea63d02ade53a2c8ee177fe82c8acaf6add1e78a67478f57
Instruction ID: 2f17a02e1ece89c5536bc553b147c3466d82ceb01a57b9f6f22dc707e9fda794
Opcode Fuzzy Hash: f9b7a2cd9fd79f01ea63d02ade53a2c8ee177fe82c8acaf6add1e78a67478f57
Instruction Fuzzy Hash: C941A4A5C2051876CB50FBB5CC8AACFB3A8AF04311F509562F958E3122F734E714C7AA

Function 000838AD Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 111filestringCOMMON

Download Yara Rule

APIs

Part of subcall function 000848AA: GetFullPathNameW.KERNEL32(00000000,00007FFF,?,?,?,?,?,?,000838D3,?), ref: 000848C7

Part of subcall function 000848AA: GetFullPathNameW.KERNEL32(?,00007FFF,?,?,?,?,?,000838D3,?), ref: 000848E0

lstrcmpiW.KERNEL32(?,?), ref: 000838F3
_wcscmp.LIBCMT ref: 0008390F
MoveFileW.KERNEL32(?,?), ref: 00083927
_wcscat.LIBCMT ref: 0008396F
SHFileOperationW.SHELL32(?), ref: 000839DB

Strings

\*.*, xrefs: 00083969

Memory Dump Source

Source File: 00000000.00000002.1643917647.0000000000021000.00000020.00000001.01000000.00000003.sdmp, Offset: 00020000, based on PE: true

Associated: 00000000.00000002.1643904003.0000000000020000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1643958107.00000000000AF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1643958107.00000000000D5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1643993044.00000000000DF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1644007204.00000000000E8000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_20000_Ship Docs_CI PL HBL COO_.jbxd

Similarity

API ID: FileFullNamePath$MoveOperation_wcscat_wcscmplstrcmpi
String ID: \*.*
API String ID: 1377345388-1173974218
Opcode ID: 91c0f16101d5a7abe36f61fea69bcc5367ea5abbec451f914d9689f05fb08cc6
Instruction ID: 79eef9de601c2391e4dc8817ecaf6781c5c8332d58ecad42e0192d30d18ecca1
Opcode Fuzzy Hash: 91c0f16101d5a7abe36f61fea69bcc5367ea5abbec451f914d9689f05fb08cc6
Instruction Fuzzy Hash: 094159B25083459AD791EF64C481AEFB7E8BF89740F40192EF4CAC3252EA74D688C752

Function 000A7500 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 103windowCOMMON

Download Yara Rule

APIs

_memset.LIBCMT ref: 000A7519
GetMenuItemInfoW.USER32(?,000000FF,00000000,00000030), ref: 000A75C0
IsMenu.USER32(?), ref: 000A75D8
InsertMenuItemW.USER32(?,?,00000001,00000030), ref: 000A7620
DrawMenuBar.USER32 ref: 000A7633

Strings

0, xrefs: 000A750D

Memory Dump Source

Source File: 00000000.00000002.1643917647.0000000000021000.00000020.00000001.01000000.00000003.sdmp, Offset: 00020000, based on PE: true

Associated: 00000000.00000002.1643904003.0000000000020000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1643958107.00000000000AF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1643958107.00000000000D5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1643993044.00000000000DF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1644007204.00000000000E8000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_20000_Ship Docs_CI PL HBL COO_.jbxd

Similarity

API ID: Menu$Item$DrawInfoInsert_memset
String ID: 0
API String ID: 3866635326-4108050209
Opcode ID: b34ddd72392dad58e23a6839af1cb4c7155248c35df10df462fde01696e4ec49
Instruction ID: a0cea84cdd2eb25ccd201c90344c109b1d5289ece5db88002c595678ce37c524
Opcode Fuzzy Hash: b34ddd72392dad58e23a6839af1cb4c7155248c35df10df462fde01696e4ec49
Instruction Fuzzy Hash: 05413D75A04A09EFDB20DFA4D884EAABBF5FF06350F048129E9599B250D735ED50CF90

Function 000A122D Relevance: 10.6, APIs: 7, Instructions: 101registryCOMMON

Download Yara Rule

APIs

RegEnumKeyExW.ADVAPI32(?,00000000,?,000000FF,00000000,00000000,00000000,?,?,?), ref: 000A125C
RegOpenKeyExW.ADVAPI32(?,?,00000000,?,?), ref: 000A1286
FreeLibrary.KERNEL32(00000000), ref: 000A133D

Part of subcall function 000A122D: RegCloseKey.ADVAPI32(?), ref: 000A12A3
Part of subcall function 000A122D: FreeLibrary.KERNEL32(?), ref: 000A12F5
Part of subcall function 000A122D: RegEnumKeyExW.ADVAPI32(?,00000000,?,000000FF,00000000,00000000,00000000,?), ref: 000A1318

RegDeleteKeyW.ADVAPI32(?,?), ref: 000A12E0

Memory Dump Source

Source File: 00000000.00000002.1643917647.0000000000021000.00000020.00000001.01000000.00000003.sdmp, Offset: 00020000, based on PE: true

Associated: 00000000.00000002.1643904003.0000000000020000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1643958107.00000000000AF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1643958107.00000000000D5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1643993044.00000000000DF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1644007204.00000000000E8000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_20000_Ship Docs_CI PL HBL COO_.jbxd

Similarity

API ID: EnumFreeLibrary$CloseDeleteOpen
String ID:
API String ID: 395352322-0
Opcode ID: 5c773e244e24d604f1d07bfc5977a7397c10c9c84295a08f0b277af87da8b865
Instruction ID: bd82355272ef8813ccf8c7f3ac8aa818ee52295aefef136c7447902ce5bb8edd
Opcode Fuzzy Hash: 5c773e244e24d604f1d07bfc5977a7397c10c9c84295a08f0b277af87da8b865
Instruction Fuzzy Hash: 123108B1901119BFEB159FD0DC89EFEB7BCEF0A340F00016AE552E2151EA749F859BA4

Function 000A653C Relevance: 10.6, APIs: 7, Instructions: 99windowCOMMON

Download Yara Rule

APIs

SendMessageW.USER32(00000000,000000F0,00000000,00000000), ref: 000A655B
GetWindowLongW.USER32(00C37C00,000000F0), ref: 000A658E
GetWindowLongW.USER32(00C37C00,000000F0), ref: 000A65C3
SendMessageW.USER32(00000000,000000F1,00000000,00000000), ref: 000A65F5
SendMessageW.USER32(00000000,000000F1,00000001,00000000), ref: 000A661F
GetWindowLongW.USER32(00000000,000000F0), ref: 000A6630
SetWindowLongW.USER32(00000000,000000F0,00000000), ref: 000A664A

Memory Dump Source

Source File: 00000000.00000002.1643917647.0000000000021000.00000020.00000001.01000000.00000003.sdmp, Offset: 00020000, based on PE: true

Associated: 00000000.00000002.1643904003.0000000000020000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1643958107.00000000000AF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1643958107.00000000000D5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1643993044.00000000000DF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1644007204.00000000000E8000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_20000_Ship Docs_CI PL HBL COO_.jbxd

Similarity

API ID: LongWindow$MessageSend
String ID:
API String ID: 2178440468-0
Opcode ID: d27d73a2904fc9f890d08aa34c550aa829eeacf693898e4b6a2cdf9d4655cbe2
Instruction ID: 3eb687aa697624d0c157db520c13ec70f1532eeab1a6990388fbe21d5f14756b
Opcode Fuzzy Hash: d27d73a2904fc9f890d08aa34c550aa829eeacf693898e4b6a2cdf9d4655cbe2
Instruction Fuzzy Hash: 3D310330A04551AFEB20CFA8EC88F6537F1FB5A790F190268F5119F2B6CB66A840DB41

Function 00096486 Relevance: 10.6, APIs: 7, Instructions: 94networkCOMMON

Download Yara Rule

APIs

Part of subcall function 000980A0: inet_addr.WSOCK32(00000000,?,00000000,?,?,?,00000000), ref: 000980CB

socket.WSOCK32(00000002,00000001,00000006,?,?,00000000), ref: 000964D9
WSAGetLastError.WSOCK32(00000000), ref: 000964E8
ioctlsocket.WSOCK32(00000000,8004667E,00000000), ref: 00096521
connect.WSOCK32(00000000,?,00000010), ref: 0009652A
WSAGetLastError.WSOCK32 ref: 00096534
closesocket.WSOCK32(00000000), ref: 0009655D
ioctlsocket.WSOCK32(00000000,8004667E,00000000), ref: 00096576

Memory Dump Source

Source File: 00000000.00000002.1643917647.0000000000021000.00000020.00000001.01000000.00000003.sdmp, Offset: 00020000, based on PE: true

Associated: 00000000.00000002.1643904003.0000000000020000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1643958107.00000000000AF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1643958107.00000000000D5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1643993044.00000000000DF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1644007204.00000000000E8000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_20000_Ship Docs_CI PL HBL COO_.jbxd

Similarity

API ID: ErrorLastioctlsocket$closesocketconnectinet_addrsocket
String ID:
API String ID: 910771015-0
Opcode ID: d2de125417ffd7d72c01c33fc47a09c06d3fe18ac876c75c35eb561915c88522
Instruction ID: 8323fe2f7c516b290e15b4bb4c7369d0aa77e864e39b75ce381847d2d2e4da55
Opcode Fuzzy Hash: d2de125417ffd7d72c01c33fc47a09c06d3fe18ac876c75c35eb561915c88522
Instruction Fuzzy Hash: 9B31B331600618AFEF109F64DC85BBE7BECEB45724F008029FD4997291DB79AD04DBA1

Function 0007E0B5 Relevance: 10.6, APIs: 7, Instructions: 90memoryCOMMON

Download Yara Rule

APIs

MultiByteToWideChar.KERNEL32(00000000,00000000,?,000000FF,00000000,00000000), ref: 0007E0FA
MultiByteToWideChar.KERNEL32(00000000,00000000,?,000000FF,00000000,00000000), ref: 0007E120
SysAllocString.OLEAUT32(00000000), ref: 0007E123
SysAllocString.OLEAUT32 ref: 0007E144
SysFreeString.OLEAUT32 ref: 0007E14D
StringFromGUID2.OLE32(?,?,00000028), ref: 0007E167
SysAllocString.OLEAUT32(?), ref: 0007E175

Memory Dump Source

Source File: 00000000.00000002.1643917647.0000000000021000.00000020.00000001.01000000.00000003.sdmp, Offset: 00020000, based on PE: true

Associated: 00000000.00000002.1643904003.0000000000020000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1643958107.00000000000AF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1643958107.00000000000D5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1643993044.00000000000DF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1644007204.00000000000E8000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_20000_Ship Docs_CI PL HBL COO_.jbxd

Similarity

API ID: String$Alloc$ByteCharMultiWide$FreeFrom
String ID:
API String ID: 3761583154-0
Opcode ID: aa0cf60712ca19ac3003377e923713a1de07797b24153402b0fdbac6586a3012
Instruction ID: a044a6da09807988782657365d52fadd1ad48cf7843156005776aba6d9c30dfb
Opcode Fuzzy Hash: aa0cf60712ca19ac3003377e923713a1de07797b24153402b0fdbac6586a3012
Instruction Fuzzy Hash: 05219531601109AFEB10AFA8DC89CBB77ECEB0D760B408175F918CB260DA789C418B68

Function 0007FB6E Relevance: 10.6, APIs: 3, Strings: 3, Instructions: 90COMMON

Download Yara Rule

APIs

__wcsnicmp.LIBCMT ref: 0007FB81
__wcsnicmp.LIBCMT ref: 0007FBA2
__wcsnicmp.LIBCMT ref: 0007FBBC

Strings

#requireadmin, xrefs: 0007FB9C
#OnAutoItStartRegister, xrefs: 0007FBB6
#notrayicon, xrefs: 0007FB79

Memory Dump Source

Source File: 00000000.00000002.1643917647.0000000000021000.00000020.00000001.01000000.00000003.sdmp, Offset: 00020000, based on PE: true

Associated: 00000000.00000002.1643904003.0000000000020000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1643958107.00000000000AF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1643958107.00000000000D5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1643993044.00000000000DF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1644007204.00000000000E8000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_20000_Ship Docs_CI PL HBL COO_.jbxd

Similarity

API ID: __wcsnicmp
String ID: #OnAutoItStartRegister$#notrayicon$#requireadmin
API String ID: 1038674560-2734436370
Opcode ID: 42700123fb5334dceb74e666dbbf3242bcf6a5cee8b9beb573815f905086cfba
Instruction ID: 7be38f8027b21f8365ca0cbfb0225ac4c00eafee243c7488ffec98200bb955fb
Opcode Fuzzy Hash: 42700123fb5334dceb74e666dbbf3242bcf6a5cee8b9beb573815f905086cfba
Instruction Fuzzy Hash: 002167B2A04116E6D235E624DE12EFB73D8EF11300F10C035F98987182EB98AD91D29D

Function 000A783C Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 75windowCOMMON

Download Yara Rule

APIs

Part of subcall function 00021D35: CreateWindowExW.USER32(?,?,?,?,?,?,?,?,?,?,00000000,00000096), ref: 00021D73
Part of subcall function 00021D35: GetStockObject.GDI32(00000011), ref: 00021D87
Part of subcall function 00021D35: SendMessageW.USER32(00000000,00000030,00000000), ref: 00021D91

SendMessageW.USER32(00000000,00002001,00000000,FF000000), ref: 000A78A1
SendMessageW.USER32(?,00000409,00000000,FF000000), ref: 000A78AE
SendMessageW.USER32(?,00000402,00000000,00000000), ref: 000A78B9
SendMessageW.USER32(?,00000401,00000000,00640000), ref: 000A78C8
SendMessageW.USER32(?,00000404,00000001,00000000), ref: 000A78D4

Strings

Msctls_Progress32, xrefs: 000A7872

Memory Dump Source

Source File: 00000000.00000002.1643917647.0000000000021000.00000020.00000001.01000000.00000003.sdmp, Offset: 00020000, based on PE: true

Associated: 00000000.00000002.1643904003.0000000000020000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1643958107.00000000000AF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1643958107.00000000000D5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1643993044.00000000000DF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1644007204.00000000000E8000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_20000_Ship Docs_CI PL HBL COO_.jbxd

Similarity

API ID: MessageSend$CreateObjectStockWindow
String ID: Msctls_Progress32
API String ID: 1025951953-3636473452
Opcode ID: 65af08eda26de6b5a20259ba3e2e1ee43dd0e352baafaf42cfe23d949a945f03
Instruction ID: e093bb460876b585a9fe5df7f1a0c95c41c9f9461a8025c0ac583b324ae72d02
Opcode Fuzzy Hash: 65af08eda26de6b5a20259ba3e2e1ee43dd0e352baafaf42cfe23d949a945f03
Instruction Fuzzy Hash: 5E11B6B1154219BFEF159FA0CC85EE77F5DEF09798F014115F608A6091CB769C21DBA0

Function 000441C9 Relevance: 10.5, APIs: 4, Strings: 2, Instructions: 24libraryloaderCOMMONLIBRARYCODE

Download Yara Rule

APIs

LoadLibraryExW.KERNEL32(combase.dll,00000000,00000800,RoInitialize,00044292,?), ref: 000441E3
GetProcAddress.KERNEL32(00000000), ref: 000441EA
EncodePointer.KERNEL32(00000000), ref: 000441F6
DecodePointer.KERNEL32(00000001,00044292,?), ref: 00044213

Strings

combase.dll, xrefs: 000441DE
RoInitialize, xrefs: 000441D2

Memory Dump Source

Source File: 00000000.00000002.1643917647.0000000000021000.00000020.00000001.01000000.00000003.sdmp, Offset: 00020000, based on PE: true

Associated: 00000000.00000002.1643904003.0000000000020000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1643958107.00000000000AF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1643958107.00000000000D5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1643993044.00000000000DF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1644007204.00000000000E8000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_20000_Ship Docs_CI PL HBL COO_.jbxd

Similarity

API ID: Pointer$AddressDecodeEncodeLibraryLoadProc
String ID: RoInitialize$combase.dll
API String ID: 3489934621-340411864
Opcode ID: e20dd1806871a8ed1a7044ccd56ca75a4e7eb6bb60bf1b1e7cc3f322c75debbd
Instruction ID: 6863783a2ecdc21c2547e0b2fed7d69ed4eac735f8ece00c66e2e093730e66f0
Opcode Fuzzy Hash: e20dd1806871a8ed1a7044ccd56ca75a4e7eb6bb60bf1b1e7cc3f322c75debbd
Instruction Fuzzy Hash: F5E01AB0A90741AEFF606BB0EC89B643AA4B762B43F504874F511ED0A0DBBD40959F04

Function 0004429E Relevance: 10.5, APIs: 4, Strings: 2, Instructions: 19libraryloaderCOMMONLIBRARYCODE

Download Yara Rule

APIs

LoadLibraryExW.KERNEL32(combase.dll,00000000,00000800,RoUninitialize,000441B8), ref: 000442B8
GetProcAddress.KERNEL32(00000000), ref: 000442BF
EncodePointer.KERNEL32(00000000), ref: 000442CA
DecodePointer.KERNEL32(000441B8), ref: 000442E5

Strings

RoUninitialize, xrefs: 000442A7
combase.dll, xrefs: 000442B3

Memory Dump Source

Source File: 00000000.00000002.1643917647.0000000000021000.00000020.00000001.01000000.00000003.sdmp, Offset: 00020000, based on PE: true

Associated: 00000000.00000002.1643904003.0000000000020000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1643958107.00000000000AF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1643958107.00000000000D5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1643993044.00000000000DF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1644007204.00000000000E8000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_20000_Ship Docs_CI PL HBL COO_.jbxd

Similarity

API ID: Pointer$AddressDecodeEncodeLibraryLoadProc
String ID: RoUninitialize$combase.dll
API String ID: 3489934621-2819208100
Opcode ID: b7933da295cad2c61fe0a030ceaf55baba76d7adde5093dca83da252e3a75f56
Instruction ID: f3ea98a6990614fb6cf7c87d062abb5dd37cc3270e9e00f40e40b02da9141f31
Opcode Fuzzy Hash: b7933da295cad2c61fe0a030ceaf55baba76d7adde5093dca83da252e3a75f56
Instruction Fuzzy Hash: FDE0B6B8681742AFFF50ABA1ED4DB553AA4B725B42F504478F501E90A0CBBC4540DB18

Function 0008675A Relevance: 9.2, APIs: 6, Instructions: 205COMMON

Download Yara Rule

APIs

_memmove.LIBCMT ref: 000868AD
_memmove.LIBCMT ref: 000867E8

Part of subcall function 00029997: __itow.LIBCMT ref: 000299C2
Part of subcall function 00029997: __swprintf.LIBCMT ref: 00029A0C

_memmove.LIBCMT ref: 0008685B
_memmove.LIBCMT ref: 00086942
_memmove.LIBCMT ref: 0008695B
_memmove.LIBCMT ref: 00086977

Memory Dump Source

Source File: 00000000.00000002.1643917647.0000000000021000.00000020.00000001.01000000.00000003.sdmp, Offset: 00020000, based on PE: true

Associated: 00000000.00000002.1643904003.0000000000020000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1643958107.00000000000AF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1643958107.00000000000D5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1643993044.00000000000DF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1644007204.00000000000E8000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_20000_Ship Docs_CI PL HBL COO_.jbxd

Similarity

API ID: _memmove$__itow__swprintf
String ID:
API String ID: 3253778849-0
Opcode ID: ab4eb5b95743a44d51d7fadd3155ba3afd48b97ef46ff4ca0970a978f0b83e01
Instruction ID: 3f3f140d465d9b42690b97ac081fe044f57d0278a1a446d9f6fe9f2e3efe887f
Opcode Fuzzy Hash: ab4eb5b95743a44d51d7fadd3155ba3afd48b97ef46ff4ca0970a978f0b83e01
Instruction Fuzzy Hash: 6361AD3050066A9BDF12FF24DC82EFE37A8BF04308F054529F9995B293DB359945CB90

Function 000A046F Relevance: 9.2, APIs: 6, Instructions: 167registryCOMMON

Download Yara Rule

APIs

Part of subcall function 00027F41: _memmove.LIBCMT ref: 00027F82

Part of subcall function 000A10A5: CharUpperBuffW.USER32(?,?,?,?,?,?,?,000A0038,?,?), ref: 000A10BC

RegConnectRegistryW.ADVAPI32(?,?,?), ref: 000A0548
RegOpenKeyExW.ADVAPI32(?,?,00000000,?,?), ref: 000A0588
RegCloseKey.ADVAPI32(?,00000001,00000000), ref: 000A05AB
RegEnumValueW.ADVAPI32(?,-00000001,?,?,00000000,?,00000000,00000000), ref: 000A05D4
RegCloseKey.ADVAPI32(?,?,00000000), ref: 000A0617
RegCloseKey.ADVAPI32(00000000), ref: 000A0624

Memory Dump Source

Source File: 00000000.00000002.1643917647.0000000000021000.00000020.00000001.01000000.00000003.sdmp, Offset: 00020000, based on PE: true

Associated: 00000000.00000002.1643904003.0000000000020000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1643958107.00000000000AF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1643958107.00000000000D5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1643993044.00000000000DF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1644007204.00000000000E8000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_20000_Ship Docs_CI PL HBL COO_.jbxd

Similarity

API ID: Close$BuffCharConnectEnumOpenRegistryUpperValue_memmove
String ID:
API String ID: 4046560759-0
Opcode ID: 7a1f69f0a46b7474ba556c8affa838c8d60e4409c5df0460734324628b18a68a
Instruction ID: cb1495ba9f5367020e98f1eb29367bbb54643744e10912decc2b4e13271ae4ea
Opcode Fuzzy Hash: 7a1f69f0a46b7474ba556c8affa838c8d60e4409c5df0460734324628b18a68a
Instruction Fuzzy Hash: 04515B31508205AFDB14EFA4D885EAFBBE8FF89314F04492DF585972A2DB31E904CB52

Function 000A5A20 Relevance: 9.2, APIs: 6, Instructions: 160windowCOMMON

Download Yara Rule

APIs

GetMenu.USER32(?), ref: 000A5A82
GetMenuItemCount.USER32(00000000), ref: 000A5AB9
GetMenuStringW.USER32(00000000,00000000,?,00007FFF,00000400), ref: 000A5AE1
GetMenuItemID.USER32(?,?), ref: 000A5B50
GetSubMenu.USER32(?,?), ref: 000A5B5E
PostMessageW.USER32(?,00000111,?,00000000), ref: 000A5BAF

Memory Dump Source

Source File: 00000000.00000002.1643917647.0000000000021000.00000020.00000001.01000000.00000003.sdmp, Offset: 00020000, based on PE: true

Associated: 00000000.00000002.1643904003.0000000000020000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1643958107.00000000000AF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1643958107.00000000000D5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1643993044.00000000000DF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1644007204.00000000000E8000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_20000_Ship Docs_CI PL HBL COO_.jbxd

Similarity

API ID: Menu$Item$CountMessagePostString
String ID:
API String ID: 650687236-0
Opcode ID: df9f5e2d42938727aa5a4b48561c9d214aba96e0b914df7f3936cc1d341c1aed
Instruction ID: bcc3c432cdeda5ec7e3c66251572fdec7b49cf57c421627e937ddb359f26bcb2
Opcode Fuzzy Hash: df9f5e2d42938727aa5a4b48561c9d214aba96e0b914df7f3936cc1d341c1aed
Instruction Fuzzy Hash: 0D517D71A00A25EFDB11EFA4C845AEEB7B4FF49321F104469F942B7252CB74AE418B91

Function 0007F3DD Relevance: 9.2, APIs: 6, Instructions: 159COMMON

Download Yara Rule

APIs

VariantInit.OLEAUT32(?), ref: 0007F3F7
VariantClear.OLEAUT32(00000013), ref: 0007F469
VariantClear.OLEAUT32(00000000), ref: 0007F4C4
_memmove.LIBCMT ref: 0007F4EE
VariantClear.OLEAUT32(?), ref: 0007F53B
VariantChangeType.OLEAUT32(?,?,00000000,00000013), ref: 0007F569

Memory Dump Source

Source File: 00000000.00000002.1643917647.0000000000021000.00000020.00000001.01000000.00000003.sdmp, Offset: 00020000, based on PE: true

Associated: 00000000.00000002.1643904003.0000000000020000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1643958107.00000000000AF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1643958107.00000000000D5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1643993044.00000000000DF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1644007204.00000000000E8000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_20000_Ship Docs_CI PL HBL COO_.jbxd

Similarity

API ID: Variant$Clear$ChangeInitType_memmove
String ID:
API String ID: 1101466143-0
Opcode ID: a39360ada93654efdaf15f8321e9b9bd25710b168661a47f81cd26146c266a2d
Instruction ID: 164f93baa07317dd10a8a723e300e3682b1bdefab1e9613edc2125d8e559c311
Opcode Fuzzy Hash: a39360ada93654efdaf15f8321e9b9bd25710b168661a47f81cd26146c266a2d
Instruction Fuzzy Hash: 585168B5A0020AEFDB10DF58D884AAAB7F8FF4C354B158169EA59DB300D734E951CBA0

Function 000826F9 Relevance: 9.1, APIs: 6, Instructions: 138windowCOMMON

Download Yara Rule

APIs

_memset.LIBCMT ref: 00082747
GetMenuItemInfoW.USER32(?,000000FF,00000000,00000030), ref: 00082792
IsMenu.USER32(00000000), ref: 000827B2
CreatePopupMenu.USER32 ref: 000827E6
GetMenuItemCount.USER32(000000FF), ref: 00082844
InsertMenuItemW.USER32(00000000,?,00000001,00000030), ref: 00082875

Memory Dump Source

Source File: 00000000.00000002.1643917647.0000000000021000.00000020.00000001.01000000.00000003.sdmp, Offset: 00020000, based on PE: true

Associated: 00000000.00000002.1643904003.0000000000020000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1643958107.00000000000AF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1643958107.00000000000D5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1643993044.00000000000DF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1644007204.00000000000E8000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_20000_Ship Docs_CI PL HBL COO_.jbxd

Similarity

API ID: Menu$Item$CountCreateInfoInsertPopup_memset
String ID:
API String ID: 3311875123-0
Opcode ID: 3b2877ba501a9965886d7e40c2aa4657cba96237442870f8b34e76d18ef85766
Instruction ID: 0a338ff4f6c720291180ad4dcdb4d959b65b1978eefb60da6809972ce99bfcc7
Opcode Fuzzy Hash: 3b2877ba501a9965886d7e40c2aa4657cba96237442870f8b34e76d18ef85766
Instruction Fuzzy Hash: E951D670A02306EFDF24EF68D888BAEBBF5FF55314F104169E8919B291DB709944CB51

Function 00021765 Relevance: 9.1, APIs: 6, Instructions: 113COMMON

Download Yara Rule

APIs

Part of subcall function 00022612: GetWindowLongW.USER32(?,000000EB), ref: 00022623

BeginPaint.USER32(?,?,?,?,?,?), ref: 0002179A
GetWindowRect.USER32(?,?), ref: 000217FE
ScreenToClient.USER32(?,?), ref: 0002181B
SetViewportOrgEx.GDI32(00000000,?,?,00000000), ref: 0002182C
EndPaint.USER32(?,?), ref: 00021876

Memory Dump Source

Source File: 00000000.00000002.1643917647.0000000000021000.00000020.00000001.01000000.00000003.sdmp, Offset: 00020000, based on PE: true

Associated: 00000000.00000002.1643904003.0000000000020000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1643958107.00000000000AF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1643958107.00000000000D5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1643993044.00000000000DF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1644007204.00000000000E8000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_20000_Ship Docs_CI PL HBL COO_.jbxd

Similarity

API ID: PaintWindow$BeginClientLongRectScreenViewport
String ID:
API String ID: 1827037458-0
Opcode ID: cf6a176c1451563ff7ebb61b9653124d5fea723ab9dc2f320e4ea027a5d5a3c0
Instruction ID: 5a21444e24dd80503348ffd3db7199c9359c4f9c080dba9ef7e27186c7866159
Opcode Fuzzy Hash: cf6a176c1451563ff7ebb61b9653124d5fea723ab9dc2f320e4ea027a5d5a3c0
Instruction Fuzzy Hash: C641C230104351AFD710DF64ECC4FBA7BF9EB66724F140629F9948B1A2CB35A805DB62

Function 000AB958 Relevance: 9.1, APIs: 6, Instructions: 109windowCOMMON

Download Yara Rule

APIs

ShowWindow.USER32(000E67B0,00000000,00C37C00,?,?,000E67B0,?,000AB862,?,?), ref: 000AB9CC
EnableWindow.USER32(00000000,00000000), ref: 000AB9F0
ShowWindow.USER32(000E67B0,00000000,00C37C00,?,?,000E67B0,?,000AB862,?,?), ref: 000ABA50
ShowWindow.USER32(00000000,00000004,?,000AB862,?,?), ref: 000ABA62
EnableWindow.USER32(00000000,00000001), ref: 000ABA86
SendMessageW.USER32(?,0000130C,?,00000000), ref: 000ABAA9

Memory Dump Source

Source File: 00000000.00000002.1643917647.0000000000021000.00000020.00000001.01000000.00000003.sdmp, Offset: 00020000, based on PE: true

Associated: 00000000.00000002.1643904003.0000000000020000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1643958107.00000000000AF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1643958107.00000000000D5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1643993044.00000000000DF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1644007204.00000000000E8000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_20000_Ship Docs_CI PL HBL COO_.jbxd

Similarity

API ID: Window$Show$Enable$MessageSend
String ID:
API String ID: 642888154-0
Opcode ID: 522e26c5d57ffa8569c3485f6354ecb90967ff70c4ce1fb741356f9ab36e7540
Instruction ID: dea2b18ed863bda34aaf10c94bd4e0516f956d294ddbedc74febc50d6e2a7c51
Opcode Fuzzy Hash: 522e26c5d57ffa8569c3485f6354ecb90967ff70c4ce1fb741356f9ab36e7540
Instruction Fuzzy Hash: 61416031600641AFDB62CFA8C489BA57BE0FF17310F1842B9FA488F6A3C731A845CB51

Function 000973B1 Relevance: 9.1, APIs: 6, Instructions: 97COMMON

Download Yara Rule

APIs

GetForegroundWindow.USER32(?,?,?,?,?,?,00095134,?,?,00000000,00000001), ref: 000973BF

Part of subcall function 00093C94: GetWindowRect.USER32(?,?), ref: 00093CA7

GetDesktopWindow.USER32 ref: 000973E9
GetWindowRect.USER32(00000000), ref: 000973F0
mouse_event.USER32(00008001,?,?,00000001,00000001), ref: 00097422

Part of subcall function 000854E6: Sleep.KERNEL32(?,00000000,?,?,?,?,?,?,?,?,?,?), ref: 0008555E

GetCursorPos.USER32(?), ref: 0009744E
mouse_event.USER32(00008001,?,?,00000000,00000000), ref: 000974AC

Memory Dump Source

Source File: 00000000.00000002.1643917647.0000000000021000.00000020.00000001.01000000.00000003.sdmp, Offset: 00020000, based on PE: true

Associated: 00000000.00000002.1643904003.0000000000020000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1643958107.00000000000AF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1643958107.00000000000D5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1643993044.00000000000DF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1644007204.00000000000E8000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_20000_Ship Docs_CI PL HBL COO_.jbxd

Similarity

API ID: Window$Rectmouse_event$CursorDesktopForegroundSleep
String ID:
API String ID: 4137160315-0
Opcode ID: b8738af3795ee8fb1d0e3c75ed5a386bc40b71f485dae1be9f3f43737e324c53
Instruction ID: 81f04b1d1d3d7d018b26900f4b5a7b5b7a2c2c3f24e8160c8c791b6644b9e548
Opcode Fuzzy Hash: b8738af3795ee8fb1d0e3c75ed5a386bc40b71f485dae1be9f3f43737e324c53
Instruction Fuzzy Hash: E531E472508706ABDB24DF54DC49FABBBE9FF89314F000929F58997192C774E908CB92

Function 00078D5B Relevance: 9.1, APIs: 6, Instructions: 69memoryCOMMON

Download Yara Rule

APIs

Part of subcall function 000785F1: GetTokenInformation.ADVAPI32(?,00000002,?,00000000,?), ref: 00078608
Part of subcall function 000785F1: GetLastError.KERNEL32(?,00000002,?,00000000,?), ref: 00078612
Part of subcall function 000785F1: GetProcessHeap.KERNEL32(00000008,?,?,00000002,?,00000000,?), ref: 00078621
Part of subcall function 000785F1: HeapAlloc.KERNEL32(00000000,?,00000002,?,00000000,?), ref: 00078628
Part of subcall function 000785F1: GetTokenInformation.ADVAPI32(?,00000002,00000000,?,?,?,00000002,?,00000000,?), ref: 0007863E

GetLengthSid.ADVAPI32(?,00000000,00078977), ref: 00078DAC
GetProcessHeap.KERNEL32(00000008,00000000), ref: 00078DB8
HeapAlloc.KERNEL32(00000000), ref: 00078DBF
CopySid.ADVAPI32(00000000,00000000,?), ref: 00078DD8
GetProcessHeap.KERNEL32(00000000,00000000,00078977), ref: 00078DEC
HeapFree.KERNEL32(00000000), ref: 00078DF3

Memory Dump Source

Source File: 00000000.00000002.1643917647.0000000000021000.00000020.00000001.01000000.00000003.sdmp, Offset: 00020000, based on PE: true

Associated: 00000000.00000002.1643904003.0000000000020000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1643958107.00000000000AF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1643958107.00000000000D5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1643993044.00000000000DF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1644007204.00000000000E8000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_20000_Ship Docs_CI PL HBL COO_.jbxd

Similarity

API ID: Heap$Process$AllocInformationToken$CopyErrorFreeLastLength
String ID:
API String ID: 3008561057-0
Opcode ID: 9042eb8d4c0262a82b9b0dbbdc72742faffa893d7e83399dbf2399a192a3038b
Instruction ID: 45608748dffa440a5e28a896d6c59d08ddaad5ac8cde85e8fe60995e57290efb
Opcode Fuzzy Hash: 9042eb8d4c0262a82b9b0dbbdc72742faffa893d7e83399dbf2399a192a3038b
Instruction Fuzzy Hash: 5011B131A40A05FFEB649FA4CC0DBBE77A9EF55315F10C029E84997250CB399D00CB64

Function 00078AF9 Relevance: 9.1, APIs: 6, Instructions: 65processCOMMON

Download Yara Rule

APIs

GetCurrentProcess.KERNEL32(0000000A,00000004), ref: 00078B2A
OpenProcessToken.ADVAPI32(00000000), ref: 00078B31
CreateEnvironmentBlock.USERENV(?,00000004,00000001), ref: 00078B40
CloseHandle.KERNEL32(00000004), ref: 00078B4B
CreateProcessWithLogonW.ADVAPI32(?,?,?,00000000,00000000,?,?,00000000,?,?,?), ref: 00078B7A
DestroyEnvironmentBlock.USERENV(00000000), ref: 00078B8E

Memory Dump Source

Source File: 00000000.00000002.1643917647.0000000000021000.00000020.00000001.01000000.00000003.sdmp, Offset: 00020000, based on PE: true

Associated: 00000000.00000002.1643904003.0000000000020000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1643958107.00000000000AF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1643958107.00000000000D5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1643993044.00000000000DF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1644007204.00000000000E8000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_20000_Ship Docs_CI PL HBL COO_.jbxd

Similarity

API ID: Process$BlockCreateEnvironment$CloseCurrentDestroyHandleLogonOpenTokenWith
String ID:
API String ID: 1413079979-0
Opcode ID: 87a58d2219f29ab9ff872487b8c87463e0500987c418fa4a1c3120fcdbabdbdf
Instruction ID: 18af26c5af8cbe15899dfad825db706fe0f412e4bb7ecda2e4b0a4619f849194
Opcode Fuzzy Hash: 87a58d2219f29ab9ff872487b8c87463e0500987c418fa4a1c3120fcdbabdbdf
Instruction Fuzzy Hash: 24112CB294120EABEF118FA4DD49FEE7BA9EF49304F048065FE04A6160C7799D609B60

Function 000AC19A Relevance: 9.0, APIs: 6, Instructions: 49COMMON

Download Yara Rule

APIs

Part of subcall function 000212F3: ExtCreatePen.GDI32(?,?,00000000,00000000,00000000,?,00000000), ref: 0002134D
Part of subcall function 000212F3: SelectObject.GDI32(?,00000000), ref: 0002135C
Part of subcall function 000212F3: BeginPath.GDI32(?), ref: 00021373
Part of subcall function 000212F3: SelectObject.GDI32(?,00000000), ref: 0002139C

MoveToEx.GDI32(00000000,-00000002,?,00000000), ref: 000AC1C4
LineTo.GDI32(00000000,00000003,?), ref: 000AC1D8
MoveToEx.GDI32(00000000,00000000,?,00000000), ref: 000AC1E6
LineTo.GDI32(00000000,00000000,?), ref: 000AC1F6
EndPath.GDI32(00000000), ref: 000AC206
StrokePath.GDI32(00000000), ref: 000AC216

Memory Dump Source

Source File: 00000000.00000002.1643917647.0000000000021000.00000020.00000001.01000000.00000003.sdmp, Offset: 00020000, based on PE: true

Associated: 00000000.00000002.1643904003.0000000000020000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1643958107.00000000000AF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1643958107.00000000000D5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1643993044.00000000000DF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1644007204.00000000000E8000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_20000_Ship Docs_CI PL HBL COO_.jbxd

Similarity

API ID: Path$LineMoveObjectSelect$BeginCreateStroke
String ID:
API String ID: 43455801-0
Opcode ID: 52cf0e08f9da8897199e93227676b293c89b390dbb9708c5300e29297ca97e2a
Instruction ID: 193af28e8e7ceb01ddc22726e3d80049a9f7e836ccad9ea147f72e920e7a2c92
Opcode Fuzzy Hash: 52cf0e08f9da8897199e93227676b293c89b390dbb9708c5300e29297ca97e2a
Instruction Fuzzy Hash: 3C115B7600014DBFEF119FD0EC88FEA3FACEB09390F048121BA085A161C7769D95DBA0

Function 000403A2 Relevance: 9.0, APIs: 6, Instructions: 44keyboardCOMMON

Download Yara Rule

APIs

MapVirtualKeyW.USER32(0000005B,00000000), ref: 000403D3
MapVirtualKeyW.USER32(00000010,00000000), ref: 000403DB
MapVirtualKeyW.USER32(000000A0,00000000), ref: 000403E6
MapVirtualKeyW.USER32(000000A1,00000000), ref: 000403F1
MapVirtualKeyW.USER32(00000011,00000000), ref: 000403F9
MapVirtualKeyW.USER32(00000012,00000000), ref: 00040401

Memory Dump Source

Source File: 00000000.00000002.1643917647.0000000000021000.00000020.00000001.01000000.00000003.sdmp, Offset: 00020000, based on PE: true

Associated: 00000000.00000002.1643904003.0000000000020000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1643958107.00000000000AF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1643958107.00000000000D5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1643993044.00000000000DF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1644007204.00000000000E8000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_20000_Ship Docs_CI PL HBL COO_.jbxd

Similarity

API ID: Virtual
String ID:
API String ID: 4278518827-0
Opcode ID: a3dd68cb347b08e3eecc882c7db1fbf60681390a3c537b6c272eb1412aaa4d51
Instruction ID: 8b3120cef0d595622393c5a407dbba301d618176fb8a84b00c962eafbe39f4ba
Opcode Fuzzy Hash: a3dd68cb347b08e3eecc882c7db1fbf60681390a3c537b6c272eb1412aaa4d51
Instruction Fuzzy Hash: 26016CB0901B5A7DE3008F5A8C85B52FFA8FF19354F00411BA15C47941C7F5A864CBE5

Function 0008568B Relevance: 9.0, APIs: 6, Instructions: 43windowtimethreadCOMMON

Download Yara Rule

APIs

PostMessageW.USER32(?,00000010,00000000,00000000), ref: 0008569B
SendMessageTimeoutW.USER32(?,00000010,00000000,00000000,00000002,000001F4,?), ref: 000856B1
GetWindowThreadProcessId.USER32(?,?), ref: 000856C0
OpenProcess.KERNEL32(001F0FFF,00000000,?,?,?,?,00000010,00000000,00000000,00000002,000001F4,?,?,00000010,00000000,00000000), ref: 000856CF
TerminateProcess.KERNEL32(00000000,00000000,?,?,?,00000010,00000000,00000000,00000002,000001F4,?,?,00000010,00000000,00000000), ref: 000856D9
CloseHandle.KERNEL32(00000000,?,?,?,00000010,00000000,00000000,00000002,000001F4,?,?,00000010,00000000,00000000), ref: 000856E0

Memory Dump Source

Source File: 00000000.00000002.1643917647.0000000000021000.00000020.00000001.01000000.00000003.sdmp, Offset: 00020000, based on PE: true

Associated: 00000000.00000002.1643904003.0000000000020000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1643958107.00000000000AF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1643958107.00000000000D5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1643993044.00000000000DF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1644007204.00000000000E8000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_20000_Ship Docs_CI PL HBL COO_.jbxd

Similarity

API ID: Process$Message$CloseHandleOpenPostSendTerminateThreadTimeoutWindow
String ID:
API String ID: 839392675-0
Opcode ID: ac5f52cd29119e5f1f42dc6cf7b965761aec7786c612585cf8a05fa085f5cf44
Instruction ID: a27124a495f414069891648d791b7478859ba12e66ee3fc049ae5855c733f125
Opcode Fuzzy Hash: ac5f52cd29119e5f1f42dc6cf7b965761aec7786c612585cf8a05fa085f5cf44
Instruction Fuzzy Hash: 92F01D3224195ABBE7215BE2DC0EEBB7A7CEBC7B11F000169FA04D105096A51A0186B5

Function 000874D2 Relevance: 9.0, APIs: 6, Instructions: 33synchronizationthreadCOMMONLIBRARYCODE

Download Yara Rule

APIs

InterlockedExchange.KERNEL32(?,?), ref: 000874E5
EnterCriticalSection.KERNEL32(?,?,00031044,?,?), ref: 000874F6
TerminateThread.KERNEL32(00000000,000001F6,?,00031044,?,?), ref: 00087503
WaitForSingleObject.KERNEL32(00000000,000003E8,?,00031044,?,?), ref: 00087510

Part of subcall function 00086ED7: CloseHandle.KERNEL32(00000000,?,0008751D,?,00031044,?,?), ref: 00086EE1

InterlockedExchange.KERNEL32(?,000001F6), ref: 00087523
LeaveCriticalSection.KERNEL32(?,?,00031044,?,?), ref: 0008752A

Memory Dump Source

Source File: 00000000.00000002.1643917647.0000000000021000.00000020.00000001.01000000.00000003.sdmp, Offset: 00020000, based on PE: true

Associated: 00000000.00000002.1643904003.0000000000020000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1643958107.00000000000AF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1643958107.00000000000D5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1643993044.00000000000DF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1644007204.00000000000E8000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_20000_Ship Docs_CI PL HBL COO_.jbxd

Similarity

API ID: CriticalExchangeInterlockedSection$CloseEnterHandleLeaveObjectSingleTerminateThreadWait
String ID:
API String ID: 3495660284-0
Opcode ID: 3361136b0b8984b37d718b4eb995742bc6095102d80ce8c96a60db01973490a0
Instruction ID: 2d1fa755e2fb19fe052ff1847fef5c03ca18d2d582a6659874eb6306722301ae
Opcode Fuzzy Hash: 3361136b0b8984b37d718b4eb995742bc6095102d80ce8c96a60db01973490a0
Instruction Fuzzy Hash: 40F05E3A140A13EBEB612BA4FC8CAFB776AFF46302B100531F242910B5DBB95801CB50

Function 00078E74 Relevance: 9.0, APIs: 6, Instructions: 23memorysynchronizationCOMMON

Download Yara Rule

APIs

WaitForSingleObject.KERNEL32(?,000000FF), ref: 00078E7F
UnloadUserProfile.USERENV(?,?), ref: 00078E8B
CloseHandle.KERNEL32(?), ref: 00078E94
CloseHandle.KERNEL32(?), ref: 00078E9C
GetProcessHeap.KERNEL32(00000000,?), ref: 00078EA5
HeapFree.KERNEL32(00000000), ref: 00078EAC

Memory Dump Source

Source File: 00000000.00000002.1643917647.0000000000021000.00000020.00000001.01000000.00000003.sdmp, Offset: 00020000, based on PE: true

Associated: 00000000.00000002.1643904003.0000000000020000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1643958107.00000000000AF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1643958107.00000000000D5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1643993044.00000000000DF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1644007204.00000000000E8000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_20000_Ship Docs_CI PL HBL COO_.jbxd

Similarity

API ID: CloseHandleHeap$FreeObjectProcessProfileSingleUnloadUserWait
String ID:
API String ID: 146765662-0
Opcode ID: 7813bd57702af6500194af6e85f693904436c2f7b6635021c663f5c3917fab50
Instruction ID: 9bce13c2dfee74042a0bc12fb3025c666e75b57f81c858b2de37678767bbda8f
Opcode Fuzzy Hash: 7813bd57702af6500194af6e85f693904436c2f7b6635021c663f5c3917fab50
Instruction Fuzzy Hash: 98E05276104906FFEB012FE5EC0C96ABB69FB8A762B508631F219C1470CB3A9461DB50

Function 00098902 Relevance: 9.0, APIs: 3, Strings: 2, Instructions: 225COMMON

Download Yara Rule

APIs

VariantInit.OLEAUT32(?), ref: 00098928
CharUpperBuffW.USER32(?,?), ref: 00098A37
VariantClear.OLEAUT32(?), ref: 00098BAF

Part of subcall function 00087804: VariantInit.OLEAUT32(00000000), ref: 00087844
Part of subcall function 00087804: VariantCopy.OLEAUT32(00000000,?), ref: 0008784D
Part of subcall function 00087804: VariantClear.OLEAUT32(00000000), ref: 00087859

Strings

AUTOIT.ERROR, xrefs: 00098A3D
Incorrect Parameter format, xrefs: 00098960, 00098B22

Memory Dump Source

Source File: 00000000.00000002.1643917647.0000000000021000.00000020.00000001.01000000.00000003.sdmp, Offset: 00020000, based on PE: true

Associated: 00000000.00000002.1643904003.0000000000020000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1643958107.00000000000AF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1643958107.00000000000D5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1643993044.00000000000DF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1644007204.00000000000E8000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_20000_Ship Docs_CI PL HBL COO_.jbxd

Similarity

API ID: Variant$ClearInit$BuffCharCopyUpper
String ID: AUTOIT.ERROR$Incorrect Parameter format
API String ID: 4237274167-1221869570
Opcode ID: 67573b25ff8ea7f82f6b7d30be6379b176fea6bec2ac24a8499c8c18899797a1
Instruction ID: 11849ebe5973ca1b1bb7432b6d09ee4eee9076cf40ec4896d7eea4253468274d
Opcode Fuzzy Hash: 67573b25ff8ea7f82f6b7d30be6379b176fea6bec2ac24a8499c8c18899797a1
Instruction Fuzzy Hash: 139162716083019FCB10DF24C48599BBBE4EF8A714F18896EF89A8B362DB31D945DB52

Function 00082F86 Relevance: 8.9, APIs: 4, Strings: 1, Instructions: 195windowCOMMON

Download Yara Rule

APIs

Part of subcall function 0003FEC6: _wcscpy.LIBCMT ref: 0003FEE9

_memset.LIBCMT ref: 00083077
GetMenuItemInfoW.USER32(?,?,00000000,?), ref: 000830A6
SetMenuItemInfoW.USER32(?,?,00000000,?), ref: 00083159
SetMenuDefaultItem.USER32(?,000000FF,00000000), ref: 00083187

Strings

0, xrefs: 00083063

Memory Dump Source

Source File: 00000000.00000002.1643917647.0000000000021000.00000020.00000001.01000000.00000003.sdmp, Offset: 00020000, based on PE: true

Associated: 00000000.00000002.1643904003.0000000000020000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1643958107.00000000000AF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1643958107.00000000000D5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1643993044.00000000000DF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1644007204.00000000000E8000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_20000_Ship Docs_CI PL HBL COO_.jbxd

Similarity

API ID: ItemMenu$Info$Default_memset_wcscpy
String ID: 0
API String ID: 4152858687-4108050209
Opcode ID: 0e7ad70a6424994bf0641553c1069c3ceb91ac505039e66e83dcdfa30f12f809
Instruction ID: 1b7e7793edb7f4f35b263506129687a43780fbcc1ba873698fce5e09f747117a
Opcode Fuzzy Hash: 0e7ad70a6424994bf0641553c1069c3ceb91ac505039e66e83dcdfa30f12f809
Instruction Fuzzy Hash: 1051D0716083009ADB65BF28D849AABBBE4FF95F60F040A2DF8C5D3191DB74CE448B56

Function 0007DA5D Relevance: 8.9, APIs: 4, Strings: 1, Instructions: 121comlibraryloaderCOMMON

Download Yara Rule

APIs

CoCreateInstance.OLE32(?,00000000,00000005,?,?,?,?,?,?,?,?,?,?,?), ref: 0007DAC5
SetErrorMode.KERNEL32(00000001,?,?,?,?,?,?,?,?,?), ref: 0007DAFB
GetProcAddress.KERNEL32(?,DllGetClassObject), ref: 0007DB0C
SetErrorMode.KERNEL32(00000000,?,?,?,?,?,?,?,?,?), ref: 0007DB8E

Strings

DllGetClassObject, xrefs: 0007DB01

Memory Dump Source

Source File: 00000000.00000002.1643917647.0000000000021000.00000020.00000001.01000000.00000003.sdmp, Offset: 00020000, based on PE: true

Associated: 00000000.00000002.1643904003.0000000000020000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1643958107.00000000000AF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1643958107.00000000000D5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1643993044.00000000000DF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1644007204.00000000000E8000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_20000_Ship Docs_CI PL HBL COO_.jbxd

Similarity

API ID: ErrorMode$AddressCreateInstanceProc
String ID: DllGetClassObject
API String ID: 753597075-1075368562
Opcode ID: fd588ed5b26c538b1973a5c813cc8106c0d6f39c566384995ecacfa4bd547e13
Instruction ID: 3923c4ece0d066a36acd6de3990fd2d9eadba6bcc81205a7a9a2a8a825a981eb
Opcode Fuzzy Hash: fd588ed5b26c538b1973a5c813cc8106c0d6f39c566384995ecacfa4bd547e13
Instruction Fuzzy Hash: 41418371A00205EFDB15CF54C884A9A7BF9EF44350F15C1ABAD099F206D7B9DD40DBA4

Function 00082C42 Relevance: 8.9, APIs: 4, Strings: 1, Instructions: 114windowCOMMON

Download Yara Rule

APIs

_memset.LIBCMT ref: 00082CAF
GetMenuItemInfoW.USER32(00000004,00000000,00000000,?), ref: 00082CCB
DeleteMenu.USER32(?,00000007,00000000), ref: 00082D11
DeleteMenu.USER32(?,00000000,00000000,?,00000000,00000000,000E6890,00000000), ref: 00082D5A

Strings

0, xrefs: 00082CA4

Memory Dump Source

Source File: 00000000.00000002.1643917647.0000000000021000.00000020.00000001.01000000.00000003.sdmp, Offset: 00020000, based on PE: true

Associated: 00000000.00000002.1643904003.0000000000020000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1643958107.00000000000AF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1643958107.00000000000D5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1643993044.00000000000DF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1644007204.00000000000E8000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_20000_Ship Docs_CI PL HBL COO_.jbxd

Similarity

API ID: Menu$Delete$InfoItem_memset
String ID: 0
API String ID: 1173514356-4108050209
Opcode ID: acb8fdddb7055a547abc8d827245e93334d52d85eafc87d57912764f2a3c537c
Instruction ID: 9df464f3250b5ecf4177124bfa70bfcd2724a1e2eb687a35874f04b15afb3121
Opcode Fuzzy Hash: acb8fdddb7055a547abc8d827245e93334d52d85eafc87d57912764f2a3c537c
Instruction Fuzzy Hash: EB4186701053029FD724EF24D845B5BBBE4FF85320F144A6DF9A597292D770E905CB92

Function 0009DAB9 Relevance: 8.9, APIs: 1, Strings: 4, Instructions: 101COMMON

Download Yara Rule

APIs

CharLowerBuffW.USER32(?,?,?,?,00000000,?,?), ref: 0009DAD9

Part of subcall function 000279AB: _memmove.LIBCMT ref: 000279F9

Strings

none, xrefs: 0009DBB4
winapi, xrefs: 0009DB4A
stdcall, xrefs: 0009DB5B
cdecl, xrefs: 0009DB30

Memory Dump Source

Source File: 00000000.00000002.1643917647.0000000000021000.00000020.00000001.01000000.00000003.sdmp, Offset: 00020000, based on PE: true

Associated: 00000000.00000002.1643904003.0000000000020000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1643958107.00000000000AF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1643958107.00000000000D5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1643993044.00000000000DF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1644007204.00000000000E8000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_20000_Ship Docs_CI PL HBL COO_.jbxd

Similarity

API ID: BuffCharLower_memmove
String ID: cdecl$none$stdcall$winapi
API String ID: 3425801089-567219261
Opcode ID: 10e797c51f1c8953d221c372aabd05cebf6b36368b9ecbbd378afcb8d5a9672f
Instruction ID: 9a9256b812646ac81a7a2dd6a71921e7198ea28673e4b5989e084370c4496869
Opcode Fuzzy Hash: 10e797c51f1c8953d221c372aabd05cebf6b36368b9ecbbd378afcb8d5a9672f
Instruction Fuzzy Hash: 4C31A27190461AEFCF10EF94CC819EEB7B4FF05310B10866AE865A77D2DB31A905CB90

Function 00079372 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 94windowCOMMON

Download Yara Rule

APIs

Part of subcall function 00027F41: _memmove.LIBCMT ref: 00027F82

Part of subcall function 0007B0C4: GetClassNameW.USER32(?,?,000000FF), ref: 0007B0E7

SendMessageW.USER32(?,00000188,00000000,00000000), ref: 000793F6
SendMessageW.USER32(?,0000018A,00000000,00000000), ref: 00079409
SendMessageW.USER32(?,00000189,?,00000000), ref: 00079439

Part of subcall function 00027D2C: _memmove.LIBCMT ref: 00027D66

Strings

ComboBox, xrefs: 00079380
ListBox, xrefs: 000793B5

Memory Dump Source

Source File: 00000000.00000002.1643917647.0000000000021000.00000020.00000001.01000000.00000003.sdmp, Offset: 00020000, based on PE: true

Associated: 00000000.00000002.1643904003.0000000000020000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1643958107.00000000000AF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1643958107.00000000000D5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1643993044.00000000000DF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1644007204.00000000000E8000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_20000_Ship Docs_CI PL HBL COO_.jbxd

Similarity

API ID: MessageSend$_memmove$ClassName
String ID: ComboBox$ListBox
API String ID: 365058703-1403004172
Opcode ID: db738f5de9d3bb6b2c8d3f3fba46d3514f355be58c0843cfe1015701dd15d160
Instruction ID: 915cd27767bc28ee4ac8fe1937f94dbb3a312d54ef4fac4dd6119e6f839981dd
Opcode Fuzzy Hash: db738f5de9d3bb6b2c8d3f3fba46d3514f355be58c0843cfe1015701dd15d160
Instruction Fuzzy Hash: 3F21D671D04104BBDB14ABB4DC86DFFB7BCDF06350B148129F929A72E2DB394A0A9664

Function 00091B21 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 86networkCOMMON

Download Yara Rule

APIs

InternetOpenUrlW.WININET(?,?,00000000,00000000,?,00000000), ref: 00091B40
HttpSendRequestW.WININET(00000000,00000000,00000000,00000000,00000000), ref: 00091B66
HttpQueryInfoW.WININET(00000000,00000005,?,?,?), ref: 00091B96
InternetCloseHandle.WININET(00000000), ref: 00091BDD

Part of subcall function 00092777: GetLastError.KERNEL32(?,?,00091B0B,00000000,00000000,00000001), ref: 0009278C
Part of subcall function 00092777: SetEvent.KERNEL32(?,?,00091B0B,00000000,00000000,00000001), ref: 000927A1

Strings

, xrefs: 00091B87

Memory Dump Source

Source File: 00000000.00000002.1643917647.0000000000021000.00000020.00000001.01000000.00000003.sdmp, Offset: 00020000, based on PE: true

Associated: 00000000.00000002.1643904003.0000000000020000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1643958107.00000000000AF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1643958107.00000000000D5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1643993044.00000000000DF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1644007204.00000000000E8000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_20000_Ship Docs_CI PL HBL COO_.jbxd

Similarity

API ID: HttpInternet$CloseErrorEventHandleInfoLastOpenQueryRequestSend
String ID:
API String ID: 3113390036-3916222277
Opcode ID: ba71a0da039ad2816a9816c26b7e84abbb74fcde01da62d87fdf6b278f81a004
Instruction ID: 1b82899759137a5c57b7165eb6074c8574d0f09400ef20a7982ba006ca8df760
Opcode Fuzzy Hash: ba71a0da039ad2816a9816c26b7e84abbb74fcde01da62d87fdf6b278f81a004
Instruction Fuzzy Hash: 4C21CFB1604209BFEF219FA49CC5EFF76EDEB49744F10012AF445A2240EB349D04A7A1

Function 000A6656 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 80windowlibraryCOMMON

Download Yara Rule

APIs

Part of subcall function 00021D35: CreateWindowExW.USER32(?,?,?,?,?,?,?,?,?,?,00000000,00000096), ref: 00021D73
Part of subcall function 00021D35: GetStockObject.GDI32(00000011), ref: 00021D87
Part of subcall function 00021D35: SendMessageW.USER32(00000000,00000030,00000000), ref: 00021D91

SendMessageW.USER32(00000000,00000467,00000000,?), ref: 000A66D0
LoadLibraryW.KERNEL32(?), ref: 000A66D7
SendMessageW.USER32(?,00000467,00000000,00000000), ref: 000A66EC
DestroyWindow.USER32(?), ref: 000A66F4

Strings

SysAnimate32, xrefs: 000A66AB

Memory Dump Source

Source File: 00000000.00000002.1643917647.0000000000021000.00000020.00000001.01000000.00000003.sdmp, Offset: 00020000, based on PE: true

Associated: 00000000.00000002.1643904003.0000000000020000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1643958107.00000000000AF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1643958107.00000000000D5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1643993044.00000000000DF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1644007204.00000000000E8000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_20000_Ship Docs_CI PL HBL COO_.jbxd

Similarity

API ID: MessageSend$Window$CreateDestroyLibraryLoadObjectStock
String ID: SysAnimate32
API String ID: 4146253029-1011021900
Opcode ID: 2f96dc355b2e4b5e651a1b4e6a8c30cffed23443332bd29ff9894d1bfdff4931
Instruction ID: 1d3a2e59b2f02b187002f12f5fdc22197b94c781966e0c4bb7d473102187cd32
Opcode Fuzzy Hash: 2f96dc355b2e4b5e651a1b4e6a8c30cffed23443332bd29ff9894d1bfdff4931
Instruction Fuzzy Hash: 10219D71200206ABEF104FA4EC80EBB77FDEB5A368F184629F950961A0DB72CC519760

Function 0008703E Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 79filepipeCOMMON

Download Yara Rule

APIs

GetStdHandle.KERNEL32(0000000C), ref: 0008705E
CreatePipe.KERNEL32(?,?,0000000C,00000000), ref: 00087091
GetStdHandle.KERNEL32(0000000C), ref: 000870A3
CreateFileW.KERNEL32(nul,40000000,00000002,0000000C,00000003,00000080,00000000), ref: 000870DD

Strings

nul, xrefs: 000870D8

Memory Dump Source

Source File: 00000000.00000002.1643917647.0000000000021000.00000020.00000001.01000000.00000003.sdmp, Offset: 00020000, based on PE: true

Associated: 00000000.00000002.1643904003.0000000000020000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1643958107.00000000000AF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1643958107.00000000000D5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1643993044.00000000000DF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1644007204.00000000000E8000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_20000_Ship Docs_CI PL HBL COO_.jbxd

Similarity

API ID: CreateHandle$FilePipe
String ID: nul
API String ID: 4209266947-2873401336
Opcode ID: 1ef778f67ba6a5be1e718b2e744d656b8db50f8981c08533bdba626be847b23f
Instruction ID: db1d374722c129a862c2c9af2a52f709db072fefb722a2284d147b7da7c2f312
Opcode Fuzzy Hash: 1ef778f67ba6a5be1e718b2e744d656b8db50f8981c08533bdba626be847b23f
Instruction Fuzzy Hash: CC217F74604309EBDB20AF68D805A9A77E8BF95720F304A29F9E4D72D5D771E850CB60

Function 0008710C Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 79filepipeCOMMON

Download Yara Rule

APIs

GetStdHandle.KERNEL32(000000F6), ref: 0008712B
CreatePipe.KERNEL32(?,?,0000000C,00000000), ref: 0008715D
GetStdHandle.KERNEL32(000000F6), ref: 0008716E
CreateFileW.KERNEL32(nul,80000000,00000001,0000000C,00000003,00000080,00000000), ref: 000871A8

Strings

nul, xrefs: 000871A3

Memory Dump Source

Source File: 00000000.00000002.1643917647.0000000000021000.00000020.00000001.01000000.00000003.sdmp, Offset: 00020000, based on PE: true

Associated: 00000000.00000002.1643904003.0000000000020000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1643958107.00000000000AF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1643958107.00000000000D5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1643993044.00000000000DF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1644007204.00000000000E8000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_20000_Ship Docs_CI PL HBL COO_.jbxd

Similarity

API ID: CreateHandle$FilePipe
String ID: nul
API String ID: 4209266947-2873401336
Opcode ID: e43dfccb097613adf5dac42a4e3476428f4db7e1ad798371d171e28666b9c500
Instruction ID: 15d333aaa8b96edd0583296a8ecc39a77f2d5dbe3f481618427ba7dbd859855c
Opcode Fuzzy Hash: e43dfccb097613adf5dac42a4e3476428f4db7e1ad798371d171e28666b9c500
Instruction Fuzzy Hash: A5219D75608206ABDF20AF6C9C08AAAB7E8BF55720F300A19F9E4D72D4D770D841CB61

Function 0008AEAB Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 73COMMON

Download Yara Rule

APIs

SetErrorMode.KERNEL32(00000001), ref: 0008AEBF
GetVolumeInformationW.KERNEL32(?,?,00007FFF,?,00000000,00000000,00000000,00000000), ref: 0008AF13
__swprintf.LIBCMT ref: 0008AF2C
SetErrorMode.KERNEL32(00000000,00000001,00000000,000AF910), ref: 0008AF6A

Strings

%lu, xrefs: 0008AF26

Memory Dump Source

Source File: 00000000.00000002.1643917647.0000000000021000.00000020.00000001.01000000.00000003.sdmp, Offset: 00020000, based on PE: true

Associated: 00000000.00000002.1643904003.0000000000020000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1643958107.00000000000AF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1643958107.00000000000D5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1643993044.00000000000DF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1644007204.00000000000E8000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_20000_Ship Docs_CI PL HBL COO_.jbxd

Similarity

API ID: ErrorMode$InformationVolume__swprintf
String ID: %lu
API String ID: 3164766367-685833217
Opcode ID: d3c37b40cf18148431ee75bc3ac8475bb89a8489225034fb7d7e963ac1569608
Instruction ID: 57da4a7ab39a6e1d68f377acc92e372a9f409bc9fcea3f5714c1626b53223d89
Opcode Fuzzy Hash: d3c37b40cf18148431ee75bc3ac8475bb89a8489225034fb7d7e963ac1569608
Instruction Fuzzy Hash: 21215630A00209AFDB10EF94DD85DEE77B8FF49704B104069F909DB252DB31EA45CB61

Function 0007A52F Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 68windowCOMMON

Download Yara Rule

APIs

Part of subcall function 00027D2C: _memmove.LIBCMT ref: 00027D66

Part of subcall function 0007A37C: SendMessageTimeoutW.USER32(?,00000000,00000000,00000000,00000002,00001388,00000001), ref: 0007A399
Part of subcall function 0007A37C: GetWindowThreadProcessId.USER32(?,00000000), ref: 0007A3AC
Part of subcall function 0007A37C: GetCurrentThreadId.KERNEL32 ref: 0007A3B3
Part of subcall function 0007A37C: AttachThreadInput.USER32(00000000), ref: 0007A3BA

GetFocus.USER32 ref: 0007A554

Part of subcall function 0007A3C5: GetParent.USER32(?), ref: 0007A3D3

GetClassNameW.USER32(?,?,00000100), ref: 0007A59D
EnumChildWindows.USER32(?,0007A615), ref: 0007A5C5
__swprintf.LIBCMT ref: 0007A5DF

Strings

%s%d, xrefs: 0007A5D9

Memory Dump Source

Source File: 00000000.00000002.1643917647.0000000000021000.00000020.00000001.01000000.00000003.sdmp, Offset: 00020000, based on PE: true

Associated: 00000000.00000002.1643904003.0000000000020000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1643958107.00000000000AF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1643958107.00000000000D5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1643993044.00000000000DF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1644007204.00000000000E8000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_20000_Ship Docs_CI PL HBL COO_.jbxd

Similarity

API ID: Thread$AttachChildClassCurrentEnumFocusInputMessageNameParentProcessSendTimeoutWindowWindows__swprintf_memmove
String ID: %s%d
API String ID: 1941087503-1110647743
Opcode ID: c2ae0bb77f638b8e5283f2bbf7bef743ca1bbe352c035e9cadacb4dc04b6627c
Instruction ID: 221572147a5f419ce9c9efeaca406d30f7426ec1fe825d63eb5afa92bdadd4dc
Opcode Fuzzy Hash: c2ae0bb77f638b8e5283f2bbf7bef743ca1bbe352c035e9cadacb4dc04b6627c
Instruction Fuzzy Hash: D6117271A002096BDF117FA4DC85FFE77789F8A710F048075BE0CAA193CA785A458B79

Function 00082017 Relevance: 8.8, APIs: 1, Strings: 4, Instructions: 49COMMON

Download Yara Rule

APIs

CharUpperBuffW.USER32(?,?), ref: 00082048

Strings

KEYS, xrefs: 0008205F
REMOVE, xrefs: 0008204E
APPEND, xrefs: 00082081
EXISTS, xrefs: 00082070

Memory Dump Source

Source File: 00000000.00000002.1643917647.0000000000021000.00000020.00000001.01000000.00000003.sdmp, Offset: 00020000, based on PE: true

Associated: 00000000.00000002.1643904003.0000000000020000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1643958107.00000000000AF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1643958107.00000000000D5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1643993044.00000000000DF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1644007204.00000000000E8000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_20000_Ship Docs_CI PL HBL COO_.jbxd

Similarity

API ID: BuffCharUpper
String ID: APPEND$EXISTS$KEYS$REMOVE
API String ID: 3964851224-769500911
Opcode ID: 0f27761af44cb8ff4b456287283ae71e725517df666efb3729115b87491a5620
Instruction ID: 2aceffd4e91e1e7b69d43d4dece55e3374304c763a9d76b18c15fdaebe569982
Opcode Fuzzy Hash: 0f27761af44cb8ff4b456287283ae71e725517df666efb3729115b87491a5620
Instruction Fuzzy Hash: 58113974D0021A8FCF40EFA4D9418EEB7B4BF16304F1084A9D895A7353EB32690ACB50

Function 0009EE69 Relevance: 7.7, APIs: 5, Instructions: 247COMMON

Download Yara Rule

APIs

OpenProcess.KERNEL32(00000410,00000000,00000000), ref: 0009EF1B
GetProcessIoCounters.KERNEL32(00000000,?), ref: 0009EF4B
GetProcessMemoryInfo.PSAPI(00000000,?,00000028), ref: 0009F07E
CloseHandle.KERNEL32(?), ref: 0009F0FF

Memory Dump Source

Source File: 00000000.00000002.1643917647.0000000000021000.00000020.00000001.01000000.00000003.sdmp, Offset: 00020000, based on PE: true

Associated: 00000000.00000002.1643904003.0000000000020000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1643958107.00000000000AF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1643958107.00000000000D5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1643993044.00000000000DF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1644007204.00000000000E8000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_20000_Ship Docs_CI PL HBL COO_.jbxd

Similarity

API ID: Process$CloseCountersHandleInfoMemoryOpen
String ID:
API String ID: 2364364464-0
Opcode ID: 0aa7910aa213eb03136738940bc8d78637e75cfa5734f78a4a27fd0f1fd865f8
Instruction ID: dfb2189f1ba352d03452dbd4551bfa9381a7af09def54e3f448dc4e591d7e02f
Opcode Fuzzy Hash: 0aa7910aa213eb03136738940bc8d78637e75cfa5734f78a4a27fd0f1fd865f8
Instruction Fuzzy Hash: 678184716047119FDB20DF28D846F6AB7E5AF88710F14881DF995DB293DB71AC40CB91

Function 000A02C2 Relevance: 7.6, APIs: 5, Instructions: 144registryCOMMON

Download Yara Rule

APIs

Part of subcall function 00027F41: _memmove.LIBCMT ref: 00027F82

Part of subcall function 000A10A5: CharUpperBuffW.USER32(?,?,?,?,?,?,?,000A0038,?,?), ref: 000A10BC

RegConnectRegistryW.ADVAPI32(?,?,?), ref: 000A0388
RegOpenKeyExW.ADVAPI32(?,?,00000000,?,?), ref: 000A03C7
RegEnumKeyExW.ADVAPI32(?,-00000001,?,?,00000000,00000000,00000000,?), ref: 000A040E
RegCloseKey.ADVAPI32(?,?), ref: 000A043A
RegCloseKey.ADVAPI32(00000000), ref: 000A0447

Memory Dump Source

Source File: 00000000.00000002.1643917647.0000000000021000.00000020.00000001.01000000.00000003.sdmp, Offset: 00020000, based on PE: true

Associated: 00000000.00000002.1643904003.0000000000020000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1643958107.00000000000AF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1643958107.00000000000D5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1643993044.00000000000DF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1644007204.00000000000E8000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_20000_Ship Docs_CI PL HBL COO_.jbxd

Similarity

API ID: Close$BuffCharConnectEnumOpenRegistryUpper_memmove
String ID:
API String ID: 3440857362-0
Opcode ID: 9e9a8bb8c4603800b6bc41f570be833bd19255022c245d50967fbb86cbe52a1a
Instruction ID: 49ce380e48ea8baca35eb581470fb3afda0ab06ac4519a13e85e448b1efeb684
Opcode Fuzzy Hash: 9e9a8bb8c4603800b6bc41f570be833bd19255022c245d50967fbb86cbe52a1a
Instruction Fuzzy Hash: 77513C71208205AFDB14EF94DC81EAEB7E8FF89304F04892DB59597292DB35E904CB52

Function 0008E7DC Relevance: 7.6, APIs: 5, Instructions: 135COMMON

Download Yara Rule

APIs

GetPrivateProfileSectionW.KERNEL32(00000003,?,00007FFF,?), ref: 0008E88A
GetPrivateProfileSectionW.KERNEL32(?,00000001,00000003,?), ref: 0008E8B3
WritePrivateProfileSectionW.KERNEL32(?,?,?), ref: 0008E8F2

Part of subcall function 00029997: __itow.LIBCMT ref: 000299C2
Part of subcall function 00029997: __swprintf.LIBCMT ref: 00029A0C

WritePrivateProfileStringW.KERNEL32(00000003,00000000,00000000,?), ref: 0008E917
WritePrivateProfileStringW.KERNEL32(00000000,00000000,00000000,?), ref: 0008E91F

Memory Dump Source

Source File: 00000000.00000002.1643917647.0000000000021000.00000020.00000001.01000000.00000003.sdmp, Offset: 00020000, based on PE: true

Associated: 00000000.00000002.1643904003.0000000000020000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1643958107.00000000000AF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1643958107.00000000000D5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1643993044.00000000000DF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1644007204.00000000000E8000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_20000_Ship Docs_CI PL HBL COO_.jbxd

Similarity

API ID: PrivateProfile$SectionWrite$String$__itow__swprintf
String ID:
API String ID: 1389676194-0
Opcode ID: 9f266ae033e001f871e9281ce32050ecc1ebf04a68417e94b01ce994a5708832
Instruction ID: 739762f3de85cd5586164a4fa28287697abc8bd9c68f45ae2ba49242995ea593
Opcode Fuzzy Hash: 9f266ae033e001f871e9281ce32050ecc1ebf04a68417e94b01ce994a5708832
Instruction Fuzzy Hash: 96512735A00215EFDB01EF64D981AAEBBF5FF09310F1480A9E849AB362CB71ED51CB51

Function 000AA2C5 Relevance: 7.6, APIs: 5, Instructions: 130COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1643917647.0000000000021000.00000020.00000001.01000000.00000003.sdmp, Offset: 00020000, based on PE: true

Associated: 00000000.00000002.1643904003.0000000000020000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1643958107.00000000000AF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1643958107.00000000000D5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1643993044.00000000000DF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1644007204.00000000000E8000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_20000_Ship Docs_CI PL HBL COO_.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4963f0aef947fba0e3770322552900ada7657e4cdfcde08d5993196c65193870
Instruction ID: d51ff90b9a52e260da9fb04d0402a15b60f69804b5b75ba464b16b8758f2d982
Opcode Fuzzy Hash: 4963f0aef947fba0e3770322552900ada7657e4cdfcde08d5993196c65193870
Instruction Fuzzy Hash: BA41F336E00204AFDB20DFA8DC48FB9BBE4EB0B350F140265F956A72E1D774AE41DA51

Function 00022344 Relevance: 7.6, APIs: 5, Instructions: 111keyboardCOMMON

Download Yara Rule

APIs

GetCursorPos.USER32(?), ref: 00022357
ScreenToClient.USER32(000E67B0,?), ref: 00022374
GetAsyncKeyState.USER32(00000001), ref: 00022399
GetAsyncKeyState.USER32(00000002), ref: 000223A7

Memory Dump Source

Source File: 00000000.00000002.1643917647.0000000000021000.00000020.00000001.01000000.00000003.sdmp, Offset: 00020000, based on PE: true

Associated: 00000000.00000002.1643904003.0000000000020000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1643958107.00000000000AF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1643958107.00000000000D5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1643993044.00000000000DF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1644007204.00000000000E8000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_20000_Ship Docs_CI PL HBL COO_.jbxd

Similarity

API ID: AsyncState$ClientCursorScreen
String ID:
API String ID: 4210589936-0
Opcode ID: 2ace49735ee07f7ce8264caba162acfec613d5a788755aae12703475962271b8
Instruction ID: e29d828808fa2c81b2597b972d5630713a2b4adf475ad10c72ebedc2d961f193
Opcode Fuzzy Hash: 2ace49735ee07f7ce8264caba162acfec613d5a788755aae12703475962271b8
Instruction Fuzzy Hash: 15418E31504229FFEF15DFA8D844EEEBBB4FB06324F20431AF82896290C7755A94DB91

Function 00076920 Relevance: 7.6, APIs: 5, Instructions: 97windowCOMMON

Download Yara Rule

APIs

PeekMessageW.USER32(?,00000000,00000000,00000000,00000001), ref: 0007695D
TranslateAcceleratorW.USER32(?,?,?), ref: 000769A9
TranslateMessage.USER32(?), ref: 000769D2
DispatchMessageW.USER32(?), ref: 000769DC
PeekMessageW.USER32(?,00000000,00000000,00000000,00000001), ref: 000769EB

Memory Dump Source

Source File: 00000000.00000002.1643917647.0000000000021000.00000020.00000001.01000000.00000003.sdmp, Offset: 00020000, based on PE: true

Associated: 00000000.00000002.1643904003.0000000000020000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1643958107.00000000000AF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1643958107.00000000000D5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1643993044.00000000000DF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1644007204.00000000000E8000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_20000_Ship Docs_CI PL HBL COO_.jbxd

Similarity

API ID: Message$PeekTranslate$AcceleratorDispatch
String ID:
API String ID: 2108273632-0
Opcode ID: acb38b740682823020174fbf0b69b36822ef593f167e191a724062a8dc741426
Instruction ID: 980fd346a4b71672b667a746191d65bb2031821906526073c087134a6d55b172
Opcode Fuzzy Hash: acb38b740682823020174fbf0b69b36822ef593f167e191a724062a8dc741426
Instruction Fuzzy Hash: 71310771D00A82AAEB60CF74EC84BF67BECAB12740F108169E12BD7061D73F9845DB54

Function 00078F01 Relevance: 7.6, APIs: 5, Instructions: 89sleepwindowCOMMON

Download Yara Rule

APIs

GetWindowRect.USER32(?,?), ref: 00078F12
PostMessageW.USER32(?,00000201,00000001), ref: 00078FBC
Sleep.KERNEL32(00000000,?,00000201,00000001,?,?,?), ref: 00078FC4
PostMessageW.USER32(?,00000202,00000000), ref: 00078FD2
Sleep.KERNEL32(00000000,?,00000202,00000000,?,?,00000201,00000001,?,?,?), ref: 00078FDA

Memory Dump Source

Source File: 00000000.00000002.1643917647.0000000000021000.00000020.00000001.01000000.00000003.sdmp, Offset: 00020000, based on PE: true

Associated: 00000000.00000002.1643904003.0000000000020000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1643958107.00000000000AF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1643958107.00000000000D5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1643993044.00000000000DF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1644007204.00000000000E8000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_20000_Ship Docs_CI PL HBL COO_.jbxd

Similarity

API ID: MessagePostSleep$RectWindow
String ID:
API String ID: 3382505437-0
Opcode ID: 18e6c597f77dd0417df08f1a4e28f0cba65b1f924ec6fa1a7d805f8d58199680
Instruction ID: 7576ea72f85ddb3483e22a584ea11b26085731f49591d8b95790ac38eee43161
Opcode Fuzzy Hash: 18e6c597f77dd0417df08f1a4e28f0cba65b1f924ec6fa1a7d805f8d58199680
Instruction Fuzzy Hash: 9631C071900219EFDB14CFA8D94CAAE7BB6FB05315F10C229F929E61D0C7B89914DB91

Function 0007B6AF Relevance: 7.6, APIs: 5, Instructions: 88windowCOMMON

Download Yara Rule

APIs

IsWindowVisible.USER32(?), ref: 0007B6C7
SendMessageW.USER32(?,0000000E,00000000,00000000), ref: 0007B6E4
SendMessageW.USER32(?,0000000D,00000001,00000000), ref: 0007B71C
CharUpperBuffW.USER32(00000000,00000000,?,?,?,?), ref: 0007B742
_wcsstr.LIBCMT ref: 0007B74C

Memory Dump Source

Source File: 00000000.00000002.1643917647.0000000000021000.00000020.00000001.01000000.00000003.sdmp, Offset: 00020000, based on PE: true

Associated: 00000000.00000002.1643904003.0000000000020000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1643958107.00000000000AF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1643958107.00000000000D5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1643993044.00000000000DF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1644007204.00000000000E8000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_20000_Ship Docs_CI PL HBL COO_.jbxd

Similarity

API ID: MessageSend$BuffCharUpperVisibleWindow_wcsstr
String ID:
API String ID: 3902887630-0
Opcode ID: 1d787610b2b250973ea5ad550c31f22a6f8615ade98a057801df1012e0dfb086
Instruction ID: 59caa297882abe85f37c8f95d52d407af8f22b026d75dad3352439ae48b5b723
Opcode Fuzzy Hash: 1d787610b2b250973ea5ad550c31f22a6f8615ade98a057801df1012e0dfb086
Instruction Fuzzy Hash: 95212971608644BBEB295B799C49F7B7BD8DF49760F008039FD09CA1A1EF69DC40D2A4

Function 000AB405 Relevance: 7.6, APIs: 5, Instructions: 85COMMON

Download Yara Rule

APIs

Part of subcall function 00022612: GetWindowLongW.USER32(?,000000EB), ref: 00022623

GetWindowLongW.USER32(?,000000F0), ref: 000AB44C
SetWindowLongW.USER32(00000000,000000F0,00000001), ref: 000AB471
SetWindowLongW.USER32(00000000,000000EC,000000FF), ref: 000AB489
GetSystemMetrics.USER32(00000004), ref: 000AB4B2
SetWindowPos.USER32(00000000,00000000,00000000,00000000,00000000,00000000,00000047,?,?,?,?,?,?,?,00091184,00000000), ref: 000AB4D0

Memory Dump Source

Source File: 00000000.00000002.1643917647.0000000000021000.00000020.00000001.01000000.00000003.sdmp, Offset: 00020000, based on PE: true

Associated: 00000000.00000002.1643904003.0000000000020000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1643958107.00000000000AF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1643958107.00000000000D5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1643993044.00000000000DF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1644007204.00000000000E8000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_20000_Ship Docs_CI PL HBL COO_.jbxd

Similarity

API ID: Window$Long$MetricsSystem
String ID:
API String ID: 2294984445-0
Opcode ID: 89fdfb635f1492d6d311202331fd8e6c62f85cad34ae889843fcde853645c264
Instruction ID: 90653bc41d12d9f0bd8ed95870fec14eee4e859ed723b7328dfb4128f1d905f6
Opcode Fuzzy Hash: 89fdfb635f1492d6d311202331fd8e6c62f85cad34ae889843fcde853645c264
Instruction Fuzzy Hash: C4219131910666AFDB609FB8DC44A6A3BA4FB0B720F104738F926D61E3E7359811DB80

Function 000797E9 Relevance: 7.6, APIs: 5, Instructions: 84windowCOMMON

Download Yara Rule

APIs

SendMessageW.USER32(?,00001004,00000000,00000000), ref: 00079802

Part of subcall function 00027D2C: _memmove.LIBCMT ref: 00027D66

SendMessageW.USER32(?,0000102C,00000000,00000002), ref: 00079834
__itow.LIBCMT ref: 0007984C
SendMessageW.USER32(?,0000102C,00000000,00000002), ref: 00079874
__itow.LIBCMT ref: 00079885

Memory Dump Source

Source File: 00000000.00000002.1643917647.0000000000021000.00000020.00000001.01000000.00000003.sdmp, Offset: 00020000, based on PE: true

Associated: 00000000.00000002.1643904003.0000000000020000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1643958107.00000000000AF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1643958107.00000000000D5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1643993044.00000000000DF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1644007204.00000000000E8000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_20000_Ship Docs_CI PL HBL COO_.jbxd

Similarity

API ID: MessageSend$__itow$_memmove
String ID:
API String ID: 2983881199-0
Opcode ID: 7c6d58eb909036b0964ed71c15c6f5db17cd62f55e3a201f6631815329f97580
Instruction ID: fb2c078d1e551836f7cc7b54a7c8747a7353093a9f9bad263c3b6938393da72a
Opcode Fuzzy Hash: 7c6d58eb909036b0964ed71c15c6f5db17cd62f55e3a201f6631815329f97580
Instruction Fuzzy Hash: 1621DD71F00204ABDB509BA59C86EEE7BB8DF4A710F088035FD08DB252DA748D4187D6

Function 000212F3 Relevance: 7.6, APIs: 5, Instructions: 67COMMON

Download Yara Rule

APIs

ExtCreatePen.GDI32(?,?,00000000,00000000,00000000,?,00000000), ref: 0002134D
SelectObject.GDI32(?,00000000), ref: 0002135C
BeginPath.GDI32(?), ref: 00021373
SelectObject.GDI32(?,00000000), ref: 0002139C

Memory Dump Source

Source File: 00000000.00000002.1643917647.0000000000021000.00000020.00000001.01000000.00000003.sdmp, Offset: 00020000, based on PE: true

Associated: 00000000.00000002.1643904003.0000000000020000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1643958107.00000000000AF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1643958107.00000000000D5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1643993044.00000000000DF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1644007204.00000000000E8000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_20000_Ship Docs_CI PL HBL COO_.jbxd

Similarity

API ID: ObjectSelect$BeginCreatePath
String ID:
API String ID: 3225163088-0
Opcode ID: e7c21a781256ddedfb2ecdfd3db0d1f38c8fbf3b23f94a836f9a4eab422e7081
Instruction ID: 86950969cd3c85710b176460f3c68b685a8672e5c8bfad1cb0f632af093084ad
Opcode Fuzzy Hash: e7c21a781256ddedfb2ecdfd3db0d1f38c8fbf3b23f94a836f9a4eab422e7081
Instruction Fuzzy Hash: 44219070800254EFEB10CF65FD447AD3BF9FB20761F244326F814AA1A0DB7A9995CB90

Function 0007C161 Relevance: 7.6, APIs: 5, Instructions: 61COMMON

Download Yara Rule

APIs

_memcmp.LIBCMT ref: 0007C176
_memcmp.LIBCMT ref: 0007C194
_memcmp.LIBCMT ref: 0007C1A7
_memcmp.LIBCMT ref: 0007C1BF
_memcmp.LIBCMT ref: 0007C1D7

Memory Dump Source

Source File: 00000000.00000002.1643917647.0000000000021000.00000020.00000001.01000000.00000003.sdmp, Offset: 00020000, based on PE: true

Associated: 00000000.00000002.1643904003.0000000000020000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1643958107.00000000000AF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1643958107.00000000000D5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1643993044.00000000000DF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1644007204.00000000000E8000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_20000_Ship Docs_CI PL HBL COO_.jbxd

Similarity

API ID: _memcmp
String ID:
API String ID: 2931989736-0
Opcode ID: 2537a51f0519c95dce7d0f5922555dc38ff8961113a17c40069b9dd64a1bc6fb
Instruction ID: 60fd725bc7765af87c3118a96fb9dacd713df91821e4b342abbe72f52934bbfc
Opcode Fuzzy Hash: 2537a51f0519c95dce7d0f5922555dc38ff8961113a17c40069b9dd64a1bc6fb
Instruction Fuzzy Hash: D801B5B1A041057BF214A6209C42FEF77DC9B223A4F848139FE089A283FB54DE1182E8

Function 00084D35 Relevance: 7.6, APIs: 5, Instructions: 56synchronizationthreadwindowCOMMON

Download Yara Rule

APIs

GetCurrentThreadId.KERNEL32 ref: 00084D5C
__beginthreadex.LIBCMT ref: 00084D7A
MessageBoxW.USER32(?,?,?,?), ref: 00084D8F
WaitForSingleObject.KERNEL32(00000000,000000FF,?,?,?,?), ref: 00084DA5
CloseHandle.KERNEL32(00000000,?,?,?,?), ref: 00084DAC

Memory Dump Source

Source File: 00000000.00000002.1643917647.0000000000021000.00000020.00000001.01000000.00000003.sdmp, Offset: 00020000, based on PE: true

Associated: 00000000.00000002.1643904003.0000000000020000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1643958107.00000000000AF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1643958107.00000000000D5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1643993044.00000000000DF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1644007204.00000000000E8000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_20000_Ship Docs_CI PL HBL COO_.jbxd

Similarity

API ID: CloseCurrentHandleMessageObjectSingleThreadWait__beginthreadex
String ID:
API String ID: 3824534824-0
Opcode ID: 368f673e11c59c7291352131181afec6243c2af40a195eb5d544d133cc6afd5a
Instruction ID: e3e734e7edf3d9d6d9f0a7fd126852f322a67bcddb437d0d1dd98e578b9e1569
Opcode Fuzzy Hash: 368f673e11c59c7291352131181afec6243c2af40a195eb5d544d133cc6afd5a
Instruction Fuzzy Hash: 6C1148B2904645BBDB009BA8AC44AEA7FACFB45320F144369FA54D7350D6798D0087A0

Function 0007874A Relevance: 7.5, APIs: 5, Instructions: 49memoryCOMMON

Download Yara Rule

APIs

GetUserObjectSecurity.USER32(?,00000004,?,00000000,?), ref: 00078766
GetLastError.KERNEL32(?,0007822A,?,?,?), ref: 00078770
GetProcessHeap.KERNEL32(00000008,?,?,0007822A,?,?,?), ref: 0007877F
HeapAlloc.KERNEL32(00000000,?,0007822A,?,?,?), ref: 00078786
GetUserObjectSecurity.USER32(?,00000004,00000000,?,?), ref: 0007879D

Memory Dump Source

Source File: 00000000.00000002.1643917647.0000000000021000.00000020.00000001.01000000.00000003.sdmp, Offset: 00020000, based on PE: true

Associated: 00000000.00000002.1643904003.0000000000020000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1643958107.00000000000AF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1643958107.00000000000D5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1643993044.00000000000DF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1644007204.00000000000E8000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_20000_Ship Docs_CI PL HBL COO_.jbxd

Similarity

API ID: HeapObjectSecurityUser$AllocErrorLastProcess
String ID:
API String ID: 842720411-0
Opcode ID: 54ba310b12ee571cf47bee2223fca75ff80c382a363b480abe1f4a301b085582
Instruction ID: 3f22a5862c8ebacc0ede8b5f694dbf699a36f69ae3054db3251546d6f0fa8d99
Opcode Fuzzy Hash: 54ba310b12ee571cf47bee2223fca75ff80c382a363b480abe1f4a301b085582
Instruction Fuzzy Hash: 30014F71644605EFEB245FAADC4CD6B7BACEF863557208429F84AC2160DA35CD00CB60

Function 000854E6 Relevance: 7.5, APIs: 5, Instructions: 48sleepCOMMON

Download Yara Rule

APIs

QueryPerformanceCounter.KERNEL32(?,00000000,?,?,?,?,?,?,?,?,?,?), ref: 00085502
QueryPerformanceFrequency.KERNEL32(?,?,?,?,?,?,?,?,?,?,?), ref: 00085510
Sleep.KERNEL32(00000000,?,?,?,?,?,?,?,?,?,?), ref: 00085518
QueryPerformanceCounter.KERNEL32(?,?,?,?,?,?,?,?,?,?,?), ref: 00085522
Sleep.KERNEL32(?,00000000,?,?,?,?,?,?,?,?,?,?), ref: 0008555E

Memory Dump Source

Source File: 00000000.00000002.1643917647.0000000000021000.00000020.00000001.01000000.00000003.sdmp, Offset: 00020000, based on PE: true

Associated: 00000000.00000002.1643904003.0000000000020000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1643958107.00000000000AF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1643958107.00000000000D5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1643993044.00000000000DF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1644007204.00000000000E8000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_20000_Ship Docs_CI PL HBL COO_.jbxd

Similarity

API ID: PerformanceQuery$CounterSleep$Frequency
String ID:
API String ID: 2833360925-0
Opcode ID: d130076655b1592dbcf1e57cf9ed57a18c72479ead31d468e7b21c1b5df5a857
Instruction ID: 731e223a2a44653c0faeef30d0cc4f126b139027a8bc61b876f553ccc6f2c247
Opcode Fuzzy Hash: d130076655b1592dbcf1e57cf9ed57a18c72479ead31d468e7b21c1b5df5a857
Instruction Fuzzy Hash: C2011B35D00E1ADBDF10EFE9EC59AEDBBB9BB09712F400156E981B2140DB345654CBA1

Function 00077652 Relevance: 7.5, APIs: 5, Instructions: 48stringCOMMON

Download Yara Rule

APIs

CLSIDFromProgID.OLE32(?,?,00000000,?,00000000,?,?,-C0000018,00000001,?,0007758C,80070057,?,?,?,0007799D), ref: 0007766F
ProgIDFromCLSID.OLE32(?,00000000,?,?,00000000,?,00000000,?,?,-C0000018,00000001,?,0007758C,80070057,?,?), ref: 0007768A
lstrcmpiW.KERNEL32(?,00000000,?,?,00000000,?,00000000,?,?,-C0000018,00000001,?,0007758C,80070057,?,?), ref: 00077698
CoTaskMemFree.OLE32(00000000,?,00000000,?,?,00000000,?,00000000,?,?,-C0000018,00000001,?,0007758C,80070057,?), ref: 000776A8
CLSIDFromString.OLE32(?,?,?,?,00000000,?,00000000,?,?,-C0000018,00000001,?,0007758C,80070057,?,?), ref: 000776B4

Memory Dump Source

Source File: 00000000.00000002.1643917647.0000000000021000.00000020.00000001.01000000.00000003.sdmp, Offset: 00020000, based on PE: true

Associated: 00000000.00000002.1643904003.0000000000020000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1643958107.00000000000AF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1643958107.00000000000D5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1643993044.00000000000DF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1644007204.00000000000E8000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_20000_Ship Docs_CI PL HBL COO_.jbxd

Similarity

API ID: From$Prog$FreeStringTasklstrcmpi
String ID:
API String ID: 3897988419-0
Opcode ID: 65a774c2f5b73d748ded9521af6d6667e887a544c75149d1aff98699f92ad665
Instruction ID: 49f15a5ceb02fc429cb61d60df9eb9aaec0e7004037f328948ec74d33e842fae
Opcode Fuzzy Hash: 65a774c2f5b73d748ded9521af6d6667e887a544c75149d1aff98699f92ad665
Instruction Fuzzy Hash: 4001D8B6A00605BBEB105F58DC04BAA7BECEB45791F104124FD0CD6225EB39DD0087A0

Function 000785F1 Relevance: 7.5, APIs: 5, Instructions: 45memoryCOMMON

Download Yara Rule

APIs

GetTokenInformation.ADVAPI32(?,00000002,?,00000000,?), ref: 00078608
GetLastError.KERNEL32(?,00000002,?,00000000,?), ref: 00078612
GetProcessHeap.KERNEL32(00000008,?,?,00000002,?,00000000,?), ref: 00078621
HeapAlloc.KERNEL32(00000000,?,00000002,?,00000000,?), ref: 00078628
GetTokenInformation.ADVAPI32(?,00000002,00000000,?,?,?,00000002,?,00000000,?), ref: 0007863E

Memory Dump Source

Source File: 00000000.00000002.1643917647.0000000000021000.00000020.00000001.01000000.00000003.sdmp, Offset: 00020000, based on PE: true

Associated: 00000000.00000002.1643904003.0000000000020000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1643958107.00000000000AF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1643958107.00000000000D5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1643993044.00000000000DF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1644007204.00000000000E8000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_20000_Ship Docs_CI PL HBL COO_.jbxd

Similarity

API ID: HeapInformationToken$AllocErrorLastProcess
String ID:
API String ID: 44706859-0
Opcode ID: ebbf5fa743ef212972cde5b95ecd14def45c38778a82ea125df61f5134e344e5
Instruction ID: 568c6d3543369c5ea4093f42ecba6415cfd3f1a0f208b34cec1b4508f6411b60
Opcode Fuzzy Hash: ebbf5fa743ef212972cde5b95ecd14def45c38778a82ea125df61f5134e344e5
Instruction Fuzzy Hash: 68F04931241605BFEB601FE5DC8DE7B3BACEF8A755B008429F94DC6150CBA99D41DB60

Function 00078652 Relevance: 7.5, APIs: 5, Instructions: 45memoryCOMMON

Download Yara Rule

APIs

GetTokenInformation.ADVAPI32(?,00000003(TokenIntegrityLevel),?,00000000,?), ref: 00078669
GetLastError.KERNEL32(?,TokenIntegrityLevel,?,00000000,?), ref: 00078673
GetProcessHeap.KERNEL32(00000008,?,?,TokenIntegrityLevel,?,00000000,?), ref: 00078682
HeapAlloc.KERNEL32(00000000,?,TokenIntegrityLevel,?,00000000,?), ref: 00078689
GetTokenInformation.ADVAPI32(?,00000003(TokenIntegrityLevel),00000000,?,?,?,TokenIntegrityLevel,?,00000000,?), ref: 0007869F

Memory Dump Source

Source File: 00000000.00000002.1643917647.0000000000021000.00000020.00000001.01000000.00000003.sdmp, Offset: 00020000, based on PE: true

Associated: 00000000.00000002.1643904003.0000000000020000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1643958107.00000000000AF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1643958107.00000000000D5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1643993044.00000000000DF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1644007204.00000000000E8000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_20000_Ship Docs_CI PL HBL COO_.jbxd

Similarity

API ID: HeapInformationToken$AllocErrorLastProcess
String ID:
API String ID: 44706859-0
Opcode ID: b37aa4adab19be80352b7f9ac069a5bea023869370b5ae33772d04fb05ccdd35
Instruction ID: 4db6166fe44539d6812af597ee17feec5f873bb33b590804429cd507436763fd
Opcode Fuzzy Hash: b37aa4adab19be80352b7f9ac069a5bea023869370b5ae33772d04fb05ccdd35
Instruction Fuzzy Hash: 0BF0AF71240205BFEB211FA4EC8CE773BACEF8A765B108025F909D2250CBA89900DB61

Function 0007C6A6 Relevance: 7.5, APIs: 5, Instructions: 41windowtimeCOMMON

Download Yara Rule

APIs

GetDlgItem.USER32(?,000003E9), ref: 0007C6BA
GetWindowTextW.USER32(00000000,?,00000100), ref: 0007C6D1
MessageBeep.USER32(00000000), ref: 0007C6E9
KillTimer.USER32(?,0000040A), ref: 0007C705
EndDialog.USER32(?,00000001), ref: 0007C71F

Memory Dump Source

Source File: 00000000.00000002.1643917647.0000000000021000.00000020.00000001.01000000.00000003.sdmp, Offset: 00020000, based on PE: true

Associated: 00000000.00000002.1643904003.0000000000020000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1643958107.00000000000AF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1643958107.00000000000D5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1643993044.00000000000DF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1644007204.00000000000E8000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_20000_Ship Docs_CI PL HBL COO_.jbxd

Similarity

API ID: BeepDialogItemKillMessageTextTimerWindow
String ID:
API String ID: 3741023627-0
Opcode ID: 855d535ad655c030a048ac59d5ac79dd65841eb06064dfd7d48528dca74bc82a
Instruction ID: 2bc18ed24cc7cc0df609a1fc85a78dfe768609ef70e36547d143a17780b83032
Opcode Fuzzy Hash: 855d535ad655c030a048ac59d5ac79dd65841eb06064dfd7d48528dca74bc82a
Instruction Fuzzy Hash: 82018F30804B05ABFB245B60EC8EFA677B8BB01701F00466DB586A10E1DBE8A9548A84

Function 000213B0 Relevance: 7.5, APIs: 5, Instructions: 29COMMON

Download Yara Rule

APIs

EndPath.GDI32(?), ref: 000213BF
StrokeAndFillPath.GDI32(?,?,0005BAD8,00000000,?), ref: 000213DB
SelectObject.GDI32(?,00000000), ref: 000213EE
DeleteObject.GDI32 ref: 00021401
StrokePath.GDI32(?), ref: 0002141C

Memory Dump Source

Source File: 00000000.00000002.1643917647.0000000000021000.00000020.00000001.01000000.00000003.sdmp, Offset: 00020000, based on PE: true

Associated: 00000000.00000002.1643904003.0000000000020000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1643958107.00000000000AF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1643958107.00000000000D5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1643993044.00000000000DF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1644007204.00000000000E8000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_20000_Ship Docs_CI PL HBL COO_.jbxd

Similarity

API ID: Path$ObjectStroke$DeleteFillSelect
String ID:
API String ID: 2625713937-0
Opcode ID: 942d2b898d3820970654787479e898858d18a360429fa3e8ce951bba302723a9
Instruction ID: 6955c2f6876860e2ae2fd2e3d1c2e96e5dc9cd124c94f8cc3322f224ac7b4761
Opcode Fuzzy Hash: 942d2b898d3820970654787479e898858d18a360429fa3e8ce951bba302723a9
Instruction Fuzzy Hash: FBF03C30000749EBEB255F66FE8CBA83FE5AB21766F04C324E469980F1CB3A4995DF10

Function 00032E5B Relevance: 7.3, APIs: 3, Strings: 1, Instructions: 265COMMON

Download Yara Rule

APIs

Part of subcall function 00040FF6: std::exception::exception.LIBCMT ref: 0004102C
Part of subcall function 00040FF6: __CxxThrowException@8.LIBCMT ref: 00041041

Part of subcall function 00027F41: _memmove.LIBCMT ref: 00027F82

Part of subcall function 00027BB1: _memmove.LIBCMT ref: 00027C0B

__swprintf.LIBCMT ref: 0003302D

Strings

\\[\\nrt]|%%|%[-+ 0#]?([0-9]*|\*)?(\.[0-9]*|\.\*)?[hlL]?[diouxXeEfgGs], xrefs: 00032EC6

Memory Dump Source

Source File: 00000000.00000002.1643917647.0000000000021000.00000020.00000001.01000000.00000003.sdmp, Offset: 00020000, based on PE: true

Associated: 00000000.00000002.1643904003.0000000000020000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1643958107.00000000000AF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1643958107.00000000000D5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1643993044.00000000000DF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1644007204.00000000000E8000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_20000_Ship Docs_CI PL HBL COO_.jbxd

Similarity

API ID: _memmove$Exception@8Throw__swprintfstd::exception::exception
String ID: \\[\\nrt]|%%|%[-+ 0#]?([0-9]*|\*)?(\.[0-9]*|\.\*)?[hlL]?[diouxXeEfgGs]
API String ID: 1943609520-557222456
Opcode ID: 1b1f815197da2ab67325134dc639a527ffc5f29b948055ecceaf7d36b28bcae2
Instruction ID: cc8c3ca29a110c0efea0298a219b8f5f60925881eebcdd4bb47052b38b26ac0f
Opcode Fuzzy Hash: 1b1f815197da2ab67325134dc639a527ffc5f29b948055ecceaf7d36b28bcae2
Instruction Fuzzy Hash: AF917C711083119FC729EF24D895DAEB7E8EF85750F00492DF4469B2A2DB71EE44CB52

Function 0008BBA6 Relevance: 7.3, APIs: 3, Strings: 1, Instructions: 261comCOMMON

Download Yara Rule

APIs

Part of subcall function 000248AE: GetFullPathNameW.KERNEL32(?,00007FFF,?,00000000,?,?,000248A1,?,?,000237C0,?), ref: 000248CE

CoInitialize.OLE32(00000000), ref: 0008BC26
CoCreateInstance.OLE32(000B2D6C,00000000,00000001,000B2BDC,?), ref: 0008BC3F
CoUninitialize.OLE32 ref: 0008BC5C

Part of subcall function 00029997: __itow.LIBCMT ref: 000299C2
Part of subcall function 00029997: __swprintf.LIBCMT ref: 00029A0C

Strings

.lnk, xrefs: 0008BC08, 0008BC16

Memory Dump Source

Source File: 00000000.00000002.1643917647.0000000000021000.00000020.00000001.01000000.00000003.sdmp, Offset: 00020000, based on PE: true

Associated: 00000000.00000002.1643904003.0000000000020000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1643958107.00000000000AF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1643958107.00000000000D5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1643993044.00000000000DF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1644007204.00000000000E8000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_20000_Ship Docs_CI PL HBL COO_.jbxd

Similarity

API ID: CreateFullInitializeInstanceNamePathUninitialize__itow__swprintf
String ID: .lnk
API String ID: 2126378814-24824748
Opcode ID: 64a7c5efc554f05ffb3804184a89670cfc49587b194d59b1bd0997377c2ed5e9
Instruction ID: 38d1891234f96800710cdd69f20ab496764d75da4a2447c6cc05e2725fa9db74
Opcode Fuzzy Hash: 64a7c5efc554f05ffb3804184a89670cfc49587b194d59b1bd0997377c2ed5e9
Instruction Fuzzy Hash: 92A136756043119FCB10EF14C484DAABBE5FF89314F148998F8999B3A2CB31ED45CB91

Function 0004524D Relevance: 7.2, APIs: 3, Strings: 1, Instructions: 180COMMON

Download Yara Rule

APIs

__startOneArgErrorHandling.LIBCMT ref: 000452DD

Part of subcall function 00050340: __87except.LIBCMT ref: 0005037B

Strings

pow, xrefs: 000452B5, 000452D2

Memory Dump Source

Source File: 00000000.00000002.1643917647.0000000000021000.00000020.00000001.01000000.00000003.sdmp, Offset: 00020000, based on PE: true

Associated: 00000000.00000002.1643904003.0000000000020000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1643958107.00000000000AF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1643958107.00000000000D5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1643993044.00000000000DF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1644007204.00000000000E8000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_20000_Ship Docs_CI PL HBL COO_.jbxd

Similarity

API ID: ErrorHandling__87except__start
String ID: pow
API String ID: 2905807303-2276729525
Opcode ID: 049a577aaec52557adb6dba17ced118c83d673d3abc13f581a5323b8b6b5c8c8
Instruction ID: a71538c3931fbc2e70e60beb7fc522918f6cd0ccb739cfb1b8f0cdd2334e50c2
Opcode Fuzzy Hash: 049a577aaec52557adb6dba17ced118c83d673d3abc13f581a5323b8b6b5c8c8
Instruction Fuzzy Hash: 21515BE1A09A0187DB617B14CE413BF2BD49B40753F208D79E895861E7EE788DC89E4A

Function 0004023B Relevance: 7.2, APIs: 2, Strings: 2, Instructions: 163COMMON

Download Yara Rule

Strings

+, xrefs: 00040277
#, xrefs: 00040280

Memory Dump Source

Source File: 00000000.00000002.1643917647.0000000000021000.00000020.00000001.01000000.00000003.sdmp, Offset: 00020000, based on PE: true

Associated: 00000000.00000002.1643904003.0000000000020000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1643958107.00000000000AF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1643958107.00000000000D5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1643993044.00000000000DF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1644007204.00000000000E8000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_20000_Ship Docs_CI PL HBL COO_.jbxd

Similarity

API ID:
String ID: #$+
API String ID: 0-2552117581
Opcode ID: 246563f00f42ddce8b97baf1e99905b08c69ac1da4eb5ebca020419c14bcd766
Instruction ID: 19d8b43a7d4788c2359be24804e072102c48519960e58de46fe50fa42d9082e3
Opcode Fuzzy Hash: 246563f00f42ddce8b97baf1e99905b08c69ac1da4eb5ebca020419c14bcd766
Instruction Fuzzy Hash: CB5155758042468FDF75DF28C888AFD7BE4EF1A311F188065EC95AB2A1D7789D42C724

Function 000362F2 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 143COMMON

Download Yara Rule

APIs

_memset.LIBCMT ref: 000363A8
_memmove.LIBCMT ref: 00036446
_memset.LIBCMT ref: 0003646A

Strings

ERCP, xrefs: 00036313

Memory Dump Source

Source File: 00000000.00000002.1643917647.0000000000021000.00000020.00000001.01000000.00000003.sdmp, Offset: 00020000, based on PE: true

Associated: 00000000.00000002.1643904003.0000000000020000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1643958107.00000000000AF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1643958107.00000000000D5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1643993044.00000000000DF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1644007204.00000000000E8000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_20000_Ship Docs_CI PL HBL COO_.jbxd

Similarity

API ID: _memset$_memmove
String ID: ERCP
API String ID: 2532777613-1384759551
Opcode ID: 27c940ca2af05b9ed1701bb1bf289fc45c6c9378f92358f112596485cb50858e
Instruction ID: 960d9d5c7b3b30c455340715e011d887a6b0ba9c067d2ce6407e5bc05f32761d
Opcode Fuzzy Hash: 27c940ca2af05b9ed1701bb1bf289fc45c6c9378f92358f112596485cb50858e
Instruction Fuzzy Hash: 8B51A171D00309EBDB25CF65C8817EABBF8EF04714F20856EE64ACB281E7759684CB54

Function 000A7648 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 90windowCOMMON

Download Yara Rule

APIs

SendMessageW.USER32(00000000,00001009,00000000,?), ref: 000A76D0
SetWindowPos.USER32(?,00000000,?,?,?,?,00000004), ref: 000A76E4
SendMessageW.USER32(?,00001002,00000000,?), ref: 000A7708

Strings

SysMonthCal32, xrefs: 000A769B

Memory Dump Source

Source File: 00000000.00000002.1643917647.0000000000021000.00000020.00000001.01000000.00000003.sdmp, Offset: 00020000, based on PE: true

Associated: 00000000.00000002.1643904003.0000000000020000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1643958107.00000000000AF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1643958107.00000000000D5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1643993044.00000000000DF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1644007204.00000000000E8000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_20000_Ship Docs_CI PL HBL COO_.jbxd

Similarity

API ID: MessageSend$Window
String ID: SysMonthCal32
API String ID: 2326795674-1439706946
Opcode ID: 5409106068a1bf6abfa0756479bd565c300019b6ef0774138e0817c3662be7b3
Instruction ID: 2065cd0dd2c0be0323e60903721fcbed3523dd9b567508ff98a1ac523148d479
Opcode Fuzzy Hash: 5409106068a1bf6abfa0756479bd565c300019b6ef0774138e0817c3662be7b3
Instruction Fuzzy Hash: F721D332504219BBDF11CF94CC46FEA3BA9EF49754F110214FE196B1D1DAB5A8508BA0

Function 000A6F1F Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 84windowCOMMON

Download Yara Rule

APIs

SendMessageW.USER32(00000000,00000180,00000000,?), ref: 000A6FAA
SendMessageW.USER32(?,00000186,00000000,00000000), ref: 000A6FBA
MoveWindow.USER32(?,?,?,?,?,00000000,?,?,Listbox,00000000,00000000,?,?,?,?,?), ref: 000A6FDF

Strings

Listbox, xrefs: 000A6F77

Memory Dump Source

Source File: 00000000.00000002.1643917647.0000000000021000.00000020.00000001.01000000.00000003.sdmp, Offset: 00020000, based on PE: true

Associated: 00000000.00000002.1643904003.0000000000020000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1643958107.00000000000AF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1643958107.00000000000D5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1643993044.00000000000DF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1644007204.00000000000E8000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_20000_Ship Docs_CI PL HBL COO_.jbxd

Similarity

API ID: MessageSend$MoveWindow
String ID: Listbox
API String ID: 3315199576-2633736733
Opcode ID: b6c3e590d075b8a4b20a4c25663403d3ae855fe7ba449c1a01471ebba2aa6449
Instruction ID: dc315d305d1e85e8359c50b794b58fd65f52606d36031915a7870f8a4edbd532
Opcode Fuzzy Hash: b6c3e590d075b8a4b20a4c25663403d3ae855fe7ba449c1a01471ebba2aa6449
Instruction Fuzzy Hash: 08218332614118BFEF118F94DC85EBB37BAEF8A754F058124F9159B190CA769C518BA0

Function 000A797D Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 66windowCOMMON

Download Yara Rule

APIs

SendMessageW.USER32(00000000,00000405,00000000,00000000), ref: 000A79E1
SendMessageW.USER32(?,00000406,00000000,00640000), ref: 000A79F6
SendMessageW.USER32(?,00000414,0000000A,00000000), ref: 000A7A03

Strings

msctls_trackbar32, xrefs: 000A79B8

Memory Dump Source

Source File: 00000000.00000002.1643917647.0000000000021000.00000020.00000001.01000000.00000003.sdmp, Offset: 00020000, based on PE: true

Associated: 00000000.00000002.1643904003.0000000000020000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1643958107.00000000000AF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1643958107.00000000000D5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1643993044.00000000000DF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1644007204.00000000000E8000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_20000_Ship Docs_CI PL HBL COO_.jbxd

Similarity

API ID: MessageSend
String ID: msctls_trackbar32
API String ID: 3850602802-1010561917
Opcode ID: 6524ac197865721c8140af39bd9978a4254299b83ea6691ea989a6e96d8d2da5
Instruction ID: d955c6bbf81e88fb7ee3aea8237e32ee5b57554486d9e1eadfe64241012008df
Opcode Fuzzy Hash: 6524ac197865721c8140af39bd9978a4254299b83ea6691ea989a6e96d8d2da5
Instruction Fuzzy Hash: B6110A32244208BBEF209FB4CC05FEB77ADEFDA764F024519F655A6091D671D811CB60

Function 00024C95 Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 18libraryloaderCOMMON

Download Yara Rule

APIs

LoadLibraryA.KERNEL32(kernel32.dll,?,00024C2E), ref: 00024CA3
GetProcAddress.KERNEL32(00000000,GetNativeSystemInfo), ref: 00024CB5

Strings

kernel32.dll, xrefs: 00024C9E
GetNativeSystemInfo, xrefs: 00024CAF

Memory Dump Source

Source File: 00000000.00000002.1643917647.0000000000021000.00000020.00000001.01000000.00000003.sdmp, Offset: 00020000, based on PE: true

Associated: 00000000.00000002.1643904003.0000000000020000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1643958107.00000000000AF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1643958107.00000000000D5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1643993044.00000000000DF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1644007204.00000000000E8000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_20000_Ship Docs_CI PL HBL COO_.jbxd

Similarity

API ID: AddressLibraryLoadProc
String ID: GetNativeSystemInfo$kernel32.dll
API String ID: 2574300362-192647395
Opcode ID: 2d25f4033b67f2bf4f6a7e3d7151395e1260d083ec9849dfd4be177f45935d7e
Instruction ID: de0b2746dd91f2c1f89b75f289b40e45a21947feb7828af37417fc6a5aa91104
Opcode Fuzzy Hash: 2d25f4033b67f2bf4f6a7e3d7151395e1260d083ec9849dfd4be177f45935d7e
Instruction Fuzzy Hash: D1D0C270510723CFD7205FB4D919612B2E4AF02780B208839D882C6150D774C480C620

Function 00024D61 Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 18libraryloaderCOMMON

Download Yara Rule

APIs

LoadLibraryA.KERNEL32(kernel32.dll,?,00024D2E,?,00024F4F,?,000E62F8,00000001,>>>AUTOIT NO CMDEXECUTE<<<,?), ref: 00024D6F
GetProcAddress.KERNEL32(00000000,Wow64DisableWow64FsRedirection), ref: 00024D81

Strings

kernel32.dll, xrefs: 00024D6A
Wow64DisableWow64FsRedirection, xrefs: 00024D7B

Memory Dump Source

Source File: 00000000.00000002.1643917647.0000000000021000.00000020.00000001.01000000.00000003.sdmp, Offset: 00020000, based on PE: true

Associated: 00000000.00000002.1643904003.0000000000020000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1643958107.00000000000AF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1643958107.00000000000D5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1643993044.00000000000DF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1644007204.00000000000E8000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_20000_Ship Docs_CI PL HBL COO_.jbxd

Similarity

API ID: AddressLibraryLoadProc
String ID: Wow64DisableWow64FsRedirection$kernel32.dll
API String ID: 2574300362-3689287502
Opcode ID: 922e4130de07f1a744f2cb1aa0f90762871dd30866b424eec38c0fabcbfcab24
Instruction ID: 9f7a6be5837c82ef80dcbe4f513cebb663b625de5f28dec7faf9866ab3cc5750
Opcode Fuzzy Hash: 922e4130de07f1a744f2cb1aa0f90762871dd30866b424eec38c0fabcbfcab24
Instruction Fuzzy Hash: B8D01730510B23CFE7209FB1E85866676E8AF16392B11C93AD486DA290E7B4D880CA60

Function 00024D94 Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 18libraryloaderCOMMON

Download Yara Rule

APIs

LoadLibraryA.KERNEL32(kernel32.dll,?,00024CE1,?), ref: 00024DA2
GetProcAddress.KERNEL32(00000000,Wow64RevertWow64FsRedirection), ref: 00024DB4

Strings

kernel32.dll, xrefs: 00024D9D
Wow64RevertWow64FsRedirection, xrefs: 00024DAE

Memory Dump Source

Source File: 00000000.00000002.1643917647.0000000000021000.00000020.00000001.01000000.00000003.sdmp, Offset: 00020000, based on PE: true

Associated: 00000000.00000002.1643904003.0000000000020000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1643958107.00000000000AF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1643958107.00000000000D5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1643993044.00000000000DF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1644007204.00000000000E8000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_20000_Ship Docs_CI PL HBL COO_.jbxd

Similarity

API ID: AddressLibraryLoadProc
String ID: Wow64RevertWow64FsRedirection$kernel32.dll
API String ID: 2574300362-1355242751
Opcode ID: 8e21e1868e4795e0b8a454ab4efada68c8b9077a665f4e1d27c60bd202dae27c
Instruction ID: 51597ae060931abc537a37181ec9b5e60246a4184714cd652c23bbf527f88da9
Opcode Fuzzy Hash: 8e21e1868e4795e0b8a454ab4efada68c8b9077a665f4e1d27c60bd202dae27c
Instruction Fuzzy Hash: C8D05B31550723CFD7305FB1D85875676E4EF06355B11C83ED8C5D6150E774D480C660

Function 000A1072 Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 18libraryloaderCOMMON

Download Yara Rule

APIs

LoadLibraryA.KERNEL32(advapi32.dll,?,000A12C1), ref: 000A1080
GetProcAddress.KERNEL32(00000000,RegDeleteKeyExW), ref: 000A1092

Strings

advapi32.dll, xrefs: 000A107B
RegDeleteKeyExW, xrefs: 000A108C

Memory Dump Source

Source File: 00000000.00000002.1643917647.0000000000021000.00000020.00000001.01000000.00000003.sdmp, Offset: 00020000, based on PE: true

Associated: 00000000.00000002.1643904003.0000000000020000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1643958107.00000000000AF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1643958107.00000000000D5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1643993044.00000000000DF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1644007204.00000000000E8000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_20000_Ship Docs_CI PL HBL COO_.jbxd

Similarity

API ID: AddressLibraryLoadProc
String ID: RegDeleteKeyExW$advapi32.dll
API String ID: 2574300362-4033151799
Opcode ID: 2944d4df9e2db3ca311cf7fe2175c087b1a78126acf1f41f8620ae76fcb69a1a
Instruction ID: 4fc5512507c74fc81c0e504e604f57086501454d7c342f8169f15f897c25e87c
Opcode Fuzzy Hash: 2944d4df9e2db3ca311cf7fe2175c087b1a78126acf1f41f8620ae76fcb69a1a
Instruction Fuzzy Hash: A9D01231510713CFD7205FB5D95896A76E4AF06351F118C3EE4C5DA250D7B4C4C0C650

Function 000993F5 Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 18libraryloaderCOMMON

Download Yara Rule

APIs

LoadLibraryA.KERNEL32(kernel32.dll,00000001,00099009,?,000AF910), ref: 00099403
GetProcAddress.KERNEL32(00000000,GetModuleHandleExW), ref: 00099415

Strings

kernel32.dll, xrefs: 000993FE
GetModuleHandleExW, xrefs: 0009940F

Memory Dump Source

Source File: 00000000.00000002.1643917647.0000000000021000.00000020.00000001.01000000.00000003.sdmp, Offset: 00020000, based on PE: true

Associated: 00000000.00000002.1643904003.0000000000020000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1643958107.00000000000AF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1643958107.00000000000D5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1643993044.00000000000DF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1644007204.00000000000E8000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_20000_Ship Docs_CI PL HBL COO_.jbxd

Similarity

API ID: AddressLibraryLoadProc
String ID: GetModuleHandleExW$kernel32.dll
API String ID: 2574300362-199464113
Opcode ID: 250984f4e65aff28c1ae16f486c02e63eb511636644cff64093959d1e8329563
Instruction ID: 000c7f3d8b0ab6157f71622266ab14191463d32d3baa3fa4a89af9ad7f6972e3
Opcode Fuzzy Hash: 250984f4e65aff28c1ae16f486c02e63eb511636644cff64093959d1e8329563
Instruction Fuzzy Hash: E9D0C230514713CFDB305FB4C90851272E4AF22351B00C83ED481C6550D774C4C0C720

Function 00061B3E Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 17timeCOMMON

Download Yara Rule

APIs

GetLocalTime.KERNEL32(?), ref: 00061B42
__swprintf.LIBCMT ref: 00061B73

Strings

%.3d, xrefs: 00061B4D
WIN_XPe, xrefs: 00061BB2

Memory Dump Source

Source File: 00000000.00000002.1643917647.0000000000021000.00000020.00000001.01000000.00000003.sdmp, Offset: 00020000, based on PE: true

Associated: 00000000.00000002.1643904003.0000000000020000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1643958107.00000000000AF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1643958107.00000000000D5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1643993044.00000000000DF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1644007204.00000000000E8000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_20000_Ship Docs_CI PL HBL COO_.jbxd

Similarity

API ID: LocalTime__swprintf
String ID: %.3d$WIN_XPe
API String ID: 2070861257-2409531811
Opcode ID: 8eb48f162f729d7e9e5a38488e0cd6eff10121ca9441fb35fc6f00f4666b1b65
Instruction ID: e4b7f23c6195e04961a168c036e9a413858b0d3047091bac72161414758583ea
Opcode Fuzzy Hash: 8eb48f162f729d7e9e5a38488e0cd6eff10121ca9441fb35fc6f00f4666b1b65
Instruction Fuzzy Hash: 20D012B1C08218EADB249AA09C44DFD737DAB09301F181592B50291040F7389B84DB25

Function 000776C5 Relevance: 6.3, APIs: 4, Instructions: 333COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1643917647.0000000000021000.00000020.00000001.01000000.00000003.sdmp, Offset: 00020000, based on PE: true

Associated: 00000000.00000002.1643904003.0000000000020000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1643958107.00000000000AF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1643958107.00000000000D5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1643993044.00000000000DF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1644007204.00000000000E8000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_20000_Ship Docs_CI PL HBL COO_.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ecdc87acb957ea282ef389e238c6f67a10bddce6e45b2b36f382fc3a606c75b4
Instruction ID: 348511653b3dcffa1ef9f9bbe491122d280dae474e7c691ce28e92b138fc9821
Opcode Fuzzy Hash: ecdc87acb957ea282ef389e238c6f67a10bddce6e45b2b36f382fc3a606c75b4
Instruction Fuzzy Hash: BAC17975E04216EFDB14CFA8C884AAEB7F5FF48340B118598E809EB251D734EE81CB94

Function 0009E33E Relevance: 6.3, APIs: 4, Instructions: 307memoryCOMMON

Download Yara Rule

APIs

CharLowerBuffW.USER32(?,?), ref: 0009E3D2
CharLowerBuffW.USER32(?,?), ref: 0009E415

Part of subcall function 0009DAB9: CharLowerBuffW.USER32(?,?,?,?,00000000,?,?), ref: 0009DAD9

VirtualAlloc.KERNEL32(00000000,00000077,00003000,00000040), ref: 0009E615
_memmove.LIBCMT ref: 0009E628

Memory Dump Source

Source File: 00000000.00000002.1643917647.0000000000021000.00000020.00000001.01000000.00000003.sdmp, Offset: 00020000, based on PE: true

Associated: 00000000.00000002.1643904003.0000000000020000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1643958107.00000000000AF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1643958107.00000000000D5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1643993044.00000000000DF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1644007204.00000000000E8000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_20000_Ship Docs_CI PL HBL COO_.jbxd

Similarity

API ID: BuffCharLower$AllocVirtual_memmove
String ID:
API String ID: 3659485706-0
Opcode ID: 0bcd9ae9307f1338e7c25be8c45890966ad43d2931acaf0c3186a9278e68ce53
Instruction ID: 450a33e0c8f93f769431b42a9a4e2171944cedc0151adbff8af0073f12a8092e
Opcode Fuzzy Hash: 0bcd9ae9307f1338e7c25be8c45890966ad43d2931acaf0c3186a9278e68ce53
Instruction Fuzzy Hash: D7C16971A083519FCB54DF28C480A6ABBE4FF88714F14896EF8999B352D731ED45CB82

Function 000983A8 Relevance: 6.3, APIs: 4, Instructions: 267COMMON

Download Yara Rule

APIs

CoInitialize.OLE32(00000000), ref: 000983D8
CoUninitialize.OLE32 ref: 000983E3

Part of subcall function 0007DA5D: CoCreateInstance.OLE32(?,00000000,00000005,?,?,?,?,?,?,?,?,?,?,?), ref: 0007DAC5

VariantInit.OLEAUT32(?), ref: 000983EE
VariantClear.OLEAUT32(?), ref: 000986BF

Memory Dump Source

Source File: 00000000.00000002.1643917647.0000000000021000.00000020.00000001.01000000.00000003.sdmp, Offset: 00020000, based on PE: true

Associated: 00000000.00000002.1643904003.0000000000020000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1643958107.00000000000AF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1643958107.00000000000D5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1643993044.00000000000DF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1644007204.00000000000E8000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_20000_Ship Docs_CI PL HBL COO_.jbxd

Similarity

API ID: Variant$ClearCreateInitInitializeInstanceUninitialize
String ID:
API String ID: 780911581-0
Opcode ID: b86a99c2195be1432aed9789d5b81e85f6d0c004ff7cb850baf3fb858509b0ea
Instruction ID: 8f7a8578ede147c74097cb2e4b7c34c61d902c68d70bde4e4839e3d6e9f4b822
Opcode Fuzzy Hash: b86a99c2195be1432aed9789d5b81e85f6d0c004ff7cb850baf3fb858509b0ea
Instruction Fuzzy Hash: 16A15C752047119FDB10DF28C481B6AB7E4BF89324F14885DF99A9B3A2CB31ED44DB86

Function 00077A78 Relevance: 6.2, APIs: 4, Instructions: 231COMMON

Download Yara Rule

APIs

ProgIDFromCLSID.OLE32(?,00000000,?,00000000,00000800,00000000,?,000B2C7C,?), ref: 00077C32
CoTaskMemFree.OLE32(00000000,00000000,?,00000000,00000800,00000000,?,000B2C7C,?), ref: 00077C4A
CLSIDFromProgID.OLE32(?,?,00000000,000AFB80,000000FF,?,00000000,00000800,00000000,?,000B2C7C,?), ref: 00077C6F
_memcmp.LIBCMT ref: 00077C90

Memory Dump Source

Source File: 00000000.00000002.1643917647.0000000000021000.00000020.00000001.01000000.00000003.sdmp, Offset: 00020000, based on PE: true

Associated: 00000000.00000002.1643904003.0000000000020000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1643958107.00000000000AF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1643958107.00000000000D5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1643993044.00000000000DF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1644007204.00000000000E8000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_20000_Ship Docs_CI PL HBL COO_.jbxd

Similarity

API ID: FromProg$FreeTask_memcmp
String ID:
API String ID: 314563124-0
Opcode ID: e9a3eed2032c4e186223f2d3aef886768173fa3cbf676f47a1781112544810d6
Instruction ID: 290ed981e05904e94ea150e24a09ac29fe54cd7538ca1cd851eac4884721d296
Opcode Fuzzy Hash: e9a3eed2032c4e186223f2d3aef886768173fa3cbf676f47a1781112544810d6
Instruction Fuzzy Hash: C7811B71E00109EFCB04DF94C984EEEB7B9FF89355F208198E509AB250DB75AE06CB61

Function 00076DF3 Relevance: 6.2, APIs: 4, Instructions: 202memoryCOMMON

Download Yara Rule

APIs

VariantInit.OLEAUT32(?), ref: 00076E04
SysAllocString.OLEAUT32(00000000), ref: 00076EAD
VariantCopy.OLEAUT32 ref: 00076EDC
VariantClear.OLEAUT32(?), ref: 00076F03

Memory Dump Source

Source File: 00000000.00000002.1643917647.0000000000021000.00000020.00000001.01000000.00000003.sdmp, Offset: 00020000, based on PE: true

Associated: 00000000.00000002.1643904003.0000000000020000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1643958107.00000000000AF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1643958107.00000000000D5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1643993044.00000000000DF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1644007204.00000000000E8000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_20000_Ship Docs_CI PL HBL COO_.jbxd

Similarity

API ID: Variant$AllocClearCopyInitString
String ID:
API String ID: 2808897238-0
Opcode ID: 99d98ed74a4faa34f5eff073dad13b8aa007f6b4a14172ea64ce983504acb791
Instruction ID: c22db953ffa59c5ddb42ccc06b704065c0a99026ce7fa9a3e66586993bdc2399
Opcode Fuzzy Hash: 99d98ed74a4faa34f5eff073dad13b8aa007f6b4a14172ea64ce983504acb791
Instruction Fuzzy Hash: C051FA30A04702DADB30AF75D491A7DB3E5AF08350F60C82FE59FC7292DB7998409B59

Function 000A9A63 Relevance: 6.1, APIs: 4, Instructions: 140COMMON

Download Yara Rule

APIs

GetWindowRect.USER32(00C411D0,?), ref: 000A9AD2
ScreenToClient.USER32(00000002,00000002), ref: 000A9B05
MoveWindow.USER32(?,?,?,?,000000FF,00000001,?,?,00000002,?,?), ref: 000A9B72

Memory Dump Source

Source File: 00000000.00000002.1643917647.0000000000021000.00000020.00000001.01000000.00000003.sdmp, Offset: 00020000, based on PE: true

Associated: 00000000.00000002.1643904003.0000000000020000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1643958107.00000000000AF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1643958107.00000000000D5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1643993044.00000000000DF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1644007204.00000000000E8000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_20000_Ship Docs_CI PL HBL COO_.jbxd

Similarity

API ID: Window$ClientMoveRectScreen
String ID:
API String ID: 3880355969-0
Opcode ID: 91ae5ee244f88cdfcadfb3f931f7cbf85a5bb47d8ec5745199edbc31685c16e8
Instruction ID: 002c4f127eef513ac27af23f5f1dbdc9466af8c7554c6f17a042e4395fdc314f
Opcode Fuzzy Hash: 91ae5ee244f88cdfcadfb3f931f7cbf85a5bb47d8ec5745199edbc31685c16e8
Instruction Fuzzy Hash: 8B515134A00609EFDF50DFA8E9809AE7BF6FF56760F108259F9159B2A0D730AD41CB90

Function 00096CBD Relevance: 6.1, APIs: 4, Instructions: 127networkCOMMON

Download Yara Rule

APIs

socket.WSOCK32(00000002,00000002,00000011), ref: 00096CE4
WSAGetLastError.WSOCK32(00000000), ref: 00096CF4

Part of subcall function 00029997: __itow.LIBCMT ref: 000299C2
Part of subcall function 00029997: __swprintf.LIBCMT ref: 00029A0C

#21.WSOCK32(?,0000FFFF,00000020,00000002,00000004), ref: 00096D58
WSAGetLastError.WSOCK32(00000000), ref: 00096D64

Memory Dump Source

Source File: 00000000.00000002.1643917647.0000000000021000.00000020.00000001.01000000.00000003.sdmp, Offset: 00020000, based on PE: true

Associated: 00000000.00000002.1643904003.0000000000020000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1643958107.00000000000AF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1643958107.00000000000D5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1643993044.00000000000DF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1644007204.00000000000E8000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_20000_Ship Docs_CI PL HBL COO_.jbxd

Similarity

API ID: ErrorLast$__itow__swprintfsocket
String ID:
API String ID: 2214342067-0
Opcode ID: fa083e7c41a09d587c188d852ce7152d5e5093971f224d757c23e08bc6d1a93c
Instruction ID: a491b0df8051a39c60ff1e62ead3bc4a4cba9048061e428e98b3bb05eceb63ee
Opcode Fuzzy Hash: fa083e7c41a09d587c188d852ce7152d5e5093971f224d757c23e08bc6d1a93c
Instruction Fuzzy Hash: C5419374B40610AFEB24AF24EC87F7A77E59B08B10F44C418FA599B2D3DA759D008B91

Function 0009672D Relevance: 6.1, APIs: 4, Instructions: 116COMMON

Download Yara Rule

APIs

#16.WSOCK32(?,?,00000000,00000000,00000000,00000000,?,?,00000000,000AF910), ref: 000967BA
_strlen.LIBCMT ref: 000967EC

Memory Dump Source

Source File: 00000000.00000002.1643917647.0000000000021000.00000020.00000001.01000000.00000003.sdmp, Offset: 00020000, based on PE: true

Associated: 00000000.00000002.1643904003.0000000000020000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1643958107.00000000000AF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1643958107.00000000000D5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1643993044.00000000000DF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1644007204.00000000000E8000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_20000_Ship Docs_CI PL HBL COO_.jbxd

Similarity

API ID: _strlen
String ID:
API String ID: 4218353326-0
Opcode ID: c227b879a612db9077ede1db5edcc0efdbd1f597a70a2a861021a921fc348519
Instruction ID: f0cab101fd00b26ce1ff5a5827a6b95186fd2aa8e17f5c98f1acfa2e564b927a
Opcode Fuzzy Hash: c227b879a612db9077ede1db5edcc0efdbd1f597a70a2a861021a921fc348519
Instruction Fuzzy Hash: 5B41C071A00115ABCF14EBA4DCD5EFEB3A9AF48310F148265F81A9B293DF31AD04DB55

Function 0008BA5F Relevance: 6.1, APIs: 4, Instructions: 111fileCOMMON

Download Yara Rule

APIs

CreateHardLinkW.KERNEL32(00000002,?,00000000), ref: 0008BB09
GetLastError.KERNEL32(?,00000000), ref: 0008BB2F
DeleteFileW.KERNEL32(00000002,?,00000000), ref: 0008BB54
CreateHardLinkW.KERNEL32(00000002,?,00000000,?,00000000), ref: 0008BB80

Memory Dump Source

Source File: 00000000.00000002.1643917647.0000000000021000.00000020.00000001.01000000.00000003.sdmp, Offset: 00020000, based on PE: true

Associated: 00000000.00000002.1643904003.0000000000020000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1643958107.00000000000AF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1643958107.00000000000D5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1643993044.00000000000DF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1644007204.00000000000E8000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_20000_Ship Docs_CI PL HBL COO_.jbxd

Similarity

API ID: CreateHardLink$DeleteErrorFileLast
String ID:
API String ID: 3321077145-0
Opcode ID: 5ce045bf3a083d471f1843dbea58f220ba7a24a1cae3bcd350d77958bdc3185a
Instruction ID: 5fa8cb8169a9fdf52c284686e4d8219404b2e711da6c3832b01e68df383f837d
Opcode Fuzzy Hash: 5ce045bf3a083d471f1843dbea58f220ba7a24a1cae3bcd350d77958bdc3185a
Instruction Fuzzy Hash: 92412B35600A21DFDB10EF18D585A5DBBE1BF49320F198498EC8A9B362CB35FD41CB91

Function 000A8AC0 Relevance: 6.1, APIs: 4, Instructions: 109COMMON

Download Yara Rule

APIs

InvalidateRect.USER32(?,00000000,00000001,?,?,?), ref: 000A8B4D

Memory Dump Source

Source File: 00000000.00000002.1643917647.0000000000021000.00000020.00000001.01000000.00000003.sdmp, Offset: 00020000, based on PE: true

Associated: 00000000.00000002.1643904003.0000000000020000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1643958107.00000000000AF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1643958107.00000000000D5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1643993044.00000000000DF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1644007204.00000000000E8000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_20000_Ship Docs_CI PL HBL COO_.jbxd

Similarity

API ID: InvalidateRect
String ID:
API String ID: 634782764-0
Opcode ID: edc4eca88416d7bba32dbe56e50065b65a7510801f09722c6e72a317f2121e8d
Instruction ID: ac8c9c4db01cfb51439df8a7ef686b5ee870dedcb1a3fffa2b81e6fec8fe87d7
Opcode Fuzzy Hash: edc4eca88416d7bba32dbe56e50065b65a7510801f09722c6e72a317f2121e8d
Instruction Fuzzy Hash: 1631D2B4620214BFEB749EE8DC85FAD37A4FB07350F24CA12FA51D62A1DF35A9408761

Function 000AADF1 Relevance: 6.1, APIs: 4, Instructions: 106windowCOMMON

Download Yara Rule

APIs

ClientToScreen.USER32(?,?), ref: 000AAE1A
GetWindowRect.USER32(?,?), ref: 000AAE90
PtInRect.USER32(?,?,000AC304), ref: 000AAEA0
MessageBeep.USER32(00000000), ref: 000AAF11

Memory Dump Source

Source File: 00000000.00000002.1643917647.0000000000021000.00000020.00000001.01000000.00000003.sdmp, Offset: 00020000, based on PE: true

Associated: 00000000.00000002.1643904003.0000000000020000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1643958107.00000000000AF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1643958107.00000000000D5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1643993044.00000000000DF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1644007204.00000000000E8000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_20000_Ship Docs_CI PL HBL COO_.jbxd

Similarity

API ID: Rect$BeepClientMessageScreenWindow
String ID:
API String ID: 1352109105-0
Opcode ID: 854994e3193d6ec29216f007aa8927cc7e79270ad8857b008221fc8291cb174d
Instruction ID: 38df67834ffee97ee01247519ca285a71aa5ae433df1e7eca85783cf30c2d587
Opcode Fuzzy Hash: 854994e3193d6ec29216f007aa8927cc7e79270ad8857b008221fc8291cb174d
Instruction Fuzzy Hash: D3418E70700219DFDB21CF98D884AA9BBF5FB4B740F1481A9E4149B291D731A842CF92

Function 00080FE6 Relevance: 6.1, APIs: 4, Instructions: 105keyboardwindowCOMMON

Download Yara Rule

APIs

GetKeyboardState.USER32(?,00000000,?,00000001), ref: 00081037
SetKeyboardState.USER32(00000080,?,00000001), ref: 00081053
PostMessageW.USER32(00000000,00000102,00000001,00000001), ref: 000810B9
SendInput.USER32(00000001,00000000,0000001C,00000000,?,00000001), ref: 0008110B

Memory Dump Source

Source File: 00000000.00000002.1643917647.0000000000021000.00000020.00000001.01000000.00000003.sdmp, Offset: 00020000, based on PE: true

Associated: 00000000.00000002.1643904003.0000000000020000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1643958107.00000000000AF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1643958107.00000000000D5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1643993044.00000000000DF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1644007204.00000000000E8000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_20000_Ship Docs_CI PL HBL COO_.jbxd

Similarity

API ID: KeyboardState$InputMessagePostSend
String ID:
API String ID: 432972143-0
Opcode ID: 6491b6d43091a765c4b771c7bdf08d9ccefa893360e632e17b2a1fb88e3b5500
Instruction ID: 917790b4b61746b0332bc43e882332786aa7558d22a8785d72e210c884234054
Opcode Fuzzy Hash: 6491b6d43091a765c4b771c7bdf08d9ccefa893360e632e17b2a1fb88e3b5500
Instruction Fuzzy Hash: 73311430E44698AEFB30AA658C09BFDBBEDBF45320F04431AE5C4521D1C3B589C69B91

Function 00081121 Relevance: 6.1, APIs: 4, Instructions: 101keyboardwindowCOMMON

Download Yara Rule

APIs

GetKeyboardState.USER32(?,75C0C0D0,?,00008000), ref: 00081176
SetKeyboardState.USER32(00000080,?,00008000), ref: 00081192
PostMessageW.USER32(00000000,00000101,00000000), ref: 000811F1
SendInput.USER32(00000001,?,0000001C,75C0C0D0,?,00008000), ref: 00081243

Memory Dump Source

Source File: 00000000.00000002.1643917647.0000000000021000.00000020.00000001.01000000.00000003.sdmp, Offset: 00020000, based on PE: true

Associated: 00000000.00000002.1643904003.0000000000020000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1643958107.00000000000AF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1643958107.00000000000D5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1643993044.00000000000DF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1644007204.00000000000E8000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_20000_Ship Docs_CI PL HBL COO_.jbxd

Similarity

API ID: KeyboardState$InputMessagePostSend
String ID:
API String ID: 432972143-0
Opcode ID: 648007844425a600df1e6eeecbc3047d8d96ee486d8acd7ce04e297757578b4e
Instruction ID: 99f2841460787fe2cc1dabbd514d4126a777b83bf618c37553eaaff1ca7f5591
Opcode Fuzzy Hash: 648007844425a600df1e6eeecbc3047d8d96ee486d8acd7ce04e297757578b4e
Instruction Fuzzy Hash: 18312670E406186AFF70AAA58C08BFEBBEEBF49320F04431AF6C5921D1C37889569751

Function 00056415 Relevance: 6.1, APIs: 4, Instructions: 97COMMONLIBRARYCODE

Download Yara Rule

APIs

_LocaleUpdate::_LocaleUpdate.LIBCMT ref: 0005644B
__isleadbyte_l.LIBCMT ref: 00056479
MultiByteToWideChar.KERNEL32(00000080,00000009,00000002,00000001,00000000,00000000,?,00000000,00000000,?,?), ref: 000564A7
MultiByteToWideChar.KERNEL32(00000080,00000009,00000002,00000001,00000000,00000000,?,00000000,00000000,?,?), ref: 000564DD

Memory Dump Source

Source File: 00000000.00000002.1643917647.0000000000021000.00000020.00000001.01000000.00000003.sdmp, Offset: 00020000, based on PE: true

Associated: 00000000.00000002.1643904003.0000000000020000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1643958107.00000000000AF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1643958107.00000000000D5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1643993044.00000000000DF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1644007204.00000000000E8000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_20000_Ship Docs_CI PL HBL COO_.jbxd

Similarity

API ID: ByteCharLocaleMultiWide$UpdateUpdate::___isleadbyte_l
String ID:
API String ID: 3058430110-0
Opcode ID: e6c56be98ee657ccf27d1ddd9c599f65e88c1a3ba476a61ac1c90adc27f1ce16
Instruction ID: d337b8e9e0171eface3da981219958d090ba323af0bc58770ee3d97ab0ae6c4a
Opcode Fuzzy Hash: e6c56be98ee657ccf27d1ddd9c599f65e88c1a3ba476a61ac1c90adc27f1ce16
Instruction Fuzzy Hash: FE31AF31600246AFDB218F65C845BAB7BE9FF41312F554529EC54872A1EB32D898DF90

Function 000A5175 Relevance: 6.1, APIs: 4, Instructions: 95COMMON

Download Yara Rule

APIs

GetForegroundWindow.USER32 ref: 000A5189

Part of subcall function 0008387D: GetWindowThreadProcessId.USER32(00000000,00000000), ref: 00083897
Part of subcall function 0008387D: GetCurrentThreadId.KERNEL32 ref: 0008389E
Part of subcall function 0008387D: AttachThreadInput.USER32(00000000,?,000852A7), ref: 000838A5

GetCaretPos.USER32(?), ref: 000A519A
ClientToScreen.USER32(00000000,?), ref: 000A51D5
GetForegroundWindow.USER32 ref: 000A51DB

Memory Dump Source

Source File: 00000000.00000002.1643917647.0000000000021000.00000020.00000001.01000000.00000003.sdmp, Offset: 00020000, based on PE: true

Associated: 00000000.00000002.1643904003.0000000000020000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1643958107.00000000000AF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1643958107.00000000000D5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1643993044.00000000000DF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1644007204.00000000000E8000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_20000_Ship Docs_CI PL HBL COO_.jbxd

Similarity

API ID: ThreadWindow$Foreground$AttachCaretClientCurrentInputProcessScreen
String ID:
API String ID: 2759813231-0
Opcode ID: eaa813d15685a87f1ac372e292f254d038d5929fd50751d6f45f621314820533
Instruction ID: 1963e5ac043453c9725fde66d263ed9373d367a6f04e49c3e864dc615afd3772
Opcode Fuzzy Hash: eaa813d15685a87f1ac372e292f254d038d5929fd50751d6f45f621314820533
Instruction Fuzzy Hash: 9F310E71D00218AFDB10EFA5D885DEFB7F9EF99300F10406AE915E7242EA759E05CBA1

Function 000AC788 Relevance: 6.1, APIs: 4, Instructions: 83windowCOMMON

Download Yara Rule

APIs

Part of subcall function 00022612: GetWindowLongW.USER32(?,000000EB), ref: 00022623

GetCursorPos.USER32(?), ref: 000AC7C2
TrackPopupMenuEx.USER32(?,00000000,?,?,?,00000000,?,0005BBFB,?,?,?,?,?), ref: 000AC7D7
GetCursorPos.USER32(?), ref: 000AC824
DefDlgProcW.USER32(?,0000007B,?,?,?,?,?,?,?,?,?,?,0005BBFB,?,?,?), ref: 000AC85E

Memory Dump Source

Source File: 00000000.00000002.1643917647.0000000000021000.00000020.00000001.01000000.00000003.sdmp, Offset: 00020000, based on PE: true

Associated: 00000000.00000002.1643904003.0000000000020000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1643958107.00000000000AF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1643958107.00000000000D5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1643993044.00000000000DF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1644007204.00000000000E8000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_20000_Ship Docs_CI PL HBL COO_.jbxd

Similarity

API ID: Cursor$LongMenuPopupProcTrackWindow
String ID:
API String ID: 2864067406-0
Opcode ID: 6f5b23b5f1d459090050efd9646c74436ea07c81ad96245da2a6b01db0ee507d
Instruction ID: 26b58f94dfbb5e4a09f6a5e5158bd34993ef66de0a33ac2bcbe4a96255c5a142
Opcode Fuzzy Hash: 6f5b23b5f1d459090050efd9646c74436ea07c81ad96245da2a6b01db0ee507d
Instruction Fuzzy Hash: F7319335500418AFEB25CF98D898EEA7BF6FB0A710F054165F9059B261CB395D50DF60

Function 00078B9E Relevance: 6.1, APIs: 4, Instructions: 79memoryCOMMON

Download Yara Rule

APIs

Part of subcall function 00078652: GetTokenInformation.ADVAPI32(?,00000003(TokenIntegrityLevel),?,00000000,?), ref: 00078669
Part of subcall function 00078652: GetLastError.KERNEL32(?,TokenIntegrityLevel,?,00000000,?), ref: 00078673
Part of subcall function 00078652: GetProcessHeap.KERNEL32(00000008,?,?,TokenIntegrityLevel,?,00000000,?), ref: 00078682
Part of subcall function 00078652: HeapAlloc.KERNEL32(00000000,?,TokenIntegrityLevel,?,00000000,?), ref: 00078689
Part of subcall function 00078652: GetTokenInformation.ADVAPI32(?,00000003(TokenIntegrityLevel),00000000,?,?,?,TokenIntegrityLevel,?,00000000,?), ref: 0007869F

LookupPrivilegeValueW.ADVAPI32(00000000,?,?), ref: 00078BEB
_memcmp.LIBCMT ref: 00078C0E
GetProcessHeap.KERNEL32(00000000,00000000), ref: 00078C44
HeapFree.KERNEL32(00000000), ref: 00078C4B

Memory Dump Source

Source File: 00000000.00000002.1643917647.0000000000021000.00000020.00000001.01000000.00000003.sdmp, Offset: 00020000, based on PE: true

Associated: 00000000.00000002.1643904003.0000000000020000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1643958107.00000000000AF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1643958107.00000000000D5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1643993044.00000000000DF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1644007204.00000000000E8000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_20000_Ship Docs_CI PL HBL COO_.jbxd

Similarity

API ID: Heap$InformationProcessToken$AllocErrorFreeLastLookupPrivilegeValue_memcmp
String ID:
API String ID: 1592001646-0
Opcode ID: c665b29e3b630ac3094ef4f5e2f1ca87d70dfa0ef83f85047116f740240c3126
Instruction ID: e00e84d9573ba6bdf5276a511ec0304b4e9b2f0da9b847bff9fa2ba73bd4008f
Opcode Fuzzy Hash: c665b29e3b630ac3094ef4f5e2f1ca87d70dfa0ef83f85047116f740240c3126
Instruction Fuzzy Hash: 8C218B71E81209EBDB10DFA4C949BEEB7F8EF40350F15C059E458A7241DB38AA06CB65

Function 00040BD0 Relevance: 6.1, APIs: 4, Instructions: 79COMMON

Download Yara Rule

APIs

__setmode.LIBCMT ref: 00040BF2

Part of subcall function 00025B75: WideCharToMultiByte.KERNEL32(00000000,00000000,?,00000001,00000000,00000000,00000000,00000000,00000000,00000000,?,00087B20,?,?,00000000), ref: 00025B8C
Part of subcall function 00025B75: WideCharToMultiByte.KERNEL32(00000000,00000000,?,00000001,00000000,?,00000000,00000000,?,?,00087B20,?,?,00000000,?,?), ref: 00025BB0

_fprintf.LIBCMT ref: 00040C29
OutputDebugStringW.KERNEL32(?), ref: 00076331

Part of subcall function 00044CDA: _flsall.LIBCMT ref: 00044CF3

__setmode.LIBCMT ref: 00040C5E

Memory Dump Source

Source File: 00000000.00000002.1643917647.0000000000021000.00000020.00000001.01000000.00000003.sdmp, Offset: 00020000, based on PE: true

Associated: 00000000.00000002.1643904003.0000000000020000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1643958107.00000000000AF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1643958107.00000000000D5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1643993044.00000000000DF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1644007204.00000000000E8000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_20000_Ship Docs_CI PL HBL COO_.jbxd

Similarity

API ID: ByteCharMultiWide__setmode$DebugOutputString_flsall_fprintf
String ID:
API String ID: 521402451-0
Opcode ID: 81dcd412d0677202413b8c7c12c9d692bdb93666fcb88fd8de42f517fe6087e7
Instruction ID: 78e22ff69635485f3b348a40dd605d23b8bc5c2b4dbcc50866f91ade9b0e1567
Opcode Fuzzy Hash: 81dcd412d0677202413b8c7c12c9d692bdb93666fcb88fd8de42f517fe6087e7
Instruction Fuzzy Hash: 181136B2904614BEDB04B3B4AC83AFE7B699F41320F14413AF20467193DF315D82939D

Function 00091A5B Relevance: 6.1, APIs: 4, Instructions: 78networkCOMMON

Download Yara Rule

APIs

InternetConnectW.WININET(?,?,?,?,?,?,00000000,00000000), ref: 00091A97

Part of subcall function 00091B21: InternetOpenUrlW.WININET(?,?,00000000,00000000,?,00000000), ref: 00091B40
Part of subcall function 00091B21: InternetCloseHandle.WININET(00000000), ref: 00091BDD

Memory Dump Source

Source File: 00000000.00000002.1643917647.0000000000021000.00000020.00000001.01000000.00000003.sdmp, Offset: 00020000, based on PE: true

Associated: 00000000.00000002.1643904003.0000000000020000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1643958107.00000000000AF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1643958107.00000000000D5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1643993044.00000000000DF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1644007204.00000000000E8000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_20000_Ship Docs_CI PL HBL COO_.jbxd

Similarity

API ID: Internet$CloseConnectHandleOpen
String ID:
API String ID: 1463438336-0
Opcode ID: 112308d022f541c350b2716a65b7fc44924a99feaa913f5133ae1bfb71935b75
Instruction ID: 6d92a9594b17727a2ac3e522c1e8d52524c92ed44a990220826287a16c37b623
Opcode Fuzzy Hash: 112308d022f541c350b2716a65b7fc44924a99feaa913f5133ae1bfb71935b75
Instruction Fuzzy Hash: 10217F35304A02BFEF219FA08C01FFAB7AABB49701F10401AF91196551E7719811A790

Function 0007E1AF Relevance: 6.1, APIs: 3, Strings: 1, Instructions: 68stringCOMMON

Download Yara Rule

APIs

Part of subcall function 0007F5AD: lstrlenW.KERNEL32(?,00000002,?,?,000000EF,?,0007E1C4,?,?,?,0007EFB7,00000000,000000EF,00000119,?,?), ref: 0007F5BC
Part of subcall function 0007F5AD: lstrcpyW.KERNEL32(00000000,?), ref: 0007F5E2
Part of subcall function 0007F5AD: lstrcmpiW.KERNEL32(00000000,?,0007E1C4,?,?,?,0007EFB7,00000000,000000EF,00000119,?,?), ref: 0007F613

lstrlenW.KERNEL32(?,00000002,?,?,?,?,0007EFB7,00000000,000000EF,00000119,?,?,00000000), ref: 0007E1DD
lstrcpyW.KERNEL32(00000000,?), ref: 0007E203
lstrcmpiW.KERNEL32(00000002,cdecl,?,0007EFB7,00000000,000000EF,00000119,?,?,00000000), ref: 0007E237

Strings

cdecl, xrefs: 0007E22E

Memory Dump Source

Source File: 00000000.00000002.1643917647.0000000000021000.00000020.00000001.01000000.00000003.sdmp, Offset: 00020000, based on PE: true

Associated: 00000000.00000002.1643904003.0000000000020000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1643958107.00000000000AF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1643958107.00000000000D5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1643993044.00000000000DF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1644007204.00000000000E8000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_20000_Ship Docs_CI PL HBL COO_.jbxd

Similarity

API ID: lstrcmpilstrcpylstrlen
String ID: cdecl
API String ID: 4031866154-3896280584
Opcode ID: 3f2bd35bc1685245fa2ce86ea76afadfa349029a250d4cf794ecaf5e1e3a11c1
Instruction ID: 7e1fcd466de2c44a3ef2bec229b13161dee68ad27035d5c67683c4034bb9781a
Opcode Fuzzy Hash: 3f2bd35bc1685245fa2ce86ea76afadfa349029a250d4cf794ecaf5e1e3a11c1
Instruction Fuzzy Hash: 7D110336200342EFCB24AF74DC05D7A37A8FF49310B40807AF90ACB251EB759851C7A4

Function 00055332 Relevance: 6.1, APIs: 4, Instructions: 67COMMONLIBRARYCODE

Download Yara Rule

APIs

_free.LIBCMT ref: 00055351

Part of subcall function 0004594C: __FF_MSGBANNER.LIBCMT ref: 00045963
Part of subcall function 0004594C: __NMSG_WRITE.LIBCMT ref: 0004596A
Part of subcall function 0004594C: RtlAllocateHeap.NTDLL(00C20000,00000000,00000001,00000000,?,?,?,00041013,?), ref: 0004598F

Memory Dump Source

Source File: 00000000.00000002.1643917647.0000000000021000.00000020.00000001.01000000.00000003.sdmp, Offset: 00020000, based on PE: true

Associated: 00000000.00000002.1643904003.0000000000020000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1643958107.00000000000AF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1643958107.00000000000D5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1643993044.00000000000DF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1644007204.00000000000E8000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_20000_Ship Docs_CI PL HBL COO_.jbxd

Similarity

API ID: AllocateHeap_free
String ID:
API String ID: 614378929-0
Opcode ID: 70713a0ef4a336b8d76d241a2bdc2eac743386e8cb6ff5c406be615d3ca1198c
Instruction ID: d214f89de9db4f155c1bc7cea9babc3107f9b91bfbd16612ffa220d40889667e
Opcode Fuzzy Hash: 70713a0ef4a336b8d76d241a2bdc2eac743386e8cb6ff5c406be615d3ca1198c
Instruction Fuzzy Hash: 10110472905A05AFDB302F70EC556AF37D45F013E3B104439FD48AA092EE748B449354

Function 00024531 Relevance: 6.1, APIs: 4, Instructions: 66timewindowCOMMON

Download Yara Rule

APIs

_memset.LIBCMT ref: 00024560

Part of subcall function 0002410D: _memset.LIBCMT ref: 0002418D
Part of subcall function 0002410D: _wcscpy.LIBCMT ref: 000241E1
Part of subcall function 0002410D: Shell_NotifyIconW.SHELL32(00000001,000003A8), ref: 000241F1

KillTimer.USER32(?,00000001,?,?), ref: 000245B5
SetTimer.USER32(?,00000001,000002EE,00000000), ref: 000245C4
Shell_NotifyIconW.SHELL32(00000001,000003A8), ref: 0005D6CE

Memory Dump Source

Source File: 00000000.00000002.1643917647.0000000000021000.00000020.00000001.01000000.00000003.sdmp, Offset: 00020000, based on PE: true

Associated: 00000000.00000002.1643904003.0000000000020000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1643958107.00000000000AF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1643958107.00000000000D5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1643993044.00000000000DF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1644007204.00000000000E8000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_20000_Ship Docs_CI PL HBL COO_.jbxd

Similarity

API ID: IconNotifyShell_Timer_memset$Kill_wcscpy
String ID:
API String ID: 1378193009-0
Opcode ID: 3758d7f3b7421b3b381b75aced355a064427232d9acfdc3a0d3a8bf0f275a1e4
Instruction ID: f7ff979fe59c17fb30bbbfe997e1bc0804aab5aa060b1e20de7e45255ebe6978
Opcode Fuzzy Hash: 3758d7f3b7421b3b381b75aced355a064427232d9acfdc3a0d3a8bf0f275a1e4
Instruction Fuzzy Hash: 7F210A70904B949FFB728B24D845BEBBBEC9F01309F00009FE6DE56142C7B45A898B51

Function 000840B1 Relevance: 6.1, APIs: 4, Instructions: 65fileCOMMON

Download Yara Rule

APIs

CreateFileW.KERNEL32(?,C0000000,00000003,00000000,00000003,00000080,00000000), ref: 000840D1
_memset.LIBCMT ref: 000840F2
DeviceIoControl.KERNEL32(00000000,0004D02C,?,00000200,?,00000200,?,00000000), ref: 00084144
CloseHandle.KERNEL32(00000000), ref: 0008414D

Memory Dump Source

Source File: 00000000.00000002.1643917647.0000000000021000.00000020.00000001.01000000.00000003.sdmp, Offset: 00020000, based on PE: true

Associated: 00000000.00000002.1643904003.0000000000020000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1643958107.00000000000AF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1643958107.00000000000D5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1643993044.00000000000DF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1644007204.00000000000E8000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_20000_Ship Docs_CI PL HBL COO_.jbxd

Similarity

API ID: CloseControlCreateDeviceFileHandle_memset
String ID:
API String ID: 1157408455-0
Opcode ID: cf35e82ac1aacc52916d030a7d0531e978d82fc8cd4e90ff202f9fda519b5a66
Instruction ID: 04024cd3e6edc4066a4793eece965007ee90146a5160b093d7f6848c45c0a95d
Opcode Fuzzy Hash: cf35e82ac1aacc52916d030a7d0531e978d82fc8cd4e90ff202f9fda519b5a66
Instruction Fuzzy Hash: AD11AB759012287AE7305BA59C4DFABBBBCEF45760F1046A6F908D7180D6744E808BA4

Function 0009667C Relevance: 6.1, APIs: 4, Instructions: 61networkCOMMON

Download Yara Rule

APIs

Part of subcall function 00025B75: WideCharToMultiByte.KERNEL32(00000000,00000000,?,00000001,00000000,00000000,00000000,00000000,00000000,00000000,?,00087B20,?,?,00000000), ref: 00025B8C
Part of subcall function 00025B75: WideCharToMultiByte.KERNEL32(00000000,00000000,?,00000001,00000000,?,00000000,00000000,?,?,00087B20,?,?,00000000,?,?), ref: 00025BB0

gethostbyname.WSOCK32(?,?,?), ref: 000966AC
WSAGetLastError.WSOCK32(00000000), ref: 000966B7
_memmove.LIBCMT ref: 000966E4
inet_ntoa.WSOCK32(?), ref: 000966EF

Memory Dump Source

Source File: 00000000.00000002.1643917647.0000000000021000.00000020.00000001.01000000.00000003.sdmp, Offset: 00020000, based on PE: true

Associated: 00000000.00000002.1643904003.0000000000020000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1643958107.00000000000AF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1643958107.00000000000D5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1643993044.00000000000DF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1644007204.00000000000E8000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_20000_Ship Docs_CI PL HBL COO_.jbxd

Similarity

API ID: ByteCharMultiWide$ErrorLast_memmovegethostbynameinet_ntoa
String ID:
API String ID: 1504782959-0
Opcode ID: cdeca72b9f8dab2b0ae2092289ed2eada6dda9809ebef4c090c953c6ed3332cc
Instruction ID: 50f9b16a737ff689e6857db3faddda578e215b0108e4b6e8f9df2cb83ccb978f
Opcode Fuzzy Hash: cdeca72b9f8dab2b0ae2092289ed2eada6dda9809ebef4c090c953c6ed3332cc
Instruction Fuzzy Hash: 3411B235900509AFCF00FBE4ED86DEEB7B8AF05311B148125F506A72A2DF31AE04DB65

Function 00079023 Relevance: 6.1, APIs: 4, Instructions: 59windowCOMMON

Download Yara Rule

APIs

SendMessageW.USER32(?,000000B0,?,?), ref: 00079043
SendMessageW.USER32(?,000000C9,?,00000000), ref: 00079055
SendMessageW.USER32(?,000000C9,?,00000000), ref: 0007906B
SendMessageW.USER32(?,000000C9,?,00000000), ref: 00079086

Memory Dump Source

Source File: 00000000.00000002.1643917647.0000000000021000.00000020.00000001.01000000.00000003.sdmp, Offset: 00020000, based on PE: true

Associated: 00000000.00000002.1643904003.0000000000020000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1643958107.00000000000AF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1643958107.00000000000D5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1643993044.00000000000DF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1644007204.00000000000E8000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_20000_Ship Docs_CI PL HBL COO_.jbxd

Similarity

API ID: MessageSend
String ID:
API String ID: 3850602802-0
Opcode ID: 4ab6638ffb3d28b0cb565a02b1ce8cea6e5131574b5a976362fad4948502012b
Instruction ID: 1f424b6517a8c6d2565e617389b61514f8984d2c6a616c11c25f54580ce4ece3
Opcode Fuzzy Hash: 4ab6638ffb3d28b0cb565a02b1ce8cea6e5131574b5a976362fad4948502012b
Instruction Fuzzy Hash: CD114879D00218FFEB10DFA5C885EADBBB8FB48310F2040A5EA04B7290D6726E10DBD4

Function 00021290 Relevance: 6.1, APIs: 4, Instructions: 59COMMON

Download Yara Rule

APIs

Part of subcall function 00022612: GetWindowLongW.USER32(?,000000EB), ref: 00022623

DefDlgProcW.USER32(?,00000020,?), ref: 000212D8
GetClientRect.USER32(?,?), ref: 0005B84B
GetCursorPos.USER32(?), ref: 0005B855
ScreenToClient.USER32(?,?), ref: 0005B860

Memory Dump Source

Source File: 00000000.00000002.1643917647.0000000000021000.00000020.00000001.01000000.00000003.sdmp, Offset: 00020000, based on PE: true

Associated: 00000000.00000002.1643904003.0000000000020000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1643958107.00000000000AF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1643958107.00000000000D5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1643993044.00000000000DF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1644007204.00000000000E8000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_20000_Ship Docs_CI PL HBL COO_.jbxd

Similarity

API ID: Client$CursorLongProcRectScreenWindow
String ID:
API String ID: 4127811313-0
Opcode ID: ee3fa7f9c32ae4af39743f7855d76c09b22e73606086c43cb74c6f3d87f2b57f
Instruction ID: e3eac68ccce4ba12f1d7f3a60af39255b15f0b0f006ee2225911e64d059c2e75
Opcode Fuzzy Hash: ee3fa7f9c32ae4af39743f7855d76c09b22e73606086c43cb74c6f3d87f2b57f
Instruction Fuzzy Hash: 78113A35A0042AEFDB10EFA4E8859FE77B8EB16301F100456F941E7251C734BA658BA5

Function 00081652 Relevance: 6.1, APIs: 4, Instructions: 51sleepCOMMON

Download Yara Rule

APIs

QueryPerformanceCounter.KERNEL32(?,?,?,?,?,?,?,000801FD,?,00081250,?,00008000), ref: 0008166F
Sleep.KERNEL32(00000000,?,?,?,?,?,?,000801FD,?,00081250,?,00008000), ref: 00081694
QueryPerformanceCounter.KERNEL32(?,?,?,?,?,?,?,000801FD,?,00081250,?,00008000), ref: 0008169E
Sleep.KERNEL32(?,?,?,?,?,?,?,000801FD,?,00081250,?,00008000), ref: 000816D1

Memory Dump Source

Source File: 00000000.00000002.1643917647.0000000000021000.00000020.00000001.01000000.00000003.sdmp, Offset: 00020000, based on PE: true

Associated: 00000000.00000002.1643904003.0000000000020000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1643958107.00000000000AF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1643958107.00000000000D5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1643993044.00000000000DF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1644007204.00000000000E8000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_20000_Ship Docs_CI PL HBL COO_.jbxd

Similarity

API ID: CounterPerformanceQuerySleep
String ID:
API String ID: 2875609808-0
Opcode ID: 4bd96ebf6321e4f01271bfaedb0764a561daa491c3cd1e05181cc9acfec6c511
Instruction ID: d48e6830aa09c0c2bf4c88b1b831f21378329bd491d310dd5b843fda2b9b93cc
Opcode Fuzzy Hash: 4bd96ebf6321e4f01271bfaedb0764a561daa491c3cd1e05181cc9acfec6c511
Instruction Fuzzy Hash: 72115A31D0051DD7CF00AFE5E848AFEBB78FF09711F054055E9C0B6240DB3555628B96

Function 00057207 Relevance: 6.0, APIs: 4, Instructions: 48COMMONLIBRARYCODE

Download Yara Rule

APIs

__cftof_l.LIBCMT ref: 0005722B

Part of subcall function 00057912: __fltout2.LIBCMT ref: 0005793B

__cftog_l.LIBCMT ref: 00057251
__cftoe_l.LIBCMT ref: 00057283

Memory Dump Source

Source File: 00000000.00000002.1643917647.0000000000021000.00000020.00000001.01000000.00000003.sdmp, Offset: 00020000, based on PE: true

Associated: 00000000.00000002.1643904003.0000000000020000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1643958107.00000000000AF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1643958107.00000000000D5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1643993044.00000000000DF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1644007204.00000000000E8000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_20000_Ship Docs_CI PL HBL COO_.jbxd

Similarity

API ID: __cftoe_l__cftof_l__cftog_l__fltout2
String ID:
API String ID: 3016257755-0
Opcode ID: a65d1881d29c7e947f5b32dbcea64912f89e558cad637ae539af3f1adf23f7b4
Instruction ID: ed9a885d3fcd09b7ff3aff88dcb8b58560839dd4ca05dbd6cc1e86299113db44
Opcode Fuzzy Hash: a65d1881d29c7e947f5b32dbcea64912f89e558cad637ae539af3f1adf23f7b4
Instruction Fuzzy Hash: AE014B3604814ABBCF565E84EC018EE3F62BF69352F588615FE1C58431D236C9B9BB81

Function 000AB57F Relevance: 6.0, APIs: 4, Instructions: 47COMMON

Download Yara Rule

APIs

GetWindowRect.USER32(?,?), ref: 000AB59E
ScreenToClient.USER32(?,?), ref: 000AB5B6
ScreenToClient.USER32(?,?), ref: 000AB5DA
InvalidateRect.USER32(?,?,?,?,?,?,?,?,?,?,?,?), ref: 000AB5F5

Memory Dump Source

Source File: 00000000.00000002.1643917647.0000000000021000.00000020.00000001.01000000.00000003.sdmp, Offset: 00020000, based on PE: true

Associated: 00000000.00000002.1643904003.0000000000020000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1643958107.00000000000AF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1643958107.00000000000D5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1643993044.00000000000DF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1644007204.00000000000E8000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_20000_Ship Docs_CI PL HBL COO_.jbxd

Similarity

API ID: ClientRectScreen$InvalidateWindow
String ID:
API String ID: 357397906-0
Opcode ID: 866191c62215719c204f46333c83fdc8b2ecbecf72af22345ffdc9f41f8953c9
Instruction ID: 88c846967ec745f052b55f6ebc9ad3ed5421b6bb90f454bb7c3bcee669893e1b
Opcode Fuzzy Hash: 866191c62215719c204f46333c83fdc8b2ecbecf72af22345ffdc9f41f8953c9
Instruction Fuzzy Hash: C01134B5D0060AEFDB41DFA9C484AEEBBF5FB09310F104166E914E2220D735AA558F90

Function 000AB8EF Relevance: 6.0, APIs: 4, Instructions: 40processCOMMON

Download Yara Rule

APIs

_memset.LIBCMT ref: 000AB8FE
_memset.LIBCMT ref: 000AB90D
CreateProcessW.KERNEL32(00000000,?,00000000,00000000,00000000,00000020,00000000,00000000,000E7F20,000E7F64), ref: 000AB93C
CloseHandle.KERNEL32 ref: 000AB94E

Memory Dump Source

Source File: 00000000.00000002.1643917647.0000000000021000.00000020.00000001.01000000.00000003.sdmp, Offset: 00020000, based on PE: true

Associated: 00000000.00000002.1643904003.0000000000020000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1643958107.00000000000AF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1643958107.00000000000D5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1643993044.00000000000DF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1644007204.00000000000E8000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_20000_Ship Docs_CI PL HBL COO_.jbxd

Similarity

API ID: _memset$CloseCreateHandleProcess
String ID:
API String ID: 3277943733-0
Opcode ID: 2edb160484f7888957cb2067f6140e7f5d22ce1062bd11b2b16bc36f639def85
Instruction ID: cda01e9ee32e35ed75b4609585cf04e161dc0594c7ffe390d4e844cc5136cc65
Opcode Fuzzy Hash: 2edb160484f7888957cb2067f6140e7f5d22ce1062bd11b2b16bc36f639def85
Instruction Fuzzy Hash: 81F05EF25443807FF71027A1AC49FBB3A9CEB09754F000070FA0CE91A2D7794D0087A8

Function 00086E7C Relevance: 6.0, APIs: 4, Instructions: 33COMMON

Download Yara Rule

APIs

EnterCriticalSection.KERNEL32(?), ref: 00086E88

Part of subcall function 0008794E: _memset.LIBCMT ref: 00087983

_memmove.LIBCMT ref: 00086EAB
_memset.LIBCMT ref: 00086EB8
LeaveCriticalSection.KERNEL32(?), ref: 00086EC8

Memory Dump Source

Source File: 00000000.00000002.1643917647.0000000000021000.00000020.00000001.01000000.00000003.sdmp, Offset: 00020000, based on PE: true

Associated: 00000000.00000002.1643904003.0000000000020000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1643958107.00000000000AF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1643958107.00000000000D5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1643993044.00000000000DF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1644007204.00000000000E8000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_20000_Ship Docs_CI PL HBL COO_.jbxd

Similarity

API ID: CriticalSection_memset$EnterLeave_memmove
String ID:
API String ID: 48991266-0
Opcode ID: 9f18d218290d0d8353be0292b2fe7bc7ddb36388407ca02ea0b9bf1284dcf762
Instruction ID: 6f0f63211b93c9934fb05b3b78773558568f06c9267f7cc2901f0c62d525268d
Opcode Fuzzy Hash: 9f18d218290d0d8353be0292b2fe7bc7ddb36388407ca02ea0b9bf1284dcf762
Instruction Fuzzy Hash: F5F0547A100200ABCF416F55DC85B9ABB29EF45320B04C065FE089E22BC735E951CBB4

Function 000AC00C Relevance: 6.0, APIs: 4, Instructions: 31COMMON

Download Yara Rule

APIs

Part of subcall function 000212F3: ExtCreatePen.GDI32(?,?,00000000,00000000,00000000,?,00000000), ref: 0002134D
Part of subcall function 000212F3: SelectObject.GDI32(?,00000000), ref: 0002135C
Part of subcall function 000212F3: BeginPath.GDI32(?), ref: 00021373
Part of subcall function 000212F3: SelectObject.GDI32(?,00000000), ref: 0002139C

MoveToEx.GDI32(00000000,00000000,?,00000000), ref: 000AC030
LineTo.GDI32(00000000,?,?), ref: 000AC03D
EndPath.GDI32(00000000), ref: 000AC04D
StrokePath.GDI32(00000000), ref: 000AC05B

Memory Dump Source

Source File: 00000000.00000002.1643917647.0000000000021000.00000020.00000001.01000000.00000003.sdmp, Offset: 00020000, based on PE: true

Associated: 00000000.00000002.1643904003.0000000000020000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1643958107.00000000000AF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1643958107.00000000000D5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1643993044.00000000000DF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1644007204.00000000000E8000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_20000_Ship Docs_CI PL HBL COO_.jbxd

Similarity

API ID: Path$ObjectSelect$BeginCreateLineMoveStroke
String ID:
API String ID: 1539411459-0
Opcode ID: 022cf4bdcc67cfa5af0e920ce816a3139373866fb71d2b30891ea728f3c08df9
Instruction ID: de7d5bd718f429468eb7f93d4505897fc846eb54bbdb3a63022054bc7553fbc1
Opcode Fuzzy Hash: 022cf4bdcc67cfa5af0e920ce816a3139373866fb71d2b30891ea728f3c08df9
Instruction Fuzzy Hash: 4AF05E3100165AFBEB226F94EC09FDE3F99AF16711F044100FA11650E28BB95565CF95

Function 0007A37C Relevance: 6.0, APIs: 4, Instructions: 30threadwindowtimeCOMMON

Download Yara Rule

APIs

SendMessageTimeoutW.USER32(?,00000000,00000000,00000000,00000002,00001388,00000001), ref: 0007A399
GetWindowThreadProcessId.USER32(?,00000000), ref: 0007A3AC
GetCurrentThreadId.KERNEL32 ref: 0007A3B3
AttachThreadInput.USER32(00000000), ref: 0007A3BA

Memory Dump Source

Source File: 00000000.00000002.1643917647.0000000000021000.00000020.00000001.01000000.00000003.sdmp, Offset: 00020000, based on PE: true

Associated: 00000000.00000002.1643904003.0000000000020000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1643958107.00000000000AF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1643958107.00000000000D5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1643993044.00000000000DF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1644007204.00000000000E8000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_20000_Ship Docs_CI PL HBL COO_.jbxd

Similarity

API ID: Thread$AttachCurrentInputMessageProcessSendTimeoutWindow
String ID:
API String ID: 2710830443-0
Opcode ID: 528ff556213c13bab0a5cf7d1aebce75d6952b30ddcdf52773dccd4ea80012e5
Instruction ID: ad16c2dcc7cc8a91d4c836b04fd6e5bdc906c47999382ec1885f6d5726725288
Opcode Fuzzy Hash: 528ff556213c13bab0a5cf7d1aebce75d6952b30ddcdf52773dccd4ea80012e5
Instruction Fuzzy Hash: 0AE0C931645629BAEB605FA2DC0DEEB7F5CEF177A2F008025F509D50A0C6798640DBA5

Function 00022218 Relevance: 6.0, APIs: 4, Instructions: 23COMMON

Download Yara Rule

APIs

GetSysColor.USER32(00000008), ref: 00022231
SetTextColor.GDI32(?,000000FF), ref: 0002223B
SetBkMode.GDI32(?,00000001), ref: 00022250
GetStockObject.GDI32(00000005), ref: 00022258
GetWindowDC.USER32(?,00000000), ref: 0005C0D3
GetPixel.GDI32(00000000,00000000,00000000), ref: 0005C0E0
GetPixel.GDI32(00000000,?,00000000), ref: 0005C0F9
GetPixel.GDI32(00000000,00000000,?), ref: 0005C112
GetPixel.GDI32(00000000,?,?), ref: 0005C132
ReleaseDC.USER32(?,00000000), ref: 0005C13D

Memory Dump Source

Source File: 00000000.00000002.1643917647.0000000000021000.00000020.00000001.01000000.00000003.sdmp, Offset: 00020000, based on PE: true

Associated: 00000000.00000002.1643904003.0000000000020000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1643958107.00000000000AF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1643958107.00000000000D5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1643993044.00000000000DF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1644007204.00000000000E8000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_20000_Ship Docs_CI PL HBL COO_.jbxd

Similarity

API ID: Pixel$Color$ModeObjectReleaseStockTextWindow
String ID:
API String ID: 1946975507-0
Opcode ID: 77145f28ea993aa21d9e57ac61335cda509697077b2298c7758439977554ee78
Instruction ID: b0a1893aaf8c9563af334373a4797c9565e22adb9ddcb677528388253e1a4735
Opcode Fuzzy Hash: 77145f28ea993aa21d9e57ac61335cda509697077b2298c7758439977554ee78
Instruction Fuzzy Hash: DBE03932600A45EEEB615FA4FC09BE83B50EB06332F008366FA69480E187764984DB22

Function 00078C5A Relevance: 6.0, APIs: 4, Instructions: 23threadCOMMON

Download Yara Rule

APIs

GetCurrentThread.KERNEL32 ref: 00078C63
OpenThreadToken.ADVAPI32(00000000,?,?,?,0007882E), ref: 00078C6A
GetCurrentProcess.KERNEL32(00000028,?,?,?,?,0007882E), ref: 00078C77
OpenProcessToken.ADVAPI32(00000000,?,?,?,0007882E), ref: 00078C7E

Memory Dump Source

Source File: 00000000.00000002.1643917647.0000000000021000.00000020.00000001.01000000.00000003.sdmp, Offset: 00020000, based on PE: true

Associated: 00000000.00000002.1643904003.0000000000020000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1643958107.00000000000AF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1643958107.00000000000D5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1643993044.00000000000DF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1644007204.00000000000E8000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_20000_Ship Docs_CI PL HBL COO_.jbxd

Similarity

API ID: CurrentOpenProcessThreadToken
String ID:
API String ID: 3974789173-0
Opcode ID: 2b46195a8041ede3d1ad31a2ce1c55121edd0dde5468b8f8af2f2618238a0e55
Instruction ID: e25606d7fbb21896dd816a4f65f449a1b968b4621c88e15ef1f73d4f79b307d6
Opcode Fuzzy Hash: 2b46195a8041ede3d1ad31a2ce1c55121edd0dde5468b8f8af2f2618238a0e55
Instruction Fuzzy Hash: 0DE08636A42212DBE7605FF16D0CFA73BACEF52792F088828B245C9040DA3C8441CB61

Function 00062187 Relevance: 6.0, APIs: 4, Instructions: 20COMMON

Download Yara Rule

APIs

GetDesktopWindow.USER32 ref: 00062187
GetDC.USER32(00000000), ref: 00062191
GetDeviceCaps.GDI32(00000000,0000000C), ref: 000621B1
ReleaseDC.USER32(?), ref: 000621D2

Memory Dump Source

Source File: 00000000.00000002.1643917647.0000000000021000.00000020.00000001.01000000.00000003.sdmp, Offset: 00020000, based on PE: true

Associated: 00000000.00000002.1643904003.0000000000020000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1643958107.00000000000AF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1643958107.00000000000D5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1643993044.00000000000DF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1644007204.00000000000E8000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_20000_Ship Docs_CI PL HBL COO_.jbxd

Similarity

API ID: CapsDesktopDeviceReleaseWindow
String ID:
API String ID: 2889604237-0
Opcode ID: 87695534ad3c48d967333a60bed4aa3ca698b9715b4c0b4a7138bc90554ad00a
Instruction ID: 8a27d5703ed2530f5739abe3a22b592be5c11a7881e005a7272a6193253259d5
Opcode Fuzzy Hash: 87695534ad3c48d967333a60bed4aa3ca698b9715b4c0b4a7138bc90554ad00a
Instruction Fuzzy Hash: 1EE01A75800A15EFEB219FA0D808AAD7BF1EB5D351F108425FD5A97220CB3C81419F40

Function 0006219B Relevance: 6.0, APIs: 4, Instructions: 19COMMON

Download Yara Rule

APIs

GetDesktopWindow.USER32 ref: 0006219B
GetDC.USER32(00000000), ref: 000621A5
GetDeviceCaps.GDI32(00000000,0000000C), ref: 000621B1
ReleaseDC.USER32(?), ref: 000621D2

Memory Dump Source

Source File: 00000000.00000002.1643917647.0000000000021000.00000020.00000001.01000000.00000003.sdmp, Offset: 00020000, based on PE: true

Associated: 00000000.00000002.1643904003.0000000000020000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1643958107.00000000000AF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1643958107.00000000000D5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1643993044.00000000000DF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1644007204.00000000000E8000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_20000_Ship Docs_CI PL HBL COO_.jbxd

Similarity

API ID: CapsDesktopDeviceReleaseWindow
String ID:
API String ID: 2889604237-0
Opcode ID: 2a31edbd80ed3340a81d9cc9fd0a62d12eb24705e49cd94a069d678497953c4c
Instruction ID: e4403f0afe57cd6259faf786922046db2654162c0e58e3e9ef021ef040e418b7
Opcode Fuzzy Hash: 2a31edbd80ed3340a81d9cc9fd0a62d12eb24705e49cd94a069d678497953c4c
Instruction Fuzzy Hash: F1E012B5C00A16AFEB219FB0D808AADBBF1EB4D311F108029F95AA7220CB3C91419F40

Function 0007B7B6 Relevance: 5.5, APIs: 1, Strings: 2, Instructions: 241comCOMMON

Download Yara Rule

APIs

OleSetContainedObject.OLE32(?,00000001), ref: 0007B981

Strings

AutoIt3GUI, xrefs: 0007B8F9
Container, xrefs: 0007B8FE

Memory Dump Source

Source File: 00000000.00000002.1643917647.0000000000021000.00000020.00000001.01000000.00000003.sdmp, Offset: 00020000, based on PE: true

Associated: 00000000.00000002.1643904003.0000000000020000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1643958107.00000000000AF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1643958107.00000000000D5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1643993044.00000000000DF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1644007204.00000000000E8000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_20000_Ship Docs_CI PL HBL COO_.jbxd

Similarity

API ID: ContainedObject
String ID: AutoIt3GUI$Container
API String ID: 3565006973-3941886329
Opcode ID: 3df621886ab8ddfd384c747e78122a3e347b39afc7328f1a778277e0255f26d8
Instruction ID: 2b0bb8b85158c64c26918c949e1f9f88978f3d6bf59152a6a43498942772f6ce
Opcode Fuzzy Hash: 3df621886ab8ddfd384c747e78122a3e347b39afc7328f1a778277e0255f26d8
Instruction Fuzzy Hash: 03915C70600601AFDB64DF28C884BAABBF9FF48710F14856EF949CB691DB75E840CB65

Function 0008B217 Relevance: 5.5, APIs: 2, Strings: 1, Instructions: 201shareCOMMON

Download Yara Rule

APIs

Part of subcall function 0003FEC6: _wcscpy.LIBCMT ref: 0003FEE9

Part of subcall function 00029997: __itow.LIBCMT ref: 000299C2
Part of subcall function 00029997: __swprintf.LIBCMT ref: 00029A0C

__wcsnicmp.LIBCMT ref: 0008B298
WNetUseConnectionW.MPR(00000000,?,?,00000000,?,?,00000100,?), ref: 0008B361

Strings

LPT, xrefs: 0008B292

Memory Dump Source

Source File: 00000000.00000002.1643917647.0000000000021000.00000020.00000001.01000000.00000003.sdmp, Offset: 00020000, based on PE: true

Associated: 00000000.00000002.1643904003.0000000000020000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1643958107.00000000000AF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1643958107.00000000000D5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1643993044.00000000000DF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1644007204.00000000000E8000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_20000_Ship Docs_CI PL HBL COO_.jbxd

Similarity

API ID: Connection__itow__swprintf__wcsnicmp_wcscpy
String ID: LPT
API String ID: 3222508074-1350329615
Opcode ID: 7e00a33af801d4b7c8c5e6a56d37f36812a7bdce9b060c6cda24abdef78c6e8b
Instruction ID: 25db27f4d2f81920320232e0fd3487a3debc7a95ec7e8ec237fc8a1c9871881d
Opcode Fuzzy Hash: 7e00a33af801d4b7c8c5e6a56d37f36812a7bdce9b060c6cda24abdef78c6e8b
Instruction Fuzzy Hash: EA616375A00215EFDB14EF94C885EEEB7F4BF08310F154569F586AB252DB70AE40CB51

Function 00032AB7 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 144sleepCOMMON

Download Yara Rule

APIs

Sleep.KERNEL32(00000000), ref: 00032AC8
GlobalMemoryStatusEx.KERNEL32(?), ref: 00032AE1

Strings

@, xrefs: 00032AD5

Memory Dump Source

Source File: 00000000.00000002.1643917647.0000000000021000.00000020.00000001.01000000.00000003.sdmp, Offset: 00020000, based on PE: true

Associated: 00000000.00000002.1643904003.0000000000020000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1643958107.00000000000AF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1643958107.00000000000D5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1643993044.00000000000DF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1644007204.00000000000E8000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_20000_Ship Docs_CI PL HBL COO_.jbxd

Similarity

API ID: GlobalMemorySleepStatus
String ID: @
API String ID: 2783356886-2766056989
Opcode ID: 1eb510191801bc39680273d6f33ec698d9f2fdbda5bfaeceb8dde43d364c9f53
Instruction ID: b655400439529b4e66fdb6fed1d78bb7032626c4453bc583925beed991c1501f
Opcode Fuzzy Hash: 1eb510191801bc39680273d6f33ec698d9f2fdbda5bfaeceb8dde43d364c9f53
Instruction Fuzzy Hash: EC5158714187549BE320AF50EC86BABBBE8FF84310F42485DF6D9411A6DB348929CB66

Function 000899BE Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 138COMMON

Download Yara Rule

APIs

Part of subcall function 0002506B: __fread_nolock.LIBCMT ref: 00025089

_wcscmp.LIBCMT ref: 00089AAE
_wcscmp.LIBCMT ref: 00089AC1

Strings

FILE, xrefs: 000899FA

Memory Dump Source

Source File: 00000000.00000002.1643917647.0000000000021000.00000020.00000001.01000000.00000003.sdmp, Offset: 00020000, based on PE: true

Associated: 00000000.00000002.1643904003.0000000000020000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1643958107.00000000000AF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1643958107.00000000000D5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1643993044.00000000000DF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1644007204.00000000000E8000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_20000_Ship Docs_CI PL HBL COO_.jbxd

Similarity

API ID: _wcscmp$__fread_nolock
String ID: FILE
API String ID: 4029003684-3121273764
Opcode ID: 11414fe14082b86a62493b416c6d3c1533641cf1d44a01220667cc7644f90359
Instruction ID: 6ae0701533bea39879495ca02bd74451d8652ba05563e211111ad269bd8f07da
Opcode Fuzzy Hash: 11414fe14082b86a62493b416c6d3c1533641cf1d44a01220667cc7644f90359
Instruction Fuzzy Hash: D341B571A00619BADF20AAA4DC85FEFBBBDEF45710F040079B940A7182DA759A0487A5

Function 00092882 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 97networkCOMMON

Download Yara Rule

APIs

_memset.LIBCMT ref: 00092892
InternetCrackUrlW.WININET(?,00000000,00000000,0000007C), ref: 000928C8

Strings

|, xrefs: 00092899

Memory Dump Source

Source File: 00000000.00000002.1643917647.0000000000021000.00000020.00000001.01000000.00000003.sdmp, Offset: 00020000, based on PE: true

Associated: 00000000.00000002.1643904003.0000000000020000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1643958107.00000000000AF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1643958107.00000000000D5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1643993044.00000000000DF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1644007204.00000000000E8000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_20000_Ship Docs_CI PL HBL COO_.jbxd

Similarity

API ID: CrackInternet_memset
String ID: |
API String ID: 1413715105-2343686810
Opcode ID: 5f07a57b4cddd4aacecea59067a0badad5f3fe063843854a4e4c41e26065f518
Instruction ID: 2c0632b05d68fef336fa9dd1fffb376725d1570153361403584e03d2080e9626
Opcode Fuzzy Hash: 5f07a57b4cddd4aacecea59067a0badad5f3fe063843854a4e4c41e26065f518
Instruction Fuzzy Hash: DD310A71801119AFCF11DFA1DC85EEEBFB9FF09310F10406AF815A6166EA315A56DBA0

Function 000A6CD2 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 95COMMON

Download Yara Rule

APIs

DestroyWindow.USER32(?,?,?,?), ref: 000A6D86
MoveWindow.USER32(?,?,?,?,?,00000001,?,?,?), ref: 000A6DC2

Strings

static, xrefs: 000A6D22

Memory Dump Source

Source File: 00000000.00000002.1643917647.0000000000021000.00000020.00000001.01000000.00000003.sdmp, Offset: 00020000, based on PE: true

Associated: 00000000.00000002.1643904003.0000000000020000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1643958107.00000000000AF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1643958107.00000000000D5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1643993044.00000000000DF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1644007204.00000000000E8000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_20000_Ship Docs_CI PL HBL COO_.jbxd

Similarity

API ID: Window$DestroyMove
String ID: static
API String ID: 2139405536-2160076837
Opcode ID: 252ab7a7df18da10a7b60cc83a384fa4061291a333e853f32c151b19c2ebcbdb
Instruction ID: 3255f4bf61731402242b3ee559357c8b78519c2915d7cbad2dffe13c04e1879d
Opcode Fuzzy Hash: 252ab7a7df18da10a7b60cc83a384fa4061291a333e853f32c151b19c2ebcbdb
Instruction Fuzzy Hash: 1F31A171600604AEEB109FB4DC80AFB77B9FF49760F148619F9A597191CA31AC51CB60

Function 00082D91 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 88windowCOMMON

Download Yara Rule

APIs

_memset.LIBCMT ref: 00082E00
GetMenuItemInfoW.USER32(?,?,00000000,00000030), ref: 00082E3B

Strings

0, xrefs: 00082DF9

Memory Dump Source

Source File: 00000000.00000002.1643917647.0000000000021000.00000020.00000001.01000000.00000003.sdmp, Offset: 00020000, based on PE: true

Associated: 00000000.00000002.1643904003.0000000000020000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1643958107.00000000000AF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1643958107.00000000000D5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1643993044.00000000000DF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1644007204.00000000000E8000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_20000_Ship Docs_CI PL HBL COO_.jbxd

Similarity

API ID: InfoItemMenu_memset
String ID: 0
API String ID: 2223754486-4108050209
Opcode ID: 1920445aba6078623069edc018133e61d1e6335f15c28c4fc845845e44041713
Instruction ID: e92bd33e03fbfb599179fe659b1891b9ddc676c3cfdd4fe3b3926d4f4d32b481
Opcode Fuzzy Hash: 1920445aba6078623069edc018133e61d1e6335f15c28c4fc845845e44041713
Instruction Fuzzy Hash: C631F571A00309ABEB64AF58D885BEEBBF9FF05340F14003AE9C5A61A1D7709980CB18

Function 000A6943 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 72windowCOMMON

Download Yara Rule

APIs

SendMessageW.USER32(00000000,00000143,00000000,?), ref: 000A69D0
SendMessageW.USER32(?,0000014E,00000000,00000000), ref: 000A69DB

Strings

Combobox, xrefs: 000A699D

Memory Dump Source

Source File: 00000000.00000002.1643917647.0000000000021000.00000020.00000001.01000000.00000003.sdmp, Offset: 00020000, based on PE: true

Associated: 00000000.00000002.1643904003.0000000000020000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1643958107.00000000000AF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1643958107.00000000000D5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1643993044.00000000000DF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1644007204.00000000000E8000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_20000_Ship Docs_CI PL HBL COO_.jbxd

Similarity

API ID: MessageSend
String ID: Combobox
API String ID: 3850602802-2096851135
Opcode ID: 77049d1faeec3a0a63327ee8c293e5bee5af0d88cd596b0fb8c502be5f04e01f
Instruction ID: 4f0ab364bcc1bdce8bd7920f5008ea8f9a28258d6050b830d93e3ec114657898
Opcode Fuzzy Hash: 77049d1faeec3a0a63327ee8c293e5bee5af0d88cd596b0fb8c502be5f04e01f
Instruction Fuzzy Hash: CC110471300208AFEF118F94CC80EFB37BEEB9A3A4F150125F9589B291D6369C5087A0

Function 000A6E76 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 68COMMON

Download Yara Rule

APIs

Part of subcall function 00021D35: CreateWindowExW.USER32(?,?,?,?,?,?,?,?,?,?,00000000,00000096), ref: 00021D73
Part of subcall function 00021D35: GetStockObject.GDI32(00000011), ref: 00021D87
Part of subcall function 00021D35: SendMessageW.USER32(00000000,00000030,00000000), ref: 00021D91

GetWindowRect.USER32(00000000,?), ref: 000A6EE0
GetSysColor.USER32(00000012), ref: 000A6EFA

Strings

static, xrefs: 000A6EBD

Memory Dump Source

Source File: 00000000.00000002.1643917647.0000000000021000.00000020.00000001.01000000.00000003.sdmp, Offset: 00020000, based on PE: true

Associated: 00000000.00000002.1643904003.0000000000020000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1643958107.00000000000AF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1643958107.00000000000D5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1643993044.00000000000DF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1644007204.00000000000E8000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_20000_Ship Docs_CI PL HBL COO_.jbxd

Similarity

API ID: Window$ColorCreateMessageObjectRectSendStock
String ID: static
API String ID: 1983116058-2160076837
Opcode ID: 4176b7f6e2a939445854399b9900694f751981b167afae119a76a817f535adeb
Instruction ID: 69d68c7d2fe8722471f210e914462e2e7fef69420bcac60bad819d1820cdcfd2
Opcode Fuzzy Hash: 4176b7f6e2a939445854399b9900694f751981b167afae119a76a817f535adeb
Instruction Fuzzy Hash: 2B21597261020AAFDB04DFE8DC45AFA7BF8FB09314F044629FA55D3250D635E861DB50

Function 000A6B8F Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 64windowCOMMON

Download Yara Rule

APIs

GetWindowTextLengthW.USER32(00000000), ref: 000A6C11
SendMessageW.USER32(?,000000B1,00000000,00000000), ref: 000A6C20

Strings

edit, xrefs: 000A6BF5

Memory Dump Source

Source File: 00000000.00000002.1643917647.0000000000021000.00000020.00000001.01000000.00000003.sdmp, Offset: 00020000, based on PE: true

Associated: 00000000.00000002.1643904003.0000000000020000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1643958107.00000000000AF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1643958107.00000000000D5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1643993044.00000000000DF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1644007204.00000000000E8000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_20000_Ship Docs_CI PL HBL COO_.jbxd

Similarity

API ID: LengthMessageSendTextWindow
String ID: edit
API String ID: 2978978980-2167791130
Opcode ID: 18e983a4dc1ad0a372e6d661731ff82ef6b91ea3625f172e20b8c46e574f588a
Instruction ID: d95ff5491ea6c22117c1640fe516e8664e02a78325108830275147879191eb00
Opcode Fuzzy Hash: 18e983a4dc1ad0a372e6d661731ff82ef6b91ea3625f172e20b8c46e574f588a
Instruction Fuzzy Hash: E2118F71510108ABEB505EA4DC41AFB37B9EB163B8F144724F961D71E0C776DC919B60

Function 00082E9E Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 63windowCOMMON

Download Yara Rule

APIs

_memset.LIBCMT ref: 00082F11
GetMenuItemInfoW.USER32(00000030,?,00000000,00000030), ref: 00082F30

Strings

0, xrefs: 00082F07

Memory Dump Source

Source File: 00000000.00000002.1643917647.0000000000021000.00000020.00000001.01000000.00000003.sdmp, Offset: 00020000, based on PE: true

Associated: 00000000.00000002.1643904003.0000000000020000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1643958107.00000000000AF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1643958107.00000000000D5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1643993044.00000000000DF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1644007204.00000000000E8000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_20000_Ship Docs_CI PL HBL COO_.jbxd

Similarity

API ID: InfoItemMenu_memset
String ID: 0
API String ID: 2223754486-4108050209
Opcode ID: 54e810a7dbefd61367ca894e1d25ced668e5773e6ad72d30ba1ef69b3029826d
Instruction ID: 2e7ef4e28674e182ffbf9611a551da67f10c0a927908660579df53a17e300b90
Opcode Fuzzy Hash: 54e810a7dbefd61367ca894e1d25ced668e5773e6ad72d30ba1ef69b3029826d
Instruction Fuzzy Hash: 5B11E231D01114ABDB20FB58DC44BAE73F9FB11350F0800B6EA94B72A1DBB0AD04C799

Function 000924CA Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 62networkCOMMON

Download Yara Rule

APIs

InternetOpenW.WININET(?,00000000,00000000,00000000,00000000), ref: 00092520
InternetSetOptionW.WININET(00000000,00000032,?,00000008), ref: 00092549

Strings

<local>, xrefs: 00092511

Memory Dump Source

Source File: 00000000.00000002.1643917647.0000000000021000.00000020.00000001.01000000.00000003.sdmp, Offset: 00020000, based on PE: true

Associated: 00000000.00000002.1643904003.0000000000020000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1643958107.00000000000AF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1643958107.00000000000D5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1643993044.00000000000DF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1644007204.00000000000E8000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_20000_Ship Docs_CI PL HBL COO_.jbxd

Similarity

API ID: Internet$OpenOption
String ID: <local>
API String ID: 942729171-4266983199
Opcode ID: 00d6368e9c1424439c7df8952acc4ff73a31681dd2842b48759946a1c5d7fd7a
Instruction ID: 7b9fc79fd9544ad4d5e14a679a31b2d59055a816dc74a05e5558a386cf6df0a7
Opcode Fuzzy Hash: 00d6368e9c1424439c7df8952acc4ff73a31681dd2842b48759946a1c5d7fd7a
Instruction Fuzzy Hash: 9411C270505A25BADF248F618C99EFBFFA8FF06751F11812AF90586140D270A991EAF0

Function 000980A0 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 55networkCOMMON

Download Yara Rule

APIs

Part of subcall function 0009830B: WideCharToMultiByte.KERNEL32(00000000,00000000,?,?,00000000,00000000,00000000,00000000,?,?,?,000980C8,?,00000000,?,?), ref: 00098322

inet_addr.WSOCK32(00000000,?,00000000,?,?,?,00000000), ref: 000980CB
htons.WSOCK32(00000000,?,00000000), ref: 00098108

Strings

255.255.255.255, xrefs: 000980E3

Memory Dump Source

Source File: 00000000.00000002.1643917647.0000000000021000.00000020.00000001.01000000.00000003.sdmp, Offset: 00020000, based on PE: true

Associated: 00000000.00000002.1643904003.0000000000020000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1643958107.00000000000AF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1643958107.00000000000D5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1643993044.00000000000DF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1644007204.00000000000E8000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_20000_Ship Docs_CI PL HBL COO_.jbxd

Similarity

API ID: ByteCharMultiWidehtonsinet_addr
String ID: 255.255.255.255
API String ID: 2496851823-2422070025
Opcode ID: ac1eb0001bd48f7fb8f4bbf92719a6cf8c496ef5abe7c097d581a59f3c4c9388
Instruction ID: 2f1583ec6062765e9c1054a6e02fa38128fc387163ad7ac5535e36a2da72ccb0
Opcode Fuzzy Hash: ac1eb0001bd48f7fb8f4bbf92719a6cf8c496ef5abe7c097d581a59f3c4c9388
Instruction Fuzzy Hash: 5711CE34604205ABDF20AFA4CC46FFDB368EF46320F10C526EA1697392DA32A811D795

Function 000792E7 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 52windowCOMMON

Download Yara Rule

APIs

Part of subcall function 00027F41: _memmove.LIBCMT ref: 00027F82

Part of subcall function 0007B0C4: GetClassNameW.USER32(?,?,000000FF), ref: 0007B0E7

SendMessageW.USER32(?,000001A2,000000FF,?), ref: 00079355

Strings

ComboBox, xrefs: 000792F4
ListBox, xrefs: 0007931F

Memory Dump Source

Source File: 00000000.00000002.1643917647.0000000000021000.00000020.00000001.01000000.00000003.sdmp, Offset: 00020000, based on PE: true

Associated: 00000000.00000002.1643904003.0000000000020000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1643958107.00000000000AF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1643958107.00000000000D5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1643993044.00000000000DF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1644007204.00000000000E8000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_20000_Ship Docs_CI PL HBL COO_.jbxd

Similarity

API ID: ClassMessageNameSend_memmove
String ID: ComboBox$ListBox
API String ID: 372448540-1403004172
Opcode ID: c84482df553435ec20b10e96e96837130c2137d2cb2b6f536d2983e31ea07f57
Instruction ID: 41d1a075a3f8d639b47f8a9b632c514f7228b04f265e6756006a7fbb0aeb04d1
Opcode Fuzzy Hash: c84482df553435ec20b10e96e96837130c2137d2cb2b6f536d2983e31ea07f57
Instruction Fuzzy Hash: 1B01F171E05228ABCB04EBA0CC928FE77ADBF06320B144629F936672D2DB3559088764

Function 000791DF Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 50windowCOMMON

Download Yara Rule

APIs

Part of subcall function 00027F41: _memmove.LIBCMT ref: 00027F82

Part of subcall function 0007B0C4: GetClassNameW.USER32(?,?,000000FF), ref: 0007B0E7

SendMessageW.USER32(?,00000180,00000000,?), ref: 0007924D

Strings

ComboBox, xrefs: 000791EC
ListBox, xrefs: 00079217

Memory Dump Source

Source File: 00000000.00000002.1643917647.0000000000021000.00000020.00000001.01000000.00000003.sdmp, Offset: 00020000, based on PE: true

Associated: 00000000.00000002.1643904003.0000000000020000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1643958107.00000000000AF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1643958107.00000000000D5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1643993044.00000000000DF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1644007204.00000000000E8000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_20000_Ship Docs_CI PL HBL COO_.jbxd

Similarity

API ID: ClassMessageNameSend_memmove
String ID: ComboBox$ListBox
API String ID: 372448540-1403004172
Opcode ID: af25206332f735121b2a057f7c0c4b0806fccddb1f3358f5e1470c082e0e0034
Instruction ID: bc93114a4fb2f693b150a78ecbf4c50a9c7ad52c8b1277f85e62e2e1ff54dcf5
Opcode Fuzzy Hash: af25206332f735121b2a057f7c0c4b0806fccddb1f3358f5e1470c082e0e0034
Instruction Fuzzy Hash: E201F771E452087BCF14FBA0D992EFF77AC9F05300F144169B91A67293EA285F0C82B5

Function 00079264 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 49windowCOMMON

Download Yara Rule

APIs

Part of subcall function 00027F41: _memmove.LIBCMT ref: 00027F82

Part of subcall function 0007B0C4: GetClassNameW.USER32(?,?,000000FF), ref: 0007B0E7

SendMessageW.USER32(?,00000182,?,00000000), ref: 000792D0

Strings

ComboBox, xrefs: 00079271
ListBox, xrefs: 0007929C

Memory Dump Source

Source File: 00000000.00000002.1643917647.0000000000021000.00000020.00000001.01000000.00000003.sdmp, Offset: 00020000, based on PE: true

Associated: 00000000.00000002.1643904003.0000000000020000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1643958107.00000000000AF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1643958107.00000000000D5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1643993044.00000000000DF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1644007204.00000000000E8000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_20000_Ship Docs_CI PL HBL COO_.jbxd

Similarity

API ID: ClassMessageNameSend_memmove
String ID: ComboBox$ListBox
API String ID: 372448540-1403004172
Opcode ID: 5cea1a721f381075b5e3a97605cd0ceab079efc60d1c86ff3a3052733b80f639
Instruction ID: c9cdb448d388e5ac3f55773d0bc0aa5e710ef397a81ebae211693879ea2b6ba9
Opcode Fuzzy Hash: 5cea1a721f381075b5e3a97605cd0ceab079efc60d1c86ff3a3052733b80f639
Instruction Fuzzy Hash: EA01A271E4521877CF14FAA0D992EFF77AC9F11300F244125B91A77283DA295E0896BA

Function 000851CA Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 29COMMON

Download Yara Rule

APIs

GetClassNameW.USER32(?,?,00000100), ref: 000851E8
_wcscmp.LIBCMT ref: 000851FA

Strings

#32770, xrefs: 000851F4

Memory Dump Source

Source File: 00000000.00000002.1643917647.0000000000021000.00000020.00000001.01000000.00000003.sdmp, Offset: 00020000, based on PE: true

Associated: 00000000.00000002.1643904003.0000000000020000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1643958107.00000000000AF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1643958107.00000000000D5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1643993044.00000000000DF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1644007204.00000000000E8000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_20000_Ship Docs_CI PL HBL COO_.jbxd

Similarity

API ID: ClassName_wcscmp
String ID: #32770
API String ID: 2292705959-463685578
Opcode ID: f87bb1ab337315e5c47c2a6a3f6040a590f6a7abb8527153f6c7cd09f46cd91c
Instruction ID: e6d593c5c36ac4cf1bfc8ec857782c28af246034a7125e7ce93499be42645ce4
Opcode Fuzzy Hash: f87bb1ab337315e5c47c2a6a3f6040a590f6a7abb8527153f6c7cd09f46cd91c
Instruction Fuzzy Hash: 51E06173A0472D17E320A6999C49FB7F7ECEB41731F000167FD54D7040D560990587E0

Function 000781BC Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 22windowCOMMON

Download Yara Rule

APIs

MessageBoxW.USER32(00000000,Error allocating memory.,AutoIt,00000010), ref: 000781CA

Part of subcall function 00043598: _doexit.LIBCMT ref: 000435A2

Strings

Error allocating memory., xrefs: 000781C3
AutoIt, xrefs: 000781BE

Memory Dump Source

Source File: 00000000.00000002.1643917647.0000000000021000.00000020.00000001.01000000.00000003.sdmp, Offset: 00020000, based on PE: true

Associated: 00000000.00000002.1643904003.0000000000020000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1643958107.00000000000AF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1643958107.00000000000D5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1643993044.00000000000DF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1644007204.00000000000E8000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_20000_Ship Docs_CI PL HBL COO_.jbxd

Similarity

API ID: Message_doexit
String ID: AutoIt$Error allocating memory.
API String ID: 1993061046-4017498283
Opcode ID: cfbc1940a8b0583a67e12537ae2528492545e095b132829b47d7629ee0a4b79a
Instruction ID: 3a973a7834f0c63006267ca17825fb8e7bb62bf2952418ff951a4b5186349d1d
Opcode Fuzzy Hash: cfbc1940a8b0583a67e12537ae2528492545e095b132829b47d7629ee0a4b79a
Instruction Fuzzy Hash: 6BD05E723C532832E21432E87C0BFCA7A884F05B52F448036BB08995D3CEE699D242ED

Function 0005B511 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 22COMMON

Download Yara Rule

APIs

Part of subcall function 0005B564: _memset.LIBCMT ref: 0005B571

Part of subcall function 00040B84: InitializeCriticalSectionAndSpinCount.KERNEL32(?,00000000,?,0005B540,?,?,?,0002100A), ref: 00040B89

IsDebuggerPresent.KERNEL32(?,?,?,0002100A), ref: 0005B544
OutputDebugStringW.KERNEL32(ERROR : Unable to initialize critical section in CAtlBaseModule,?,?,?,0002100A), ref: 0005B553

Strings

ERROR : Unable to initialize critical section in CAtlBaseModule, xrefs: 0005B54E

Memory Dump Source

Source File: 00000000.00000002.1643917647.0000000000021000.00000020.00000001.01000000.00000003.sdmp, Offset: 00020000, based on PE: true

Associated: 00000000.00000002.1643904003.0000000000020000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1643958107.00000000000AF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1643958107.00000000000D5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1643993044.00000000000DF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1644007204.00000000000E8000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_20000_Ship Docs_CI PL HBL COO_.jbxd

Similarity

API ID: CountCriticalDebugDebuggerInitializeOutputPresentSectionSpinString_memset
String ID: ERROR : Unable to initialize critical section in CAtlBaseModule
API String ID: 3158253471-631824599
Opcode ID: f28e6dc4f2a6381264aa010f9886a2955e3ee9f65b126525381c5bf475b93e76
Instruction ID: 98377b4ed482ab1387c9aaf8731120e5384e90f650f1c88167caad918bb22306
Opcode Fuzzy Hash: f28e6dc4f2a6381264aa010f9886a2955e3ee9f65b126525381c5bf475b93e76
Instruction Fuzzy Hash: 90E092B0200B11CFE725DF68E4047477BE4AF00745F00892CE946DB652E7B9E408CBA1

Description:	Adversaries may obtain and abuse credentials of existing accounts as a means of gaining Initial Access, Persistence, Privilege Escalation, or Defense Evasion. Compromised credentials may be used to bypass access controls placed on various resources on systems within the network and may even be used for persistent access to remote systems and externally available services, such as VPNs, Outlook Web Access, network devices, and remote desktop.Compromised credentials may also grant an adversary increased privilege to specific systems or access to restricted areas of the network. Adversaries may choose not to use malware or tools in conjunction with the legitimate access those credentials provide to make it harder to detect their presence.
Tactics:	Defense Evasion, Initial Access, Persistence, Privilege Escalation
Data Sources:	Logon Session: Logon Session Creation, Logon Session: Logon Session Metadata, User Account: User Account Authentication
Platforms:	Azure AD, Containers, Google Workspace, IaaS, Linux, macOS, Network, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse Windows Management Instrumentation (WMI) to execute malicious commands and payloads. WMI is an administration feature that provides a uniform environment to access Windows system components. The WMI service enables both local and remote access, though the latter is facilitated by Remote Services such as Distributed Component Object Model (DCOM) and Windows Remote Management (WinRM).Remote WMI over DCOM operates using port 135, whereas WMI over WinRM operates over port 5985 when using HTTP and 5986 for HTTPS.
Tactics:	Execution
Data Sources:	Command: Command Execution, Network Traffic: Network Connection Creation, Process: Process Creation, WMI: WMI Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may interact with the native OS application programming interface (API) to execute behaviors. Native APIs provide a controlled means of calling low-level OS services within the kernel, such as those involving hardware/devices, memory, and processes.These native APIs are leveraged by the OS during system boot (when other system components are not yet initialized) as well as carrying out tasks and requests during routine operations.
Tactics:	Execution
Data Sources:	Module: Module Load, Process: OS API Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may execute their own malicious payloads by side-loading DLLs. Similar to DLL Search Order Hijacking , side-loading involves hijacking which DLL a program loads. But rather than just planting the DLL within the search order of a program then waiting for the victim application to be invoked, adversaries may directly side-load their payloads by planting then invoking a legitimate application that executes their payload(s).
Tactics:	Defense Evasion, Persistence, Privilege Escalation
Data Sources:	File: File Creation, File: File Modification, Module: Module Load, Process: Process Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may exploit software vulnerabilities in an attempt to elevate privileges. Exploitation of a software vulnerability occurs when an adversary takes advantage of a programming error in a program, service, or within the operating system software or kernel itself to execute adversary-controlled code. Security constructs such as permission levels will often hinder access to information and use of certain techniques, so adversaries will likely need to perform privilege escalation to include use of software exploitation to circumvent those restrictions.
Tactics:	Privilege Escalation
Data Sources:	Driver: Driver Load, Process: Process Creation
Platforms:	Containers, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may modify access tokens to operate under a different user or system security context to perform actions and bypass access controls. Windows uses access tokens to determine the ownership of a running process. A user can manipulate access tokens to make a running process appear as though it is the child of a different process or belongs to someone other than the user that started the process. When this occurs, the process also takes on the security context associated with the new token.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	Active Directory: Active Directory Object Modification, Command: Command Execution, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, User Account: User Account Metadata
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	File: File Metadata, File: File Modification, Module: Module Load, Process: OS API Execution, Process: Process Access, Process: Process Metadata, Process: Process Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may modify and/or disable security tools to avoid possible detection of their malware/tools and activities. This may take many forms, such as killing security software processes or services, modifying / deleting Registry keys or configuration files so that tools do not operate properly, or other methods to interfere with security tools scanning or reporting information. Adversaries may also disable updates to prevent the latest security patches from reaching tools on victim systems.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, Driver: Driver Load, Process: Process Creation, Process: Process Termination, Sensor Health: Host Status, Service: Service Metadata, Windows Registry: Windows Registry Key Deletion, Windows Registry: Windows Registry Key Modification
Platforms:	Containers, IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use Obfuscated Files or Information to hide artifacts of an intrusion from analysis. They may require separate mechanisms to decode or deobfuscate that information depending on how they intend to use it. Methods for doing that include built-in functionality of malware or by using utilities present on the system.
Tactics:	Defense Evasion
Data Sources:	File: File Modification, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit. This is common behavior that can be used across different platforms and the network to evade defenses.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Creation, File: File Metadata, Module: Module Load, Process: OS API Execution, Process: Process Creation, Script: Script Execution, WMI: WMI Creation, Windows Registry: Windows Registry Key Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ various means to detect and avoid virtualization and analysis environments. This may include changing behaviors based on the results of checks for the presence of artifacts indicative of a virtual machine environment (VME) or sandbox. If the adversary detects a VME, they may alter their malware to disengage from the victim or conceal the core functions of the implant. They may also search for VME artifacts before dropping secondary or additional payloads. Adversaries may use the information learned from [Virtualization/Sandbox Evasion](https://attack.mitre.org/techniques/T1497) during automated discovery to shape follow-on behaviors.
Tactics:	Defense Evasion, Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to dump credentials to obtain account login and credential material, normally in the form of a hash or a clear text password, from the operating system and software. Credentials can then be used to perform Lateral Movement and access restricted information.
Tactics:	Credential Access
Data Sources:	Active Directory: Active Directory Object Access, Command: Command Execution, File: File Access, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow, Process: OS API Execution, Process: Process Access, Process: Process Creation, Windows Registry: Windows Registry Key Access
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use methods of capturing user input to obtain credentials or collect information. During normal system usage, users often provide credentials to various different locations, such as login pages/portals or system dialog boxes. Input capture mechanisms may be transparent to the user (e.g. Credential API Hooking ) or rely on deceiving the user into providing input into what they believe to be a genuine service (e.g. Web Portal Capture ).
Tactics:	Collection, Credential Access
Data Sources:	Driver: Driver Load, File: File Modification, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, Windows Registry: Windows Registry Key Modification
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may search the Registry on compromised systems for insecurely stored credentials. The Windows Registry stores configuration information that can be used by the system or other programs. Adversaries may query the Registry looking for credentials and passwords that have been stored for use by other programs or services. Sometimes these credentials are used for automatic logons.
Tactics:	Credential Access
Data Sources:	Command: Command Execution, Process: Process Creation, Windows Registry: Windows Registry Key Access
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	An adversary may gather the system time and/or time zone from a local or remote system. The system time is set and stored by the Windows Time Service within a domain to maintain time synchronization between systems and services in an enterprise network.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of valid accounts, usernames, or email addresses on a system or within a compromised environment. This information can help adversaries determine which accounts exist, which can aid in follow-on behavior such as brute-forcing, spear-phishing attacks, or account takeovers (e.g., Valid Accounts ).
Tactics:	Discovery
Data Sources:	Command: Command Execution, File: File Access, Process: Process Creation
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may enumerate files and directories or may search in specific locations of a host or network share for certain information within a file system. Adversaries may use the information from File and Directory Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get information about running processes on a system. Information obtained could be used to gain an understanding of common software/applications running on systems within the network. Adversaries may use the information from Process Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to identify the primary user, currently logged in user, set of users that commonly uses a system, or whether a user is actively using the system. They may do this, for example, by retrieving account usernames or by using OS Credential Dumping . The information may be collected in a number of different ways using other Discovery techniques, because user and username details are prevalent throughout a system and include running process ownership, file/directory ownership, session information, and system logs. Adversaries may use the information from [System Owner/User Discovery](https://attack.mitre.org/techniques/T1033) during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Active Directory: Active Directory Object Access, Command: Command Execution, File: File Access, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow, Process: OS API Execution, Process: Process Access, Process: Process Creation, Windows Registry: Windows Registry Key Access
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report Ship Docs_CI PL HBL COO_.exe

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Threat Intel

Malware Configuration

Threatname: Agenttesla

Yara Signatures

Memory Dumps

Unpacked PEs

Sigma Signatures

System Summary

Snort Signatures

Joe Sandbox Signatures

AV Detection

Compliance

Spreading

Networking

Key, Mouse, Clipboard, Microphone and Screen Capturing

System Summary

Data Obfuscation

Persistence and Installation Behavior

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

Anti Debugging

HIPS / PFW / Operating System Protection Evasion

Language, Device and Operating System Detection

Stealing of Sensitive Information

Remote Access Functionality

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

Contacted URLs

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

General Information

Warnings

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

C:\Users\user\AppData\Local\Temp\Graff

C:\Users\user\AppData\Local\Temp\aut5F9C.tmp

C:\Users\user\AppData\Local\Temp\aut5FCC.tmp

C:\Users\user\AppData\Local\Temp\vehiculation

Static File Info

General

File Icon

Static PE Info

General

Entrypoint Preview

Rich Headers

Data Directories

Sections

Resources

Windows Analysis Report
Ship Docs_CI PL HBL COO_.exe

Function 00023B4C Relevance: 17.7, APIs: 8, Strings: 2, Instructions: 153
windowCOMMON

Function 00024AFE Relevance: 10.7, APIs: 7, Instructions: 223
COMMON

Function 00024FE9 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 62
COMMON

Function 000893DF Relevance: 19.8, APIs: 13, Instructions: 322
fileCOMMON

Function 00023015 Relevance: 19.3, APIs: 7, Strings: 4, Instructions: 71
windowregistryCOMMON

Function 00023041 Relevance: 19.3, APIs: 7, Strings: 4, Instructions: 54
windowregistryCOMMON

Function 000271EB Relevance: 17.7, APIs: 6, Strings: 4, Instructions: 201
registryCOMMON

Function 00023A58 Relevance: 17.6, APIs: 7, Strings: 3, Instructions: 71
windowregistryCOMMON

Function 00023633 Relevance: 15.9, APIs: 8, Strings: 1, Instructions: 151
windowtimeregistryCOMMON

Function 00023778 Relevance: 14.3, APIs: 1, Strings: 7, Instructions: 267
COMMON

Function 019D25D0 Relevance: 10.7, APIs: 7, Instructions: 239
fileCOMMON

Function 000239E7 Relevance: 10.5, APIs: 4, Strings: 2, Instructions: 44
COMMON

Function 019D23B0 Relevance: 8.9, APIs: 4, Strings: 1, Instructions: 141
fileCOMMON

Function 0002410D Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 88
windowCOMMON

Function 0004564D Relevance: 7.7, APIs: 5, Instructions: 163
COMMONLIBRARYCODE

Description:	Adversaries may look for details about the network configuration and settings, such as IP and/or MAC addresses, of systems they access or through information discovery of remote systems. Several operating system administration utilities exist that can be used to gather this information. Examples include Arp , ipconfig / ifconfig , nbtstat , and route .
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may compress and/or encrypt data that is collected prior to exfiltration. Compressing the data can help to obfuscate the collected data and minimize the amount of data sent over the network. Encryption can be used to hide information that is being exfiltrated from detection or make exfiltration less conspicuous upon inspection by a defender.
Tactics:	Collection
Data Sources:	Command: Command Execution, File: File Creation, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may search local system sources, such as file systems and configuration files or local databases, to find files of interest and sensitive data prior to Exfiltration.
Tactics:	Collection
Data Sources:	Command: Command Execution, File: File Access, Process: OS API Execution, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may target user email to collect sensitive information. Emails may contain sensitive data, including trade secrets or personal information, that can prove valuable to adversaries. Adversaries can collect or forward email from mail servers or clients.
Tactics:	Collection
Data Sources:	Application Log: Application Log Content, Command: Command Execution, File: File Access, Logon Session: Logon Session Creation, Network Traffic: Network Connection Creation
Platforms:	Google Workspace, Linux, macOS, Office 365, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may collect data stored in the clipboard from users copying information within or between applications.
Tactics:	Collection
Data Sources:	Command: Command Execution, Process: OS API Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may transfer tools or other files from an external system into a compromised environment. Tools or files may be copied from an external adversary-controlled system to the victim network through the command and control channel or through alternate protocols such as ftp . Once present, adversaries may also transfer/spread tools between victim devices within a compromised environment (i.e. Lateral Tool Transfer ).
Tactics:	Command and Control
Data Sources:	Command: Command Execution, File: File Creation, Network Traffic: Network Connection Creation, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ a known encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Despite the use of a secure algorithm, these implementations may be vulnerable to reverse engineering if secret keys are encoded and/or generated within malware samples/configuration files.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using a protocol and port pairing that are typically not associated. For example, HTTPS over port 8088or port 587as opposed to the traditional port 443. Adversaries may make changes to the standard port used by a protocol to bypass filtering or muddle analysis/parsing of network data.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use an OSI non-application layer protocol for communication between host and C2 server or among infected hosts within a network. The list of possible protocols is extensive.Specific examples include use of network layer protocols, such as the Internet Control Message Protocol (ICMP), transport layer protocols, such as the User Datagram Protocol (UDP), session layer protocols, such as Socket Secure (SOCKS), as well as redirected/tunneled protocols, such as Serial over LAN (SOL).
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using OSI application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre