Edit tour

Windows Analysis Report
GOmRjFSKNz.exe

Overview

General Information

Sample name:	GOmRjFSKNz.exe renamed because original name is a hash value
Original sample name:	bc37b8380183870ec6acd56886f3ef4537bf63c71935a094307875e03b0d2bb5.exe
Analysis ID:	1534173
MD5:	01ef5f0617d6cb995abe430c3c6c7acd
SHA1:	9d6cee782bce7762f58f2bf6c1c38218491e9f94
SHA256:	bc37b8380183870ec6acd56886f3ef4537bf63c71935a094307875e03b0d2bb5
Tags:	87-120-114-39exeuser-JAMESWT_MHT
Infos:

Detection

RedLine

Score:	100
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

Found malware configuration

Multi AV Scanner detection for submitted file

Sigma detected: Search for Antivirus process

Yara detected RedLine Stealer

AI detected suspicious sample

C2 URLs / IPs found in malware configuration

Connects to many ports of the same IP (likely port scanning)

Drops PE files with a suspicious file extension

Found API chain indicative of debugger detection

Injects a PE file into a foreign processes

Installs new ROOT certificates

Sigma detected: Bad Opsec Defaults Sacrificial Processes With Improper Arguments

Writes to foreign memory regions

Allocates memory with a write watch (potentially for evading sandboxes)

Contains functionality for read data from the clipboard

Contains functionality to block mouse and keyboard input (often used to hinder debugging)

Contains functionality to check if a debugger is running (IsDebuggerPresent)

Contains functionality to check if a debugger is running (OutputDebugString,GetLastError)

Contains functionality to check if a window is minimized (may be used to check if an application is visible)

Contains functionality to communicate with device drivers

Contains functionality to dynamically determine API calls

Contains functionality to execute programs as a different user

Contains functionality to launch a process as a different user

Contains functionality to launch a program with higher privileges

Contains functionality to modify clipboard data

Contains functionality to open a port and listen for incoming connection (possibly a backdoor)

Contains functionality to query CPU information (cpuid)

Contains functionality to read the clipboard data

Contains functionality to retrieve information about pressed keystrokes

Contains functionality to shutdown / reboot the system

Contains functionality to simulate keystroke presses

Contains functionality to simulate mouse events

Contains functionality which may be used to detect a debugger (GetProcessHeap)

Creates a process in suspended mode (likely to inject code)

Creates files inside the system directory

Detected TCP or UDP traffic on non-standard ports

Detected potential crypto function

Dropped file seen in connection with other malware

Drops PE files

Drops certificate files (DER)

Enables debug privileges

Extensive use of GetProcAddress (often used to hide API calls)

Found large amount of non-executed APIs

Found potential string decryption / allocating functions

Internet Provider seen in connection with other malware

Monitors certain registry keys / values for changes (often done to protect autostart functionality)

OS version to string mapping found (often used in BOTs)

Potential key logger detected (key state polling based)

Queries the volume information (name, serial number etc) of a device

Sample execution stops while process was sleeping (likely an evasion)

Sample file is different than original file name gathered from version info

Sigma detected: Execution of Suspicious File Type Extension

Sigma detected: Potentially Suspicious Execution Of Regasm/Regsvcs From Uncommon Location

Tries to resolve domain names, but no domain seems valid (expired dropper behavior)

Uses 32bit PE files

Uses code obfuscation techniques (call, push, ret)

Classification

Process Tree

System is w10x64

GOmRjFSKNz.exe (PID: 7056 cmdline: "C:\Users\user\Desktop\GOmRjFSKNz.exe" MD5: 01EF5F0617D6CB995ABE430C3C6C7ACD)

cmd.exe (PID: 1188 cmdline: "C:\Windows\System32\cmd.exe" /c move Pediatric Pediatric.bat & Pediatric.bat MD5: D0FCE3AFA6AA1D58CE9FA336CC2B675B)

conhost.exe (PID: 5900 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

tasklist.exe (PID: 4996 cmdline: tasklist MD5: 0A4448B31CE7F83CB7691A2657F330F1)

findstr.exe (PID: 5956 cmdline: findstr /I "wrsa opssvc" MD5: F1D4BE0E99EC734376FDE474A8D4EA3E)

tasklist.exe (PID: 6120 cmdline: tasklist MD5: 0A4448B31CE7F83CB7691A2657F330F1)

findstr.exe (PID: 5672 cmdline: findstr /I "avastui avgui bdservicehost nswscsvc sophoshealth" MD5: F1D4BE0E99EC734376FDE474A8D4EA3E)

cmd.exe (PID: 5960 cmdline: cmd /c md 72076 MD5: D0FCE3AFA6AA1D58CE9FA336CC2B675B)

findstr.exe (PID: 2140 cmdline: findstr /V "SILICONLATINOAMPLANDBLOW" Words MD5: F1D4BE0E99EC734376FDE474A8D4EA3E)

cmd.exe (PID: 5868 cmdline: cmd /c copy /b ..\Indoor + ..\An + ..\Transport + ..\Strap + ..\Passed + ..\Treasure s MD5: D0FCE3AFA6AA1D58CE9FA336CC2B675B)

Launches.pif (PID: 4296 cmdline: Launches.pif s MD5: 18CE19B57F43CE0A5AF149C96AECC685)

RegAsm.exe (PID: 1144 cmdline: C:\Users\user\AppData\Local\Temp\72076\RegAsm.exe MD5: 0D5DF43AF2916F47D00C1573797C1A13)

choice.exe (PID: 888 cmdline: choice /d y /t 5 MD5: FCE0E41C87DC4ABBE976998AD26C27E4)

cleanup

Malware Threat Intel

Provided by

Name	Description	Attribution	Blogpost URLs	Link
RedLine Stealer	RedLine Stealer is a malware available on underground forums for sale apparently as a standalone ($100/$150 depending on the version) or also on a subscription basis ($100/month). This malware harvests information from browsers such as saved credentials, autocomplete data, and credit card information. A system inventory is also taken when running on a target machine, to include details such as the username, location data, hardware configuration, and information regarding installed security software. More recent versions of RedLine added the ability to steal cryptocurrency. FTP and IM clients are also apparently targeted by this family, and this malware has the ability to upload and download files, execute commands, and periodically send back information about the infected computer.	No Attribution	https://any.run/cybersecurity-blog/crackedcantil-breakdown/ https://apophis133.medium.com/redline-technical-analysis-report-5034e16ad152 https://asec.ahnlab.com/en/30445/ https://asec.ahnlab.com/en/35981/ https://asec.ahnlab.com/ko/25837/	https://malpedia.caad.fkie.fraunhofer.de/details/win.redline_stealer

Malware Configuration

Threatname: RedLine

{"C2 url": "87.120.114.39:47928", "Bot Id": "new", "Authorization Header": "4484cd46611513b45d351e0b5010e5bb"}

Yara Signatures

Memory Dumps

Source	Rule	Description	Author
0000000A.00000003.2825546542.000000000519F000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_RedLine	Yara detected RedLine Stealer	Joe Security
0000000A.00000003.2833770879.0000000001F91000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_RedLine	Yara detected RedLine Stealer	Joe Security
0000000A.00000003.2825065700.0000000001DDD000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_RedLine	Yara detected RedLine Stealer	Joe Security
0000000A.00000003.2825688213.0000000001E5B000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_RedLine	Yara detected RedLine Stealer	Joe Security
0000000A.00000003.2824672801.0000000001E5B000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_RedLine	Yara detected RedLine Stealer	Joe Security
0000000A.00000003.2882687318.0000000001DD3000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_RedLine	Yara detected RedLine Stealer	Joe Security
00000010.00000002.3032255109.0000000000342000.00000040.00000400.00020000.00000000.sdmp	JoeSecurity_RedLine	Yara detected RedLine Stealer	Joe Security
0000000A.00000003.2882687318.0000000001D91000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_RedLine	Yara detected RedLine Stealer	Joe Security
0000000A.00000003.2825305490.0000000001D91000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_RedLine	Yara detected RedLine Stealer	Joe Security
0000000A.00000003.2825305490.0000000001DD3000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_RedLine	Yara detected RedLine Stealer	Joe Security
0000000A.00000003.2833826824.000000000449B000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_RedLine	Yara detected RedLine Stealer	Joe Security
0000000A.00000003.2884666788.0000000001DDC000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_RedLine	Yara detected RedLine Stealer	Joe Security
0000000A.00000003.2825915690.0000000001F91000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_RedLine	Yara detected RedLine Stealer	Joe Security
0000000A.00000003.2833895594.0000000004418000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_RedLine	Yara detected RedLine Stealer	Joe Security
0000000A.00000003.2884370254.0000000001F02000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_RedLine	Yara detected RedLine Stealer	Joe Security
0000000A.00000003.2884574282.0000000001E5C000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_RedLine	Yara detected RedLine Stealer	Joe Security
Process Memory Space: Launches.pif PID: 4296	JoeSecurity_RedLine	Yara detected RedLine Stealer	Joe Security
Process Memory Space: RegAsm.exe PID: 1144	JoeSecurity_RedLine	Yara detected RedLine Stealer	Joe Security
Click to see the 13 entries

Unpacked PEs

Source	Rule	Description	Author
10.3.Launches.pif.1ddc050.0.raw.unpack	JoeSecurity_RedLine	Yara detected RedLine Stealer	Joe Security
16.2.RegAsm.exe.340000.0.unpack	JoeSecurity_RedLine	Yara detected RedLine Stealer	Joe Security
10.3.Launches.pif.1ddc050.1.raw.unpack	JoeSecurity_RedLine	Yara detected RedLine Stealer	Joe Security

Sigma Signatures

System Summary

Sigma detected: Bad Opsec Defaults Sacrificial Processes With Improper Arguments

Source: Process started

Author: Oleg Kolesnikov @securonix invrep_de, oscd.community, Florian Roth (Nextron Systems), Christian Burkard (Nextron Systems): Data: Command: C:\Users\user\AppData\Local\Temp\72076\RegAsm.exe, CommandLine: C:\Users\user\AppData\Local\Temp\72076\RegAsm.exe, CommandLine|base64offset|contains: , Image: C:\Users\user\AppData\Local\Temp\72076\RegAsm.exe, NewProcessName: C:\Users\user\AppData\Local\Temp\72076\RegAsm.exe, OriginalFileName: C:\Users\user\AppData\Local\Temp\72076\RegAsm.exe, ParentCommandLine: Launches.pif s, ParentImage: C:\Users\user\AppData\Local\Temp\72076\Launches.pif, ParentProcessId: 4296, ParentProcessName: Launches.pif, ProcessCommandLine: C:\Users\user\AppData\Local\Temp\72076\RegAsm.exe, ProcessId: 1144, ProcessName: RegAsm.exe

Sigma detected: Execution of Suspicious File Type Extension

Source: Process started

Author: Max Altgelt (Nextron Systems): Data: Command: Launches.pif s, CommandLine: Launches.pif s, CommandLine|base64offset|contains: , Image: C:\Users\user\AppData\Local\Temp\72076\Launches.pif, NewProcessName: C:\Users\user\AppData\Local\Temp\72076\Launches.pif, OriginalFileName: C:\Users\user\AppData\Local\Temp\72076\Launches.pif, ParentCommandLine: "C:\Windows\System32\cmd.exe" /c move Pediatric Pediatric.bat & Pediatric.bat, ParentImage: C:\Windows\SysWOW64\cmd.exe, ParentProcessId: 1188, ParentProcessName: cmd.exe, ProcessCommandLine: Launches.pif s, ProcessId: 4296, ProcessName: Launches.pif

Sigma detected: Potentially Suspicious Execution Of Regasm/Regsvcs From Uncommon Location

Source: Process started

Author: Nasreddine Bencherchali (Nextron Systems): Data: Command: C:\Users\user\AppData\Local\Temp\72076\RegAsm.exe, CommandLine: C:\Users\user\AppData\Local\Temp\72076\RegAsm.exe, CommandLine|base64offset|contains: , Image: C:\Users\user\AppData\Local\Temp\72076\RegAsm.exe, NewProcessName: C:\Users\user\AppData\Local\Temp\72076\RegAsm.exe, OriginalFileName: C:\Users\user\AppData\Local\Temp\72076\RegAsm.exe, ParentCommandLine: Launches.pif s, ParentImage: C:\Users\user\AppData\Local\Temp\72076\Launches.pif, ParentProcessId: 4296, ParentProcessName: Launches.pif, ProcessCommandLine: C:\Users\user\AppData\Local\Temp\72076\RegAsm.exe, ProcessId: 1144, ProcessName: RegAsm.exe

HIPS / PFW / Operating System Protection Evasion

Sigma detected: Search for Antivirus process

Source: Process started

Author: Joe Security: Data: Command: findstr /I "avastui avgui bdservicehost nswscsvc sophoshealth" , CommandLine: findstr /I "avastui avgui bdservicehost nswscsvc sophoshealth" , CommandLine|base64offset|contains: ~), Image: C:\Windows\SysWOW64\findstr.exe, NewProcessName: C:\Windows\SysWOW64\findstr.exe, OriginalFileName: C:\Windows\SysWOW64\findstr.exe, ParentCommandLine: "C:\Windows\System32\cmd.exe" /c move Pediatric Pediatric.bat & Pediatric.bat, ParentImage: C:\Windows\SysWOW64\cmd.exe, ParentProcessId: 1188, ParentProcessName: cmd.exe, ProcessCommandLine: findstr /I "avastui avgui bdservicehost nswscsvc sophoshealth" , ProcessId: 5672, ProcessName: findstr.exe

Suricata Signatures

⊘No Suricata rule has matched

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

AV Detection

Found malware configuration

Source: 00000010.00000002.3033364620.0000000002601000.00000004.00000800.00020000.00000000.sdmp

Malware Configuration Extractor: RedLine {"C2 url": "87.120.114.39:47928", "Bot Id": "new", "Authorization Header": "4484cd46611513b45d351e0b5010e5bb"}

Multi AV Scanner detection for submitted file

Source: GOmRjFSKNz.exe

ReversingLabs: Detection: 34%

AI detected suspicious sample

Source: Submited Sample

Integrated Neural Analysis Model: Matched 99.5% probability

Source: GOmRjFSKNz.exe

Static PE information: EXECUTABLE_IMAGE, 32BIT_MACHINE

Source: GOmRjFSKNz.exe

Static PE information: DYNAMIC_BASE, NX_COMPAT, NO_SEH, TERMINAL_SERVER_AWARE

Source:	Binary string: \??\C:\Windows\Microsoft.Net\assembly\GAC_MSIL\System.ServiceModel\v4.0_4.0.0.0__b77a5c561934e089\System.ServiceModel.pdb8 source: RegAsm.exe, 00000010.00000002.3032787620.0000000000962000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: \??\C:\Windows\dll\System.ServiceModel.pdb source: RegAsm.exe, 00000010.00000002.3034584358.0000000005EF2000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: nHC:\Windows\System.ServiceModel.pdbpdbdel.pdb source: RegAsm.exe, 00000010.00000002.3032392433.00000000006F7000.00000004.00000010.00020000.00000000.sdmp
Source:	Binary string: RegAsm.pdb source: Launches.pif, 0000000A.00000003.2823843249.0000000004418000.00000004.00000800.00020000.00000000.sdmp, RegAsm.exe, 00000010.00000000.2826358198.0000000000262000.00000002.00000001.01000000.00000007.sdmp, RegAsm.exe.10.dr
Source:	Binary string: C:\Windows\System.ServiceModel.pdb source: RegAsm.exe, 00000010.00000002.3032392433.00000000006F7000.00000004.00000010.00020000.00000000.sdmp
Source:	Binary string: RegAsm.pdb4 source: Launches.pif, 0000000A.00000003.2823843249.0000000004418000.00000004.00000800.00020000.00000000.sdmp, RegAsm.exe, 00000010.00000000.2826358198.0000000000262000.00000002.00000001.01000000.00000007.sdmp, RegAsm.exe.10.dr
Source:	Binary string: System.ServiceModel.pdb source: RegAsm.exe, 00000010.00000002.3032787620.00000000009FC000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: \??\C:\Windows\Microsoft.Net\assembly\GAC_MSIL\System.ServiceModel\v4.0_4.0.0.0__b77a5c561934e089\System.ServiceModel.pdb source: RegAsm.exe, 00000010.00000002.3032787620.0000000000962000.00000004.00000020.00020000.00000000.sdmp

Source: C:\Users\user\Desktop\GOmRjFSKNz.exe	Code function: 0_2_004062D5 FindFirstFileW,FindClose,	0_2_004062D5
Source: C:\Users\user\Desktop\GOmRjFSKNz.exe	Code function: 0_2_00402E18 FindFirstFileW,	0_2_00402E18
Source: C:\Users\user\Desktop\GOmRjFSKNz.exe	Code function: 0_2_00406C9B DeleteFileW,lstrcatW,lstrcatW,lstrcatW,lstrlenW,FindFirstFileW,DeleteFileW,FindNextFileW,FindClose,RemoveDirectoryW,	0_2_00406C9B
Source: C:\Users\user\AppData\Local\Temp\72076\Launches.pif	Code function: 10_2_007A4005 FindFirstFileW,DeleteFileW,FindNextFileW,FindClose,FindClose,	10_2_007A4005
Source: C:\Users\user\AppData\Local\Temp\72076\Launches.pif	Code function: 10_2_007A494A GetFileAttributesW,FindFirstFileW,FindClose,	10_2_007A494A
Source: C:\Users\user\AppData\Local\Temp\72076\Launches.pif	Code function: 10_2_007A3CE2 FindFirstFileW,DeleteFileW,DeleteFileW,MoveFileW,DeleteFileW,FindNextFileW,FindClose,FindClose,	10_2_007A3CE2
Source: C:\Users\user\AppData\Local\Temp\72076\Launches.pif	Code function: 10_2_007AC2FF FindFirstFileW,_wcscmp,_wcscmp,FindNextFileW,FindClose,	10_2_007AC2FF
Source: C:\Users\user\AppData\Local\Temp\72076\Launches.pif	Code function: 10_2_007ACD14 FindFirstFileW,FindClose,	10_2_007ACD14
Source: C:\Users\user\AppData\Local\Temp\72076\Launches.pif	Code function: 10_2_007ACD9F FindFirstFileW,FindClose,FileTimeToLocalFileTime,FileTimeToLocalFileTime,FileTimeToLocalFileTime,FileTimeToSystemTime,__swprintf,__swprintf,__swprintf,__swprintf,__swprintf,__swprintf,__swprintf,	10_2_007ACD9F
Source: C:\Users\user\AppData\Local\Temp\72076\Launches.pif	Code function: 10_2_007AF5D8 SetCurrentDirectoryW,FindFirstFileW,FindFirstFileW,_wcscmp,_wcscmp,GetFileAttributesW,SetFileAttributesW,FindNextFileW,FindClose,FindFirstFileW,SetCurrentDirectoryW,_wcscmp,_wcscmp,SetCurrentDirectoryW,SetCurrentDirectoryW,FindNextFileW,FindClose,FindClose,	10_2_007AF5D8
Source: C:\Users\user\AppData\Local\Temp\72076\Launches.pif	Code function: 10_2_007AF735 SetCurrentDirectoryW,FindFirstFileW,FindFirstFileW,_wcscmp,_wcscmp,FindNextFileW,FindClose,FindFirstFileW,SetCurrentDirectoryW,_wcscmp,_wcscmp,SetCurrentDirectoryW,SetCurrentDirectoryW,FindNextFileW,FindClose,FindClose,	10_2_007AF735
Source: C:\Users\user\AppData\Local\Temp\72076\Launches.pif	Code function: 10_2_007AFA36 FindFirstFileW,Sleep,_wcscmp,_wcscmp,FindNextFileW,FindClose,	10_2_007AFA36

Source: C:\Windows\SysWOW64\cmd.exe	File opened: C:\Users\user\AppData\Local\Temp\72076\	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	File opened: C:\Users\user\AppData\Local\Temp\	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	File opened: C:\Users\user\AppData\Local\	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	File opened: C:\Users\user\AppData\Local\Temp\72076	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	File opened: C:\Users\user\AppData\	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	File opened: C:\Users\user\	Jump to behavior

Networking

C2 URLs / IPs found in malware configuration

Source: Malware configuration extractor

URLs: 87.120.114.39:47928

Connects to many ports of the same IP (likely port scanning)

Source: global traffic

TCP traffic: 87.120.114.39 ports 47928,2,4,7,8,9

Source: global traffic

TCP traffic: 192.168.2.4:50002 -> 87.120.114.39:47928

Source: Joe Sandbox View

ASN Name: UNACS-AS-BG8000BurgasBG UNACS-AS-BG8000BurgasBG

Source: unknown

DNS traffic detected: query: GRfewLDzqhRQJfpDiaidRNex.GRfewLDzqhRQJfpDiaidRNex replaycode: Name error (3)

Source: unknown	TCP traffic detected without corresponding DNS query: 87.120.114.39
Source: unknown	TCP traffic detected without corresponding DNS query: 87.120.114.39
Source: unknown	TCP traffic detected without corresponding DNS query: 87.120.114.39
Source: unknown	TCP traffic detected without corresponding DNS query: 87.120.114.39
Source: unknown	TCP traffic detected without corresponding DNS query: 87.120.114.39
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1

Source: C:\Users\user\AppData\Local\Temp\72076\Launches.pif

Code function: 10_2_007B29BA InternetReadFile,InternetQueryDataAvailable,InternetReadFile,

10_2_007B29BA

Source: global traffic

DNS traffic detected: DNS query: GRfewLDzqhRQJfpDiaidRNex.GRfewLDzqhRQJfpDiaidRNex

Source: GOmRjFSKNz.exe, 00000000.00000003.1781635044.0000000002886000.00000004.00000020.00020000.00000000.sdmp, Carol.0.dr, Launches.pif.1.dr	String found in binary or memory: http://crl.globalsign.com/gs/gstimestampingsha2g2.crl0
Source: GOmRjFSKNz.exe, 00000000.00000003.1781635044.0000000002886000.00000004.00000020.00020000.00000000.sdmp, Carol.0.dr, Launches.pif.1.dr	String found in binary or memory: http://crl.globalsign.com/gscodesignsha2g3.crl0
Source: GOmRjFSKNz.exe, 00000000.00000003.1781635044.0000000002886000.00000004.00000020.00020000.00000000.sdmp, Carol.0.dr, Launches.pif.1.dr	String found in binary or memory: http://crl.globalsign.com/root-r3.crl0c
Source: GOmRjFSKNz.exe, 00000000.00000003.1781635044.0000000002886000.00000004.00000020.00020000.00000000.sdmp, Carol.0.dr, Launches.pif.1.dr	String found in binary or memory: http://crl.globalsign.net/root-r3.crl0
Source: GOmRjFSKNz.exe	String found in binary or memory: http://nsis.sf.net/NSIS_ErrorError
Source: GOmRjFSKNz.exe, 00000000.00000003.1781635044.0000000002886000.00000004.00000020.00020000.00000000.sdmp, Carol.0.dr, Launches.pif.1.dr	String found in binary or memory: http://ocsp2.globalsign.com/gscodesignsha2g30V
Source: GOmRjFSKNz.exe, 00000000.00000003.1781635044.0000000002886000.00000004.00000020.00020000.00000000.sdmp, Carol.0.dr, Launches.pif.1.dr	String found in binary or memory: http://ocsp2.globalsign.com/gstimestampingsha2g20
Source: GOmRjFSKNz.exe, 00000000.00000003.1781635044.0000000002886000.00000004.00000020.00020000.00000000.sdmp, Carol.0.dr, Launches.pif.1.dr	String found in binary or memory: http://ocsp2.globalsign.com/rootr306
Source: RegAsm.exe, 00000010.00000002.3033364620.0000000002601000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/soap/actor/next
Source: RegAsm.exe, 00000010.00000002.3033364620.0000000002601000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/soap/envelope/
Source: RegAsm.exe, 00000010.00000002.3033364620.0000000002601000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/08/addressing
Source: RegAsm.exe, 00000010.00000002.3033364620.0000000002601000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/08/addressing/faultp9
Source: RegAsm.exe, 00000010.00000002.3033364620.0000000002601000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/08/addressing/role/anonymous
Source: RegAsm.exe, 00000010.00000002.3033364620.0000000002601000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/rm
Source: RegAsm.exe, 00000010.00000002.3033364620.0000000002601000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/rm/AckRequested
Source: RegAsm.exe, 00000010.00000002.3033364620.0000000002601000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/rm/CreateSequence
Source: RegAsm.exe, 00000010.00000002.3033364620.0000000002601000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/rm/CreateSequenceResponse
Source: RegAsm.exe, 00000010.00000002.3033364620.0000000002601000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/rm/LastMessage
Source: RegAsm.exe, 00000010.00000002.3033364620.0000000002601000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/rm/SequenceAcknowledgement
Source: RegAsm.exe, 00000010.00000002.3033364620.0000000002601000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/rm/TerminateSequence
Source: RegAsm.exe, 00000010.00000002.3033364620.0000000002601000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/05/identity/claims/dns
Source: RegAsm.exe, 00000010.00000002.3033364620.0000000002601000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/05/identity/right/possessproperty
Source: GOmRjFSKNz.exe, 00000000.00000003.1781635044.0000000002886000.00000004.00000020.00020000.00000000.sdmp, Carol.0.dr, Launches.pif.1.dr	String found in binary or memory: http://secure.globalsign.com/cacert/gscodesignsha2g3ocsp.crt08
Source: GOmRjFSKNz.exe, 00000000.00000003.1781635044.0000000002886000.00000004.00000020.00020000.00000000.sdmp, Carol.0.dr, Launches.pif.1.dr	String found in binary or memory: http://secure.globalsign.com/cacert/gstimestampingsha2g2.crt0
Source: RegAsm.exe, 00000010.00000002.3033364620.0000000002601000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/
Source: RegAsm.exe, 00000010.00000002.3033364620.0000000002601000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/
Source: RegAsm.exe, 00000010.00000002.3033364620.0000000002601000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id10LRfq
Source: RegAsm.exe, 00000010.00000002.3033364620.0000000002601000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id10Responsex
Source: RegAsm.exe, 00000010.00000002.3033364620.0000000002601000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id11LRfq
Source: RegAsm.exe, 00000010.00000002.3033364620.0000000002601000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id11Responsex
Source: RegAsm.exe, 00000010.00000002.3033364620.0000000002601000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id12LRfq
Source: RegAsm.exe, 00000010.00000002.3033364620.0000000002601000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id12Responsex
Source: RegAsm.exe, 00000010.00000002.3033364620.0000000002601000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id13LRfq
Source: RegAsm.exe, 00000010.00000002.3033364620.0000000002601000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id13Responsex
Source: RegAsm.exe, 00000010.00000002.3033364620.0000000002601000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id14LRfq
Source: RegAsm.exe, 00000010.00000002.3033364620.0000000002601000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id14Responsex
Source: RegAsm.exe, 00000010.00000002.3033364620.0000000002601000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id15LRfqx/j
Source: RegAsm.exe, 00000010.00000002.3033364620.0000000002601000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id15Responsex
Source: RegAsm.exe, 00000010.00000002.3033364620.0000000002601000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id16LRfq
Source: RegAsm.exe, 00000010.00000002.3033364620.0000000002601000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id16Responsex
Source: RegAsm.exe, 00000010.00000002.3033364620.0000000002601000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id17LRfq
Source: RegAsm.exe, 00000010.00000002.3033364620.0000000002601000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id17Responsex
Source: RegAsm.exe, 00000010.00000002.3033364620.0000000002601000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id18LRfq
Source: RegAsm.exe, 00000010.00000002.3033364620.0000000002601000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id18Responsex
Source: RegAsm.exe, 00000010.00000002.3033364620.0000000002601000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id19LRfq
Source: RegAsm.exe, 00000010.00000002.3033364620.0000000002601000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id19Responsex
Source: RegAsm.exe, 00000010.00000002.3033364620.0000000002601000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id1LRfq4
Source: RegAsm.exe, 00000010.00000002.3033364620.0000000002601000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id1Responsex
Source: RegAsm.exe, 00000010.00000002.3033364620.0000000002601000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id20LRfq
Source: RegAsm.exe, 00000010.00000002.3033364620.0000000002601000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id20Responsex
Source: RegAsm.exe, 00000010.00000002.3033364620.0000000002601000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id21LRfqduj
Source: RegAsm.exe, 00000010.00000002.3033364620.0000000002601000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id21Responsex
Source: RegAsm.exe, 00000010.00000002.3033364620.0000000002601000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id22LRfq
Source: RegAsm.exe, 00000010.00000002.3033364620.0000000002601000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id22Responsex
Source: RegAsm.exe, 00000010.00000002.3033364620.0000000002601000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id23LRfq
Source: RegAsm.exe, 00000010.00000002.3033364620.0000000002601000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id23Responsex
Source: RegAsm.exe, 00000010.00000002.3033364620.0000000002601000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id24LRfq
Source: RegAsm.exe, 00000010.00000002.3033364620.0000000002601000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id24Responsex
Source: RegAsm.exe, 00000010.00000002.3033364620.0000000002601000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id2LRfq
Source: RegAsm.exe, 00000010.00000002.3033364620.0000000002601000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id2Responsex
Source: RegAsm.exe, 00000010.00000002.3033364620.0000000002601000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id3LRfq
Source: RegAsm.exe, 00000010.00000002.3033364620.0000000002601000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id3Responsex
Source: RegAsm.exe, 00000010.00000002.3033364620.0000000002601000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id4LRfq
Source: RegAsm.exe, 00000010.00000002.3033364620.0000000002601000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id4Responsex
Source: RegAsm.exe, 00000010.00000002.3033364620.0000000002601000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id5LRfq
Source: RegAsm.exe, 00000010.00000002.3033364620.0000000002601000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id5Responsex
Source: RegAsm.exe, 00000010.00000002.3033364620.0000000002601000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id6LRfq
Source: RegAsm.exe, 00000010.00000002.3033364620.0000000002601000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id6Responsex
Source: RegAsm.exe, 00000010.00000002.3033364620.0000000002601000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id7LRfqx
Source: RegAsm.exe, 00000010.00000002.3033364620.0000000002601000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id7Responsex
Source: RegAsm.exe, 00000010.00000002.3033364620.0000000002601000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id8LRfq
Source: RegAsm.exe, 00000010.00000002.3033364620.0000000002601000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id8Responsex
Source: RegAsm.exe, 00000010.00000002.3033364620.0000000002601000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id9LRfq
Source: RegAsm.exe, 00000010.00000002.3033364620.0000000002601000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id9Responsex
Source: GOmRjFSKNz.exe, 00000000.00000003.1781635044.0000000002886000.00000004.00000020.00020000.00000000.sdmp, Launches.pif, 0000000A.00000000.1818602986.0000000000809000.00000002.00000001.01000000.00000006.sdmp, Carol.0.dr, Launches.pif.1.dr	String found in binary or memory: http://www.autoitscript.com/autoit3/J
Source: Launches.pif, 0000000A.00000003.2825065700.0000000001DDD000.00000004.00000800.00020000.00000000.sdmp, Launches.pif, 0000000A.00000003.2833770879.0000000001F91000.00000004.00000800.00020000.00000000.sdmp, Launches.pif, 0000000A.00000003.2825546542.000000000519F000.00000004.00000800.00020000.00000000.sdmp, Launches.pif, 0000000A.00000003.2825688213.0000000001E5B000.00000004.00000800.00020000.00000000.sdmp, Launches.pif, 0000000A.00000003.2882687318.0000000001DD3000.00000004.00000800.00020000.00000000.sdmp, Launches.pif, 0000000A.00000003.2882687318.0000000001D91000.00000004.00000800.00020000.00000000.sdmp, Launches.pif, 0000000A.00000003.2833826824.000000000449B000.00000004.00000800.00020000.00000000.sdmp, Launches.pif, 0000000A.00000003.2884666788.0000000001DDC000.00000004.00000800.00020000.00000000.sdmp, Launches.pif, 0000000A.00000003.2833895594.0000000004418000.00000004.00000800.00020000.00000000.sdmp, Launches.pif, 0000000A.00000003.2884574282.0000000001E5C000.00000004.00000800.00020000.00000000.sdmp, RegAsm.exe, 00000010.00000002.3032255109.0000000000342000.00000040.00000400.00020000.00000000.sdmp	String found in binary or memory: https://api.ip.sb/ip
Source: GOmRjFSKNz.exe, 00000000.00000003.1781635044.0000000002886000.00000004.00000020.00020000.00000000.sdmp, Carol.0.dr, Launches.pif.1.dr	String found in binary or memory: https://www.autoitscript.com/autoit3/
Source: Launches.pif.1.dr	String found in binary or memory: https://www.globalsign.com/repository/0
Source: GOmRjFSKNz.exe, 00000000.00000003.1781635044.0000000002886000.00000004.00000020.00020000.00000000.sdmp, Carol.0.dr, Launches.pif.1.dr	String found in binary or memory: https://www.globalsign.com/repository/06

Source: C:\Users\user\Desktop\GOmRjFSKNz.exe

Code function: 0_2_004050CD GetDlgItem,GetDlgItem,GetDlgItem,GetDlgItem,GetClientRect,GetSystemMetrics,SendMessageW,SendMessageW,SendMessageW,SendMessageW,SendMessageW,SendMessageW,ShowWindow,ShowWindow,GetDlgItem,SendMessageW,SendMessageW,SendMessageW,GetDlgItem,CreateThread,CloseHandle,ShowWindow,ShowWindow,ShowWindow,ShowWindow,SendMessageW,CreatePopupMenu,AppendMenuW,GetWindowRect,TrackPopupMenu,SendMessageW,OpenClipboard,EmptyClipboard,GlobalAlloc,GlobalLock,SendMessageW,GlobalUnlock,SetClipboardData,CloseClipboard,

0_2_004050CD

Source: C:\Users\user\AppData\Local\Temp\72076\Launches.pif

Code function: 10_2_007B4830 OpenClipboard,EmptyClipboard,GlobalAlloc,GlobalLock,_wcscpy,GlobalUnlock,OpenClipboard,EmptyClipboard,SetClipboardData,CloseClipboard,

10_2_007B4830

Source: C:\Users\user\AppData\Local\Temp\72076\Launches.pif

Code function: 10_2_007B4632 OpenClipboard,IsClipboardFormatAvailable,IsClipboardFormatAvailable,GetClipboardData,CloseClipboard,GlobalLock,CloseClipboard,GlobalUnlock,IsClipboardFormatAvailable,GetClipboardData,GlobalLock,GlobalUnlock,IsClipboardFormatAvailable,GetClipboardData,GlobalLock,DragQueryFileW,DragQueryFileW,DragQueryFileW,GlobalUnlock,CountClipboardFormats,CloseClipboard,

10_2_007B4632

Source: C:\Users\user\Desktop\GOmRjFSKNz.exe

Code function: 0_2_004044A5 GetDlgItem,GetDlgItem,IsDlgButtonChecked,GetDlgItem,GetAsyncKeyState,GetDlgItem,ShowWindow,SetWindowTextW,SHBrowseForFolderW,CoTaskMemFree,lstrcmpiW,lstrcatW,SetDlgItemTextW,GetDiskFreeSpaceW,MulDiv,SetDlgItemTextW,

0_2_004044A5

Source: C:\Users\user\AppData\Local\Temp\72076\Launches.pif

Code function: 10_2_007CD164 DefDlgProcW,SendMessageW,GetWindowLongW,SendMessageW,SendMessageW,_wcsncpy,GetKeyState,GetKeyState,GetKeyState,SendMessageW,GetKeyState,SendMessageW,SendMessageW,SendMessageW,ImageList_SetDragCursorImage,ImageList_BeginDrag,SetCapture,ClientToScreen,ImageList_DragEnter,InvalidateRect,ReleaseCapture,GetCursorPos,ScreenToClient,SendMessageW,SendMessageW,SendMessageW,SendMessageW,SendMessageW,SendMessageW,SendMessageW,GetCursorPos,ScreenToClient,GetParent,SendMessageW,SendMessageW,ClientToScreen,TrackPopupMenuEx,SendMessageW,SendMessageW,ClientToScreen,TrackPopupMenuEx,GetWindowLongW,

10_2_007CD164

Source: C:\Users\user\AppData\Local\Temp\72076\RegAsm.exe	File created: C:\Users\user\AppData\Local\Temp\Tmp90E.tmp			Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\72076\RegAsm.exe	File created: C:\Users\user\AppData\Local\Temp\Tmp93E.tmp			Jump to dropped file

Source: C:\Users\user\AppData\Local\Temp\72076\Launches.pif

Code function: 10_2_007A4254: CreateFileW,DeviceIoControl,CloseHandle,

10_2_007A4254

Source: C:\Users\user\AppData\Local\Temp\72076\Launches.pif

Code function: 10_2_00798F2E _memset,DuplicateTokenEx,CloseHandle,OpenWindowStationW,GetProcessWindowStation,SetProcessWindowStation,OpenDesktopW,_wcscpy,LoadUserProfileW,CreateEnvironmentBlock,CreateProcessAsUserW,UnloadUserProfile,CloseWindowStation,CloseDesktop,SetProcessWindowStation,CloseHandle,DestroyEnvironmentBlock,

10_2_00798F2E

Source: C:\Users\user\Desktop\GOmRjFSKNz.exe	Code function: 0_2_00403883 EntryPoint,#17,SetErrorMode,OleInitialize,SHGetFileInfoW,GetCommandLineW,GetModuleHandleW,CharNextW,GetTempPathW,GetWindowsDirectoryW,lstrcatW,DeleteFileW,CoUninitialize,ExitProcess,lstrcatW,lstrcmpiW,CreateDirectoryW,SetCurrentDirectoryW,DeleteFileW,CopyFileW,CloseHandle,GetCurrentProcess,InitOnceBeginInitialize,ExitWindowsEx,		0_2_00403883
Source: C:\Users\user\AppData\Local\Temp\72076\Launches.pif	Code function: 10_2_007A5778 ExitWindowsEx,InitiateSystemShutdownExW,SetSystemPowerState,		10_2_007A5778

Source: C:\Users\user\Desktop\GOmRjFSKNz.exe

File created: C:\Windows\MississippiClinic

Jump to behavior

Source: C:\Users\user\Desktop\GOmRjFSKNz.exe	Code function: 0_2_0040497C	0_2_0040497C
Source: C:\Users\user\Desktop\GOmRjFSKNz.exe	Code function: 0_2_00406ED2	0_2_00406ED2
Source: C:\Users\user\Desktop\GOmRjFSKNz.exe	Code function: 0_2_004074BB	0_2_004074BB
Source: C:\Users\user\AppData\Local\Temp\72076\Launches.pif	Code function: 10_2_0074B020	10_2_0074B020
Source: C:\Users\user\AppData\Local\Temp\72076\Launches.pif	Code function: 10_2_007494E0	10_2_007494E0
Source: C:\Users\user\AppData\Local\Temp\72076\Launches.pif	Code function: 10_2_00749C80	10_2_00749C80
Source: C:\Users\user\AppData\Local\Temp\72076\Launches.pif	Code function: 10_2_007623F5	10_2_007623F5
Source: C:\Users\user\AppData\Local\Temp\72076\Launches.pif	Code function: 10_2_007C8400	10_2_007C8400
Source: C:\Users\user\AppData\Local\Temp\72076\Launches.pif	Code function: 10_2_00776502	10_2_00776502
Source: C:\Users\user\AppData\Local\Temp\72076\Launches.pif	Code function: 10_2_0077265E	10_2_0077265E
Source: C:\Users\user\AppData\Local\Temp\72076\Launches.pif	Code function: 10_2_0074E6F0	10_2_0074E6F0
Source: C:\Users\user\AppData\Local\Temp\72076\Launches.pif	Code function: 10_2_0076282A	10_2_0076282A
Source: C:\Users\user\AppData\Local\Temp\72076\Launches.pif	Code function: 10_2_007789BF	10_2_007789BF
Source: C:\Users\user\AppData\Local\Temp\72076\Launches.pif	Code function: 10_2_00776A74	10_2_00776A74
Source: C:\Users\user\AppData\Local\Temp\72076\Launches.pif	Code function: 10_2_007C0A3A	10_2_007C0A3A
Source: C:\Users\user\AppData\Local\Temp\72076\Launches.pif	Code function: 10_2_00750BE0	10_2_00750BE0
Source: C:\Users\user\AppData\Local\Temp\72076\Launches.pif	Code function: 10_2_0076CD51	10_2_0076CD51
Source: C:\Users\user\AppData\Local\Temp\72076\Launches.pif	Code function: 10_2_0079EDB2	10_2_0079EDB2
Source: C:\Users\user\AppData\Local\Temp\72076\Launches.pif	Code function: 10_2_007A8E44	10_2_007A8E44
Source: C:\Users\user\AppData\Local\Temp\72076\Launches.pif	Code function: 10_2_007C0EB7	10_2_007C0EB7
Source: C:\Users\user\AppData\Local\Temp\72076\Launches.pif	Code function: 10_2_00776FE6	10_2_00776FE6
Source: C:\Users\user\AppData\Local\Temp\72076\Launches.pif	Code function: 10_2_007633B7	10_2_007633B7
Source: C:\Users\user\AppData\Local\Temp\72076\Launches.pif	Code function: 10_2_0075D45D	10_2_0075D45D
Source: C:\Users\user\AppData\Local\Temp\72076\Launches.pif	Code function: 10_2_0076F409	10_2_0076F409
Source: C:\Users\user\AppData\Local\Temp\72076\Launches.pif	Code function: 10_2_00741663	10_2_00741663
Source: C:\Users\user\AppData\Local\Temp\72076\Launches.pif	Code function: 10_2_0075F628	10_2_0075F628
Source: C:\Users\user\AppData\Local\Temp\72076\Launches.pif	Code function: 10_2_007616B4	10_2_007616B4
Source: C:\Users\user\AppData\Local\Temp\72076\Launches.pif	Code function: 10_2_0074F6A0	10_2_0074F6A0
Source: C:\Users\user\AppData\Local\Temp\72076\Launches.pif	Code function: 10_2_007678C3	10_2_007678C3
Source: C:\Users\user\AppData\Local\Temp\72076\Launches.pif	Code function: 10_2_0076DBA5	10_2_0076DBA5
Source: C:\Users\user\AppData\Local\Temp\72076\Launches.pif	Code function: 10_2_00761BA8	10_2_00761BA8
Source: C:\Users\user\AppData\Local\Temp\72076\Launches.pif	Code function: 10_2_00779CE5	10_2_00779CE5
Source: C:\Users\user\AppData\Local\Temp\72076\Launches.pif	Code function: 10_2_0075DD28	10_2_0075DD28
Source: C:\Users\user\AppData\Local\Temp\72076\Launches.pif	Code function: 10_2_0076BFD6	10_2_0076BFD6
Source: C:\Users\user\AppData\Local\Temp\72076\Launches.pif	Code function: 10_2_00761FC0	10_2_00761FC0
Source: C:\Users\user\AppData\Local\Temp\72076\RegAsm.exe	Code function: 16_2_00BBDC74	16_2_00BBDC74
Source: C:\Users\user\AppData\Local\Temp\72076\RegAsm.exe	Code function: 16_2_05DA67D8	16_2_05DA67D8
Source: C:\Users\user\AppData\Local\Temp\72076\RegAsm.exe	Code function: 16_2_05DAA3E8	16_2_05DAA3E8
Source: C:\Users\user\AppData\Local\Temp\72076\RegAsm.exe	Code function: 16_2_05DAA3D8	16_2_05DAA3D8
Source: C:\Users\user\AppData\Local\Temp\72076\RegAsm.exe	Code function: 16_2_05DA6FF8	16_2_05DA6FF8
Source: C:\Users\user\AppData\Local\Temp\72076\RegAsm.exe	Code function: 16_2_05DA6FE8	16_2_05DA6FE8

Source: Joe Sandbox View

Dropped File: C:\Users\user\AppData\Local\Temp\72076\Launches.pif D8B7C7178FBADBF169294E4F29DCE582F89A5CF372E9DA9215AA082330DC12FD

Source: C:\Users\user\Desktop\GOmRjFSKNz.exe	Code function: String function: 004062A3 appears 57 times
Source: C:\Users\user\AppData\Local\Temp\72076\Launches.pif	Code function: String function: 00768B30 appears 42 times
Source: C:\Users\user\AppData\Local\Temp\72076\Launches.pif	Code function: String function: 00751A36 appears 34 times
Source: C:\Users\user\AppData\Local\Temp\72076\Launches.pif	Code function: String function: 00760D17 appears 70 times

Source: GOmRjFSKNz.exe, 00000000.00000003.1781635044.0000000002886000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameAutoIt3.exeB vs GOmRjFSKNz.exe
Source: GOmRjFSKNz.exe, 00000000.00000003.1786608510.0000000000804000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameCmd.Exej% vs GOmRjFSKNz.exe
Source: GOmRjFSKNz.exe, 00000000.00000002.1787695654.0000000000804000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameCmd.Exej% vs GOmRjFSKNz.exe

Source: GOmRjFSKNz.exe

Static PE information: EXECUTABLE_IMAGE, 32BIT_MACHINE

Source: classification engine

Classification label: mal100.troj.evad.winEXE@24/17@1/1

Source: C:\Users\user\AppData\Local\Temp\72076\Launches.pif

Code function: 10_2_007AA6AD GetLastError,FormatMessageW,

10_2_007AA6AD

Source: C:\Users\user\AppData\Local\Temp\72076\Launches.pif	Code function: 10_2_00798DE9 AdjustTokenPrivileges,CloseHandle,		10_2_00798DE9
Source: C:\Users\user\AppData\Local\Temp\72076\Launches.pif	Code function: 10_2_00799399 LookupPrivilegeValueW,AdjustTokenPrivileges,GetLastError,		10_2_00799399

Source: C:\Users\user\Desktop\GOmRjFSKNz.exe

0_2_004044A5

Source: C:\Users\user\AppData\Local\Temp\72076\Launches.pif

Code function: 10_2_007A4148 CreateToolhelp32Snapshot,Process32FirstW,Process32NextW,CloseHandle,

10_2_007A4148

Source: C:\Users\user\Desktop\GOmRjFSKNz.exe

Code function: 0_2_004024FB CoCreateInstance,

0_2_004024FB

Source: C:\Users\user\AppData\Local\Temp\72076\Launches.pif

Code function: 10_2_007A443D __swprintf,__swprintf,FindResourceW,LoadResource,LockResource,FindResourceW,LoadResource,SizeofResource,LockResource,CreateIconFromResourceEx,

10_2_007A443D

Source: C:\Users\user\AppData\Local\Temp\72076\RegAsm.exe

File created: C:\Users\user\AppData\Roaming\Microsoft\Crypto\RSA\S-1-5-21-2246122658-3693405117-2476756634-1002\76b53b3ec448f7ccdda2063b15d2bfc3_9e146be9-c76a-4720-bcdb-53011b87bd06

Jump to behavior

Source: C:\Users\user\AppData\Local\Temp\72076\RegAsm.exe	Mutant created: NULL
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:5900:120:WilError_03

Source: C:\Users\user\Desktop\GOmRjFSKNz.exe

File created: C:\Users\user\AppData\Local\Temp\nsl4E2F.tmp

Jump to behavior

Source: C:\Users\user\Desktop\GOmRjFSKNz.exe

Process created: C:\Windows\SysWOW64\cmd.exe "C:\Windows\System32\cmd.exe" /c move Pediatric Pediatric.bat & Pediatric.bat

Source: GOmRjFSKNz.exe

Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ

Source: C:\Windows\SysWOW64\tasklist.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT __PATH, ProcessId, CSName, Caption, SessionId, ThreadCount, WorkingSetSize, KernelModeTime, UserModeTime FROM Win32_Process
Source: C:\Windows\SysWOW64\tasklist.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT __PATH, ProcessId, CSName, Caption, SessionId, ThreadCount, WorkingSetSize, KernelModeTime, UserModeTime FROM Win32_Process

Source: C:\Users\user\Desktop\GOmRjFSKNz.exe

File read: C:\Users\desktop.ini

Jump to behavior

Source: C:\Users\user\Desktop\GOmRjFSKNz.exe

Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: GOmRjFSKNz.exe

ReversingLabs: Detection: 34%

Source: C:\Users\user\Desktop\GOmRjFSKNz.exe

File read: C:\Users\user\Desktop\GOmRjFSKNz.exe

Jump to behavior

Source: unknown	Process created: C:\Users\user\Desktop\GOmRjFSKNz.exe "C:\Users\user\Desktop\GOmRjFSKNz.exe"
Source: C:\Users\user\Desktop\GOmRjFSKNz.exe	Process created: C:\Windows\SysWOW64\cmd.exe "C:\Windows\System32\cmd.exe" /c move Pediatric Pediatric.bat & Pediatric.bat
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\tasklist.exe tasklist
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\findstr.exe findstr /I "wrsa opssvc"
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\tasklist.exe tasklist
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\findstr.exe findstr /I "avastui avgui bdservicehost nswscsvc sophoshealth"
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\cmd.exe cmd /c md 72076
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\findstr.exe findstr /V "SILICONLATINOAMPLANDBLOW" Words
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\cmd.exe cmd /c copy /b ..\Indoor + ..\An + ..\Transport + ..\Strap + ..\Passed + ..\Treasure s
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Users\user\AppData\Local\Temp\72076\Launches.pif Launches.pif s
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\choice.exe choice /d y /t 5
Source: C:\Users\user\AppData\Local\Temp\72076\Launches.pif	Process created: C:\Users\user\AppData\Local\Temp\72076\RegAsm.exe C:\Users\user\AppData\Local\Temp\72076\RegAsm.exe
Source: C:\Users\user\Desktop\GOmRjFSKNz.exe	Process created: C:\Windows\SysWOW64\cmd.exe "C:\Windows\System32\cmd.exe" /c move Pediatric Pediatric.bat & Pediatric.bat	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\tasklist.exe tasklist	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\findstr.exe findstr /I "wrsa opssvc"	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\tasklist.exe tasklist	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\findstr.exe findstr /I "avastui avgui bdservicehost nswscsvc sophoshealth"	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\cmd.exe cmd /c md 72076	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\findstr.exe findstr /V "SILICONLATINOAMPLANDBLOW" Words	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\cmd.exe cmd /c copy /b ..\Indoor + ..\An + ..\Transport + ..\Strap + ..\Passed + ..\Treasure s	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Users\user\AppData\Local\Temp\72076\Launches.pif Launches.pif s	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\choice.exe choice /d y /t 5	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\72076\Launches.pif	Process created: C:\Users\user\AppData\Local\Temp\72076\RegAsm.exe C:\Users\user\AppData\Local\Temp\72076\RegAsm.exe	Jump to behavior

Source: C:\Users\user\Desktop\GOmRjFSKNz.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\Desktop\GOmRjFSKNz.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Users\user\Desktop\GOmRjFSKNz.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\Desktop\GOmRjFSKNz.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Users\user\Desktop\GOmRjFSKNz.exe	Section loaded: shfolder.dll	Jump to behavior
Source: C:\Users\user\Desktop\GOmRjFSKNz.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Users\user\Desktop\GOmRjFSKNz.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Users\user\Desktop\GOmRjFSKNz.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Users\user\Desktop\GOmRjFSKNz.exe	Section loaded: riched20.dll	Jump to behavior
Source: C:\Users\user\Desktop\GOmRjFSKNz.exe	Section loaded: usp10.dll	Jump to behavior
Source: C:\Users\user\Desktop\GOmRjFSKNz.exe	Section loaded: msls31.dll	Jump to behavior
Source: C:\Users\user\Desktop\GOmRjFSKNz.exe	Section loaded: textinputframework.dll	Jump to behavior
Source: C:\Users\user\Desktop\GOmRjFSKNz.exe	Section loaded: coreuicomponents.dll	Jump to behavior
Source: C:\Users\user\Desktop\GOmRjFSKNz.exe	Section loaded: coremessaging.dll	Jump to behavior
Source: C:\Users\user\Desktop\GOmRjFSKNz.exe	Section loaded: ntmarta.dll	Jump to behavior
Source: C:\Users\user\Desktop\GOmRjFSKNz.exe	Section loaded: coremessaging.dll	Jump to behavior
Source: C:\Users\user\Desktop\GOmRjFSKNz.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Users\user\Desktop\GOmRjFSKNz.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Users\user\Desktop\GOmRjFSKNz.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Users\user\Desktop\GOmRjFSKNz.exe	Section loaded: textshaping.dll	Jump to behavior
Source: C:\Users\user\Desktop\GOmRjFSKNz.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\GOmRjFSKNz.exe	Section loaded: edputil.dll	Jump to behavior
Source: C:\Users\user\Desktop\GOmRjFSKNz.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Users\user\Desktop\GOmRjFSKNz.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Users\user\Desktop\GOmRjFSKNz.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Users\user\Desktop\GOmRjFSKNz.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Users\user\Desktop\GOmRjFSKNz.exe	Section loaded: windows.staterepositoryps.dll	Jump to behavior
Source: C:\Users\user\Desktop\GOmRjFSKNz.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Users\user\Desktop\GOmRjFSKNz.exe	Section loaded: appresolver.dll	Jump to behavior
Source: C:\Users\user\Desktop\GOmRjFSKNz.exe	Section loaded: bcp47langs.dll	Jump to behavior
Source: C:\Users\user\Desktop\GOmRjFSKNz.exe	Section loaded: slc.dll	Jump to behavior
Source: C:\Users\user\Desktop\GOmRjFSKNz.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Users\user\Desktop\GOmRjFSKNz.exe	Section loaded: sppc.dll	Jump to behavior
Source: C:\Users\user\Desktop\GOmRjFSKNz.exe	Section loaded: onecorecommonproxystub.dll	Jump to behavior
Source: C:\Users\user\Desktop\GOmRjFSKNz.exe	Section loaded: onecoreuapcommonproxystub.dll	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Section loaded: cmdext.dll	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\tasklist.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\SysWOW64\tasklist.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Windows\SysWOW64\tasklist.exe	Section loaded: framedynos.dll	Jump to behavior
Source: C:\Windows\SysWOW64\tasklist.exe	Section loaded: dbghelp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\tasklist.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\SysWOW64\tasklist.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\SysWOW64\tasklist.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\SysWOW64\tasklist.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\SysWOW64\tasklist.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\SysWOW64\tasklist.exe	Section loaded: wbemcomn.dll	Jump to behavior
Source: C:\Windows\SysWOW64\tasklist.exe	Section loaded: winsta.dll	Jump to behavior
Source: C:\Windows\SysWOW64\tasklist.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\tasklist.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\SysWOW64\tasklist.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\tasklist.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\SysWOW64\tasklist.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Windows\SysWOW64\tasklist.exe	Section loaded: framedynos.dll	Jump to behavior
Source: C:\Windows\SysWOW64\tasklist.exe	Section loaded: dbghelp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\tasklist.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\SysWOW64\tasklist.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\SysWOW64\tasklist.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\SysWOW64\tasklist.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\SysWOW64\tasklist.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\SysWOW64\tasklist.exe	Section loaded: wbemcomn.dll	Jump to behavior
Source: C:\Windows\SysWOW64\tasklist.exe	Section loaded: winsta.dll	Jump to behavior
Source: C:\Windows\SysWOW64\tasklist.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\tasklist.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\SysWOW64\tasklist.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\72076\Launches.pif	Section loaded: wsock32.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\72076\Launches.pif	Section loaded: version.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\72076\Launches.pif	Section loaded: winmm.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\72076\Launches.pif	Section loaded: mpr.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\72076\Launches.pif	Section loaded: wininet.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\72076\Launches.pif	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\72076\Launches.pif	Section loaded: userenv.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\72076\Launches.pif	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\72076\Launches.pif	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\72076\Launches.pif	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\72076\Launches.pif	Section loaded: wldp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\72076\Launches.pif	Section loaded: napinsp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\72076\Launches.pif	Section loaded: pnrpnsp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\72076\Launches.pif	Section loaded: wshbth.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\72076\Launches.pif	Section loaded: nlaapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\72076\Launches.pif	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\72076\Launches.pif	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\72076\Launches.pif	Section loaded: winrnr.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\72076\Launches.pif	Section loaded: rasadhlp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\72076\Launches.pif	Section loaded: ntmarta.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\72076\Launches.pif	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\choice.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\72076\RegAsm.exe	Section loaded: mscoree.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\72076\RegAsm.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\72076\RegAsm.exe	Section loaded: aclayers.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\72076\RegAsm.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\72076\RegAsm.exe	Section loaded: sfc.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\72076\RegAsm.exe	Section loaded: sfc_os.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\72076\RegAsm.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\72076\RegAsm.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\72076\RegAsm.exe	Section loaded: vcruntime140_clr0400.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\72076\RegAsm.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\72076\RegAsm.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\72076\RegAsm.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\72076\RegAsm.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\72076\RegAsm.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\72076\RegAsm.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\72076\RegAsm.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\72076\RegAsm.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\72076\RegAsm.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\72076\RegAsm.exe	Section loaded: dwrite.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\72076\RegAsm.exe	Section loaded: msvcp140_clr0400.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\72076\RegAsm.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\72076\RegAsm.exe	Section loaded: msisip.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\72076\RegAsm.exe	Section loaded: wshext.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\72076\RegAsm.exe	Section loaded: appxsip.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\72076\RegAsm.exe	Section loaded: opcservices.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\72076\RegAsm.exe	Section loaded: esdsip.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\72076\RegAsm.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\72076\RegAsm.exe	Section loaded: dpapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\72076\RegAsm.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\72076\RegAsm.exe	Section loaded: sxs.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\72076\RegAsm.exe	Section loaded: scrrun.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\72076\RegAsm.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\72076\RegAsm.exe	Section loaded: linkinfo.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\72076\RegAsm.exe	Section loaded: mswsock.dll	Jump to behavior

Source: C:\Users\user\Desktop\GOmRjFSKNz.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{20D04FE0-3AEA-1069-A2D8-08002B30309D}\InProcServer32

Jump to behavior

Source: C:\Windows\SysWOW64\cmd.exe

Process created: C:\Windows\SysWOW64\tasklist.exe tasklist

Source: Google Chrome.lnk.16.dr

LNK file: ..\..\..\Program Files\Google\Chrome\Application\chrome.exe

Source: Window Recorder

Window detected: More than 3 window changes detected

Source: C:\Users\user\AppData\Local\Temp\72076\RegAsm.exe

File opened: C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorrc.dll

Jump to behavior

Source: GOmRjFSKNz.exe

Static PE information: DYNAMIC_BASE, NX_COMPAT, NO_SEH, TERMINAL_SERVER_AWARE

Source:	Binary string: \??\C:\Windows\Microsoft.Net\assembly\GAC_MSIL\System.ServiceModel\v4.0_4.0.0.0__b77a5c561934e089\System.ServiceModel.pdb8 source: RegAsm.exe, 00000010.00000002.3032787620.0000000000962000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: \??\C:\Windows\dll\System.ServiceModel.pdb source: RegAsm.exe, 00000010.00000002.3034584358.0000000005EF2000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: nHC:\Windows\System.ServiceModel.pdbpdbdel.pdb source: RegAsm.exe, 00000010.00000002.3032392433.00000000006F7000.00000004.00000010.00020000.00000000.sdmp
Source:	Binary string: RegAsm.pdb source: Launches.pif, 0000000A.00000003.2823843249.0000000004418000.00000004.00000800.00020000.00000000.sdmp, RegAsm.exe, 00000010.00000000.2826358198.0000000000262000.00000002.00000001.01000000.00000007.sdmp, RegAsm.exe.10.dr
Source:	Binary string: C:\Windows\System.ServiceModel.pdb source: RegAsm.exe, 00000010.00000002.3032392433.00000000006F7000.00000004.00000010.00020000.00000000.sdmp
Source:	Binary string: RegAsm.pdb4 source: Launches.pif, 0000000A.00000003.2823843249.0000000004418000.00000004.00000800.00020000.00000000.sdmp, RegAsm.exe, 00000010.00000000.2826358198.0000000000262000.00000002.00000001.01000000.00000007.sdmp, RegAsm.exe.10.dr
Source:	Binary string: System.ServiceModel.pdb source: RegAsm.exe, 00000010.00000002.3032787620.00000000009FC000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: \??\C:\Windows\Microsoft.Net\assembly\GAC_MSIL\System.ServiceModel\v4.0_4.0.0.0__b77a5c561934e089\System.ServiceModel.pdb source: RegAsm.exe, 00000010.00000002.3032787620.0000000000962000.00000004.00000020.00020000.00000000.sdmp

Source: C:\Users\user\Desktop\GOmRjFSKNz.exe

Code function: 0_2_004062FC GetModuleHandleA,LoadLibraryA,GetProcAddress,

0_2_004062FC

Source: C:\Users\user\AppData\Local\Temp\72076\Launches.pif	Code function: 10_2_00768B75 push ecx; ret	10_2_00768B88
Source: C:\Users\user\AppData\Local\Temp\72076\Launches.pif	Code function: 10_2_0075CBDB push eax; retf	10_2_0075CBF8
Source: C:\Users\user\AppData\Local\Temp\72076\Launches.pif	Code function: 10_2_0075CC06 push eax; retf	10_2_0075CBF8
Source: C:\Users\user\AppData\Local\Temp\72076\RegAsm.exe	Code function: 16_2_05DAD413 push es; ret	16_2_05DAD420
Source: C:\Users\user\AppData\Local\Temp\72076\RegAsm.exe	Code function: 16_2_05DAC711 push es; ret	16_2_05DAC720
Source: C:\Users\user\AppData\Local\Temp\72076\RegAsm.exe	Code function: 16_2_05DA804D push ecx; iretd	16_2_05DA8052
Source: C:\Users\user\AppData\Local\Temp\72076\RegAsm.exe	Code function: 16_2_05DAECF2 push eax; ret	16_2_05DAED01
Source: C:\Users\user\AppData\Local\Temp\72076\RegAsm.exe	Code function: 16_2_05DA49AB push FFFFFF8Bh; retf	16_2_05DA49AD
Source: C:\Users\user\AppData\Local\Temp\72076\RegAsm.exe	Code function: 16_2_05DA3B4F push dword ptr [esp+ecx*2-75h]; ret	16_2_05DA3B53

Persistence and Installation Behavior

Drops PE files with a suspicious file extension

Source: C:\Windows\SysWOW64\cmd.exe

File created: C:\Users\user\AppData\Local\Temp\72076\Launches.pif

Jump to dropped file

Installs new ROOT certificates

Source: C:\Users\user\AppData\Local\Temp\72076\RegAsm.exe

Registry value created: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\F1A578C4CB5DE79A370893983FD4DA8B67B2B064 Blob

Jump to behavior

Source: C:\Users\user\AppData\Local\Temp\72076\Launches.pif	File created: C:\Users\user\AppData\Local\Temp\72076\RegAsm.exe			Jump to dropped file
Source: C:\Windows\SysWOW64\cmd.exe	File created: C:\Users\user\AppData\Local\Temp\72076\Launches.pif			Jump to dropped file

Source: C:\Users\user\AppData\Local\Temp\72076\Launches.pif	Code function: 10_2_007C59B3 IsWindowVisible,IsWindowEnabled,GetForegroundWindow,IsIconic,IsZoomed,		10_2_007C59B3
Source: C:\Users\user\AppData\Local\Temp\72076\Launches.pif	Code function: 10_2_00755EDA GetForegroundWindow,FindWindowW,IsIconic,ShowWindow,SetForegroundWindow,GetWindowThreadProcessId,GetWindowThreadProcessId,GetCurrentThreadId,GetWindowThreadProcessId,AttachThreadInput,AttachThreadInput,AttachThreadInput,AttachThreadInput,SetForegroundWindow,MapVirtualKeyW,MapVirtualKeyW,keybd_event,keybd_event,MapVirtualKeyW,keybd_event,MapVirtualKeyW,keybd_event,MapVirtualKeyW,keybd_event,SetForegroundWindow,AttachThreadInput,AttachThreadInput,AttachThreadInput,AttachThreadInput,		10_2_00755EDA

Source: C:\Users\user\AppData\Local\Temp\72076\Launches.pif

Code function: 10_2_007633B7 EncodePointer,__initp_misc_winsig,GetModuleHandleW,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,

10_2_007633B7

Source: C:\Users\user\AppData\Local\Temp\72076\RegAsm.exe

Registry key monitored for changes: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT

Jump to behavior

Source: C:\Users\user\Desktop\GOmRjFSKNz.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\GOmRjFSKNz.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\GOmRjFSKNz.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\GOmRjFSKNz.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\GOmRjFSKNz.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\GOmRjFSKNz.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\GOmRjFSKNz.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\GOmRjFSKNz.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\GOmRjFSKNz.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\GOmRjFSKNz.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\GOmRjFSKNz.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\GOmRjFSKNz.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\tasklist.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\tasklist.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\72076\Launches.pif	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\72076\Launches.pif	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\72076\Launches.pif	Process information set: FAILCRITICALERRORS \| NOALIGNMENTFAULTEXCEPT \| NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\72076\RegAsm.exe	Process information set: NOALIGNMENTFAULTEXCEPT \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\72076\RegAsm.exe	Process information set: NOALIGNMENTFAULTEXCEPT \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\72076\RegAsm.exe	Process information set: NOALIGNMENTFAULTEXCEPT \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\72076\RegAsm.exe	Process information set: NOALIGNMENTFAULTEXCEPT \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\72076\RegAsm.exe	Process information set: NOALIGNMENTFAULTEXCEPT \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\72076\RegAsm.exe	Process information set: NOALIGNMENTFAULTEXCEPT \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\72076\RegAsm.exe	Process information set: NOALIGNMENTFAULTEXCEPT \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\72076\RegAsm.exe	Process information set: NOALIGNMENTFAULTEXCEPT \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\72076\RegAsm.exe	Process information set: NOALIGNMENTFAULTEXCEPT \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\72076\RegAsm.exe	Process information set: NOALIGNMENTFAULTEXCEPT \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\72076\RegAsm.exe	Process information set: NOALIGNMENTFAULTEXCEPT \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\72076\RegAsm.exe	Process information set: NOALIGNMENTFAULTEXCEPT \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\72076\RegAsm.exe	Process information set: NOALIGNMENTFAULTEXCEPT \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\72076\RegAsm.exe	Process information set: NOALIGNMENTFAULTEXCEPT \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\72076\RegAsm.exe	Process information set: NOALIGNMENTFAULTEXCEPT \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\72076\RegAsm.exe	Process information set: NOALIGNMENTFAULTEXCEPT \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\72076\RegAsm.exe	Process information set: NOALIGNMENTFAULTEXCEPT \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\72076\RegAsm.exe	Process information set: NOALIGNMENTFAULTEXCEPT \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\72076\RegAsm.exe	Process information set: NOALIGNMENTFAULTEXCEPT \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\72076\RegAsm.exe	Process information set: NOALIGNMENTFAULTEXCEPT \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\72076\RegAsm.exe	Process information set: NOALIGNMENTFAULTEXCEPT \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\72076\RegAsm.exe	Process information set: NOALIGNMENTFAULTEXCEPT \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\72076\RegAsm.exe	Process information set: NOALIGNMENTFAULTEXCEPT \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\72076\RegAsm.exe	Process information set: NOALIGNMENTFAULTEXCEPT \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\72076\RegAsm.exe	Process information set: NOALIGNMENTFAULTEXCEPT \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\72076\RegAsm.exe	Process information set: NOALIGNMENTFAULTEXCEPT \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\72076\RegAsm.exe	Process information set: NOALIGNMENTFAULTEXCEPT \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\72076\RegAsm.exe	Process information set: NOALIGNMENTFAULTEXCEPT \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\72076\RegAsm.exe	Process information set: NOALIGNMENTFAULTEXCEPT \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\72076\RegAsm.exe	Process information set: NOALIGNMENTFAULTEXCEPT \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\72076\RegAsm.exe	Process information set: NOALIGNMENTFAULTEXCEPT \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\72076\RegAsm.exe	Process information set: NOALIGNMENTFAULTEXCEPT \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\72076\RegAsm.exe	Process information set: NOALIGNMENTFAULTEXCEPT \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\72076\RegAsm.exe	Process information set: NOALIGNMENTFAULTEXCEPT \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\72076\RegAsm.exe	Process information set: NOALIGNMENTFAULTEXCEPT \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\72076\RegAsm.exe	Process information set: NOALIGNMENTFAULTEXCEPT \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\72076\RegAsm.exe	Process information set: NOALIGNMENTFAULTEXCEPT \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\72076\RegAsm.exe	Process information set: NOALIGNMENTFAULTEXCEPT \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\72076\RegAsm.exe	Process information set: NOALIGNMENTFAULTEXCEPT \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\72076\RegAsm.exe	Process information set: NOALIGNMENTFAULTEXCEPT \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\72076\RegAsm.exe	Process information set: NOALIGNMENTFAULTEXCEPT \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\72076\RegAsm.exe	Process information set: NOALIGNMENTFAULTEXCEPT \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\72076\RegAsm.exe	Process information set: NOALIGNMENTFAULTEXCEPT \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\72076\RegAsm.exe	Process information set: NOALIGNMENTFAULTEXCEPT \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\72076\RegAsm.exe	Process information set: NOALIGNMENTFAULTEXCEPT \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\72076\RegAsm.exe	Process information set: NOALIGNMENTFAULTEXCEPT \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\72076\RegAsm.exe	Process information set: NOALIGNMENTFAULTEXCEPT \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\72076\RegAsm.exe	Process information set: NOALIGNMENTFAULTEXCEPT \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\72076\RegAsm.exe	Process information set: NOALIGNMENTFAULTEXCEPT \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\72076\RegAsm.exe	Process information set: NOALIGNMENTFAULTEXCEPT \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\72076\RegAsm.exe	Process information set: NOALIGNMENTFAULTEXCEPT \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\72076\RegAsm.exe	Process information set: NOALIGNMENTFAULTEXCEPT \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\72076\RegAsm.exe	Process information set: NOALIGNMENTFAULTEXCEPT \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\72076\RegAsm.exe	Process information set: NOALIGNMENTFAULTEXCEPT \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\72076\RegAsm.exe	Process information set: NOALIGNMENTFAULTEXCEPT \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\72076\RegAsm.exe	Process information set: NOALIGNMENTFAULTEXCEPT \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\72076\RegAsm.exe	Process information set: NOALIGNMENTFAULTEXCEPT \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\72076\RegAsm.exe	Process information set: NOALIGNMENTFAULTEXCEPT \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\72076\RegAsm.exe	Process information set: NOALIGNMENTFAULTEXCEPT \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\72076\RegAsm.exe	Process information set: NOALIGNMENTFAULTEXCEPT \| NOOPENFILEERRORBOX	Jump to behavior

Source: C:\Users\user\AppData\Local\Temp\72076\RegAsm.exe	Memory allocated: BB0000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\72076\RegAsm.exe	Memory allocated: 2600000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\72076\RegAsm.exe	Memory allocated: 4600000 memory reserve \| memory write watch	Jump to behavior

Source: C:\Users\user\AppData\Local\Temp\72076\Launches.pif

API coverage: 4.8 %

Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Users\user\AppData\Local\Temp\72076\RegAsm.exe	Last function: Thread delayed

Source: C:\Users\user\Desktop\GOmRjFSKNz.exe	Code function: 0_2_004062D5 FindFirstFileW,FindClose,	0_2_004062D5
Source: C:\Users\user\Desktop\GOmRjFSKNz.exe	Code function: 0_2_00402E18 FindFirstFileW,	0_2_00402E18
Source: C:\Users\user\Desktop\GOmRjFSKNz.exe	Code function: 0_2_00406C9B DeleteFileW,lstrcatW,lstrcatW,lstrcatW,lstrlenW,FindFirstFileW,DeleteFileW,FindNextFileW,FindClose,RemoveDirectoryW,	0_2_00406C9B
Source: C:\Users\user\AppData\Local\Temp\72076\Launches.pif	Code function: 10_2_007A4005 FindFirstFileW,DeleteFileW,FindNextFileW,FindClose,FindClose,	10_2_007A4005
Source: C:\Users\user\AppData\Local\Temp\72076\Launches.pif	Code function: 10_2_007A494A GetFileAttributesW,FindFirstFileW,FindClose,	10_2_007A494A
Source: C:\Users\user\AppData\Local\Temp\72076\Launches.pif	Code function: 10_2_007A3CE2 FindFirstFileW,DeleteFileW,DeleteFileW,MoveFileW,DeleteFileW,FindNextFileW,FindClose,FindClose,	10_2_007A3CE2
Source: C:\Users\user\AppData\Local\Temp\72076\Launches.pif	Code function: 10_2_007AC2FF FindFirstFileW,_wcscmp,_wcscmp,FindNextFileW,FindClose,	10_2_007AC2FF
Source: C:\Users\user\AppData\Local\Temp\72076\Launches.pif	Code function: 10_2_007ACD14 FindFirstFileW,FindClose,	10_2_007ACD14
Source: C:\Users\user\AppData\Local\Temp\72076\Launches.pif	Code function: 10_2_007ACD9F FindFirstFileW,FindClose,FileTimeToLocalFileTime,FileTimeToLocalFileTime,FileTimeToLocalFileTime,FileTimeToSystemTime,__swprintf,__swprintf,__swprintf,__swprintf,__swprintf,__swprintf,__swprintf,	10_2_007ACD9F
Source: C:\Users\user\AppData\Local\Temp\72076\Launches.pif	Code function: 10_2_007AF5D8 SetCurrentDirectoryW,FindFirstFileW,FindFirstFileW,_wcscmp,_wcscmp,GetFileAttributesW,SetFileAttributesW,FindNextFileW,FindClose,FindFirstFileW,SetCurrentDirectoryW,_wcscmp,_wcscmp,SetCurrentDirectoryW,SetCurrentDirectoryW,FindNextFileW,FindClose,FindClose,	10_2_007AF5D8
Source: C:\Users\user\AppData\Local\Temp\72076\Launches.pif	Code function: 10_2_007AF735 SetCurrentDirectoryW,FindFirstFileW,FindFirstFileW,_wcscmp,_wcscmp,FindNextFileW,FindClose,FindFirstFileW,SetCurrentDirectoryW,_wcscmp,_wcscmp,SetCurrentDirectoryW,SetCurrentDirectoryW,FindNextFileW,FindClose,FindClose,	10_2_007AF735
Source: C:\Users\user\AppData\Local\Temp\72076\Launches.pif	Code function: 10_2_007AFA36 FindFirstFileW,Sleep,_wcscmp,_wcscmp,FindNextFileW,FindClose,	10_2_007AFA36

Source: C:\Users\user\AppData\Local\Temp\72076\Launches.pif

Code function: 10_2_00755D13 GetVersionExW,GetCurrentProcess,IsWow64Process,GetNativeSystemInfo,FreeLibrary,GetSystemInfo,GetSystemInfo,

10_2_00755D13

Source: C:\Windows\SysWOW64\cmd.exe	File opened: C:\Users\user\AppData\Local\Temp\72076\	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	File opened: C:\Users\user\AppData\Local\Temp\	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	File opened: C:\Users\user\AppData\Local\	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	File opened: C:\Users\user\AppData\Local\Temp\72076	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	File opened: C:\Users\user\AppData\	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	File opened: C:\Users\user\	Jump to behavior

Source: Launches.pif, 0000000A.00000002.2895968083.0000000001D7A000.00000004.00000020.00020000.00000000.sdmp, Launches.pif, 0000000A.00000003.2894423586.0000000001D79000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW%SystemRoot%\system32\mswsock.dllG
Source: RegAsm.exe, 00000010.00000002.3034584358.0000000005F25000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW%SystemRoot%\system32\mswsock.dll

Source: C:\Users\user\AppData\Local\Temp\72076\Launches.pif

Process information queried: ProcessInformation

Jump to behavior

Anti Debugging

Found API chain indicative of debugger detection

Source: C:\Users\user\AppData\Local\Temp\72076\Launches.pif

Debugger detection routine: QueryPerformanceCounter, DebugActiveProcess, DecisionNodes, ExitProcess or Sleep

graph_10-99316

Source: C:\Users\user\AppData\Local\Temp\72076\Launches.pif

Code function: 10_2_007B45D5 BlockInput,

10_2_007B45D5

Source: C:\Users\user\AppData\Local\Temp\72076\Launches.pif

Code function: 10_2_00755240 GetCurrentDirectoryW,IsDebuggerPresent,GetFullPathNameW,KiUserCallbackDispatcher,SetCurrentDirectoryW,MessageBoxA,SetCurrentDirectoryW,GetForegroundWindow,ShellExecuteW,

10_2_00755240

Source: C:\Users\user\AppData\Local\Temp\72076\Launches.pif

Code function: 10_2_00775CAC EncodePointer,EncodePointer,___crtIsPackagedApp,LoadLibraryExW,GetLastError,LoadLibraryExW,GetProcAddress,EncodePointer,GetProcAddress,EncodePointer,GetProcAddress,EncodePointer,GetProcAddress,EncodePointer,GetProcAddress,EncodePointer,IsDebuggerPresent,OutputDebugStringW,DecodePointer,DecodePointer,DecodePointer,DecodePointer,DecodePointer,DecodePointer,DecodePointer,

10_2_00775CAC

Source: C:\Users\user\Desktop\GOmRjFSKNz.exe

Code function: 0_2_004062FC GetModuleHandleA,LoadLibraryA,GetProcAddress,

0_2_004062FC

Source: C:\Users\user\AppData\Local\Temp\72076\Launches.pif

Code function: 10_2_007988CD GetSecurityDescriptorDacl,_memset,GetAclInformation,GetLengthSid,GetAce,AddAce,GetLengthSid,GetProcessHeap,HeapAlloc,GetLengthSid,CopySid,AddAce,SetSecurityDescriptorDacl,SetUserObjectSecurity,

10_2_007988CD

Source: C:\Windows\SysWOW64\tasklist.exe	Process token adjusted: Debug			Jump to behavior
Source: C:\Windows\SysWOW64\tasklist.exe	Process token adjusted: Debug			Jump to behavior

Source: C:\Users\user\AppData\Local\Temp\72076\Launches.pif	Code function: 10_2_0076A354 SetUnhandledExceptionFilter,		10_2_0076A354
Source: C:\Users\user\AppData\Local\Temp\72076\Launches.pif	Code function: 10_2_0076A385 SetUnhandledExceptionFilter,UnhandledExceptionFilter,		10_2_0076A385

Source: C:\Users\user\AppData\Local\Temp\72076\RegAsm.exe

Memory allocated: page read and write | page guard

Jump to behavior

HIPS / PFW / Operating System Protection Evasion

Injects a PE file into a foreign processes

Source: C:\Users\user\AppData\Local\Temp\72076\Launches.pif

Memory written: C:\Users\user\AppData\Local\Temp\72076\RegAsm.exe base: 340000 value starts with: 4D5A

Jump to behavior

Writes to foreign memory regions

Source: C:\Users\user\AppData\Local\Temp\72076\Launches.pif	Memory written: C:\Users\user\AppData\Local\Temp\72076\RegAsm.exe base: 340000			Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\72076\Launches.pif	Memory written: C:\Users\user\AppData\Local\Temp\72076\RegAsm.exe base: 449000			Jump to behavior

Source: C:\Users\user\AppData\Local\Temp\72076\Launches.pif

Code function: 10_2_00799369 LogonUserW,

10_2_00799369

Source: C:\Users\user\AppData\Local\Temp\72076\Launches.pif

Code function: 10_2_00755240 GetCurrentDirectoryW,IsDebuggerPresent,GetFullPathNameW,KiUserCallbackDispatcher,SetCurrentDirectoryW,MessageBoxA,SetCurrentDirectoryW,GetForegroundWindow,ShellExecuteW,

10_2_00755240

Source: C:\Users\user\AppData\Local\Temp\72076\Launches.pif

Code function: 10_2_007A1AC6 SendInput,keybd_event,

10_2_007A1AC6

Source: C:\Users\user\AppData\Local\Temp\72076\Launches.pif

Code function: 10_2_007A51E2 mouse_event,

10_2_007A51E2

Source: C:\Users\user\Desktop\GOmRjFSKNz.exe	Process created: C:\Windows\SysWOW64\cmd.exe "C:\Windows\System32\cmd.exe" /c move Pediatric Pediatric.bat & Pediatric.bat	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\tasklist.exe tasklist	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\findstr.exe findstr /I "wrsa opssvc"	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\tasklist.exe tasklist	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\findstr.exe findstr /I "avastui avgui bdservicehost nswscsvc sophoshealth"	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\cmd.exe cmd /c md 72076	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\findstr.exe findstr /V "SILICONLATINOAMPLANDBLOW" Words	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\cmd.exe cmd /c copy /b ..\Indoor + ..\An + ..\Transport + ..\Strap + ..\Passed + ..\Treasure s	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Users\user\AppData\Local\Temp\72076\Launches.pif Launches.pif s	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\choice.exe choice /d y /t 5	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\72076\Launches.pif	Process created: C:\Users\user\AppData\Local\Temp\72076\RegAsm.exe C:\Users\user\AppData\Local\Temp\72076\RegAsm.exe	Jump to behavior

Source: C:\Users\user\AppData\Local\Temp\72076\Launches.pif

10_2_007988CD

Source: C:\Users\user\AppData\Local\Temp\72076\Launches.pif

Code function: 10_2_007A4F1C AllocateAndInitializeSid,CheckTokenMembership,FreeSid,

10_2_007A4F1C

Source: GOmRjFSKNz.exe, 00000000.00000003.1781635044.0000000002878000.00000004.00000020.00020000.00000000.sdmp, Launches.pif, 0000000A.00000002.2894810207.00000000007F6000.00000002.00000001.01000000.00000006.sdmp, Carol.0.dr, Launches.pif.1.dr	Binary or memory string: Run Script:AutoIt script files (.au3, .a3x).au3;.a3xAll files (.).au3#include depth exceeded. Make sure there are no recursive includesError opening the file>>>AUTOIT SCRIPT<<<Bad directive syntax errorUnterminated stringCannot parse #includeUnterminated group of commentsONOFF0%d%dShell_TrayWndREMOVEKEYSEXISTSAPPENDblankinfoquestionstopwarning
Source: Launches.pif	Binary or memory string: Shell_TrayWnd

Source: C:\Users\user\AppData\Local\Temp\72076\Launches.pif

Code function: 10_2_0076885B cpuid

10_2_0076885B

Source: C:\Users\user\AppData\Local\Temp\72076\RegAsm.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\72076\RegAsm.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\72076\RegAsm.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Windows.Forms\v4.0_4.0.0.0__b77a5c561934e089\System.Windows.Forms.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\72076\RegAsm.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Drawing\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Drawing.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\72076\RegAsm.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Accessibility\v4.0_4.0.0.0__b03f5f7f11d50a3a\Accessibility.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\72076\RegAsm.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.CSharp\v4.0_4.0.0.0__b03f5f7f11d50a3a\Microsoft.CSharp.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\72076\RegAsm.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Dynamic\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Dynamic.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\72076\RegAsm.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.ServiceModel\v4.0_4.0.0.0__b77a5c561934e089\System.ServiceModel.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\72076\RegAsm.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.IdentityModel\v4.0_4.0.0.0__b77a5c561934e089\System.IdentityModel.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\72076\RegAsm.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\SMDiagnostics\v4.0_4.0.0.0__b77a5c561934e089\SMDiagnostics.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\72076\RegAsm.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.ServiceModel.Internals\v4.0_4.0.0.0__31bf3856ad364e35\System.ServiceModel.Internals.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\72076\RegAsm.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation	Jump to behavior

Source: C:\Users\user\AppData\Local\Temp\72076\Launches.pif

Code function: 10_2_00780030 GetLocalTime,__swprintf,

10_2_00780030

Source: C:\Users\user\AppData\Local\Temp\72076\Launches.pif

Code function: 10_2_00780722 GetUserNameW,

10_2_00780722

Source: C:\Users\user\AppData\Local\Temp\72076\Launches.pif

Code function: 10_2_0077416A __lock,____lc_codepage_func,__getenv_helper_nolock,_free,_strlen,__malloc_crt,_strlen,__invoke_watson,_free,GetTimeZoneInformation,WideCharToMultiByte,WideCharToMultiByte,

10_2_0077416A

Source: C:\Users\user\Desktop\GOmRjFSKNz.exe

Code function: 0_2_00406805 GetVersion,GetSystemDirectoryW,GetWindowsDirectoryW,SHGetSpecialFolderLocation,SHGetPathFromIDListW,CoTaskMemFree,lstrcatW,lstrlenW,

0_2_00406805

Source: C:\Users\user\AppData\Local\Temp\72076\RegAsm.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid

Jump to behavior

Stealing of Sensitive Information

Yara detected RedLine Stealer

Source: Yara match	File source: 10.3.Launches.pif.1ddc050.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 16.2.RegAsm.exe.340000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 10.3.Launches.pif.1ddc050.1.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0000000A.00000003.2825546542.000000000519F000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000A.00000003.2833770879.0000000001F91000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000A.00000003.2825065700.0000000001DDD000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000A.00000003.2825688213.0000000001E5B000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000A.00000003.2824672801.0000000001E5B000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000A.00000003.2882687318.0000000001DD3000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000010.00000002.3032255109.0000000000342000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000A.00000003.2882687318.0000000001D91000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000A.00000003.2825305490.0000000001D91000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000A.00000003.2825305490.0000000001DD3000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000A.00000003.2833826824.000000000449B000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000A.00000003.2884666788.0000000001DDC000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000A.00000003.2825915690.0000000001F91000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000A.00000003.2833895594.0000000004418000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000A.00000003.2884370254.0000000001F02000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000A.00000003.2884574282.0000000001E5C000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: Launches.pif PID: 4296, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: RegAsm.exe PID: 1144, type: MEMORYSTR

Source: Launches.pif	Binary or memory string: WIN_81
Source: Launches.pif	Binary or memory string: WIN_XP
Source: Launches.pif	Binary or memory string: WIN_XPe
Source: Launches.pif	Binary or memory string: WIN_VISTA
Source: Launches.pif	Binary or memory string: WIN_7
Source: Launches.pif	Binary or memory string: WIN_8
Source: Launches.pif.1.dr	Binary or memory string: %.3d%S%M%H%m%Y%jX86IA64X64WIN32_NTWIN_10WIN_2016WIN_81WIN_2012R2WIN_2012WIN_8WIN_2008R2WIN_7WIN_2008WIN_VISTAWIN_2003WIN_XPeWIN_XPInstallLanguageSYSTEM\CurrentControlSet\Control\Nls\LanguageSchemeLangIDControl Panel\Appearance3, 3, 14, 3USERPROFILEUSERDOMAINUSERDNSDOMAINGetSystemWow64DirectoryWSeDebugPrivilege:winapistdcallubyte

Remote Access Functionality

Yara detected RedLine Stealer

Source: Yara match	File source: 10.3.Launches.pif.1ddc050.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 16.2.RegAsm.exe.340000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 10.3.Launches.pif.1ddc050.1.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0000000A.00000003.2825546542.000000000519F000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000A.00000003.2833770879.0000000001F91000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000A.00000003.2825065700.0000000001DDD000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000A.00000003.2825688213.0000000001E5B000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000A.00000003.2824672801.0000000001E5B000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000A.00000003.2882687318.0000000001DD3000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000010.00000002.3032255109.0000000000342000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000A.00000003.2882687318.0000000001D91000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000A.00000003.2825305490.0000000001D91000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000A.00000003.2825305490.0000000001DD3000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000A.00000003.2833826824.000000000449B000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000A.00000003.2884666788.0000000001DDC000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000A.00000003.2825915690.0000000001F91000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000A.00000003.2833895594.0000000004418000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000A.00000003.2884370254.0000000001F02000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000A.00000003.2884574282.0000000001E5C000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: Launches.pif PID: 4296, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: RegAsm.exe PID: 1144, type: MEMORYSTR

Source: C:\Users\user\AppData\Local\Temp\72076\Launches.pif	Code function: 10_2_007B696E socket,WSAGetLastError,bind,listen,WSAGetLastError,closesocket,		10_2_007B696E
Source: C:\Users\user\AppData\Local\Temp\72076\Launches.pif	Code function: 10_2_007B6E32 socket,WSAGetLastError,bind,WSAGetLastError,closesocket,		10_2_007B6E32

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	1 Scripting	2 Valid Accounts	1 Windows Management Instrumentation	1 Scripting	1 Exploitation for Privilege Escalation	11 Disable or Modify Tools	21 Input Capture	2 System Time Discovery	Remote Services	1 Archive Collected Data	1 Ingress Tool Transfer	Exfiltration Over Other Network Medium	1 System Shutdown/Reboot
Credentials	Domains	Default Accounts	1 Native API	1 DLL Side-Loading	1 DLL Side-Loading	1 Deobfuscate/Decode Files or Information	LSASS Memory	1 Account Discovery	Remote Desktop Protocol	21 Input Capture	1 Encrypted Channel	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	At	2 Valid Accounts	2 Valid Accounts	2 Obfuscated Files or Information	Security Account Manager	3 File and Directory Discovery	SMB/Windows Admin Shares	3 Clipboard Data	1 Non-Standard Port	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	Cron	Login Hook	21 Access Token Manipulation	1 Install Root Certificate	NTDS	27 System Information Discovery	Distributed Component Object Model	Input Capture	1 Non-Application Layer Protocol	Traffic Duplication	Data Destruction
Gather Victim Network Information	Server	Cloud Accounts	Launchd	Network Logon Script	212 Process Injection	1 DLL Side-Loading	LSA Secrets	1 Query Registry	SSH	Keylogging	11 Application Layer Protocol	Scheduled Transfer	Data Encrypted for Impact
Domain Properties	Botnet	Replication Through Removable Media	Scheduled Task	RC Scripts	RC Scripts	111 Masquerading	Cached Domain Credentials	131 Security Software Discovery	VNC	GUI Input Capture	Multiband Communication	Data Transfer Size Limits	Service Stop
DNS	Web Services	External Remote Services	Systemd Timers	Startup Items	Startup Items	2 Valid Accounts	DCSync	11 Virtualization/Sandbox Evasion	Windows Remote Management	Web Portal Capture	Commonly Used Port	Exfiltration Over C2 Channel	Inhibit System Recovery
Network Trust Dependencies	Serverless	Drive-by Compromise	Container Orchestration Job	Scheduled Task/Job	Scheduled Task/Job	11 Virtualization/Sandbox Evasion	Proc Filesystem	4 Process Discovery	Cloud Services	Credential API Hooking	Application Layer Protocol	Exfiltration Over Alternative Protocol	Defacement
Network Topology	Malvertising	Exploit Public-Facing Application	Command and Scripting Interpreter	At	At	21 Access Token Manipulation	/etc/passwd and /etc/shadow	1 Application Window Discovery	Direct Cloud VM Connections	Data Staged	Web Protocols	Exfiltration Over Symmetric Encrypted Non-C2 Protocol	Internal Defacement
IP Addresses	Compromise Infrastructure	Supply Chain Compromise	PowerShell	Cron	Cron	212 Process Injection	Network Sniffing	1 System Owner/User Discovery	Shared Webroot	Local Data Staging	File Transfer Protocols	Exfiltration Over Asymmetric Encrypted Non-C2 Protocol	External Defacement

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Source	Detection	Scanner	Label	Link
GOmRjFSKNz.exe	34%	ReversingLabs	Win32.Trojan.Generic

Dropped Files

Source	Detection	Scanner	Label	Link
C:\Users\user\AppData\Local\Temp\72076\Launches.pif	5%	ReversingLabs
C:\Users\user\AppData\Local\Temp\72076\RegAsm.exe	0%	ReversingLabs

Source	Detection	Scanner	Label
http://schemas.xmlsoap.org/soap/envelope/	0%	URL Reputation	safe
http://schemas.xmlsoap.org/ws/2005/02/rm/CreateSequenceResponse	0%	URL Reputation	safe
http://schemas.xmlsoap.org/ws/2005/02/rm/TerminateSequence	0%	URL Reputation	safe
http://schemas.xmlsoap.org/ws/2005/05/identity/right/possessproperty	0%	URL Reputation	safe
https://api.ip.sb/ip	0%	URL Reputation	safe
http://schemas.xmlsoap.org/ws/2005/02/rm/SequenceAcknowledgement	0%	URL Reputation	safe
http://schemas.xmlsoap.org/ws/2004/08/addressing/role/anonymous	0%	URL Reputation	safe
http://nsis.sf.net/NSIS_ErrorError	0%	URL Reputation	safe
http://schemas.xmlsoap.org/ws/2005/02/rm/AckRequested	0%	URL Reputation	safe
http://schemas.xmlsoap.org/ws/2004/08/addressing	0%	URL Reputation	safe
http://schemas.xmlsoap.org/ws/2005/02/rm/LastMessage	0%	URL Reputation	safe
http://schemas.xmlsoap.org/ws/2005/02/rm/CreateSequence	0%	URL Reputation	safe
http://schemas.xmlsoap.org/soap/actor/next	0%	URL Reputation	safe
http://schemas.xmlsoap.org/ws/2005/05/identity/claims/dns	0%	URL Reputation	safe

Domains and IPs

Contacted Domains

Name	IP	Active	Malicious	Antivirus Detection	Reputation
GRfewLDzqhRQJfpDiaidRNex.GRfewLDzqhRQJfpDiaidRNex	unknown	unknown	false		unknown

Contacted URLs

Name	Malicious	Antivirus Detection	Reputation
87.120.114.39:47928	true		unknown

URLs from Memory and Binaries

Name	Source	Malicious	Antivirus Detection	Reputation
http://tempuri.org/Entity/Id15Responsex	RegAsm.exe, 00000010.00000002.3033364620.0000000002601000.00000004.00000800.00020000.00000000.sdmp	false		unknown
http://tempuri.org/Entity/Id24LRfq	RegAsm.exe, 00000010.00000002.3033364620.0000000002601000.00000004.00000800.00020000.00000000.sdmp	false		unknown
http://tempuri.org/Entity/Id18Responsex	RegAsm.exe, 00000010.00000002.3033364620.0000000002601000.00000004.00000800.00020000.00000000.sdmp	false		unknown
http://tempuri.org/Entity/Id7LRfqx	RegAsm.exe, 00000010.00000002.3033364620.0000000002601000.00000004.00000800.00020000.00000000.sdmp	false		unknown
http://schemas.xmlsoap.org/soap/envelope/	RegAsm.exe, 00000010.00000002.3033364620.0000000002601000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://tempuri.org/	RegAsm.exe, 00000010.00000002.3033364620.0000000002601000.00000004.00000800.00020000.00000000.sdmp	false		unknown
https://www.autoitscript.com/autoit3/	GOmRjFSKNz.exe, 00000000.00000003.1781635044.0000000002886000.00000004.00000020.00020000.00000000.sdmp, Carol.0.dr, Launches.pif.1.dr	false		unknown
http://tempuri.org/Entity/Id16LRfq	RegAsm.exe, 00000010.00000002.3033364620.0000000002601000.00000004.00000800.00020000.00000000.sdmp	false		unknown
http://tempuri.org/Entity/Id9LRfq	RegAsm.exe, 00000010.00000002.3033364620.0000000002601000.00000004.00000800.00020000.00000000.sdmp	false		unknown
http://tempuri.org/Entity/Id22Responsex	RegAsm.exe, 00000010.00000002.3033364620.0000000002601000.00000004.00000800.00020000.00000000.sdmp	false		unknown
http://tempuri.org/Entity/Id10Responsex	RegAsm.exe, 00000010.00000002.3033364620.0000000002601000.00000004.00000800.00020000.00000000.sdmp	false		unknown
http://tempuri.org/Entity/Id19Responsex	RegAsm.exe, 00000010.00000002.3033364620.0000000002601000.00000004.00000800.00020000.00000000.sdmp	false		unknown
http://schemas.xmlsoap.org/ws/2005/02/rm/CreateSequenceResponse	RegAsm.exe, 00000010.00000002.3033364620.0000000002601000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://tempuri.org/Entity/Id3LRfq	RegAsm.exe, 00000010.00000002.3033364620.0000000002601000.00000004.00000800.00020000.00000000.sdmp	false		unknown
http://tempuri.org/Entity/Id2LRfq	RegAsm.exe, 00000010.00000002.3033364620.0000000002601000.00000004.00000800.00020000.00000000.sdmp	false		unknown
http://schemas.xmlsoap.org/ws/2005/02/rm/TerminateSequence	RegAsm.exe, 00000010.00000002.3033364620.0000000002601000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://tempuri.org/Entity/Id13LRfq	RegAsm.exe, 00000010.00000002.3033364620.0000000002601000.00000004.00000800.00020000.00000000.sdmp	false		unknown
http://tempuri.org/Entity/Id6Responsex	RegAsm.exe, 00000010.00000002.3033364620.0000000002601000.00000004.00000800.00020000.00000000.sdmp	false		unknown
http://tempuri.org/Entity/Id7Responsex	RegAsm.exe, 00000010.00000002.3033364620.0000000002601000.00000004.00000800.00020000.00000000.sdmp	false		unknown
http://tempuri.org/Entity/Id1Responsex	RegAsm.exe, 00000010.00000002.3033364620.0000000002601000.00000004.00000800.00020000.00000000.sdmp	false		unknown
http://tempuri.org/Entity/Id21Responsex	RegAsm.exe, 00000010.00000002.3033364620.0000000002601000.00000004.00000800.00020000.00000000.sdmp	false		unknown
http://schemas.xmlsoap.org/ws/2004/08/addressing/faultp9	RegAsm.exe, 00000010.00000002.3033364620.0000000002601000.00000004.00000800.00020000.00000000.sdmp	false		unknown
http://schemas.xmlsoap.org/ws/2005/05/identity/right/possessproperty	RegAsm.exe, 00000010.00000002.3033364620.0000000002601000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://tempuri.org/Entity/Id14LRfq	RegAsm.exe, 00000010.00000002.3033364620.0000000002601000.00000004.00000800.00020000.00000000.sdmp	false		unknown
http://tempuri.org/Entity/Id5LRfq	RegAsm.exe, 00000010.00000002.3033364620.0000000002601000.00000004.00000800.00020000.00000000.sdmp	false		unknown
http://www.autoitscript.com/autoit3/J	GOmRjFSKNz.exe, 00000000.00000003.1781635044.0000000002886000.00000004.00000020.00020000.00000000.sdmp, Launches.pif, 0000000A.00000000.1818602986.0000000000809000.00000002.00000001.01000000.00000006.sdmp, Carol.0.dr, Launches.pif.1.dr	false		unknown
https://api.ip.sb/ip	Launches.pif, 0000000A.00000003.2825065700.0000000001DDD000.00000004.00000800.00020000.00000000.sdmp, Launches.pif, 0000000A.00000003.2833770879.0000000001F91000.00000004.00000800.00020000.00000000.sdmp, Launches.pif, 0000000A.00000003.2825546542.000000000519F000.00000004.00000800.00020000.00000000.sdmp, Launches.pif, 0000000A.00000003.2825688213.0000000001E5B000.00000004.00000800.00020000.00000000.sdmp, Launches.pif, 0000000A.00000003.2882687318.0000000001DD3000.00000004.00000800.00020000.00000000.sdmp, Launches.pif, 0000000A.00000003.2882687318.0000000001D91000.00000004.00000800.00020000.00000000.sdmp, Launches.pif, 0000000A.00000003.2833826824.000000000449B000.00000004.00000800.00020000.00000000.sdmp, Launches.pif, 0000000A.00000003.2884666788.0000000001DDC000.00000004.00000800.00020000.00000000.sdmp, Launches.pif, 0000000A.00000003.2833895594.0000000004418000.00000004.00000800.00020000.00000000.sdmp, Launches.pif, 0000000A.00000003.2884574282.0000000001E5C000.00000004.00000800.00020000.00000000.sdmp, RegAsm.exe, 00000010.00000002.3032255109.0000000000342000.00000040.00000400.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://tempuri.org/Entity/Id23Responsex	RegAsm.exe, 00000010.00000002.3033364620.0000000002601000.00000004.00000800.00020000.00000000.sdmp	false		unknown
http://schemas.xmlsoap.org/ws/2005/02/rm/SequenceAcknowledgement	RegAsm.exe, 00000010.00000002.3033364620.0000000002601000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://tempuri.org/Entity/Id5Responsex	RegAsm.exe, 00000010.00000002.3033364620.0000000002601000.00000004.00000800.00020000.00000000.sdmp	false		unknown
http://schemas.xmlsoap.org/ws/2004/08/addressing/role/anonymous	RegAsm.exe, 00000010.00000002.3033364620.0000000002601000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://tempuri.org/Entity/Id11LRfq	RegAsm.exe, 00000010.00000002.3033364620.0000000002601000.00000004.00000800.00020000.00000000.sdmp	false		unknown
http://tempuri.org/Entity/Id1LRfq4	RegAsm.exe, 00000010.00000002.3033364620.0000000002601000.00000004.00000800.00020000.00000000.sdmp	false		unknown
http://tempuri.org/Entity/Id14Responsex	RegAsm.exe, 00000010.00000002.3033364620.0000000002601000.00000004.00000800.00020000.00000000.sdmp	false		unknown
http://tempuri.org/Entity/Id2Responsex	RegAsm.exe, 00000010.00000002.3033364620.0000000002601000.00000004.00000800.00020000.00000000.sdmp	false		unknown
http://tempuri.org/Entity/Id11Responsex	RegAsm.exe, 00000010.00000002.3033364620.0000000002601000.00000004.00000800.00020000.00000000.sdmp	false		unknown
http://tempuri.org/Entity/Id20Responsex	RegAsm.exe, 00000010.00000002.3033364620.0000000002601000.00000004.00000800.00020000.00000000.sdmp	false		unknown
http://tempuri.org/Entity/Id4LRfq	RegAsm.exe, 00000010.00000002.3033364620.0000000002601000.00000004.00000800.00020000.00000000.sdmp	false		unknown
http://nsis.sf.net/NSIS_ErrorError	GOmRjFSKNz.exe	false	URL Reputation: safe	unknown
http://tempuri.org/Entity/Id20LRfq	RegAsm.exe, 00000010.00000002.3033364620.0000000002601000.00000004.00000800.00020000.00000000.sdmp	false		unknown
http://tempuri.org/Entity/Id21LRfqduj	RegAsm.exe, 00000010.00000002.3033364620.0000000002601000.00000004.00000800.00020000.00000000.sdmp	false		unknown
http://schemas.xmlsoap.org/ws/2005/02/rm/AckRequested	RegAsm.exe, 00000010.00000002.3033364620.0000000002601000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://tempuri.org/Entity/Id12LRfq	RegAsm.exe, 00000010.00000002.3033364620.0000000002601000.00000004.00000800.00020000.00000000.sdmp	false		unknown
http://tempuri.org/Entity/Id8Responsex	RegAsm.exe, 00000010.00000002.3033364620.0000000002601000.00000004.00000800.00020000.00000000.sdmp	false		unknown
http://tempuri.org/Entity/Id13Responsex	RegAsm.exe, 00000010.00000002.3033364620.0000000002601000.00000004.00000800.00020000.00000000.sdmp	false		unknown
http://tempuri.org/Entity/Id16Responsex	RegAsm.exe, 00000010.00000002.3033364620.0000000002601000.00000004.00000800.00020000.00000000.sdmp	false		unknown
http://tempuri.org/Entity/	RegAsm.exe, 00000010.00000002.3033364620.0000000002601000.00000004.00000800.00020000.00000000.sdmp	false		unknown
http://tempuri.org/Entity/Id9Responsex	RegAsm.exe, 00000010.00000002.3033364620.0000000002601000.00000004.00000800.00020000.00000000.sdmp	false		unknown
http://schemas.xmlsoap.org/ws/2004/08/addressing	RegAsm.exe, 00000010.00000002.3033364620.0000000002601000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://tempuri.org/Entity/Id15LRfqx/j	RegAsm.exe, 00000010.00000002.3033364620.0000000002601000.00000004.00000800.00020000.00000000.sdmp	false		unknown
http://tempuri.org/Entity/Id3Responsex	RegAsm.exe, 00000010.00000002.3033364620.0000000002601000.00000004.00000800.00020000.00000000.sdmp	false		unknown
http://tempuri.org/Entity/Id8LRfq	RegAsm.exe, 00000010.00000002.3033364620.0000000002601000.00000004.00000800.00020000.00000000.sdmp	false		unknown
http://tempuri.org/Entity/Id17LRfq	RegAsm.exe, 00000010.00000002.3033364620.0000000002601000.00000004.00000800.00020000.00000000.sdmp	false		unknown
http://tempuri.org/Entity/Id24Responsex	RegAsm.exe, 00000010.00000002.3033364620.0000000002601000.00000004.00000800.00020000.00000000.sdmp	false		unknown
http://schemas.xmlsoap.org/ws/2005/02/rm	RegAsm.exe, 00000010.00000002.3033364620.0000000002601000.00000004.00000800.00020000.00000000.sdmp	false		unknown
http://tempuri.org/Entity/Id19LRfq	RegAsm.exe, 00000010.00000002.3033364620.0000000002601000.00000004.00000800.00020000.00000000.sdmp	false		unknown
http://tempuri.org/Entity/Id6LRfq	RegAsm.exe, 00000010.00000002.3033364620.0000000002601000.00000004.00000800.00020000.00000000.sdmp	false		unknown
http://schemas.xmlsoap.org/ws/2005/02/rm/LastMessage	RegAsm.exe, 00000010.00000002.3033364620.0000000002601000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://tempuri.org/Entity/Id22LRfq	RegAsm.exe, 00000010.00000002.3033364620.0000000002601000.00000004.00000800.00020000.00000000.sdmp	false		unknown
http://tempuri.org/Entity/Id23LRfq	RegAsm.exe, 00000010.00000002.3033364620.0000000002601000.00000004.00000800.00020000.00000000.sdmp	false		unknown
http://tempuri.org/Entity/Id12Responsex	RegAsm.exe, 00000010.00000002.3033364620.0000000002601000.00000004.00000800.00020000.00000000.sdmp	false		unknown
http://tempuri.org/Entity/Id17Responsex	RegAsm.exe, 00000010.00000002.3033364620.0000000002601000.00000004.00000800.00020000.00000000.sdmp	false		unknown
http://tempuri.org/Entity/Id10LRfq	RegAsm.exe, 00000010.00000002.3033364620.0000000002601000.00000004.00000800.00020000.00000000.sdmp	false		unknown
http://schemas.xmlsoap.org/ws/2005/02/rm/CreateSequence	RegAsm.exe, 00000010.00000002.3033364620.0000000002601000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://tempuri.org/Entity/Id18LRfq	RegAsm.exe, 00000010.00000002.3033364620.0000000002601000.00000004.00000800.00020000.00000000.sdmp	false		unknown
http://schemas.xmlsoap.org/soap/actor/next	RegAsm.exe, 00000010.00000002.3033364620.0000000002601000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://schemas.xmlsoap.org/ws/2005/05/identity/claims/dns	RegAsm.exe, 00000010.00000002.3033364620.0000000002601000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://tempuri.org/Entity/Id4Responsex	RegAsm.exe, 00000010.00000002.3033364620.0000000002601000.00000004.00000800.00020000.00000000.sdmp	false		unknown

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	Flag	ASN	ASN Name	Malicious
87.120.114.39	unknown	Bulgaria		25206	UNACS-AS-BG8000BurgasBG	true

General Information

Joe Sandbox version:	41.0.0 Charoite
Analysis ID:	1534173
Start date and time:	2024-10-15 17:01:15 +02:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 7m 41s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	18
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Sample name:	GOmRjFSKNz.exe renamed because original name is a hash value
Original Sample Name:	bc37b8380183870ec6acd56886f3ef4537bf63c71935a094307875e03b0d2bb5.exe
Detection:	MAL
Classification:	mal100.troj.evad.winEXE@24/17@1/1
EGA Information:	Successful, ratio: 100%
HCA Information:	Successful, ratio: 99% Number of executed functions: 100 Number of non-executed functions: 296
Cookbook Comments:	Found application associated with file extension: .exe

Warnings

Exclude process from analysis (whitelisted): MpCmdRun.exe, dllhost.exe, WMIADAP.exe, SIHClient.exe, conhost.exe
Excluded domains from analysis (whitelisted): ocsp.digicert.com, slscr.update.microsoft.com, otelrules.azureedge.net, ctldl.windowsupdate.com, fe3cr.delivery.mp.microsoft.com
Not all processes where analyzed, report is missing behavior information
Report size exceeded maximum capacity and may have missing behavior information.
Report size exceeded maximum capacity and may have missing disassembly code.
Report size getting too big, too many NtAllocateVirtualMemory calls found.
Report size getting too big, too many NtOpenKeyEx calls found.
Report size getting too big, too many NtProtectVirtualMemory calls found.
Report size getting too big, too many NtQueryValueKey calls found.
Report size getting too big, too many NtSetInformationFile calls found.
VT rate limit hit for: GOmRjFSKNz.exe

Simulations

Behavior and APIs

Time	Type	Description
11:02:22	API Interceptor	2503x Sleep call for process: Launches.pif modified

Joe Sandbox View / Context

IPs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
87.120.114.39	t1B7sgX825.exe	Get hash	malicious	RedLine	Browse

Domains

⊘No context

ASNs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
UNACS-AS-BG8000BurgasBG	t1B7sgX825.exe	Get hash	malicious	RedLine	Browse	87.120.114.39
	r3DGQXicwA.exe	Get hash	malicious	LummaC, RedLine	Browse	87.120.127.223
	r3DGQXicwA.exe	Get hash	malicious	LummaC, MicroClip, RedLine	Browse	87.120.127.223
	https://anviict.com/?qvtvxymb	Get hash	malicious	HTMLPhisher	Browse	87.120.125.203
	1728486965f09c65efe9ac8095b3334d8c21391956afcf95821ee79f205e6ccc5199206ffd610.dat-decoded.exe	Get hash	malicious	Remcos	Browse	87.120.117.161
	n92fR6j8tl.rtf	Get hash	malicious	Remcos	Browse	87.120.117.161
	https://www.google.com.bo/url?url=https://coqjcqixwpeuzndc&hpj=jguragr&fwbtzg=qoe&ffzzf=olnshn&aes=fvotjnl&garqe=txbrxc&emrj=ycbtmrgd&uwzlcgsurn=eygnbnharg&q=amp/jhjn24u.v%C2%ADvg%C2%ADzy%C2%ADnp%C2%ADe%C2%ADw%C2%ADl%C2%ADkkukl.com%E2%80%8B/4b3puorbt&vijx=zlglfoj&qcobrch=pupf&cjaim=omgedz&guneqiu=xqm&d=DwMFAg	Get hash	malicious	Unknown	Browse	87.120.114.172
	ordin de plat#U0103.docx	Get hash	malicious	Remcos	Browse	87.120.117.161
	5fnrWlGa3H.exe	Get hash	malicious	XenoRAT	Browse	87.120.116.119
	https://z168563365.cloud/	Get hash	malicious	Unknown	Browse	87.120.117.199

JA3 Fingerprints

⊘No context

Dropped Files

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link
C:\Users\user\AppData\Local\Temp\72076\Launches.pif	t1B7sgX825.exe	Get hash	malicious	RedLine	Browse
	sV9ElC4fU4.exe	Get hash	malicious	GO Backdoor	Browse
	Lz1uWbvPmZ.exe	Get hash	malicious	Unknown	Browse
	cW5i0RdQ4L.exe	Get hash	malicious	Unknown	Browse
	cW5i0RdQ4L.exe	Get hash	malicious	Unknown	Browse
	67079aecc452b_xin.exe	Get hash	malicious	Unknown	Browse
	6706e721f2c06.exe	Get hash	malicious	Remcos	Browse
	hlyG1m5UmO.exe	Get hash	malicious	Stealc, Vidar	Browse
	file.exe	Get hash	malicious	Clipboard Hijacker, Stealc, Vidar	Browse
	M13W1o3scc.exe	Get hash	malicious	Stealc	Browse
C:\Users\user\AppData\Local\Temp\72076\RegAsm.exe	t1B7sgX825.exe	Get hash	malicious	RedLine	Browse
	08(2)_00.exe	Get hash	malicious	AgentTesla	Browse
	rDoc5633276235623657_xls.exe	Get hash	malicious	StormKitty, XWorm	Browse
	lchs.exe	Get hash	malicious	Quasar	Browse
	Shipping Documemt.vbs	Get hash	malicious	Lokibot	Browse
	AaK2FmzNcl.exe	Get hash	malicious	LummaC	Browse
	SecuriteInfo.com.Trojan.Siggen29.33686.11630.12129.exe	Get hash	malicious	Unknown	Browse
	SecuriteInfo.com.Trojan.Siggen29.33686.11630.12129.exe	Get hash	malicious	Unknown	Browse
	pic4.jpg.exe	Get hash	malicious	AsyncRAT, DcRat, Stealerium, StormKitty	Browse
	file.exe	Get hash	malicious	RisePro Stealer	Browse

Created / dropped Files

C:\Users\Public\Desktop\Google Chrome.lnk

Download File

Process:	C:\Users\user\AppData\Local\Temp\72076\RegAsm.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Description string, Has Relative path, Has Working directory, Has command line arguments, Icon number=0, Archive, ctime=Tue Oct 3 09:48:41 2023, mtime=Wed Oct 4 11:02:38 2023, atime=Wed Sep 27 04:28:27 2023, length=3242272, window=hide
Category:	dropped
Size (bytes):	2104
Entropy (8bit):	3.4565377172144633
Encrypted:	false
SSDEEP:	48:8SFd7oTbs07RYrnvPdAKRkdAGdAKRFdAKR/U:8Sjon4
MD5:	8EDBB395DA95C66BF31B1DE5F62D176F
SHA1:	143D31721A37A5D9850206956C16DEC9058B246C
SHA-256:	B7519557D493FC60C12BF5325BC9CAB0D6FAF6CE23FA0FFDD4316FA35603E5B6
SHA-512:	BF1E14118BF8BB0ED065F4EB240959C64FF464382D13F2FE8A4B5E0DC8AB06AA31BD084C122E51CEE9DA5BA5D2E72A96B07C02D3CB797CCC10D45B1F802A0A8D
Malicious:	false
Preview:	L..................F.@.. ......,......0........q.... y1.....................#....P.O. .:i.....+00.../C:\.....................1.....DW.V..PROGRA~1..t......O.IDW5`....B...............J.....i...P.r.o.g.r.a.m. .F.i.l.e.s...@.s.h.e.l.l.3.2...d.l.l.,.-.2.1.7.8.1.....T.1.....CW.V..Google..>......CW.VDWT`....L.....................p+j.G.o.o.g.l.e.....T.1.....CW.V..Chrome..>......CW.VDWT`....M......................8..C.h.r.o.m.e.....`.1.....CW.V..APPLIC~1..H......CW.VDWT`..........................."&.A.p.p.l.i.c.a.t.i.o.n.....`.2. y1.;W.+ .chrome.exe..F......CW.VDWJ`..........................,.6.c.h.r.o.m.e...e.x.e.......d...............-.......c............F.......C:\Program Files\Google\Chrome\Application\chrome.exe....A.c.c.e.s.s. .t.h.e. .I.n.t.e.r.n.e.t.;.....\.....\.....\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.\.c.h.r.o.m.e...e.x.e.*.C.:.\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.!.-.-.p.r.o.x.y.-.s.e.r.v.e.r

C:\Users\user\AppData\Local\Temp\72076\Launches.pif

Download File

Process:	C:\Windows\SysWOW64\cmd.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	modified
Size (bytes):	893608
Entropy (8bit):	6.62028134425878
Encrypted:	false
SSDEEP:	12288:WpV0etV7qtINsegA/rMyyzlcqakvAfcN9b2MyZa31tqoPTdFbgawV2501:WTxz1JMyyzlohMf1tN70aw8501
MD5:	18CE19B57F43CE0A5AF149C96AECC685
SHA1:	1BD5CA29FC35FC8AC346F23B155337C5B28BBC36
SHA-256:	D8B7C7178FBADBF169294E4F29DCE582F89A5CF372E9DA9215AA082330DC12FD
SHA-512:	A0C58F04DFB49272A2B6F1E8CE3F541A030A6C7A09BB040E660FC4CD9892CA3AC39CF3D6754C125F7CD1987D1FCA01640A153519B4E2EB3E3B4B8C9DC1480558
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 5%
Joe Sandbox View:	Filename: t1B7sgX825.exe, Detection: malicious, Browse Filename: sV9ElC4fU4.exe, Detection: malicious, Browse Filename: Lz1uWbvPmZ.exe, Detection: malicious, Browse Filename: cW5i0RdQ4L.exe, Detection: malicious, Browse Filename: cW5i0RdQ4L.exe, Detection: malicious, Browse Filename: 67079aecc452b_xin.exe, Detection: malicious, Browse Filename: 6706e721f2c06.exe, Detection: malicious, Browse Filename: hlyG1m5UmO.exe, Detection: malicious, Browse Filename: file.exe, Detection: malicious, Browse Filename: M13W1o3scc.exe, Detection: malicious, Browse
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........sD.R..R..R...C..P.....S.._@..a.._@....._@..g..[j..[..[j..w..R.+.r...........S.._@..S..R...P.....S..RichR.*.........................PE..L...._pZ.........."...............................@.......................................@...@.......@.........................\|.......P....................p...q...;.............................. [..@............................................text............................... ..`.rdata..............................@..@.data...t........R..................@....rsrc...P............<..............@..@.reloc...q...p...r..................@..B................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\72076\RegAsm.exe

Download File

Process:	C:\Users\user\AppData\Local\Temp\72076\Launches.pif
File Type:	PE32 executable (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	65440
Entropy (8bit):	6.049806962480652
Encrypted:	false
SSDEEP:	768:X8XcJiMjm2ieHlPyCsSuJbn8dBhFwlSMF6Iq8KSYDKbQ22qWqO8w1R:rYMaNylPYSAb8dBnsHsPDKbQBqTY
MD5:	0D5DF43AF2916F47D00C1573797C1A13
SHA1:	230AB5559E806574D26B4C20847C368ED55483B0
SHA-256:	C066AEE7AA3AA83F763EBC5541DAA266ED6C648FBFFCDE0D836A13B221BB2ADC
SHA-512:	F96CF9E1890746B12DAF839A6D0F16F062B72C1B8A40439F96583F242980F10F867720232A6FA0F7D4D7AC0A7A6143981A5A130D6417EA98B181447134C7CFE2
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Joe Sandbox View:	Filename: t1B7sgX825.exe, Detection: malicious, Browse Filename: 08(2)_00.exe, Detection: malicious, Browse Filename: rDoc5633276235623657_xls.exe, Detection: malicious, Browse Filename: lchs.exe, Detection: malicious, Browse Filename: Shipping Documemt.vbs, Detection: malicious, Browse Filename: AaK2FmzNcl.exe, Detection: malicious, Browse Filename: SecuriteInfo.com.Trojan.Siggen29.33686.11630.12129.exe, Detection: malicious, Browse Filename: SecuriteInfo.com.Trojan.Siggen29.33686.11630.12129.exe, Detection: malicious, Browse Filename: pic4.jpg.exe, Detection: malicious, Browse Filename: file.exe, Detection: malicious, Browse
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L....<.]..............0.............^.... ........@.. ....................... .......F....`.....................................O.......8................A........................................................... ............... ..H............text...d.... ...................... ..`.rsrc...8...........................@..@.reloc..............................@..B................@.......H........A...p..........T................................................~P...-.r...p.....(....(....s.....P.....0.."........(......-.r...p.rI..p(....s....z....0..........(....~P.....o........(....n(.....(..........%...(....~(.....(..........%...%...(.....(.....(..........%...%...%...(....V.(......}Q.....}R.....{Q.....{R......0...........(.......i.=...}S......i.@...}T......i.@...}U.....+m...(....o .....r]..p.o!...,..{T.......{U........o"....+(.ra..p.o!...,..{T.......

C:\Users\user\AppData\Local\Temp\72076\s

Download File

Process:	C:\Windows\SysWOW64\cmd.exe
File Type:	data
Category:	dropped
Size (bytes):	420239
Entropy (8bit):	7.9996089165412725
Encrypted:	true
SSDEEP:	12288:jPaglnjMkNF5iT/bCRILfQBhhJCDoTaHSs:Flnjbq/bC+f+wDoOHSs
MD5:	78490A8C0979F627FCF9817A5A6441A4
SHA1:	472C2041122415DFEE9C75CF9573827D4EEADDA7
SHA-256:	8711245C729901471854228C9296EB81DA03B3E7A62A0A8D840747FC11E02C85
SHA-512:	C0F5883095FB8D31A5254012C265FBE33A8DC6847431FB56AC2D59B475A278BDC62544ECC73F6B1A19ACA7E3CDA39CFE79A9BB6E279B94999E55C301BEBBC8F4
Malicious:	false
Preview:	..}].....<.,%.^dX..5..!Z...;......-IY..db..`......7?.....Z....[.+.....q..i.?TGLd.`w....a)R.HK..lJ..LS...H}AU3!EA06M..s$.<.z..g....kC.R.....:!.)......@...F..k;!..u:.=..3............d.a.Mb...l.t.jxI..8.v...r.T...txH..!..)98O...,.XOg;Mm.=..A..FPWW.....Y...$c..F.Kx...i..f3.H....2)...<.9.m....&...4....Rx...5.I.'.F...h.............8....e.8....e.kC.R......%x....}...q..U-...(....%....V..?p.hf..........@.#....{'.l..v..)~.K....dC`:.......c!.).A.&!0..~..}..h..w14.h.%.!4.A...V..+}.,{{.s.x..K....V.E...`.[..r....#..,P..Myn.2..t.W............k.2.8.....T.8....e.m.....6.....5...x..2).U.j....>.T#.~...He....<%i.......u-......r.w....i,9..a.` ...K=._.EN3SY.<...N.`.`g......' ."..vd...k.n.P..'......0.%.;!..il."..HM...7.z..Y(?.[y&..M..........nG..t....j...q..%q,..3.r.r.....{m...z.{.-dXJ.h.]....(?.....P$w.k...4...mS.Ts.]. ...'..2..(R.>..p..X...`w..N.../....b.....8...{y......:..AB.u....e..?..p.....1P.\|.Z..I~./...-....t...Y....t..K.{.:........!o..!.....

C:\Users\user\AppData\Local\Temp\An

Download File

Process:	C:\Users\user\Desktop\GOmRjFSKNz.exe
File Type:	data
Category:	dropped
Size (bytes):	92160
Entropy (8bit):	7.998172355437157
Encrypted:	true
SSDEEP:	1536:zvqgDz0auKciGQkNKQl3DYDdjSXogZbEhOU7IKhXM4E7ia1Y:WBauKxkNP9tbo/IKdE7iaK
MD5:	8F2D0F66949DBAF2B2D01B372F1D1EF9
SHA1:	0C032B114276123BA432C02E1A5FC398F86BBC45
SHA-256:	9FD98BBAA8AA38BE6D437DA50043547840F532D1655EBE0A5A4B42ED35C7A559
SHA-512:	970969F0ECF909A47161AEAEC37AC72D1059FC1BA875AC0686334543F0CC9065B22E79EADD929D41C7D6D8B059B6DAF5C69E2C3ABFBC47417243D505D6675333
Malicious:	false
Preview:	u.DK4z\...&.`2..........e.>....B...x...x.[.%...6.6.a.n0...<.x~...<...3.l..(.@h....~Rse...b^\.D.J~"lB...Jt..@g...I1....=....U...."._Lv.`.d.\|.............(.x..fj.R;.....~L.Ca.'...S........]..V.....Y$?....].kc...._.d.x..H........K.Q.]W).M.C..2.u...DeD\.....Jj....{.WI7..VSUS....).9S...!.l.....f....3.....'....Ld1.+......r....V..Y. Y...k8...9..z.).....>oz....T.=(..p\....d.....i.V..}I.......w.+..?a{.q.b....9..@Z.8?_.dT&..a#..w...5N.. ..^]f..}.O..t...l..`;.f.2.S.rL.0...bBW..\Q.u...m...<..>..!A.I.FE..Za.......=<.P.X....._.F...-'..l.fs.........-.D...8....#.s...}..r....X...YF.!.x!N....U...^^.C#..{K....@..."....../#...v6.3..l.2.!.4....]...j.....x.G..f.."a.!....D%h.C....Q6.KG._.Ev)....'/.8._<..g.'..n.y.^.......r......f~.b.G.w.`.8.;_. j.nH.c.o+.Z.4....x....7.c..p...n.f\.ww...1.A.v......!.......a.._..l.-...k.1......=pc+u...w......k..vQF/.+.R....W..T.".4.....4K\.k...l?.(.ps...n.......qp.Q..86S...2....r...L...3F.-.G...4..z9...E..g...Bf.....T.....\...G

C:\Users\user\AppData\Local\Temp\Carol

Download File

Process:	C:\Users\user\Desktop\GOmRjFSKNz.exe
File Type:	data
Category:	dropped
Size (bytes):	888126
Entropy (8bit):	6.622335651056381
Encrypted:	false
SSDEEP:	12288:QV0etV7qtINsegA/rMyyzlcqakvAfcN9b2MyZa31tqoPTdFbgawV2501:yxz1JMyyzlohMf1tN70aw8501
MD5:	9E472DFB4AA9E650F42014869344AA5A
SHA1:	FA126D3BD607524507C57D2CAD46735ECE0DAE9C
SHA-256:	0FEBD931280B14D0747869030D265C77EF301158680E0EF360522481D2E81E2D
SHA-512:	B192F9FD67BE1EBF8F413582036AF23463AE8A277B1E8053A177AFA4279B54C5C6428ACD6BEBF00245F1CF92AB897739F73668DF68F843AD29EB3DED7180662E
Malicious:	false
Preview:	j0V....I.9..........._..^[].0.%.....U...8SV.u.W.~:...m....].........E.E.P.6..4.I..M.E.VD.~H.M..E..U..}.....d.......s............}....E.P.3....I..E.M.+..U.E.E.+.E.E.P.6.U..M...p.I..}....E..u.M..}.f..........E...}.f.......E...E...}.f.......E...E...}.f......f..............t(.E.f.........u..........E..+...;............t'.E.f........`u..........E..+...;........U......................... ..R.....@..U..._^[..]....}.f.FX.......f......f.F\f......t_f.F`f......f.Fdf.......E.P.7..4.I....9^Xt=9^\tE.E.P.7....I.9^`......9^d...............{.......}..t..f.E.f.......f.E.f.......U..wL..M..........E....t..AX.E....t..A\.E...~..A`.E...~..Ad]...U..Q..xL.V.u.Wj.....8W................4xL.j.Z.U.;........$xL.....0.........F.;G.............................................}...VW.....~d.......~h.......~D........~P.......>.t..6..<.I..&..u...wL..x.....4xL..U.B.U.;...V....u... .........$..........xL........t.Q........xL..... ....wL.J...wL.;5.xL.u....xL.....xL.........._^..u..5.wL.R....I..%

C:\Users\user\AppData\Local\Temp\Indoor

Download File

Process:	C:\Users\user\Desktop\GOmRjFSKNz.exe
File Type:	data
Category:	dropped
Size (bytes):	74752
Entropy (8bit):	7.99770612293514
Encrypted:	true
SSDEEP:	1536:CqtEhrLCHJqu5Ni+tUyxpcAwgU/HKH3bj6hc3TaIrcYOt:xE1yH5Ni49DJwgU/HKH3v6auYOt
MD5:	31709B274F120FC824D4201C851AB05B
SHA1:	2273B87CED1B45D0B5BE3B69129B7FCCD87B242E
SHA-256:	F27112C86F03CBB7AD3794D5AE25ED3266D759454F77FD277779D92C78E30BD4
SHA-512:	E8CCA4F35AACECB4DC062F8EFEF3AA1B04600833B3EE82A2480C3FDD2A27ABF44589A1EFB955488814253F69270E13253E150F02987C84116CCDBD854E77BCA5
Malicious:	false
Preview:	..}].....<.,%.^dX..5..!Z...;......-IY..db..`......7?.....Z....[.+.....q..i.?TGLd.`w....a)R.HK..lJ..LS...H}AU3!EA06M..s$.<.z..g....kC.R.....:!.)......@...F..k;!..u:.=..3............d.a.Mb...l.t.jxI..8.v...r.T...txH..!..)98O...,.XOg;Mm.=..A..FPWW.....Y...$c..F.Kx...i..f3.H....2)...<.9.m....&...4....Rx...5.I.'.F...h.............8....e.8....e.kC.R......%x....}...q..U-...(....%....V..?p.hf..........@.#....{'.l..v..)~.K....dC`:.......c!.).A.&!0..~..}..h..w14.h.%.!4.A...V..+}.,{{.s.x..K....V.E...`.[..r....#..,P..Myn.2..t.W............k.2.8.....T.8....e.m.....6.....5...x..2).U.j....>.T#.~...He....<%i.......u-......r.w....i,9..a.` ...K=._.EN3SY.<...N.`.`g......' ."..vd...k.n.P..'......0.%.;!..il."..HM...7.z..Y(?.[y&..M..........nG..t....j...q..%q,..3.r.r.....{m...z.{.-dXJ.h.]....(?.....P$w.k...4...mS.Ts.]. ...'..2..(R.>..p..X...`w..N.../....b.....8...{y......:..AB.u....e..?..p.....1P.\|.Z..I~./...-....t...Y....t..K.{.:........!o..!.....

C:\Users\user\AppData\Local\Temp\Passed

Download File

Process:	C:\Users\user\Desktop\GOmRjFSKNz.exe
File Type:	data
Category:	dropped
Size (bytes):	90112
Entropy (8bit):	7.997968848515228
Encrypted:	true
SSDEEP:	1536:3yvb76bs28es8dnqEX/mrRAtgGmoH7KxFGH0hCcLhMSPMkxth+kaNa3VGUiE:CvkqE6ueGmoyFGHIdBP/jaN0VGC
MD5:	8E319204F44DD7F3DC576AF2F5AD460A
SHA1:	AA93C6DE824398C0B72FC2FF73F5880F947B9138
SHA-256:	CCE6247863F966B4C491F3E5ABC7DCC6D539CAB4EE155C0CD89A9D1340AEE8D3
SHA-512:	1436B1ACDB02BD698C1CBE8B6A04EB19F1561F66A14318C4C391AC55F1E035C5D8ED88BCD990DB0CDFEE9E5F51FD177F060E7AC79FC3EDC6210E99EF864F469E
Malicious:	false
Preview:	...$h...mm....:.'\|..V....0A.t.c._.Eu......L.,....J.{6.}..h....=&?;...[YmqN...-4.g.`Ju.^?.g..M.....Vq........#....Ip..`.!".l..........u..f......e\.....~.>s9w.>...C..K..~..m.I.P{..H..k..x..^,..n.M.SG.....T.}...\|K..../..HZWHA.d.......@..\.O.2...X...z.Q.MZ_./%........%u.....F. .U.PnnW}`.`.@4.[...V........m.p..v.6.....<Z.0.u@&ly..>.3V......zJm..{..va...Cb............N.....(...%."?....'.......3.2....x..(.;...s._..R.L.....q(..{D.'e.Z^2.V_WK.0.ok.N.0.....V...&..x....e{?.r.ww...~.JR...I.4.Z.D.F...X...z..?p..O.$NGCF...Yf..w.B..2...>{y.../....#m...T.10..D.&M..tU....qG.$..C..{{K.....P.Z?.....l.4q....,.=...q.XN.X7ff.G.dI...`...........f..7.&y....f..\.....!..E..\....].((qs...m..C.%. .OV./.H..+W..............+[..?.SV......+...ZO{g......et...T]M.M+.:.)s.D....(s..0.....-!.F....@...x-....u......r.!...:Rq..d!.}..S{...IM..d..x..]B..Yg..b..;.w.S...x..0.zOc]H..U...x.oc#...+...K.4.!..!.{\.9...~....A..5M/.v.......u.......gv}.. 62.9%I)Q..$..f,)E1......t.>.Xvpb....{.

C:\Users\user\AppData\Local\Temp\Pediatric

Download File

Process:	C:\Users\user\Desktop\GOmRjFSKNz.exe
File Type:	ASCII text, with very long lines (701), with CRLF line terminators
Category:	dropped
Size (bytes):	19614
Entropy (8bit):	5.111305020482894
Encrypted:	false
SSDEEP:	384:saIumW1XDpRcLDD15YVx4I7kdl4jLs2SmMvptNVVYY296QS:sEXDvcJ5Ux4IeSjLsXmCLt
MD5:	760676D8E0F2A9E3012EE11B7AC50C59
SHA1:	616D91F2E3F9A91BCBE68EE3E2D1CD4E320CC19B
SHA-256:	A3C4FE5E9A0E64ECFB9A094DB7E695EE75009A65B27982C435FC9EEBFF45F40F
SHA-512:	0E5A31AD7A22D0B5C353DB1528E978B6068E5A887552BE938936FDC0807CAE8F52F8BFEA03D53BA2A9693E3A5232E29EE2281D47193DC13D8E40EC2B541A2410
Malicious:	false
Preview:	Set Diy=2..cAnhGamespot-Arrived-..imhcBali-Jd-Champions-..LxBut-Reputation-Wives-Addressing-Matched-Un-..kXvhScreens-Appliance-Nebraska-Colleagues-Dale-Printers-Electron-..eLTechnology-..bJBrowsing-Cayman-Tue-Indication-Spell-Following-Powers-Performance-..nLkSpec-Sufficiently-Rc-Custom-Lived-Og-Context-..fVsBlack-Mo-Harmful-Quantities-..TySolar-Blowjob-Shift-..QVvUpskirt-Participation-Revised-Weeks-..Set Journal=D..kzDon-Ka-Programme-..zQIMime-Zoom-Dressed-Cc-Missed-..LYCalibration-Suited-Caring-Upskirts-Possibility-Southeast-Win-Cheaper-Lovely-..XWBasics-Working-Ah-Plastics-Pf-Hundred-Viewing-Deer-..aBExecution-Said-Ne-Body-..Set Continuity=O..QWiVisitors-Gordon-Farm-Courtesy-Consent-Struck-Grand-Shoulder-..OveBroad-Interaction-Microphone-..mDOrganisations-Linked-It-Tm-Libraries-Minolta-Colours-Headers-Fallen-..koRetail-Investigated-..LQdoStats-Refine-Ide-Wn-Wines-Party-Guitars-Sweden-..mdalImpacts-Transcription-..KGJJimmy-Crm-Microwave-Discretion-Trials-Learners-Pcs-Mice-Spiritualit

C:\Users\user\AppData\Local\Temp\Pediatric.bat (copy)

Download File

Process:	C:\Windows\SysWOW64\cmd.exe
File Type:	ASCII text, with very long lines (701), with CRLF line terminators
Category:	dropped
Size (bytes):	19614
Entropy (8bit):	5.111305020482894
Encrypted:	false
SSDEEP:	384:saIumW1XDpRcLDD15YVx4I7kdl4jLs2SmMvptNVVYY296QS:sEXDvcJ5Ux4IeSjLsXmCLt
MD5:	760676D8E0F2A9E3012EE11B7AC50C59
SHA1:	616D91F2E3F9A91BCBE68EE3E2D1CD4E320CC19B
SHA-256:	A3C4FE5E9A0E64ECFB9A094DB7E695EE75009A65B27982C435FC9EEBFF45F40F
SHA-512:	0E5A31AD7A22D0B5C353DB1528E978B6068E5A887552BE938936FDC0807CAE8F52F8BFEA03D53BA2A9693E3A5232E29EE2281D47193DC13D8E40EC2B541A2410
Malicious:	false
Preview:	Set Diy=2..cAnhGamespot-Arrived-..imhcBali-Jd-Champions-..LxBut-Reputation-Wives-Addressing-Matched-Un-..kXvhScreens-Appliance-Nebraska-Colleagues-Dale-Printers-Electron-..eLTechnology-..bJBrowsing-Cayman-Tue-Indication-Spell-Following-Powers-Performance-..nLkSpec-Sufficiently-Rc-Custom-Lived-Og-Context-..fVsBlack-Mo-Harmful-Quantities-..TySolar-Blowjob-Shift-..QVvUpskirt-Participation-Revised-Weeks-..Set Journal=D..kzDon-Ka-Programme-..zQIMime-Zoom-Dressed-Cc-Missed-..LYCalibration-Suited-Caring-Upskirts-Possibility-Southeast-Win-Cheaper-Lovely-..XWBasics-Working-Ah-Plastics-Pf-Hundred-Viewing-Deer-..aBExecution-Said-Ne-Body-..Set Continuity=O..QWiVisitors-Gordon-Farm-Courtesy-Consent-Struck-Grand-Shoulder-..OveBroad-Interaction-Microphone-..mDOrganisations-Linked-It-Tm-Libraries-Minolta-Colours-Headers-Fallen-..koRetail-Investigated-..LQdoStats-Refine-Ide-Wn-Wines-Party-Guitars-Sweden-..mdalImpacts-Transcription-..KGJJimmy-Crm-Microwave-Discretion-Trials-Learners-Pcs-Mice-Spiritualit

C:\Users\user\AppData\Local\Temp\Strap

Download File

Process:	C:\Users\user\Desktop\GOmRjFSKNz.exe
File Type:	data
Category:	dropped
Size (bytes):	61440
Entropy (8bit):	7.997091785746
Encrypted:	true
SSDEEP:	1536:ZFUUx6pwe9hVRwzmD0MPSYrz/angq+ldnwh4buCt83ofAhna:7WpRamH7r+ngq8dnHbuCG3yAha
MD5:	42436500E325B861C42E887CD628D4CC
SHA1:	8F5CC73E895479DEED184EB5F2E5B26C88FB2021
SHA-256:	6A441418116DA88A87E5CB0D5C683239CF174037A14EB7BBEA50CF93C13BE1F2
SHA-512:	80353791BEB93075F32A329F395893CC6405AA858275B668B849A978C73882CF4E4C010ED9C7B7E1386B4FBCED5C5DCE4098FEA12F0A04CCBA89FE4D3023EAD3
Malicious:	false
Preview:	.O.._p_a.......Y.\|....&f8.sz.U..a...f.]...Uh..M.......f.t]I`...YbY.Z.^...4h.=...Gf.n.5..]....S.KY./....s..M...d.r.G......po..n......2...Zj..U8.:.4)l..`..hD`z.5.\|.....[.~...?.....k..:.\|....En.Bs=&SI.},{.(..'V.b..g...e..di....n..9...."...#.X[.33.."s.[.Q#{.yBsV..O1.N..{HP.s.4../......UXD.#.?%....).v.@r.6.......eR.S........[.6.N ..8....kIt...,Jx..W.....'I13...F8...........V..[.`...3P...5y.../..q...G....F>..8C[..}.u>..7c. S._h..~..I;VFpF.}.....wX.@.O...E..g?l.e..IpS.[.}.\|A..-.,0te.P..h..q.f.9_m.'`n..e....)f.\|......;Js.u(5Bv..(.j..ZE...(t...V...6)...r........x.$.)(y.Bp..rK...v0..lf......\@.'-i%...3)5.4z.3.&.u4]w..s..L...8. 2.&`.{'x...n...D..;..".6(....&2.....0.....IM....C.2...wS..X.....\|s%..O.E%[z..i....H."...,~=... ...zi.%...P.'.....q:...!...R...../.75d.1r..b....@.Z.. ..$.C...Jq189O.-....C......l_.............p...i...+.."^t )....hF..2.7..`=..u}".....O.4....v......!-4.Qed.u..tF.c..K.%...@[.X.+...F..t..#.3!.gl......:.z....(..Z.(.@....w:.

C:\Users\user\AppData\Local\Temp\Tmp90E.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\72076\RegAsm.exe
File Type:	data
Category:	dropped
Size (bytes):	2662
Entropy (8bit):	7.8230547059446645
Encrypted:	false
SSDEEP:	48:qJdHasMPAUha1DgSVVi59ca13MfyKjWwUmq9W2UgniDhiRhkjp9g:bhhEgSVVi59defyfW2sDgAj3g
MD5:	1420D30F964EAC2C85B2CCFE968EEBCE
SHA1:	BDF9A6876578A3E38079C4F8CF5D6C79687AD750
SHA-256:	F3327793E3FD1F3F9A93F58D033ED89CE832443E2695BECA9F2B04ADBA049ED9
SHA-512:	6FCB6CE148E1E246D6805502D4914595957061946751656567A5013D96033DD1769A22A87C45821E7542CDE533450E41182CEE898CD2CCF911C91BC4822371A8
Malicious:	false
Preview:	0..b...0.."...H..............0...0......H..............0...0......H............0...0....H.......0...p.,\|.(.............mW.....$\|Bb.[ .w..#.G.a.K-..i.....+Yo..^m~{........@...iC....[....L.q.J....s?K..G..n.}......;.Q..6..WW..uP.k.F..</..%...X.P...V..R......@.Va...Zm....(M3......"..2-..{9......k.3....Y..c]..O.Bq.H.>..p.RS...\|B.d..kr.=G.g.v..f.d.C.?...0Ch[2:.V....A..7..PD..G....p..*.L{1.&'e..uU)@.i....:.P.;.j.j.......Y.:.a..6.j.L.J.....^[..8,."...2E.......[qU..6.].......nr..i..^l......-..m..u@P;..Ra."......n.p.Z..).:p).F($..\|.R.!9V.....[.gV...i..!.....=.y{.T6.9.m..+.....(2..\..V.1..].V...q.%.4.a...n.B..Q..g.~N..s....=iZ...3..).......E..A.I...hH..Q%0.]...u..........h0T.P.X.A............'.....O....Py.=..3..n..c.F.$z..t..jM.E..W...i1..'...Y,r.,.+...o.}.7..kb.t'DQTV..{...#....sT..G...:..3.L.....c..b%z..e.\.EY...M;x.Z....t..nv...@Ka.....\|s>.2Qr..f,O..XJ`d....78H8.....`..);.vMcUJ.......m.G5.ib]5.h.v<.?S.{1O.Y...kb.....a&.R......E.l..."J..G.

C:\Users\user\AppData\Local\Temp\Tmp93E.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\72076\RegAsm.exe
File Type:	data
Category:	dropped
Size (bytes):	2662
Entropy (8bit):	7.8230547059446645
Encrypted:	false
SSDEEP:	48:qJdHasMPAUha1DgSVVi59ca13MfyKjWwUmq9W2UgniDhiRhkjp9g:bhhEgSVVi59defyfW2sDgAj3g
MD5:	1420D30F964EAC2C85B2CCFE968EEBCE
SHA1:	BDF9A6876578A3E38079C4F8CF5D6C79687AD750
SHA-256:	F3327793E3FD1F3F9A93F58D033ED89CE832443E2695BECA9F2B04ADBA049ED9
SHA-512:	6FCB6CE148E1E246D6805502D4914595957061946751656567A5013D96033DD1769A22A87C45821E7542CDE533450E41182CEE898CD2CCF911C91BC4822371A8
Malicious:	false
Preview:	0..b...0.."...H..............0...0......H..............0...0......H............0...0....H.......0...p.,\|.(.............mW.....$\|Bb.[ .w..#.G.a.K-..i.....+Yo..^m~{........@...iC....[....L.q.J....s?K..G..n.}......;.Q..6..WW..uP.k.F..</..%...X.P...V..R......@.Va...Zm....(M3......"..2-..{9......k.3....Y..c]..O.Bq.H.>..p.RS...\|B.d..kr.=G.g.v..f.d.C.?...0Ch[2:.V....A..7..PD..G....p..*.L{1.&'e..uU)@.i....:.P.;.j.j.......Y.:.a..6.j.L.J.....^[..8,."...2E.......[qU..6.].......nr..i..^l......-..m..u@P;..Ra."......n.p.Z..).:p).F($..\|.R.!9V.....[.gV...i..!.....=.y{.T6.9.m..+.....(2..\..V.1..].V...q.%.4.a...n.B..Q..g.~N..s....=iZ...3..).......E..A.I...hH..Q%0.]...u..........h0T.P.X.A............'.....O....Py.=..3..n..c.F.$z..t..jM.E..W...i1..'...Y,r.,.+...o.}.7..kb.t'DQTV..{...#....sT..G...:..3.L.....c..b%z..e.\.EY...M;x.Z....t..nv...@Ka.....\|s>.2Qr..f,O..XJ`d....78H8.....`..);.vMcUJ.......m.G5.ib]5.h.v<.?S.{1O.Y...kb.....a&.R......E.l..."J..G.

C:\Users\user\AppData\Local\Temp\Transport

Download File

Process:	C:\Users\user\Desktop\GOmRjFSKNz.exe
File Type:	data
Category:	dropped
Size (bytes):	95232
Entropy (8bit):	7.998279107865314
Encrypted:	true
SSDEEP:	1536:pTcSb+KT9p5mZNd1viurQv7hDUz7iLuaEinXZL2hm5r9N6OO4U1QxxSGai:p/b9j5mZNdKv7CzOL7EinR9jO4U1ISe
MD5:	7DD1DEF5A1D40E2CC11B86D108305856
SHA1:	72430E111A37DE13B51968A51B516C3C92B14D11
SHA-256:	DDF7B993E9926D69027AC0D516461E50DE18C93B49B20D86C8354CBC7F1A2DFF
SHA-512:	D2888392C322BB8C28F5536799A75AF24BE53A1BE4345BA1BE2F858B3DC4D76E793C1BE813007079553DBA36B1AF3A4963C2D5F620C8523D0854F1F92D02C063
Malicious:	false
Preview:	....o?......M.. ..~..BO.....v...{..............~o...Y.%.......(.v.R.D...K...).h.\|..~N.cRY:Ngd...............$Jk^8~\..}S.o.(...#AD.@V.A.,J..Q.q...h....zY.....4.........u2..Sg.3L........E~....[vC.."`....Gqz..#.=.$.N.@.L..y.!.~....gvLh../j..d....6..{...P..A.@.+.O...~.l..6.a.j<...#.&.....0"..h\|.KY..V..lA.......a.H.....\...G7w.`1:..+r......... .s.A.....rg.2#...)...^.r....Ebov.BT.JF...i.;c{Y....\|........"n..X..K......~l{qX.R$..z.W.....=.....)...S.&..S...6..m!.I.Nz...B..k..a.h.1@....K...8vE...O..;.D+...........d7......d..c......>.'..L......G.....k.I.?J....,d..3.....:...n!.0>;0k..c..,.m->?f,.Vi...~nQ...6.....4.S]h..6..J..3Q$..[.....s..m(.}T.!.bY..f._..i..GGj/.?..)\.q~8......61..Q...>..Q...v.....\|H5...F.S<.>e._...v...B.].?...`.5Y...o..vV.~.9.. 7<..#_<.4.9..S....*.p....!\|.$.....`.....M...%.....qg,...Ui.B...N.....^...mv.W.8M#...t.Lq.i.<....5....g?..$\|q...K..P...i..?A`...s.0>..-.`.\|]...h:.....\|D~..W....5E...F..V..O.....5.....0\......

C:\Users\user\AppData\Local\Temp\Treasure

Download File

Process:	C:\Users\user\Desktop\GOmRjFSKNz.exe
File Type:	SysEx File -
Category:	dropped
Size (bytes):	6543
Entropy (8bit):	7.9665867972422815
Encrypted:	false
SSDEEP:	96:3kXPAvUXP1GG0sRukZoV3J++z43fBS5kJSFIsY1NV7IGTKzdU9P1NtY416BhKmyq:3cmUNG7kZerzGfnSFbWPoURHKYeIpngB
MD5:	C619C8157AE98FF02D5F0DDB8AF58F8C
SHA1:	6F776C8177601BF48673C288F98550EDF82CE80E
SHA-256:	5D845BE14BB27293881AA165E3BCCF5FE9444184B1ED9A09C119C39B119A804E
SHA-512:	087E9BA1D8F40BF95B13713D1E8C3BE52CA30338C28C9C734BF6287DE661A1FEA732A41017929B8426A2E1CD6F1AB6D292BD6AA0824DE5B903F2E3B68FC58BE5
Malicious:	false
Preview:	.]....N.l.0...,,:./i.+e._..N..>......(...[]I....V..^QN.}1....`Lt.L.oF..X..G.. ...j.p.w1.\|B ..~....]{>(as.L......Q.'...7t...N.......l.%...........2.xR...@....\N.b..GE..(E.L..z..;S5.ap...r...{..:.Zif...gAK.y...../.?.5..3?>..Z....'...T....J...<f.qC.x\...2.Y.r...2.5/2./......\|......O1.Fe.......;x!..x...E.3.(...R...n....G0j.E..a.&.4......_I.n.7..E<?......ra.<.Bg.)..3P...N.......:....f.&:~.Dr...\|..g...RU$.F.f)..B.BD......L.#.R_Z..d.u.W..x.N....f1.).b.E.bHM8N.Q.;S..l.....S^X5.......?.Fv....a9....T. ..,....2..A.u..[..t..M.7..h..^.r.....B ...N;....l2.UL...y..L.d....O..U.o..c}..c..P.g.8..<. t...=.V-W5...N.6......j...~..HI.7Xp.>p...h.z.........#.'1..Hl./..H..E........B.../...3..? /\|(.}.k...Hg.C....r..b..O...i\|2mh..Kc..Pi....D.s..$sI......w@8X..T.L6..;......+d.}H/v1.Igr..ht....d.-.h..h-.q.6m..W.V...x>..v...C..ee........]..'.<.&..Y.=1@.U.c....C.Q3.Rn..d.+o..e.)..A0..F.o....@.....E\|f.y.EV.........;.......r9..3..E.(.C.....f.Db(+6.G,..s.I..

C:\Users\user\AppData\Local\Temp\Words

Download File

Process:	C:\Users\user\Desktop\GOmRjFSKNz.exe
File Type:	data
Category:	dropped
Size (bytes):	5508
Entropy (8bit):	6.079035795908131
Encrypted:	false
SSDEEP:	96:yxgUzr4tgOwVAfBzDICS09CAi6R7u+IhsObfS+NsPvj6ooxdofjxP3yGj1B:AHAeOqAFDw09CV/2nPvj6DdMP3r1B
MD5:	B6789D8027794142C4BAC9A74C68C63E
SHA1:	927CDD6C97C27FC2DEFD7DE098BCCDA29B48847C
SHA-256:	4473101D3F926A84426CADEEDC51F488873F649644432A5E2097275034919D0C
SHA-512:	7EDCB5146DE5B1207080D598D1D466E2E17989FB3EEB5C7D990E29418BFC77474E74AF8A653CE6923FDE6BD8AFA240DBA866F7931FC2421BCA13AF64CF8225EC
Malicious:	false
Preview:	SILICONLATINOAMPLANDBLOW..MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........sD.R..R..R...C..P.....S.._@..a.._@....._@..g..[j..[..[j..w..R.+.r...........S.._@..S..R...P.....S..RichR.*.........................PE..L...._pZ.........."...............................@.......................................@...@.......@.........................\|.......P....................p...q...;.............................. [..@............................................text............................... ..`.rdata..............................@..@.data...t........R..................@....rsrc...P............<..............@..@.reloc...q...p...r..................@..B......................................................................................................................................................................................................................................................

C:\Users\user\AppData\Roaming\Microsoft\Crypto\RSA\S-1-5-21-2246122658-3693405117-2476756634-1002\76b53b3ec448f7ccdda2063b15d2bfc3_9e146be9-c76a-4720-bcdb-53011b87bd06

Download File

Process:	C:\Users\user\AppData\Local\Temp\72076\RegAsm.exe
File Type:	data
Category:	dropped
Size (bytes):	2251
Entropy (8bit):	7.634813089843593
Encrypted:	false
SSDEEP:	48:S7SjQDUhr47iCkbNlR9WHTZHZx3bdU9V8xxvctnDcgvvej4yLsCJW:ASUD3Fk5lRcHxZxrdwOxu9DBvFoW
MD5:	35189FE8EF38DA33ED603DD4E1F832F9
SHA1:	12156E2B8F5E63860BEB86453039986930E6FEE1
SHA-256:	0F38B6DEC5EEB22C46A31D33022431DDEC7D5D924E32C01A8184083501E55F7F
SHA-512:	B24B1C92B86C0B85BFD112FCBD165562AC8BEA3DA6141F72B3258BB72EFCA483E4E9BC5BEF5089EFF26337705838B6DE0F77B703F24D4106F2025D1AD466346F
Malicious:	false
Preview:	........'...............P...............{41744BE4-11C5-494C-A213-BA0CE944938E}.....................RSA1..................v..XU~l2_.......vj....b.... ..&...X.Y...=q...).....`.1.0..~......5DL. ..S>.......<..y...?YOA.... eb.QD..B..<.!..'J..+.'...4fu.z./....]@.y.b...o...).j'......0}B.j..R..-..2.....'=...@....s....;. .v=..;...\$...G....2S....al.ZQ.Q...w...aXzW.....................z..O......B....IiD...tJ..V....,...C.r.y.p.t.o.A.P.I. .P.r.i.v.a.t.e. .K.e.y....f...... ....U..\.M.4.uy.....:..}]ch...N............. ....V;........g..rf.d...BM..\..,t..P.... ?\i.QD.f.,%.&...d.).Y.j.m[.$...X.....W0.<....-.....9.Q]sL..rU.{@.{...d....(...Ww......T7!.G!Pg.]...........-....#...,......g.gpvI...@..B.........ek...k.o......\|^..\|.b.}4.8.C.d.[..[....K.. .;..H.X.&%H.2!..e.<.pAn..j..W..\.Ld.l.+.W.yF....O.,...f.$O6..m.sr)z..;.{.z.......}..^......Eic.......g....4.{......xs.O\|....L.+....>...2T.U.....0.......K.U.:Y.4....(e.......A....$.G.p....H.%\.KE.Q.\..-..;B.g.....)....

Static File Info

General

File type:	PE32 executable (GUI) Intel 80386, for MS Windows
Entropy (8bit):	7.8115204801573555
TrID:	Win32 Executable (generic) a (10002005/4) 99.96% Generic Win/DOS Executable (2004/3) 0.02% DOS Executable Generic (2002/1) 0.02% Autodesk FLIC Image File (extensions: flc, fli, cel) (7/3) 0.00%
File name:	GOmRjFSKNz.exe
File size:	967'740 bytes
MD5:	01ef5f0617d6cb995abe430c3c6c7acd
SHA1:	9d6cee782bce7762f58f2bf6c1c38218491e9f94
SHA256:	bc37b8380183870ec6acd56886f3ef4537bf63c71935a094307875e03b0d2bb5
SHA512:	22c51adae0926d86adbe4501a96d0018b3eca5510cdf7bb9a40ae38f8c6ff46bf10b893e2e24d585ee2a84767ab67e3c3519f2d7c3192aad293e70c828bda5ec
SSDEEP:	24576:PXvK4Xot7jgUuQJ4RerTCk7Zp1sZKvsfzxSHcm:XVXohjgPQJMa7dULxS8m
TLSH:	1B25126245BB8897F26C0DB17422509636E6DC63C5AD4E7A32A6BF7D74318C14E2C32F
File Content Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......A{.k...8...8...8.b<8...8.b,8...8...8...8...8...8..%8...8.."8...8Rich...8........PE..L.....GO.................n.......B...8.....

File Icon


Icon Hash:	00a4a4a0bafec6d9

Static PE Info

General

Entrypoint:	0x403883
Entrypoint Section:	.text
Digitally signed:	false
Imagebase:	0x400000
Subsystem:	windows gui
Image File Characteristics:	EXECUTABLE_IMAGE, 32BIT_MACHINE
DLL Characteristics:	DYNAMIC_BASE, NX_COMPAT, NO_SEH, TERMINAL_SERVER_AWARE
Time Stamp:	0x4F47E2DA [Fri Feb 24 19:19:54 2012 UTC]
TLS Callbacks:
CLR (.Net) Version:
OS Version Major:	5
OS Version Minor:	0
File Version Major:	5
File Version Minor:	0
Subsystem Version Major:	5
Subsystem Version Minor:	0
Import Hash:	be41bf7b8cc010b614bd36bbca606973

Entrypoint Preview

Instruction
sub esp, 000002D4h
push ebx
push ebp
push esi
push edi
push 00000020h
xor ebp, ebp
pop esi
mov dword ptr [esp+18h], ebp
mov dword ptr [esp+10h], 00409268h
mov dword ptr [esp+14h], ebp
call dword ptr [00408030h]
push 00008001h
call dword ptr [004080B4h]
push ebp
call dword ptr [004082C0h]
push 00000008h
mov dword ptr [00472EB8h], eax
call 00007F4C90D8123Bh
push ebp
push 000002B4h
mov dword ptr [00472DD0h], eax
lea eax, dword ptr [esp+38h]
push eax
push ebp
push 00409264h
call dword ptr [00408184h]
push 0040924Ch
push 0046ADC0h
call 00007F4C90D80F1Dh
call dword ptr [004080B0h]
push eax
mov edi, 004C30A0h
push edi
call 00007F4C90D80F0Bh
push ebp
call dword ptr [00408134h]
cmp word ptr [004C30A0h], 0022h
mov dword ptr [00472DD8h], eax
mov eax, edi
jne 00007F4C90D7E80Ah
push 00000022h
pop esi
mov eax, 004C30A2h
push esi
push eax
call 00007F4C90D80BE1h
push eax
call dword ptr [00408260h]
mov esi, eax
mov dword ptr [esp+1Ch], esi
jmp 00007F4C90D7E893h
push 00000020h
pop ebx
cmp ax, bx
jne 00007F4C90D7E80Ah
add esi, 02h
cmp word ptr [esi], bx

Rich Headers

Programming Language:

[ C ] VS2008 SP1 build 30729
[IMP] VS2008 SP1 build 30729
[ C ] VS2010 SP1 build 40219
[RES] VS2010 SP1 build 40219
[LNK] VS2010 SP1 build 40219

Data Directories

Name	Virtual Address	Virtual Size	Is in Section
IMAGE_DIRECTORY_ENTRY_EXPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IMPORT	0x9b34	0xb4	.rdata
IMAGE_DIRECTORY_ENTRY_RESOURCE	0xf4000	0x18230	.rsrc
IMAGE_DIRECTORY_ENTRY_EXCEPTION	0x0	0x0
IMAGE_DIRECTORY_ENTRY_SECURITY	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BASERELOC	0x7a000	0x964	.ndata
IMAGE_DIRECTORY_ENTRY_DEBUG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COPYRIGHT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_GLOBALPTR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_TLS	0x0	0x0
IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IAT	0x8000	0x2d0	.rdata
IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_RESERVED	0x0	0x0

Sections

Name	Virtual Address	Virtual Size	Raw Size	MD5	Xored PE	ZLIB Complexity	File Type	Entropy	Characteristics
.text	0x1000	0x6dae	0x6e00	00499a6f70259150109c809d6aa0e6ed	False	0.6611150568181818	data	6.508529563136936	IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
.rdata	0x8000	0x2a62	0x2c00	07990aaa54c3bc638bb87a87f3fb13e3	False	0.3526278409090909	data	4.390535020989255	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.data	0xb000	0x67ebc	0x200	014871d9a00f0e0c8c2a7cd25606c453	False	0.203125	data	1.4308602597540492	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.ndata	0x73000	0x81000	0x0	d41d8cd98f00b204e9800998ecf8427e	False	0	empty	0.0	IMAGE_SCN_CNT_UNINITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.rsrc	0xf4000	0x18230	0x18400	aed7a309d71788055593343feb166489	False	0.13999073775773196	data	4.453157753333787	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.reloc	0x10d000	0xf32	0x1000	feac04c9105fefc599bb70f28a0362d6	False	0.2177734375	data	5.072514748524003	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_READ

Resources

Name	RVA	Size	Type	Language	Country	ZLIB Complexity
RT_ICON	0xf41f0	0x11028	Device independent bitmap graphic, 128 x 256 x 32, image size 69632	English	United States	0.10019807096107475
RT_ICON	0x105218	0x4428	Device independent bitmap graphic, 64 x 128 x 32, image size 17408	English	United States	0.20821870701513068
RT_ICON	0x109640	0x2668	Device independent bitmap graphic, 48 x 96 x 32, image size 9792	English	United States	0.26078112286411714
RT_DIALOG	0x10bca8	0x100	data	English	United States	0.5234375
RT_DIALOG	0x10bda8	0x11c	data	English	United States	0.6056338028169014
RT_DIALOG	0x10bec8	0x60	data	English	United States	0.7291666666666666
RT_GROUP_ICON	0x10bf28	0x30	data	English	United States	0.875
RT_MANIFEST	0x10bf58	0x2d6	XML 1.0 document, ASCII text, with very long lines (726), with no line terminators	English	United States	0.5647382920110193

Imports

DLL	Import
KERNEL32.dll	SetFileTime, CompareFileTime, SearchPathW, GetShortPathNameW, GetFullPathNameW, MoveFileW, SetCurrentDirectoryW, GetFileAttributesW, GetLastError, CreateDirectoryW, SetFileAttributesW, Sleep, GetTickCount, GetFileSize, GetModuleFileNameW, GetCurrentProcess, CopyFileW, ExitProcess, GetWindowsDirectoryW, GetTempPathW, GetCommandLineW, SetErrorMode, lstrcpynA, CloseHandle, lstrcpynW, GetDiskFreeSpaceW, GlobalUnlock, GlobalLock, CreateThread, LoadLibraryW, CreateProcessW, lstrcmpiA, CreateFileW, GetTempFileNameW, lstrcatW, GetProcAddress, LoadLibraryA, GetModuleHandleA, OpenProcess, lstrcpyW, GetVersionExW, GetSystemDirectoryW, GetVersion, lstrcpyA, RemoveDirectoryW, lstrcmpA, lstrcmpiW, lstrcmpW, ExpandEnvironmentStringsW, GlobalAlloc, WaitForSingleObject, GetExitCodeProcess, GlobalFree, GetModuleHandleW, LoadLibraryExW, FreeLibrary, WritePrivateProfileStringW, GetPrivateProfileStringW, WideCharToMultiByte, lstrlenA, MulDiv, WriteFile, ReadFile, MultiByteToWideChar, SetFilePointer, FindClose, FindNextFileW, FindFirstFileW, DeleteFileW, lstrlenW
USER32.dll	GetAsyncKeyState, IsDlgButtonChecked, ScreenToClient, GetMessagePos, CallWindowProcW, IsWindowVisible, LoadBitmapW, CloseClipboard, SetClipboardData, EmptyClipboard, OpenClipboard, TrackPopupMenu, GetWindowRect, AppendMenuW, CreatePopupMenu, GetSystemMetrics, EndDialog, EnableMenuItem, GetSystemMenu, SetClassLongW, IsWindowEnabled, SetWindowPos, DialogBoxParamW, CheckDlgButton, CreateWindowExW, SystemParametersInfoW, RegisterClassW, SetDlgItemTextW, GetDlgItemTextW, MessageBoxIndirectW, CharNextA, CharUpperW, CharPrevW, wvsprintfW, DispatchMessageW, PeekMessageW, wsprintfA, DestroyWindow, CreateDialogParamW, SetTimer, SetWindowTextW, PostQuitMessage, SetForegroundWindow, ShowWindow, wsprintfW, SendMessageTimeoutW, LoadCursorW, SetCursor, GetWindowLongW, GetSysColor, CharNextW, GetClassInfoW, ExitWindowsEx, IsWindow, GetDlgItem, SetWindowLongW, LoadImageW, GetDC, EnableWindow, InvalidateRect, SendMessageW, DefWindowProcW, BeginPaint, GetClientRect, FillRect, DrawTextW, EndPaint, FindWindowExW
GDI32.dll	SetBkColor, GetDeviceCaps, DeleteObject, CreateBrushIndirect, CreateFontIndirectW, SetBkMode, SetTextColor, SelectObject
SHELL32.dll	SHBrowseForFolderW, SHGetPathFromIDListW, SHGetFileInfoW, ShellExecuteW, SHFileOperationW, SHGetSpecialFolderLocation
ADVAPI32.dll	RegEnumKeyW, RegOpenKeyExW, RegCloseKey, RegDeleteKeyW, RegDeleteValueW, RegCreateKeyExW, RegSetValueExW, RegQueryValueExW, RegEnumValueW
COMCTL32.dll	ImageList_AddMasked, ImageList_Destroy, ImageList_Create
ole32.dll	CoTaskMemFree, OleInitialize, OleUninitialize, CoCreateInstance
VERSION.dll	GetFileVersionInfoSizeW, GetFileVersionInfoW, VerQueryValueW

Possible Origin

Language of compilation system	Country where language is spoken	Map
English	United States

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Oct 15, 2024 17:04:13.055944920 CEST	50002	47928	192.168.2.4	87.120.114.39
Oct 15, 2024 17:04:13.061114073 CEST	47928	50002	87.120.114.39	192.168.2.4
Oct 15, 2024 17:04:13.061232090 CEST	50002	47928	192.168.2.4	87.120.114.39
Oct 15, 2024 17:04:13.069871902 CEST	50002	47928	192.168.2.4	87.120.114.39
Oct 15, 2024 17:04:13.074827909 CEST	47928	50002	87.120.114.39	192.168.2.4
Oct 15, 2024 17:04:21.558343887 CEST	47928	50002	87.120.114.39	192.168.2.4
Oct 15, 2024 17:04:21.558485985 CEST	50002	47928	192.168.2.4	87.120.114.39
Oct 15, 2024 17:04:21.582398891 CEST	50002	47928	192.168.2.4	87.120.114.39

UDP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Oct 15, 2024 17:02:22.822249889 CEST	53690	53	192.168.2.4	1.1.1.1
Oct 15, 2024 17:02:22.832077026 CEST	53	53690	1.1.1.1	192.168.2.4

DNS Queries

Timestamp	Source IP	Dest IP	Trans ID	OP Code	Name	Type	Class	DNS over HTTPS
Oct 15, 2024 17:02:22.822249889 CEST	192.168.2.4	1.1.1.1	0x89b5	Standard query (0)	GRfewLDzqhRQJfpDiaidRNex.GRfewLDzqhRQJfpDiaidRNex	A (IP address)	IN (0x0001)	false

DNS Answers

Timestamp	Source IP	Dest IP	Trans ID	Reply Code	Name	CName	Address	Type	Class	DNS over HTTPS
Oct 15, 2024 17:02:22.832077026 CEST	1.1.1.1	192.168.2.4	0x89b5	Name error (3)	GRfewLDzqhRQJfpDiaidRNex.GRfewLDzqhRQJfpDiaidRNex	none	none	A (IP address)	IN (0x0001)	false

Target ID:	0
Start time:	11:02:16
Start date:	15/10/2024
Path:	C:\Users\user\Desktop\GOmRjFSKNz.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\Desktop\GOmRjFSKNz.exe"
Imagebase:	0x400000
File size:	967'740 bytes
MD5 hash:	01EF5F0617D6CB995ABE430C3C6C7ACD
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	1
Start time:	11:02:17
Start date:	15/10/2024
Path:	C:\Windows\SysWOW64\cmd.exe
Wow64 process (32bit):	true
Commandline:	"C:\Windows\System32\cmd.exe" /c move Pediatric Pediatric.bat & Pediatric.bat
Imagebase:	0x240000
File size:	236'544 bytes
MD5 hash:	D0FCE3AFA6AA1D58CE9FA336CC2B675B
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	2
Start time:	11:02:18
Start date:	15/10/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff7699e0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	3
Start time:	11:02:19
Start date:	15/10/2024
Path:	C:\Windows\SysWOW64\tasklist.exe
Wow64 process (32bit):	true
Commandline:	tasklist
Imagebase:	0xb50000
File size:	79'360 bytes
MD5 hash:	0A4448B31CE7F83CB7691A2657F330F1
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	moderate
Has exited:	true

Show Windows behavior

Target ID:	4
Start time:	11:02:19
Start date:	15/10/2024
Path:	C:\Windows\SysWOW64\findstr.exe
Wow64 process (32bit):	true
Commandline:	findstr /I "wrsa opssvc"
Imagebase:	0x4e0000
File size:	29'696 bytes
MD5 hash:	F1D4BE0E99EC734376FDE474A8D4EA3E
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	moderate
Has exited:	true

Show Windows behavior

Target ID:	5
Start time:	11:02:20
Start date:	15/10/2024
Path:	C:\Windows\SysWOW64\tasklist.exe
Wow64 process (32bit):	true
Commandline:	tasklist
Imagebase:	0xb50000
File size:	79'360 bytes
MD5 hash:	0A4448B31CE7F83CB7691A2657F330F1
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	moderate
Has exited:	true

Show Windows behavior

Target ID:	6
Start time:	11:02:20
Start date:	15/10/2024
Path:	C:\Windows\SysWOW64\findstr.exe
Wow64 process (32bit):	true
Commandline:	findstr /I "avastui avgui bdservicehost nswscsvc sophoshealth"
Imagebase:	0x4e0000
File size:	29'696 bytes
MD5 hash:	F1D4BE0E99EC734376FDE474A8D4EA3E
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	moderate
Has exited:	true

Show Windows behavior

Target ID:	7
Start time:	11:02:20
Start date:	15/10/2024
Path:	C:\Windows\SysWOW64\cmd.exe
Wow64 process (32bit):	true
Commandline:	cmd /c md 72076
Imagebase:	0x240000
File size:	236'544 bytes
MD5 hash:	D0FCE3AFA6AA1D58CE9FA336CC2B675B
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	8
Start time:	11:02:20
Start date:	15/10/2024
Path:	C:\Windows\SysWOW64\findstr.exe
Wow64 process (32bit):	true
Commandline:	findstr /V "SILICONLATINOAMPLANDBLOW" Words
Imagebase:	0x4e0000
File size:	29'696 bytes
MD5 hash:	F1D4BE0E99EC734376FDE474A8D4EA3E
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	moderate
Has exited:	true

Show Windows behavior

Target ID:	9
Start time:	11:02:21
Start date:	15/10/2024
Path:	C:\Windows\SysWOW64\cmd.exe
Wow64 process (32bit):	true
Commandline:	cmd /c copy /b ..\Indoor + ..\An + ..\Transport + ..\Strap + ..\Passed + ..\Treasure s
Imagebase:	0x240000
File size:	236'544 bytes
MD5 hash:	D0FCE3AFA6AA1D58CE9FA336CC2B675B
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	10
Start time:	11:02:21
Start date:	15/10/2024
Path:	C:\Users\user\AppData\Local\Temp\72076\Launches.pif
Wow64 process (32bit):	true
Commandline:	Launches.pif s
Imagebase:	0x740000
File size:	893'608 bytes
MD5 hash:	18CE19B57F43CE0A5AF149C96AECC685
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_RedLine, Description: Yara detected RedLine Stealer, Source: 0000000A.00000003.2825546542.000000000519F000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_RedLine, Description: Yara detected RedLine Stealer, Source: 0000000A.00000003.2833770879.0000000001F91000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_RedLine, Description: Yara detected RedLine Stealer, Source: 0000000A.00000003.2825065700.0000000001DDD000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_RedLine, Description: Yara detected RedLine Stealer, Source: 0000000A.00000003.2825688213.0000000001E5B000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_RedLine, Description: Yara detected RedLine Stealer, Source: 0000000A.00000003.2824672801.0000000001E5B000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_RedLine, Description: Yara detected RedLine Stealer, Source: 0000000A.00000003.2882687318.0000000001DD3000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_RedLine, Description: Yara detected RedLine Stealer, Source: 0000000A.00000003.2882687318.0000000001D91000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_RedLine, Description: Yara detected RedLine Stealer, Source: 0000000A.00000003.2825305490.0000000001D91000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_RedLine, Description: Yara detected RedLine Stealer, Source: 0000000A.00000003.2825305490.0000000001DD3000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_RedLine, Description: Yara detected RedLine Stealer, Source: 0000000A.00000003.2833826824.000000000449B000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_RedLine, Description: Yara detected RedLine Stealer, Source: 0000000A.00000003.2884666788.0000000001DDC000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_RedLine, Description: Yara detected RedLine Stealer, Source: 0000000A.00000003.2825915690.0000000001F91000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_RedLine, Description: Yara detected RedLine Stealer, Source: 0000000A.00000003.2833895594.0000000004418000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_RedLine, Description: Yara detected RedLine Stealer, Source: 0000000A.00000003.2884370254.0000000001F02000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_RedLine, Description: Yara detected RedLine Stealer, Source: 0000000A.00000003.2884574282.0000000001E5C000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security
Antivirus matches:	Detection: 5%, ReversingLabs
Reputation:	moderate
Has exited:	true

Show Windows behavior

Target ID:	11
Start time:	11:02:21
Start date:	15/10/2024
Path:	C:\Windows\SysWOW64\choice.exe
Wow64 process (32bit):	true
Commandline:	choice /d y /t 5
Imagebase:	0xa50000
File size:	28'160 bytes
MD5 hash:	FCE0E41C87DC4ABBE976998AD26C27E4
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	moderate
Has exited:	true

Show Windows behavior

Target ID:	16
Start time:	11:04:01
Start date:	15/10/2024
Path:	C:\Users\user\AppData\Local\Temp\72076\RegAsm.exe
Wow64 process (32bit):	true
Commandline:	C:\Users\user\AppData\Local\Temp\72076\RegAsm.exe
Imagebase:	0x260000
File size:	65'440 bytes
MD5 hash:	0D5DF43AF2916F47D00C1573797C1A13
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_RedLine, Description: Yara detected RedLine Stealer, Source: 00000010.00000002.3032255109.0000000000342000.00000040.00000400.00020000.00000000.sdmp, Author: Joe Security
Antivirus matches:	Detection: 0%, ReversingLabs
Has exited:	false

Show Windows behavior

Execution Graph

Execution Coverage:	17.7%
Dynamic/Decrypted Code Coverage:	0%
Signature Coverage:	20.7%
Total number of Nodes:	1528
Total number of Limit Nodes:	33

Executed Functions

Function 004050CD Relevance: 68.5, APIs: 36, Strings: 3, Instructions: 295
windowclipboardmemoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetDlgItem.USER32(?,00000403), ref: 0040512F
GetDlgItem.USER32(?,000003EE), ref: 0040513E
GetClientRect.USER32(?,?), ref: 00405196
GetSystemMetrics.USER32(00000015), ref: 0040519E
SendMessageW.USER32(?,00001061,00000000,00000002), ref: 004051BF
SendMessageW.USER32(?,00001036,00004000,00004000), ref: 004051D0
SendMessageW.USER32(?,00001001,00000000,00000110), ref: 004051E3
SendMessageW.USER32(?,00001026,00000000,00000110), ref: 004051F1
SendMessageW.USER32(?,00001024,00000000,?), ref: 00405204
ShowWindow.USER32(00000000,?,0000001B,000000FF), ref: 00405226
ShowWindow.USER32(?,00000008), ref: 0040523A
GetDlgItem.USER32(?,000003EC), ref: 0040525B
SendMessageW.USER32(00000000,00000401,00000000,75300000), ref: 0040526B
SendMessageW.USER32(00000000,00000409,00000000,?), ref: 00405280
SendMessageW.USER32(00000000,00002001,00000000,00000110), ref: 0040528C
GetDlgItem.USER32(?,000003F8), ref: 0040514D

Part of subcall function 00403D98: SendMessageW.USER32(00000028,?,00000001,004057B4), ref: 00403DA6

Part of subcall function 00406805: GetVersion.KERNEL32(0043B228,?,00000000,00404FA9,0043B228,00000000,?,00000000,00000000), ref: 004068D6

Part of subcall function 004062A3: lstrlenW.KERNEL32(RMDir: RemoveDirectory invalid input(""),00406E79,RMDir: RemoveDirectory("%s"),?,?,?), ref: 004062B0
Part of subcall function 004062A3: wvsprintfW.USER32(00000000,?,?), ref: 004062C7

GetDlgItem.USER32(?,000003EC), ref: 004052AB
CreateThread.KERNELBASE(00000000,00000000,Function_00005047,00000000), ref: 004052B9
CloseHandle.KERNELBASE(00000000), ref: 004052C0
ShowWindow.USER32(00000000), ref: 004052E7
ShowWindow.USER32(?,00000008), ref: 004052EC
ShowWindow.USER32(00000008), ref: 00405333
SendMessageW.USER32(?,00001004,00000000,00000000), ref: 00405365
CreatePopupMenu.USER32 ref: 00405376
AppendMenuW.USER32(00000000,00000000,00000001,00000000), ref: 0040538B
GetWindowRect.USER32(?,?), ref: 0040539E
TrackPopupMenu.USER32(00000000,00000180,?,?,00000000,?,00000000), ref: 004053C0
SendMessageW.USER32(?,00001073,00000000,?), ref: 004053FB
OpenClipboard.USER32(00000000), ref: 0040540B
EmptyClipboard.USER32 ref: 00405411
GlobalAlloc.KERNEL32(00000042,00000000,?,?,00000000,?,00000000), ref: 0040541D
GlobalLock.KERNEL32(00000000), ref: 00405427
SendMessageW.USER32(?,00001073,00000000,?), ref: 0040543B
GlobalUnlock.KERNEL32(00000000), ref: 0040545D
SetClipboardData.USER32(0000000D,00000000), ref: 00405468
CloseClipboard.USER32 ref: 0040546E

Strings

@rD, xrefs: 004053D7
{, xrefs: 00405352
New install of "%s" to "%s", xrefs: 00405182

Memory Dump Source

Source File: 00000000.00000002.1786996002.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1786976555.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1787017126.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1787037791.000000000040B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1787037791.000000000041F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1787037791.0000000000461000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1787037791.00000000004B3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1787138270.00000000004F4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1787138270.0000000000505000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_GOmRjFSKNz.jbxd

Similarity

API ID: MessageSend$Window$ItemShow$Clipboard$GlobalMenu$CloseCreatePopupRect$AllocAppendClientDataEmptyHandleLockMetricsOpenSystemThreadTrackUnlockVersionlstrlenwvsprintf
String ID: @rD$New install of "%s" to "%s"${
API String ID: 2110491804-2409696222
Opcode ID: f168db28b2c12902a58862b60cbdcc3c6e49ead995c60d9878de2ccec3fe74d8
Instruction ID: 480b9f2609884c7685ddca5963e0cfcc77f9e358d06567921943d8ab7e89b76b
Opcode Fuzzy Hash: f168db28b2c12902a58862b60cbdcc3c6e49ead995c60d9878de2ccec3fe74d8
Instruction Fuzzy Hash: 14B15B70800608FFDB11AFA0DD85EAE7B79EF44355F00803AFA45BA1A0CBB49A519F59

Function 00403883 Relevance: 54.6, APIs: 22, Strings: 9, Instructions: 304
filestringcomCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

#17.COMCTL32 ref: 004038A2
SetErrorMode.KERNELBASE(00008001), ref: 004038AD
OleInitialize.OLE32(00000000), ref: 004038B4

Part of subcall function 004062FC: GetModuleHandleA.KERNEL32(?,?,00000020,004038C6,00000008), ref: 0040630A
Part of subcall function 004062FC: LoadLibraryA.KERNELBASE(?,?,?,00000020,004038C6,00000008), ref: 00406315
Part of subcall function 004062FC: GetProcAddress.KERNEL32(00000000), ref: 00406327

SHGetFileInfoW.SHELL32(00409264,00000000,?,000002B4,00000000), ref: 004038DC

Part of subcall function 00406009: lstrcpynW.KERNEL32(?,?,00002004,004038F1,0046ADC0,NSIS Error), ref: 00406016

GetCommandLineW.KERNEL32(0046ADC0,NSIS Error), ref: 004038F1
GetModuleHandleW.KERNEL32(00000000,004C30A0,00000000), ref: 00403904
CharNextW.USER32(00000000,004C30A0,00000020), ref: 0040392B
GetTempPathW.KERNEL32(00002004,004D70C8,00000000,00000020), ref: 00403A00
GetWindowsDirectoryW.KERNEL32(004D70C8,00001FFF), ref: 00403A15
lstrcatW.KERNEL32(004D70C8,\Temp), ref: 00403A21
DeleteFileW.KERNELBASE(004D30C0), ref: 00403A38
CoUninitialize.COMBASE(?), ref: 00403AD1
ExitProcess.KERNEL32 ref: 00403AF1
lstrcatW.KERNEL32(004D70C8,~nsu.tmp), ref: 00403AFD
lstrcmpiW.KERNEL32(004D70C8,004CF0B8,004D70C8,~nsu.tmp), ref: 00403B09
CreateDirectoryW.KERNEL32(004D70C8,00000000), ref: 00403B15
SetCurrentDirectoryW.KERNEL32(004D70C8), ref: 00403B1C
DeleteFileW.KERNEL32(004331E8,004331E8,?,00477008,00409204,00473000,?), ref: 00403B6D
CopyFileW.KERNEL32(004DF0D8,004331E8,00000001), ref: 00403B81
CloseHandle.KERNEL32(00000000,004331E8,004331E8,?,004331E8,00000000), ref: 00403BAE
GetCurrentProcess.KERNEL32(00000028,00000005,00000005,00000004,00000003), ref: 00403C04
ExitWindowsEx.USER32(00000002,00000000), ref: 00403C40

Strings

SeShutdownPrivilege, xrefs: 00403C16
NCRC, xrefs: 0040397C
_?=, xrefs: 00403A64
Error launching installer, xrefs: 00403A7D
~nsu.tmp, xrefs: 00403AF7
1C, xrefs: 00403B56
\Temp, xrefs: 00403A1B
NSIS Error, xrefs: 004038E2
/D=, xrefs: 004039A6

Memory Dump Source

Source File: 00000000.00000002.1786996002.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1786976555.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1787017126.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1787037791.000000000040B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1787037791.000000000041F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1787037791.0000000000461000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1787037791.00000000004B3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1787138270.00000000004F4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1787138270.0000000000505000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_GOmRjFSKNz.jbxd

Similarity

API ID: File$DirectoryHandle$CurrentDeleteExitModuleProcessWindowslstrcat$AddressCharCloseCommandCopyCreateErrorInfoInitializeLibraryLineLoadModeNextPathProcTempUninitializelstrcmpilstrcpyn
String ID: /D=$ _?=$Error launching installer$NCRC$NSIS Error$SeShutdownPrivilege$\Temp$~nsu.tmp$1C
API String ID: 2435955865-239407132
Opcode ID: b4c90e19bc4a522d6528af1b5983b0f211df9e73c6af6eb8e5ff34ebe7c06cb6
Instruction ID: 7cf1fa831aca86d96b8495533088dbe4cf0b0326274ef0a42366eb07f7c747b9
Opcode Fuzzy Hash: b4c90e19bc4a522d6528af1b5983b0f211df9e73c6af6eb8e5ff34ebe7c06cb6
Instruction Fuzzy Hash: C4A1B671544305BAD6207F629D4AF1B3EACAF0070AF15483FF585B61D2DBBC8A448B6E

Function 004074BB Relevance: 5.4, APIs: 4, Instructions: 382
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Memory Dump Source

Source File: 00000000.00000002.1786996002.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1786976555.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1787017126.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1787037791.000000000040B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1787037791.000000000041F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1787037791.0000000000461000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1787037791.00000000004B3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1787138270.00000000004F4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1787138270.0000000000505000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_GOmRjFSKNz.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 40903ab5852a4d5be4c36b37cb9ac035c10bc9e934730a02f9966fb4d26bd2b9
Instruction ID: b44593247c4c050b0e646bb53675e7b1a8962b0b92449cff70e8ee1879f4dc4f
Opcode Fuzzy Hash: 40903ab5852a4d5be4c36b37cb9ac035c10bc9e934730a02f9966fb4d26bd2b9
Instruction Fuzzy Hash: 00F14871908249DBDF18CF28C8946E93BB1FF44345F14852AFD5A9B281D338E986DF86

Function 004062FC Relevance: 4.5, APIs: 3, Instructions: 18libraryloaderCOMMON

Download Yara Rule

APIs

GetModuleHandleA.KERNEL32(?,?,00000020,004038C6,00000008), ref: 0040630A
LoadLibraryA.KERNELBASE(?,?,?,00000020,004038C6,00000008), ref: 00406315
GetProcAddress.KERNEL32(00000000), ref: 00406327

Memory Dump Source

Source File: 00000000.00000002.1786996002.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1786976555.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1787017126.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1787037791.000000000040B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1787037791.000000000041F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1787037791.0000000000461000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1787037791.00000000004B3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1787138270.00000000004F4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1787138270.0000000000505000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_GOmRjFSKNz.jbxd

Similarity

API ID: AddressHandleLibraryLoadModuleProc
String ID:
API String ID: 310444273-0
Opcode ID: a32725a6e723fbcd4130456278775f3bec070c67c36dcd31cef0056e0dec9b78
Instruction ID: 23f85fcbdf3119ad7ff9d94b99dcad510d7c567b01d836bd9cab37df641e0753
Opcode Fuzzy Hash: a32725a6e723fbcd4130456278775f3bec070c67c36dcd31cef0056e0dec9b78
Instruction Fuzzy Hash: 53D0123120010597C6001B65AE0895F776CEF95611707803EF542F3132EB34D415AAEC

Function 004062D5 Relevance: 3.0, APIs: 2, Instructions: 14fileCOMMON

Download Yara Rule

APIs

FindFirstFileW.KERNELBASE(004572C0,0045BEC8,004572C0,004067CE,004572C0), ref: 004062E0
FindClose.KERNEL32(00000000), ref: 004062EC

Memory Dump Source

Source File: 00000000.00000002.1786996002.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1786976555.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1787017126.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1787037791.000000000040B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1787037791.000000000041F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1787037791.0000000000461000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1787037791.00000000004B3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1787138270.00000000004F4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1787138270.0000000000505000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_GOmRjFSKNz.jbxd

Similarity

API ID: Find$CloseFileFirst
String ID:
API String ID: 2295610775-0
Opcode ID: c6f116a51c08f79c55c0589ec24d04b7eaebe21ecc1702d782a9edd0eda53026
Instruction ID: 3dd5e1b78c12f0f437ff376ab6b0e1f90f8becb0d3509d6a9a7f52ed6ae53baf
Opcode Fuzzy Hash: c6f116a51c08f79c55c0589ec24d04b7eaebe21ecc1702d782a9edd0eda53026
Instruction Fuzzy Hash: 7AD0C9315041205BC25127386E0889B6A589F163723258A7AB5A6E11E0CB388C2296A8

Function 00405479 Relevance: 58.1, APIs: 32, Strings: 1, Instructions: 345
windowstringCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

SetWindowPos.USER32(?,00000000,00000000,00000000,00000000,00000013), ref: 004054B5
ShowWindow.USER32(?), ref: 004054D2
DestroyWindow.USER32 ref: 004054E6
SetWindowLongW.USER32(?,00000000,00000000), ref: 00405502
GetDlgItem.USER32(?,?), ref: 00405523
SendMessageW.USER32(00000000,000000F3,00000000,00000000), ref: 00405537
IsWindowEnabled.USER32(00000000), ref: 0040553E
GetDlgItem.USER32(?,00000001), ref: 004055ED
GetDlgItem.USER32(?,00000002), ref: 004055F7
SetClassLongW.USER32(?,000000F2,?), ref: 00405611
SendMessageW.USER32(0000040F,00000000,00000001,?), ref: 00405662
GetDlgItem.USER32(?,00000003), ref: 00405708
ShowWindow.USER32(00000000,?), ref: 0040572A
KiUserCallbackDispatcher.NTDLL(?,?), ref: 0040573C
EnableWindow.USER32(?,?), ref: 00405757
GetSystemMenu.USER32(?,00000000,0000F060,00000001), ref: 0040576D
EnableMenuItem.USER32(00000000), ref: 00405774
SendMessageW.USER32(?,000000F4,00000000,00000001), ref: 0040578C
SendMessageW.USER32(?,00000401,00000002,00000000), ref: 0040579F
lstrlenW.KERNEL32(00447240,?,00447240,0046ADC0), ref: 004057C8
SetWindowTextW.USER32(?,00447240), ref: 004057DC
ShowWindow.USER32(?,0000000A), ref: 00405910

Strings

@rD, xrefs: 004057B9

Memory Dump Source

Source File: 00000000.00000002.1786996002.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1786976555.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1787017126.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1787037791.000000000040B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1787037791.000000000041F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1787037791.0000000000461000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1787037791.00000000004B3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1787138270.00000000004F4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1787138270.0000000000505000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_GOmRjFSKNz.jbxd

Similarity

API ID: Window$Item$MessageSend$Show$EnableLongMenu$CallbackClassDestroyDispatcherEnabledSystemTextUserlstrlen
String ID: @rD
API String ID: 3282139019-3814967855
Opcode ID: 892c705fd8619986465a6960d4e81f7d1e8168c1c52714a2b5abc7a1d7472251
Instruction ID: 0f9b988f21b44e482dc064b3562f20aa73efc2902ac8c6ffeb9ddf27563d0ddb
Opcode Fuzzy Hash: 892c705fd8619986465a6960d4e81f7d1e8168c1c52714a2b5abc7a1d7472251
Instruction Fuzzy Hash: D8C1C371500A04EBDB216F61EE49E2B3BA9EB45345F00093EF551B12F0DB799891EF2E

Function 004015A0 Relevance: 56.4, APIs: 15, Strings: 17, Instructions: 351
sleepfilewindowCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

PostQuitMessage.USER32(00000000), ref: 00401648
Sleep.KERNEL32(00000000,?,00000000,00000000,00000000), ref: 004016B2
SetForegroundWindow.USER32(?), ref: 004016CB
ShowWindow.USER32(?), ref: 00401753
ShowWindow.USER32(?), ref: 00401767
SetFileAttributesW.KERNEL32(00000000,00000000,?,000000F0), ref: 0040178C
CreateDirectoryW.KERNELBASE(?,00000000,00000000,0000005C,?,?,?,000000F0,?,000000F0), ref: 004017F4
GetLastError.KERNEL32(?,?,000000F0,?,000000F0), ref: 004017FE
GetLastError.KERNEL32(?,?,000000F0,?,000000F0), ref: 0040180B
GetFileAttributesW.KERNELBASE(?,?,?,000000F0,?,000000F0), ref: 0040182A
SetCurrentDirectoryW.KERNELBASE(?,004CB0B0,?,000000E6,0040F0D0,?,?,?,000000F0,?,000000F0), ref: 00401885
MoveFileW.KERNEL32(00000000,?), ref: 00401908
GetFullPathNameW.KERNEL32(00000000,00002004,00000000,?,00000000,000000E3,0040F0D0,?,00000000,00000000,?,?,?,?,?,000000F0), ref: 00401975
GetShortPathNameW.KERNEL32(00000000,00000000,00002004), ref: 004019BF
SearchPathW.KERNELBASE(00000000,00000000,00000000,00002004,00000000,?,000000FF,?,00000000,00000000,?,?,?,?,?,000000F0), ref: 004019DE

Strings

IfFileExists: file "%s" exists, jumping %d, xrefs: 004018AD
Sleep(%d), xrefs: 0040169D
CreateDirectory: "%s" created, xrefs: 00401849
CreateDirectory: can't create "%s" (err=%d), xrefs: 00401815
CreateDirectory: "%s" (%d), xrefs: 004017BF
Rename on reboot: %s, xrefs: 00401943
Rename: %s, xrefs: 004018F8
Jump: %d, xrefs: 00401602
CreateDirectory: can't create "%s" - a file already exists, xrefs: 00401837
BringToFront, xrefs: 004016BD
Aborting: "%s", xrefs: 0040161D
SetFileAttributes: "%s":%08X, xrefs: 0040177B
Rename failed: %s, xrefs: 0040194B
detailprint: %s, xrefs: 00401679
Call: %d, xrefs: 0040165A
IfFileExists: file "%s" does not exist, jumping %d, xrefs: 004018C6
SetFileAttributes failed., xrefs: 004017A1

Memory Dump Source

Source File: 00000000.00000002.1786996002.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1786976555.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1787017126.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1787037791.000000000040B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1787037791.000000000041F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1787037791.0000000000461000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1787037791.00000000004B3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1787138270.00000000004F4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1787138270.0000000000505000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_GOmRjFSKNz.jbxd

Similarity

API ID: FilePathWindow$AttributesDirectoryErrorLastNameShow$CreateCurrentForegroundFullMessageMovePostQuitSearchShortSleep
String ID: Aborting: "%s"$BringToFront$Call: %d$CreateDirectory: "%s" (%d)$CreateDirectory: "%s" created$CreateDirectory: can't create "%s" (err=%d)$CreateDirectory: can't create "%s" - a file already exists$IfFileExists: file "%s" does not exist, jumping %d$IfFileExists: file "%s" exists, jumping %d$Jump: %d$Rename failed: %s$Rename on reboot: %s$Rename: %s$SetFileAttributes failed.$SetFileAttributes: "%s":%08X$Sleep(%d)$detailprint: %s
API String ID: 2872004960-3619442763
Opcode ID: e7226c198396c3fe3a7f3bea8c4d52a2e846d2bb9e79691e18455936b93e1c7d
Instruction ID: b6b48939bc8a7188504c618ab7841b31fdd5898bf24c808f75461ec369738802
Opcode Fuzzy Hash: e7226c198396c3fe3a7f3bea8c4d52a2e846d2bb9e79691e18455936b93e1c7d
Instruction Fuzzy Hash: 0AB1F471A00204ABDB10BF61DD46DAE3B69EF44314B21817FF946B21E1DA7D4E40CAAE

Function 0040592C Relevance: 45.7, APIs: 15, Strings: 11, Instructions: 233
stringregistrylibraryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 004062FC: GetModuleHandleA.KERNEL32(?,?,00000020,004038C6,00000008), ref: 0040630A
Part of subcall function 004062FC: LoadLibraryA.KERNELBASE(?,?,?,00000020,004038C6,00000008), ref: 00406315
Part of subcall function 004062FC: GetProcAddress.KERNEL32(00000000), ref: 00406327

lstrcatW.KERNEL32(004D30C0,00447240,80000001,Control Panel\Desktop\ResourceLocale,00000000,00447240,00000000,00000006,004C30A0,-00000002,00000000,004D70C8,00403AC1,?), ref: 004059AE
lstrlenW.KERNEL32(00462540,?,?,?,00462540,00000000,004C70A8,004D30C0,00447240,80000001,Control Panel\Desktop\ResourceLocale,00000000,00447240,00000000,00000006,004C30A0), ref: 00405A30
lstrcmpiW.KERNEL32(00462538,.exe,00462540,?,?,?,00462540,00000000,004C70A8,004D30C0,00447240,80000001,Control Panel\Desktop\ResourceLocale,00000000,00447240,00000000), ref: 00405A43
GetFileAttributesW.KERNEL32(00462540), ref: 00405A4E

Part of subcall function 00405F51: wsprintfW.USER32 ref: 00405F5E

LoadImageW.USER32(00000067,00000001,00000000,00000000,00008040,004C70A8), ref: 00405AB7
RegisterClassW.USER32(0046AD60), ref: 00405B0A
SystemParametersInfoW.USER32(00000030,00000000,?,00000000), ref: 00405B22
CreateWindowExW.USER32(00000080,?,00000000,80000000,?,?,?,?,00000000,00000000,00000000), ref: 00405B5B

Part of subcall function 00403E95: SetWindowTextW.USER32(00000000,0046ADC0), ref: 00403F30

ShowWindow.USER32(00000005,00000000), ref: 00405B91
LoadLibraryW.KERNELBASE(RichEd20), ref: 00405BA2
LoadLibraryW.KERNEL32(RichEd32), ref: 00405BAD
GetClassInfoW.USER32(00000000,RichEdit20A,0046AD60), ref: 00405BBD
GetClassInfoW.USER32(00000000,RichEdit,0046AD60), ref: 00405BCA
RegisterClassW.USER32(0046AD60), ref: 00405BD3
DialogBoxParamW.USER32(?,00000000,00405479,00000000), ref: 00405BF2

Strings

@%F, xrefs: 004059F6
_Nb, xrefs: 00405AD1
B%F, xrefs: 00405A1F
RichEd20, xrefs: 00405B9D
Control Panel\Desktop\ResourceLocale, xrefs: 00405972
RichEd32, xrefs: 00405BA8
.DEFAULT\Control Panel\International, xrefs: 00405999
@rD, xrefs: 00405965
RichEdit20A, xrefs: 00405BB6, 00405BBB
RichEdit, xrefs: 00405BC4
.exe, xrefs: 00405A3D

Memory Dump Source

Source File: 00000000.00000002.1786996002.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1786976555.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1787017126.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1787037791.000000000040B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1787037791.000000000041F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1787037791.0000000000461000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1787037791.00000000004B3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1787138270.00000000004F4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1787138270.0000000000505000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_GOmRjFSKNz.jbxd

Similarity

API ID: ClassLoad$InfoLibraryWindow$Register$AddressAttributesCreateDialogFileHandleImageModuleParamParametersProcShowSystemTextlstrcatlstrcmpilstrlenwsprintf
String ID: .DEFAULT\Control Panel\International$.exe$@%F$@rD$B%F$Control Panel\Desktop\ResourceLocale$RichEd20$RichEd32$RichEdit$RichEdit20A$_Nb
API String ID: 608394941-1650083594
Opcode ID: 18be7924d3bcca259bbbf180237d25193f30e5c9112311b2c349bb590eb249de
Instruction ID: 271ce27004ef92612bfc9362a6cc74883a37054a4c8cca7c49d128c059fded9a
Opcode Fuzzy Hash: 18be7924d3bcca259bbbf180237d25193f30e5c9112311b2c349bb590eb249de
Instruction Fuzzy Hash: 5E71A370604B04AED721AB65EE85F2736ACEB44749F00053FF945B22E2D7B89D418F6E

Function 00401A1F Relevance: 22.9, APIs: 5, Strings: 8, Instructions: 185
stringtimeCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 004062A3: lstrlenW.KERNEL32(RMDir: RemoveDirectory invalid input(""),00406E79,RMDir: RemoveDirectory("%s"),?,?,?), ref: 004062B0
Part of subcall function 004062A3: wvsprintfW.USER32(00000000,?,?), ref: 004062C7

lstrcatW.KERNEL32(00000000,00000000,open,004CB0B0,00000000,00000000), ref: 00401A76
CompareFileTime.KERNEL32(-00000014,?,open,open,00000000,00000000,open,004CB0B0,00000000,00000000), ref: 00401AA0

Part of subcall function 00406009: lstrcpynW.KERNEL32(?,?,00002004,004038F1,0046ADC0,NSIS Error), ref: 00406016

Part of subcall function 00404F72: lstrlenW.KERNEL32(0043B228,?,00000000,00000000), ref: 00404FAA
Part of subcall function 00404F72: lstrlenW.KERNEL32(004034BB,0043B228,?,00000000,00000000), ref: 00404FBA
Part of subcall function 00404F72: lstrcatW.KERNEL32(0043B228,004034BB,004034BB,0043B228,?,00000000,00000000), ref: 00404FCD
Part of subcall function 00404F72: SetWindowTextW.USER32(0043B228,0043B228), ref: 00404FDF
Part of subcall function 00404F72: SendMessageW.USER32(?,00001004,00000000,00000000), ref: 00405005
Part of subcall function 00404F72: SendMessageW.USER32(?,0000104D,00000000,00000001), ref: 0040501F
Part of subcall function 00404F72: SendMessageW.USER32(?,00001013,?,00000000), ref: 0040502D

Strings

File: error creating "%s", xrefs: 00401AF0
File: overwriteflag=%d, allowskipfilesflag=%d, name="%s", xrefs: 00401A39
File: error, user abort, xrefs: 00401B53
open, xrefs: 00401A53, 00401A5C, 00401A69, 00401A7B, 00401A8C, 00401AC2, 00401AD8, 00401AEF, 00401B07, 00401B5E, 00401B80, 00401BCE, 00401C10, 00401C19, 00401C23, 00401C29, 00401C3B
File: wrote %d to "%s", xrefs: 00401BD0
File: error, user retry, xrefs: 00401B40
File: skipped: "%s" (overwriteflag=%d), xrefs: 00401B81
File: error, user cancel, xrefs: 00401B93

Memory Dump Source

Source File: 00000000.00000002.1786996002.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1786976555.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1787017126.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1787037791.000000000040B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1787037791.000000000041F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1787037791.0000000000461000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1787037791.00000000004B3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1787138270.00000000004F4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1787138270.0000000000505000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_GOmRjFSKNz.jbxd

Similarity

API ID: MessageSendlstrlen$lstrcat$CompareFileTextTimeWindowlstrcpynwvsprintf
String ID: File: error creating "%s"$File: error, user abort$File: error, user cancel$File: error, user retry$File: overwriteflag=%d, allowskipfilesflag=%d, name="%s"$File: skipped: "%s" (overwriteflag=%d)$File: wrote %d to "%s"$open
API String ID: 4286501637-2478300759
Opcode ID: b6a2df31382c61c88927ef82d5f6ae0aba2303a4f2552ab8741c3bf9876e390d
Instruction ID: fe683e2e252f9e2189d7cf48164ff2fe6631720e8c40e43e96375682ff159270
Opcode Fuzzy Hash: b6a2df31382c61c88927ef82d5f6ae0aba2303a4f2552ab8741c3bf9876e390d
Instruction Fuzzy Hash: 9D510871901114BADF10BBB1CD46EAE3A68DF05369F21413FF416B10D2EB7C5A518AAE

Function 00403587 Relevance: 17.7, APIs: 5, Strings: 5, Instructions: 182
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetTickCount.KERNEL32 ref: 00403598
GetModuleFileNameW.KERNEL32(00000000,004DF0D8,00002004,?,?,?,00000000,00403A47,?), ref: 004035B4

Part of subcall function 00405E50: GetFileAttributesW.KERNELBASE(00000003,004035C7,004DF0D8,80000000,00000003,?,?,?,00000000,00403A47,?), ref: 00405E54
Part of subcall function 00405E50: CreateFileW.KERNELBASE(?,?,00000001,00000000,?,00000001,00000000,?,?,?,00000000,00403A47,?), ref: 00405E76

GetFileSize.KERNEL32(00000000,00000000,004E30E0,00000000,004CF0B8,004CF0B8,004DF0D8,004DF0D8,80000000,00000003,?,?,?,00000000,00403A47,?), ref: 00403600

Strings

Null, xrefs: 0040367E
Error launching installer, xrefs: 004035D7
Inst, xrefs: 0040366C
Installer integrity check has failed. Common causes includeincomplete download and damaged media. Contact theinstaller's author , xrefs: 004037C5
soft, xrefs: 00403675

Memory Dump Source

Source File: 00000000.00000002.1786996002.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1786976555.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1787017126.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1787037791.000000000040B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1787037791.000000000041F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1787037791.0000000000461000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1787037791.00000000004B3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1787138270.00000000004F4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1787138270.0000000000505000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_GOmRjFSKNz.jbxd

Similarity

API ID: File$AttributesCountCreateModuleNameSizeTick
String ID: Error launching installer$Inst$Installer integrity check has failed. Common causes includeincomplete download and damaged media. Contact theinstaller's author $Null$soft
API String ID: 4283519449-527102705
Opcode ID: 120a85709c4a4315a44e2654504c88cd7b3d990096a9d7006e83d60a3a2719f2
Instruction ID: 97831ba7e8e922ff386f77eab0e0d18630bd2de4bbb47cca7d976ce2c46b30f6
Opcode Fuzzy Hash: 120a85709c4a4315a44e2654504c88cd7b3d990096a9d7006e83d60a3a2719f2
Instruction Fuzzy Hash: 3151D5B1900204AFDB219F65CD85B9E7EB8AB14756F10803FE605B72D1D77D9E808B9C

Function 0040337F Relevance: 17.7, APIs: 6, Strings: 4, Instructions: 166
fileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetTickCount.KERNEL32 ref: 004033E7
GetTickCount.KERNEL32 ref: 00403464
MulDiv.KERNEL32(7FFFFFFF,00000064,?), ref: 00403491
wsprintfW.USER32 ref: 004034A4
WriteFile.KERNELBASE(00000000,00000000,?,7FFFFFFF,00000000), ref: 004034D3
WriteFile.KERNEL32(00000000,0041F150,?,00000000,00000000,0041F150,?,000000FF,00000004,00000000,00000000,00000000), ref: 0040356A

Strings

X1C, xrefs: 004033ED
... %d%%, xrefs: 0040349E
P1B, xrefs: 004033A9
X1C, xrefs: 0040343C

Memory Dump Source

Source File: 00000000.00000002.1786996002.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1786976555.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1787017126.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1787037791.000000000040B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1787037791.000000000041F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1787037791.0000000000461000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1787037791.00000000004B3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1787138270.00000000004F4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1787138270.0000000000505000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_GOmRjFSKNz.jbxd

Similarity

API ID: CountFileTickWrite$wsprintf
String ID: ... %d%%$P1B$X1C$X1C
API String ID: 651206458-1535804072
Opcode ID: 44661cc85d05d2ece2df72a1dadfaff530150b4f00ec14a98415859341c8c9fb
Instruction ID: 0313947f0097750978ec936bbe46de4fad37e772bc1cb17ec77dd8e30cfa9ece
Opcode Fuzzy Hash: 44661cc85d05d2ece2df72a1dadfaff530150b4f00ec14a98415859341c8c9fb
Instruction Fuzzy Hash: 88518D71900219ABDF10DF65AE44AAF7BACAB00316F14417BF900B7290DB78DF40CBA9

Function 00404F72 Relevance: 10.6, APIs: 7, Instructions: 73
stringwindowCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

lstrlenW.KERNEL32(0043B228,?,00000000,00000000), ref: 00404FAA
lstrlenW.KERNEL32(004034BB,0043B228,?,00000000,00000000), ref: 00404FBA
lstrcatW.KERNEL32(0043B228,004034BB,004034BB,0043B228,?,00000000,00000000), ref: 00404FCD
SetWindowTextW.USER32(0043B228,0043B228), ref: 00404FDF
SendMessageW.USER32(?,00001004,00000000,00000000), ref: 00405005
SendMessageW.USER32(?,0000104D,00000000,00000001), ref: 0040501F
SendMessageW.USER32(?,00001013,?,00000000), ref: 0040502D

Part of subcall function 00406805: GetVersion.KERNEL32(0043B228,?,00000000,00404FA9,0043B228,00000000,?,00000000,00000000), ref: 004068D6

Memory Dump Source

Source File: 00000000.00000002.1786996002.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1786976555.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1787017126.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1787037791.000000000040B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1787037791.000000000041F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1787037791.0000000000461000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1787037791.00000000004B3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1787138270.00000000004F4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1787138270.0000000000505000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_GOmRjFSKNz.jbxd

Similarity

API ID: MessageSend$lstrlen$TextVersionWindowlstrcat
String ID:
API String ID: 2740478559-0
Opcode ID: 7bcaf298b14bfcb271399e4538be81cf37b8538d1c197863d88476df1de4366a
Instruction ID: 1d640e6b4f0869ec625b39ce8112f9bd6789598538fb42bade37fe3884716a8e
Opcode Fuzzy Hash: 7bcaf298b14bfcb271399e4538be81cf37b8538d1c197863d88476df1de4366a
Instruction Fuzzy Hash: 3C21B0B1900518BACF119FA5DD84E9EBFB5EF84310F10813AFA04BA291D7798E509F98

Function 00401EB9 Relevance: 7.6, APIs: 2, Strings: 3, Instructions: 78
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 00406009: lstrcpynW.KERNEL32(?,?,00002004,004038F1,0046ADC0,NSIS Error), ref: 00406016

GlobalFree.KERNELBASE(007FA840), ref: 00402387

Strings

Pop: stack empty, xrefs: 00401F2C
open, xrefs: 00401EFB, 00401F00, 00401F1A
Exch: stack < %d elements, xrefs: 00401ED8

Memory Dump Source

Source File: 00000000.00000002.1786996002.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1786976555.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1787017126.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1787037791.000000000040B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1787037791.000000000041F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1787037791.0000000000461000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1787037791.00000000004B3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1787138270.00000000004F4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1787138270.0000000000505000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_GOmRjFSKNz.jbxd

Similarity

API ID: FreeGloballstrcpyn
String ID: Exch: stack < %d elements$Pop: stack empty$open
API String ID: 1459762280-1711415406
Opcode ID: 1ca185eeaafbead47595a1cc0f367f8cfd746e673960b0814e4cdcb04772ee17
Instruction ID: ae7cb1f2c63b60d7baa415153617f8c61fd22799b34192a347ea6a0a5f6d971a
Opcode Fuzzy Hash: 1ca185eeaafbead47595a1cc0f367f8cfd746e673960b0814e4cdcb04772ee17
Instruction Fuzzy Hash: 4721D172601105EBE710EB95DD81A6F77A8EF44318B21003FF542F32D1EB7998118AAD

Function 004022FD Relevance: 7.6, APIs: 5, Instructions: 56
memoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetFileVersionInfoSizeW.VERSION(00000000,?,000000EE), ref: 0040230C
GlobalAlloc.KERNEL32(00000040,00000000,00000000,?,000000EE), ref: 0040232E
GetFileVersionInfoW.VERSION(?,?,?,00000000), ref: 00402347
VerQueryValueW.VERSION(?,00408838,?,?,?,?,?,00000000), ref: 00402360

Part of subcall function 00405F51: wsprintfW.USER32 ref: 00405F5E

GlobalFree.KERNELBASE(007FA840), ref: 00402387

Memory Dump Source

Source File: 00000000.00000002.1786996002.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1786976555.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1787017126.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1787037791.000000000040B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1787037791.000000000041F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1787037791.0000000000461000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1787037791.00000000004B3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1787138270.00000000004F4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1787138270.0000000000505000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_GOmRjFSKNz.jbxd

Similarity

API ID: FileGlobalInfoVersion$AllocFreeQuerySizeValuewsprintf
String ID:
API String ID: 3376005127-0
Opcode ID: 6f3e0dbebcfa7f75c0754c170d72e8097fcb7c93b116c2da6e8eed637ff4f305
Instruction ID: 606d2f288e59f9406d2e88b5b0598c54d729d8d595f649ff0f3e4a994beab86c
Opcode Fuzzy Hash: 6f3e0dbebcfa7f75c0754c170d72e8097fcb7c93b116c2da6e8eed637ff4f305
Instruction Fuzzy Hash: 82115E72900109AFCF00EFA1DD45DAE7BB8EF04344F10403AFA09F61A1D7799A40DB19

Function 00402B23 Relevance: 7.6, APIs: 5, Instructions: 54
memoryfilestringCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GlobalAlloc.KERNEL32(00000040,00002004), ref: 00402B2B
WideCharToMultiByte.KERNEL32(?,?,0040F0D0,000000FF,?,00002004,?,?,00000011), ref: 00402B61
lstrlenA.KERNEL32(?,?,?,0040F0D0,000000FF,?,00002004,?,?,00000011), ref: 00402B6A
WriteFile.KERNEL32(00000000,?,?,00000000,?,?,?,?,0040F0D0,000000FF,?,00002004,?,?,00000011), ref: 00402B85

Memory Dump Source

Source File: 00000000.00000002.1786996002.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1786976555.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1787017126.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1787037791.000000000040B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1787037791.000000000041F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1787037791.0000000000461000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1787037791.00000000004B3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1787138270.00000000004F4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1787138270.0000000000505000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_GOmRjFSKNz.jbxd

Similarity

API ID: AllocByteCharFileGlobalMultiWideWritelstrlen
String ID:
API String ID: 2568930968-0
Opcode ID: 02f149ecbdf3f63b5c58a8b7f5a2f789e982e3470d3956ff315881f03770554e
Instruction ID: 5d007b3c2ae3d1ce6b2586a1921c4ad46276280cee2e515d5d1d957ff8a092fa
Opcode Fuzzy Hash: 02f149ecbdf3f63b5c58a8b7f5a2f789e982e3470d3956ff315881f03770554e
Instruction Fuzzy Hash: 76016171500205FBDB14AF70DE48D9E3B78EF05359F10443AF646B91E1D6798982DB68

Function 00402713 Relevance: 7.0, APIs: 1, Strings: 3, Instructions: 42
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 00406009: lstrcpynW.KERNEL32(?,?,00002004,004038F1,0046ADC0,NSIS Error), ref: 00406016

WritePrivateProfileStringW.KERNEL32(?,?,?,00000000), ref: 0040278C

Strings

<RM>, xrefs: 00402713
open, xrefs: 00402770
WriteINIStr: wrote [%s] %s=%s in %s, xrefs: 00402775

Memory Dump Source

Source File: 00000000.00000002.1786996002.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1786976555.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1787017126.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1787037791.000000000040B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1787037791.000000000041F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1787037791.0000000000461000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1787037791.00000000004B3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1787138270.00000000004F4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1787138270.0000000000505000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_GOmRjFSKNz.jbxd

Similarity

API ID: PrivateProfileStringWritelstrcpyn
String ID: <RM>$WriteINIStr: wrote [%s] %s=%s in %s$open
API String ID: 247603264-1827671502
Opcode ID: ebd727ba1388524afa6f7b5c72e47581e9b4ec966d204d2154218169f3a3a122
Instruction ID: 1675f45263e21dacb3bd3d3c28f4c469aa899418fcec56767b4290250f933745
Opcode Fuzzy Hash: ebd727ba1388524afa6f7b5c72e47581e9b4ec966d204d2154218169f3a3a122
Instruction Fuzzy Hash: 05014F70D40319BADB10BFA18D859AF7A78AF09304F10403FF11A761E3D7B80A408BAD

Function 004021B5 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 54
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 00404F72: lstrlenW.KERNEL32(0043B228,?,00000000,00000000), ref: 00404FAA
Part of subcall function 00404F72: lstrlenW.KERNEL32(004034BB,0043B228,?,00000000,00000000), ref: 00404FBA
Part of subcall function 00404F72: lstrcatW.KERNEL32(0043B228,004034BB,004034BB,0043B228,?,00000000,00000000), ref: 00404FCD
Part of subcall function 00404F72: SetWindowTextW.USER32(0043B228,0043B228), ref: 00404FDF
Part of subcall function 00404F72: SendMessageW.USER32(?,00001004,00000000,00000000), ref: 00405005
Part of subcall function 00404F72: SendMessageW.USER32(?,0000104D,00000000,00000001), ref: 0040501F
Part of subcall function 00404F72: SendMessageW.USER32(?,00001013,?,00000000), ref: 0040502D

ShellExecuteW.SHELL32(?,00000000,00000000,00000000,004CB0B0,?), ref: 00402202

Part of subcall function 004062A3: lstrlenW.KERNEL32(RMDir: RemoveDirectory invalid input(""),00406E79,RMDir: RemoveDirectory("%s"),?,?,?), ref: 004062B0
Part of subcall function 004062A3: wvsprintfW.USER32(00000000,?,?), ref: 004062C7

Strings

ExecShell: success ("%s": file:"%s" params:"%s"), xrefs: 00402226
ExecShell: warning: error ("%s": file:"%s" params:"%s")=%d, xrefs: 00402211

Memory Dump Source

Source File: 00000000.00000002.1786996002.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1786976555.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1787017126.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1787037791.000000000040B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1787037791.000000000041F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1787037791.0000000000461000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1787037791.00000000004B3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1787138270.00000000004F4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1787138270.0000000000505000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_GOmRjFSKNz.jbxd

Similarity

API ID: MessageSendlstrlen$ExecuteShellTextWindowlstrcatwvsprintf
String ID: ExecShell: success ("%s": file:"%s" params:"%s")$ExecShell: warning: error ("%s": file:"%s" params:"%s")=%d
API String ID: 3156913733-2180253247
Opcode ID: 0e9dd1e26526b91e1c41cfd2ad6e78dbbf82426293fff8cc21759efb88a5ec27
Instruction ID: bbc106df3db47d5a89d2587a4e22f40687ed87c50c6518a2742e337a88eb4af1
Opcode Fuzzy Hash: 0e9dd1e26526b91e1c41cfd2ad6e78dbbf82426293fff8cc21759efb88a5ec27
Instruction Fuzzy Hash: E001F7B2B4021476DB2077B69C87F6B2A5CDB41764B20047BF502F20E3E5BD88009139

Function 00405E7F Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 37COMMON

Download Yara Rule

APIs

GetTickCount.KERNEL32 ref: 00405E9D
GetTempFileNameW.KERNELBASE(?,?,00000000,?,?,?,00000000,004037FE,004D30C0,004D70C8), ref: 00405EB8

Strings

nsa, xrefs: 00405E8C

Memory Dump Source

Source File: 00000000.00000002.1786996002.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1786976555.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1787017126.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1787037791.000000000040B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1787037791.000000000041F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1787037791.0000000000461000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1787037791.00000000004B3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1787138270.00000000004F4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1787138270.0000000000505000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_GOmRjFSKNz.jbxd

Similarity

API ID: CountFileNameTempTick
String ID: nsa
API String ID: 1716503409-2209301699
Opcode ID: 74c86182fa67e47248f5fe200c9c22c18b8020e4291a34397a9b0f642818afda
Instruction ID: bbb7b3741c82bae03d84fc31e008e00914f4f4b6280f54d22115683b6c602e07
Opcode Fuzzy Hash: 74c86182fa67e47248f5fe200c9c22c18b8020e4291a34397a9b0f642818afda
Instruction Fuzzy Hash: 39F0F635600604BBDB00CF55DD05A9FBBBDEF90310F00803BE944E7140E6B09E00C798

Function 00402175 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 28COMMON

Download Yara Rule

APIs

ShowWindow.USER32(00000000,00000000), ref: 0040219F

Part of subcall function 004062A3: lstrlenW.KERNEL32(RMDir: RemoveDirectory invalid input(""),00406E79,RMDir: RemoveDirectory("%s"),?,?,?), ref: 004062B0
Part of subcall function 004062A3: wvsprintfW.USER32(00000000,?,?), ref: 004062C7

EnableWindow.USER32(00000000,00000000), ref: 004021AA

Strings

HideWindow, xrefs: 0040218D

Memory Dump Source

Source File: 00000000.00000002.1786996002.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1786976555.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1787017126.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1787037791.000000000040B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1787037791.000000000041F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1787037791.0000000000461000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1787037791.00000000004B3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1787138270.00000000004F4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1787138270.0000000000505000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_GOmRjFSKNz.jbxd

Similarity

API ID: Window$EnableShowlstrlenwvsprintf
String ID: HideWindow
API String ID: 1249568736-780306582
Opcode ID: 0616bcda597e9750e62a76ee812eb00f220ec1a404151e7fe1b3dec3a2ed7f78
Instruction ID: bfe0de145d0e58e27592ef60cc9cda220d4f3e6bacb950e19a0f62fa040dbd34
Opcode Fuzzy Hash: 0616bcda597e9750e62a76ee812eb00f220ec1a404151e7fe1b3dec3a2ed7f78
Instruction Fuzzy Hash: F1E09232A05111DBCB08FBB5A74A5AE76B4EA9532A721007FE143F20D0DABD8D01C62D

Function 004078C5 Relevance: 5.2, APIs: 4, Instructions: 238COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1786996002.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1786976555.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1787017126.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1787037791.000000000040B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1787037791.000000000041F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1787037791.0000000000461000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1787037791.00000000004B3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1787138270.00000000004F4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1787138270.0000000000505000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_GOmRjFSKNz.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 34a0988d6b53cb3e5c5cab68a25a042cd6e02f2342b0fd139447399893daab40
Instruction ID: 5b61ba0e549d4a34e11b5feda41afe9ae6537485a044c30e59ebd23bda5797f4
Opcode Fuzzy Hash: 34a0988d6b53cb3e5c5cab68a25a042cd6e02f2342b0fd139447399893daab40
Instruction Fuzzy Hash: BCA14771908248DBEF18CF28C8946AD3BB1FB44359F14812AFC56AB280D738E985DF85

Function 00407AC3 Relevance: 5.2, APIs: 4, Instructions: 211COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1786996002.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1786976555.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1787017126.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1787037791.000000000040B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1787037791.000000000041F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1787037791.0000000000461000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1787037791.00000000004B3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1787138270.00000000004F4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1787138270.0000000000505000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_GOmRjFSKNz.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5706958415abe038d8bc904968b39eb1c0ab21271a5e62a9b552e9204fe8a243
Instruction ID: 0868455ade8710e2db62ea7c97591ecaf8a07f5330254cde648c5a00cf1b77b0
Opcode Fuzzy Hash: 5706958415abe038d8bc904968b39eb1c0ab21271a5e62a9b552e9204fe8a243
Instruction Fuzzy Hash: 30912871908248DBEF14CF18C8947A93BB1FF44359F14812AFC5AAB291D738E985DF89

Function 00407312 Relevance: 5.2, APIs: 4, Instructions: 201COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1786996002.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1786976555.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1787017126.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1787037791.000000000040B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1787037791.000000000041F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1787037791.0000000000461000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1787037791.00000000004B3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1787138270.00000000004F4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1787138270.0000000000505000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_GOmRjFSKNz.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 11cd2314bdb72fbaaf254cc8ab9d4ea11bc1da16cf3644787fbca669908488dc
Instruction ID: 3981f1dd08afc316d24d9ed5113be2a17ca7da729ed8f25fba603efd3ef4d826
Opcode Fuzzy Hash: 11cd2314bdb72fbaaf254cc8ab9d4ea11bc1da16cf3644787fbca669908488dc
Instruction Fuzzy Hash: 39815931908248DBEF14CF29C8446AE3BB1FF44355F10812AFC66AB291D778E985DF86

Function 00407752 Relevance: 5.2, APIs: 4, Instructions: 179COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1786996002.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1786976555.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1787017126.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1787037791.000000000040B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1787037791.000000000041F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1787037791.0000000000461000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1787037791.00000000004B3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1787138270.00000000004F4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1787138270.0000000000505000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_GOmRjFSKNz.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f6fc324ba2a3154e694309e6bae2168c7942ffc843c4c16a3e425845c98615c2
Instruction ID: 01891581271c5a124b16634c3a8992e7a6857e255b4271240234ec945a90a24d
Opcode Fuzzy Hash: f6fc324ba2a3154e694309e6bae2168c7942ffc843c4c16a3e425845c98615c2
Instruction Fuzzy Hash: 73713571908248DBEF18CF28C894AAD3BF1FB44355F14812AFC56AB291D738E985DF85

Function 00407854 Relevance: 5.2, APIs: 4, Instructions: 169COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1786996002.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1786976555.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1787017126.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1787037791.000000000040B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1787037791.000000000041F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1787037791.0000000000461000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1787037791.00000000004B3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1787138270.00000000004F4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1787138270.0000000000505000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_GOmRjFSKNz.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 50afaaeaa81713190e6368922b68e72c74c0f8af07b8473edddf34e42917c2b6
Instruction ID: 94e3b44a92ae0aa4503ed5f8848dd13d39bc4d5c5e61625994f203468061122b
Opcode Fuzzy Hash: 50afaaeaa81713190e6368922b68e72c74c0f8af07b8473edddf34e42917c2b6
Instruction Fuzzy Hash: 25713671908248DBEF18CF19C894BA93BF1FB44345F10812AFC56AA291C738E985DF86

Function 004077B2 Relevance: 5.2, APIs: 4, Instructions: 166COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1786996002.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1786976555.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1787017126.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1787037791.000000000040B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1787037791.000000000041F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1787037791.0000000000461000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1787037791.00000000004B3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1787138270.00000000004F4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1787138270.0000000000505000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_GOmRjFSKNz.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c1e8f36220be8f98feef1199d10cba6751babd433578914259dc57061f930aad
Instruction ID: 61f7b93237898aea062553d5d4b8719da8ac7eccb5076a10c91df3859b53dd49
Opcode Fuzzy Hash: c1e8f36220be8f98feef1199d10cba6751babd433578914259dc57061f930aad
Instruction Fuzzy Hash: 98612771908248DBEF18CF19C894BAD3BF1FB44345F14812AFC56AA291C738E985DF86

Function 00407C5F Relevance: 5.2, APIs: 4, Instructions: 156memoryCOMMON

Download Yara Rule

APIs

GlobalFree.KERNELBASE(?), ref: 004073C5
GlobalAlloc.KERNELBASE(00000040,?,00000000,0041F150,00004000), ref: 004073CE
GlobalFree.KERNELBASE(?), ref: 0040743D
GlobalAlloc.KERNELBASE(00000040,?,00000000,0041F150,00004000), ref: 00407448

Memory Dump Source

Source File: 00000000.00000002.1786996002.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1786976555.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1787017126.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1787037791.000000000040B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1787037791.000000000041F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1787037791.0000000000461000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1787037791.00000000004B3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1787138270.00000000004F4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1787138270.0000000000505000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_GOmRjFSKNz.jbxd

Similarity

API ID: Global$AllocFree
String ID:
API String ID: 3394109436-0
Opcode ID: b4e0c1391c46ae50f73649b3c762cd7b27ce57b462bacfc2a9e8da119b19f928
Instruction ID: da36524f31269fd1e9de8fc6705d7123eeae9c681c0d19372ba3dadca10d6d3f
Opcode Fuzzy Hash: b4e0c1391c46ae50f73649b3c762cd7b27ce57b462bacfc2a9e8da119b19f928
Instruction Fuzzy Hash: 81513871918248EBEF18CF19C894AAD3BF1FF44345F10812AFC56AA291C738E985DF85

Function 0040139D Relevance: 3.0, APIs: 2, Instructions: 42windowCOMMON

Download Yara Rule

APIs

MulDiv.KERNEL32(00007530,00000000,00000000), ref: 004013F6
SendMessageW.USER32(00000402,00000402,00000000), ref: 00401406

Memory Dump Source

Source File: 00000000.00000002.1786996002.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1786976555.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1787017126.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1787037791.000000000040B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1787037791.000000000041F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1787037791.0000000000461000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1787037791.00000000004B3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1787138270.00000000004F4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1787138270.0000000000505000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_GOmRjFSKNz.jbxd

Similarity

API ID: MessageSend
String ID:
API String ID: 3850602802-0
Opcode ID: 5a31974c6ff286c329462761e498969acf5a6972bf7682297af78da516706e42
Instruction ID: d71d45502f518029c3ce7990b7c8d381ac94a1bb539c673c2af025244294d997
Opcode Fuzzy Hash: 5a31974c6ff286c329462761e498969acf5a6972bf7682297af78da516706e42
Instruction Fuzzy Hash: 96F0F471A10220DFD7555B74DD04B273699AB80361F24463BF911F62F1E6B8DC528B4E

Function 00405E50 Relevance: 3.0, APIs: 2, Instructions: 15fileCOMMON

Download Yara Rule

APIs

GetFileAttributesW.KERNELBASE(00000003,004035C7,004DF0D8,80000000,00000003,?,?,?,00000000,00403A47,?), ref: 00405E54
CreateFileW.KERNELBASE(?,?,00000001,00000000,?,00000001,00000000,?,?,?,00000000,00403A47,?), ref: 00405E76

Memory Dump Source

Source File: 00000000.00000002.1786996002.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1786976555.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1787017126.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1787037791.000000000040B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1787037791.000000000041F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1787037791.0000000000461000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1787037791.00000000004B3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1787138270.00000000004F4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1787138270.0000000000505000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_GOmRjFSKNz.jbxd

Similarity

API ID: File$AttributesCreate
String ID:
API String ID: 415043291-0
Opcode ID: 6f817a4f04f8c8cc68f88398dd52813d28edb2112aa12cde00d29204b34f1fbe
Instruction ID: fe2e31f24f36ecb58ba6038de6e4569557e5a61990f2f31681ab57118d472e11
Opcode Fuzzy Hash: 6f817a4f04f8c8cc68f88398dd52813d28edb2112aa12cde00d29204b34f1fbe
Instruction Fuzzy Hash: BCD09E71554202EFEF098F60DE1AF6EBBA2FB94B00F11852CB292550F0DAB25819DB15

Function 00405E30 Relevance: 3.0, APIs: 2, Instructions: 9COMMON

Download Yara Rule

APIs

GetFileAttributesW.KERNELBASE(?,00406E81,?,?,?), ref: 00405E34
SetFileAttributesW.KERNEL32(?,00000000), ref: 00405E47

Memory Dump Source

Source File: 00000000.00000002.1786996002.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1786976555.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1787017126.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1787037791.000000000040B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1787037791.000000000041F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1787037791.0000000000461000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1787037791.00000000004B3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1787138270.00000000004F4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1787138270.0000000000505000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_GOmRjFSKNz.jbxd

Similarity

API ID: AttributesFile
String ID:
API String ID: 3188754299-0
Opcode ID: 404706a0ec70c465fc6e77d3f379a59e81a865ab84cdc077efcd7274a0164b66
Instruction ID: a99f375bd2b1051765f890e1d94d2f722c1bb1ba0a12d38356d8610c0186b9c0
Opcode Fuzzy Hash: 404706a0ec70c465fc6e77d3f379a59e81a865ab84cdc077efcd7274a0164b66
Instruction Fuzzy Hash: 84C01272404800EAC6000B34DF0881A7B62AB90330B268B39B0BAE00F0CB3488A99A18

Function 00403336 Relevance: 1.5, APIs: 1, Instructions: 22fileCOMMON

Download Yara Rule

APIs

ReadFile.KERNELBASE(00000000,00000000,00000000,00000000,000000FF,?,004033CE,000000FF,00000004,00000000,00000000,00000000), ref: 0040334D

Memory Dump Source

Source File: 00000000.00000002.1786996002.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1786976555.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1787017126.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1787037791.000000000040B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1787037791.000000000041F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1787037791.0000000000461000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1787037791.00000000004B3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1787138270.00000000004F4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1787138270.0000000000505000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_GOmRjFSKNz.jbxd

Similarity

API ID: FileRead
String ID:
API String ID: 2738559852-0
Opcode ID: 1a43d381f500bc8dc9f00bbbc079669c25ab728c1eaf5fecfa5fd6a2526f4c39
Instruction ID: a3bc5d39330dd194e4c7332763fdc94ca13499671d705f1c19c6925397c50364
Opcode Fuzzy Hash: 1a43d381f500bc8dc9f00bbbc079669c25ab728c1eaf5fecfa5fd6a2526f4c39
Instruction Fuzzy Hash: C8E08C32550118BFCB109EA69C40EE73B5CFB047A2F00C832BD55E5290DA30DA00EBE8

Function 004037CC Relevance: 1.5, APIs: 1, Instructions: 20COMMON

Download Yara Rule

APIs

Part of subcall function 00406038: CharNextW.USER32(?,*?|<>/":,00000000,004D70C8,004C30A0,004D70C8,00000000,004037D8,004D70C8,-00000002,00403A0B), ref: 0040609B
Part of subcall function 00406038: CharNextW.USER32(?,?,?,00000000), ref: 004060AA
Part of subcall function 00406038: CharNextW.USER32(?,004D70C8,004C30A0,004D70C8,00000000,004037D8,004D70C8,-00000002,00403A0B), ref: 004060AF
Part of subcall function 00406038: CharPrevW.USER32(?,?,004C30A0,004D70C8,00000000,004037D8,004D70C8,-00000002,00403A0B), ref: 004060C3

CreateDirectoryW.KERNELBASE(004D70C8,00000000,004D70C8,004D70C8,004D70C8,-00000002,00403A0B), ref: 004037ED

Memory Dump Source

Source File: 00000000.00000002.1786996002.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1786976555.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1787017126.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1787037791.000000000040B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1787037791.000000000041F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1787037791.0000000000461000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1787037791.00000000004B3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1787138270.00000000004F4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1787138270.0000000000505000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_GOmRjFSKNz.jbxd

Similarity

API ID: Char$Next$CreateDirectoryPrev
String ID:
API String ID: 4115351271-0
Opcode ID: df63d9f6fb0dfe925f434423aee030f478bab57ed52ac2db2f8962d9fd449c2e
Instruction ID: 8ea1286759415c6f695425ed34242866ebe8a7a529327a4e56f2759b30593fc1
Opcode Fuzzy Hash: df63d9f6fb0dfe925f434423aee030f478bab57ed52ac2db2f8962d9fd449c2e
Instruction Fuzzy Hash: B1D0A921083C3221C562332A3D06FCF090C8F2635AB02C07BF841B61CA8B2C4B8240EE

Function 00403DAF Relevance: 1.5, APIs: 1, Instructions: 9windowCOMMON

Download Yara Rule

APIs

SendMessageW.USER32(?,?,00000000,00000000), ref: 00403DC1

Memory Dump Source

Source File: 00000000.00000002.1786996002.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1786976555.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1787017126.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1787037791.000000000040B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1787037791.000000000041F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1787037791.0000000000461000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1787037791.00000000004B3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1787138270.00000000004F4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1787138270.0000000000505000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_GOmRjFSKNz.jbxd

Similarity

API ID: MessageSend
String ID:
API String ID: 3850602802-0
Opcode ID: 203c4a4104ade6b46efc04414fb016ca35add41c2a64233918ece76cb1940256
Instruction ID: 301fa2329b67e93c742f3c195cb428e9759bf169fd062939fd541a9b7e119014
Opcode Fuzzy Hash: 203c4a4104ade6b46efc04414fb016ca35add41c2a64233918ece76cb1940256
Instruction Fuzzy Hash: D3C04C71650601AADA108B509D45F1677595B50B41F544439B641F50E0D674E450DA1E

Function 00403368 Relevance: 1.5, APIs: 1, Instructions: 6COMMON

Download Yara Rule

APIs

SetFilePointer.KERNELBASE(00000000,00000000,00000000,0040375A,?,?,?,?,00000000,00403A47,?), ref: 00403376

Memory Dump Source

Source File: 00000000.00000002.1786996002.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1786976555.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1787017126.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1787037791.000000000040B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1787037791.000000000041F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1787037791.0000000000461000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1787037791.00000000004B3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1787138270.00000000004F4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1787138270.0000000000505000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_GOmRjFSKNz.jbxd

Similarity

API ID: FilePointer
String ID:
API String ID: 973152223-0
Opcode ID: ff5c9719b5bb24227ed98436e19d1f66b73f6b097333bfca9e4e1763c30da83c
Instruction ID: da19c3e449f5d10d282cbd9bcc1d8f2f369397d5e390659c1e8fea63e82898b0
Opcode Fuzzy Hash: ff5c9719b5bb24227ed98436e19d1f66b73f6b097333bfca9e4e1763c30da83c
Instruction Fuzzy Hash: 0CB09231140204AEDA214B109E05F067A21FB94700F208824B2A0380F086711420EA0C

Function 00403D98 Relevance: 1.5, APIs: 1, Instructions: 6windowCOMMON

Download Yara Rule

APIs

SendMessageW.USER32(00000028,?,00000001,004057B4), ref: 00403DA6

Memory Dump Source

Source File: 00000000.00000002.1786996002.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1786976555.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1787017126.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1787037791.000000000040B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1787037791.000000000041F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1787037791.0000000000461000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1787037791.00000000004B3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1787138270.00000000004F4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1787138270.0000000000505000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_GOmRjFSKNz.jbxd

Similarity

API ID: MessageSend
String ID:
API String ID: 3850602802-0
Opcode ID: 8ef0c84af5b69eb6e5c04aecb335cbd5d798096170d60dc049d97623b8df0028
Instruction ID: f61ffac979fbda5733e9df3da2bdae5977773398d3d4f9e0d67d11d125479468
Opcode Fuzzy Hash: 8ef0c84af5b69eb6e5c04aecb335cbd5d798096170d60dc049d97623b8df0028
Instruction Fuzzy Hash: EFB09235181A00AADE614B00DF0AF457A62A764701F008079B245640B0CAB200E0DB08

Function 00403D85 Relevance: 1.5, APIs: 1, Instructions: 4COMMON

Download Yara Rule

APIs

KiUserCallbackDispatcher.NTDLL(?,0040574D), ref: 00403D8F

Memory Dump Source

Source File: 00000000.00000002.1786996002.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1786976555.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1787017126.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1787037791.000000000040B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1787037791.000000000041F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1787037791.0000000000461000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1787037791.00000000004B3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1787138270.00000000004F4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1787138270.0000000000505000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_GOmRjFSKNz.jbxd

Similarity

API ID: CallbackDispatcherUser
String ID:
API String ID: 2492992576-0
Opcode ID: 7b5b3f07ec4b69a7f183f6b544b36b38adf2938630adbd4e30d083ffe7510c70
Instruction ID: d14db2bc66c636a64d409f7b36464c270e9f3e97be8c2f7aaa1954d4611ec3db
Opcode Fuzzy Hash: 7b5b3f07ec4b69a7f183f6b544b36b38adf2938630adbd4e30d083ffe7510c70
Instruction Fuzzy Hash: 8DA01275005500DBCF014B40EF048067A61B7503007108478F1810003086310420EB08

Non-executed Functions

Function 0040497C Relevance: 65.2, APIs: 33, Strings: 4, Instructions: 470windowmemoryCOMMON

Download Yara Rule

APIs

GetDlgItem.USER32(?,000003F9), ref: 00404993
GetDlgItem.USER32(?,00000408), ref: 004049A0
GlobalAlloc.KERNEL32(00000040,?), ref: 004049EF
LoadBitmapW.USER32(0000006E), ref: 00404A02
SetWindowLongW.USER32(?,000000FC,Function_000048CC), ref: 00404A1C
ImageList_Create.COMCTL32(00000010,00000010,00000021,00000006,00000000), ref: 00404A2E
ImageList_AddMasked.COMCTL32(00000000,?,00FF00FF), ref: 00404A42
SendMessageW.USER32(?,00001109,00000002), ref: 00404A58
SendMessageW.USER32(?,0000111C,00000000,00000000), ref: 00404A64
SendMessageW.USER32(?,0000111B,00000010,00000000), ref: 00404A74
DeleteObject.GDI32(?), ref: 00404A79
SendMessageW.USER32(?,00000143,00000000,00000000), ref: 00404AA4
SendMessageW.USER32(?,00000151,00000000,00000000), ref: 00404AB0
SendMessageW.USER32(?,00001132,00000000,?), ref: 00404B51
SendMessageW.USER32(?,0000110A,00000003,00000110), ref: 00404B74
SendMessageW.USER32(?,00001132,00000000,?), ref: 00404B85
GetWindowLongW.USER32(?,000000F0), ref: 00404BAF
SetWindowLongW.USER32(?,000000F0,00000000), ref: 00404BBE
ShowWindow.USER32(?,00000005), ref: 00404BCF
SendMessageW.USER32(?,00000419,00000000,?), ref: 00404CCD
SendMessageW.USER32(?,00000147,00000000,00000000), ref: 00404D28
SendMessageW.USER32(?,00000150,00000000,00000000), ref: 00404D3D
SendMessageW.USER32(?,00000420,00000000,00000020), ref: 00404D61
SendMessageW.USER32(?,00000200,00000000,00000000), ref: 00404D87
ImageList_Destroy.COMCTL32(?), ref: 00404D9C
GlobalFree.KERNEL32(?), ref: 00404DAC
SendMessageW.USER32(?,0000014E,00000000,00000000), ref: 00404E1C
SendMessageW.USER32(?,00001102,?,?), ref: 00404ECA
SendMessageW.USER32(?,0000113F,00000000,00000008), ref: 00404ED9
InvalidateRect.USER32(?,00000000,00000001), ref: 00404EF9
ShowWindow.USER32(?,00000000), ref: 00404F49
GetDlgItem.USER32(?,000003FE), ref: 00404F54
ShowWindow.USER32(00000000), ref: 00404F5B

Strings

M, xrefs: 00404B43
@, xrefs: 00404B90
N, xrefs: 00404C06
, xrefs: 00404F39

Memory Dump Source

Source File: 00000000.00000002.1786996002.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1786976555.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1787017126.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1787037791.000000000040B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1787037791.000000000041F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1787037791.0000000000461000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1787037791.00000000004B3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1787138270.00000000004F4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1787138270.0000000000505000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_GOmRjFSKNz.jbxd

Similarity

API ID: MessageSend$Window$ImageItemList_LongShow$Global$AllocBitmapCreateDeleteDestroyFreeInvalidateLoadMaskedObjectRect
String ID: $ @$M$N
API String ID: 1638840714-3479655940
Opcode ID: 222e44079ed98782fbb34ec8da515d99173e785f6e02dcb26c66960398e67004
Instruction ID: e2b6c32447eba08f07ab18e4c0942225b167af9b9c7e550a0b0592367213937f
Opcode Fuzzy Hash: 222e44079ed98782fbb34ec8da515d99173e785f6e02dcb26c66960398e67004
Instruction Fuzzy Hash: 09026CB0900209AFEF209FA4CD45AAE7BB5FB84314F10413AF615B62E1D7B89D91DF58

Function 004044A5 Relevance: 33.6, APIs: 15, Strings: 4, Instructions: 300stringkeyboardCOMMON

Download Yara Rule

APIs

GetDlgItem.USER32(?,000003F0), ref: 004044F9
IsDlgButtonChecked.USER32(?,000003F0), ref: 00404507
GetDlgItem.USER32(?,000003FB), ref: 00404527
GetAsyncKeyState.USER32(00000010), ref: 0040452E
GetDlgItem.USER32(?,000003F0), ref: 00404543
ShowWindow.USER32(00000000,00000008,?,00000008,000000E0), ref: 00404554
SetWindowTextW.USER32(?,?), ref: 00404583
SHBrowseForFolderW.SHELL32(?), ref: 0040463D
lstrcmpiW.KERNEL32(00462540,00447240,00000000,?,?), ref: 0040467A
lstrcatW.KERNEL32(?,00462540), ref: 00404686
SetDlgItemTextW.USER32(?,000003FB,?), ref: 00404696
CoTaskMemFree.OLE32(00000000), ref: 00404648

Part of subcall function 00405C84: GetDlgItemTextW.USER32(00000001,00000001,00002004,00403F81), ref: 00405C97

Part of subcall function 00406038: CharNextW.USER32(?,*?|<>/":,00000000,004D70C8,004C30A0,004D70C8,00000000,004037D8,004D70C8,-00000002,00403A0B), ref: 0040609B
Part of subcall function 00406038: CharNextW.USER32(?,?,?,00000000), ref: 004060AA
Part of subcall function 00406038: CharNextW.USER32(?,004D70C8,004C30A0,004D70C8,00000000,004037D8,004D70C8,-00000002,00403A0B), ref: 004060AF
Part of subcall function 00406038: CharPrevW.USER32(?,?,004C30A0,004D70C8,00000000,004037D8,004D70C8,-00000002,00403A0B), ref: 004060C3

Part of subcall function 00403E74: lstrcatW.KERNEL32(00000000,00000000,0046A560,004C70A8,install.log,00405A9C,004C70A8,004C70A8,004D30C0,00447240,80000001,Control Panel\Desktop\ResourceLocale,00000000,00447240,00000000,00000006), ref: 00403E8F

GetDiskFreeSpaceW.KERNEL32(00443238,?,?,0000040F,?,00443238,00443238,?,00000000,00443238,?,?,000003FB,?), ref: 00404759
MulDiv.KERNEL32(?,0000040F,00000400), ref: 00404774

Part of subcall function 00406805: GetVersion.KERNEL32(0043B228,?,00000000,00404FA9,0043B228,00000000,?,00000000,00000000), ref: 004068D6

SetDlgItemTextW.USER32(00000000,00000400,00409264), ref: 004047ED

Strings

@rD, xrefs: 00404610
@%F, xrefs: 00404674
A, xrefs: 00404636
82D, xrefs: 004046DB

Memory Dump Source

Source File: 00000000.00000002.1786996002.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1786976555.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1787017126.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1787037791.000000000040B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1787037791.000000000041F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1787037791.0000000000461000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1787037791.00000000004B3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1787138270.00000000004F4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1787138270.0000000000505000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_GOmRjFSKNz.jbxd

Similarity

API ID: Item$CharText$Next$FreeWindowlstrcat$AsyncBrowseButtonCheckedDiskFolderPrevShowSpaceStateTaskVersionlstrcmpi
String ID: 82D$@%F$@rD$A
API String ID: 3347642858-1086125096
Opcode ID: 41223eded68e0cc8c9bf9fa9bd2dae48608aba550ad56c91da83586f0d18507e
Instruction ID: 5c5d6a603380bcdbc7d7d35b60f5621b43697e5e98684918e033f9398a36e476
Opcode Fuzzy Hash: 41223eded68e0cc8c9bf9fa9bd2dae48608aba550ad56c91da83586f0d18507e
Instruction Fuzzy Hash: D1B1A4B1900209BBDB11AFA1CD85AAF7AB8EF45314F10847BF605B72D1D77C8A41CB59

Function 00406ED2 Relevance: 30.0, APIs: 14, Strings: 3, Instructions: 270filestringCOMMON

Download Yara Rule

APIs

CreateFileW.KERNEL32(?,80000000,00000001,00000000,00000003,00000080,00000000), ref: 00406EF6
ReadFile.KERNEL32(00000000,?,0000000C,?,00000000), ref: 00406F30
ReadFile.KERNEL32(?,?,00000010,?,00000000), ref: 00406FA9
lstrcpynA.KERNEL32(?,?,00000005), ref: 00406FB5
lstrcmpA.KERNEL32(name,?), ref: 00406FC7
CloseHandle.KERNEL32(?), ref: 004071E6

Part of subcall function 004062A3: lstrlenW.KERNEL32(RMDir: RemoveDirectory invalid input(""),00406E79,RMDir: RemoveDirectory("%s"),?,?,?), ref: 004062B0
Part of subcall function 004062A3: wvsprintfW.USER32(00000000,?,?), ref: 004062C7

Strings

%s: failed opening file "%s", xrefs: 00406F0C
name, xrefs: 00406FBF
GetTTFNameString, xrefs: 00406F07

Memory Dump Source

Source File: 00000000.00000002.1786996002.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1786976555.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1787017126.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1787037791.000000000040B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1787037791.000000000041F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1787037791.0000000000461000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1787037791.00000000004B3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1787138270.00000000004F4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1787138270.0000000000505000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_GOmRjFSKNz.jbxd

Similarity

API ID: File$Read$CloseCreateHandlelstrcmplstrcpynlstrlenwvsprintf
String ID: %s: failed opening file "%s"$GetTTFNameString$name
API String ID: 1916479912-1189179171
Opcode ID: c1ee4f9d51a5711eefddbfc324bacbf89cb8dd321db642bada23a62a27e44b0a
Instruction ID: 34713ba181b26839f7619e948cf229fd8716e5ee99c03f3e8673f79b0d3e70cf
Opcode Fuzzy Hash: c1ee4f9d51a5711eefddbfc324bacbf89cb8dd321db642bada23a62a27e44b0a
Instruction Fuzzy Hash: 9091BF70D1412DAACF04EBA5DD909FEBBBAEF48301F00416AF592F72D0E6785A05DB64

Function 00406C9B Relevance: 29.9, APIs: 9, Strings: 8, Instructions: 190filestringCOMMON

Download Yara Rule

APIs

DeleteFileW.KERNEL32(?,?,004C30A0), ref: 00406CB8
lstrcatW.KERNEL32(0045C918,\*.*,0045C918,?,-00000002,004D70C8,?,004C30A0), ref: 00406D09
lstrcatW.KERNEL32(?,00408838,?,0045C918,?,-00000002,004D70C8,?,004C30A0), ref: 00406D29
lstrlenW.KERNEL32(?), ref: 00406D2C
FindFirstFileW.KERNEL32(0045C918,?), ref: 00406D40
FindNextFileW.KERNEL32(?,00000010,000000F2,?), ref: 00406E22
FindClose.KERNEL32(?), ref: 00406E33

Strings

Delete: DeleteFile("%s"), xrefs: 00406DBC
RMDir: RemoveDirectory on Reboot("%s"), xrefs: 00406E93
RMDir: RemoveDirectory invalid input("%s"), xrefs: 00406E58
\*.*, xrefs: 00406D03
RMDir: RemoveDirectory failed("%s"), xrefs: 00406EB0
RMDir: RemoveDirectory("%s"), xrefs: 00406E6F
Delete: DeleteFile on Reboot("%s"), xrefs: 00406DE0
Delete: DeleteFile failed("%s"), xrefs: 00406DFD

Memory Dump Source

Source File: 00000000.00000002.1786996002.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1786976555.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1787017126.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1787037791.000000000040B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1787037791.000000000041F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1787037791.0000000000461000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1787037791.00000000004B3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1787138270.00000000004F4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1787138270.0000000000505000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_GOmRjFSKNz.jbxd

Similarity

API ID: FileFind$lstrcat$CloseDeleteFirstNextlstrlen
String ID: Delete: DeleteFile failed("%s")$Delete: DeleteFile on Reboot("%s")$Delete: DeleteFile("%s")$RMDir: RemoveDirectory failed("%s")$RMDir: RemoveDirectory invalid input("%s")$RMDir: RemoveDirectory on Reboot("%s")$RMDir: RemoveDirectory("%s")$\*.*
API String ID: 2035342205-3294556389
Opcode ID: 15be8897d6e9b53d01f132332000c29bcd26e475d5c6b9324dd4f7514e94a53d
Instruction ID: 0ca3ec5a28b3c1cae8259a28e21d86b18febecd5c0179aed135e39ed79665852
Opcode Fuzzy Hash: 15be8897d6e9b53d01f132332000c29bcd26e475d5c6b9324dd4f7514e94a53d
Instruction Fuzzy Hash: 2D51E3315043056ADB20AB61CD46EAF37B89F81725F22803FF943751D2DB7C49A2DAAD

Function 00406805 Relevance: 21.2, APIs: 8, Strings: 4, Instructions: 212stringCOMMON

Download Yara Rule

APIs

GetVersion.KERNEL32(0043B228,?,00000000,00404FA9,0043B228,00000000,?,00000000,00000000), ref: 004068D6
GetSystemDirectoryW.KERNEL32(00462540,00002004), ref: 00406958

Part of subcall function 00406009: lstrcpynW.KERNEL32(?,?,00002004,004038F1,0046ADC0,NSIS Error), ref: 00406016

GetWindowsDirectoryW.KERNEL32(00462540,00002004), ref: 0040696B
lstrcatW.KERNEL32(00462540,\Microsoft\Internet Explorer\Quick Launch), ref: 004069E5
lstrlenW.KERNEL32(00462540,0043B228,?,00000000,00404FA9,0043B228,00000000,?,00000000,00000000), ref: 00406A47

Strings

\Microsoft\Internet Explorer\Quick Launch, xrefs: 004069DF
@%F, xrefs: 0040682C
Software\Microsoft\Windows\CurrentVersion, xrefs: 00406926
@%F, xrefs: 00406A53

Memory Dump Source

Source File: 00000000.00000002.1786996002.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1786976555.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1787017126.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1787037791.000000000040B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1787037791.000000000041F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1787037791.0000000000461000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1787037791.00000000004B3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1787138270.00000000004F4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1787138270.0000000000505000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_GOmRjFSKNz.jbxd

Similarity

API ID: Directory$SystemVersionWindowslstrcatlstrcpynlstrlen
String ID: @%F$@%F$Software\Microsoft\Windows\CurrentVersion$\Microsoft\Internet Explorer\Quick Launch
API String ID: 3581403547-784952888
Opcode ID: 5b9b76f287d52b653a8a41dc6b1224aada0ccbd74d66441f1f03372adecf381e
Instruction ID: 7881bd453c5698e0e02013fa1c3524f2cf467b60749c67c5a59258f73e57ab2a
Opcode Fuzzy Hash: 5b9b76f287d52b653a8a41dc6b1224aada0ccbd74d66441f1f03372adecf381e
Instruction Fuzzy Hash: F171F4B1A00215ABDB20AF28CD44A7E3771EF55314F12C03FE906B62E0E77C89A19B5D

Function 004024FB Relevance: 3.6, APIs: 1, Strings: 1, Instructions: 133comCOMMON

Download Yara Rule

APIs

CoCreateInstance.OLE32(00409B24,?,00000001,00409B04,?), ref: 0040257E

Strings

CreateShortCut: out: "%s", in: "%s %s", icon: %s,%d, sw=%d, hk=%d, xrefs: 00402560

Memory Dump Source

Source File: 00000000.00000002.1786996002.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1786976555.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1787017126.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1787037791.000000000040B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1787037791.000000000041F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1787037791.0000000000461000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1787037791.00000000004B3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1787138270.00000000004F4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1787138270.0000000000505000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_GOmRjFSKNz.jbxd

Similarity

API ID: CreateInstance
String ID: CreateShortCut: out: "%s", in: "%s %s", icon: %s,%d, sw=%d, hk=%d
API String ID: 542301482-1377821865
Opcode ID: 0ddbb4256677b6c48083548557f3f7fdb52e2b2de327cf14ae3b1cdcca70b28b
Instruction ID: c24c797a6f187c751e7d972b1a807078ee58ffeb38f484aa28d094541f0f6205
Opcode Fuzzy Hash: 0ddbb4256677b6c48083548557f3f7fdb52e2b2de327cf14ae3b1cdcca70b28b
Instruction Fuzzy Hash: 02415E74A00205BFCF04EFA0CC99EAE7B79FF48314B20456AF915EB2E1C679A941CB54

Function 00402E18 Relevance: 1.5, APIs: 1, Instructions: 27fileCOMMON

Download Yara Rule

APIs

FindFirstFileW.KERNEL32(00000000,?,00000002), ref: 00402E27

Memory Dump Source

Source File: 00000000.00000002.1786996002.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1786976555.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1787017126.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1787037791.000000000040B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1787037791.000000000041F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1787037791.0000000000461000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1787037791.00000000004B3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1787138270.00000000004F4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1787138270.0000000000505000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_GOmRjFSKNz.jbxd

Similarity

API ID: FileFindFirst
String ID:
API String ID: 1974802433-0
Opcode ID: 005be0a9498432eb51f9697d6085e84733c01c19a866f8c94ce5140aa3afdc34
Instruction ID: b91193b5dd17d351e639dca097a4c2443a83fae7855d8014906372cda19badf2
Opcode Fuzzy Hash: 005be0a9498432eb51f9697d6085e84733c01c19a866f8c94ce5140aa3afdc34
Instruction Fuzzy Hash: 4EE06D32600204AFD700EB749D45ABE736CDF01329F20457BF146F20D1E6B89A41976A

Function 004063AC Relevance: 70.3, APIs: 29, Strings: 11, Instructions: 256libraryloadermemoryCOMMON

Download Yara Rule

APIs

GlobalAlloc.KERNEL32(00000040,00000FA0), ref: 004063BF
lstrlenW.KERNEL32(?), ref: 004063CC
GetVersionExW.KERNEL32(?), ref: 0040642A

Part of subcall function 0040602B: CharUpperW.USER32(?,00406401,?), ref: 00406031

LoadLibraryA.KERNEL32(PSAPI.DLL), ref: 00406469
GetProcAddress.KERNEL32(00000000,EnumProcesses), ref: 00406488
GetProcAddress.KERNEL32(00000000,EnumProcessModules), ref: 00406492
GetProcAddress.KERNEL32(00000000,GetModuleBaseNameW), ref: 0040649D
FreeLibrary.KERNEL32(00000000), ref: 004064D4
GlobalFree.KERNEL32(?), ref: 004064DD

Strings

Module32FirstW, xrefs: 004065D3
CreateToolhelp32Snapshot, xrefs: 004065B5
Process32FirstW, xrefs: 004065BD
Kernel32.DLL, xrefs: 0040659B
Module32NextW, xrefs: 004065DE
Process32NextW, xrefs: 004065C8
GetModuleBaseNameW, xrefs: 00406494
EnumProcesses, xrefs: 00406482
Unknown, xrefs: 004064FC
EnumProcessModules, xrefs: 0040648A
PSAPI.DLL, xrefs: 00406464

Memory Dump Source

Source File: 00000000.00000002.1786996002.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1786976555.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1787017126.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1787037791.000000000040B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1787037791.000000000041F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1787037791.0000000000461000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1787037791.00000000004B3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1787138270.00000000004F4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1787138270.0000000000505000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_GOmRjFSKNz.jbxd

Similarity

API ID: AddressProc$FreeGlobalLibrary$AllocCharLoadUpperVersionlstrlen
String ID: CreateToolhelp32Snapshot$EnumProcessModules$EnumProcesses$GetModuleBaseNameW$Kernel32.DLL$Module32FirstW$Module32NextW$PSAPI.DLL$Process32FirstW$Process32NextW$Unknown
API String ID: 20674999-2124804629
Opcode ID: a5c47c37ebb79c3570a5199304d67498c128a01cd5ae19e8b8640fa4b13707a3
Instruction ID: f5db07f83b48746be4b9c4f5c588c21b75103c60b5638216cabcef37c42edb4d
Opcode Fuzzy Hash: a5c47c37ebb79c3570a5199304d67498c128a01cd5ae19e8b8640fa4b13707a3
Instruction Fuzzy Hash: 38919331900219EBDF109FA4CD88AAFBBB8EF44741F11447BE546F6281DB388A51CF68

Function 004040B8 Relevance: 40.5, APIs: 20, Strings: 3, Instructions: 210windowstringCOMMON

Download Yara Rule

APIs

CheckDlgButton.USER32(?,-0000040A,00000001), ref: 0040416D
GetDlgItem.USER32(?,000003E8), ref: 00404181
SendMessageW.USER32(00000000,0000045B,00000001,00000000), ref: 0040419E
GetSysColor.USER32(?), ref: 004041AF
SendMessageW.USER32(00000000,00000443,00000000,?), ref: 004041BD
SendMessageW.USER32(00000000,00000445,00000000,04010000), ref: 004041CB
lstrlenW.KERNEL32(?), ref: 004041D6
SendMessageW.USER32(00000000,00000435,00000000,00000000), ref: 004041E3
SendMessageW.USER32(00000000,00000449,00000110,00000110), ref: 004041F2

Part of subcall function 00403FCA: WideCharToMultiByte.KERNEL32(00000000,00000000,00000000,000000FF,00000000,00000000,00000000,00000000,?,?,00000000,00404124,?), ref: 00403FE1
Part of subcall function 00403FCA: GlobalAlloc.KERNEL32(00000040,00000001,?,?,?,00000000,00404124,?), ref: 00403FF0
Part of subcall function 00403FCA: WideCharToMultiByte.KERNEL32(00000000,00000000,00000000,000000FF,00000000,00000001,00000000,00000000,?,?,00000000,00404124,?), ref: 00404004

GetDlgItem.USER32(?,0000040A), ref: 0040424A
SendMessageW.USER32(00000000), ref: 00404251
GetDlgItem.USER32(?,000003E8), ref: 0040427E
SendMessageW.USER32(00000000,0000044B,00000000,?), ref: 004042C1
LoadCursorW.USER32(00000000,00007F02), ref: 004042CF
SetCursor.USER32(00000000), ref: 004042D2
ShellExecuteW.SHELL32(0000070B,open,00462540,00000000,00000000,00000001), ref: 004042E7
LoadCursorW.USER32(00000000,00007F00), ref: 004042F3
SetCursor.USER32(00000000), ref: 004042F6
SendMessageW.USER32(00000111,00000001,00000000), ref: 00404325
SendMessageW.USER32(00000010,00000000,00000000), ref: 00404337

Strings

@%F, xrefs: 004042A7
N, xrefs: 0040426C
open, xrefs: 004042DF

Memory Dump Source

Source File: 00000000.00000002.1786996002.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1786976555.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1787017126.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1787037791.000000000040B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1787037791.000000000041F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1787037791.0000000000461000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1787037791.00000000004B3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1787138270.00000000004F4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1787138270.0000000000505000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_GOmRjFSKNz.jbxd

Similarity

API ID: MessageSend$Cursor$Item$ByteCharLoadMultiWide$AllocButtonCheckColorExecuteGlobalShelllstrlen
String ID: @%F$N$open
API String ID: 3928313111-3849437375
Opcode ID: a841256503f372cb329faf737530af9fe18869c9bb3e71d47027397a25b41a99
Instruction ID: 2c1438ad93098d7b112eeb2502b55652a68651cb38e922ac8f4fb42b83a973d4
Opcode Fuzzy Hash: a841256503f372cb329faf737530af9fe18869c9bb3e71d47027397a25b41a99
Instruction Fuzzy Hash: 0F71A4B1900609FFDB109F60DD45EAA7B79FB44305F00843AFA05B62D1C778A991CF99

Function 00406A99 Relevance: 33.4, APIs: 15, Strings: 4, Instructions: 163filestringmemoryCOMMON

Download Yara Rule

APIs

lstrcpyW.KERNEL32(0045B2C8,NUL,?,00000000,?,00000000,?,00406C90,000000F1,000000F1,00000001,00406EAE,?,00000000,000000F1,?), ref: 00406AA9
CloseHandle.KERNEL32(00000000,000000F1,00000000,00000001,?,00000000,?,00406C90,000000F1,000000F1,00000001,00406EAE,?,00000000,000000F1,?), ref: 00406AC8
GetShortPathNameW.KERNEL32(000000F1,0045B2C8,00000400), ref: 00406AD1

Part of subcall function 00405DB6: lstrlenA.KERNEL32(00000000,?,00000000,00000000,?,00000000,00406BD3,00000000,[Rename]), ref: 00405DC6
Part of subcall function 00405DB6: lstrlenA.KERNEL32(?,?,00000000,00406BD3,00000000,[Rename]), ref: 00405DF8

GetShortPathNameW.KERNEL32(000000F1,00460920,00000400), ref: 00406AF2
WideCharToMultiByte.KERNEL32(00000000,00000000,0045B2C8,000000FF,0045BAC8,00000400,00000000,00000000,?,00000000,?,00406C90,000000F1,000000F1,00000001,00406EAE), ref: 00406B1B
WideCharToMultiByte.KERNEL32(00000000,00000000,00460920,000000FF,0045C118,00000400,00000000,00000000,?,00000000,?,00406C90,000000F1,000000F1,00000001,00406EAE), ref: 00406B33
wsprintfA.USER32 ref: 00406B4D
GetFileSize.KERNEL32(00000000,00000000,00460920,C0000000,00000004,00460920,?,?,00000000,000000F1,?), ref: 00406B85
GlobalAlloc.KERNEL32(00000040,0000000A), ref: 00406B94
ReadFile.KERNEL32(?,00000000,00000000,?,00000000), ref: 00406BB0
lstrcpyA.KERNEL32(00000000,[Rename],00000000,[Rename]), ref: 00406BE0
SetFilePointer.KERNEL32(?,00000000,00000000,00000000,?,0045C518,00000000,-0000000A,0040987C,00000000,[Rename]), ref: 00406C37

Part of subcall function 00405E50: GetFileAttributesW.KERNELBASE(00000003,004035C7,004DF0D8,80000000,00000003,?,?,?,00000000,00403A47,?), ref: 00405E54
Part of subcall function 00405E50: CreateFileW.KERNELBASE(?,?,00000001,00000000,?,00000001,00000000,?,?,?,00000000,00403A47,?), ref: 00405E76

WriteFile.KERNEL32(?,00000000,?,?,00000000), ref: 00406C4B
GlobalFree.KERNEL32(00000000), ref: 00406C52
CloseHandle.KERNEL32(?), ref: 00406C5C

Strings

F, xrefs: 00406AE8
%s=%s, xrefs: 00406B43
[Rename], xrefs: 00406BC8, 00406BD7
NUL, xrefs: 00406A9E

Memory Dump Source

Source File: 00000000.00000002.1786996002.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1786976555.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1787017126.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1787037791.000000000040B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1787037791.000000000041F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1787037791.0000000000461000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1787037791.00000000004B3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1787138270.00000000004F4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1787138270.0000000000505000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_GOmRjFSKNz.jbxd

Similarity

API ID: File$ByteCharCloseGlobalHandleMultiNamePathShortWidelstrcpylstrlen$AllocAttributesCreateFreePointerReadSizeWritewsprintf
String ID: F$%s=%s$NUL$[Rename]
API String ID: 565278875-1653569448
Opcode ID: a83451b5c4aab99109613fb463f01f18261c5de4d9c28115f8397278e7cafe6e
Instruction ID: f97e154d5ee7f709bd30e138c0dd6e282719408add8f0d739c14b832633f1bd9
Opcode Fuzzy Hash: a83451b5c4aab99109613fb463f01f18261c5de4d9c28115f8397278e7cafe6e
Instruction Fuzzy Hash: AE412632104208BFE6206B619E8CD6B3B6CDF86754B16043EF586F22D1DA3CDC158ABC

Function 00401000 Relevance: 26.4, APIs: 14, Strings: 1, Instructions: 127COMMON

Download Yara Rule

APIs

DefWindowProcW.USER32(?,00000046,?,?), ref: 0040102C
BeginPaint.USER32(?,?), ref: 00401047
GetClientRect.USER32(?,?), ref: 0040105B
CreateBrushIndirect.GDI32(00000000), ref: 004010D8
FillRect.USER32(00000000,?,00000000), ref: 004010ED
DeleteObject.GDI32(?), ref: 004010F6
CreateFontIndirectW.GDI32(?), ref: 0040110E
SetBkMode.GDI32(00000000,00000001), ref: 0040112F
SetTextColor.GDI32(00000000,000000FF), ref: 00401139
SelectObject.GDI32(00000000,?), ref: 00401149
DrawTextW.USER32(00000000,0046ADC0,000000FF,00000010,00000820), ref: 0040115F
SelectObject.GDI32(00000000,00000000), ref: 00401169
DeleteObject.GDI32(?), ref: 0040116E
EndPaint.USER32(?,?), ref: 00401177

Strings

F, xrefs: 0040100C

Memory Dump Source

Source File: 00000000.00000002.1786996002.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1786976555.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1787017126.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1787037791.000000000040B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1787037791.000000000041F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1787037791.0000000000461000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1787037791.00000000004B3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1787138270.00000000004F4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1787138270.0000000000505000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_GOmRjFSKNz.jbxd

Similarity

API ID: Object$CreateDeleteIndirectPaintRectSelectText$BeginBrushClientColorDrawFillFontModeProcWindow
String ID: F
API String ID: 941294808-1304234792
Opcode ID: f4369597f17a3e87964d78a18e042c43d151941ad2c2ecd61bd33e0f0092c561
Instruction ID: e7530e13063599d95e155ed3b2c7b7521dfa2668d538c4695d9c695e9582dc0d
Opcode Fuzzy Hash: f4369597f17a3e87964d78a18e042c43d151941ad2c2ecd61bd33e0f0092c561
Instruction Fuzzy Hash: 01516C71400209AFCB058F95DE459AF7FB9FF45311F00802EF992AA1A0CB78DA55DFA4

Function 00402880 Relevance: 17.6, APIs: 4, Strings: 6, Instructions: 131registrystringCOMMON

Download Yara Rule

APIs

RegCreateKeyExW.ADVAPI32(?,?,?,?,?,?,?,?,?,00000011,00000002), ref: 004028DA
lstrlenW.KERNEL32(004130D8,00000023,?,?,?,?,?,?,?,00000011,00000002), ref: 004028FD
RegSetValueExW.ADVAPI32(?,?,?,?,004130D8,?,?,?,?,?,?,?,?,00000011,00000002), ref: 004029BC
RegCloseKey.ADVAPI32(?), ref: 004029E4

Part of subcall function 004062A3: lstrlenW.KERNEL32(RMDir: RemoveDirectory invalid input(""),00406E79,RMDir: RemoveDirectory("%s"),?,?,?), ref: 004062B0
Part of subcall function 004062A3: wvsprintfW.USER32(00000000,?,?), ref: 004062C7

Strings

WriteRegDWORD: "%s\%s" "%s"="0x%08x", xrefs: 00402959
WriteRegStr: "%s\%s" "%s"="%s", xrefs: 00402918
WriteReg: error creating key "%s\%s", xrefs: 004029F5
WriteRegExpandStr: "%s\%s" "%s"="%s", xrefs: 0040292A
WriteReg: error writing into "%s\%s" "%s", xrefs: 004029D4
WriteRegBin: "%s\%s" "%s"="%s", xrefs: 004029A1

Memory Dump Source

Source File: 00000000.00000002.1786996002.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1786976555.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1787017126.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1787037791.000000000040B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1787037791.000000000041F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1787037791.0000000000461000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1787037791.00000000004B3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1787138270.00000000004F4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1787138270.0000000000505000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_GOmRjFSKNz.jbxd

Similarity

API ID: lstrlen$CloseCreateValuewvsprintf
String ID: WriteReg: error creating key "%s\%s"$WriteReg: error writing into "%s\%s" "%s"$WriteRegBin: "%s\%s" "%s"="%s"$WriteRegDWORD: "%s\%s" "%s"="0x%08x"$WriteRegExpandStr: "%s\%s" "%s"="%s"$WriteRegStr: "%s\%s" "%s"="%s"
API String ID: 1641139501-220328614
Opcode ID: 51d35262b0c2a2c9e21de093e360e43a16013741a0d7e0050a8341ec78c57d1d
Instruction ID: 4ea7a0066738be70411365ddd6f3e5606018e51d84950e7919a1ab5782edcef9
Opcode Fuzzy Hash: 51d35262b0c2a2c9e21de093e360e43a16013741a0d7e0050a8341ec78c57d1d
Instruction Fuzzy Hash: 3D41BFB2D00209BFDF11AF90CE46DAEBBB9EB04704F20407BF505B61A1D6B94B509B59

Function 00402E55 Relevance: 14.1, APIs: 7, Strings: 1, Instructions: 103memoryfileCOMMON

Download Yara Rule

APIs

GlobalAlloc.KERNEL32(00000040,?,00000000,40000000,00000002,00000000,00000000,?,?,?,?,000000F0), ref: 00402EA9
GlobalAlloc.KERNEL32(00000040,?,00000000,?,?,?,?,?,?,000000F0), ref: 00402EC5
GlobalFree.KERNEL32(FFFFFD66), ref: 00402EFE
WriteFile.KERNEL32(?,00000000,?,?,?,?,?,?,?,?,000000F0), ref: 00402F10
GlobalFree.KERNEL32(00000000), ref: 00402F17
CloseHandle.KERNEL32(?,?,?,?,?,000000F0), ref: 00402F2F
DeleteFileW.KERNEL32(?), ref: 00402F56

Strings

created uninstaller: %d, "%s", xrefs: 00402F3B

Memory Dump Source

Source File: 00000000.00000002.1786996002.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1786976555.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1787017126.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1787037791.000000000040B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1787037791.000000000041F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1787037791.0000000000461000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1787037791.00000000004B3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1787138270.00000000004F4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1787138270.0000000000505000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_GOmRjFSKNz.jbxd

Similarity

API ID: Global$AllocFileFree$CloseDeleteHandleWrite
String ID: created uninstaller: %d, "%s"
API String ID: 3294113728-3145124454
Opcode ID: 7d19fd18931236c609f14dd9ebe02190de13aa3954742adab313f132dac73535
Instruction ID: 876417c632a2c352b67fb01c84f3ccb8dada3a759dccfb7ac575e016526b3130
Opcode Fuzzy Hash: 7d19fd18931236c609f14dd9ebe02190de13aa3954742adab313f132dac73535
Instruction Fuzzy Hash: E231B272800115BBCB11AFA4CE45DAF7FB9EF08364F10023AF555B61E1CB794E419B98

Function 004060E7 Relevance: 14.1, APIs: 7, Strings: 1, Instructions: 72filestringCOMMON

Download Yara Rule

APIs

CloseHandle.KERNEL32(FFFFFFFF,00000000,?,?,004062D4,00000000), ref: 004060FE
GetFileAttributesW.KERNEL32(0046A560,?,00000000,00000000,?,?,004062D4,00000000), ref: 0040613C
WriteFile.KERNEL32(00000000,000000FF,00000002,00000000,00000000,0046A560,40000000,00000004), ref: 00406175
SetFilePointer.KERNEL32(00000000,00000000,00000000,00000002,0046A560,40000000,00000004), ref: 00406181
lstrcatW.KERNEL32(RMDir: RemoveDirectory invalid input(""),00409678,?,00000000,00000000,?,?,004062D4,00000000), ref: 0040619B
lstrlenW.KERNEL32(RMDir: RemoveDirectory invalid input(""),?,?,004062D4,00000000), ref: 004061A2
WriteFile.KERNEL32(RMDir: RemoveDirectory invalid input(""),00000000,004062D4,00000000,?,?,004062D4,00000000), ref: 004061B7

Strings

RMDir: RemoveDirectory invalid input(""), xrefs: 00406195, 0040619A, 004061A1, 004061B0

Memory Dump Source

Source File: 00000000.00000002.1786996002.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1786976555.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1787017126.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1787037791.000000000040B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1787037791.000000000041F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1787037791.0000000000461000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1787037791.00000000004B3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1787138270.00000000004F4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1787138270.0000000000505000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_GOmRjFSKNz.jbxd

Similarity

API ID: File$Write$AttributesCloseHandlePointerlstrcatlstrlen
String ID: RMDir: RemoveDirectory invalid input("")
API String ID: 3734993849-2769509956
Opcode ID: db2296b131d449b30ff8990abd275774a0521ce3dbf342b3e8cfb01d18cadc82
Instruction ID: 719ae6cd10854ac59b0cdc08190af65770ef99398ad526dd54b0ef62760a23c4
Opcode Fuzzy Hash: db2296b131d449b30ff8990abd275774a0521ce3dbf342b3e8cfb01d18cadc82
Instruction Fuzzy Hash: 4621F271400200BBD710AB64DD88D9B376CEB02370B25C73AF626BA1E1E77449868BAD

Function 00403DCA Relevance: 12.1, APIs: 8, Instructions: 60COMMON

Download Yara Rule

APIs

GetWindowLongW.USER32(?,000000EB), ref: 00403DE4
GetSysColor.USER32(00000000), ref: 00403E00
SetTextColor.GDI32(?,00000000), ref: 00403E0C
SetBkMode.GDI32(?,?), ref: 00403E18
GetSysColor.USER32(?), ref: 00403E2B
SetBkColor.GDI32(?,?), ref: 00403E3B
DeleteObject.GDI32(?), ref: 00403E55
CreateBrushIndirect.GDI32(?), ref: 00403E5F

Memory Dump Source

Source File: 00000000.00000002.1786996002.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1786976555.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1787017126.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1787037791.000000000040B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1787037791.000000000041F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1787037791.0000000000461000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1787037791.00000000004B3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1787138270.00000000004F4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1787138270.0000000000505000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_GOmRjFSKNz.jbxd

Similarity

API ID: Color$BrushCreateDeleteIndirectLongModeObjectTextWindow
String ID:
API String ID: 2320649405-0
Opcode ID: ac93da855729cb6ae330e7292f06b4dcfb528e6a29ab184958864ff4432b54b5
Instruction ID: efe235911933e34786796033030fc6f48e67331b78f43f6f4bde0ddab4ebbdd0
Opcode Fuzzy Hash: ac93da855729cb6ae330e7292f06b4dcfb528e6a29ab184958864ff4432b54b5
Instruction Fuzzy Hash: 7D1166715007046BCB219F78DE08B5BBFF8AF01755F048A2DE886F22A0D774DA48CB94

Function 004023F0 Relevance: 10.6, APIs: 3, Strings: 3, Instructions: 83libraryCOMMON

Download Yara Rule

APIs

GetModuleHandleW.KERNEL32(00000000,00000001,000000F0), ref: 0040241C

Part of subcall function 00404F72: lstrlenW.KERNEL32(0043B228,?,00000000,00000000), ref: 00404FAA
Part of subcall function 00404F72: lstrlenW.KERNEL32(004034BB,0043B228,?,00000000,00000000), ref: 00404FBA
Part of subcall function 00404F72: lstrcatW.KERNEL32(0043B228,004034BB,004034BB,0043B228,?,00000000,00000000), ref: 00404FCD
Part of subcall function 00404F72: SetWindowTextW.USER32(0043B228,0043B228), ref: 00404FDF
Part of subcall function 00404F72: SendMessageW.USER32(?,00001004,00000000,00000000), ref: 00405005
Part of subcall function 00404F72: SendMessageW.USER32(?,0000104D,00000000,00000001), ref: 0040501F
Part of subcall function 00404F72: SendMessageW.USER32(?,00001013,?,00000000), ref: 0040502D

Part of subcall function 004062A3: lstrlenW.KERNEL32(RMDir: RemoveDirectory invalid input(""),00406E79,RMDir: RemoveDirectory("%s"),?,?,?), ref: 004062B0
Part of subcall function 004062A3: wvsprintfW.USER32(00000000,?,?), ref: 004062C7

LoadLibraryExW.KERNEL32(00000000,?,00000008,00000001,000000F0), ref: 0040242D
FreeLibrary.KERNEL32(?,?), ref: 004024C3

Strings

Error registering DLL: Could not load %s, xrefs: 004024DB
Error registering DLL: Could not initialize OLE, xrefs: 004024F1
Error registering DLL: %s not found in %s, xrefs: 0040249A

Memory Dump Source

Source File: 00000000.00000002.1786996002.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1786976555.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1787017126.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1787037791.000000000040B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1787037791.000000000041F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1787037791.0000000000461000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1787037791.00000000004B3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1787138270.00000000004F4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1787138270.0000000000505000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_GOmRjFSKNz.jbxd

Similarity

API ID: MessageSendlstrlen$Library$FreeHandleLoadModuleTextWindowlstrcatwvsprintf
String ID: Error registering DLL: %s not found in %s$Error registering DLL: Could not initialize OLE$Error registering DLL: Could not load %s
API String ID: 1033533793-945480824
Opcode ID: dad84e194389b7cbeb1d3ab4357ce8e64ef755489eaa46c5795f6130922e59d8
Instruction ID: e967fad4df15afb35ea17a6f8951328f27fda4bee3b51f855042d01f5ead75df
Opcode Fuzzy Hash: dad84e194389b7cbeb1d3ab4357ce8e64ef755489eaa46c5795f6130922e59d8
Instruction Fuzzy Hash: 34219131904208BBCF206FA1CE45E9E7A74AF40314F30817FF511B61E1D7BD4A819A5D

Function 00402238 Relevance: 10.6, APIs: 3, Strings: 3, Instructions: 59synchronizationCOMMON

Download Yara Rule

APIs

Part of subcall function 004062A3: lstrlenW.KERNEL32(RMDir: RemoveDirectory invalid input(""),00406E79,RMDir: RemoveDirectory("%s"),?,?,?), ref: 004062B0
Part of subcall function 004062A3: wvsprintfW.USER32(00000000,?,?), ref: 004062C7

Part of subcall function 00404F72: lstrlenW.KERNEL32(0043B228,?,00000000,00000000), ref: 00404FAA
Part of subcall function 00404F72: lstrlenW.KERNEL32(004034BB,0043B228,?,00000000,00000000), ref: 00404FBA
Part of subcall function 00404F72: lstrcatW.KERNEL32(0043B228,004034BB,004034BB,0043B228,?,00000000,00000000), ref: 00404FCD
Part of subcall function 00404F72: SetWindowTextW.USER32(0043B228,0043B228), ref: 00404FDF
Part of subcall function 00404F72: SendMessageW.USER32(?,00001004,00000000,00000000), ref: 00405005
Part of subcall function 00404F72: SendMessageW.USER32(?,0000104D,00000000,00000001), ref: 0040501F
Part of subcall function 00404F72: SendMessageW.USER32(?,00001013,?,00000000), ref: 0040502D

Part of subcall function 00405C3F: CreateProcessW.KERNEL32(00000000,?,00000000,00000000,00000000,00000000,00000000,00000000,00457278,Error launching installer), ref: 00405C64
Part of subcall function 00405C3F: CloseHandle.KERNEL32(?), ref: 00405C71

WaitForSingleObject.KERNEL32(?,00000064,00000000,000000EB,00000000), ref: 00402288
GetExitCodeProcess.KERNEL32(?,?), ref: 00402298
CloseHandle.KERNEL32(?,00000000,000000EB,00000000), ref: 00402AF2

Strings

Exec: success ("%s"), xrefs: 00402263
Exec: command="%s", xrefs: 00402241
Exec: failed createprocess ("%s"), xrefs: 004022C2

Memory Dump Source

Source File: 00000000.00000002.1786996002.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1786976555.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1787017126.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1787037791.000000000040B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1787037791.000000000041F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1787037791.0000000000461000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1787037791.00000000004B3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1787138270.00000000004F4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1787138270.0000000000505000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_GOmRjFSKNz.jbxd

Similarity

API ID: MessageSendlstrlen$CloseHandleProcess$CodeCreateExitObjectSingleTextWaitWindowlstrcatwvsprintf
String ID: Exec: command="%s"$Exec: failed createprocess ("%s")$Exec: success ("%s")
API String ID: 2014279497-3433828417
Opcode ID: 6d54c557fbd6fdf8dc19518642d08f2325eb4e2a9a3136ddaf8bbf3ddc9e5317
Instruction ID: 1f9fd54ce4b92d80b15c686f19ace2d36b15c716f321f29b17dee5dd027f7fd2
Opcode Fuzzy Hash: 6d54c557fbd6fdf8dc19518642d08f2325eb4e2a9a3136ddaf8bbf3ddc9e5317
Instruction Fuzzy Hash: 3E11C632904115EBDB11BBE0DE46AAE3A61EF00314B24807FF501B50D1CBBC4D41D79D

Function 0040484E Relevance: 10.5, APIs: 5, Strings: 1, Instructions: 48windowCOMMON

Download Yara Rule

APIs

SendMessageW.USER32(?,0000110A,00000009,00000000), ref: 00404869
GetMessagePos.USER32 ref: 00404871
ScreenToClient.USER32(?,?), ref: 00404889
SendMessageW.USER32(?,00001111,00000000,?), ref: 0040489B
SendMessageW.USER32(?,0000113E,00000000,?), ref: 004048C1

Strings

f, xrefs: 0040489D

Memory Dump Source

Source File: 00000000.00000002.1786996002.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1786976555.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1787017126.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1787037791.000000000040B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1787037791.000000000041F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1787037791.0000000000461000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1787037791.00000000004B3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1787138270.00000000004F4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1787138270.0000000000505000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_GOmRjFSKNz.jbxd

Similarity

API ID: Message$Send$ClientScreen
String ID: f
API String ID: 41195575-1993550816
Opcode ID: e83bf87fd3d3de8100a00259917b631f02ad10d2ae0db71d55c08ccb040208c3
Instruction ID: 7db1728360bf3821ce9645a1193633f180912fe022e8629b13ab7a69f18166cd
Opcode Fuzzy Hash: e83bf87fd3d3de8100a00259917b631f02ad10d2ae0db71d55c08ccb040208c3
Instruction Fuzzy Hash: C5015E7290021CBAEB00DBA4DD85BEEBBB8AF54710F10452ABB50B61D0D7B85A058BA5

Function 0040324C Relevance: 10.5, APIs: 5, Strings: 1, Instructions: 40timeCOMMON

Download Yara Rule

APIs

SetTimer.USER32(?,00000001,000000FA,00000000), ref: 0040326A
MulDiv.KERNEL32(00023400,00000064,?), ref: 00403295
wsprintfW.USER32 ref: 004032A5
SetWindowTextW.USER32(?,?), ref: 004032B5
SetDlgItemTextW.USER32(?,00000406,?), ref: 004032C7

Strings

verifying installer: %d%%, xrefs: 0040329F

Memory Dump Source

Source File: 00000000.00000002.1786996002.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1786976555.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1787017126.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1787037791.000000000040B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1787037791.000000000041F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1787037791.0000000000461000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1787037791.00000000004B3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1787138270.00000000004F4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1787138270.0000000000505000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_GOmRjFSKNz.jbxd

Similarity

API ID: Text$ItemTimerWindowwsprintf
String ID: verifying installer: %d%%
API String ID: 1451636040-82062127
Opcode ID: 2242266ec469d88fb33e3e049bed9c2e1137abfcadbc35e47a6ba444652a7516
Instruction ID: 2210906da4c477318a924a5c8cf459ae641b3a2c10b729e3aa38b42dd2c8d99c
Opcode Fuzzy Hash: 2242266ec469d88fb33e3e049bed9c2e1137abfcadbc35e47a6ba444652a7516
Instruction Fuzzy Hash: 98014470610109ABEF109F60DD49FAA3B69FB00349F00803DFA46B51E0DB7996558B58

Function 004043AD Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 73stringCOMMON

Download Yara Rule

APIs

lstrlenW.KERNEL32(00447240,%u.%u%s%s,?,00000000,00000000,?,FFFFFFDC,00000000,?,000000DF,00447240,?), ref: 0040444A
wsprintfW.USER32 ref: 00404457
SetDlgItemTextW.USER32(?,00447240,000000DF), ref: 0040446A

Strings

%u.%u%s%s, xrefs: 00404444
@rD, xrefs: 00404402

Memory Dump Source

Source File: 00000000.00000002.1786996002.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1786976555.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1787017126.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1787037791.000000000040B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1787037791.000000000041F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1787037791.0000000000461000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1787037791.00000000004B3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1787138270.00000000004F4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1787138270.0000000000505000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_GOmRjFSKNz.jbxd

Similarity

API ID: ItemTextlstrlenwsprintf
String ID: %u.%u%s%s$@rD
API String ID: 3540041739-1813061909
Opcode ID: 49e77ae85f825c85ec9bd325533554715bd64ccbe848738256e3a305efe714d4
Instruction ID: f1896056faf18a44ee7e341cc3389f256aee6b01e91544d35c55ed1e8b934206
Opcode Fuzzy Hash: 49e77ae85f825c85ec9bd325533554715bd64ccbe848738256e3a305efe714d4
Instruction Fuzzy Hash: EF11BD327002087BDB10AA6A9D45E9E765EEBC5334F10423BFA15F30E1F6788A218679

Function 00406038 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 71COMMON

Download Yara Rule

APIs

CharNextW.USER32(?,*?|<>/":,00000000,004D70C8,004C30A0,004D70C8,00000000,004037D8,004D70C8,-00000002,00403A0B), ref: 0040609B
CharNextW.USER32(?,?,?,00000000), ref: 004060AA
CharNextW.USER32(?,004D70C8,004C30A0,004D70C8,00000000,004037D8,004D70C8,-00000002,00403A0B), ref: 004060AF
CharPrevW.USER32(?,?,004C30A0,004D70C8,00000000,004037D8,004D70C8,-00000002,00403A0B), ref: 004060C3

Strings

*?|<>/":, xrefs: 0040608A

Memory Dump Source

Source File: 00000000.00000002.1786996002.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1786976555.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1787017126.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1787037791.000000000040B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1787037791.000000000041F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1787037791.0000000000461000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1787037791.00000000004B3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1787138270.00000000004F4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1787138270.0000000000505000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_GOmRjFSKNz.jbxd

Similarity

API ID: Char$Next$Prev
String ID: *?|<>/":
API String ID: 589700163-165019052
Opcode ID: a05e433a329b084189efa29dbf9bba5ae0ab8f0c6b5464517f8198c591f21e0d
Instruction ID: 6b5d27536512bbf775d32d1a11483b1b035cd55ac1fbc93341df7bc26af2800c
Opcode Fuzzy Hash: a05e433a329b084189efa29dbf9bba5ae0ab8f0c6b5464517f8198c591f21e0d
Instruction Fuzzy Hash: C611EB2184061559CB30FB659C4097BA6F9AE56750712843FE886F32C1FB7CCCE192BD

Function 0040149D Relevance: 7.6, APIs: 5, Instructions: 67registryCOMMON

Download Yara Rule

APIs

RegOpenKeyExW.ADVAPI32(?,?,00000000,?,?), ref: 004014BF
RegEnumKeyW.ADVAPI32(?,00000000,?,00000105), ref: 004014FB
RegCloseKey.ADVAPI32(?), ref: 00401504
RegCloseKey.ADVAPI32(?), ref: 00401529
RegDeleteKeyW.ADVAPI32(?,?), ref: 00401547

Memory Dump Source

Source File: 00000000.00000002.1786996002.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1786976555.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1787017126.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1787037791.000000000040B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1787037791.000000000041F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1787037791.0000000000461000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1787037791.00000000004B3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1787138270.00000000004F4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1787138270.0000000000505000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_GOmRjFSKNz.jbxd

Similarity

API ID: Close$DeleteEnumOpen
String ID:
API String ID: 1912718029-0
Opcode ID: 2b80b69c85b54ac5f33439f299733a34c1a7b021a45597119d957f721ab6f898
Instruction ID: 29266b44d1cae769f6d8fca298176d7cc4518162af5fbc8546bcefd12e7d5eb7
Opcode Fuzzy Hash: 2b80b69c85b54ac5f33439f299733a34c1a7b021a45597119d957f721ab6f898
Instruction Fuzzy Hash: EF114972500008FFDF119F90EE85DAA3B7AFB54348F00407AFA06F6170D7759E54AA29

Function 0040209F Relevance: 7.5, APIs: 5, Instructions: 39windowCOMMON

Download Yara Rule

APIs

GetDlgItem.USER32(?), ref: 004020A3
GetClientRect.USER32(00000000,?), ref: 004020B0
LoadImageW.USER32(?,00000000,?,?,?,?), ref: 004020D1
SendMessageW.USER32(00000000,00000172,?,00000000), ref: 004020DF
DeleteObject.GDI32(00000000), ref: 004020EE

Memory Dump Source

Source File: 00000000.00000002.1786996002.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1786976555.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1787017126.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1787037791.000000000040B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1787037791.000000000041F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1787037791.0000000000461000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1787037791.00000000004B3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1787138270.00000000004F4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1787138270.0000000000505000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_GOmRjFSKNz.jbxd

Similarity

API ID: ClientDeleteImageItemLoadMessageObjectRectSend
String ID:
API String ID: 1849352358-0
Opcode ID: 1f7c9829ad23568ddcd68d747fd9c97de9c434eb898eff28d5e97dd8542ad38d
Instruction ID: a6d8e4af78efbdafb2d3f18e6b80530ac635d705efb76da9f8ac6e555915fa7b
Opcode Fuzzy Hash: 1f7c9829ad23568ddcd68d747fd9c97de9c434eb898eff28d5e97dd8542ad38d
Instruction Fuzzy Hash: 95F012B2600508AFDB00EBA4EF89DAF7BBCEB04305B104579F642F6161C6759E418B28

Function 00401F80 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 84windowtimeCOMMON

Download Yara Rule

APIs

SendMessageTimeoutW.USER32(00000000,00000000,?,?,?,00000002,?), ref: 00401FE6
SendMessageW.USER32(00000000,00000000,?,?), ref: 00401FFE

Strings

!, xrefs: 00401FB6

Memory Dump Source

Source File: 00000000.00000002.1786996002.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1786976555.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1787017126.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1787037791.000000000040B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1787037791.000000000041F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1787037791.0000000000461000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1787037791.00000000004B3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1787138270.00000000004F4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1787138270.0000000000505000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_GOmRjFSKNz.jbxd

Similarity

API ID: MessageSend$Timeout
String ID: !
API String ID: 1777923405-2657877971
Opcode ID: 268bfc816d722a3cdb4a25197971aab361e313674f42ba9e2dfc46ce407b5277
Instruction ID: e43e738488dd09895ebc4b193b1bc1394e214230f2e5861cb954e074e697f1bf
Opcode Fuzzy Hash: 268bfc816d722a3cdb4a25197971aab361e313674f42ba9e2dfc46ce407b5277
Instruction Fuzzy Hash: 93217171900209ABDF15AFB4D986ABE7BB9EF04349F14413EF602F60E2D6798A40D758

Function 004027E3 Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 60registryCOMMON

Download Yara Rule

APIs

Part of subcall function 00401553: RegOpenKeyExW.ADVAPI32(?,00000000,00000022,00000000,?,?), ref: 0040158B

RegCloseKey.ADVAPI32(00000000), ref: 0040282E
RegDeleteValueW.ADVAPI32(00000000,00000000,00000033), ref: 0040280E

Part of subcall function 004062A3: lstrlenW.KERNEL32(RMDir: RemoveDirectory invalid input(""),00406E79,RMDir: RemoveDirectory("%s"),?,?,?), ref: 004062B0
Part of subcall function 004062A3: wvsprintfW.USER32(00000000,?,?), ref: 004062C7

Strings

DeleteRegValue: "%s\%s" "%s", xrefs: 00402820
DeleteRegKey: "%s\%s", xrefs: 00402843

Memory Dump Source

Source File: 00000000.00000002.1786996002.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1786976555.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1787017126.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1787037791.000000000040B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1787037791.000000000041F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1787037791.0000000000461000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1787037791.00000000004B3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1787138270.00000000004F4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1787138270.0000000000505000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_GOmRjFSKNz.jbxd

Similarity

API ID: CloseDeleteOpenValuelstrlenwvsprintf
String ID: DeleteRegKey: "%s\%s"$DeleteRegValue: "%s\%s" "%s"
API String ID: 1697273262-1764544995
Opcode ID: 17145ca8eb8223996ba0bf6dcd82413fea569a735e29ac8632e0b2d115fecab3
Instruction ID: a9eecf508c221bc7802a822649300ece756bcc80235207ffe39efc99e8d71eac
Opcode Fuzzy Hash: 17145ca8eb8223996ba0bf6dcd82413fea569a735e29ac8632e0b2d115fecab3
Instruction Fuzzy Hash: FA11A772E00101ABDB10FFA5DD4AABE7AA4EF40354F14443FF50AB61D2D6BD8A50879D

Function 004048CC Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 58windowCOMMON

Download Yara Rule

APIs

IsWindowVisible.USER32(?), ref: 00404902
CallWindowProcW.USER32(?,00000200,?,?), ref: 00404970

Part of subcall function 00403DAF: SendMessageW.USER32(?,?,00000000,00000000), ref: 00403DC1

Strings

@rD, xrefs: 00404934
, xrefs: 004048DA

Memory Dump Source

Source File: 00000000.00000002.1786996002.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1786976555.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1787017126.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1787037791.000000000040B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1787037791.000000000041F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1787037791.0000000000461000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1787037791.00000000004B3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1787138270.00000000004F4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1787138270.0000000000505000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_GOmRjFSKNz.jbxd

Similarity

API ID: Window$CallMessageProcSendVisible
String ID: $@rD
API String ID: 3748168415-881980237
Opcode ID: dbb9f75acddd66739c757162f424edfdbc4896bcfe3732b5d05f7797001715e0
Instruction ID: bed307b1c5f775dd60c200178c13c7fdb07d6bd57f5d25ab133f42f3a31df96a
Opcode Fuzzy Hash: dbb9f75acddd66739c757162f424edfdbc4896bcfe3732b5d05f7797001715e0
Instruction Fuzzy Hash: 7A114FB1500218ABEF21AF61ED41E9B3769AB84359F00803BF714751A2C77C8D519BAD

Function 00402665 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 56stringCOMMON

Download Yara Rule

APIs

Part of subcall function 004062A3: lstrlenW.KERNEL32(RMDir: RemoveDirectory invalid input(""),00406E79,RMDir: RemoveDirectory("%s"),?,?,?), ref: 004062B0
Part of subcall function 004062A3: wvsprintfW.USER32(00000000,?,?), ref: 004062C7

Part of subcall function 004062D5: FindFirstFileW.KERNELBASE(004572C0,0045BEC8,004572C0,004067CE,004572C0), ref: 004062E0
Part of subcall function 004062D5: FindClose.KERNEL32(00000000), ref: 004062EC

lstrlenW.KERNEL32 ref: 004026B4
lstrlenW.KERNEL32(00000000), ref: 004026C1
SHFileOperationW.SHELL32(?,?,?,00000000), ref: 004026EC

Strings

CopyFiles "%s"->"%s", xrefs: 0040267F

Memory Dump Source

Source File: 00000000.00000002.1786996002.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1786976555.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1787017126.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1787037791.000000000040B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1787037791.000000000041F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1787037791.0000000000461000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1787037791.00000000004B3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1787138270.00000000004F4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1787138270.0000000000505000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_GOmRjFSKNz.jbxd

Similarity

API ID: lstrlen$FileFind$CloseFirstOperationwvsprintf
String ID: CopyFiles "%s"->"%s"
API String ID: 2577523808-3778932970
Opcode ID: d138b8f9e5546ee40c5c7b94d2e402c7a6ef9e03f94093a7ede85926a053d7b8
Instruction ID: a779005ae7d6007116ac0765ed120a10e3eb966af121a96df1e98a57451096ba
Opcode Fuzzy Hash: d138b8f9e5546ee40c5c7b94d2e402c7a6ef9e03f94093a7ede85926a053d7b8
Instruction Fuzzy Hash: A0112171D00214A6CB10FFBA994699FBBBCEF44354F10843FB506F72D2E6B985118B59

Function 00406224 Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 53stringCOMMON

Download Yara Rule

APIs

wsprintfW.USER32 ref: 00406278
lstrcatW.KERNEL32(00000000,...), ref: 0040629B

Strings

%02x%c, xrefs: 00406270
..., xrefs: 00406293

Memory Dump Source

Source File: 00000000.00000002.1786996002.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1786976555.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1787017126.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1787037791.000000000040B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1787037791.000000000041F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1787037791.0000000000461000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1787037791.00000000004B3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1787138270.00000000004F4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1787138270.0000000000505000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_GOmRjFSKNz.jbxd

Similarity

API ID: lstrcatwsprintf
String ID: %02x%c$...
API String ID: 3065427908-1057055748
Opcode ID: ab6e3f364f28889fa0e557be1434f2389f45bfc0df6a8c97b916548b2a1c6c1a
Instruction ID: b8620b589ecf2e5093343df65250d9ec4fb1615d5218d90249241d8ea01b8719
Opcode Fuzzy Hash: ab6e3f364f28889fa0e557be1434f2389f45bfc0df6a8c97b916548b2a1c6c1a
Instruction Fuzzy Hash: A2014932500214EFCB10EF58CC84A9EBBE9EB84304F20407AF405F3180D6759EA48794

Function 00405047 Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 41comCOMMON

Download Yara Rule

APIs

OleInitialize.OLE32(00000000), ref: 00405057

Part of subcall function 00403DAF: SendMessageW.USER32(?,?,00000000,00000000), ref: 00403DC1

OleUninitialize.OLE32(00000404,00000000), ref: 004050A5

Part of subcall function 004062A3: lstrlenW.KERNEL32(RMDir: RemoveDirectory invalid input(""),00406E79,RMDir: RemoveDirectory("%s"),?,?,?), ref: 004062B0
Part of subcall function 004062A3: wvsprintfW.USER32(00000000,?,?), ref: 004062C7

Strings

Skipping section: "%s", xrefs: 004050B5
Section: "%s", xrefs: 00405079

Memory Dump Source

Source File: 00000000.00000002.1786996002.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1786976555.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1787017126.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1787037791.000000000040B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1787037791.000000000041F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1787037791.0000000000461000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1787037791.00000000004B3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1787138270.00000000004F4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1787138270.0000000000505000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_GOmRjFSKNz.jbxd

Similarity

API ID: InitializeMessageSendUninitializelstrlenwvsprintf
String ID: Section: "%s"$Skipping section: "%s"
API String ID: 2266616436-4211696005
Opcode ID: e437b8ceb6229a6f9ab503619c9af8890d1bc97808a7dc02d8be9cd793390a3b
Instruction ID: 490ae00110c0e09774d0d246d4d4a011172e9101669e5a2b786a62fce758e9f8
Opcode Fuzzy Hash: e437b8ceb6229a6f9ab503619c9af8890d1bc97808a7dc02d8be9cd793390a3b
Instruction Fuzzy Hash: 41F0F4338087009BE6506B64AE07B9B77A4DFD4320F24007FFE48721E1ABFC48818A9D

Function 004020F9 Relevance: 6.0, APIs: 4, Instructions: 45COMMON

Download Yara Rule

APIs

GetDC.USER32(?), ref: 00402100
GetDeviceCaps.GDI32(00000000), ref: 00402107
MulDiv.KERNEL32(00000000,00000000), ref: 00402117

Part of subcall function 00406805: GetVersion.KERNEL32(0043B228,?,00000000,00404FA9,0043B228,00000000,?,00000000,00000000), ref: 004068D6

CreateFontIndirectW.GDI32(0041F0F0), ref: 0040216A

Part of subcall function 00405F51: wsprintfW.USER32 ref: 00405F5E

Memory Dump Source

Source File: 00000000.00000002.1786996002.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1786976555.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1787017126.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1787037791.000000000040B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1787037791.000000000041F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1787037791.0000000000461000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1787037791.00000000004B3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1787138270.00000000004F4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1787138270.0000000000505000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_GOmRjFSKNz.jbxd

Similarity

API ID: CapsCreateDeviceFontIndirectVersionwsprintf
String ID:
API String ID: 1599320355-0
Opcode ID: 6f0d7b084d37585979e4dd0fd2aac30abed8a2b5fd168dddd791f163065a0eb0
Instruction ID: 656afd6720eca978824560f17fb47cc17b19fb3a621816cfe3730d6e1c8eda21
Opcode Fuzzy Hash: 6f0d7b084d37585979e4dd0fd2aac30abed8a2b5fd168dddd791f163065a0eb0
Instruction Fuzzy Hash: DA017172644650EFE701ABB4ED4ABDA3BA4A725315F10C43AE645A61E3C678440A8B2D

Function 004071F8 Relevance: 6.0, APIs: 3, Strings: 1, Instructions: 43stringCOMMON

Download Yara Rule

APIs

Part of subcall function 00406ED2: CreateFileW.KERNEL32(?,80000000,00000001,00000000,00000003,00000080,00000000), ref: 00406EF6

lstrcpynW.KERNEL32(?,?,00000009), ref: 00407239
lstrcmpW.KERNEL32(?,Version ), ref: 0040724A
lstrcpynW.KERNEL32(?,?,?), ref: 00407261

Strings

Version , xrefs: 00407241

Memory Dump Source

Source File: 00000000.00000002.1786996002.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1786976555.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1787017126.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1787037791.000000000040B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1787037791.000000000041F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1787037791.0000000000461000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1787037791.00000000004B3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1787138270.00000000004F4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1787138270.0000000000505000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_GOmRjFSKNz.jbxd

Similarity

API ID: lstrcpyn$CreateFilelstrcmp
String ID: Version
API String ID: 512980652-315105994
Opcode ID: 4a1870cd75b7b8bbcc0c4c6a066d827f0aa8b2b5b5f43a101b4d9a41e631e9ca
Instruction ID: 151640cc4cfa07bb85738859349229c9473c158da19ee21f10eacb3052f8d035
Opcode Fuzzy Hash: 4a1870cd75b7b8bbcc0c4c6a066d827f0aa8b2b5b5f43a101b4d9a41e631e9ca
Instruction Fuzzy Hash: 3EF03172A0021CABDB109AA5DD46EEA777CAB44700F100476F600F6191E6B59E158BA5

Function 004032D2 Relevance: 6.0, APIs: 4, Instructions: 33COMMON

Download Yara Rule

APIs

DestroyWindow.USER32(00000000,00000000,00403703,00000001,?,?,?,00000000,00403A47,?), ref: 004032E5
GetTickCount.KERNEL32 ref: 00403303
CreateDialogParamW.USER32(0000006F,00000000,0040324C,00000000), ref: 00403320
ShowWindow.USER32(00000000,00000005,?,?,?,00000000,00403A47,?), ref: 0040332E

Memory Dump Source

Source File: 00000000.00000002.1786996002.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1786976555.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1787017126.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1787037791.000000000040B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1787037791.000000000041F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1787037791.0000000000461000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1787037791.00000000004B3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1787138270.00000000004F4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1787138270.0000000000505000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_GOmRjFSKNz.jbxd

Similarity

API ID: Window$CountCreateDestroyDialogParamShowTick
String ID:
API String ID: 2102729457-0
Opcode ID: 47d4170aef7bfd746f2c3ad407b5e1a24093745f4c41283d4ce41cd21e437078
Instruction ID: 401e6cecbc7a0b9e3d471fb50fe358663bd3ad25f9a7ebc527197863dd5a4904
Opcode Fuzzy Hash: 47d4170aef7bfd746f2c3ad407b5e1a24093745f4c41283d4ce41cd21e437078
Instruction Fuzzy Hash: 23F08230502620EBC221AF64FE5CBAB7F68FB04B82701447EF545F12A4CB7849928BDC

Function 00406365 Relevance: 6.0, APIs: 4, Instructions: 31memorylibraryloaderCOMMON

Download Yara Rule

APIs

GlobalAlloc.KERNEL32(00000040,00002004,00000000,?,?,00402449,?,?,?,00000008,00000001,000000F0), ref: 00406370
WideCharToMultiByte.KERNEL32(00000000,00000000,?,000000FF,00000000,00002004,00000000,00000000,?,?,00402449,?,?,?,00000008,00000001), ref: 00406386
GetProcAddress.KERNEL32(?,00000000), ref: 00406395
GlobalFree.KERNEL32(00000000), ref: 0040639E

Memory Dump Source

Source File: 00000000.00000002.1786996002.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1786976555.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1787017126.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1787037791.000000000040B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1787037791.000000000041F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1787037791.0000000000461000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1787037791.00000000004B3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1787138270.00000000004F4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1787138270.0000000000505000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_GOmRjFSKNz.jbxd

Similarity

API ID: Global$AddressAllocByteCharFreeMultiProcWide
String ID:
API String ID: 2883127279-0
Opcode ID: 9b9152501c533f071dd2545c5f3fa28dbd06be6ef0eddba5fde26ce4b08cefa4
Instruction ID: 581917a1a4a7218ca9fbbc4554f9bfb31441e22884f00dccc1ee77d568dea7f2
Opcode Fuzzy Hash: 9b9152501c533f071dd2545c5f3fa28dbd06be6ef0eddba5fde26ce4b08cefa4
Instruction Fuzzy Hash: 19E048712012107BE2101B669E8CD677EADDFCA7B6B05013EF695F51A0CE348C15D675

Function 00402797 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 25stringCOMMON

Download Yara Rule

APIs

GetPrivateProfileStringW.KERNEL32(00000000,00000000,?,?,00002003,00000000), ref: 004027CD
lstrcmpW.KERNEL32(?,?,?,00002003,00000000,000000DD,00000012,00000001), ref: 004027D8

Strings

!N~, xrefs: 00402797

Memory Dump Source

Source File: 00000000.00000002.1786996002.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1786976555.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1787017126.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1787037791.000000000040B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1787037791.000000000041F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1787037791.0000000000461000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1787037791.00000000004B3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1787138270.00000000004F4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1787138270.0000000000505000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_GOmRjFSKNz.jbxd

Similarity

API ID: PrivateProfileStringlstrcmp
String ID: !N~
API String ID: 623250636-529124213
Opcode ID: 866873a94fae700ec207294a0f2462ae5c2747d97e8320b74985250fbb79316b
Instruction ID: 7cd271610f6b1cb64eb4c57d825f56a096f62725fe87e34e9129affe44791136
Opcode Fuzzy Hash: 866873a94fae700ec207294a0f2462ae5c2747d97e8320b74985250fbb79316b
Instruction Fuzzy Hash: 37E0E571500208ABDB00BBA0DE85DAE7BBCAF05304F14443AF641F71E3EA7459028718

Function 00405C3F Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 24processCOMMON

Download Yara Rule

APIs

CreateProcessW.KERNEL32(00000000,?,00000000,00000000,00000000,00000000,00000000,00000000,00457278,Error launching installer), ref: 00405C64
CloseHandle.KERNEL32(?), ref: 00405C71

Strings

Error launching installer, xrefs: 00405C48

Memory Dump Source

Source File: 00000000.00000002.1786996002.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1786976555.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1787017126.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1787037791.000000000040B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1787037791.000000000041F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1787037791.0000000000461000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1787037791.00000000004B3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1787138270.00000000004F4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1787138270.0000000000505000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_GOmRjFSKNz.jbxd

Similarity

API ID: CloseCreateHandleProcess
String ID: Error launching installer
API String ID: 3712363035-66219284
Opcode ID: 47f41dc08d07e361b35e7f66cf96497c8c5e39d775029f064e59fed031f864e7
Instruction ID: c3c9ba135fb9cbcc5263534f4c07e322ce29f53e9eda4e03cc008bde6a4ec24c
Opcode Fuzzy Hash: 47f41dc08d07e361b35e7f66cf96497c8c5e39d775029f064e59fed031f864e7
Instruction Fuzzy Hash: 44E0EC70504209ABEF009B64EE49E7F7BBCEB00305F504575BD51E2561D774D9188A68

Function 004062A3 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 13stringCOMMON

Download Yara Rule

APIs

lstrlenW.KERNEL32(RMDir: RemoveDirectory invalid input(""),00406E79,RMDir: RemoveDirectory("%s"),?,?,?), ref: 004062B0
wvsprintfW.USER32(00000000,?,?), ref: 004062C7

Part of subcall function 004060E7: CloseHandle.KERNEL32(FFFFFFFF,00000000,?,?,004062D4,00000000), ref: 004060FE

Strings

RMDir: RemoveDirectory invalid input(""), xrefs: 004062A5, 004062AA

Memory Dump Source

Source File: 00000000.00000002.1786996002.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1786976555.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1787017126.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1787037791.000000000040B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1787037791.000000000041F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1787037791.0000000000461000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1787037791.00000000004B3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1787138270.00000000004F4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1787138270.0000000000505000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_GOmRjFSKNz.jbxd

Similarity

API ID: CloseHandlelstrlenwvsprintf
String ID: RMDir: RemoveDirectory invalid input("")
API String ID: 3509786178-2769509956
Opcode ID: 7e77ee9ca870ff99cdb2782ad16b85c265d3824fde99dea76e58772afe0e1651
Instruction ID: 8d95e7b1bd6a8fe250904a0927f32055e446839aab417a06e937ad69edd5bb19
Opcode Fuzzy Hash: 7e77ee9ca870ff99cdb2782ad16b85c265d3824fde99dea76e58772afe0e1651
Instruction Fuzzy Hash: 04D05E34150316BACA009BA0DE09E997B64FBD0384F50442EF147C5070FA748001C70E

Function 00405DB6 Relevance: 5.0, APIs: 4, Instructions: 37stringCOMMON

Download Yara Rule

APIs

lstrlenA.KERNEL32(00000000,?,00000000,00000000,?,00000000,00406BD3,00000000,[Rename]), ref: 00405DC6
lstrcmpiA.KERNEL32(?,?), ref: 00405DDE
CharNextA.USER32(?,?,00000000,00406BD3,00000000,[Rename]), ref: 00405DEF
lstrlenA.KERNEL32(?,?,00000000,00406BD3,00000000,[Rename]), ref: 00405DF8

Memory Dump Source

Source File: 00000000.00000002.1786996002.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1786976555.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1787017126.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1787037791.000000000040B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1787037791.000000000041F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1787037791.0000000000461000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1787037791.00000000004B3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1787138270.00000000004F4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1787138270.0000000000505000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_GOmRjFSKNz.jbxd

Similarity

API ID: lstrlen$CharNextlstrcmpi
String ID:
API String ID: 190613189-0
Opcode ID: f82830a26d6d2443e283ff34aa02cafdf5392a3ccdb3054c8558e2fdbecc5bb1
Instruction ID: 82a91399e33c41d3abe84131f59dcd741317d7299bce3ff9d06b8c6e92496674
Opcode Fuzzy Hash: f82830a26d6d2443e283ff34aa02cafdf5392a3ccdb3054c8558e2fdbecc5bb1
Instruction Fuzzy Hash: D5F0CD31205988EFCB019FA9CD04C9FBBA8EF56350B2180AAE840E7310D630EE01DBA4

Analysis Process: Launches.pifPID: 4296, Parent PID: 1188COMMON

Execution Graph

Execution Coverage:	4.3%
Dynamic/Decrypted Code Coverage:	0%
Signature Coverage:	2.1%
Total number of Nodes:	2000
Total number of Limit Nodes:	70

Executed Functions

Function 00755240 Relevance: 19.4, APIs: 8, Strings: 3, Instructions: 147
windowCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetCurrentDirectoryW.KERNEL32(00007FFF,?), ref: 0075526C
IsDebuggerPresent.KERNEL32 ref: 0075527E
GetFullPathNameW.KERNEL32(00007FFF,?,?), ref: 007552E6

Part of subcall function 00751821: _memmove.LIBCMT ref: 0075185B

Part of subcall function 0074BBC6: GetFullPathNameW.KERNEL32(?,00007FFF,?,?), ref: 0074BC07

SetCurrentDirectoryW.KERNEL32(?), ref: 00755366
MessageBoxA.USER32(00000000,It is a violation of the AutoIt EULA to attempt to reverse engineer this program.,AutoIt,00000010), ref: 00790B2E
SetCurrentDirectoryW.KERNEL32(?), ref: 00790B66
GetForegroundWindow.USER32(runas,?,?,?,00000001,?,007F6D10), ref: 00790BE9
ShellExecuteW.SHELL32(00000000), ref: 00790BF0

Part of subcall function 0075514C: GetSysColorBrush.USER32(0000000F), ref: 00755156
Part of subcall function 0075514C: LoadCursorW.USER32(00000000,00007F00), ref: 00755165
Part of subcall function 0075514C: LoadIconW.USER32(00000063), ref: 0075517C
Part of subcall function 0075514C: LoadIconW.USER32(000000A4), ref: 0075518E
Part of subcall function 0075514C: LoadIconW.USER32(000000A2), ref: 007551A0
Part of subcall function 0075514C: LoadImageW.USER32(00000063,00000001,00000010,00000010,00000000), ref: 007551C6
Part of subcall function 0075514C: RegisterClassExW.USER32(?), ref: 0075521C

Part of subcall function 007550DB: CreateWindowExW.USER32(00000000,AutoIt v3,AutoIt v3,00CF0000,80000000,80000000,0000012C,00000064,00000000,00000000,00000000,00000001), ref: 00755109
Part of subcall function 007550DB: CreateWindowExW.USER32(00000000,edit,00000000,50B008C4,00000000,00000000,00000000,00000000,00000000,00000001,00000000), ref: 0075512A
Part of subcall function 007550DB: ShowWindow.USER32(00000000), ref: 0075513E
Part of subcall function 007550DB: ShowWindow.USER32(00000000), ref: 00755147

Part of subcall function 007559D3: _memset.LIBCMT ref: 007559F9
Part of subcall function 007559D3: Shell_NotifyIconW.SHELL32(00000000,?), ref: 00755A9E

Strings

runas, xrefs: 00790BE4
It is a violation of the AutoIt EULA to attempt to reverse engineer this program., xrefs: 00790B28
AutoIt, xrefs: 00790B23

Memory Dump Source

Source File: 0000000A.00000002.2894756195.0000000000741000.00000020.00000001.01000000.00000006.sdmp, Offset: 00740000, based on PE: true

Associated: 0000000A.00000002.2894716076.0000000000740000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.2894810207.00000000007D0000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.2894810207.00000000007F6000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.2894865972.0000000000800000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.2894887053.0000000000809000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_740000_Launches.jbxd

Similarity

API ID: LoadWindow$Icon$CurrentDirectory$CreateFullNamePathShow$BrushClassColorCursorDebuggerExecuteForegroundImageMessageNotifyPresentRegisterShellShell__memmove_memset
String ID: AutoIt$It is a violation of the AutoIt EULA to attempt to reverse engineer this program.$runas
API String ID: 529118366-2030392706
Opcode ID: 3e4b745ca1c84b64a0678d5c425f6932a420dd868ecaeca3e52981828a15f77c
Instruction ID: 399f80d888df2a5cd649704952b998810daea3d1f4a85ac7e0a4bb790422a2b3
Opcode Fuzzy Hash: 3e4b745ca1c84b64a0678d5c425f6932a420dd868ecaeca3e52981828a15f77c
Instruction Fuzzy Hash: 1B510571D05248EECF11ABB4DC19EFD7B78BB05342F104069F956A22A2DAFC6948C760

Function 007A3CE2 Relevance: 14.2, APIs: 7, Strings: 1, Instructions: 167
fileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 00760284: GetFullPathNameW.KERNEL32(?,00007FFF,?,00000000,?,?,00752A58,?,00008000), ref: 007602A4

Part of subcall function 007A4FEC: GetFileAttributesW.KERNEL32(?,007A3BFE), ref: 007A4FED

FindFirstFileW.KERNEL32(?,?), ref: 007A3D96
DeleteFileW.KERNEL32(?,?,00000000,?,?,?,?), ref: 007A3E3E
MoveFileW.KERNEL32(?,?), ref: 007A3E51
DeleteFileW.KERNEL32(?,?,?,?,?), ref: 007A3E6E
FindNextFileW.KERNELBASE(00000000,00000010), ref: 007A3E90
FindClose.KERNEL32(00000000,?,?,?,?), ref: 007A3EAC

Strings

\*.*, xrefs: 007A3D41, 007A3D4A, 007A3D5F

Memory Dump Source

Source File: 0000000A.00000002.2894756195.0000000000741000.00000020.00000001.01000000.00000006.sdmp, Offset: 00740000, based on PE: true

Associated: 0000000A.00000002.2894716076.0000000000740000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.2894810207.00000000007D0000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.2894810207.00000000007F6000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.2894865972.0000000000800000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.2894887053.0000000000809000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_740000_Launches.jbxd

Similarity

API ID: File$Find$Delete$AttributesCloseFirstFullMoveNameNextPath
String ID: \*.*
API String ID: 4002782344-1173974218
Opcode ID: 448d3ebaf25c20ac871274b1cc15fbb79fcae9e368c653a61487a463e7380319
Instruction ID: 779292761a9198400296f4f3c582a621911506c0b2bb7099e12e814135bc6ab4
Opcode Fuzzy Hash: 448d3ebaf25c20ac871274b1cc15fbb79fcae9e368c653a61487a463e7380319
Instruction Fuzzy Hash: 9451723190114DEACF15EFA0C95AAEDB779AF51302FA04265F842B3191EB796F0DCB60

Function 00755D13 Relevance: 10.7, APIs: 7, Instructions: 223
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetVersionExW.KERNEL32(?), ref: 00755D40

Part of subcall function 00751821: _memmove.LIBCMT ref: 0075185B

GetCurrentProcess.KERNEL32(?,007D0A18,00000000,00000000,?), ref: 00755E07
IsWow64Process.KERNEL32(00000000), ref: 00755E0E
GetNativeSystemInfo.KERNEL32(00000000), ref: 00755E54
FreeLibrary.KERNEL32(00000000), ref: 00755E5F
GetSystemInfo.KERNEL32(00000000), ref: 00755E90
GetSystemInfo.KERNEL32(00000000), ref: 00755E9C

Memory Dump Source

Source File: 0000000A.00000002.2894756195.0000000000741000.00000020.00000001.01000000.00000006.sdmp, Offset: 00740000, based on PE: true

Associated: 0000000A.00000002.2894716076.0000000000740000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.2894810207.00000000007D0000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.2894810207.00000000007F6000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.2894865972.0000000000800000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.2894887053.0000000000809000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_740000_Launches.jbxd

Similarity

API ID: InfoSystem$Process$CurrentFreeLibraryNativeVersionWow64_memmove
String ID:
API String ID: 1986165174-0
Opcode ID: ad2be627d95ef4d58a21f60e88ff8c086468585d4a83cdf01fb509af8a99ba05
Instruction ID: 879b83f5e6dc9e12ba6fac0864ae2af3aef992ed9e4eaa78db5e90530e3b9595
Opcode Fuzzy Hash: ad2be627d95ef4d58a21f60e88ff8c086468585d4a83cdf01fb509af8a99ba05
Instruction Fuzzy Hash: 4E91F53154ABC0DECB31CB6894611EABFE16F25301F884A9ED4C787A01D279B64CC7A9

Function 007A4005 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 91
fileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 00760284: GetFullPathNameW.KERNEL32(?,00007FFF,?,00000000,?,?,00752A58,?,00008000), ref: 007602A4

Part of subcall function 007A4FEC: GetFileAttributesW.KERNEL32(?,007A3BFE), ref: 007A4FED

FindFirstFileW.KERNEL32(?,?), ref: 007A407C
DeleteFileW.KERNEL32(?,?,?,?), ref: 007A40CC
FindNextFileW.KERNELBASE(00000000,00000010), ref: 007A40DD
FindClose.KERNEL32(00000000), ref: 007A40F4
FindClose.KERNEL32(00000000), ref: 007A40FD

Strings

\*.*, xrefs: 007A404E

Memory Dump Source

Source File: 0000000A.00000002.2894756195.0000000000741000.00000020.00000001.01000000.00000006.sdmp, Offset: 00740000, based on PE: true

Associated: 0000000A.00000002.2894716076.0000000000740000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.2894810207.00000000007D0000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.2894810207.00000000007F6000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.2894865972.0000000000800000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.2894887053.0000000000809000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_740000_Launches.jbxd

Similarity

API ID: FileFind$Close$AttributesDeleteFirstFullNameNextPath
String ID: \*.*
API String ID: 2649000838-1173974218
Opcode ID: 67faae0797364ddfb8457ab2d2ae9277c564508d5d2f76fea7a305f5beb915bf
Instruction ID: 925eb40269bd399a278ff9d5abe33236e4d9f86eca8fb892ea382c5f476441ee
Opcode Fuzzy Hash: 67faae0797364ddfb8457ab2d2ae9277c564508d5d2f76fea7a305f5beb915bf
Instruction Fuzzy Hash: 7731A431009345DBC300EB60C8999EFB7E8BED2306F844A1DF9D182191EB69A90DD7A7

Function 007A4148 Relevance: 6.1, APIs: 4, Instructions: 85processCOMMON

Download Yara Rule

APIs

CreateToolhelp32Snapshot.KERNEL32 ref: 007A416D
Process32FirstW.KERNEL32(00000000,?), ref: 007A417B
Process32NextW.KERNEL32(00000000,?), ref: 007A419B
CloseHandle.KERNEL32(00000000), ref: 007A4245

Memory Dump Source

Source File: 0000000A.00000002.2894756195.0000000000741000.00000020.00000001.01000000.00000006.sdmp, Offset: 00740000, based on PE: true

Associated: 0000000A.00000002.2894716076.0000000000740000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.2894810207.00000000007D0000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.2894810207.00000000007F6000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.2894865972.0000000000800000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.2894887053.0000000000809000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_740000_Launches.jbxd

Similarity

API ID: Process32$CloseCreateFirstHandleNextSnapshotToolhelp32
String ID:
API String ID: 420147892-0
Opcode ID: bcf9cfe22d5bef62aac17d71ccb4d931a5d92cf2e213be44ca283f0e0b7e9506
Instruction ID: 6e269b8cb264589301a58b743f3f432d567a0756fb742f7a2ff72ab617de5b10
Opcode Fuzzy Hash: bcf9cfe22d5bef62aac17d71ccb4d931a5d92cf2e213be44ca283f0e0b7e9506
Instruction Fuzzy Hash: F6318F71108345DBD300EF50D889BAFBBF8BFD5351F40062DF985821A1EBBA9949CB92

Function 0074B020 Relevance: 5.6, APIs: 3, Instructions: 1146COMMON

Download Yara Rule

APIs

Part of subcall function 00753740: CharUpperBuffW.USER32(?,008071DC,00000001,?,00000000,008071DC,?,007453A5,?,?,?,?), ref: 0075375D

_memmove.LIBCMT ref: 0074B68A

Memory Dump Source

Source File: 0000000A.00000002.2894756195.0000000000741000.00000020.00000001.01000000.00000006.sdmp, Offset: 00740000, based on PE: true

Associated: 0000000A.00000002.2894716076.0000000000740000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.2894810207.00000000007D0000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.2894810207.00000000007F6000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.2894865972.0000000000800000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.2894887053.0000000000809000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_740000_Launches.jbxd

Similarity

API ID: BuffCharUpper_memmove
String ID:
API String ID: 2819905725-0
Opcode ID: aff617526015b1f003ecd732ccf940bfb858f6507fa5a24e2e6d6ef9eebc34b2
Instruction ID: 89664e79000e2935b3b84b014d70adf89c4cfe0e8a4b455ad8a91ed4841dfe27
Opcode Fuzzy Hash: aff617526015b1f003ecd732ccf940bfb858f6507fa5a24e2e6d6ef9eebc34b2
Instruction Fuzzy Hash: 9CA25570608741DFD720DF28C484B2AB7E1FF89704F14896DE89A8B262D779ED45CB92

Function 007A494A Relevance: 4.5, APIs: 3, Instructions: 25fileCOMMON

Download Yara Rule

APIs

GetFileAttributesW.KERNEL32(?,0078FC86), ref: 007A495A
FindFirstFileW.KERNEL32(?,?), ref: 007A496B
FindClose.KERNEL32(00000000), ref: 007A497B

Memory Dump Source

Source File: 0000000A.00000002.2894756195.0000000000741000.00000020.00000001.01000000.00000006.sdmp, Offset: 00740000, based on PE: true

Associated: 0000000A.00000002.2894716076.0000000000740000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.2894810207.00000000007D0000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.2894810207.00000000007F6000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.2894865972.0000000000800000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.2894887053.0000000000809000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_740000_Launches.jbxd

Similarity

API ID: FileFind$AttributesCloseFirst
String ID:
API String ID: 48322524-0
Opcode ID: 0def84389a9dbfcf3aa39f05c5088870e5317f9120f38890a0f0ff9ea720af17
Instruction ID: d5348e1a68b5554d1e56181841f7303a5e5271909a04920491c3412bf3bed7cb
Opcode Fuzzy Hash: 0def84389a9dbfcf3aa39f05c5088870e5317f9120f38890a0f0ff9ea720af17
Instruction Fuzzy Hash: 9BE0D8324115059B52106B38EC0D4EF7B6CAE87335F104706F535C10D0E7B9A95446D9

Function 007494E0 Relevance: 3.5, APIs: 2, Instructions: 539COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.2894756195.0000000000741000.00000020.00000001.01000000.00000006.sdmp, Offset: 00740000, based on PE: true

Associated: 0000000A.00000002.2894716076.0000000000740000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.2894810207.00000000007D0000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.2894810207.00000000007F6000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.2894865972.0000000000800000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.2894887053.0000000000809000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_740000_Launches.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3034c20af1671d51093400cafe59064028f1e436cfccc0889b7f71e9a6a81c89
Instruction ID: f83c75e6edf3c2223281d7790c46b56f63bffbf699f0246afb2f5a92236e077b
Opcode Fuzzy Hash: 3034c20af1671d51093400cafe59064028f1e436cfccc0889b7f71e9a6a81c89
Instruction Fuzzy Hash: 6F22AE74D00215DFDB24DF58C484AAFB7B4FF49310F248169EA56AB351E338AD81CB91

Function 0074BC70 Relevance: 50.4, APIs: 22, Strings: 6, Instructions: 1379sleeptimeCOMMON

Download Yara Rule

APIs

timeGetTime.WINMM ref: 0074BF57

Part of subcall function 007452B0: PeekMessageW.USER32(?,00000000,00000000,00000000,00000001), ref: 007452E6

Sleep.KERNEL32(0000000A,?,?), ref: 007836B5

Strings

@GUI_CTRLID, xrefs: 0078376C
@COM_EVENTOBJ, xrefs: 00783D2E
@GUI_CTRLHANDLE, xrefs: 00783816
@GUI_WINHANDLE, xrefs: 007837C1
CALL, xrefs: 0074C277
@TRAY_ID, xrefs: 00783FCD

Memory Dump Source

Source File: 0000000A.00000002.2894756195.0000000000741000.00000020.00000001.01000000.00000006.sdmp, Offset: 00740000, based on PE: true

Associated: 0000000A.00000002.2894716076.0000000000740000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.2894810207.00000000007D0000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.2894810207.00000000007F6000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.2894865972.0000000000800000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.2894887053.0000000000809000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_740000_Launches.jbxd

Similarity

API ID: MessagePeekSleepTimetime
String ID: @COM_EVENTOBJ$@GUI_CTRLHANDLE$@GUI_CTRLID$@GUI_WINHANDLE$@TRAY_ID$CALL
API String ID: 1792118007-922114024
Opcode ID: 1e0c999a5fcdd179eccc96e43fcbcdf6336c91152565026d474e165985f8144f
Instruction ID: c0469b81301dd41d410e1c499ed33a8906c6f64bee16ff44fa46bf140e4fe1df
Opcode Fuzzy Hash: 1e0c999a5fcdd179eccc96e43fcbcdf6336c91152565026d474e165985f8144f
Instruction Fuzzy Hash: A0C2B170608341DFD728DF28C858BAAB7E4BF84704F14891DF58A972A1DB79ED44CB92

Function 007433E8 Relevance: 19.3, APIs: 7, Strings: 4, Instructions: 72
windowregistryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetSysColorBrush.USER32(0000000F), ref: 00743444
RegisterClassExW.USER32(00000030), ref: 0074346E
RegisterWindowMessageW.USER32(TaskbarCreated), ref: 0074347F
InitCommonControlsEx.COMCTL32(?), ref: 0074349C
ImageList_Create.COMCTL32(00000010,00000010,00000021,00000001,00000001), ref: 007434AC
LoadIconW.USER32(000000A9), ref: 007434C2
ImageList_ReplaceIcon.COMCTL32(000000FF,00000000), ref: 007434D1

Strings

AutoIt v3 GUI, xrefs: 00743460
TaskbarCreated, xrefs: 00743474
0, xrefs: 00743426
+, xrefs: 0074342D

Memory Dump Source

Source File: 0000000A.00000002.2894756195.0000000000741000.00000020.00000001.01000000.00000006.sdmp, Offset: 00740000, based on PE: true

Associated: 0000000A.00000002.2894716076.0000000000740000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.2894810207.00000000007D0000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.2894810207.00000000007F6000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.2894865972.0000000000800000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.2894887053.0000000000809000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_740000_Launches.jbxd

Similarity

API ID: IconImageList_Register$BrushClassColorCommonControlsCreateInitLoadMessageReplaceWindow
String ID: +$0$AutoIt v3 GUI$TaskbarCreated
API String ID: 2914291525-1005189915
Opcode ID: 7e48893201f4c8355600550eefead75b8a3d0cc78063e269884e1a6632705d8b
Instruction ID: 2b32df93e48431ad8a7c7e9596b1282cbb7ec70cc91107ee3b5183a26c54fa89
Opcode Fuzzy Hash: 7e48893201f4c8355600550eefead75b8a3d0cc78063e269884e1a6632705d8b
Instruction Fuzzy Hash: F4312AB1D41349AFDB909FA4DC88BDDBBF0FB08320F10812AE555A62A0D7B95581CF95

Function 00743411 Relevance: 19.3, APIs: 7, Strings: 4, Instructions: 54
windowregistryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetSysColorBrush.USER32(0000000F), ref: 00743444
RegisterClassExW.USER32(00000030), ref: 0074346E
RegisterWindowMessageW.USER32(TaskbarCreated), ref: 0074347F
InitCommonControlsEx.COMCTL32(?), ref: 0074349C
ImageList_Create.COMCTL32(00000010,00000010,00000021,00000001,00000001), ref: 007434AC
LoadIconW.USER32(000000A9), ref: 007434C2
ImageList_ReplaceIcon.COMCTL32(000000FF,00000000), ref: 007434D1

Strings

AutoIt v3 GUI, xrefs: 00743460
TaskbarCreated, xrefs: 00743474
0, xrefs: 00743426
+, xrefs: 0074342D

Memory Dump Source

Source File: 0000000A.00000002.2894756195.0000000000741000.00000020.00000001.01000000.00000006.sdmp, Offset: 00740000, based on PE: true

Associated: 0000000A.00000002.2894716076.0000000000740000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.2894810207.00000000007D0000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.2894810207.00000000007F6000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.2894865972.0000000000800000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.2894887053.0000000000809000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_740000_Launches.jbxd

Similarity

API ID: IconImageList_Register$BrushClassColorCommonControlsCreateInitLoadMessageReplaceWindow
String ID: +$0$AutoIt v3 GUI$TaskbarCreated
API String ID: 2914291525-1005189915
Opcode ID: 6a616c71f505a338c78c8289fe56ab14a4fc158ed1d5f9ab867cb6d1c626875b
Instruction ID: 776741786cdf32e402db509243c73fd9abd74bba074864d39a705c40ccec0686
Opcode Fuzzy Hash: 6a616c71f505a338c78c8289fe56ab14a4fc158ed1d5f9ab867cb6d1c626875b
Instruction Fuzzy Hash: E921E5B1D05308AFDB409FA4EC88B9DBBF4FB08710F00912AF611A62A0D7B56540CFA9

Function 00752FC5 Relevance: 17.7, APIs: 6, Strings: 4, Instructions: 201
registryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 007600CF: GetModuleFileNameW.KERNEL32(00000000,?,00007FFF,?,?,00753094), ref: 007600ED

Part of subcall function 007608C1: GetFullPathNameW.KERNEL32(?,00007FFF,?,?,?,?,0075309F), ref: 007608E3

RegOpenKeyExW.KERNEL32(80000001,Software\AutoIt v3\AutoIt,00000000,00000001,?,?,\Include\), ref: 007530E2
RegQueryValueExW.ADVAPI32(?,Include,00000000,00000000,00000000,?), ref: 007901BA
RegQueryValueExW.ADVAPI32(?,Include,00000000,00000000,?,?,00000000), ref: 007901FB
RegCloseKey.ADVAPI32(?), ref: 00790239
_wcscat.LIBCMT ref: 00790292

Strings

Include, xrefs: 007901B1, 007901F2
\, xrefs: 007902B5
Software\AutoIt v3\AutoIt, xrefs: 007530D8
\Include\, xrefs: 0075309F

Memory Dump Source

Source File: 0000000A.00000002.2894756195.0000000000741000.00000020.00000001.01000000.00000006.sdmp, Offset: 00740000, based on PE: true

Associated: 0000000A.00000002.2894716076.0000000000740000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.2894810207.00000000007D0000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.2894810207.00000000007F6000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.2894865972.0000000000800000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.2894887053.0000000000809000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_740000_Launches.jbxd

Similarity

API ID: NameQueryValue$CloseFileFullModuleOpenPath_wcscat
String ID: Include$Software\AutoIt v3\AutoIt$\$\Include\
API String ID: 2673923337-2727554177
Opcode ID: 77e2c138e6afd21717ee7f5893e00d59946c899d0993942debe5ec4c674e2087
Instruction ID: 311616307148ae1f0a9d18da9e074adc08ed8da2b904648ca215081961c89100
Opcode Fuzzy Hash: 77e2c138e6afd21717ee7f5893e00d59946c899d0993942debe5ec4c674e2087
Instruction Fuzzy Hash: A9717D71505701DEC740EF65EC499ABBBE8FF44341F80052EF885872A1EF749989CB96

Function 0075514C Relevance: 17.6, APIs: 7, Strings: 3, Instructions: 71
windowregistryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetSysColorBrush.USER32(0000000F), ref: 00755156
LoadCursorW.USER32(00000000,00007F00), ref: 00755165
LoadIconW.USER32(00000063), ref: 0075517C
LoadIconW.USER32(000000A4), ref: 0075518E
LoadIconW.USER32(000000A2), ref: 007551A0
LoadImageW.USER32(00000063,00000001,00000010,00000010,00000000), ref: 007551C6
RegisterClassExW.USER32(?), ref: 0075521C

Part of subcall function 00743411: GetSysColorBrush.USER32(0000000F), ref: 00743444
Part of subcall function 00743411: RegisterClassExW.USER32(00000030), ref: 0074346E
Part of subcall function 00743411: RegisterWindowMessageW.USER32(TaskbarCreated), ref: 0074347F
Part of subcall function 00743411: InitCommonControlsEx.COMCTL32(?), ref: 0074349C
Part of subcall function 00743411: ImageList_Create.COMCTL32(00000010,00000010,00000021,00000001,00000001), ref: 007434AC
Part of subcall function 00743411: LoadIconW.USER32(000000A9), ref: 007434C2
Part of subcall function 00743411: ImageList_ReplaceIcon.COMCTL32(000000FF,00000000), ref: 007434D1

Strings

AutoIt v3, xrefs: 0075520B
#, xrefs: 00755201
0, xrefs: 007551FA

Memory Dump Source

Source File: 0000000A.00000002.2894756195.0000000000741000.00000020.00000001.01000000.00000006.sdmp, Offset: 00740000, based on PE: true

Associated: 0000000A.00000002.2894716076.0000000000740000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.2894810207.00000000007D0000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.2894810207.00000000007F6000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.2894865972.0000000000800000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.2894887053.0000000000809000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_740000_Launches.jbxd

Similarity

API ID: Load$Icon$ImageRegister$BrushClassColorList_$CommonControlsCreateCursorInitMessageReplaceWindow
String ID: #$0$AutoIt v3
API String ID: 423443420-4155596026
Opcode ID: 37bd54f9cadfc84d37347f8117b49fda2ecb9e318c4d842453c7b832681540b9
Instruction ID: 60444d8424687c1e2235c12ab24aac19427b1e6d765b0a1fc814d23e88a57952
Opcode Fuzzy Hash: 37bd54f9cadfc84d37347f8117b49fda2ecb9e318c4d842453c7b832681540b9
Instruction Fuzzy Hash: C5214870E05308EFEF509FA4ED09B9D7BB5FB08311F00411AF505AA2A0D7BA6550CF94

Function 007B5E1D Relevance: 15.9, APIs: 8, Strings: 1, Instructions: 163
networkfileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

WSAStartup.WS2_32(00000101,?), ref: 007B5E7E
inet_addr.WSOCK32(?,?,?), ref: 007B5EC3
gethostbyname.WS2_32(?), ref: 007B5ECF
IcmpCreateFile.IPHLPAPI ref: 007B5EDD
IcmpSendEcho.IPHLPAPI(?,?,?,00000005,00000000,?,00000029,00000FA0), ref: 007B5F4D
IcmpSendEcho.IPHLPAPI(00000000,00000000,?,00000005,00000000,?,00000029,00000FA0), ref: 007B5F63
IcmpCloseHandle.IPHLPAPI(00000000), ref: 007B5FD8
WSACleanup.WSOCK32 ref: 007B5FDE

Strings

Ping, xrefs: 007B5F01

Memory Dump Source

Source File: 0000000A.00000002.2894756195.0000000000741000.00000020.00000001.01000000.00000006.sdmp, Offset: 00740000, based on PE: true

Associated: 0000000A.00000002.2894716076.0000000000740000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.2894810207.00000000007D0000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.2894810207.00000000007F6000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.2894865972.0000000000800000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.2894887053.0000000000809000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_740000_Launches.jbxd

Similarity

API ID: Icmp$EchoSend$CleanupCloseCreateFileHandleStartupgethostbynameinet_addr
String ID: Ping
API String ID: 1028309954-2246546115
Opcode ID: 77687b640c829bba6a057fdf266b0608480e4bd7d471a745f62e106a140e6338
Instruction ID: 38879581ee8e29548614cd9fc1206221d4e2b06afe4754add3c8ff87626f084e
Opcode Fuzzy Hash: 77687b640c829bba6a057fdf266b0608480e4bd7d471a745f62e106a140e6338
Instruction Fuzzy Hash: 8D516D31604601DFDB20EF24DC49BAAB7E4EF48720F148529F955DB2A1DB78E900DB42

Function 00754D83 Relevance: 15.9, APIs: 8, Strings: 1, Instructions: 151
windowtimeregistryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

DefWindowProcW.USER32(?,?,?,?), ref: 00754E22
KillTimer.USER32(?,00000001), ref: 00754E4C
SetTimer.USER32(?,00000001,000002EE,00000000), ref: 00754E6F
RegisterWindowMessageW.USER32(TaskbarCreated), ref: 00754E7A
CreatePopupMenu.USER32 ref: 00754E8E
PostQuitMessage.USER32(00000000), ref: 00754EAF

Strings

TaskbarCreated, xrefs: 00754E75

Memory Dump Source

Source File: 0000000A.00000002.2894756195.0000000000741000.00000020.00000001.01000000.00000006.sdmp, Offset: 00740000, based on PE: true

Associated: 0000000A.00000002.2894716076.0000000000740000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.2894810207.00000000007D0000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.2894810207.00000000007F6000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.2894865972.0000000000800000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.2894887053.0000000000809000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_740000_Launches.jbxd

Similarity

API ID: MessageTimerWindow$CreateKillMenuPopupPostProcQuitRegister
String ID: TaskbarCreated
API String ID: 129472671-2362178303
Opcode ID: 270a4696422fa91bae4a25753310724413909196d9e7e7a028be5ea76c86f3f4
Instruction ID: aa31739e6b672247c4c46014b9e9a26cfe26ec514738d3f33432c0e607c79ddd
Opcode Fuzzy Hash: 270a4696422fa91bae4a25753310724413909196d9e7e7a028be5ea76c86f3f4
Instruction Fuzzy Hash: 85412531609245EBEF915F68AC0FBFA3665F740316F044125FD02D52E1CAECAC9897A5

Function 0074AD98 Relevance: 14.3, APIs: 7, Strings: 1, Instructions: 264
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

mciSendStringW.WINMM(close all,00000000,00000000,00000000), ref: 0074ADE1
CoUninitialize.COMBASE ref: 0074AE80
UnregisterHotKey.USER32(?), ref: 0074AFD7
DestroyWindow.USER32(?), ref: 00782F64
FreeLibrary.KERNEL32(?), ref: 00782FC9
VirtualFree.KERNEL32(?,00000000,00008000), ref: 00782FF6

Strings

close all, xrefs: 0074ADDC

Memory Dump Source

Source File: 0000000A.00000002.2894756195.0000000000741000.00000020.00000001.01000000.00000006.sdmp, Offset: 00740000, based on PE: true

Associated: 0000000A.00000002.2894716076.0000000000740000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.2894810207.00000000007D0000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.2894810207.00000000007F6000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.2894865972.0000000000800000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.2894887053.0000000000809000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_740000_Launches.jbxd

Similarity

API ID: Free$DestroyLibrarySendStringUninitializeUnregisterVirtualWindow
String ID: close all
API String ID: 469580280-3243417748
Opcode ID: 4f83a9744c0aba0b3f1149c18f56c11ea165aca65d1d9aa3ff8c30e171102b62
Instruction ID: c93f5704e5e6ebf399d5c8ce596488821e08dc400edd623e49477a4ef4e624be
Opcode Fuzzy Hash: 4f83a9744c0aba0b3f1149c18f56c11ea165aca65d1d9aa3ff8c30e171102b62
Instruction Fuzzy Hash: 7DA16D70742212DFCB29EF14C499B69F365BF04701F5042ADE90AAB252DB39ED16CF91

Function 007556F8 Relevance: 14.1, APIs: 5, Strings: 3, Instructions: 117
windowCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

LoadStringW.USER32(00000065,?,0000007F,00000104), ref: 00790C5B

Part of subcall function 00751821: _memmove.LIBCMT ref: 0075185B

_memset.LIBCMT ref: 00755787
_wcscpy.LIBCMT ref: 007557DB
Shell_NotifyIconW.SHELL32(00000001,000003A8), ref: 007557EB
__swprintf.LIBCMT ref: 00790CD1

Strings

Line %d: , xrefs: 00790CCB
2#2#, xrefs: 00790C95, 00790C9E, 00790CA9, 00790CB7, 00790CA2, 00790CAD
AutoIt - , xrefs: 00755760

Memory Dump Source

Source File: 0000000A.00000002.2894756195.0000000000741000.00000020.00000001.01000000.00000006.sdmp, Offset: 00740000, based on PE: true

Associated: 0000000A.00000002.2894716076.0000000000740000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.2894810207.00000000007D0000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.2894810207.00000000007F6000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.2894865972.0000000000800000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.2894887053.0000000000809000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_740000_Launches.jbxd

Similarity

API ID: IconLoadNotifyShell_String__swprintf_memmove_memset_wcscpy
String ID: Line %d: $2#2#$AutoIt -
API String ID: 230667853-2022516920
Opcode ID: bbb5a8eaa8b6fab3992ed893e331dd3d59b7137018893cc73426422fb33676ae
Instruction ID: 9f11b088bdfaa485a10830dcecfc695893c231b81c3490dfd23558cb77c0eea5
Opcode Fuzzy Hash: bbb5a8eaa8b6fab3992ed893e331dd3d59b7137018893cc73426422fb33676ae
Instruction Fuzzy Hash: 2A41D671408304EAD321EB60DC49BDF77ECAF45352F400A1EF985921A1EBB8A64DC7A6

Function 007550DB Relevance: 10.5, APIs: 4, Strings: 2, Instructions: 44
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateWindowExW.USER32(00000000,AutoIt v3,AutoIt v3,00CF0000,80000000,80000000,0000012C,00000064,00000000,00000000,00000000,00000001), ref: 00755109
CreateWindowExW.USER32(00000000,edit,00000000,50B008C4,00000000,00000000,00000000,00000000,00000000,00000001,00000000), ref: 0075512A
ShowWindow.USER32(00000000), ref: 0075513E
ShowWindow.USER32(00000000), ref: 00755147

Strings

edit, xrefs: 00755124
AutoIt v3, xrefs: 00755101, 00755106, 00755107

Memory Dump Source

Source File: 0000000A.00000002.2894756195.0000000000741000.00000020.00000001.01000000.00000006.sdmp, Offset: 00740000, based on PE: true

Associated: 0000000A.00000002.2894716076.0000000000740000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.2894810207.00000000007D0000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.2894810207.00000000007F6000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.2894865972.0000000000800000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.2894887053.0000000000809000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_740000_Launches.jbxd

Similarity

API ID: Window$CreateShow
String ID: AutoIt v3$edit
API String ID: 1584632944-3779509399
Opcode ID: da433b520b9e6ac74fba40a0d73f763e814dacac554d59ad472ee70e2bf7b80a
Instruction ID: 1bcac8b92f05495451d6bb12f02524edba199de792e1a6d68a79f84f21406e3d
Opcode Fuzzy Hash: da433b520b9e6ac74fba40a0d73f763e814dacac554d59ad472ee70e2bf7b80a
Instruction Fuzzy Hash: 87F03A70A452907EFA7117236C4CF272E7DE7C6F20F00401AB900A62B0C6652840CAB0

Function 007A9B16 Relevance: 8.9, APIs: 4, Strings: 1, Instructions: 155
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 00754A8C: _fseek.LIBCMT ref: 00754AA4

Part of subcall function 007A9CF1: _wcscmp.LIBCMT ref: 007A9DE1
Part of subcall function 007A9CF1: _wcscmp.LIBCMT ref: 007A9DF4

_free.LIBCMT ref: 007A9C5F
_free.LIBCMT ref: 007A9C66
_free.LIBCMT ref: 007A9CD1

Part of subcall function 00762F85: RtlFreeHeap.NTDLL(00000000,00000000,?,00769C54,00000000,00768D5D,007659C3), ref: 00762F99
Part of subcall function 00762F85: GetLastError.KERNEL32(00000000,?,00769C54,00000000,00768D5D,007659C3), ref: 00762FAB

_free.LIBCMT ref: 007A9CD9

Strings

>>>AUTOIT SCRIPT<<<, xrefs: 007A9B8F

Memory Dump Source

Source File: 0000000A.00000002.2894756195.0000000000741000.00000020.00000001.01000000.00000006.sdmp, Offset: 00740000, based on PE: true

Associated: 0000000A.00000002.2894716076.0000000000740000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.2894810207.00000000007D0000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.2894810207.00000000007F6000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.2894865972.0000000000800000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.2894887053.0000000000809000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_740000_Launches.jbxd

Similarity

API ID: _free$_wcscmp$ErrorFreeHeapLast_fseek
String ID: >>>AUTOIT SCRIPT<<<
API String ID: 1552873950-2806939583
Opcode ID: f5538ae4973e842a3f381e374052794b9fd18ff8198279df727bcc9ca4743f92
Instruction ID: 464334f032d9434e982559a1d52571a57cb5f8d23f5de103e75885ecb8e98ada
Opcode Fuzzy Hash: f5538ae4973e842a3f381e374052794b9fd18ff8198279df727bcc9ca4743f92
Instruction Fuzzy Hash: AB515DB1904219EFDF24DF64DC85AAEBBB9FF48304F00419EB609A3241DB755E948F58

Function 0076563D Relevance: 7.7, APIs: 5, Instructions: 163COMMONLIBRARYCODE

Download Yara Rule

APIs

_memset.LIBCMT ref: 0076569B
_memcpy_s.LIBCMT ref: 0076570D
__read_nolock.LIBCMT ref: 0076576B
__filbuf.LIBCMT ref: 0076578E
_memset.LIBCMT ref: 007657D2

Part of subcall function 00768D58: __getptd_noexit.LIBCMT ref: 00768D58

Memory Dump Source

Source File: 0000000A.00000002.2894756195.0000000000741000.00000020.00000001.01000000.00000006.sdmp, Offset: 00740000, based on PE: true

Associated: 0000000A.00000002.2894716076.0000000000740000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.2894810207.00000000007D0000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.2894810207.00000000007F6000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.2894865972.0000000000800000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.2894887053.0000000000809000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_740000_Launches.jbxd

Similarity

API ID: _memset$__filbuf__getptd_noexit__read_nolock_memcpy_s
String ID:
API String ID: 1559183368-0
Opcode ID: 00b866a24d890f7fe79ae922164f866efed2fee1f991de586a4896b02612db73
Instruction ID: 9a164eed39378922d78979dfb74c1d4e5d33ac630356c24d2dbcda2ee53291e8
Opcode Fuzzy Hash: 00b866a24d890f7fe79ae922164f866efed2fee1f991de586a4896b02612db73
Instruction Fuzzy Hash: 1351C030A00B05DBDB248FA9C88466EB7B5AF40720F248729FC3B962D0D7789D50EB51

Function 007452B0 Relevance: 7.6, APIs: 5, Instructions: 99windowCOMMON

Download Yara Rule

APIs

PeekMessageW.USER32(?,00000000,00000000,00000000,00000001), ref: 007452E6
PeekMessageW.USER32(?,00000000,00000000,00000000,00000001), ref: 0074534A
TranslateMessage.USER32(?), ref: 00745356
DispatchMessageW.USER32(?), ref: 00745360

Memory Dump Source

Source File: 0000000A.00000002.2894756195.0000000000741000.00000020.00000001.01000000.00000006.sdmp, Offset: 00740000, based on PE: true

Associated: 0000000A.00000002.2894716076.0000000000740000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.2894810207.00000000007D0000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.2894810207.00000000007F6000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.2894865972.0000000000800000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.2894887053.0000000000809000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_740000_Launches.jbxd

Similarity

API ID: Message$Peek$DispatchTranslate
String ID:
API String ID: 1795658109-0
Opcode ID: e0812ce7c6fc1bb2d31750d0245bedc80f98f7b4e8c8f387817e25b2f8425e9e
Instruction ID: 1e6ea6e2526f795b4c03b62bf55b0b516604fffbd9e565133be2c9be86e64134
Opcode Fuzzy Hash: e0812ce7c6fc1bb2d31750d0245bedc80f98f7b4e8c8f387817e25b2f8425e9e
Instruction Fuzzy Hash: 5731F430908705DBEB708F649C44BAA77B8BF01788F24806AE426961D2D7BDA885D711

Function 007A57FF Relevance: 7.5, APIs: 5, Instructions: 48sleepCOMMON

Download Yara Rule

APIs

QueryPerformanceCounter.KERNEL32(?,00000000,?,?,?,?,?,?,?,?,?,?), ref: 007A581B
QueryPerformanceFrequency.KERNEL32(?,?,?,?,?,?,?,?,?,?,?), ref: 007A5829
Sleep.KERNEL32(00000000,?,?,?,?,?,?,?,?,?,?), ref: 007A5831
QueryPerformanceCounter.KERNEL32(?,?,?,?,?,?,?,?,?,?,?), ref: 007A583B
Sleep.KERNEL32(?,00000000,?,?,?,?,?,?,?,?,?,?), ref: 007A5877

Memory Dump Source

Source File: 0000000A.00000002.2894756195.0000000000741000.00000020.00000001.01000000.00000006.sdmp, Offset: 00740000, based on PE: true

Associated: 0000000A.00000002.2894716076.0000000000740000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.2894810207.00000000007D0000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.2894810207.00000000007F6000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.2894865972.0000000000800000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.2894887053.0000000000809000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_740000_Launches.jbxd

Similarity

API ID: PerformanceQuery$CounterSleep$Frequency
String ID:
API String ID: 2833360925-0
Opcode ID: 2bee64b5abd30c5118280f72ee69f3aa86bc446cf0bd6f5ad6c9f2694181603d
Instruction ID: 705e7c3b7477d2b5182ee8dc55ad8fb87d89fd60922458b863b8ee86086b8460
Opcode Fuzzy Hash: 2bee64b5abd30c5118280f72ee69f3aa86bc446cf0bd6f5ad6c9f2694181603d
Instruction Fuzzy Hash: D2012931D02A2DEBDF009FE5D849AEDBBB8FB4A711F008656E541B2140DB3D9990CBA5

Function 00741284 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 59registryCOMMON

Download Yara Rule

APIs

RegOpenKeyExW.KERNEL32(80000001,Control Panel\Mouse,00000000,00000001,00000000,?,?,80000001,80000001,?,00741275,SwapMouseButtons,00000004,?), ref: 007412A8
RegQueryValueExW.KERNEL32(00000000,00000000,00000000,00000000,?,?,?,?,?,80000001,80000001,?,00741275,SwapMouseButtons,00000004,?), ref: 007412C9
RegCloseKey.KERNEL32(00000000,?,?,?,80000001,80000001,?,00741275,SwapMouseButtons,00000004,?), ref: 007412EB

Strings

Control Panel\Mouse, xrefs: 007412A6

Memory Dump Source

Source File: 0000000A.00000002.2894756195.0000000000741000.00000020.00000001.01000000.00000006.sdmp, Offset: 00740000, based on PE: true

Associated: 0000000A.00000002.2894716076.0000000000740000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.2894810207.00000000007D0000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.2894810207.00000000007F6000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.2894865972.0000000000800000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.2894887053.0000000000809000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_740000_Launches.jbxd

Similarity

API ID: CloseOpenQueryValue
String ID: Control Panel\Mouse
API String ID: 3677997916-824357125
Opcode ID: 5eba66ae8d96d29a383e4787da50f477c3a6b95403a42bb0fa1d8edf020ab04b
Instruction ID: 0fa4dd0966333b10d60619cb08202d15782ec57615e2cdde9a58717606b83174
Opcode Fuzzy Hash: 5eba66ae8d96d29a383e4787da50f477c3a6b95403a42bb0fa1d8edf020ab04b
Instruction Fuzzy Hash: 5B112775611208FFDB209FA4DC84EAEBBB8EF05741F50856AF805D7210E7759E80ABA4

Function 00760FE6 Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 44COMMONLIBRARYCODE

Download Yara Rule

APIs

Part of subcall function 0076593C: __FF_MSGBANNER.LIBCMT ref: 00765953
Part of subcall function 0076593C: __NMSG_WRITE.LIBCMT ref: 0076595A
Part of subcall function 0076593C: RtlAllocateHeap.NTDLL(01990000,00000000,00000001,?,00000004,?,?,00761003,?), ref: 0076597F

std::exception::exception.LIBCMT ref: 0076101C
__CxxThrowException@8.LIBCMT ref: 00761031

Part of subcall function 007687CB: RaiseException.KERNEL32(?,?,?,007FCAF8,?,?,?,?,?,00761036,?,007FCAF8,?,00000001), ref: 00768820

Strings

`=}, xrefs: 00761029
h=}, xrefs: 00761011

Memory Dump Source

Source File: 0000000A.00000002.2894756195.0000000000741000.00000020.00000001.01000000.00000006.sdmp, Offset: 00740000, based on PE: true

Associated: 0000000A.00000002.2894716076.0000000000740000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.2894810207.00000000007D0000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.2894810207.00000000007F6000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.2894865972.0000000000800000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.2894887053.0000000000809000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_740000_Launches.jbxd

Similarity

API ID: AllocateExceptionException@8HeapRaiseThrowstd::exception::exception
String ID: `=}$h=}
API String ID: 3902256705-2192852056
Opcode ID: 0323489680dfd3943f22ca74627cf0d018e0ecba5171c83cffc8f1452012b526
Instruction ID: 048edf485c919bc9fd1deeefa798d6ce8ad1ce0b47ed003b9ec7813fd0c4619f
Opcode Fuzzy Hash: 0323489680dfd3943f22ca74627cf0d018e0ecba5171c83cffc8f1452012b526
Instruction Fuzzy Hash: D5F04C3460421DF6CB20BB98DD1D9DF77AC9F01310F100466FC1692281DFB89B80C6E2

Function 00755B29 Relevance: 6.1, APIs: 4, Instructions: 66timewindowCOMMON

Download Yara Rule

APIs

_memset.LIBCMT ref: 00755B58

Part of subcall function 007556F8: _memset.LIBCMT ref: 00755787
Part of subcall function 007556F8: _wcscpy.LIBCMT ref: 007557DB
Part of subcall function 007556F8: Shell_NotifyIconW.SHELL32(00000001,000003A8), ref: 007557EB

KillTimer.USER32(?,00000001,?,?), ref: 00755BAD
SetTimer.USER32(?,00000001,000002EE,00000000), ref: 00755BBC
Shell_NotifyIconW.SHELL32(00000001,000003A8), ref: 00790D7C

Memory Dump Source

Source File: 0000000A.00000002.2894756195.0000000000741000.00000020.00000001.01000000.00000006.sdmp, Offset: 00740000, based on PE: true

Associated: 0000000A.00000002.2894716076.0000000000740000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.2894810207.00000000007D0000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.2894810207.00000000007F6000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.2894865972.0000000000800000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.2894887053.0000000000809000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_740000_Launches.jbxd

Similarity

API ID: IconNotifyShell_Timer_memset$Kill_wcscpy
String ID:
API String ID: 1378193009-0
Opcode ID: c68ed2257e350e66e0bdfb337a01de0b4d5d3e8e0cc89a8d40e4e2d2d605cc64
Instruction ID: 3c50f6c3c381b7a9c38f395311a492de2582e4709b37212dae62189df92a35f6
Opcode Fuzzy Hash: c68ed2257e350e66e0bdfb337a01de0b4d5d3e8e0cc89a8d40e4e2d2d605cc64
Instruction Fuzzy Hash: B321FF70505B849FEB728764D899FE6BBFCAF01305F04049DE69A56141C7782988CB91

Function 0075278A Relevance: 5.5, APIs: 2, Strings: 1, Instructions: 260COMMON

Download Yara Rule

APIs

Part of subcall function 007549C2: LoadLibraryExW.KERNEL32(?,00000000,00000002,?,?,007527AF,?,00000001), ref: 007549F4

_free.LIBCMT ref: 0078FB04
_free.LIBCMT ref: 0078FB4B

Part of subcall function 007529BE: SetCurrentDirectoryW.KERNEL32(?,?,?,?,00000000), ref: 00752ADF

Strings

Bad directive syntax error, xrefs: 0078FB33

Memory Dump Source

Source File: 0000000A.00000002.2894756195.0000000000741000.00000020.00000001.01000000.00000006.sdmp, Offset: 00740000, based on PE: true

Associated: 0000000A.00000002.2894716076.0000000000740000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.2894810207.00000000007D0000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.2894810207.00000000007F6000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.2894865972.0000000000800000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.2894887053.0000000000809000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_740000_Launches.jbxd

Similarity

API ID: _free$CurrentDirectoryLibraryLoad
String ID: Bad directive syntax error
API String ID: 2861923089-2118420937
Opcode ID: 2758748a18f6054a7a6b7e160012cf585b0548afd5a1e6238a7f89e23bbdaf3e
Instruction ID: 59082c4fdd291b6d709cca4b665f5824b4890532f944a9fb01d27d0ec2b3adee
Opcode Fuzzy Hash: 2758748a18f6054a7a6b7e160012cf585b0548afd5a1e6238a7f89e23bbdaf3e
Instruction Fuzzy Hash: D9918071940219EFCF08EFA4CC559EEB7B4FF09310F14452AF816AB2A1DB78A945CB50

Function 007548B0 Relevance: 5.4, APIs: 1, Strings: 2, Instructions: 141COMMON

Download Yara Rule

APIs

_memmove.LIBCMT ref: 007548FA

Strings

EA06, xrefs: 007908A1
AU3! ?}, xrefs: 007548F4

Memory Dump Source

Source File: 0000000A.00000002.2894756195.0000000000741000.00000020.00000001.01000000.00000006.sdmp, Offset: 00740000, based on PE: true

Associated: 0000000A.00000002.2894716076.0000000000740000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.2894810207.00000000007D0000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.2894810207.00000000007F6000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.2894865972.0000000000800000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.2894887053.0000000000809000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_740000_Launches.jbxd

Similarity

API ID: _memmove
String ID: AU3! ?}$EA06
API String ID: 4104443479-645541865
Opcode ID: cab218e8dc256c80f6e661f731b79c070897dc0152de6009610972bdd7b93794
Instruction ID: 4d9eff65afec7c18e1cc242ef4eaaa0eec29984658d1586847fac82b883ecda1
Opcode Fuzzy Hash: cab218e8dc256c80f6e661f731b79c070897dc0152de6009610972bdd7b93794
Instruction Fuzzy Hash: 35419D62A04198ABDF219B548856BFF7BA19B45305F184074EC82E7286D7ADADC883E1

Function 007A9CF1 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 138COMMON

Download Yara Rule

APIs

Part of subcall function 00754AB2: __fread_nolock.LIBCMT ref: 00754AD0

_wcscmp.LIBCMT ref: 007A9DE1
_wcscmp.LIBCMT ref: 007A9DF4

Strings

FILE, xrefs: 007A9D2D

Memory Dump Source

Source File: 0000000A.00000002.2894756195.0000000000741000.00000020.00000001.01000000.00000006.sdmp, Offset: 00740000, based on PE: true

Associated: 0000000A.00000002.2894716076.0000000000740000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.2894810207.00000000007D0000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.2894810207.00000000007F6000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.2894865972.0000000000800000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.2894887053.0000000000809000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_740000_Launches.jbxd

Similarity

API ID: _wcscmp$__fread_nolock
String ID: FILE
API String ID: 4029003684-3121273764
Opcode ID: 0e33d6c02c0a79970b8863f4aa5f0c61bc973bd3366b73ecbb00fa79c74026c1
Instruction ID: 53e53f593d98baf1051787d7d166f74207d2f9202d15e7325a86253ad144542c
Opcode Fuzzy Hash: 0e33d6c02c0a79970b8863f4aa5f0c61bc973bd3366b73ecbb00fa79c74026c1
Instruction Fuzzy Hash: 2641F872A40209FADF20DBA4CC49FEF77BDDF86714F00446AFA00A7281D679AD448764

Function 007531BF Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 65COMMON

Download Yara Rule

APIs

_memset.LIBCMT ref: 0079032B
GetOpenFileNameW.COMDLG32(?), ref: 00790375

Part of subcall function 00760284: GetFullPathNameW.KERNEL32(?,00007FFF,?,00000000,?,?,00752A58,?,00008000), ref: 007602A4

Part of subcall function 007609C5: GetLongPathNameW.KERNEL32(?,?,00007FFF), ref: 007609E4

Strings

X, xrefs: 00790343

Memory Dump Source

Source File: 0000000A.00000002.2894756195.0000000000741000.00000020.00000001.01000000.00000006.sdmp, Offset: 00740000, based on PE: true

Associated: 0000000A.00000002.2894716076.0000000000740000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.2894810207.00000000007D0000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.2894810207.00000000007F6000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.2894865972.0000000000800000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.2894887053.0000000000809000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_740000_Launches.jbxd

Similarity

API ID: Name$Path$FileFullLongOpen_memset
String ID: X
API String ID: 3777226403-3081909835
Opcode ID: 83c1f26cc7e011177bd82b9586fe543014b27b2cb54d59a74e9fc75af8c24bca
Instruction ID: 838e6663029a43dfdb9456a6e3e36980bb20de470701f129e10fc4758582f566
Opcode Fuzzy Hash: 83c1f26cc7e011177bd82b9586fe543014b27b2cb54d59a74e9fc75af8c24bca
Instruction Fuzzy Hash: 2021C671A0428C9BDF41DF94D809BEE7BF8AF49301F00405AE909A7241DBF8598DDF91

Function 007BD1C6 Relevance: 4.9, APIs: 3, Instructions: 392COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.2894756195.0000000000741000.00000020.00000001.01000000.00000006.sdmp, Offset: 00740000, based on PE: true

Associated: 0000000A.00000002.2894716076.0000000000740000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.2894810207.00000000007D0000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.2894810207.00000000007F6000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.2894865972.0000000000800000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.2894887053.0000000000809000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_740000_Launches.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a8ca4caea1c6f0f7cccb3efd0fe29bf7c3e3173e95d476bad08698bca6d962a7
Instruction ID: 9a1b2588799dd9b18b8a30650d4e0abee96a3da63433a647e43375f878b9fa28
Opcode Fuzzy Hash: a8ca4caea1c6f0f7cccb3efd0fe29bf7c3e3173e95d476bad08698bca6d962a7
Instruction Fuzzy Hash: 24F11770608341DFC724DF28C484A6ABBE5BF88314F14892EF8999B251E775ED45CF92

Function 00751680 Relevance: 4.7, APIs: 3, Instructions: 187COMMON

Download Yara Rule

APIs

_memmove.LIBCMT ref: 007516DB
_memmove.LIBCMT ref: 0075174C
_memmove.LIBCMT ref: 007517B9

Memory Dump Source

Source File: 0000000A.00000002.2894756195.0000000000741000.00000020.00000001.01000000.00000006.sdmp, Offset: 00740000, based on PE: true

Associated: 0000000A.00000002.2894716076.0000000000740000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.2894810207.00000000007D0000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.2894810207.00000000007F6000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.2894865972.0000000000800000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.2894887053.0000000000809000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_740000_Launches.jbxd

Similarity

API ID: _memmove
String ID:
API String ID: 4104443479-0
Opcode ID: 861db827404322b6d810c3d2c3cbd943a7e9a17c952146e4b6540856fed16a93
Instruction ID: 42aa9be548fcb506dd3ff9fe0d4ecc32ee665529be8ae149a277c241b5613b3b
Opcode Fuzzy Hash: 861db827404322b6d810c3d2c3cbd943a7e9a17c952146e4b6540856fed16a93
Instruction Fuzzy Hash: 8B61DC71600209EBDF048F29D8807AA7BB4FF44312F98C5A9EC19CF295EB79D964CB50

Function 0074AC2A Relevance: 4.6, APIs: 3, Instructions: 90comCOMMON

Download Yara Rule

APIs

Part of subcall function 0075FF4C: RegisterWindowMessageW.USER32(WM_GETCONTROLNAME,?,007C4186,00000001,007D0980), ref: 0075FFA7

GetStdHandle.KERNEL32(000000F6,00000000,00000000), ref: 0074AD08
OleInitialize.OLE32(00000000), ref: 0074AD85
CloseHandle.KERNEL32(00000000), ref: 00782F56

Memory Dump Source

Source File: 0000000A.00000002.2894756195.0000000000741000.00000020.00000001.01000000.00000006.sdmp, Offset: 00740000, based on PE: true

Associated: 0000000A.00000002.2894716076.0000000000740000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.2894810207.00000000007D0000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.2894810207.00000000007F6000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.2894865972.0000000000800000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.2894887053.0000000000809000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_740000_Launches.jbxd

Similarity

API ID: Handle$CloseInitializeMessageRegisterWindow
String ID:
API String ID: 3815369404-0
Opcode ID: f8d03d5a6195a715f73ff32796165d3edf1dabdef3ea657a48b3c39a5d7ca1c6
Instruction ID: 65fca29c8c2b7fe003b9c246088a4f9975773a0f7804a5fdfbddf94f9fc32180
Opcode Fuzzy Hash: f8d03d5a6195a715f73ff32796165d3edf1dabdef3ea657a48b3c39a5d7ca1c6
Instruction Fuzzy Hash: 794135B0E0D680CED3D9EF69AC496997FE4FB59310700826AD519C33B2EB742405CFA9

Function 007559D3 Relevance: 4.6, APIs: 3, Instructions: 77windowCOMMON

Download Yara Rule

APIs

_memset.LIBCMT ref: 007559F9
Shell_NotifyIconW.SHELL32(00000000,?), ref: 00755A9E
Shell_NotifyIconW.SHELL32(00000001,?), ref: 00755ABB

Memory Dump Source

Source File: 0000000A.00000002.2894756195.0000000000741000.00000020.00000001.01000000.00000006.sdmp, Offset: 00740000, based on PE: true

Associated: 0000000A.00000002.2894716076.0000000000740000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.2894810207.00000000007D0000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.2894810207.00000000007F6000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.2894865972.0000000000800000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.2894887053.0000000000809000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_740000_Launches.jbxd

Similarity

API ID: IconNotifyShell_$_memset
String ID:
API String ID: 1505330794-0
Opcode ID: 5775150e21bc02aa50224c974508e204add769fec531aacc3a994718cb4f60e3
Instruction ID: afdc396b0fa1ec5a216b1bdd20b1747dd4f612492c3ced51264d99a0d40c8a94
Opcode Fuzzy Hash: 5775150e21bc02aa50224c974508e204add769fec531aacc3a994718cb4f60e3
Instruction Fuzzy Hash: 21318FB0905701CFD760DF74D8946D7BBF8FB49305F004A2EF99A82250E7B9A948CB92

Function 0076593C Relevance: 4.6, APIs: 3, Instructions: 59memoryCOMMONLIBRARYCODE

Download Yara Rule

APIs

__FF_MSGBANNER.LIBCMT ref: 00765953

Part of subcall function 0076A39B: __NMSG_WRITE.LIBCMT ref: 0076A3C2
Part of subcall function 0076A39B: __NMSG_WRITE.LIBCMT ref: 0076A3CC

__NMSG_WRITE.LIBCMT ref: 0076595A

Part of subcall function 0076A3F8: GetModuleFileNameW.KERNEL32(00000000,008053BA,00000104,00000004,00000001,00761003), ref: 0076A48A
Part of subcall function 0076A3F8: ___crtMessageBoxW.LIBCMT ref: 0076A538

Part of subcall function 007632CF: ___crtCorExitProcess.LIBCMT ref: 007632D5
Part of subcall function 007632CF: ExitProcess.KERNEL32 ref: 007632DE

Part of subcall function 00768D58: __getptd_noexit.LIBCMT ref: 00768D58

RtlAllocateHeap.NTDLL(01990000,00000000,00000001,?,00000004,?,?,00761003,?), ref: 0076597F

Memory Dump Source

Source File: 0000000A.00000002.2894756195.0000000000741000.00000020.00000001.01000000.00000006.sdmp, Offset: 00740000, based on PE: true

Associated: 0000000A.00000002.2894716076.0000000000740000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.2894810207.00000000007D0000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.2894810207.00000000007F6000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.2894865972.0000000000800000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.2894887053.0000000000809000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_740000_Launches.jbxd

Similarity

API ID: ExitProcess___crt$AllocateFileHeapMessageModuleName__getptd_noexit
String ID:
API String ID: 1372826849-0
Opcode ID: be5934ea5de4456f66ac91257b59bad892d045ff7f93d66276da7d75e0f629a3
Instruction ID: d4728eef56d254b3f00798157b774316398741f3522a397ffa22f579318df810
Opcode Fuzzy Hash: be5934ea5de4456f66ac91257b59bad892d045ff7f93d66276da7d75e0f629a3
Instruction Fuzzy Hash: 4E01DE31341B02EAEA512B35A806A2F33589F42770F100226FD17AB292DE7CAD009A72

Function 007A92C8 Relevance: 4.5, APIs: 3, Instructions: 22COMMON

Download Yara Rule

APIs

_free.LIBCMT ref: 007A92D6

Part of subcall function 00762F85: RtlFreeHeap.NTDLL(00000000,00000000,?,00769C54,00000000,00768D5D,007659C3), ref: 00762F99
Part of subcall function 00762F85: GetLastError.KERNEL32(00000000,?,00769C54,00000000,00768D5D,007659C3), ref: 00762FAB

_free.LIBCMT ref: 007A92E7
_free.LIBCMT ref: 007A92F9

Memory Dump Source

Source File: 0000000A.00000002.2894756195.0000000000741000.00000020.00000001.01000000.00000006.sdmp, Offset: 00740000, based on PE: true

Associated: 0000000A.00000002.2894716076.0000000000740000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.2894810207.00000000007D0000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.2894810207.00000000007F6000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.2894865972.0000000000800000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.2894887053.0000000000809000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_740000_Launches.jbxd

Similarity

API ID: _free$ErrorFreeHeapLast
String ID:
API String ID: 776569668-0
Opcode ID: d545b8d0ab5e92762063c3ba8b14d4eaebd98453bfde93cefd35328ad8659e4d
Instruction ID: 099ed52bb825dc2efdf679ab5f49ad9d9aa6a6a544d4f6eb5c80be6e2628c490
Opcode Fuzzy Hash: d545b8d0ab5e92762063c3ba8b14d4eaebd98453bfde93cefd35328ad8659e4d
Instruction Fuzzy Hash: FDE0C2A2205A0293CA20A5386844FC377FC1FC8711714060DB90BE3183CE2CE8528028

Function 00745E83 Relevance: 4.1, APIs: 1, Strings: 1, Instructions: 551COMMON

Download Yara Rule

Strings

CALL, xrefs: 0077E234

Memory Dump Source

Source File: 0000000A.00000002.2894756195.0000000000741000.00000020.00000001.01000000.00000006.sdmp, Offset: 00740000, based on PE: true

Associated: 0000000A.00000002.2894716076.0000000000740000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.2894810207.00000000007D0000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.2894810207.00000000007F6000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.2894865972.0000000000800000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.2894887053.0000000000809000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_740000_Launches.jbxd

Similarity

API ID:
String ID: CALL
API String ID: 0-4196123274
Opcode ID: 39bef827b8f0072773c307f8b611f4a5c0f027fb1a6e1b7245489d1f412328e7
Instruction ID: fd4b78caa5f1f8f2dcfeb2c4805e61b038ec878628dfd20d2b48ed90ce49da63
Opcode Fuzzy Hash: 39bef827b8f0072773c307f8b611f4a5c0f027fb1a6e1b7245489d1f412328e7
Instruction Fuzzy Hash: BE325770608741DFCB24DF14C494A6AB7E1BF89344F15896DF88A9B362D739EC85CB82

Function 007BE139 Relevance: 3.2, APIs: 2, Instructions: 227COMMON

Download Yara Rule

APIs

_strcat.LIBCMT ref: 007BE20C

Part of subcall function 00744D37: __itow.LIBCMT ref: 00744D62
Part of subcall function 00744D37: __swprintf.LIBCMT ref: 00744DAC

_wcscpy.LIBCMT ref: 007BE29B

Memory Dump Source

Source File: 0000000A.00000002.2894756195.0000000000741000.00000020.00000001.01000000.00000006.sdmp, Offset: 00740000, based on PE: true

Associated: 0000000A.00000002.2894716076.0000000000740000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.2894810207.00000000007D0000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.2894810207.00000000007F6000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.2894865972.0000000000800000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.2894887053.0000000000809000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_740000_Launches.jbxd

Similarity

API ID: __itow__swprintf_strcat_wcscpy
String ID:
API String ID: 1012013722-0
Opcode ID: ab878a20d4b86f5256048cd426e8901ab3a7f2fb95dab94105e885d6ec965c9f
Instruction ID: 931ae38550fef61aa46ba8032b20c9c5b0dd3f4a5aaa768d0c983f3784e1f3ee
Opcode Fuzzy Hash: ab878a20d4b86f5256048cd426e8901ab3a7f2fb95dab94105e885d6ec965c9f
Instruction Fuzzy Hash: D6911535A00604DFCB18DF28C595AADB7F5EF49310B55809AF85A8F3A6DB38ED41CB81

Function 007A6135 Relevance: 3.1, APIs: 2, Instructions: 142COMMON

Download Yara Rule

APIs

CharLowerBuffW.USER32(?,?), ref: 007A614E

Memory Dump Source

Source File: 0000000A.00000002.2894756195.0000000000741000.00000020.00000001.01000000.00000006.sdmp, Offset: 00740000, based on PE: true

Associated: 0000000A.00000002.2894716076.0000000000740000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.2894810207.00000000007D0000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.2894810207.00000000007F6000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.2894865972.0000000000800000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.2894887053.0000000000809000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_740000_Launches.jbxd

Similarity

API ID: BuffCharLower
String ID:
API String ID: 2358735015-0
Opcode ID: aecf26859f71485664ecbcddd80404bc405ccf40daf8f49b87cbd07ab407e2ec
Instruction ID: e0a481ec9b6963cda7a93e290c56226f3c2d33e423d2029d23804b495d242fbf
Opcode Fuzzy Hash: aecf26859f71485664ecbcddd80404bc405ccf40daf8f49b87cbd07ab407e2ec
Instruction Fuzzy Hash: D641B7B6500209EFDB11DFA4C8819EE77B8FF95350B18462EE916D7281EB78DE44CB50

Function 007A7D6E Relevance: 3.1, APIs: 2, Instructions: 133COMMON

Download Yara Rule

APIs

_memmove.LIBCMT ref: 007A7E96

Memory Dump Source

Source File: 0000000A.00000002.2894756195.0000000000741000.00000020.00000001.01000000.00000006.sdmp, Offset: 00740000, based on PE: true

Associated: 0000000A.00000002.2894716076.0000000000740000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.2894810207.00000000007D0000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.2894810207.00000000007F6000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.2894865972.0000000000800000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.2894887053.0000000000809000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_740000_Launches.jbxd

Similarity

API ID: _memmove
String ID:
API String ID: 4104443479-0
Opcode ID: fff051c5351fdebea0f76ebdd73b19a0f19a6f31e57e8a58e251f94161cf2783
Instruction ID: 923fc04a3368bc7d81c879b273884e2ee919814b437a37212166697de8a39f71
Opcode Fuzzy Hash: fff051c5351fdebea0f76ebdd73b19a0f19a6f31e57e8a58e251f94161cf2783
Instruction Fuzzy Hash: E3410B7250C209EFC724EFA8CC85DBEB7A8EF9A340B244699F545D7241DB799C00DBA0

Function 00760E38 Relevance: 3.1, APIs: 2, Instructions: 94COMMON

Download Yara Rule

APIs

CloseHandle.KERNEL32 ref: 00760ED5
SetErrorMode.KERNEL32 ref: 00760EE7

Memory Dump Source

Source File: 0000000A.00000002.2894756195.0000000000741000.00000020.00000001.01000000.00000006.sdmp, Offset: 00740000, based on PE: true

Associated: 0000000A.00000002.2894716076.0000000000740000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.2894810207.00000000007D0000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.2894810207.00000000007F6000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.2894865972.0000000000800000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.2894887053.0000000000809000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_740000_Launches.jbxd

Similarity

API ID: CloseErrorHandleMode
String ID:
API String ID: 3953868439-0
Opcode ID: 160be14eaa7db79452b6aeb530136e2f2731e3e0b6e758b09a27e7bca35b483d
Instruction ID: 1aaa813090fd9cb2bab9e977c97562eb30146759e6cc2d67473f6b5e81480ecd
Opcode Fuzzy Hash: 160be14eaa7db79452b6aeb530136e2f2731e3e0b6e758b09a27e7bca35b483d
Instruction Fuzzy Hash: CE31C571A00119DFD719EF58D48496AF7A6FF59300B648AA5E80ACB251E73AEDC1CBC0

Function 00755F8B Relevance: 3.1, APIs: 2, Instructions: 59COMMON

Download Yara Rule

APIs

IsThemeActive.UXTHEME ref: 00755FEF

Part of subcall function 0076359C: __lock.LIBCMT ref: 007635A2
Part of subcall function 0076359C: DecodePointer.KERNEL32(00000001,?,00756004,00798892), ref: 007635AE
Part of subcall function 0076359C: EncodePointer.KERNEL32(?,?,00756004,00798892), ref: 007635B9

Part of subcall function 00755F00: SystemParametersInfoW.USER32(00002000,00000000,?,00000000), ref: 00755F18
Part of subcall function 00755F00: SystemParametersInfoW.USER32(00002001,00000000,00000000,00000002), ref: 00755F2D

Part of subcall function 00755240: GetCurrentDirectoryW.KERNEL32(00007FFF,?), ref: 0075526C
Part of subcall function 00755240: IsDebuggerPresent.KERNEL32 ref: 0075527E
Part of subcall function 00755240: GetFullPathNameW.KERNEL32(00007FFF,?,?), ref: 007552E6
Part of subcall function 00755240: SetCurrentDirectoryW.KERNEL32(?), ref: 00755366

SystemParametersInfoW.USER32(00002001,00000000,?,00000002), ref: 0075602F

Memory Dump Source

Source File: 0000000A.00000002.2894756195.0000000000741000.00000020.00000001.01000000.00000006.sdmp, Offset: 00740000, based on PE: true

Associated: 0000000A.00000002.2894716076.0000000000740000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.2894810207.00000000007D0000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.2894810207.00000000007F6000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.2894865972.0000000000800000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.2894887053.0000000000809000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_740000_Launches.jbxd

Similarity

API ID: InfoParametersSystem$CurrentDirectoryPointer$ActiveDebuggerDecodeEncodeFullNamePathPresentTheme__lock
String ID:
API String ID: 1438897964-0
Opcode ID: f3b8814b7e4555edf98d1a903a478483e6148913865b0c327ce42e78cbd9fe4c
Instruction ID: 98aba34d037cc648b9e61861841501739e4cee517f7144cbea164f4bcb168159
Opcode Fuzzy Hash: f3b8814b7e4555edf98d1a903a478483e6148913865b0c327ce42e78cbd9fe4c
Instruction Fuzzy Hash: 47116D71A08301DBC710DF69ED49A4ABBE8FF98710F40451EF485872B1DBB4A548CF96

Function 0076581D Relevance: 3.0, APIs: 2, Instructions: 42COMMONLIBRARYCODE

Download Yara Rule

APIs

_memset.LIBCMT ref: 0076584C
__lock_file.LIBCMT ref: 0076586D

Memory Dump Source

Source File: 0000000A.00000002.2894756195.0000000000741000.00000020.00000001.01000000.00000006.sdmp, Offset: 00740000, based on PE: true

Associated: 0000000A.00000002.2894716076.0000000000740000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.2894810207.00000000007D0000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.2894810207.00000000007F6000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.2894865972.0000000000800000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.2894887053.0000000000809000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_740000_Launches.jbxd

Similarity

API ID: __lock_file_memset
String ID:
API String ID: 26237723-0
Opcode ID: 6e0d2933fa3b242dd6d6167b06c52c96c10e3c065645eeabb8041a3fa8faa3a2
Instruction ID: d362c2053d3f2451ab6800b5270ce2115da8c171adc526883f131763d8630a3d
Opcode Fuzzy Hash: 6e0d2933fa3b242dd6d6167b06c52c96c10e3c065645eeabb8041a3fa8faa3a2
Instruction Fuzzy Hash: B6018471800649EBCF12AF69CC0989E7B61AF80760F144315FC2A2B1A1D7398A21EF92

Function 007655C6 Relevance: 3.0, APIs: 2, Instructions: 33COMMONLIBRARYCODE

Download Yara Rule

APIs

Part of subcall function 00768D58: __getptd_noexit.LIBCMT ref: 00768D58

__lock_file.LIBCMT ref: 0076560B

Part of subcall function 00766E3E: __lock.LIBCMT ref: 00766E61

__fclose_nolock.LIBCMT ref: 00765616

Memory Dump Source

Source File: 0000000A.00000002.2894756195.0000000000741000.00000020.00000001.01000000.00000006.sdmp, Offset: 00740000, based on PE: true

Associated: 0000000A.00000002.2894716076.0000000000740000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.2894810207.00000000007D0000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.2894810207.00000000007F6000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.2894865972.0000000000800000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.2894887053.0000000000809000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_740000_Launches.jbxd

Similarity

API ID: __fclose_nolock__getptd_noexit__lock__lock_file
String ID:
API String ID: 2800547568-0
Opcode ID: 54c1d89cfc24153d616db3b4dd4279896818689765da5cbee0a98b07f2162605
Instruction ID: c219d8a955e7984ba6f727a07981e3f4832f5f8f53b40c790327e4953b4dace7
Opcode Fuzzy Hash: 54c1d89cfc24153d616db3b4dd4279896818689765da5cbee0a98b07f2162605
Instruction Fuzzy Hash: 35F090B1901B05DAD7516B69C80E76E67A26F40730F158209BC2BAB1C2CB7C4901AF52

Function 00765E80 Relevance: 3.0, APIs: 2, Instructions: 29COMMON

Download Yara Rule

APIs

__lock_file.LIBCMT ref: 00765EB4
__ftell_nolock.LIBCMT ref: 00765EBF

Part of subcall function 00768D58: __getptd_noexit.LIBCMT ref: 00768D58

Memory Dump Source

Source File: 0000000A.00000002.2894756195.0000000000741000.00000020.00000001.01000000.00000006.sdmp, Offset: 00740000, based on PE: true

Associated: 0000000A.00000002.2894716076.0000000000740000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.2894810207.00000000007D0000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.2894810207.00000000007F6000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.2894865972.0000000000800000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.2894887053.0000000000809000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_740000_Launches.jbxd

Similarity

API ID: __ftell_nolock__getptd_noexit__lock_file
String ID:
API String ID: 2999321469-0
Opcode ID: 934dab847dd753ba4220868243b351e035e1f1dfcf898a4daec79a043b89d25a
Instruction ID: 334fdaf14fd1a1530e243ad7722cf2ceb1211f704bc97485c890989334e0be35
Opcode Fuzzy Hash: 934dab847dd753ba4220868243b351e035e1f1dfcf898a4daec79a043b89d25a
Instruction Fuzzy Hash: BDF0A771911619DADB40BB74C90A75E76906F01331F154306BC26AF1C1CF7C4E01AB56

Function 00755AC3 Relevance: 3.0, APIs: 2, Instructions: 25windowCOMMON

Download Yara Rule

APIs

_memset.LIBCMT ref: 00755AEF
Shell_NotifyIconW.SHELL32(00000002,?), ref: 00755B1F

Memory Dump Source

Source File: 0000000A.00000002.2894756195.0000000000741000.00000020.00000001.01000000.00000006.sdmp, Offset: 00740000, based on PE: true

Associated: 0000000A.00000002.2894716076.0000000000740000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.2894810207.00000000007D0000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.2894810207.00000000007F6000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.2894865972.0000000000800000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.2894887053.0000000000809000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_740000_Launches.jbxd

Similarity

API ID: IconNotifyShell__memset
String ID:
API String ID: 928536360-0
Opcode ID: 26ce6943d81ade48f4794841d88f886b67743ab65b6ed5d6eb1e7935fd923c1c
Instruction ID: 00c31ced2cad563111c40c9ef5e23e9c7ee7b7050aff3d87b9e334c92a1f57d3
Opcode Fuzzy Hash: 26ce6943d81ade48f4794841d88f886b67743ab65b6ed5d6eb1e7935fd923c1c
Instruction Fuzzy Hash: 22F0A770C093489FE7D28B64DC497D57BBCAB01308F0001EAAA4996292D7751B88CF95

Function 007632CF Relevance: 3.0, APIs: 2, Instructions: 7COMMONLIBRARYCODE

Download Yara Rule

APIs

___crtCorExitProcess.LIBCMT ref: 007632D5

Part of subcall function 0076329B: GetModuleHandleExW.KERNEL32(00000000,mscoree.dll,?,?,?,007632DA,00761003,?,00769EEE,000000FF,0000001E,007FCE28,00000008,00769E52,00761003,00761003), ref: 007632AA
Part of subcall function 0076329B: GetProcAddress.KERNEL32(?,CorExitProcess), ref: 007632BC

ExitProcess.KERNEL32 ref: 007632DE

Memory Dump Source

Source File: 0000000A.00000002.2894756195.0000000000741000.00000020.00000001.01000000.00000006.sdmp, Offset: 00740000, based on PE: true

Associated: 0000000A.00000002.2894716076.0000000000740000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.2894810207.00000000007D0000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.2894810207.00000000007F6000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.2894865972.0000000000800000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.2894887053.0000000000809000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_740000_Launches.jbxd

Similarity

API ID: ExitProcess$AddressHandleModuleProc___crt
String ID:
API String ID: 2427264223-0
Opcode ID: 60f19ad4c6374395e2bb7ff2d5aba9c6e5dc358b405987040dd1f85f1ad3b312
Instruction ID: 636f6be62c63c07b4bb7cca90f3dd35789a8ba79035623e3d3d0dbcb8bf1d710
Opcode Fuzzy Hash: 60f19ad4c6374395e2bb7ff2d5aba9c6e5dc358b405987040dd1f85f1ad3b312
Instruction Fuzzy Hash: 48B09230000208BFCB012F12DC0E8483F29FB00A90B408025F80508071DB76AE92DAC4

Function 007BC355 Relevance: 1.8, APIs: 1, Instructions: 288COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.2894756195.0000000000741000.00000020.00000001.01000000.00000006.sdmp, Offset: 00740000, based on PE: true

Associated: 0000000A.00000002.2894716076.0000000000740000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.2894810207.00000000007D0000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.2894810207.00000000007F6000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.2894865972.0000000000800000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.2894887053.0000000000809000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_740000_Launches.jbxd

Similarity

API ID: LoadString$__swprintf
String ID:
API String ID: 207118244-0
Opcode ID: 6e3e9341cd3178b5a534d505ae0fe5539a548659ba828c2173e0fd66c79a4c44
Instruction ID: 6789ef245f9c4e43915e0effdbe4ecb236048d0b5d081f31ffbe1d0b5ac4a8c3
Opcode Fuzzy Hash: 6e3e9341cd3178b5a534d505ae0fe5539a548659ba828c2173e0fd66c79a4c44
Instruction Fuzzy Hash: A7B15E34E0010ADFCB15DF94C895EEEB7B5FF48310F20811AF915AB291EB78A955CB90

Function 0074A820 Relevance: 1.7, APIs: 1, Instructions: 193COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.2894756195.0000000000741000.00000020.00000001.01000000.00000006.sdmp, Offset: 00740000, based on PE: true

Associated: 0000000A.00000002.2894716076.0000000000740000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.2894810207.00000000007D0000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.2894810207.00000000007F6000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.2894865972.0000000000800000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.2894887053.0000000000809000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_740000_Launches.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d8ca90573dbdc92e5c9a5cc6ec5feeb3c1a10bbad88b7a8e14aefd74e9613430
Instruction ID: 25f0f44034d7521fa7fcc2f2b64e464d63f3fbb0d51e967672fb415e1b00dc13
Opcode Fuzzy Hash: d8ca90573dbdc92e5c9a5cc6ec5feeb3c1a10bbad88b7a8e14aefd74e9613430
Instruction Fuzzy Hash: 9261DF74640606EFDB10EF54C885A7AB7E9FF48300F15812DE9168B292E778FD81CB61

Function 0075343F Relevance: 1.6, APIs: 1, Instructions: 103COMMON

Download Yara Rule

APIs

_memmove.LIBCMT ref: 0075351A

Memory Dump Source

Source File: 0000000A.00000002.2894756195.0000000000741000.00000020.00000001.01000000.00000006.sdmp, Offset: 00740000, based on PE: true

Associated: 0000000A.00000002.2894716076.0000000000740000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.2894810207.00000000007D0000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.2894810207.00000000007F6000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.2894865972.0000000000800000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.2894887053.0000000000809000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_740000_Launches.jbxd

Similarity

API ID: _memmove
String ID:
API String ID: 4104443479-0
Opcode ID: 544c0db461fe5687d1b22e364178f0e94cce9633798dc6ef396c6fb350ef1d63
Instruction ID: c57a23dfdaaa1598986e19eedbffc2b5e01685711ab79e42a7b8cf3b6dcd1a80
Opcode Fuzzy Hash: 544c0db461fe5687d1b22e364178f0e94cce9633798dc6ef396c6fb350ef1d63
Instruction Fuzzy Hash: 5231C075204602EFC724DF18D094AB2F7A0FF08391714C569ED8A8B761EB74E895CB90

Function 0077E2DF Relevance: 1.6, APIs: 1, Instructions: 88COMMON

Download Yara Rule

APIs

VariantClear.OLEAUT32 ref: 0077E2EA

Memory Dump Source

Source File: 0000000A.00000002.2894756195.0000000000741000.00000020.00000001.01000000.00000006.sdmp, Offset: 00740000, based on PE: true

Associated: 0000000A.00000002.2894716076.0000000000740000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.2894810207.00000000007D0000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.2894810207.00000000007F6000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.2894865972.0000000000800000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.2894887053.0000000000809000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_740000_Launches.jbxd

Similarity

API ID: ClearVariant
String ID:
API String ID: 1473721057-0
Opcode ID: 8bf2500edd158a04968c10319d182bde96686e1bbd481430e9269662cd87e167
Instruction ID: ad38adc525169126e518f12b190f9903fd60bbaf6692ca0c49ae603fdadd2b00
Opcode Fuzzy Hash: 8bf2500edd158a04968c10319d182bde96686e1bbd481430e9269662cd87e167
Instruction Fuzzy Hash: 08411974508351DFDB14DF14C598B1ABBE1BF45308F1989ACE88A8B362C379EC85CB92

Function 007549C2 Relevance: 1.6, APIs: 1, Instructions: 64libraryCOMMON

Download Yara Rule

APIs

Part of subcall function 00754B29: FreeLibrary.KERNEL32(00000000,?), ref: 00754B63

Part of subcall function 0076547B: __wfsopen.LIBCMT ref: 00765486

LoadLibraryExW.KERNEL32(?,00000000,00000002,?,?,007527AF,?,00000001), ref: 007549F4

Part of subcall function 00754ADE: FreeLibrary.KERNEL32(00000000), ref: 00754B18

Part of subcall function 007548B0: _memmove.LIBCMT ref: 007548FA

Memory Dump Source

Source File: 0000000A.00000002.2894756195.0000000000741000.00000020.00000001.01000000.00000006.sdmp, Offset: 00740000, based on PE: true

Associated: 0000000A.00000002.2894716076.0000000000740000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.2894810207.00000000007D0000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.2894810207.00000000007F6000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.2894865972.0000000000800000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.2894887053.0000000000809000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_740000_Launches.jbxd

Similarity

API ID: Library$Free$Load__wfsopen_memmove
String ID:
API String ID: 1396898556-0
Opcode ID: f0df71ad9ed09e279b17991985bfff75123794c8b5eb438217a482e191e973ce
Instruction ID: 9946a40fa0dad2018e7b354315a0c5373e3c0fe3e7eeff1192eaa0f5dbc1f76d
Opcode Fuzzy Hash: f0df71ad9ed09e279b17991985bfff75123794c8b5eb438217a482e191e973ce
Instruction Fuzzy Hash: 9F11C431650205EBCF14EB60CC0AFEE77A99F40706F108429F941B6182EAB99A58A794

Function 00751BCC Relevance: 1.6, APIs: 1, Instructions: 64COMMON

Download Yara Rule

APIs

_memmove.LIBCMT ref: 00751BFE

Memory Dump Source

Source File: 0000000A.00000002.2894756195.0000000000741000.00000020.00000001.01000000.00000006.sdmp, Offset: 00740000, based on PE: true

Associated: 0000000A.00000002.2894716076.0000000000740000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.2894810207.00000000007D0000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.2894810207.00000000007F6000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.2894865972.0000000000800000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.2894887053.0000000000809000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_740000_Launches.jbxd

Similarity

API ID: _memmove
String ID:
API String ID: 4104443479-0
Opcode ID: 2c79761423f540672bda14eb4514d80e2afe8b87cb0e6c2e844ebd02b31338ab
Instruction ID: fff844b01fe901c793c6fde323a1f45b557ff33fad8e16827fe8cdec263f91e4
Opcode Fuzzy Hash: 2c79761423f540672bda14eb4514d80e2afe8b87cb0e6c2e844ebd02b31338ab
Instruction Fuzzy Hash: 62118B76204601DFC724CF28D481A56F7F9FF48352B60C82EE88ACB261E776E841CB50

Function 0077E3C2 Relevance: 1.6, APIs: 1, Instructions: 63COMMON

Download Yara Rule

APIs

VariantClear.OLEAUT32(?), ref: 0077E3CE

Memory Dump Source

Source File: 0000000A.00000002.2894756195.0000000000741000.00000020.00000001.01000000.00000006.sdmp, Offset: 00740000, based on PE: true

Associated: 0000000A.00000002.2894716076.0000000000740000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.2894810207.00000000007D0000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.2894810207.00000000007F6000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.2894865972.0000000000800000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.2894887053.0000000000809000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_740000_Launches.jbxd

Similarity

API ID: ClearVariant
String ID:
API String ID: 1473721057-0
Opcode ID: b5d35cd34ac399e5dac0babd7801dd5cf93a3055339cec743722d52782156b69
Instruction ID: 874f1a7cea6267252ca03f470d60fbf24e742bd92a2325ad0a5fe8d4f8444c89
Opcode Fuzzy Hash: b5d35cd34ac399e5dac0babd7801dd5cf93a3055339cec743722d52782156b69
Instruction Fuzzy Hash: 492122B4608341DFCB14DF14C558B1ABBE1BF89304F09896CF88A57362C339E849CB92

Function 00751A36 Relevance: 1.5, APIs: 1, Instructions: 47COMMON

Download Yara Rule

APIs

_memmove.LIBCMT ref: 00751A77

Memory Dump Source

Source File: 0000000A.00000002.2894756195.0000000000741000.00000020.00000001.01000000.00000006.sdmp, Offset: 00740000, based on PE: true

Associated: 0000000A.00000002.2894716076.0000000000740000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.2894810207.00000000007D0000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.2894810207.00000000007F6000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.2894865972.0000000000800000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.2894887053.0000000000809000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_740000_Launches.jbxd

Similarity

API ID: _memmove
String ID:
API String ID: 4104443479-0
Opcode ID: 8565a2e206dddf4350968ef93c696b5c539dc39c822a590dc04b60a48f516eb7
Instruction ID: 39b21d043871748c57bc91876321d24e56036ca634dce9e61432113a943c6d5d
Opcode Fuzzy Hash: 8565a2e206dddf4350968ef93c696b5c539dc39c822a590dc04b60a48f516eb7
Instruction Fuzzy Hash: A9012672201701AEC7215B38CC0ABA7BB98DB447A1F50C52EFE1BCA1D1EA75E4408790

Function 007B495B Relevance: 1.5, APIs: 1, Instructions: 44COMMON

Download Yara Rule

APIs

GetEnvironmentVariableW.KERNEL32(?,?,00007FFF,00000000), ref: 007B4998

Memory Dump Source

Source File: 0000000A.00000002.2894756195.0000000000741000.00000020.00000001.01000000.00000006.sdmp, Offset: 00740000, based on PE: true

Associated: 0000000A.00000002.2894716076.0000000000740000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.2894810207.00000000007D0000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.2894810207.00000000007F6000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.2894865972.0000000000800000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.2894887053.0000000000809000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_740000_Launches.jbxd

Similarity

API ID: EnvironmentVariable
String ID:
API String ID: 1431749950-0
Opcode ID: 2a0ab604aa9bbdee03c6b8ba26897de7549bc3f334e129fb0a273f7f304b247d
Instruction ID: 33e8832898ec01d8620e1be69125793ea0fad2e44e5a3196bf744954a9c527d6
Opcode Fuzzy Hash: 2a0ab604aa9bbdee03c6b8ba26897de7549bc3f334e129fb0a273f7f304b247d
Instruction Fuzzy Hash: 41F03135608108FF8B14EB65D84ED9F77BCEF45320B444056F9059B261DE74BD41C7A0

Function 0077DC5A Relevance: 1.5, APIs: 1, Instructions: 32COMMON

Download Yara Rule

APIs

Part of subcall function 00760FE6: std::exception::exception.LIBCMT ref: 0076101C
Part of subcall function 00760FE6: __CxxThrowException@8.LIBCMT ref: 00761031

_memmove.LIBCMT ref: 0077DC8B

Memory Dump Source

Source File: 0000000A.00000002.2894756195.0000000000741000.00000020.00000001.01000000.00000006.sdmp, Offset: 00740000, based on PE: true

Associated: 0000000A.00000002.2894716076.0000000000740000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.2894810207.00000000007D0000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.2894810207.00000000007F6000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.2894865972.0000000000800000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.2894887053.0000000000809000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_740000_Launches.jbxd

Similarity

API ID: Exception@8Throw_memmovestd::exception::exception
String ID:
API String ID: 1602317333-0
Opcode ID: 45a849d2a6824c2a98c98ed0063ef32583db97a8290c264e89d73d06c63a9186
Instruction ID: 711cf1bddd21badc236fcd6c06d29509fc393643ded0687a8a1a28c9a53eb617
Opcode Fuzzy Hash: 45a849d2a6824c2a98c98ed0063ef32583db97a8290c264e89d73d06c63a9186
Instruction Fuzzy Hash: B8F01274604101EFD711DF68C545E15BBE1BF19340B24845CF68A8B352E737D811DB91

Function 00754A8C Relevance: 1.5, APIs: 1, Instructions: 31COMMON

Download Yara Rule

APIs

_fseek.LIBCMT ref: 00754AA4

Memory Dump Source

Source File: 0000000A.00000002.2894756195.0000000000741000.00000020.00000001.01000000.00000006.sdmp, Offset: 00740000, based on PE: true

Associated: 0000000A.00000002.2894716076.0000000000740000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.2894810207.00000000007D0000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.2894810207.00000000007F6000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.2894865972.0000000000800000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.2894887053.0000000000809000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_740000_Launches.jbxd

Similarity

API ID: _fseek
String ID:
API String ID: 2937370855-0
Opcode ID: d626904f6cb88cfd62378aba53a4cab051f17c1c31bafaeec442f62cde18398f
Instruction ID: dfba4430e4427de8b918ed1123da53ccf04b63fce44c1cc45e99997a4ed3bc2f
Opcode Fuzzy Hash: d626904f6cb88cfd62378aba53a4cab051f17c1c31bafaeec442f62cde18398f
Instruction Fuzzy Hash: 9AF085B6400208FFDF108F95EC04CEBBF79EB89324F148198FD045A210D272EA21DBA0

Function 00754A2F Relevance: 1.5, APIs: 1, Instructions: 28COMMON

Download Yara Rule

APIs

FreeLibrary.KERNEL32(?,?,?,007527AF,?,00000001), ref: 00754A63

Memory Dump Source

Source File: 0000000A.00000002.2894756195.0000000000741000.00000020.00000001.01000000.00000006.sdmp, Offset: 00740000, based on PE: true

Associated: 0000000A.00000002.2894716076.0000000000740000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.2894810207.00000000007D0000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.2894810207.00000000007F6000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.2894865972.0000000000800000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.2894887053.0000000000809000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_740000_Launches.jbxd

Similarity

API ID: FreeLibrary
String ID:
API String ID: 3664257935-0
Opcode ID: 9f107e77d85ce07625a79f83a5c41c9b8c6d45ad799c6d8c99a78711c2311ddc
Instruction ID: c5ebfd4932fe4aff2b7499954d79e4f4ef5b6a8e69ea84aeb06c288f815543b9
Opcode Fuzzy Hash: 9f107e77d85ce07625a79f83a5c41c9b8c6d45ad799c6d8c99a78711c2311ddc
Instruction Fuzzy Hash: C8F08C71541701CFCB748F24E484896BBF1AF0431A310C92EE9D783610C3799988DF44

Function 00754AB2 Relevance: 1.5, APIs: 1, Instructions: 27COMMON

Download Yara Rule

APIs

__fread_nolock.LIBCMT ref: 00754AD0

Memory Dump Source

Source File: 0000000A.00000002.2894756195.0000000000741000.00000020.00000001.01000000.00000006.sdmp, Offset: 00740000, based on PE: true

Associated: 0000000A.00000002.2894716076.0000000000740000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.2894810207.00000000007D0000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.2894810207.00000000007F6000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.2894865972.0000000000800000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.2894887053.0000000000809000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_740000_Launches.jbxd

Similarity

API ID: __fread_nolock
String ID:
API String ID: 2638373210-0
Opcode ID: 1a81c16e28573863898c67bef1386d759a1651ff521f05548b9e3597368886a1
Instruction ID: 581827d16ce2438c429f2cd12d13bab69c935d6ed056c2130f67e00e1c95e51f
Opcode Fuzzy Hash: 1a81c16e28573863898c67bef1386d759a1651ff521f05548b9e3597368886a1
Instruction Fuzzy Hash: 35F0F87240020DFFDF45CF90C945EAABB79FB14314F208589FD198B252D37AEA61AB91

Function 007609C5 Relevance: 1.5, APIs: 1, Instructions: 24COMMON

Download Yara Rule

APIs

GetLongPathNameW.KERNEL32(?,?,00007FFF), ref: 007609E4

Part of subcall function 00751821: _memmove.LIBCMT ref: 0075185B

Memory Dump Source

Source File: 0000000A.00000002.2894756195.0000000000741000.00000020.00000001.01000000.00000006.sdmp, Offset: 00740000, based on PE: true

Associated: 0000000A.00000002.2894716076.0000000000740000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.2894810207.00000000007D0000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.2894810207.00000000007F6000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.2894865972.0000000000800000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.2894887053.0000000000809000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_740000_Launches.jbxd

Similarity

API ID: LongNamePath_memmove
String ID:
API String ID: 2514874351-0
Opcode ID: 308b4e1e097bac95130a9e25825e9e52c0300237ddbfd5f5bfefaed341798cba
Instruction ID: 26dee5c25b2765f8fbcb216a95995bce477f2e39f416e5253f457b16059b7d60
Opcode Fuzzy Hash: 308b4e1e097bac95130a9e25825e9e52c0300237ddbfd5f5bfefaed341798cba
Instruction Fuzzy Hash: 84E0863290012857C721969C9C09FEE77EDDB896A1F0442B7FC0CD7214D965AC8186D1

Function 007A3EF7 Relevance: 1.5, APIs: 1, Instructions: 19COMMON

Download Yara Rule

APIs

CopyFileExW.KERNEL32(?,?,00000000,00000000,00000000,00000008,?,?,007A3E7D,?,?,?), ref: 007A3F0D

Memory Dump Source

Source File: 0000000A.00000002.2894756195.0000000000741000.00000020.00000001.01000000.00000006.sdmp, Offset: 00740000, based on PE: true

Associated: 0000000A.00000002.2894716076.0000000000740000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.2894810207.00000000007D0000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.2894810207.00000000007F6000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.2894865972.0000000000800000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.2894887053.0000000000809000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_740000_Launches.jbxd

Similarity

API ID: CopyFile
String ID:
API String ID: 1304948518-0
Opcode ID: 52ed28cceaaa36669c8b2f715d63bbbf5cc4a2d7e6e7e7542c1fbeb0f0e479b7
Instruction ID: 4195bdf5b6fa9362873853e7d98746ada0cd6df7a1146411d129f8be3eefddaa
Opcode Fuzzy Hash: 52ed28cceaaa36669c8b2f715d63bbbf5cc4a2d7e6e7e7542c1fbeb0f0e479b7
Instruction Fuzzy Hash: 8CD0A7315E120CBBEF50DFA0CC06F68B7BCE701706F1002A4B504D90E0DA76691497A5

Function 007A4FEC Relevance: 1.5, APIs: 1, Instructions: 10COMMON

Download Yara Rule

APIs

GetFileAttributesW.KERNEL32(?,007A3BFE), ref: 007A4FED

Memory Dump Source

Source File: 0000000A.00000002.2894756195.0000000000741000.00000020.00000001.01000000.00000006.sdmp, Offset: 00740000, based on PE: true

Associated: 0000000A.00000002.2894716076.0000000000740000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.2894810207.00000000007D0000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.2894810207.00000000007F6000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.2894865972.0000000000800000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.2894887053.0000000000809000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_740000_Launches.jbxd

Similarity

API ID: AttributesFile
String ID:
API String ID: 3188754299-0
Opcode ID: 9f0c3bc6f326841af27808b9801cb6004f95bc30c7c1b538fd498c756a3ebfb2
Instruction ID: d2fdd01f714282a688febf8dea4e37f40a5e633a5041b8b5fe64b351e3fc2a74
Opcode Fuzzy Hash: 9f0c3bc6f326841af27808b9801cb6004f95bc30c7c1b538fd498c756a3ebfb2
Instruction Fuzzy Hash: 76B092360416005E9D281E3C194819D37919BC33A9BDC3B82E478854E1927F884BA520

Function 0076547B Relevance: 1.5, APIs: 1, Instructions: 9COMMON

Download Yara Rule

APIs

__wfsopen.LIBCMT ref: 00765486

Memory Dump Source

Source File: 0000000A.00000002.2894756195.0000000000741000.00000020.00000001.01000000.00000006.sdmp, Offset: 00740000, based on PE: true

Associated: 0000000A.00000002.2894716076.0000000000740000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.2894810207.00000000007D0000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.2894810207.00000000007F6000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.2894865972.0000000000800000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.2894887053.0000000000809000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_740000_Launches.jbxd

Similarity

API ID: __wfsopen
String ID:
API String ID: 197181222-0
Opcode ID: 6ddf6e1ab81d7b85eaff3423c11cf18e9f26fa56f97d638f5b10e7f164e3c6f3
Instruction ID: 318ca154e947099543f2a566d0b96bcbbea91410e06e06c4054abfa5da9fad8c
Opcode Fuzzy Hash: 6ddf6e1ab81d7b85eaff3423c11cf18e9f26fa56f97d638f5b10e7f164e3c6f3
Instruction Fuzzy Hash: 38B0927644020CB7CE012A82EC03E593F299B40668F408060FF0C1C162AA77AAA0A689

Function 00763588 Relevance: 1.5, APIs: 1, Instructions: 9COMMON

Download Yara Rule

APIs

_doexit.LIBCMT ref: 00763592

Part of subcall function 00763459: __lock.LIBCMT ref: 00763467
Part of subcall function 00763459: DecodePointer.KERNEL32(007FCB70,0000001C,007633B2,00761003,00000001,00000000,?,00763300,000000FF,?,00769E5E,00000011,00761003,?,00769CAC,0000000D), ref: 007634A6
Part of subcall function 00763459: DecodePointer.KERNEL32(?,00763300,000000FF,?,00769E5E,00000011,00761003,?,00769CAC,0000000D), ref: 007634B7
Part of subcall function 00763459: EncodePointer.KERNEL32(00000000,?,00763300,000000FF,?,00769E5E,00000011,00761003,?,00769CAC,0000000D), ref: 007634D0
Part of subcall function 00763459: DecodePointer.KERNEL32(-00000004,?,00763300,000000FF,?,00769E5E,00000011,00761003,?,00769CAC,0000000D), ref: 007634E0
Part of subcall function 00763459: EncodePointer.KERNEL32(00000000,?,00763300,000000FF,?,00769E5E,00000011,00761003,?,00769CAC,0000000D), ref: 007634E6
Part of subcall function 00763459: DecodePointer.KERNEL32(?,00763300,000000FF,?,00769E5E,00000011,00761003,?,00769CAC,0000000D), ref: 007634FC
Part of subcall function 00763459: DecodePointer.KERNEL32(?,00763300,000000FF,?,00769E5E,00000011,00761003,?,00769CAC,0000000D), ref: 00763507

Memory Dump Source

Source File: 0000000A.00000002.2894756195.0000000000741000.00000020.00000001.01000000.00000006.sdmp, Offset: 00740000, based on PE: true

Associated: 0000000A.00000002.2894716076.0000000000740000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.2894810207.00000000007D0000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.2894810207.00000000007F6000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.2894865972.0000000000800000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.2894887053.0000000000809000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_740000_Launches.jbxd

Similarity

API ID: Pointer$Decode$Encode$__lock_doexit
String ID:
API String ID: 2158581194-0
Opcode ID: e664eab0a2f8ce3703c552baf369986a84cdf03d3e0bf670d1975cdb5f15a4fc
Instruction ID: 0e200c6c8a9e23632b3664aae9beda43d7af11af06e12b42e38f258d7290d325
Opcode Fuzzy Hash: e664eab0a2f8ce3703c552baf369986a84cdf03d3e0bf670d1975cdb5f15a4fc
Instruction Fuzzy Hash: 8BB0127198030C73DA112541EC03F257F0C4740B60F100021FE0C1C1E1A9D3766080C9

Function 007AC270 Relevance: 1.3, APIs: 1, Instructions: 31COMMON

Download Yara Rule

APIs

Part of subcall function 007A4005: FindFirstFileW.KERNEL32(?,?), ref: 007A407C
Part of subcall function 007A4005: DeleteFileW.KERNEL32(?,?,?,?), ref: 007A40CC
Part of subcall function 007A4005: FindNextFileW.KERNELBASE(00000000,00000010), ref: 007A40DD
Part of subcall function 007A4005: FindClose.KERNEL32(00000000), ref: 007A40F4

GetLastError.KERNEL32 ref: 007AC292

Memory Dump Source

Source File: 0000000A.00000002.2894756195.0000000000741000.00000020.00000001.01000000.00000006.sdmp, Offset: 00740000, based on PE: true

Associated: 0000000A.00000002.2894716076.0000000000740000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.2894810207.00000000007D0000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.2894810207.00000000007F6000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.2894865972.0000000000800000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.2894887053.0000000000809000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_740000_Launches.jbxd

Similarity

API ID: FileFind$CloseDeleteErrorFirstLastNext
String ID:
API String ID: 2191629493-0
Opcode ID: fcbd9bbe5f337ff1eb19d6aa64498e89c29506e1df074ec74b538bb0f15113cb
Instruction ID: 5cd2e1d361a7cf1f020af3c338fc705591c9db119635e5a1652a1c7cca42956c
Opcode Fuzzy Hash: fcbd9bbe5f337ff1eb19d6aa64498e89c29506e1df074ec74b538bb0f15113cb
Instruction Fuzzy Hash: 52F08C323102109FCB10EF59D858B6AB7E5AF89320F058059FA498B352CB78BC01DB94

Non-executed Functions

Function 007CD164 Relevance: 74.1, APIs: 40, Strings: 2, Instructions: 637windowkeyboardCOMMON

Download Yara Rule

APIs

Part of subcall function 007429E2: GetWindowLongW.USER32(?,000000EB), ref: 007429F3

DefDlgProcW.USER32(?,0000004E,?,?,?,?,?,?), ref: 007CD208
SendMessageW.USER32(?,0000130B,00000000,00000000), ref: 007CD249
GetWindowLongW.USER32(FFFFFDD9,000000F0), ref: 007CD28E
SendMessageW.USER32(?,0000110A,00000009,00000000), ref: 007CD2B8
SendMessageW.USER32 ref: 007CD2E1
_wcsncpy.LIBCMT ref: 007CD359
GetKeyState.USER32(00000011), ref: 007CD37A
GetKeyState.USER32(00000009), ref: 007CD387
SendMessageW.USER32(?,0000130B,00000000,00000000), ref: 007CD39D
GetKeyState.USER32(00000010), ref: 007CD3A7
SendMessageW.USER32(?,0000110A,00000009,00000000), ref: 007CD3D0
SendMessageW.USER32 ref: 007CD3F7
SendMessageW.USER32(?,00001030,?,007CB9BA), ref: 007CD4FD
ImageList_SetDragCursorImage.COMCTL32(00000000,00000000,00000000,?,?,?), ref: 007CD513
ImageList_BeginDrag.COMCTL32(00000000,000000F8,000000F0), ref: 007CD526
SetCapture.USER32(?), ref: 007CD52F
ClientToScreen.USER32(?,?), ref: 007CD594
ImageList_DragEnter.COMCTL32(00000000,?,?), ref: 007CD5A1
InvalidateRect.USER32(?,00000000,00000001,?,?,?), ref: 007CD5BB
ReleaseCapture.USER32 ref: 007CD5C6
GetCursorPos.USER32(?), ref: 007CD600
ScreenToClient.USER32(?,?), ref: 007CD60D
SendMessageW.USER32(?,00001012,00000000,?), ref: 007CD669
SendMessageW.USER32 ref: 007CD697
SendMessageW.USER32(?,00001111,00000000,?), ref: 007CD6D4
SendMessageW.USER32 ref: 007CD703
SendMessageW.USER32(?,0000110B,00000009,00000000), ref: 007CD724
SendMessageW.USER32(?,0000110B,00000009,?), ref: 007CD733
GetCursorPos.USER32(?), ref: 007CD753
ScreenToClient.USER32(?,?), ref: 007CD760
GetParent.USER32(?), ref: 007CD780
SendMessageW.USER32(?,00001012,00000000,?), ref: 007CD7E9
SendMessageW.USER32 ref: 007CD81A
ClientToScreen.USER32(?,?), ref: 007CD878
TrackPopupMenuEx.USER32(?,00000000,?,?,?,00000000), ref: 007CD8A8
SendMessageW.USER32(?,00001111,00000000,?), ref: 007CD8D2
SendMessageW.USER32 ref: 007CD8F5
ClientToScreen.USER32(?,?), ref: 007CD947
TrackPopupMenuEx.USER32(?,00000080,?,?,?,00000000), ref: 007CD97B

Part of subcall function 007429AB: GetWindowLongW.USER32(?,000000EB), ref: 007429BC

GetWindowLongW.USER32(?,000000F0), ref: 007CDA17

Strings

@GUI_DRAGID, xrefs: 007CD562
F, xrefs: 007CD8FB

Memory Dump Source

Source File: 0000000A.00000002.2894756195.0000000000741000.00000020.00000001.01000000.00000006.sdmp, Offset: 00740000, based on PE: true

Associated: 0000000A.00000002.2894716076.0000000000740000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.2894810207.00000000007D0000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.2894810207.00000000007F6000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.2894865972.0000000000800000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.2894887053.0000000000809000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_740000_Launches.jbxd

Similarity

API ID: MessageSend$ClientScreen$ImageLongWindow$CursorDragList_State$CaptureMenuPopupTrack$BeginEnterInvalidateParentProcRectRelease_wcsncpy
String ID: @GUI_DRAGID$F
API String ID: 3977979337-4164748364
Opcode ID: 5d54656f4c6b8db489db9ee52930f5a51e54d304e1ad9c613ea0e23d6586f299
Instruction ID: 0ba478679c042deff4dc8bcee8069e57eaaf60305e7f2b337335d6bceb50c18b
Opcode Fuzzy Hash: 5d54656f4c6b8db489db9ee52930f5a51e54d304e1ad9c613ea0e23d6586f299
Instruction Fuzzy Hash: 11427834604241EFD7259F28C848FAABBE5FF88310F18462DF695872A1C779EC55CB92

Function 00798F2E Relevance: 35.2, APIs: 17, Strings: 3, Instructions: 224COMMON

Download Yara Rule

APIs

Part of subcall function 00799399: LookupPrivilegeValueW.ADVAPI32(00000000,00000000,00000004), ref: 007993E3
Part of subcall function 00799399: AdjustTokenPrivileges.ADVAPI32(?,00000000,00000000,?,00000000,?), ref: 00799410
Part of subcall function 00799399: GetLastError.KERNEL32 ref: 0079941D

_memset.LIBCMT ref: 00798F71
DuplicateTokenEx.ADVAPI32(?,00000000,00000000,00000002,00000001,?,?,?,?,00000001,?,?), ref: 00798FC3
CloseHandle.KERNEL32(?), ref: 00798FD4
OpenWindowStationW.USER32(winsta0,00000000,00060000), ref: 00798FEB
GetProcessWindowStation.USER32 ref: 00799004
SetProcessWindowStation.USER32(00000000), ref: 0079900E
OpenDesktopW.USER32(default,00000000,00000000,00060081), ref: 00799028

Part of subcall function 00798DE9: AdjustTokenPrivileges.ADVAPI32(?,00000000,?,00000000,00000000,00000000,?,00798F27), ref: 00798DFE
Part of subcall function 00798DE9: CloseHandle.KERNEL32(?,?,00798F27), ref: 00798E10

Strings

, xrefs: 00798F80
winsta0, xrefs: 00798FE6
default, xrefs: 00799023

Memory Dump Source

Source File: 0000000A.00000002.2894756195.0000000000741000.00000020.00000001.01000000.00000006.sdmp, Offset: 00740000, based on PE: true

Associated: 0000000A.00000002.2894716076.0000000000740000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.2894810207.00000000007D0000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.2894810207.00000000007F6000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.2894865972.0000000000800000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.2894887053.0000000000809000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_740000_Launches.jbxd

Similarity

API ID: StationTokenWindow$AdjustCloseHandleOpenPrivilegesProcess$DesktopDuplicateErrorLastLookupPrivilegeValue_memset
String ID: $default$winsta0
API String ID: 2063423040-1027155976
Opcode ID: aa6164e75e43163394bc4c2a13c5b087f6b9df85bb3304b14a17ad27279bba92
Instruction ID: 43bc8032144815d577f0d8ac21e1361f18223da8b884fed4d43b29998aa492fd
Opcode Fuzzy Hash: aa6164e75e43163394bc4c2a13c5b087f6b9df85bb3304b14a17ad27279bba92
Instruction Fuzzy Hash: C3817CB190120DFFEF119FA8ED49AEE7B79FF04304F04811AFA10A6261D73A8E159B51

Function 007B4632 Relevance: 30.2, APIs: 20, Instructions: 167clipboardCOMMON

Download Yara Rule

APIs

OpenClipboard.USER32(007D0980), ref: 007B465C
IsClipboardFormatAvailable.USER32(0000000D), ref: 007B466A
GetClipboardData.USER32(0000000D), ref: 007B4672
CloseClipboard.USER32 ref: 007B467E
GlobalLock.KERNEL32(00000000), ref: 007B469A
CloseClipboard.USER32 ref: 007B46A4
GlobalUnlock.KERNEL32(00000000), ref: 007B46B9
IsClipboardFormatAvailable.USER32(00000001), ref: 007B46C6
GetClipboardData.USER32(00000001), ref: 007B46CE
GlobalLock.KERNEL32(00000000), ref: 007B46DB
GlobalUnlock.KERNEL32(00000000), ref: 007B470F
CloseClipboard.USER32 ref: 007B481F

Memory Dump Source

Source File: 0000000A.00000002.2894756195.0000000000741000.00000020.00000001.01000000.00000006.sdmp, Offset: 00740000, based on PE: true

Associated: 0000000A.00000002.2894716076.0000000000740000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.2894810207.00000000007D0000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.2894810207.00000000007F6000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.2894865972.0000000000800000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.2894887053.0000000000809000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_740000_Launches.jbxd

Similarity

API ID: Clipboard$Global$Close$AvailableDataFormatLockUnlock$Open
String ID:
API String ID: 3222323430-0
Opcode ID: 650c1e841c81c8810d5f96c7ff655d326db4e65005adc9b32600e8a4c0cf310b
Instruction ID: 13ff44bc92a485ba8c74f45b4bf2951a782dae41cbdaf985389b0bffa902143a
Opcode Fuzzy Hash: 650c1e841c81c8810d5f96c7ff655d326db4e65005adc9b32600e8a4c0cf310b
Instruction Fuzzy Hash: 5F51B471245201ABD700EF60DC89FAE77B8BF85B11F04452AF956D21E2DF78D904CBA6

Function 007AF5D8 Relevance: 29.9, APIs: 15, Strings: 2, Instructions: 119fileCOMMON

Download Yara Rule

APIs

FindFirstFileW.KERNEL32(?,?,74DE8FB0,?,00000000), ref: 007AF5F9
_wcscmp.LIBCMT ref: 007AF60E
_wcscmp.LIBCMT ref: 007AF625
GetFileAttributesW.KERNEL32(?), ref: 007AF637
SetFileAttributesW.KERNEL32(?,?), ref: 007AF651
FindNextFileW.KERNEL32(00000000,?), ref: 007AF669
FindClose.KERNEL32(00000000), ref: 007AF674
FindFirstFileW.KERNEL32(*.*,?), ref: 007AF690
_wcscmp.LIBCMT ref: 007AF6B7
_wcscmp.LIBCMT ref: 007AF6CE
SetCurrentDirectoryW.KERNEL32(?), ref: 007AF6E0
SetCurrentDirectoryW.KERNEL32(007FB578), ref: 007AF6FE
FindNextFileW.KERNEL32(00000000,00000010), ref: 007AF708
FindClose.KERNEL32(00000000), ref: 007AF715
FindClose.KERNEL32(00000000), ref: 007AF727

Strings

*.*, xrefs: 007AF68B
Sz, xrefs: 007AF6E2

Memory Dump Source

Source File: 0000000A.00000002.2894756195.0000000000741000.00000020.00000001.01000000.00000006.sdmp, Offset: 00740000, based on PE: true

Associated: 0000000A.00000002.2894716076.0000000000740000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.2894810207.00000000007D0000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.2894810207.00000000007F6000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.2894865972.0000000000800000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.2894887053.0000000000809000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_740000_Launches.jbxd

Similarity

API ID: Find$File$_wcscmp$Close$AttributesCurrentDirectoryFirstNext
String ID: *.*$Sz
API String ID: 1803514871-885807242
Opcode ID: bef1e6969eded6c0188b6b6fa9e88e3f8823ecd3e2ee9020b3297cb8190cc07d
Instruction ID: e1ff0a4acbd44e202d84d22a5d262c0a001a20b2bc2e4d2930ceafb3d96474ca
Opcode Fuzzy Hash: bef1e6969eded6c0188b6b6fa9e88e3f8823ecd3e2ee9020b3297cb8190cc07d
Instruction Fuzzy Hash: E831B67154221DAADB10DBF4DC4DAEE77BCAF4A321F104266F905E31A0DB3CDA44CA64

Function 007ACD9F Relevance: 28.3, APIs: 13, Strings: 3, Instructions: 280timefileCOMMON

Download Yara Rule

APIs

FindFirstFileW.KERNEL32(?,?), ref: 007ACDD0
FindClose.KERNEL32(00000000), ref: 007ACE24
FileTimeToLocalFileTime.KERNEL32(?,?), ref: 007ACE49
FileTimeToLocalFileTime.KERNEL32(?,?), ref: 007ACE60
FileTimeToSystemTime.KERNEL32(?,?), ref: 007ACE87
__swprintf.LIBCMT ref: 007ACED3
__swprintf.LIBCMT ref: 007ACF16

Part of subcall function 00751A36: _memmove.LIBCMT ref: 00751A77

__swprintf.LIBCMT ref: 007ACF6A

Part of subcall function 007638C8: __woutput_l.LIBCMT ref: 00763921

__swprintf.LIBCMT ref: 007ACFB8

Part of subcall function 007638C8: __flsbuf.LIBCMT ref: 00763943
Part of subcall function 007638C8: __flsbuf.LIBCMT ref: 0076395B

__swprintf.LIBCMT ref: 007AD007
__swprintf.LIBCMT ref: 007AD056
__swprintf.LIBCMT ref: 007AD0A5

Strings

%4d, xrefs: 007ACF10
%02d, xrefs: 007ACF5E, 007ACF68, 007ACFB6, 007AD005, 007AD054, 007AD0A3
%4d%02d%02d%02d%02d%02d, xrefs: 007ACECD

Memory Dump Source

Source File: 0000000A.00000002.2894756195.0000000000741000.00000020.00000001.01000000.00000006.sdmp, Offset: 00740000, based on PE: true

Associated: 0000000A.00000002.2894716076.0000000000740000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.2894810207.00000000007D0000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.2894810207.00000000007F6000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.2894865972.0000000000800000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.2894887053.0000000000809000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_740000_Launches.jbxd

Similarity

API ID: __swprintf$FileTime$FindLocal__flsbuf$CloseFirstSystem__woutput_l_memmove
String ID: %02d$%4d$%4d%02d%02d%02d%02d%02d
API String ID: 3953360268-2428617273
Opcode ID: 3c8bf093027e78269511cae39e07c858a03b62c2fe735e457ee182eeebd82158
Instruction ID: d326f2dfc966bb107d9fd876b3126b6bb1ad16bb7c2ccc92992afd7ad88c06a8
Opcode Fuzzy Hash: 3c8bf093027e78269511cae39e07c858a03b62c2fe735e457ee182eeebd82158
Instruction Fuzzy Hash: 5DA15EB1408305EBC711EF64D989EAFB7ECBF94701F404919F58583191EB78EA08CBA2

Function 007C0EB7 Relevance: 26.7, APIs: 9, Strings: 6, Instructions: 477registryCOMMON

Download Yara Rule

APIs

RegConnectRegistryW.ADVAPI32(?,?,?), ref: 007C0FB3
RegCreateKeyExW.ADVAPI32(?,?,00000000,007D0980,00000000,?,00000000,?,?), ref: 007C1021
RegCloseKey.ADVAPI32(00000000,00000001,00000000,00000000,00000000), ref: 007C1069
RegSetValueExW.ADVAPI32(00000001,?,00000000,00000002,?), ref: 007C10F2
RegCloseKey.ADVAPI32(?), ref: 007C1412
RegCloseKey.ADVAPI32(00000000), ref: 007C141F

Strings

REG_QWORD, xrefs: 007C1360
REG_DWORD, xrefs: 007C12E3
REG_BINARY, xrefs: 007C13AD
REG_EXPAND_SZ, xrefs: 007C108F
REG_SZ, xrefs: 007C1130
REG_MULTI_SZ, xrefs: 007C11DA

Memory Dump Source

Source File: 0000000A.00000002.2894756195.0000000000741000.00000020.00000001.01000000.00000006.sdmp, Offset: 00740000, based on PE: true

Associated: 0000000A.00000002.2894716076.0000000000740000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.2894810207.00000000007D0000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.2894810207.00000000007F6000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.2894865972.0000000000800000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.2894887053.0000000000809000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_740000_Launches.jbxd

Similarity

API ID: Close$ConnectCreateRegistryValue
String ID: REG_BINARY$REG_DWORD$REG_EXPAND_SZ$REG_MULTI_SZ$REG_QWORD$REG_SZ
API String ID: 536824911-966354055
Opcode ID: a743d8de7b8d16d04114ad232567ad54e06567a365d89d27041d3d6d1e1b5c12
Instruction ID: de21aac2c116b91240cb79dbd2c9c6dcca2c7afff4365bc029ff11539f7ca34f
Opcode Fuzzy Hash: a743d8de7b8d16d04114ad232567ad54e06567a365d89d27041d3d6d1e1b5c12
Instruction Fuzzy Hash: 75023575600601DFCB14EF24C859F2AB7E5EF89714F04896DF98A9B262CB38ED41CB91

Function 007AF735 Relevance: 26.4, APIs: 13, Strings: 2, Instructions: 112fileCOMMON

Download Yara Rule

APIs

FindFirstFileW.KERNEL32(?,?,74DE8FB0,?,00000000), ref: 007AF756
_wcscmp.LIBCMT ref: 007AF76B
_wcscmp.LIBCMT ref: 007AF782

Part of subcall function 007A4875: CreateFileW.KERNEL32(?,40000000,00000001,00000000,00000003,02000080,00000000), ref: 007A4890

FindNextFileW.KERNEL32(00000000,?), ref: 007AF7B1
FindClose.KERNEL32(00000000), ref: 007AF7BC
FindFirstFileW.KERNEL32(*.*,?), ref: 007AF7D8
_wcscmp.LIBCMT ref: 007AF7FF
_wcscmp.LIBCMT ref: 007AF816
SetCurrentDirectoryW.KERNEL32(?), ref: 007AF828
SetCurrentDirectoryW.KERNEL32(007FB578), ref: 007AF846
FindNextFileW.KERNEL32(00000000,00000010), ref: 007AF850
FindClose.KERNEL32(00000000), ref: 007AF85D
FindClose.KERNEL32(00000000), ref: 007AF86F

Strings

*.*, xrefs: 007AF7D3
jz, xrefs: 007AF82A

Memory Dump Source

Source File: 0000000A.00000002.2894756195.0000000000741000.00000020.00000001.01000000.00000006.sdmp, Offset: 00740000, based on PE: true

Associated: 0000000A.00000002.2894716076.0000000000740000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.2894810207.00000000007D0000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.2894810207.00000000007F6000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.2894865972.0000000000800000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.2894887053.0000000000809000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_740000_Launches.jbxd

Similarity

API ID: Find$File$_wcscmp$Close$CurrentDirectoryFirstNext$Create
String ID: *.*$jz
API String ID: 1824444939-2566750845
Opcode ID: 214b2680cbcb416ca50465abcec87fe23b09fa2bc1afbd4cd13f24a123b2d024
Instruction ID: 29f77f81ce0967fac5b903bf1b3dd1f7a93156d2fc5a5177a1162650f863e716
Opcode Fuzzy Hash: 214b2680cbcb416ca50465abcec87fe23b09fa2bc1afbd4cd13f24a123b2d024
Instruction Fuzzy Hash: F631A77150121DAADB10ABB4DC48ADE777CAF8A321F104266E914A31A0D73CDA55CA64

Function 007988CD Relevance: 21.2, APIs: 14, Instructions: 179memoryCOMMON

Download Yara Rule

APIs

Part of subcall function 00798E20: GetUserObjectSecurity.USER32(?,00000004,?,00000000,?), ref: 00798E3C
Part of subcall function 00798E20: GetLastError.KERNEL32(?,00798900,?,?,?), ref: 00798E46
Part of subcall function 00798E20: GetProcessHeap.KERNEL32(00000008,?,?,00798900,?,?,?), ref: 00798E55
Part of subcall function 00798E20: HeapAlloc.KERNEL32(00000000,?,00798900,?,?,?), ref: 00798E5C
Part of subcall function 00798E20: GetUserObjectSecurity.USER32(?,00000004,00000000,?,?), ref: 00798E73

Part of subcall function 00798EBD: GetProcessHeap.KERNEL32(00000008,00798916,00000000,00000000,?,00798916,?), ref: 00798EC9
Part of subcall function 00798EBD: HeapAlloc.KERNEL32(00000000,?,00798916,?), ref: 00798ED0
Part of subcall function 00798EBD: InitializeSecurityDescriptor.ADVAPI32(00000000,00000001,?,00798916,?), ref: 00798EE1

GetSecurityDescriptorDacl.ADVAPI32(?,?,?,?), ref: 00798931
_memset.LIBCMT ref: 00798946
GetAclInformation.ADVAPI32(?,?,0000000C,00000002), ref: 00798965
GetLengthSid.ADVAPI32(?), ref: 00798976
GetAce.ADVAPI32(?,00000000,?), ref: 007989B3
AddAce.ADVAPI32(?,00000002,000000FF,?,?), ref: 007989CF
GetLengthSid.ADVAPI32(?), ref: 007989EC
GetProcessHeap.KERNEL32(00000008,-00000008), ref: 007989FB
HeapAlloc.KERNEL32(00000000), ref: 00798A02
GetLengthSid.ADVAPI32(?,00000008,?), ref: 00798A23
CopySid.ADVAPI32(00000000), ref: 00798A2A
AddAce.ADVAPI32(?,00000002,000000FF,00000000,?), ref: 00798A5B
SetSecurityDescriptorDacl.ADVAPI32(?,00000001,?,00000000), ref: 00798A81
SetUserObjectSecurity.USER32(?,00000004,?), ref: 00798A95

Memory Dump Source

Source File: 0000000A.00000002.2894756195.0000000000741000.00000020.00000001.01000000.00000006.sdmp, Offset: 00740000, based on PE: true

Associated: 0000000A.00000002.2894716076.0000000000740000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.2894810207.00000000007D0000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.2894810207.00000000007F6000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.2894865972.0000000000800000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.2894887053.0000000000809000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_740000_Launches.jbxd

Similarity

API ID: HeapSecurity$AllocDescriptorLengthObjectProcessUser$Dacl$CopyErrorInformationInitializeLast_memset
String ID:
API String ID: 3996160137-0
Opcode ID: 16d1e57bec93abd85139bed9b717058b36247fd94be8373c11a06d12107a62af
Instruction ID: 406088023b83f462b3170a00bcaa50bebcbaf09062d05e972f1cc2fda6b85402
Opcode Fuzzy Hash: 16d1e57bec93abd85139bed9b717058b36247fd94be8373c11a06d12107a62af
Instruction Fuzzy Hash: F7615C75A00109FFDF40DFA5EC49EEEBB79FF45300F04811AE915AA290DB399A05CBA5

Function 007C0A3A Relevance: 16.9, APIs: 11, Instructions: 397registryCOMMON

Download Yara Rule

APIs

Part of subcall function 007C147A: CharUpperBuffW.USER32(?,?,?,?,?,?,?,007C040D,?,?), ref: 007C1491

RegConnectRegistryW.ADVAPI32(?,?,?), ref: 007C0B0C

Part of subcall function 00744D37: __itow.LIBCMT ref: 00744D62
Part of subcall function 00744D37: __swprintf.LIBCMT ref: 00744DAC

RegQueryValueExW.ADVAPI32(?,?,00000000,?,00000000,?), ref: 007C0BAB
RegQueryValueExW.ADVAPI32(?,?,00000000,00000000,?,00000008), ref: 007C0C43
RegCloseKey.ADVAPI32(000000FE,000000FE,00000000,?,00000000), ref: 007C0E82
RegCloseKey.ADVAPI32(00000000), ref: 007C0E8F

Memory Dump Source

Source File: 0000000A.00000002.2894756195.0000000000741000.00000020.00000001.01000000.00000006.sdmp, Offset: 00740000, based on PE: true

Associated: 0000000A.00000002.2894716076.0000000000740000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.2894810207.00000000007D0000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.2894810207.00000000007F6000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.2894865972.0000000000800000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.2894887053.0000000000809000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_740000_Launches.jbxd

Similarity

API ID: CloseQueryValue$BuffCharConnectRegistryUpper__itow__swprintf
String ID:
API String ID: 1240663315-0
Opcode ID: 67d2dc2f24c1b35fba9d74e60dfa9677a449f1834f97efd450695d642b8f6cf3
Instruction ID: c96e5baa048185d6aa692d66e5b4e7d33be4aa6a759523e7ccec101fe1e32cbb
Opcode Fuzzy Hash: 67d2dc2f24c1b35fba9d74e60dfa9677a449f1834f97efd450695d642b8f6cf3
Instruction Fuzzy Hash: A8E13A71204210EFCB14DF28C895E6ABBE8EF89714F04896DF84ADB261DB34ED05CB91

Function 007A443D Relevance: 15.1, APIs: 10, Instructions: 108windowCOMMON

Download Yara Rule

APIs

__swprintf.LIBCMT ref: 007A4451
__swprintf.LIBCMT ref: 007A445E

Part of subcall function 007638C8: __woutput_l.LIBCMT ref: 00763921

FindResourceW.KERNEL32(?,?,0000000E), ref: 007A4488
LoadResource.KERNEL32(?,00000000), ref: 007A4494
LockResource.KERNEL32(00000000), ref: 007A44A1
FindResourceW.KERNEL32(?,?,00000003), ref: 007A44C1
LoadResource.KERNEL32(?,00000000), ref: 007A44D3
SizeofResource.KERNEL32(?,00000000), ref: 007A44E2
LockResource.KERNEL32(?), ref: 007A44EE
CreateIconFromResourceEx.USER32(?,?,00000001,00030000,00000000,00000000,00000000), ref: 007A454F

Memory Dump Source

Source File: 0000000A.00000002.2894756195.0000000000741000.00000020.00000001.01000000.00000006.sdmp, Offset: 00740000, based on PE: true

Associated: 0000000A.00000002.2894716076.0000000000740000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.2894810207.00000000007D0000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.2894810207.00000000007F6000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.2894865972.0000000000800000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.2894887053.0000000000809000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_740000_Launches.jbxd

Similarity

API ID: Resource$FindLoadLock__swprintf$CreateFromIconSizeof__woutput_l
String ID:
API String ID: 1433390588-0
Opcode ID: 8965b6b9bed4d80f89719c90d790b6d74cea01ad7e7ef70b89152626f3d2fe8f
Instruction ID: 77818fecf886456533279b1f3637611d9e45477cd879dc4b988d336493f1ecf5
Opcode Fuzzy Hash: 8965b6b9bed4d80f89719c90d790b6d74cea01ad7e7ef70b89152626f3d2fe8f
Instruction Fuzzy Hash: 1631C37190221AEBCB119FA0EC58EBF7BB8FF85300F008525F946D2150E779E960CBA4

Function 007B4830 Relevance: 15.1, APIs: 10, Instructions: 83clipboardmemoryCOMMON

Download Yara Rule

APIs

OpenClipboard.USER32 ref: 007B4857
EmptyClipboard.USER32 ref: 007B485D
GlobalAlloc.KERNEL32(00000002,?), ref: 007B4872
CloseClipboard.USER32 ref: 007B4911

Memory Dump Source

Source File: 0000000A.00000002.2894756195.0000000000741000.00000020.00000001.01000000.00000006.sdmp, Offset: 00740000, based on PE: true

Associated: 0000000A.00000002.2894716076.0000000000740000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.2894810207.00000000007D0000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.2894810207.00000000007F6000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.2894865972.0000000000800000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.2894887053.0000000000809000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_740000_Launches.jbxd

Similarity

API ID: Clipboard$AllocCloseEmptyGlobalOpen
String ID:
API String ID: 1737998785-0
Opcode ID: fe5f67f5fa01a15489c930c18ab823b94701237363876c91aa4148b51d3f2a32
Instruction ID: d35c3659287fc610c87303023d2a5df0f0e0d0485f494fc01e9af746da3a9313
Opcode Fuzzy Hash: fe5f67f5fa01a15489c930c18ab823b94701237363876c91aa4148b51d3f2a32
Instruction Fuzzy Hash: 03217131602210AFDB11AF60EC4DB6E7BB8FF44711F048016F9469B2A2DB38ED11CB98

Function 007AFA36 Relevance: 12.4, APIs: 6, Strings: 1, Instructions: 120filesleepCOMMON

Download Yara Rule

APIs

Part of subcall function 00751A36: _memmove.LIBCMT ref: 00751A77

FindFirstFileW.KERNEL32(?,?,*.*,?,?,00000000,00000000), ref: 007AFA83
FindClose.KERNEL32(00000000), ref: 007AFB96

Part of subcall function 007452B0: PeekMessageW.USER32(?,00000000,00000000,00000000,00000001), ref: 007452E6

Sleep.KERNEL32(0000000A), ref: 007AFAB3
_wcscmp.LIBCMT ref: 007AFAC7
_wcscmp.LIBCMT ref: 007AFAE2
FindNextFileW.KERNEL32(?,?), ref: 007AFB80

Strings

*.*, xrefs: 007AFA68

Memory Dump Source

Source File: 0000000A.00000002.2894756195.0000000000741000.00000020.00000001.01000000.00000006.sdmp, Offset: 00740000, based on PE: true

Associated: 0000000A.00000002.2894716076.0000000000740000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.2894810207.00000000007D0000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.2894810207.00000000007F6000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.2894865972.0000000000800000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.2894887053.0000000000809000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_740000_Launches.jbxd

Similarity

API ID: Find$File_wcscmp$CloseFirstMessageNextPeekSleep_memmove
String ID: *.*
API String ID: 2185952417-438819550
Opcode ID: 97a338d652516dac59bdae0b6d0d9ecdc299a8997a2ca3ff0fb79f88bbce1808
Instruction ID: 3916c1d10e0e6d107981ed35397aaef1f224f1fb0eb5df872cf1fd7383e3744f
Opcode Fuzzy Hash: 97a338d652516dac59bdae0b6d0d9ecdc299a8997a2ca3ff0fb79f88bbce1808
Instruction Fuzzy Hash: 2A4184B190110E9FCF14DFA4CC59AEE7BB4FF45311F548566E814A2291EB389E44CBA0

Function 007A5778 Relevance: 10.6, APIs: 3, Strings: 3, Instructions: 59shutdownCOMMON

Download Yara Rule

APIs

Part of subcall function 00799399: LookupPrivilegeValueW.ADVAPI32(00000000,00000000,00000004), ref: 007993E3
Part of subcall function 00799399: AdjustTokenPrivileges.ADVAPI32(?,00000000,00000000,?,00000000,?), ref: 00799410
Part of subcall function 00799399: GetLastError.KERNEL32 ref: 0079941D

ExitWindowsEx.USER32(?,00000000), ref: 007A57B4

Strings

, xrefs: 007A57A2
SeShutdownPrivilege, xrefs: 007A5784
@, xrefs: 007A57A7

Memory Dump Source

Source File: 0000000A.00000002.2894756195.0000000000741000.00000020.00000001.01000000.00000006.sdmp, Offset: 00740000, based on PE: true

Associated: 0000000A.00000002.2894716076.0000000000740000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.2894810207.00000000007D0000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.2894810207.00000000007F6000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.2894865972.0000000000800000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.2894887053.0000000000809000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_740000_Launches.jbxd

Similarity

API ID: AdjustErrorExitLastLookupPrivilegePrivilegesTokenValueWindows
String ID: $@$SeShutdownPrivilege
API String ID: 2234035333-194228
Opcode ID: 68578003419b5a2d4cd248d824d106fea119ab25ffb60c17eaf7c7826dc200ad
Instruction ID: d27125ee9634d2faae7b920e33c8da8514072ce1591a47e0407eb0a20559b33c
Opcode Fuzzy Hash: 68578003419b5a2d4cd248d824d106fea119ab25ffb60c17eaf7c7826dc200ad
Instruction Fuzzy Hash: AF01F771751712EAE7286664EC8ABBF7358EB86750F10422AFD13F20D2DA6C5C008194

Function 007B696E Relevance: 9.1, APIs: 6, Instructions: 84networkCOMMON

Download Yara Rule

APIs

socket.WSOCK32(00000002,00000001,00000006,?,00000002,00000000), ref: 007B69C7
WSAGetLastError.WSOCK32(00000000), ref: 007B69D6
bind.WSOCK32(00000000,?,00000010), ref: 007B69F2
listen.WSOCK32(00000000,00000005), ref: 007B6A01
WSAGetLastError.WSOCK32(00000000), ref: 007B6A1B
closesocket.WSOCK32(00000000,00000000), ref: 007B6A2F

Memory Dump Source

Source File: 0000000A.00000002.2894756195.0000000000741000.00000020.00000001.01000000.00000006.sdmp, Offset: 00740000, based on PE: true

Associated: 0000000A.00000002.2894716076.0000000000740000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.2894810207.00000000007D0000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.2894810207.00000000007F6000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.2894865972.0000000000800000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.2894887053.0000000000809000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_740000_Launches.jbxd

Similarity

API ID: ErrorLast$bindclosesocketlistensocket
String ID:
API String ID: 1279440585-0
Opcode ID: fdebe7824d1b43548f5f5e96060d247905f9284e94c5688c4da16ebd9d78f668
Instruction ID: 68c70ed157a2b4f6f9e656b41cfa5f602796c933373fac6b722335f2c4e6e0ec
Opcode Fuzzy Hash: fdebe7824d1b43548f5f5e96060d247905f9284e94c5688c4da16ebd9d78f668
Instruction Fuzzy Hash: F321A074600604DFCB10EF64D889BAEB7B9EF44720F14C559FA56AB391CB78AC01DB91

Function 00741663 Relevance: 7.9, APIs: 5, Instructions: 379COMMON

Download Yara Rule

APIs

Part of subcall function 007429E2: GetWindowLongW.USER32(?,000000EB), ref: 007429F3

DefDlgProcW.USER32(?,?,?,?,?), ref: 00741DD6
GetSysColor.USER32(0000000F), ref: 00741E2A
SetBkColor.GDI32(?,00000000), ref: 00741E3D

Part of subcall function 0074166C: DefDlgProcW.USER32(?,00000020,?), ref: 007416B4

Memory Dump Source

Source File: 0000000A.00000002.2894756195.0000000000741000.00000020.00000001.01000000.00000006.sdmp, Offset: 00740000, based on PE: true

Associated: 0000000A.00000002.2894716076.0000000000740000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.2894810207.00000000007D0000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.2894810207.00000000007F6000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.2894865972.0000000000800000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.2894887053.0000000000809000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_740000_Launches.jbxd

Similarity

API ID: ColorProc$LongWindow
String ID:
API String ID: 3744519093-0
Opcode ID: 7bd757e89e2061a0c4444fdd2561973e3fa67116c4c644df45d327512bf74a80
Instruction ID: 8c9ba0d40be7cef24e189588a11633066c77cab7486ffa9ad952d890e4f5dcf3
Opcode Fuzzy Hash: 7bd757e89e2061a0c4444fdd2561973e3fa67116c4c644df45d327512bf74a80
Instruction Fuzzy Hash: A6A134B4705904FAEB3CBB698C49F7B2A9DEB41341F94C11EF406C6195CB2C9D81CA76

Function 007AC2FF Relevance: 7.6, APIs: 5, Instructions: 143fileCOMMON

Download Yara Rule

APIs

FindFirstFileW.KERNEL32(?,?), ref: 007AC329
_wcscmp.LIBCMT ref: 007AC359
_wcscmp.LIBCMT ref: 007AC36E
FindNextFileW.KERNEL32(00000000,?), ref: 007AC37F
FindClose.KERNEL32(00000000,00000001,00000000), ref: 007AC3AF

Memory Dump Source

Source File: 0000000A.00000002.2894756195.0000000000741000.00000020.00000001.01000000.00000006.sdmp, Offset: 00740000, based on PE: true

Associated: 0000000A.00000002.2894716076.0000000000740000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.2894810207.00000000007D0000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.2894810207.00000000007F6000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.2894865972.0000000000800000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.2894887053.0000000000809000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_740000_Launches.jbxd

Similarity

API ID: Find$File_wcscmp$CloseFirstNext
String ID:
API String ID: 2387731787-0
Opcode ID: c0f1a770582fb9cb20ef5cdb2db9a40ff1f8400d3cdf5f469500e2dbd9ed480b
Instruction ID: 5258d068de07301d0a39d446486b3833ad962fcd28cad7c4dd5c04835392f0c7
Opcode Fuzzy Hash: c0f1a770582fb9cb20ef5cdb2db9a40ff1f8400d3cdf5f469500e2dbd9ed480b
Instruction Fuzzy Hash: AA51AE75A04602DFD715DF68C494EAAB7E4FF8A310F10461DF9568B361DB38AD04CB91

Function 007B6E32 Relevance: 7.6, APIs: 5, Instructions: 141networkCOMMON

Download Yara Rule

APIs

Part of subcall function 007B8475: inet_addr.WSOCK32(00000000,?,00000000,?,?,?,00000000), ref: 007B84A0

socket.WSOCK32(00000002,00000002,00000011,?,?,00000000), ref: 007B6E89
WSAGetLastError.WSOCK32(00000000), ref: 007B6EB2
bind.WSOCK32(00000000,?,00000010), ref: 007B6EEB
WSAGetLastError.WSOCK32(00000000), ref: 007B6EF8
closesocket.WSOCK32(00000000,00000000), ref: 007B6F0C

Memory Dump Source

Source File: 0000000A.00000002.2894756195.0000000000741000.00000020.00000001.01000000.00000006.sdmp, Offset: 00740000, based on PE: true

Associated: 0000000A.00000002.2894716076.0000000000740000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.2894810207.00000000007D0000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.2894810207.00000000007F6000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.2894865972.0000000000800000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.2894887053.0000000000809000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_740000_Launches.jbxd

Similarity

API ID: ErrorLast$bindclosesocketinet_addrsocket
String ID:
API String ID: 99427753-0
Opcode ID: 4666449a6314f2fc969fd371b9eeeac728c1f87e564fae20885111a195c98df4
Instruction ID: 2214d416d436813dc263fe4ff6b957f3d66537770bdaf92aa380cfef5755d494
Opcode Fuzzy Hash: 4666449a6314f2fc969fd371b9eeeac728c1f87e564fae20885111a195c98df4
Instruction Fuzzy Hash: AA41D075B00200EFDB10AF64DC8AF7E77A8AB44710F048458FA16AB3D2DB789D009BE1

Function 007C59B3 Relevance: 7.6, APIs: 5, Instructions: 69windowCOMMON

Download Yara Rule

APIs

IsWindowVisible.USER32 ref: 007C5A02
IsWindowEnabled.USER32 ref: 007C5A10
GetForegroundWindow.USER32(?,?,00000001), ref: 007C5A1D
IsIconic.USER32 ref: 007C5A2B
IsZoomed.USER32 ref: 007C5A39

Memory Dump Source

Source File: 0000000A.00000002.2894756195.0000000000741000.00000020.00000001.01000000.00000006.sdmp, Offset: 00740000, based on PE: true

Associated: 0000000A.00000002.2894716076.0000000000740000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.2894810207.00000000007D0000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.2894810207.00000000007F6000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.2894865972.0000000000800000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.2894887053.0000000000809000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_740000_Launches.jbxd

Similarity

API ID: Window$EnabledForegroundIconicVisibleZoomed
String ID:
API String ID: 292994002-0
Opcode ID: 35a71170eb62dcca15176f54d8b7e92163dada741dbaf90fd0d7f835cc65ba44
Instruction ID: 939e62995a884dd13183ffd455cacd4a8556055f52ba294355d3656362e22164
Opcode Fuzzy Hash: 35a71170eb62dcca15176f54d8b7e92163dada741dbaf90fd0d7f835cc65ba44
Instruction Fuzzy Hash: E011B2327019119BEB215F269C88F2E7BA9EF84721F04812EE806D7241DB39F9418AE5

Function 00780030 Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 17timeCOMMON

Download Yara Rule

APIs

GetLocalTime.KERNEL32(?), ref: 00780034
__swprintf.LIBCMT ref: 00780065

Strings

%.3d, xrefs: 0078003F
WIN_XPe, xrefs: 007800A4

Memory Dump Source

Source File: 0000000A.00000002.2894756195.0000000000741000.00000020.00000001.01000000.00000006.sdmp, Offset: 00740000, based on PE: true

Associated: 0000000A.00000002.2894716076.0000000000740000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.2894810207.00000000007D0000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.2894810207.00000000007F6000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.2894865972.0000000000800000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.2894887053.0000000000809000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_740000_Launches.jbxd

Similarity

API ID: LocalTime__swprintf
String ID: %.3d$WIN_XPe
API String ID: 2070861257-2409531811
Opcode ID: 7a9a9bc7c4dcf3c0d578786af7b9b573af64217862aacb2986e044436074da69
Instruction ID: 05ef3cdbc2a0056dfa89387774587cae0a6938b1c9c5e39402f08d4746f0a05a
Opcode Fuzzy Hash: 7a9a9bc7c4dcf3c0d578786af7b9b573af64217862aacb2986e044436074da69
Instruction Fuzzy Hash: 5BD012B2884109EAC748AB90CC49EF9737CEB04300F104052F546E2040D33D975CDB66

Function 007B29BA Relevance: 4.7, APIs: 3, Instructions: 164networkfileCOMMON

Download Yara Rule

APIs

InternetQueryDataAvailable.WININET(00000001,?,00000000,00000000,00000000,?,?,?,?,?,?,?,?,007B1ED6,00000000), ref: 007B2AAD
InternetReadFile.WININET(00000001,00000000,00000001,00000001), ref: 007B2AE4

Memory Dump Source

Source File: 0000000A.00000002.2894756195.0000000000741000.00000020.00000001.01000000.00000006.sdmp, Offset: 00740000, based on PE: true

Associated: 0000000A.00000002.2894716076.0000000000740000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.2894810207.00000000007D0000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.2894810207.00000000007F6000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.2894865972.0000000000800000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.2894887053.0000000000809000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_740000_Launches.jbxd

Similarity

API ID: Internet$AvailableDataFileQueryRead
String ID:
API String ID: 599397726-0
Opcode ID: 24003cc88373eadd3ce806f188ebd01c36c0ad5354d6c4e81c056fa13723e7f3
Instruction ID: 80c38ddd175b75d24aa006c7b1bbb30591e6331f5bb04620b3dfa29d76b413f2
Opcode Fuzzy Hash: 24003cc88373eadd3ce806f188ebd01c36c0ad5354d6c4e81c056fa13723e7f3
Instruction Fuzzy Hash: 4841C871605209FFEB20DE54CC85FFB77BCEB40754F10805AFA05A7142EA79AE429660

Function 00799399 Relevance: 4.6, APIs: 3, Instructions: 67COMMON

Download Yara Rule

APIs

Part of subcall function 00760FE6: std::exception::exception.LIBCMT ref: 0076101C
Part of subcall function 00760FE6: __CxxThrowException@8.LIBCMT ref: 00761031

LookupPrivilegeValueW.ADVAPI32(00000000,00000000,00000004), ref: 007993E3
AdjustTokenPrivileges.ADVAPI32(?,00000000,00000000,?,00000000,?), ref: 00799410
GetLastError.KERNEL32 ref: 0079941D

Memory Dump Source

Source File: 0000000A.00000002.2894756195.0000000000741000.00000020.00000001.01000000.00000006.sdmp, Offset: 00740000, based on PE: true

Associated: 0000000A.00000002.2894716076.0000000000740000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.2894810207.00000000007D0000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.2894810207.00000000007F6000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.2894865972.0000000000800000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.2894887053.0000000000809000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_740000_Launches.jbxd

Similarity

API ID: AdjustErrorException@8LastLookupPrivilegePrivilegesThrowTokenValuestd::exception::exception
String ID:
API String ID: 1922334811-0
Opcode ID: f6cf0642d9bc9c6ad8ac2da9a8c2a3d90815bfad2b17819eea4afd1cd766e771
Instruction ID: b0df9cb16c6924d645bdfe80153bb54fe85e08d73f3aaa072c08bb7edc3581c7
Opcode Fuzzy Hash: f6cf0642d9bc9c6ad8ac2da9a8c2a3d90815bfad2b17819eea4afd1cd766e771
Instruction Fuzzy Hash: 7C11BFB1414204BFEB28DF58EC89D2BB7BCEB44310B24812EF44A82250EB34AC41CB60

Function 007A4254 Relevance: 4.6, APIs: 3, Instructions: 59fileCOMMON

Download Yara Rule

APIs

CreateFileW.KERNEL32(?,00000080,00000003,00000000,00000003,00000080,00000000), ref: 007A4271
DeviceIoControl.KERNEL32(00000000,002D1400,?,0000000C,?,00000028,?,00000000), ref: 007A42B2
CloseHandle.KERNEL32(?,?,00000080,00000003,00000000,00000003,00000080,00000000), ref: 007A42BD

Memory Dump Source

Source File: 0000000A.00000002.2894756195.0000000000741000.00000020.00000001.01000000.00000006.sdmp, Offset: 00740000, based on PE: true

Associated: 0000000A.00000002.2894716076.0000000000740000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.2894810207.00000000007D0000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.2894810207.00000000007F6000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.2894865972.0000000000800000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.2894887053.0000000000809000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_740000_Launches.jbxd

Similarity

API ID: CloseControlCreateDeviceFileHandle
String ID:
API String ID: 33631002-0
Opcode ID: 422d78ea2527b75e957122aac32678ae59c1a675df819b08e77bf046b2d2f1e6
Instruction ID: 5152ac340d9e4ae2525112c559b29662048ce547f78af222693f7eac9e56e448
Opcode Fuzzy Hash: 422d78ea2527b75e957122aac32678ae59c1a675df819b08e77bf046b2d2f1e6
Instruction Fuzzy Hash: D3113075E01228BBDB508F959C44BAFBBBCEB85B60F108256FD04E7290C6755A018BE5

Function 007A4F1C Relevance: 4.5, APIs: 3, Instructions: 43memoryCOMMON

Download Yara Rule

APIs

AllocateAndInitializeSid.ADVAPI32(?,00000002,00000020,00000220,00000000,00000000,00000000,00000000,00000000,00000000,?,?), ref: 007A4F45
CheckTokenMembership.ADVAPI32(00000000,?,?), ref: 007A4F5C
FreeSid.ADVAPI32(?), ref: 007A4F6C

Memory Dump Source

Source File: 0000000A.00000002.2894756195.0000000000741000.00000020.00000001.01000000.00000006.sdmp, Offset: 00740000, based on PE: true

Associated: 0000000A.00000002.2894716076.0000000000740000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.2894810207.00000000007D0000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.2894810207.00000000007F6000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.2894865972.0000000000800000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.2894887053.0000000000809000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_740000_Launches.jbxd

Similarity

API ID: AllocateCheckFreeInitializeMembershipToken
String ID:
API String ID: 3429775523-0
Opcode ID: 803b71b1c8485dce90a4f789a03aaaff722776986aceb32dddaac5c1ed025d30
Instruction ID: 18fb2646760f63070d14c44e25f206d8a04121dba70fc8b3f46c8146ce995917
Opcode Fuzzy Hash: 803b71b1c8485dce90a4f789a03aaaff722776986aceb32dddaac5c1ed025d30
Instruction Fuzzy Hash: 94F04975A1130CBFDF00DFE0DC89BAEBBBCEF08201F4054A9A901E2180E7396A048B94

Function 007A1AC6 Relevance: 3.0, APIs: 2, Instructions: 32keyboardCOMMON

Download Yara Rule

APIs

SendInput.USER32(00000001,?,0000001C,?,?,00000002), ref: 007A1B01
keybd_event.USER32(?,75C0C0D0,?,00000000), ref: 007A1B14

Memory Dump Source

Source File: 0000000A.00000002.2894756195.0000000000741000.00000020.00000001.01000000.00000006.sdmp, Offset: 00740000, based on PE: true

Associated: 0000000A.00000002.2894716076.0000000000740000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.2894810207.00000000007D0000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.2894810207.00000000007F6000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.2894865972.0000000000800000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.2894887053.0000000000809000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_740000_Launches.jbxd

Similarity

API ID: InputSendkeybd_event
String ID:
API String ID: 3536248340-0
Opcode ID: 9a0a5100cdcfa43c4e7d9b1befb39927bc93eadd99ad45a358af503a3a74963f
Instruction ID: e7ad86f468901212e995c3d062459582ab1418f61ab960780e3686879725920a
Opcode Fuzzy Hash: 9a0a5100cdcfa43c4e7d9b1befb39927bc93eadd99ad45a358af503a3a74963f
Instruction Fuzzy Hash: B1F0377190020DABEB00CF94D805BBE7BB4EF04315F00814AFD5596292D3799625DFA4

Function 007AA6AD Relevance: 3.0, APIs: 2, Instructions: 31windowCOMMON

Download Yara Rule

APIs

GetLastError.KERNEL32(00000000,?,00000FFF,00000000,?,?,007B9B52,?,007D098C,?), ref: 007AA6DA
FormatMessageW.KERNEL32(00001000,00000000,000000FF,00000000,?,00000FFF,00000000,?,?,007B9B52,?,007D098C,?), ref: 007AA6EC

Memory Dump Source

Source File: 0000000A.00000002.2894756195.0000000000741000.00000020.00000001.01000000.00000006.sdmp, Offset: 00740000, based on PE: true

Associated: 0000000A.00000002.2894716076.0000000000740000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.2894810207.00000000007D0000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.2894810207.00000000007F6000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.2894865972.0000000000800000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.2894887053.0000000000809000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_740000_Launches.jbxd

Similarity

API ID: ErrorFormatLastMessage
String ID:
API String ID: 3479602957-0
Opcode ID: 6dbbad007ff0316bfe31ec6964a810d414ceddfbafdc64792bcc5b6340788842
Instruction ID: 3c24646aa0f1a329b92d452087f1525d3291e7d11f3f9e473f64c222416709f9
Opcode Fuzzy Hash: 6dbbad007ff0316bfe31ec6964a810d414ceddfbafdc64792bcc5b6340788842
Instruction Fuzzy Hash: 5AF0823550522DFBDB21AFA8CC48FEA776CBF09361F008256B908D6191DA749940CFE1

Function 00798DE9 Relevance: 3.0, APIs: 2, Instructions: 22COMMON

Download Yara Rule

APIs

AdjustTokenPrivileges.ADVAPI32(?,00000000,?,00000000,00000000,00000000,?,00798F27), ref: 00798DFE
CloseHandle.KERNEL32(?,?,00798F27), ref: 00798E10

Memory Dump Source

Source File: 0000000A.00000002.2894756195.0000000000741000.00000020.00000001.01000000.00000006.sdmp, Offset: 00740000, based on PE: true

Associated: 0000000A.00000002.2894716076.0000000000740000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.2894810207.00000000007D0000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.2894810207.00000000007F6000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.2894865972.0000000000800000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.2894887053.0000000000809000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_740000_Launches.jbxd

Similarity

API ID: AdjustCloseHandlePrivilegesToken
String ID:
API String ID: 81990902-0
Opcode ID: aff0df9ed437ffbd84c866684a32b7c27cdd83f8e303c6516346e66e629e852e
Instruction ID: a5250aadc323c9d2fbe3673a975f1d1d298462afddad5e310c433d2bac5e1f27
Opcode Fuzzy Hash: aff0df9ed437ffbd84c866684a32b7c27cdd83f8e303c6516346e66e629e852e
Instruction Fuzzy Hash: 25E0B676015610EFEB662B60ED1DE777BBDEB04310B14C92EF8AA80470DB66AC90DB50

Function 0076A385 Relevance: 3.0, APIs: 2, Instructions: 8COMMONLIBRARYCODE

Download Yara Rule

APIs

SetUnhandledExceptionFilter.KERNEL32(00000000,?,00768F87,?,?,?,00000001), ref: 0076A38A
UnhandledExceptionFilter.KERNEL32(?,?,?,00000001), ref: 0076A393

Memory Dump Source

Source File: 0000000A.00000002.2894756195.0000000000741000.00000020.00000001.01000000.00000006.sdmp, Offset: 00740000, based on PE: true

Associated: 0000000A.00000002.2894716076.0000000000740000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.2894810207.00000000007D0000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.2894810207.00000000007F6000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.2894865972.0000000000800000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.2894887053.0000000000809000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_740000_Launches.jbxd

Similarity

API ID: ExceptionFilterUnhandled
String ID:
API String ID: 3192549508-0
Opcode ID: ee9b205576c26caf7cd69bf2d08de735e6bfb2a73434cd27823ab9ad192d50e5
Instruction ID: 609d9cae1b0db4e0d5cb903418c0542db063029a9f968508a253bccaced1a622
Opcode Fuzzy Hash: ee9b205576c26caf7cd69bf2d08de735e6bfb2a73434cd27823ab9ad192d50e5
Instruction Fuzzy Hash: 5AB09231065208ABCA402B95FC09B883F78EB44A62F009016F60D44060CB6654508AD9

Function 007B45D5 Relevance: 1.5, APIs: 1, Instructions: 25keyboardCOMMON

Download Yara Rule

APIs

BlockInput.USER32(00000001), ref: 007B45F0

Memory Dump Source

Source File: 0000000A.00000002.2894756195.0000000000741000.00000020.00000001.01000000.00000006.sdmp, Offset: 00740000, based on PE: true

Associated: 0000000A.00000002.2894716076.0000000000740000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.2894810207.00000000007D0000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.2894810207.00000000007F6000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.2894865972.0000000000800000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.2894887053.0000000000809000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_740000_Launches.jbxd

Similarity

API ID: BlockInput
String ID:
API String ID: 3456056419-0
Opcode ID: fb0b53ecd95e1a75a519448ef918fd9260fb9d7bd4a48d02ac88df3b07e026e5
Instruction ID: ba877183eea6e0ae6be73a78608d484a5d414577269807a358e8a4c9a9ee3a5b
Opcode Fuzzy Hash: fb0b53ecd95e1a75a519448ef918fd9260fb9d7bd4a48d02ac88df3b07e026e5
Instruction Fuzzy Hash: 62E0DF35200205AFC320AF69E804B8AF7E8AF94760F008016FC09C7312DB78EC508BE0

Function 007A51E2 Relevance: 1.5, APIs: 1, Instructions: 24COMMON

Download Yara Rule

APIs

mouse_event.USER32(00000002,00000000,00000000,00000000,00000000), ref: 007A5205

Memory Dump Source

Source File: 0000000A.00000002.2894756195.0000000000741000.00000020.00000001.01000000.00000006.sdmp, Offset: 00740000, based on PE: true

Associated: 0000000A.00000002.2894716076.0000000000740000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.2894810207.00000000007D0000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.2894810207.00000000007F6000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.2894865972.0000000000800000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.2894887053.0000000000809000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_740000_Launches.jbxd

Similarity

API ID: mouse_event
String ID:
API String ID: 2434400541-0
Opcode ID: 7ed22cac53a887ed371e2c7be677a6940508b90f4a91492b57cc02aa65579e26
Instruction ID: 23d385e759e8296de462255bb2274789808d571e4fe8dcd7ec959ac654403c29
Opcode Fuzzy Hash: 7ed22cac53a887ed371e2c7be677a6940508b90f4a91492b57cc02aa65579e26
Instruction Fuzzy Hash: 80D09E96160E0D79ED580724EE1FF761648E3837C1F94575B7242850C1FCDD58499475

Function 00799369 Relevance: 1.5, APIs: 1, Instructions: 19COMMON

Download Yara Rule

APIs

LogonUserW.ADVAPI32(?,00000001,?,?,00000000,00798FA7), ref: 00799389

Memory Dump Source

Source File: 0000000A.00000002.2894756195.0000000000741000.00000020.00000001.01000000.00000006.sdmp, Offset: 00740000, based on PE: true

Associated: 0000000A.00000002.2894716076.0000000000740000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.2894810207.00000000007D0000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.2894810207.00000000007F6000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.2894865972.0000000000800000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.2894887053.0000000000809000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_740000_Launches.jbxd

Similarity

API ID: LogonUser
String ID:
API String ID: 1244722697-0
Opcode ID: 2646e2f883c203c7cac7cb4044368a56f554c3419309572c674a1eb3bf55b229
Instruction ID: edfa1f3b5a8548aefacd80ec4f307a0c19d5a6422e42c8155136f75a801409fa
Opcode Fuzzy Hash: 2646e2f883c203c7cac7cb4044368a56f554c3419309572c674a1eb3bf55b229
Instruction Fuzzy Hash: 30D09E3226450EBBEF019EA4DD05EAE3B69EB04B01F408511FE15D51A1C775D935AB60

Function 00780722 Relevance: 1.5, APIs: 1, Instructions: 7COMMON

Download Yara Rule

APIs

GetUserNameW.ADVAPI32(?,?), ref: 00780734

Memory Dump Source

Source File: 0000000A.00000002.2894756195.0000000000741000.00000020.00000001.01000000.00000006.sdmp, Offset: 00740000, based on PE: true

Associated: 0000000A.00000002.2894716076.0000000000740000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.2894810207.00000000007D0000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.2894810207.00000000007F6000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.2894865972.0000000000800000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.2894887053.0000000000809000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_740000_Launches.jbxd

Similarity

API ID: NameUser
String ID:
API String ID: 2645101109-0
Opcode ID: 6d11c6834c5ccc4ca8ec52efb5cffcf68a2070bf8e86b0360636a391e8209923
Instruction ID: c227f30a0c1f986ac141529509da29372ab02281b59432fd47d8239b7aa5bc88
Opcode Fuzzy Hash: 6d11c6834c5ccc4ca8ec52efb5cffcf68a2070bf8e86b0360636a391e8209923
Instruction Fuzzy Hash: 9CC04CF1801109EBCB05DBA0D988EFE77BCAB04304F104056A145B2100D7789B448BB1

Function 0076A354 Relevance: 1.5, APIs: 1, Instructions: 6COMMON

Download Yara Rule

APIs

SetUnhandledExceptionFilter.KERNEL32(?), ref: 0076A35A

Memory Dump Source

Source File: 0000000A.00000002.2894756195.0000000000741000.00000020.00000001.01000000.00000006.sdmp, Offset: 00740000, based on PE: true

Associated: 0000000A.00000002.2894716076.0000000000740000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.2894810207.00000000007D0000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.2894810207.00000000007F6000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.2894865972.0000000000800000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.2894887053.0000000000809000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_740000_Launches.jbxd

Similarity

API ID: ExceptionFilterUnhandled
String ID:
API String ID: 3192549508-0
Opcode ID: b85782948d5c1efa559fd03c355c6a8e42800f70737900cedefb079b3131def7
Instruction ID: 171b4ed4ef1fa48dd8017e32213e5f5bea504999b2a5ddbebd5a07535a0b0bbc
Opcode Fuzzy Hash: b85782948d5c1efa559fd03c355c6a8e42800f70737900cedefb079b3131def7
Instruction Fuzzy Hash: 01A0223002020CFBCF002F8AFC08888BFBCEB002A0F00C022F80C00032CB33A8208AC8

Function 007C3BA9 Relevance: 51.1, APIs: 6, Strings: 23, Instructions: 365windowCOMMON

Download Yara Rule

APIs

CharUpperBuffW.USER32(?,?,007D0980), ref: 007C3C65
IsWindowVisible.USER32(?), ref: 007C3C89

Strings

ISCHECKED, xrefs: 007C3E77
GETSELECTED, xrefs: 007C3EE1
SELECTSTRING, xrefs: 007C3E44
CURRENTTAB, xrefs: 007C3CFB
GETCURRENTSELECTION, xrefs: 007C3E21
TABRIGHT, xrefs: 007C3CDB
GETCURRENTCOL, xrefs: 007C3F66
ISENABLED, xrefs: 007C3CA9
EDITPASTE, xrefs: 007C3F9D
ADDSTRING, xrefs: 007C3D54
GETLINE, xrefs: 007C3FD9
SETCURRENTSELECTION, xrefs: 007C3DF4
GETLINECOUNT, xrefs: 007C3F04
SHOWDROPDOWN, xrefs: 007C3D1E
TABLEFT, xrefs: 007C3CC5
SENDCOMMANDID, xrefs: 007C4018
CHECK, xrefs: 007C3EAB
GETCURRENTLINE, xrefs: 007C3F2B
HIDEDROPDOWN, xrefs: 007C3D3E
ISVISIBLE, xrefs: 007C3C75
UNCHECK, xrefs: 007C3EC1
FINDSTRING, xrefs: 007C3DB4
DELSTRING, xrefs: 007C3D87

Memory Dump Source

Source File: 0000000A.00000002.2894756195.0000000000741000.00000020.00000001.01000000.00000006.sdmp, Offset: 00740000, based on PE: true

Associated: 0000000A.00000002.2894716076.0000000000740000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.2894810207.00000000007D0000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.2894810207.00000000007F6000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.2894865972.0000000000800000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.2894887053.0000000000809000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_740000_Launches.jbxd

Similarity

API ID: BuffCharUpperVisibleWindow
String ID: ADDSTRING$CHECK$CURRENTTAB$DELSTRING$EDITPASTE$FINDSTRING$GETCURRENTCOL$GETCURRENTLINE$GETCURRENTSELECTION$GETLINE$GETLINECOUNT$GETSELECTED$HIDEDROPDOWN$ISCHECKED$ISENABLED$ISVISIBLE$SELECTSTRING$SENDCOMMANDID$SETCURRENTSELECTION$SHOWDROPDOWN$TABLEFT$TABRIGHT$UNCHECK
API String ID: 4105515805-45149045
Opcode ID: 09380c07c2e9906d818712323bccb3dc04287a56c33b10e05447bd8953f8216c
Instruction ID: e8d473616fc854aebb1843059646cd4a55e9cb767019f0b5321242ab0d1a7f59
Opcode Fuzzy Hash: 09380c07c2e9906d818712323bccb3dc04287a56c33b10e05447bd8953f8216c
Instruction Fuzzy Hash: D0D17E30204205DBCB15EF20C555F6EB7A1AF94354F1089ACF9865B3A2CB3DED4ACB92

Function 007CABFF Relevance: 49.8, APIs: 33, Instructions: 274COMMON

Download Yara Rule

APIs

SetTextColor.GDI32(?,00000000), ref: 007CAC55
GetSysColorBrush.USER32(0000000F), ref: 007CAC86
GetSysColor.USER32(0000000F), ref: 007CAC92
SetBkColor.GDI32(?,000000FF), ref: 007CACAC
SelectObject.GDI32(?,?), ref: 007CACBB
InflateRect.USER32(?,000000FF,000000FF), ref: 007CACE6
GetSysColor.USER32(00000010), ref: 007CACEE
CreateSolidBrush.GDI32(00000000), ref: 007CACF5
FrameRect.USER32(?,?,00000000), ref: 007CAD04
DeleteObject.GDI32(00000000), ref: 007CAD0B
InflateRect.USER32(?,000000FE,000000FE), ref: 007CAD56
FillRect.USER32(?,?,?), ref: 007CAD88
GetWindowLongW.USER32(?,000000F0), ref: 007CADB3

Part of subcall function 007CAF18: GetSysColor.USER32(00000012), ref: 007CAF51
Part of subcall function 007CAF18: SetTextColor.GDI32(?,?), ref: 007CAF55
Part of subcall function 007CAF18: GetSysColorBrush.USER32(0000000F), ref: 007CAF6B
Part of subcall function 007CAF18: GetSysColor.USER32(0000000F), ref: 007CAF76
Part of subcall function 007CAF18: GetSysColor.USER32(00000011), ref: 007CAF93
Part of subcall function 007CAF18: CreatePen.GDI32(00000000,00000001,00743C00), ref: 007CAFA1
Part of subcall function 007CAF18: SelectObject.GDI32(?,00000000), ref: 007CAFB2
Part of subcall function 007CAF18: SetBkColor.GDI32(?,00000000), ref: 007CAFBB
Part of subcall function 007CAF18: SelectObject.GDI32(?,?), ref: 007CAFC8
Part of subcall function 007CAF18: InflateRect.USER32(?,000000FF,000000FF), ref: 007CAFE7
Part of subcall function 007CAF18: RoundRect.GDI32(?,?,?,?,?,00000005,00000005), ref: 007CAFFE
Part of subcall function 007CAF18: GetWindowLongW.USER32(00000000,000000F0), ref: 007CB013

Memory Dump Source

Source File: 0000000A.00000002.2894756195.0000000000741000.00000020.00000001.01000000.00000006.sdmp, Offset: 00740000, based on PE: true

Associated: 0000000A.00000002.2894716076.0000000000740000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.2894810207.00000000007D0000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.2894810207.00000000007F6000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.2894865972.0000000000800000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.2894887053.0000000000809000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_740000_Launches.jbxd

Similarity

API ID: Color$Rect$Object$BrushInflateSelect$CreateLongTextWindow$DeleteFillFrameRoundSolid
String ID:
API String ID: 4124339563-0
Opcode ID: 80e226a769e8103d45e8db9cc46e0958c6ee82e938e5a715593fbc42fa6f27c3
Instruction ID: 1256ae1a15ecbff5aaddcfc3d651667679eac257a17d6e225a6779730c389d18
Opcode Fuzzy Hash: 80e226a769e8103d45e8db9cc46e0958c6ee82e938e5a715593fbc42fa6f27c3
Instruction Fuzzy Hash: E4A16B72109309BFD7119F64DC08F6A7BB9FF88326F105A1EF962961A0D739D840CB96

Function 00742FE8 Relevance: 49.5, APIs: 27, Strings: 1, Instructions: 486windowCOMMON

Download Yara Rule

APIs

DestroyWindow.USER32(?,?,?), ref: 00743072
DeleteObject.GDI32(00000000), ref: 007430B8
DeleteObject.GDI32(00000000), ref: 007430C3
DestroyIcon.USER32(00000000,?,?,?), ref: 007430CE
DestroyWindow.USER32(00000000,?,?,?), ref: 007430D9
SendMessageW.USER32(?,00001308,?,00000000), ref: 0077C77C
ImageList_Remove.COMCTL32(?,000000FF,?), ref: 0077C7B5
MoveWindow.USER32(?,?,?,?,?,00000000), ref: 0077CBDE

Part of subcall function 00741F1D: InvalidateRect.USER32(?,00000000,00000001,?,?,?,00742412,?,00000000,?,?,?,?,00741AA7,00000000,?), ref: 00741F76

SendMessageW.USER32(?,00001053), ref: 0077CC1B
SendMessageW.USER32(?,00001008,000000FF,00000000), ref: 0077CC32
ImageList_Destroy.COMCTL32(00000000,?,?), ref: 0077CC48
ImageList_Destroy.COMCTL32(00000000,?,?), ref: 0077CC53

Strings

0, xrefs: 0077CA72

Memory Dump Source

Source File: 0000000A.00000002.2894756195.0000000000741000.00000020.00000001.01000000.00000006.sdmp, Offset: 00740000, based on PE: true

Associated: 0000000A.00000002.2894716076.0000000000740000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.2894810207.00000000007D0000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.2894810207.00000000007F6000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.2894865972.0000000000800000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.2894887053.0000000000809000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_740000_Launches.jbxd

Similarity

API ID: Destroy$ImageList_MessageSendWindow$DeleteObject$IconInvalidateMoveRectRemove
String ID: 0
API String ID: 464785882-4108050209
Opcode ID: 9a56e9f0f6fa602f226053534d74ebd4de33aad209a10511fa74b1ce4a38c892
Instruction ID: d024785257e44f7347087050b140bf5b4350ec5422c0f481695a36d86c13693f
Opcode Fuzzy Hash: 9a56e9f0f6fa602f226053534d74ebd4de33aad209a10511fa74b1ce4a38c892
Instruction Fuzzy Hash: 2E128D30604201EFDB26CF24C889BA9B7A5FF48351F14866DF999CB262C739ED51CB91

Function 007527FC Relevance: 47.5, APIs: 12, Strings: 15, Instructions: 298COMMON

Download Yara Rule

APIs

Part of subcall function 00760FE6: std::exception::exception.LIBCMT ref: 0076101C
Part of subcall function 00760FE6: __CxxThrowException@8.LIBCMT ref: 00761031

__wcsnicmp.LIBCMT ref: 0075286A
__wcsnicmp.LIBCMT ref: 0075287E
__wcsnicmp.LIBCMT ref: 00752896
__wcsnicmp.LIBCMT ref: 007528AE
__wcsnicmp.LIBCMT ref: 007528C6
__wcsnicmp.LIBCMT ref: 007528DE
__wcsnicmp.LIBCMT ref: 007528F6
__wcsnicmp.LIBCMT ref: 0075290A
__wcsnicmp.LIBCMT ref: 00752948
__wcsnicmp.LIBCMT ref: 0075295C
__wcsnicmp.LIBCMT ref: 00752970
__wcsnicmp.LIBCMT ref: 00752984

Strings

Unterminated group of comments, xrefs: 0078FCFA
#notrayicon, xrefs: 00752878
", xrefs: 0078FB89
#include-once, xrefs: 007528C0
#OnAutoItStartRegister, xrefs: 007528A8
#include, xrefs: 007528D8
#comments-end, xrefs: 0075296A
#comments-start, xrefs: 007528F0, 00752942
#pragma compile, xrefs: 00752864
Bad directive syntax error, xrefs: 0078FBD3, 0078FBF0
Cannot parse #include, xrefs: 0078FCE5
#requireadmin, xrefs: 00752890
#ce, xrefs: 0075297E
#cs, xrefs: 00752904, 00752956
', xrefs: 0078FB9F

Memory Dump Source

Source File: 0000000A.00000002.2894756195.0000000000741000.00000020.00000001.01000000.00000006.sdmp, Offset: 00740000, based on PE: true

Associated: 0000000A.00000002.2894716076.0000000000740000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.2894810207.00000000007D0000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.2894810207.00000000007F6000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.2894865972.0000000000800000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.2894887053.0000000000809000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_740000_Launches.jbxd

Similarity

API ID: __wcsnicmp$Exception@8Throwstd::exception::exception
String ID: "$#OnAutoItStartRegister$#ce$#comments-end$#comments-start$#cs$#include$#include-once$#notrayicon$#pragma compile$#requireadmin$'$Bad directive syntax error$Cannot parse #include$Unterminated group of comments
API String ID: 2660009612-1645009161
Opcode ID: 8161f1ffeba1cd91f54f75102dc780af2bbac8370f1cca1426e51385664c4388
Instruction ID: bd456ecfee5bfeb855437cb7f24a0cb497185f6d7037a81dd1a1fe764e710067
Opcode Fuzzy Hash: 8161f1ffeba1cd91f54f75102dc780af2bbac8370f1cca1426e51385664c4388
Instruction Fuzzy Hash: 5EA1B271A40209FBCB10AF60DC56EBE3774AF55741F140029FC05AB293EBB9AE16DB61

Function 007B7B95 Relevance: 45.8, APIs: 22, Strings: 4, Instructions: 284windowCOMMON

Download Yara Rule

APIs

DestroyWindow.USER32(00000000), ref: 007B7BC8
SystemParametersInfoW.USER32(00000030,00000000,?,00000000), ref: 007B7C87
SetRect.USER32(?,00000000,00000000,0000012C,00000064), ref: 007B7CC5
AdjustWindowRectEx.USER32(?,88C00000,00000000,00000006), ref: 007B7CD7
CreateWindowExW.USER32(00000006,AutoIt v3,?,88C00000,?,?,?,?,00000000,00000000,00000000), ref: 007B7D1D
GetClientRect.USER32(00000000,?), ref: 007B7D29
CreateWindowExW.USER32(00000000,static,?,50000000,?,00000004,00000500,00000018,00000000,00000000,00000000), ref: 007B7D6D
CreateDCW.GDI32(DISPLAY,00000000,00000000,00000000), ref: 007B7D7C
GetStockObject.GDI32(00000011), ref: 007B7D8C
SelectObject.GDI32(00000000,00000000), ref: 007B7D90
GetTextFaceW.GDI32(00000000,00000040,?,?,50000000,?,00000004,00000500,00000018,00000000,00000000,00000000,?,88C00000,?), ref: 007B7DA0
GetDeviceCaps.GDI32(00000000,0000005A), ref: 007B7DA9
DeleteDC.GDI32(00000000), ref: 007B7DB2
CreateFontW.GDI32(00000000,00000000,00000000,00000000,00000258,00000000,00000000,00000000,00000001,00000004,00000000,00000002,00000000,?), ref: 007B7DDE
SendMessageW.USER32(00000030,00000000,00000001), ref: 007B7DF5
CreateWindowExW.USER32(00000200,msctls_progress32,00000000,50000001,?,0000001E,00000104,00000014,00000000,00000000,00000000), ref: 007B7E30
SendMessageW.USER32(00000000,00000401,00000000,00640000), ref: 007B7E44
SendMessageW.USER32(00000404,00000001,00000000), ref: 007B7E55
CreateWindowExW.USER32(00000000,static,?,50000000,?,00000037,00000500,00000032,00000000,00000000,00000000), ref: 007B7E85
GetStockObject.GDI32(00000011), ref: 007B7E90
SendMessageW.USER32(00000030,00000000,?,50000000), ref: 007B7E9B
ShowWindow.USER32(00000004,?,50000000,?,00000004,00000500,00000018,00000000,00000000,00000000,?,88C00000,?,?,?,?), ref: 007B7EA5

Strings

AutoIt v3, xrefs: 007B7D15
static, xrefs: 007B7D67, 007B7E7F
msctls_progress32, xrefs: 007B7E26
DISPLAY, xrefs: 007B7D72

Memory Dump Source

Source File: 0000000A.00000002.2894756195.0000000000741000.00000020.00000001.01000000.00000006.sdmp, Offset: 00740000, based on PE: true

Associated: 0000000A.00000002.2894716076.0000000000740000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.2894810207.00000000007D0000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.2894810207.00000000007F6000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.2894865972.0000000000800000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.2894887053.0000000000809000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_740000_Launches.jbxd

Similarity

API ID: Window$Create$MessageSend$ObjectRect$Stock$AdjustCapsClientDeleteDestroyDeviceFaceFontInfoParametersSelectShowSystemText
String ID: AutoIt v3$DISPLAY$msctls_progress32$static
API String ID: 2910397461-517079104
Opcode ID: 67239931cb7919b9bb89e2cc19064d35a366f42f907b5e1da7e43eb4ebe15132
Instruction ID: 6f743c9166788e013af06bdf2030b5c3d85accdb19e7341cb404ef6db114e402
Opcode Fuzzy Hash: 67239931cb7919b9bb89e2cc19064d35a366f42f907b5e1da7e43eb4ebe15132
Instruction Fuzzy Hash: 0BA17EB1A01219BFEB14DBA4DC4AFAE7BB9EF44710F048115FA15A72E1D774AD00CBA4

Function 007AB353 Relevance: 45.7, APIs: 3, Strings: 23, Instructions: 186COMMON

Download Yara Rule

APIs

SetErrorMode.KERNEL32(00000001), ref: 007AB361
GetDriveTypeW.KERNEL32(?,007D2C4C,?,\\.\,007D0980), ref: 007AB43E
SetErrorMode.KERNEL32(00000000,007D2C4C,?,\\.\,007D0980), ref: 007AB59C

Strings

FileBackedVirtual, xrefs: 007AB56B
CDROM, xrefs: 007AB472
Unknown, xrefs: 007AB45E, 007AB502
RAMDisk, xrefs: 007AB468
Virtual, xrefs: 007AB564
iSCSI, xrefs: 007AB541
\\.\, xrefs: 007AB3B3
PhysicalDrive, xrefs: 007AB3EA
SAS, xrefs: 007AB548
SSA, xrefs: 007AB525
SCSI, xrefs: 007AB509
1394, xrefs: 007AB51E
ATAPI, xrefs: 007AB510
Fibre, xrefs: 007AB52C
SATA, xrefs: 007AB54F
Removable, xrefs: 007AB490
Network, xrefs: 007AB47C
MMC, xrefs: 007AB55D
Fixed, xrefs: 007AB486
ATA, xrefs: 007AB517
SSD, xrefs: 007AB4C9
RAID, xrefs: 007AB53A
USB, xrefs: 007AB533

Memory Dump Source

Source File: 0000000A.00000002.2894756195.0000000000741000.00000020.00000001.01000000.00000006.sdmp, Offset: 00740000, based on PE: true

Associated: 0000000A.00000002.2894716076.0000000000740000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.2894810207.00000000007D0000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.2894810207.00000000007F6000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.2894865972.0000000000800000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.2894887053.0000000000809000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_740000_Launches.jbxd

Similarity

API ID: ErrorMode$DriveType
String ID: 1394$ATA$ATAPI$CDROM$Fibre$FileBackedVirtual$Fixed$MMC$Network$PhysicalDrive$RAID$RAMDisk$Removable$SAS$SATA$SCSI$SSA$SSD$USB$Unknown$Virtual$\\.\$iSCSI
API String ID: 2907320926-4222207086
Opcode ID: e398e25abda0f563a77f0a1c21cd80aab93768e3595b7a40c54887a200907812
Instruction ID: 2fbc4e690af8082cc106aca26e696f4e64a9ead868ff654b6bf68c60f05d8b77
Opcode Fuzzy Hash: e398e25abda0f563a77f0a1c21cd80aab93768e3595b7a40c54887a200907812
Instruction Fuzzy Hash: 2C519370F4020DEBCB00EB60C946A7D77E0ABCA341B648616E506A7393D77DAE91DF51

Function 007CA041 Relevance: 42.5, APIs: 23, Strings: 1, Instructions: 455windowCOMMON

Download Yara Rule

APIs

SetWindowPos.USER32(00000000,00000000,00000000,00000000,00000000,00000000,00000103,?,?,?), ref: 007CA0F7
SendMessageW.USER32(?,0000113F,00000000,00000008), ref: 007CA1B0
SendMessageW.USER32(?,00001102,00000002,?), ref: 007CA1CC

Strings

0, xrefs: 007CA209

Memory Dump Source

Source File: 0000000A.00000002.2894756195.0000000000741000.00000020.00000001.01000000.00000006.sdmp, Offset: 00740000, based on PE: true

Associated: 0000000A.00000002.2894716076.0000000000740000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.2894810207.00000000007D0000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.2894810207.00000000007F6000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.2894865972.0000000000800000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.2894887053.0000000000809000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_740000_Launches.jbxd

Similarity

API ID: MessageSend$Window
String ID: 0
API String ID: 2326795674-4108050209
Opcode ID: 065791760a87bc6e504c949a981188577ba2666adea73fa6665558af0a1619d6
Instruction ID: 11e6cde6360f8a7613df4b24c8cf21349fb8282700036a86b2d7cd06d8df09f5
Opcode Fuzzy Hash: 065791760a87bc6e504c949a981188577ba2666adea73fa6665558af0a1619d6
Instruction Fuzzy Hash: 9202DB30508349BFDB15CF18C848FAABBE4FF8931AF04852DF995962A1C778D954CB92

Function 007CAF18 Relevance: 39.2, APIs: 26, Instructions: 201windowCOMMON

Download Yara Rule

APIs

GetSysColor.USER32(00000012), ref: 007CAF51
SetTextColor.GDI32(?,?), ref: 007CAF55
GetSysColorBrush.USER32(0000000F), ref: 007CAF6B
GetSysColor.USER32(0000000F), ref: 007CAF76
CreateSolidBrush.GDI32(?), ref: 007CAF7B
GetSysColor.USER32(00000011), ref: 007CAF93
CreatePen.GDI32(00000000,00000001,00743C00), ref: 007CAFA1
SelectObject.GDI32(?,00000000), ref: 007CAFB2
SetBkColor.GDI32(?,00000000), ref: 007CAFBB
SelectObject.GDI32(?,?), ref: 007CAFC8
InflateRect.USER32(?,000000FF,000000FF), ref: 007CAFE7
RoundRect.GDI32(?,?,?,?,?,00000005,00000005), ref: 007CAFFE
GetWindowLongW.USER32(00000000,000000F0), ref: 007CB013
SendMessageW.USER32(00000000,0000000E,00000000,00000000), ref: 007CB05F
GetWindowTextW.USER32(00000000,00000000,00000001), ref: 007CB086
InflateRect.USER32(?,000000FD,000000FD), ref: 007CB0A4
DrawFocusRect.USER32(?,?), ref: 007CB0AF
GetSysColor.USER32(00000011), ref: 007CB0BD
SetTextColor.GDI32(?,00000000), ref: 007CB0C5
DrawTextW.USER32(?,00000000,000000FF,?,?), ref: 007CB0D9
SelectObject.GDI32(?,007CAC1F), ref: 007CB0F0
DeleteObject.GDI32(?), ref: 007CB0FB
SelectObject.GDI32(?,?), ref: 007CB101
DeleteObject.GDI32(?), ref: 007CB106
SetTextColor.GDI32(?,?), ref: 007CB10C
SetBkColor.GDI32(?,?), ref: 007CB116

Memory Dump Source

Source File: 0000000A.00000002.2894756195.0000000000741000.00000020.00000001.01000000.00000006.sdmp, Offset: 00740000, based on PE: true

Associated: 0000000A.00000002.2894716076.0000000000740000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.2894810207.00000000007D0000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.2894810207.00000000007F6000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.2894865972.0000000000800000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.2894887053.0000000000809000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_740000_Launches.jbxd

Similarity

API ID: Color$Object$Text$RectSelect$BrushCreateDeleteDrawInflateWindow$FocusLongMessageRoundSendSolid
String ID:
API String ID: 1996641542-0
Opcode ID: cc9d9fb94ff5038a8d702e3f36b38b056c909b226dffd2cc71b51ad055e5bf2c
Instruction ID: 075c2675691594020433e865a2d5933d28f96714ff4315097e6db89d76d4acdc
Opcode Fuzzy Hash: cc9d9fb94ff5038a8d702e3f36b38b056c909b226dffd2cc71b51ad055e5bf2c
Instruction Fuzzy Hash: 29616C71901218BFDF119FA4DC49FAE7B79EF08320F10911AF916AB2A1D7799940CF94

Function 007C8FFA Relevance: 38.9, APIs: 21, Strings: 1, Instructions: 401windowCOMMON

Download Yara Rule

APIs

SendMessageW.USER32(?,00000158,000000FF,0000014E), ref: 007C90EA
SendMessageW.USER32(?,0000014E,00000000,00000000), ref: 007C90FB
CharNextW.USER32(0000014E), ref: 007C912A
SendMessageW.USER32(?,0000014B,00000000,00000000), ref: 007C916B
SendMessageW.USER32(?,00000158,000000FF,00000158), ref: 007C9181
SendMessageW.USER32(?,0000014E,00000000,00000000), ref: 007C9192
SendMessageW.USER32(?,000000C2,00000001,0000014E), ref: 007C91AF
SetWindowTextW.USER32(?,0000014E), ref: 007C91FB
SendMessageW.USER32(?,000000B1,000F4240,000F423F), ref: 007C9211
SendMessageW.USER32(?,00001002,00000000,?), ref: 007C9242
_memset.LIBCMT ref: 007C9267
SendMessageW.USER32(00000000,00001060,00000001,00000004), ref: 007C92B0
_memset.LIBCMT ref: 007C930F
SendMessageW.USER32(?,00001053,000000FF,?), ref: 007C9339
SendMessageW.USER32(?,00001074,?,00000001), ref: 007C9391
SendMessageW.USER32(?,0000133D,?,?), ref: 007C943E
InvalidateRect.USER32(?,00000000,00000001), ref: 007C9460
GetMenuItemInfoW.USER32(?,?,00000000,00000030), ref: 007C94AA
SetMenuItemInfoW.USER32(?,?,00000000,00000030), ref: 007C94D7
DrawMenuBar.USER32(?), ref: 007C94E6
SetWindowTextW.USER32(?,0000014E), ref: 007C950E

Strings

0, xrefs: 007C9478

Memory Dump Source

Source File: 0000000A.00000002.2894756195.0000000000741000.00000020.00000001.01000000.00000006.sdmp, Offset: 00740000, based on PE: true

Associated: 0000000A.00000002.2894716076.0000000000740000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.2894810207.00000000007D0000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.2894810207.00000000007F6000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.2894865972.0000000000800000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.2894887053.0000000000809000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_740000_Launches.jbxd

Similarity

API ID: MessageSend$Menu$InfoItemTextWindow_memset$CharDrawInvalidateNextRect
String ID: 0
API String ID: 1073566785-4108050209
Opcode ID: 600ca0d6e06a140169de6f324047bc52de4474124c50d158b5aaf7cfb9229e44
Instruction ID: f6b1bd5d6e8f607495bb8b053121f4f0e0a837aee9bc361fc451ce46b3897be9
Opcode Fuzzy Hash: 600ca0d6e06a140169de6f324047bc52de4474124c50d158b5aaf7cfb9229e44
Instruction Fuzzy Hash: 66E17B70900209EBDB619F90CC89FEE7BB8FB05710F10815EFA15AA291D7789A91CF60

Function 007C4ECC Relevance: 37.0, APIs: 18, Strings: 3, Instructions: 290windowCOMMON

Download Yara Rule

APIs

GetCursorPos.USER32(?), ref: 007C5007
GetDesktopWindow.USER32 ref: 007C501C
GetWindowRect.USER32(00000000), ref: 007C5023
GetWindowLongW.USER32(?,000000F0), ref: 007C5085
DestroyWindow.USER32(?), ref: 007C50B1
CreateWindowExW.USER32(00000008,tooltips_class32,00000000,00000003,80000000,80000000,80000000,80000000,00000000,00000000,00000000,00000000), ref: 007C50DA
SendMessageW.USER32(00000000,00000432,00000000,00000030), ref: 007C50F8
SendMessageW.USER32(?,00000439,00000000,00000030), ref: 007C511E
SendMessageW.USER32(?,00000421,?,?), ref: 007C5133
SendMessageW.USER32(?,0000041D,00000000,00000000), ref: 007C5146
IsWindowVisible.USER32(?), ref: 007C5166
SendMessageW.USER32(?,00000412,00000000,D8F0D8F0), ref: 007C5181
SendMessageW.USER32(?,00000411,00000001,00000030), ref: 007C5195
GetWindowRect.USER32(?,?), ref: 007C51AD
MonitorFromPoint.USER32(?,?,00000002), ref: 007C51D3
GetMonitorInfoW.USER32(00000000,?), ref: 007C51ED
CopyRect.USER32(?,?), ref: 007C5204
SendMessageW.USER32(?,00000412,00000000), ref: 007C526F

Strings

tooltips_class32, xrefs: 007C50D3
0, xrefs: 007C4FB2
(, xrefs: 007C51E0

Memory Dump Source

Source File: 0000000A.00000002.2894756195.0000000000741000.00000020.00000001.01000000.00000006.sdmp, Offset: 00740000, based on PE: true

Associated: 0000000A.00000002.2894716076.0000000000740000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.2894810207.00000000007D0000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.2894810207.00000000007F6000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.2894865972.0000000000800000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.2894887053.0000000000809000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_740000_Launches.jbxd

Similarity

API ID: MessageSendWindow$Rect$Monitor$CopyCreateCursorDesktopDestroyFromInfoLongPointVisible
String ID: ($0$tooltips_class32
API String ID: 698492251-4156429822
Opcode ID: 4ff69a18853cea758c124ad37577276b5262710a32b47aa94e6df637f0a2fe11
Instruction ID: a395d6be5c3b95c4f46f5f5624922a5cea3509c5a19f27e8bbdac5445d480c93
Opcode Fuzzy Hash: 4ff69a18853cea758c124ad37577276b5262710a32b47aa94e6df637f0a2fe11
Instruction Fuzzy Hash: 30B17971604740AFD704DF64C888F6ABBE4FF88310F008A1DF5999B2A2D779E845CB96

Function 007A498A Relevance: 36.9, APIs: 16, Strings: 5, Instructions: 179COMMON

Download Yara Rule

APIs

GetFileVersionInfoSizeW.VERSION(?,?), ref: 007A499C
GetFileVersionInfoW.VERSION(?,00000000,00000000,00000000,?,?), ref: 007A49C2
_wcscpy.LIBCMT ref: 007A49F0
_wcscmp.LIBCMT ref: 007A49FB
_wcscat.LIBCMT ref: 007A4A11
_wcsstr.LIBCMT ref: 007A4A1C
VerQueryValueW.VERSION(?,\VarFileInfo\Translation,?,?,?,?,?,?,00000000,?,?), ref: 007A4A38
_wcscat.LIBCMT ref: 007A4A81
_wcscat.LIBCMT ref: 007A4A88
_wcsncpy.LIBCMT ref: 007A4AB3

Strings

%u.%u.%u.%u, xrefs: 007A4B16
04090000, xrefs: 007A4A6E
StringFileInfo\, xrefs: 007A4A0B
\VarFileInfo\Translation, xrefs: 007A4A30
DefaultLangCodepage, xrefs: 007A4A9B

Memory Dump Source

Source File: 0000000A.00000002.2894756195.0000000000741000.00000020.00000001.01000000.00000006.sdmp, Offset: 00740000, based on PE: true

Associated: 0000000A.00000002.2894716076.0000000000740000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.2894810207.00000000007D0000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.2894810207.00000000007F6000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.2894865972.0000000000800000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.2894887053.0000000000809000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_740000_Launches.jbxd

Similarity

API ID: _wcscat$FileInfoVersion$QuerySizeValue_wcscmp_wcscpy_wcsncpy_wcsstr
String ID: %u.%u.%u.%u$04090000$DefaultLangCodepage$StringFileInfo\$\VarFileInfo\Translation
API String ID: 699586101-1459072770
Opcode ID: db9e7f154468234e3ab0bcb9ec58c60864e91d87e207a1ebbd1b6c6d7ef9b3fb
Instruction ID: f04a09d0987f7e1066c6883479030255f7a6d832b4d4468b584519e7a69b42af
Opcode Fuzzy Hash: db9e7f154468234e3ab0bcb9ec58c60864e91d87e207a1ebbd1b6c6d7ef9b3fb
Instruction Fuzzy Hash: 804108B2600204BADB10B7648D4BEBF777CEF81721F104156FD06A6193EB7D9A0296B5

Function 00742BA9 Relevance: 35.3, APIs: 18, Strings: 2, Instructions: 286windowtimeCOMMON

Download Yara Rule

APIs

SystemParametersInfoW.USER32(00000030,00000000,000000FF,00000000), ref: 00742C8C
GetSystemMetrics.USER32(00000007), ref: 00742C94
SystemParametersInfoW.USER32(00000030,00000000,000000FF,00000000), ref: 00742CBF
GetSystemMetrics.USER32(00000008), ref: 00742CC7
GetSystemMetrics.USER32(00000004), ref: 00742CEC
SetRect.USER32(000000FF,00000000,00000000,000000FF,000000FF), ref: 00742D09
AdjustWindowRectEx.USER32(000000FF,?,00000000,?), ref: 00742D19
CreateWindowExW.USER32(?,AutoIt v3 GUI,?,?,?,000000FF,000000FF,000000FF,?,00000000,00000000), ref: 00742D4C
SetWindowLongW.USER32(00000000,000000EB,00000000), ref: 00742D60
GetClientRect.USER32(00000000,000000FF), ref: 00742D7E
GetStockObject.GDI32(00000011), ref: 00742D9A
SendMessageW.USER32(00000000,00000030,00000000), ref: 00742DA5

Part of subcall function 00742714: GetCursorPos.USER32(?), ref: 00742727
Part of subcall function 00742714: ScreenToClient.USER32(008077B0,?), ref: 00742744
Part of subcall function 00742714: GetAsyncKeyState.USER32(00000001), ref: 00742769
Part of subcall function 00742714: GetAsyncKeyState.USER32(00000002), ref: 00742777

SetTimer.USER32(00000000,00000000,00000028,007413C7), ref: 00742DCC

Strings

h}, xrefs: 00742BEC, 0077C433
AutoIt v3 GUI, xrefs: 00742D44

Memory Dump Source

Source File: 0000000A.00000002.2894756195.0000000000741000.00000020.00000001.01000000.00000006.sdmp, Offset: 00740000, based on PE: true

Associated: 0000000A.00000002.2894716076.0000000000740000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.2894810207.00000000007D0000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.2894810207.00000000007F6000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.2894865972.0000000000800000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.2894887053.0000000000809000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_740000_Launches.jbxd

Similarity

API ID: System$MetricsRectWindow$AsyncClientInfoParametersState$AdjustCreateCursorLongMessageObjectScreenSendStockTimer
String ID: AutoIt v3 GUI$h}
API String ID: 1458621304-1893895206
Opcode ID: a7078e487a304a9822dc62926b8b99ecb87126efe5865158e900624979029025
Instruction ID: d47accb15425dccc4d0a1fe7f6ac3522c90434df1a72e26aca134c982d5427f8
Opcode Fuzzy Hash: a7078e487a304a9822dc62926b8b99ecb87126efe5865158e900624979029025
Instruction Fuzzy Hash: 0DB13E71A0020ADFDB15DFA8DC59BAD7BB4FB48310F508129FA15E6290DB78A851CFA4

Function 00760429 Relevance: 30.1, APIs: 8, Strings: 9, Instructions: 349COMMON

Download Yara Rule

APIs

Part of subcall function 00751821: _memmove.LIBCMT ref: 0075185B

GetForegroundWindow.USER32(007D0980,?,?,?,?,?), ref: 007604E3
IsWindow.USER32(?), ref: 007966BB

Strings

LAST, xrefs: 00796472
INSTANCE, xrefs: 007965FA
HANDLE, xrefs: 0079649E
REGEXPCLASS, xrefs: 00796506
CLASS, xrefs: 007964E5
REGEXPTITLE, xrefs: 007964B4
ALL, xrefs: 00796622
TITLE, xrefs: 00796650
ACTIVE, xrefs: 00796488

Memory Dump Source

Source File: 0000000A.00000002.2894756195.0000000000741000.00000020.00000001.01000000.00000006.sdmp, Offset: 00740000, based on PE: true

Associated: 0000000A.00000002.2894716076.0000000000740000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.2894810207.00000000007D0000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.2894810207.00000000007F6000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.2894865972.0000000000800000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.2894887053.0000000000809000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_740000_Launches.jbxd

Similarity

API ID: Window$Foreground_memmove
String ID: ACTIVE$ALL$CLASS$HANDLE$INSTANCE$LAST$REGEXPCLASS$REGEXPTITLE$TITLE
API String ID: 3828923867-1919597938
Opcode ID: d0e713aae2c5020d8ddf8e67ed10e18272a72239b091cff55f542ed9386f8c71
Instruction ID: 939921bc9291cf37ce17c86a39c41bf7fab8e85bf648689e54c9497b86e508cd
Opcode Fuzzy Hash: d0e713aae2c5020d8ddf8e67ed10e18272a72239b091cff55f542ed9386f8c71
Instruction Fuzzy Hash: E1D1A570104202EBCF04EF60D485AAABBB5BF54344F504B29F856476A2DB38F959CBD1

Function 007C441F Relevance: 28.3, APIs: 3, Strings: 13, Instructions: 283windowCOMMON

Download Yara Rule

APIs

CharUpperBuffW.USER32(?,?), ref: 007C44AC
SendMessageW.USER32(?,00001032,00000000,00000000), ref: 007C456C

Strings

GETSELECTED, xrefs: 007C469A
GETTEXT, xrefs: 007C4515
FINDITEM, xrefs: 007C46DF
GETITEMCOUNT, xrefs: 007C44DE
ISSELECTED, xrefs: 007C4577
SELECTCLEAR, xrefs: 007C45EB
DESELECT, xrefs: 007C465A
SELECTINVERT, xrefs: 007C463C
SELECT, xrefs: 007C4606
GETSELECTEDCOUNT, xrefs: 007C454F
GETSUBITEMCOUNT, xrefs: 007C44F7
VIEWCHANGE, xrefs: 007C472B
SELECTALL, xrefs: 007C45D3

Memory Dump Source

Source File: 0000000A.00000002.2894756195.0000000000741000.00000020.00000001.01000000.00000006.sdmp, Offset: 00740000, based on PE: true

Associated: 0000000A.00000002.2894716076.0000000000740000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.2894810207.00000000007D0000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.2894810207.00000000007F6000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.2894865972.0000000000800000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.2894887053.0000000000809000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_740000_Launches.jbxd

Similarity

API ID: BuffCharMessageSendUpper
String ID: DESELECT$FINDITEM$GETITEMCOUNT$GETSELECTED$GETSELECTEDCOUNT$GETSUBITEMCOUNT$GETTEXT$ISSELECTED$SELECT$SELECTALL$SELECTCLEAR$SELECTINVERT$VIEWCHANGE
API String ID: 3974292440-719923060
Opcode ID: 880b27444115a77143c8ad4f75eb194dfc43eb392dc266fd758bbf14c7f904d9
Instruction ID: 457ec74e1eb7ea3a8b3eecd89c5d283fea94dce5922a83220b051b0a0cc45876
Opcode Fuzzy Hash: 880b27444115a77143c8ad4f75eb194dfc43eb392dc266fd758bbf14c7f904d9
Instruction Fuzzy Hash: BBA15D30214205DFCB15EF24C965F6AB3A5BF85314F20496CF9969B3A2DB38ED05CB91

Function 007B56C8 Relevance: 27.1, APIs: 18, Instructions: 124COMMON

Download Yara Rule

APIs

LoadCursorW.USER32(00000000,00007F89), ref: 007B56E1
LoadCursorW.USER32(00000000,00007F8A), ref: 007B56EC
LoadCursorW.USER32(00000000,00007F00), ref: 007B56F7
LoadCursorW.USER32(00000000,00007F03), ref: 007B5702
LoadCursorW.USER32(00000000,00007F8B), ref: 007B570D
LoadCursorW.USER32(00000000,00007F01), ref: 007B5718
LoadCursorW.USER32(00000000,00007F81), ref: 007B5723
LoadCursorW.USER32(00000000,00007F88), ref: 007B572E
LoadCursorW.USER32(00000000,00007F80), ref: 007B5739
LoadCursorW.USER32(00000000,00007F86), ref: 007B5744
LoadCursorW.USER32(00000000,00007F83), ref: 007B574F
LoadCursorW.USER32(00000000,00007F85), ref: 007B575A
LoadCursorW.USER32(00000000,00007F82), ref: 007B5765
LoadCursorW.USER32(00000000,00007F84), ref: 007B5770
LoadCursorW.USER32(00000000,00007F04), ref: 007B577B
LoadCursorW.USER32(00000000,00007F02), ref: 007B5786
GetCursorInfo.USER32(?), ref: 007B5796
GetLastError.KERNEL32(00000001,00000000), ref: 007B57C1

Memory Dump Source

Source File: 0000000A.00000002.2894756195.0000000000741000.00000020.00000001.01000000.00000006.sdmp, Offset: 00740000, based on PE: true

Associated: 0000000A.00000002.2894716076.0000000000740000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.2894810207.00000000007D0000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.2894810207.00000000007F6000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.2894865972.0000000000800000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.2894887053.0000000000809000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_740000_Launches.jbxd

Similarity

API ID: Cursor$Load$ErrorInfoLast
String ID:
API String ID: 3215588206-0
Opcode ID: b572cdde3cea83239538553c82f9a22efdd5718f73c363ea5a3c45374a6cb076
Instruction ID: 27f13c4f824e7a52c7c0552d6566da23d73841146e39ccc299c2833340bdbb82
Opcode Fuzzy Hash: b572cdde3cea83239538553c82f9a22efdd5718f73c363ea5a3c45374a6cb076
Instruction Fuzzy Hash: 21416770E04319AADB109FB68C49E6EFFF8EF51B10B10452FE519E7290DAB86400CF91

Function 0079B13A Relevance: 26.5, APIs: 14, Strings: 1, Instructions: 273windowtimeCOMMON

Download Yara Rule

APIs

GetClassNameW.USER32(?,?,00000100), ref: 0079B17B
__swprintf.LIBCMT ref: 0079B21C
_wcscmp.LIBCMT ref: 0079B22F
SendMessageTimeoutW.USER32(?,?,00000101,00000000,00000002,00001388,?), ref: 0079B284
_wcscmp.LIBCMT ref: 0079B2C0
GetClassNameW.USER32(?,?,00000400), ref: 0079B2F7
GetDlgCtrlID.USER32(?), ref: 0079B349
GetWindowRect.USER32(?,?), ref: 0079B37F
GetParent.USER32(?), ref: 0079B39D
ScreenToClient.USER32(00000000), ref: 0079B3A4
GetClassNameW.USER32(?,?,00000100), ref: 0079B41E
_wcscmp.LIBCMT ref: 0079B432
GetWindowTextW.USER32(?,?,00000400), ref: 0079B458
_wcscmp.LIBCMT ref: 0079B46C

Part of subcall function 0076385C: _iswctype.LIBCMT ref: 00763864

Strings

%s%u, xrefs: 0079B216

Memory Dump Source

Source File: 0000000A.00000002.2894756195.0000000000741000.00000020.00000001.01000000.00000006.sdmp, Offset: 00740000, based on PE: true

Associated: 0000000A.00000002.2894716076.0000000000740000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.2894810207.00000000007D0000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.2894810207.00000000007F6000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.2894865972.0000000000800000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.2894887053.0000000000809000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_740000_Launches.jbxd

Similarity

API ID: _wcscmp$ClassName$Window$ClientCtrlMessageParentRectScreenSendTextTimeout__swprintf_iswctype
String ID: %s%u
API String ID: 3744389584-679674701
Opcode ID: 91f46aab72e2f5d424bae2e5b4c0585d5f75a061f778306acba994d4d8f54768
Instruction ID: 95d72690c5ec1800787be68a001b45fc402f4324cb00eaff7e5d97d93dc8cee7
Opcode Fuzzy Hash: 91f46aab72e2f5d424bae2e5b4c0585d5f75a061f778306acba994d4d8f54768
Instruction Fuzzy Hash: 2AA1E371204306EFDB14DF64E988BEAB7E8FF44351F008529F999C21A1D738E955CB91

Function 0079BA6D Relevance: 26.5, APIs: 13, Strings: 2, Instructions: 249COMMON

Download Yara Rule

APIs

GetClassNameW.USER32(00000008,?,00000400), ref: 0079BAB1
_wcscmp.LIBCMT ref: 0079BAC2
GetWindowTextW.USER32(00000001,?,00000400), ref: 0079BAEA
CharUpperBuffW.USER32(?,00000000), ref: 0079BB07
_wcscmp.LIBCMT ref: 0079BB25
_wcsstr.LIBCMT ref: 0079BB36
GetClassNameW.USER32(00000018,?,00000400), ref: 0079BB6E
_wcscmp.LIBCMT ref: 0079BB7E
GetWindowTextW.USER32(00000002,?,00000400), ref: 0079BBA5
GetClassNameW.USER32(00000018,?,00000400), ref: 0079BBEE
_wcscmp.LIBCMT ref: 0079BBFE
GetClassNameW.USER32(00000010,?,00000400), ref: 0079BC26
GetWindowRect.USER32(00000004,?), ref: 0079BC8F

Strings

@, xrefs: 0079BA92
ThumbnailClass, xrefs: 0079BB79, 0079BBF9

Memory Dump Source

Source File: 0000000A.00000002.2894756195.0000000000741000.00000020.00000001.01000000.00000006.sdmp, Offset: 00740000, based on PE: true

Associated: 0000000A.00000002.2894716076.0000000000740000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.2894810207.00000000007D0000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.2894810207.00000000007F6000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.2894865972.0000000000800000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.2894887053.0000000000809000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_740000_Launches.jbxd

Similarity

API ID: ClassName_wcscmp$Window$Text$BuffCharRectUpper_wcsstr
String ID: @$ThumbnailClass
API String ID: 1788623398-1539354611
Opcode ID: b3954a067187db2fa2bde7bcc3468ab558c35946f9690c370523fc70a34d6daf
Instruction ID: cf79a7038cb27feef57d90c0460559cf52227aec194d18f05828db70ca2c627c
Opcode Fuzzy Hash: b3954a067187db2fa2bde7bcc3468ab558c35946f9690c370523fc70a34d6daf
Instruction Fuzzy Hash: 1981B2710043099BDF04DF14EA85FAA77E8FF84315F14856AFD898A096DB38DD49CBA1

Function 0079B8B6 Relevance: 26.4, APIs: 3, Strings: 12, Instructions: 105COMMON

Download Yara Rule

APIs

__wcsnicmp.LIBCMT ref: 0079B915

Strings

[ALL, xrefs: 0079B9BB
REGEXP=, xrefs: 0079B92A
[ACTIVE, xrefs: 0079B902
LAST, xrefs: 0079B8DA
CLASSNAME=, xrefs: 0079B952
HANDLE=, xrefs: 0079B90E
[LAST, xrefs: 0079B9C2
ALL, xrefs: 0079B9A9
[CLASS:, xrefs: 0079B965
[REGEXPTITLE:, xrefs: 0079B93D
ACTIVE, xrefs: 0079B8F0
[HANDLE:, xrefs: 0079B921

Memory Dump Source

Source File: 0000000A.00000002.2894756195.0000000000741000.00000020.00000001.01000000.00000006.sdmp, Offset: 00740000, based on PE: true

Associated: 0000000A.00000002.2894716076.0000000000740000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.2894810207.00000000007D0000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.2894810207.00000000007F6000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.2894865972.0000000000800000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.2894887053.0000000000809000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_740000_Launches.jbxd

Similarity

API ID: __wcsnicmp
String ID: ACTIVE$ALL$CLASSNAME=$HANDLE=$LAST$REGEXP=$[ACTIVE$[ALL$[CLASS:$[HANDLE:$[LAST$[REGEXPTITLE:
API String ID: 1038674560-1810252412
Opcode ID: 078001c2935eb40c5ceeee4f13132554e075be3fbaee7ef0931b65171a7ad459
Instruction ID: c00a9a8a2219656fa5ffc1dc3eb96b46fbc035fbaecd2cf4717b011fc1712c24
Opcode Fuzzy Hash: 078001c2935eb40c5ceeee4f13132554e075be3fbaee7ef0931b65171a7ad459
Instruction Fuzzy Hash: 4F31B2B0644209E6CE14FA50EE4BFFD73B4AF10762FA00125FA55B11D1EB9E7E08C952

Function 0079CB97 Relevance: 25.7, APIs: 17, Instructions: 169windowtimeCOMMON

Download Yara Rule

APIs

LoadIconW.USER32(00000063), ref: 0079CBAA
SendMessageW.USER32(?,00000080,00000000,00000000), ref: 0079CBBC
SetWindowTextW.USER32(?,?), ref: 0079CBD3
GetDlgItem.USER32(?,000003EA), ref: 0079CBE8
SetWindowTextW.USER32(00000000,?), ref: 0079CBEE
GetDlgItem.USER32(?,000003E9), ref: 0079CBFE
SetWindowTextW.USER32(00000000,?), ref: 0079CC04
SendDlgItemMessageW.USER32(?,000003E9,000000CC,?,00000000), ref: 0079CC25
SendDlgItemMessageW.USER32(?,000003E9,000000C5,00000000,00000000), ref: 0079CC3F
GetWindowRect.USER32(?,?), ref: 0079CC48
SetWindowTextW.USER32(?,?), ref: 0079CCB3
GetDesktopWindow.USER32 ref: 0079CCB9
GetWindowRect.USER32(00000000), ref: 0079CCC0
MoveWindow.USER32(?,?,?,?,00000000,00000000), ref: 0079CD0C
GetClientRect.USER32(?,?), ref: 0079CD19
PostMessageW.USER32(?,00000005,00000000,00000000), ref: 0079CD3E
SetTimer.USER32(?,0000040A,00000000,00000000), ref: 0079CD69

Memory Dump Source

Source File: 0000000A.00000002.2894756195.0000000000741000.00000020.00000001.01000000.00000006.sdmp, Offset: 00740000, based on PE: true

Associated: 0000000A.00000002.2894716076.0000000000740000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.2894810207.00000000007D0000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.2894810207.00000000007F6000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.2894865972.0000000000800000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.2894887053.0000000000809000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_740000_Launches.jbxd

Similarity

API ID: Window$ItemMessageText$RectSend$ClientDesktopIconLoadMovePostTimer
String ID:
API String ID: 3869813825-0
Opcode ID: c7d3b0da8a2cc9bf33d5b7e11db68302bfad97ef6605b51e674ce1c2bfe69dc9
Instruction ID: c87e6fcd236b258aa4979c9237167ed5ebcda25dff8431bd92b018276fcb5f59
Opcode Fuzzy Hash: c7d3b0da8a2cc9bf33d5b7e11db68302bfad97ef6605b51e674ce1c2bfe69dc9
Instruction Fuzzy Hash: 80515B70900709EFDF219FA8DE8AB6EBBF5FF04705F004919E686A25A0D778E914CB54

Function 007CA7DE Relevance: 24.7, APIs: 12, Strings: 2, Instructions: 205windowCOMMON

Download Yara Rule

APIs

_memset.LIBCMT ref: 007CA87E
DestroyWindow.USER32(00000000,?), ref: 007CA8F8

Part of subcall function 00751821: _memmove.LIBCMT ref: 0075185B

CreateWindowExW.USER32(00000008,tooltips_class32,00000000,?,80000000,80000000,80000000,80000000,?,00000000,00000000,?), ref: 007CA972
SendMessageW.USER32(00000000,00000433,00000000,00000030), ref: 007CA994
SendMessageW.USER32(00000000,00000432,00000000,00000030), ref: 007CA9A7
DestroyWindow.USER32(00000000), ref: 007CA9C9
CreateWindowExW.USER32(00000008,tooltips_class32,00000000,?,80000000,80000000,80000000,80000000,?,00000000,00740000,00000000), ref: 007CAA00
SendMessageW.USER32(00000000,00000432,00000000,00000030), ref: 007CAA19
GetDesktopWindow.USER32 ref: 007CAA32
GetWindowRect.USER32(00000000), ref: 007CAA39
SendMessageW.USER32(00000000,00000418,00000000,?), ref: 007CAA51
SendMessageW.USER32(00000000,00000421,?,00000000), ref: 007CAA69

Part of subcall function 007429AB: GetWindowLongW.USER32(?,000000EB), ref: 007429BC

Strings

tooltips_class32, xrefs: 007CA96B, 007CA9F9
0, xrefs: 007CA894

Memory Dump Source

Source File: 0000000A.00000002.2894756195.0000000000741000.00000020.00000001.01000000.00000006.sdmp, Offset: 00740000, based on PE: true

Associated: 0000000A.00000002.2894716076.0000000000740000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.2894810207.00000000007D0000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.2894810207.00000000007F6000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.2894865972.0000000000800000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.2894887053.0000000000809000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_740000_Launches.jbxd

Similarity

API ID: Window$MessageSend$CreateDestroy$DesktopLongRect_memmove_memset
String ID: 0$tooltips_class32
API String ID: 1297703922-3619404913
Opcode ID: fe170a7d624b0fab1f5b4619548fa521de35a74a5b6b9c2968f7d306a9010d14
Instruction ID: bdb904ff29cda7ed5d778196ac10ff497211650caea80c6baf5e8ad919b31610
Opcode Fuzzy Hash: fe170a7d624b0fab1f5b4619548fa521de35a74a5b6b9c2968f7d306a9010d14
Instruction Fuzzy Hash: 6C71A970540248AFD721CF28CC49F6B77E9FB88309F04851DF986872A1D779E916CB96

Function 007CCCA6 Relevance: 24.7, APIs: 11, Strings: 3, Instructions: 181windowfileCOMMON

Download Yara Rule

APIs

Part of subcall function 007429E2: GetWindowLongW.USER32(?,000000EB), ref: 007429F3

DragQueryPoint.SHELL32(?,?), ref: 007CCCCF

Part of subcall function 007CB1A9: ClientToScreen.USER32(?,?), ref: 007CB1D2
Part of subcall function 007CB1A9: GetWindowRect.USER32(?,?), ref: 007CB248
Part of subcall function 007CB1A9: PtInRect.USER32(?,?,007CC6BC), ref: 007CB258

SendMessageW.USER32(?,000000B0,?,?), ref: 007CCD38
DragQueryFileW.SHELL32(?,000000FF,00000000,00000000), ref: 007CCD43
DragQueryFileW.SHELL32(?,00000000,?,00000104), ref: 007CCD66
_wcscat.LIBCMT ref: 007CCD96
SendMessageW.USER32(?,000000C2,00000001,?), ref: 007CCDAD
SendMessageW.USER32(?,000000B0,?,?), ref: 007CCDC6
SendMessageW.USER32(?,000000B1,?,?), ref: 007CCDDD
SendMessageW.USER32(?,000000B1,?,?), ref: 007CCDFF
DragFinish.SHELL32(?), ref: 007CCE06
DefDlgProcW.USER32(?,00000233,?,00000000,?,?,?), ref: 007CCEF9

Strings

@GUI_DRAGFILE, xrefs: 007CCEA8
@GUI_DRAGID, xrefs: 007CCE71
@GUI_DROPID, xrefs: 007CCE26

Memory Dump Source

Source File: 0000000A.00000002.2894756195.0000000000741000.00000020.00000001.01000000.00000006.sdmp, Offset: 00740000, based on PE: true

Associated: 0000000A.00000002.2894716076.0000000000740000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.2894810207.00000000007D0000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.2894810207.00000000007F6000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.2894865972.0000000000800000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.2894887053.0000000000809000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_740000_Launches.jbxd

Similarity

API ID: MessageSend$Drag$Query$FileRectWindow$ClientFinishLongPointProcScreen_wcscat
String ID: @GUI_DRAGFILE$@GUI_DRAGID$@GUI_DROPID
API String ID: 169749273-3440237614
Opcode ID: 5c193407a63a19e1e7d0e4fd5520c6037a48b014c281fab656cc063d8d69a177
Instruction ID: 4251f260b061f5a44de385bf068057f993f0ebdec1dbfd81ba07ba8deb964626
Opcode Fuzzy Hash: 5c193407a63a19e1e7d0e4fd5520c6037a48b014c281fab656cc063d8d69a177
Instruction Fuzzy Hash: 09617C71508300AFC701DF50DC89E9FBBF8EF89750F404A2EF695921A1DB74AA49CB92

Function 007A82D5 Relevance: 23.1, APIs: 11, Strings: 2, Instructions: 378timeCOMMON

Download Yara Rule

APIs

VariantInit.OLEAUT32(00000000), ref: 007A831A
VariantCopy.OLEAUT32(00000000,?), ref: 007A8323
VariantClear.OLEAUT32(00000000), ref: 007A832F
VariantTimeToSystemTime.OLEAUT32(?,?,?), ref: 007A841D
__swprintf.LIBCMT ref: 007A844D
VarR8FromDec.OLEAUT32(?,?), ref: 007A8479
VariantInit.OLEAUT32(?), ref: 007A852A
SysFreeString.OLEAUT32(?), ref: 007A85BE
VariantClear.OLEAUT32(?), ref: 007A8618
VariantClear.OLEAUT32(?), ref: 007A8627
VariantInit.OLEAUT32(00000000), ref: 007A8665

Strings

Default, xrefs: 007A84DA
%4d%02d%02d%02d%02d%02d, xrefs: 007A8447

Memory Dump Source

Source File: 0000000A.00000002.2894756195.0000000000741000.00000020.00000001.01000000.00000006.sdmp, Offset: 00740000, based on PE: true

Associated: 0000000A.00000002.2894716076.0000000000740000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.2894810207.00000000007D0000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.2894810207.00000000007F6000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.2894865972.0000000000800000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.2894887053.0000000000809000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_740000_Launches.jbxd

Similarity

API ID: Variant$ClearInit$Time$CopyFreeFromStringSystem__swprintf
String ID: %4d%02d%02d%02d%02d%02d$Default
API String ID: 3730832054-3931177956
Opcode ID: 7928809e3872f2b50f7ab6bbb11f781c562b3d5d0e7ed77389bc3805fac9ac72
Instruction ID: 8d67f01636ee95c5e00f304e96b3fdab50ca13c9267a16e85b4d865f1cd401b7
Opcode Fuzzy Hash: 7928809e3872f2b50f7ab6bbb11f781c562b3d5d0e7ed77389bc3805fac9ac72
Instruction Fuzzy Hash: 1BD10471A04515EBDFA09F61C888B6EB7B4FF86701F188255E8059B281DF3CEC40DBA2

Function 007C49CF Relevance: 23.0, APIs: 2, Strings: 11, Instructions: 251windowCOMMON

Download Yara Rule

APIs

CharUpperBuffW.USER32(?,?), ref: 007C4A61
SendMessageW.USER32(?,00001105,00000000,00000000), ref: 007C4AAC

Strings

ISCHECKED, xrefs: 007C4C2F
GETTEXT, xrefs: 007C4BFF
GETSELECTED, xrefs: 007C4BBC
CHECK, xrefs: 007C4ACC
EXPAND, xrefs: 007C4B5E
COLLAPSE, xrefs: 007C4AF2
GETTOTALCOUNT, xrefs: 007C4A93
SELECT, xrefs: 007C4C5D
UNCHECK, xrefs: 007C4C88
EXISTS, xrefs: 007C4B15
GETITEMCOUNT, xrefs: 007C4B8E

Memory Dump Source

Source File: 0000000A.00000002.2894756195.0000000000741000.00000020.00000001.01000000.00000006.sdmp, Offset: 00740000, based on PE: true

Associated: 0000000A.00000002.2894716076.0000000000740000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.2894810207.00000000007D0000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.2894810207.00000000007F6000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.2894865972.0000000000800000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.2894887053.0000000000809000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_740000_Launches.jbxd

Similarity

API ID: BuffCharMessageSendUpper
String ID: CHECK$COLLAPSE$EXISTS$EXPAND$GETITEMCOUNT$GETSELECTED$GETTEXT$GETTOTALCOUNT$ISCHECKED$SELECT$UNCHECK
API String ID: 3974292440-4258414348
Opcode ID: d8aab14ca8238ce51d901a8ffa6336ef6bc795917452df3dbcf348a0393b509b
Instruction ID: 17d6dd91fcc652091557a29818d186a7c9abf4c83da382235c1428265b6a2105
Opcode Fuzzy Hash: d8aab14ca8238ce51d901a8ffa6336ef6bc795917452df3dbcf348a0393b509b
Instruction Fuzzy Hash: 3D919A70204705DBCB15EF20C465B6EB7A1BF84354F10896CF8965B3A2CB39ED0ADB92

Function 007AE25D Relevance: 22.9, APIs: 12, Strings: 1, Instructions: 185timeCOMMON

Download Yara Rule

APIs

GetLocalTime.KERNEL32(?), ref: 007AE31F
SystemTimeToFileTime.KERNEL32(?,?), ref: 007AE32F
LocalFileTimeToFileTime.KERNEL32(?,?), ref: 007AE33B
__wsplitpath.LIBCMT ref: 007AE399
_wcscat.LIBCMT ref: 007AE3B1
_wcscat.LIBCMT ref: 007AE3C3
GetCurrentDirectoryW.KERNEL32(00007FFF,?), ref: 007AE3D8
SetCurrentDirectoryW.KERNEL32(?), ref: 007AE3EC
SetCurrentDirectoryW.KERNEL32(?), ref: 007AE41E
SetCurrentDirectoryW.KERNEL32(?), ref: 007AE43F
_wcscpy.LIBCMT ref: 007AE44B
SetCurrentDirectoryW.KERNEL32(?,?,?,?,?), ref: 007AE48A

Strings

*.*, xrefs: 007AE445

Memory Dump Source

Source File: 0000000A.00000002.2894756195.0000000000741000.00000020.00000001.01000000.00000006.sdmp, Offset: 00740000, based on PE: true

Associated: 0000000A.00000002.2894716076.0000000000740000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.2894810207.00000000007D0000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.2894810207.00000000007F6000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.2894865972.0000000000800000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.2894887053.0000000000809000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_740000_Launches.jbxd

Similarity

API ID: CurrentDirectoryTime$File$Local_wcscat$System__wsplitpath_wcscpy
String ID: *.*
API String ID: 3566783562-438819550
Opcode ID: fd228f46593c35aead512e7c87822dcc49d13aae24cc84e7e68855cef9c2f38d
Instruction ID: 0538375419b9abea021f95add4a0f1af570f72ac535530b64c6e609a8535d9f6
Opcode Fuzzy Hash: fd228f46593c35aead512e7c87822dcc49d13aae24cc84e7e68855cef9c2f38d
Instruction Fuzzy Hash: 27614872504745DFCB10EF64C848A9EB7E8FF89310F048A1EF98987251EB39E945CB92

Function 007423F7 Relevance: 22.9, APIs: 12, Strings: 1, Instructions: 170timeCOMMON

Download Yara Rule

APIs

Part of subcall function 00741F1D: InvalidateRect.USER32(?,00000000,00000001,?,?,?,00742412,?,00000000,?,?,?,?,00741AA7,00000000,?), ref: 00741F76

DestroyWindow.USER32(?,?,?,?,?,?,?,?,?,?,?,00000000,?,?), ref: 007424AF
KillTimer.USER32(-00000001,?,?,?,?,00741AA7,00000000,?,?,00741EBE,?,?), ref: 0074254A
DestroyAcceleratorTable.USER32(00000000), ref: 0077BFE7
ImageList_Destroy.COMCTL32(00000000,?,00000000,?,?,?,?,00741AA7,00000000,?,?,00741EBE,?,?), ref: 0077C018
ImageList_Destroy.COMCTL32(00000000,?,00000000,?,?,?,?,00741AA7,00000000,?,?,00741EBE,?,?), ref: 0077C02F
ImageList_Destroy.COMCTL32(00000000,?,00000000,?,?,?,?,00741AA7,00000000,?,?,00741EBE,?,?), ref: 0077C04B
DeleteObject.GDI32(00000000), ref: 0077C05D

Strings

h}, xrefs: 0074256F

Memory Dump Source

Source File: 0000000A.00000002.2894756195.0000000000741000.00000020.00000001.01000000.00000006.sdmp, Offset: 00740000, based on PE: true

Associated: 0000000A.00000002.2894716076.0000000000740000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.2894810207.00000000007D0000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.2894810207.00000000007F6000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.2894865972.0000000000800000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.2894887053.0000000000809000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_740000_Launches.jbxd

Similarity

API ID: Destroy$ImageList_$AcceleratorDeleteInvalidateKillObjectRectTableTimerWindow
String ID: h}
API String ID: 641708696-1190393154
Opcode ID: 87a8af5e576ad99e6785babf623f183956758e05a41e7713c42eac4dac9a423d
Instruction ID: 2fa385838423a0c1ebbf5f41684d8edc11634ae904006620e3a2f0f86381e20a
Opcode Fuzzy Hash: 87a8af5e576ad99e6785babf623f183956758e05a41e7713c42eac4dac9a423d
Instruction Fuzzy Hash: E861AB30515640DFDB26AF18CD48B2AB7B1FB44312F90D56DE04686961C778BCA2DFA4

Function 007AA27B Relevance: 22.9, APIs: 7, Strings: 6, Instructions: 150COMMON

Download Yara Rule

APIs

LoadStringW.USER32(00000066,?,00000FFF,?), ref: 007AA2C2

Part of subcall function 00751A36: _memmove.LIBCMT ref: 00751A77

LoadStringW.USER32(00000072,?,00000FFF,?), ref: 007AA2E3
__swprintf.LIBCMT ref: 007AA33C
__swprintf.LIBCMT ref: 007AA355
_wprintf.LIBCMT ref: 007AA3FC
_wprintf.LIBCMT ref: 007AA41A

Strings

"%s" (%d) : ==> %s:%s%s, xrefs: 007AA3F7
Line %d (File "%s"):, xrefs: 007AA336, 007AA34F
Incorrect parameters to object property !, xrefs: 007AA39E
"%s" (%d) : ==> %s:, xrefs: 007AA415
^ ERROR , xrefs: 007AA391
Error: , xrefs: 007AA3C4

Memory Dump Source

Source File: 0000000A.00000002.2894756195.0000000000741000.00000020.00000001.01000000.00000006.sdmp, Offset: 00740000, based on PE: true

Associated: 0000000A.00000002.2894716076.0000000000740000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.2894810207.00000000007D0000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.2894810207.00000000007F6000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.2894865972.0000000000800000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.2894887053.0000000000809000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_740000_Launches.jbxd

Similarity

API ID: LoadString__swprintf_wprintf$_memmove
String ID: Error: $"%s" (%d) : ==> %s:$"%s" (%d) : ==> %s:%s%s$Incorrect parameters to object property !$Line %d (File "%s"):$^ ERROR
API String ID: 311963372-3080491070
Opcode ID: 7de74adcf979ab2a6ca7f7442b665a7ef833a922ab65d1753db3f90f7b31ae2e
Instruction ID: 53dbb3435d0ade9826d021957c18e545bdc9444e38e2ada69adc86e3c6224329
Opcode Fuzzy Hash: 7de74adcf979ab2a6ca7f7442b665a7ef833a922ab65d1753db3f90f7b31ae2e
Instruction Fuzzy Hash: E4518171900209FACF14EBE4CD4AEEEB779AF08342F504255F905B2192EB792F58DB61

Function 007A0065 Relevance: 22.9, APIs: 8, Strings: 5, Instructions: 138windowCOMMON

Download Yara Rule

APIs

GetModuleHandleW.KERNEL32(00000000,?,00000FFF,00000000,00000001,00000001,?,0078F8B8,00000001,0000138C,00000001,00000001,00000001,?,007B3FF9,00000001), ref: 007A009A
LoadStringW.USER32(00000000,?,0078F8B8,00000001), ref: 007A00A3

Part of subcall function 00751A36: _memmove.LIBCMT ref: 00751A77

GetModuleHandleW.KERNEL32(00000000,00807310,?,00000FFF,?,?,0078F8B8,00000001,0000138C,00000001,00000001,00000001,?,007B3FF9,00000001,00000001), ref: 007A00C5
LoadStringW.USER32(00000000,?,0078F8B8,00000001), ref: 007A00C8
__swprintf.LIBCMT ref: 007A0118
__swprintf.LIBCMT ref: 007A0129
_wprintf.LIBCMT ref: 007A01D2
MessageBoxW.USER32(00000000,?,?,00011010), ref: 007A01E9

Strings

Line %d (File "%s"):, xrefs: 007A0112
Line %d:, xrefs: 007A0123
%s (%d) : ==> %s: %s %s, xrefs: 007A01CD
^ ERROR, xrefs: 007A017E
Error: , xrefs: 007A01A0

Memory Dump Source

Source File: 0000000A.00000002.2894756195.0000000000741000.00000020.00000001.01000000.00000006.sdmp, Offset: 00740000, based on PE: true

Associated: 0000000A.00000002.2894716076.0000000000740000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.2894810207.00000000007D0000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.2894810207.00000000007F6000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.2894865972.0000000000800000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.2894887053.0000000000809000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_740000_Launches.jbxd

Similarity

API ID: HandleLoadModuleString__swprintf$Message_memmove_wprintf
String ID: Error: $%s (%d) : ==> %s: %s %s$Line %d (File "%s"):$Line %d:$^ ERROR
API String ID: 984253442-2268648507
Opcode ID: 2dd274f6c64bb5cb5801b7f5e07a61f399b29ebc053394680bf0a453e8dde3f2
Instruction ID: dcbf1ba2ff2d3459901196d9f4a8f09301453485b32ee3687f6c9598adbb6e83
Opcode Fuzzy Hash: 2dd274f6c64bb5cb5801b7f5e07a61f399b29ebc053394680bf0a453e8dde3f2
Instruction Fuzzy Hash: AA4164B180021DEACF14EBE0CD4AEEE7778AF55342F900555F905B2092EB796F08CBA1

Function 007AA995 Relevance: 22.9, APIs: 5, Strings: 8, Instructions: 138COMMON

Download Yara Rule

APIs

Part of subcall function 00744D37: __itow.LIBCMT ref: 00744D62
Part of subcall function 00744D37: __swprintf.LIBCMT ref: 00744DAC

CharLowerBuffW.USER32(?,?), ref: 007AAA0E
GetDriveTypeW.KERNEL32 ref: 007AAA5B
mciSendStringW.WINMM(?,00000000,00000000,00000000), ref: 007AAAA3
mciSendStringW.WINMM(?,00000000,00000000,00000000), ref: 007AAADA
mciSendStringW.WINMM(?,00000000,00000000,00000000), ref: 007AAB08

Part of subcall function 00751821: _memmove.LIBCMT ref: 0075185B

Strings

wait, xrefs: 007AAAC5
open, xrefs: 007AAA35
close cd wait, xrefs: 007AAAF3
open , xrefs: 007AAA6A
closed, xrefs: 007AAA22, 007AAA2B
set cd door , xrefs: 007AAAA9
type cdaudio alias cd wait, xrefs: 007AAA86
close, xrefs: 007AAA14

Memory Dump Source

Source File: 0000000A.00000002.2894756195.0000000000741000.00000020.00000001.01000000.00000006.sdmp, Offset: 00740000, based on PE: true

Associated: 0000000A.00000002.2894716076.0000000000740000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.2894810207.00000000007D0000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.2894810207.00000000007F6000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.2894865972.0000000000800000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.2894887053.0000000000809000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_740000_Launches.jbxd

Similarity

API ID: SendString$BuffCharDriveLowerType__itow__swprintf_memmove
String ID: type cdaudio alias cd wait$ wait$close$close cd wait$closed$open$open $set cd door
API String ID: 2698844021-4113822522
Opcode ID: ed3446bc7ea2acfab8aa908c7a655c34f7e5be2ed4d5cc938f97b698202d77e2
Instruction ID: ff20b47ddc6eb5b76989e69ec13c920fb9e16e2740460866735cf73f95ef1179
Opcode Fuzzy Hash: ed3446bc7ea2acfab8aa908c7a655c34f7e5be2ed4d5cc938f97b698202d77e2
Instruction Fuzzy Hash: F4518DB1204305EFC700EF20C885A6AB7F4FF88359F50896DF89597261DB39AD09CB92

Function 007AA832 Relevance: 22.9, APIs: 10, Strings: 3, Instructions: 102fileCOMMON

Download Yara Rule

APIs

GetFullPathNameW.KERNEL32(?,00007FFF,?,?), ref: 007AA852
__swprintf.LIBCMT ref: 007AA874
CreateDirectoryW.KERNEL32(?,00000000), ref: 007AA8B1
CreateFileW.KERNEL32(?,40000000,00000000,00000000,00000003,02200000,00000000), ref: 007AA8D6
_memset.LIBCMT ref: 007AA8F5
_wcsncpy.LIBCMT ref: 007AA931
DeviceIoControl.KERNEL32(00000000,000900A4,?,?,00000000,00000000,?,00000000), ref: 007AA966
CloseHandle.KERNEL32(00000000), ref: 007AA971
RemoveDirectoryW.KERNEL32(?), ref: 007AA97A
CloseHandle.KERNEL32(00000000), ref: 007AA984

Strings

:, xrefs: 007AA895
\, xrefs: 007AA88A
\??\%s, xrefs: 007AA86E

Memory Dump Source

Source File: 0000000A.00000002.2894756195.0000000000741000.00000020.00000001.01000000.00000006.sdmp, Offset: 00740000, based on PE: true

Associated: 0000000A.00000002.2894716076.0000000000740000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.2894810207.00000000007D0000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.2894810207.00000000007F6000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.2894865972.0000000000800000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.2894887053.0000000000809000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_740000_Launches.jbxd

Similarity

API ID: CloseCreateDirectoryHandle$ControlDeviceFileFullNamePathRemove__swprintf_memset_wcsncpy
String ID: :$\$\??\%s
API String ID: 2733774712-3457252023
Opcode ID: ec241fefb2ce52e641f765ac2ca6f60741d73b21dc0f89f39b5d2755fec13c73
Instruction ID: 7b0a71ab95ec7104e82a3e99f59e788d31be319f82dec005563417976e2cf88e
Opcode Fuzzy Hash: ec241fefb2ce52e641f765ac2ca6f60741d73b21dc0f89f39b5d2755fec13c73
Instruction Fuzzy Hash: 893170B150021AABDB219FA0DC49FEF77BCEF89701F1041A6F909D2160E778A645CB69

Function 007CC0A5 Relevance: 22.6, APIs: 15, Instructions: 130filecommemoryCOMMON

Download Yara Rule

APIs

CreateFileW.KERNEL32(00000000,80000000,00000000,00000000,00000003,00000000,00000000,00000000,?,?,?,?,?,007C982C,?,?), ref: 007CC0C8
GetFileSize.KERNEL32(00000000,00000000,?,?,?,?,007C982C,?,?,00000000,?), ref: 007CC0DF
GlobalAlloc.KERNEL32(00000002,00000000,?,?,?,?,007C982C,?,?,00000000,?), ref: 007CC0EA
CloseHandle.KERNEL32(00000000,?,?,?,?,007C982C,?,?,00000000,?), ref: 007CC0F7
GlobalLock.KERNEL32(00000000), ref: 007CC100
ReadFile.KERNEL32(00000000,00000000,00000000,00000000,00000000,?,?,?,?,007C982C,?,?,00000000,?), ref: 007CC10F
GlobalUnlock.KERNEL32(00000000), ref: 007CC118
CloseHandle.KERNEL32(00000000,?,?,?,?,007C982C,?,?,00000000,?), ref: 007CC11F
CreateStreamOnHGlobal.OLE32(00000000,00000001,?,?,?,?,?,007C982C,?,?,00000000,?), ref: 007CC130
OleLoadPicture.OLEAUT32(?,00000000,00000000,007D3C7C,?), ref: 007CC149
GlobalFree.KERNEL32(00000000), ref: 007CC159
GetObjectW.GDI32(00000000,00000018,?), ref: 007CC17D
CopyImage.USER32(00000000,00000000,?,?,00002000), ref: 007CC1A8
DeleteObject.GDI32(00000000), ref: 007CC1D0
SendMessageW.USER32(?,00000172,00000000,00000000), ref: 007CC1E6

Memory Dump Source

Source File: 0000000A.00000002.2894756195.0000000000741000.00000020.00000001.01000000.00000006.sdmp, Offset: 00740000, based on PE: true

Associated: 0000000A.00000002.2894716076.0000000000740000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.2894810207.00000000007D0000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.2894810207.00000000007F6000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.2894865972.0000000000800000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.2894887053.0000000000809000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_740000_Launches.jbxd

Similarity

API ID: Global$File$CloseCreateHandleObject$AllocCopyDeleteFreeImageLoadLockMessagePictureReadSendSizeStreamUnlock
String ID:
API String ID: 3840717409-0
Opcode ID: 274e0d833a1cf032e0e55cda3c7160b235a66bf28e532b3bb9bcef3efefd2f28
Instruction ID: 39a5a7a14aebb3c4b6452a4cc0f2afb4681336bdaaded4bdb8940419f3b2d299
Opcode Fuzzy Hash: 274e0d833a1cf032e0e55cda3c7160b235a66bf28e532b3bb9bcef3efefd2f28
Instruction Fuzzy Hash: 18415A71501208EFCB118F65CC88FAE7BB9FB89711F148059F909E7260C7389940DBA4

Function 007CC854 Relevance: 21.2, APIs: 11, Strings: 1, Instructions: 229windowCOMMON

Download Yara Rule

APIs

Part of subcall function 007429E2: GetWindowLongW.USER32(?,000000EB), ref: 007429F3

PostMessageW.USER32(?,00000111,00000000,00000000), ref: 007CC8A4
GetFocus.USER32 ref: 007CC8B4
GetDlgCtrlID.USER32(00000000), ref: 007CC8BF
_memset.LIBCMT ref: 007CC9EA
GetMenuItemInfoW.USER32(?,00000000,00000000,?), ref: 007CCA15
GetMenuItemCount.USER32(?), ref: 007CCA35
GetMenuItemID.USER32(?,00000000), ref: 007CCA48
GetMenuItemInfoW.USER32(?,-00000001,00000001,?), ref: 007CCA7C
GetMenuItemInfoW.USER32(?,?,00000001,?), ref: 007CCAC4
CheckMenuRadioItem.USER32(?,00000000,?,00000000,00000400), ref: 007CCAFC
DefDlgProcW.USER32(?,00000111,?,?,?,?,?,?,?), ref: 007CCB31

Strings

0, xrefs: 007CC9E2

Memory Dump Source

Source File: 0000000A.00000002.2894756195.0000000000741000.00000020.00000001.01000000.00000006.sdmp, Offset: 00740000, based on PE: true

Associated: 0000000A.00000002.2894716076.0000000000740000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.2894810207.00000000007D0000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.2894810207.00000000007F6000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.2894865972.0000000000800000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.2894887053.0000000000809000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_740000_Launches.jbxd

Similarity

API ID: ItemMenu$Info$CheckCountCtrlFocusLongMessagePostProcRadioWindow_memset
String ID: 0
API String ID: 1296962147-4108050209
Opcode ID: 3de58efd2bafe71ee4344aa62d4557b36ba7421b37b99abfc0c7aea1eaa15e6a
Instruction ID: a92a33fe9e7dcd7b75efee0fabc41870f5959404d9358345eddb93ed3719e014
Opcode Fuzzy Hash: 3de58efd2bafe71ee4344aa62d4557b36ba7421b37b99abfc0c7aea1eaa15e6a
Instruction Fuzzy Hash: 19814A706083059FD711CF14D889F6BBBE8FB88354F04856EF99997291D738E905CBA2

Function 00798ACA Relevance: 21.2, APIs: 14, Instructions: 179memoryCOMMON

Download Yara Rule

APIs

Part of subcall function 00798E20: GetUserObjectSecurity.USER32(?,00000004,?,00000000,?), ref: 00798E3C
Part of subcall function 00798E20: GetLastError.KERNEL32(?,00798900,?,?,?), ref: 00798E46
Part of subcall function 00798E20: GetProcessHeap.KERNEL32(00000008,?,?,00798900,?,?,?), ref: 00798E55
Part of subcall function 00798E20: HeapAlloc.KERNEL32(00000000,?,00798900,?,?,?), ref: 00798E5C
Part of subcall function 00798E20: GetUserObjectSecurity.USER32(?,00000004,00000000,?,?), ref: 00798E73

Part of subcall function 00798EBD: GetProcessHeap.KERNEL32(00000008,00798916,00000000,00000000,?,00798916,?), ref: 00798EC9
Part of subcall function 00798EBD: HeapAlloc.KERNEL32(00000000,?,00798916,?), ref: 00798ED0
Part of subcall function 00798EBD: InitializeSecurityDescriptor.ADVAPI32(00000000,00000001,?,00798916,?), ref: 00798EE1

GetSecurityDescriptorDacl.ADVAPI32(?,?,?,?), ref: 00798B2E
_memset.LIBCMT ref: 00798B43
GetAclInformation.ADVAPI32(?,?,0000000C,00000002), ref: 00798B62
GetLengthSid.ADVAPI32(?), ref: 00798B73
GetAce.ADVAPI32(?,00000000,?), ref: 00798BB0
AddAce.ADVAPI32(?,00000002,000000FF,?,?), ref: 00798BCC
GetLengthSid.ADVAPI32(?), ref: 00798BE9
GetProcessHeap.KERNEL32(00000008,-00000008), ref: 00798BF8
HeapAlloc.KERNEL32(00000000), ref: 00798BFF
GetLengthSid.ADVAPI32(?,00000008,?), ref: 00798C20
CopySid.ADVAPI32(00000000), ref: 00798C27
AddAce.ADVAPI32(?,00000002,000000FF,00000000,?), ref: 00798C58
SetSecurityDescriptorDacl.ADVAPI32(?,00000001,?,00000000), ref: 00798C7E
SetUserObjectSecurity.USER32(?,00000004,?), ref: 00798C92

Memory Dump Source

Source File: 0000000A.00000002.2894756195.0000000000741000.00000020.00000001.01000000.00000006.sdmp, Offset: 00740000, based on PE: true

Associated: 0000000A.00000002.2894716076.0000000000740000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.2894810207.00000000007D0000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.2894810207.00000000007F6000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.2894865972.0000000000800000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.2894887053.0000000000809000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_740000_Launches.jbxd

Similarity

API ID: HeapSecurity$AllocDescriptorLengthObjectProcessUser$Dacl$CopyErrorInformationInitializeLast_memset
String ID:
API String ID: 3996160137-0
Opcode ID: 0284c8a1be4e222d1aa6be9936b0e849a0d362c5b0dee09e5974c0f8e4f4096f
Instruction ID: a3f2da78c16937c429fff73500e257cb3e0d116c3a307d3d5753d322540a78f1
Opcode Fuzzy Hash: 0284c8a1be4e222d1aa6be9936b0e849a0d362c5b0dee09e5974c0f8e4f4096f
Instruction Fuzzy Hash: CA615B71901209FFDF509F94EC48EAEBB79FF06300F14815AE915A6290EB399A05CBA1

Function 007B7A04 Relevance: 21.2, APIs: 11, Strings: 1, Instructions: 160windowCOMMON

Download Yara Rule

APIs

GetDC.USER32(00000000), ref: 007B7A79
CreateCompatibleBitmap.GDI32(00000000,00000007,?), ref: 007B7A85
CreateCompatibleDC.GDI32(?), ref: 007B7A91
SelectObject.GDI32(00000000,?), ref: 007B7A9E
StretchBlt.GDI32(00000006,00000000,00000000,00000007,?,?,?,?,00000007,?,00CC0020), ref: 007B7AF2
GetDIBits.GDI32(00000006,?,00000000,00000000,00000000,00000028,00000000), ref: 007B7B2E
GetDIBits.GDI32(00000006,?,00000000,?,00000000,00000028,00000000), ref: 007B7B52
SelectObject.GDI32(00000006,?), ref: 007B7B5A
DeleteObject.GDI32(?), ref: 007B7B63
DeleteDC.GDI32(00000006), ref: 007B7B6A
ReleaseDC.USER32(00000000,?), ref: 007B7B75

Strings

(, xrefs: 007B7AFA

Memory Dump Source

Source File: 0000000A.00000002.2894756195.0000000000741000.00000020.00000001.01000000.00000006.sdmp, Offset: 00740000, based on PE: true

Associated: 0000000A.00000002.2894716076.0000000000740000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.2894810207.00000000007D0000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.2894810207.00000000007F6000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.2894865972.0000000000800000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.2894887053.0000000000809000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_740000_Launches.jbxd

Similarity

API ID: Object$BitsCompatibleCreateDeleteSelect$BitmapReleaseStretch
String ID: (
API String ID: 2598888154-3887548279
Opcode ID: 057749874909144bc30c61b65ea97177594bc101d3b5ea0bb207e300f91ccf4d
Instruction ID: 7c8aa1f2ad6cf5eed705d2b78bf965a16d5c66457f7f3591ffcfc7e9a89e541c
Opcode Fuzzy Hash: 057749874909144bc30c61b65ea97177594bc101d3b5ea0bb207e300f91ccf4d
Instruction Fuzzy Hash: DF512A71904209EFCB14CFA8CC85FAEBBB9EF48310F14841EF95AA7250D635A941CB94

Function 007AA48D Relevance: 21.2, APIs: 7, Strings: 5, Instructions: 156COMMON

Download Yara Rule

APIs

LoadStringW.USER32(00000066,?,00000FFF,?), ref: 007AA4D4

Part of subcall function 00751A36: _memmove.LIBCMT ref: 00751A77

LoadStringW.USER32(?,?,00000FFF,?), ref: 007AA4F6
__swprintf.LIBCMT ref: 007AA54F
__swprintf.LIBCMT ref: 007AA568
_wprintf.LIBCMT ref: 007AA61E
_wprintf.LIBCMT ref: 007AA63C

Strings

"%s" (%d) : ==> %s:%s%s, xrefs: 007AA619
Line %d (File "%s"):, xrefs: 007AA549, 007AA562
"%s" (%d) : ==> %s:, xrefs: 007AA637
^ ERROR, xrefs: 007AA5C0
Error: , xrefs: 007AA5E6

Memory Dump Source

Source File: 0000000A.00000002.2894756195.0000000000741000.00000020.00000001.01000000.00000006.sdmp, Offset: 00740000, based on PE: true

Associated: 0000000A.00000002.2894716076.0000000000740000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.2894810207.00000000007D0000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.2894810207.00000000007F6000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.2894865972.0000000000800000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.2894887053.0000000000809000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_740000_Launches.jbxd

Similarity

API ID: LoadString__swprintf_wprintf$_memmove
String ID: Error: $"%s" (%d) : ==> %s:$"%s" (%d) : ==> %s:%s%s$Line %d (File "%s"):$^ ERROR
API String ID: 311963372-2391861430
Opcode ID: a5e24663bff6a0042c073b069a0a13ea2599024d6b670900c04ad3e3a05b95cb
Instruction ID: d182db93dfad2ecbb6b7735e16a2af6f7ed1c15b5a0e80c1352798fba061597d
Opcode Fuzzy Hash: a5e24663bff6a0042c073b069a0a13ea2599024d6b670900c04ad3e3a05b95cb
Instruction Fuzzy Hash: 0351AE71900109FACF15EBE0CD4AEEEB779AF05342F504265F905A21A1EB792F58CF61

Function 007A9710 Relevance: 19.8, APIs: 13, Instructions: 322fileCOMMON

Download Yara Rule

APIs

Part of subcall function 007A951A: __time64.LIBCMT ref: 007A9524

Part of subcall function 00754A8C: _fseek.LIBCMT ref: 00754AA4

__wsplitpath.LIBCMT ref: 007A97EF

Part of subcall function 0076431E: __wsplitpath_helper.LIBCMT ref: 0076435E

_wcscpy.LIBCMT ref: 007A9802
_wcscat.LIBCMT ref: 007A9815
__wsplitpath.LIBCMT ref: 007A983A
_wcscat.LIBCMT ref: 007A9850
_wcscat.LIBCMT ref: 007A9863

Part of subcall function 007A9560: _memmove.LIBCMT ref: 007A9599
Part of subcall function 007A9560: _memmove.LIBCMT ref: 007A95A8

_wcscmp.LIBCMT ref: 007A97AA

Part of subcall function 007A9CF1: _wcscmp.LIBCMT ref: 007A9DE1
Part of subcall function 007A9CF1: _wcscmp.LIBCMT ref: 007A9DF4

DeleteFileW.KERNEL32(?,?,?,?,00000004,00000001,?,?,00000004,00000001,?,?,00000004,00000001,?,?), ref: 007A9A0D
_wcsncpy.LIBCMT ref: 007A9A80
DeleteFileW.KERNEL32(?,?), ref: 007A9AB6
CopyFileW.KERNEL32(?,?,00000000,?,?,?,00000004,00000001,?,?,00000004,00000001,?,?,00000004,00000001), ref: 007A9ACC
DeleteFileW.KERNEL32(?,?,?,00000004,00000001,?,?,00000004,00000001,?,?,00000004,00000001,?,?,00000004), ref: 007A9ADD
DeleteFileW.KERNEL32(?,?,?,00000004,00000001,?,?,00000004,00000001,?,?,00000004,00000001,?,?,00000004), ref: 007A9AEF

Memory Dump Source

Source File: 0000000A.00000002.2894756195.0000000000741000.00000020.00000001.01000000.00000006.sdmp, Offset: 00740000, based on PE: true

Associated: 0000000A.00000002.2894716076.0000000000740000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.2894810207.00000000007D0000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.2894810207.00000000007F6000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.2894865972.0000000000800000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.2894887053.0000000000809000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_740000_Launches.jbxd

Similarity

API ID: File$Delete$_wcscat_wcscmp$__wsplitpath_memmove$Copy__time64__wsplitpath_helper_fseek_wcscpy_wcsncpy
String ID:
API String ID: 1500180987-0
Opcode ID: 1a2aa619581d39dca041b08e0b4d57085890b6ceed1f28249cca1783739f020f
Instruction ID: 72563920e01f62b08adf9d24287667f0d5ffd3ebcedf685c930f4f42e5f9c88c
Opcode Fuzzy Hash: 1a2aa619581d39dca041b08e0b4d57085890b6ceed1f28249cca1783739f020f
Instruction Fuzzy Hash: 37C14DB1D00218AADF11DF95CC89ADEB7BDEF85300F0081AAF609E7151EB749A94CF65

Function 00755BD7 Relevance: 19.7, APIs: 13, Instructions: 215windowCOMMON

Download Yara Rule

APIs

_memset.LIBCMT ref: 00755BF1
GetMenuItemCount.USER32(00807890), ref: 00790E7B
GetMenuItemCount.USER32(00807890), ref: 00790F2B
GetCursorPos.USER32(?), ref: 00790F6F
SetForegroundWindow.USER32(00000000), ref: 00790F78
TrackPopupMenuEx.USER32(00807890,00000000,?,00000000,00000000,00000000), ref: 00790F8B
PostMessageW.USER32(00000000,00000000,00000000,00000000), ref: 00790F97

Memory Dump Source

Source File: 0000000A.00000002.2894756195.0000000000741000.00000020.00000001.01000000.00000006.sdmp, Offset: 00740000, based on PE: true

Associated: 0000000A.00000002.2894716076.0000000000740000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.2894810207.00000000007D0000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.2894810207.00000000007F6000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.2894865972.0000000000800000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.2894887053.0000000000809000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_740000_Launches.jbxd

Similarity

API ID: Menu$CountItem$CursorForegroundMessagePopupPostTrackWindow_memset
String ID:
API String ID: 2751501086-0
Opcode ID: 62ce795fafd4af3deb0ef8050d9d1693a925c9989ebab643d6300c6ad3a7fcb6
Instruction ID: 289559ae55a8b877834a4747d3e9636d3d1c390e6042a3c0ce94a94123d935cc
Opcode Fuzzy Hash: 62ce795fafd4af3deb0ef8050d9d1693a925c9989ebab643d6300c6ad3a7fcb6
Instruction Fuzzy Hash: 15712370605709BFEF209B54EC89FAABF65FF04724F104206F924661D1C7B96860DBE0

Function 007AAEEA Relevance: 19.4, APIs: 3, Strings: 8, Instructions: 183COMMON

Download Yara Rule

APIs

CharLowerBuffW.USER32(?,?,007D0980), ref: 007AAF4E
GetDriveTypeW.KERNEL32(00000061,007FB5F0,00000061), ref: 007AB018
_wcscpy.LIBCMT ref: 007AB042

Strings

ramdisk, xrefs: 007AAFC2
removable, xrefs: 007AAF80
all, xrefs: 007AAF54
network, xrefs: 007AAFAC
L,}, xrefs: 007AB03A
unknown, xrefs: 007AAFD9
fixed, xrefs: 007AAF96
cdrom, xrefs: 007AAF6A

Memory Dump Source

Source File: 0000000A.00000002.2894756195.0000000000741000.00000020.00000001.01000000.00000006.sdmp, Offset: 00740000, based on PE: true

Associated: 0000000A.00000002.2894716076.0000000000740000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.2894810207.00000000007D0000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.2894810207.00000000007F6000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.2894865972.0000000000800000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.2894887053.0000000000809000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_740000_Launches.jbxd

Similarity

API ID: BuffCharDriveLowerType_wcscpy
String ID: L,}$all$cdrom$fixed$network$ramdisk$removable$unknown
API String ID: 2820617543-1469465039
Opcode ID: 6231e38e2b161574ddc97daca82cc777092651eeec52adaa382b93371df70246
Instruction ID: d4e80520b3ed8fe783dcb496acb307c285a37f9a573c92d1b9fac0b319bf1bbd
Opcode Fuzzy Hash: 6231e38e2b161574ddc97daca82cc777092651eeec52adaa382b93371df70246
Instruction Fuzzy Hash: EE51E270108305EFC714EF24C895AABB7A5FF91304F504A1DF996572A2DB78ED09CB92

Function 007983FA Relevance: 19.4, APIs: 8, Strings: 3, Instructions: 128registryshareCOMMON

Download Yara Rule

APIs

Part of subcall function 00751821: _memmove.LIBCMT ref: 0075185B

_memset.LIBCMT ref: 00798489
WNetAddConnection2W.MPR(?,?,?,00000000), ref: 007984BE
RegConnectRegistryW.ADVAPI32(?,80000002,?), ref: 007984DA
RegOpenKeyExW.ADVAPI32(?,?,00000000,00020019,?,?,SOFTWARE\Classes\), ref: 007984F6
RegQueryValueExW.ADVAPI32(?,00000000,00000000,00000000,?,?,?,SOFTWARE\Classes\), ref: 00798520
CLSIDFromString.OLE32(?,?,?,SOFTWARE\Classes\), ref: 00798548
RegCloseKey.ADVAPI32(?,?,SOFTWARE\Classes\), ref: 00798553
RegCloseKey.ADVAPI32(?,?,SOFTWARE\Classes\), ref: 00798558

Strings

\IPC$, xrefs: 007984A0
SOFTWARE\Classes\, xrefs: 0079842A
\CLSID, xrefs: 00798440

Memory Dump Source

Source File: 0000000A.00000002.2894756195.0000000000741000.00000020.00000001.01000000.00000006.sdmp, Offset: 00740000, based on PE: true

Associated: 0000000A.00000002.2894716076.0000000000740000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.2894810207.00000000007D0000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.2894810207.00000000007F6000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.2894865972.0000000000800000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.2894887053.0000000000809000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_740000_Launches.jbxd

Similarity

API ID: Close$ConnectConnection2FromOpenQueryRegistryStringValue_memmove_memset
String ID: SOFTWARE\Classes\$\CLSID$\IPC$
API String ID: 1411258926-22481851
Opcode ID: 4493a3689b4000e0fe7acec44f7e1f2f6b731d3394649feac6e4ccd214331f32
Instruction ID: e2512db7bbee6012f59be70f8a270208af32ca417efcc93c40f40835ef1a7916
Opcode Fuzzy Hash: 4493a3689b4000e0fe7acec44f7e1f2f6b731d3394649feac6e4ccd214331f32
Instruction Fuzzy Hash: 36410972C1022DEBCF11EBA4DC59EEDB778FF04352F404129E915A2261EB796D08CB90

Function 007C147A Relevance: 19.4, APIs: 1, Strings: 10, Instructions: 120COMMON

Download Yara Rule

APIs

CharUpperBuffW.USER32(?,?,?,?,?,?,?,007C040D,?,?), ref: 007C1491

Strings

HKEY_CURRENT_CONFIG, xrefs: 007C154E
HKEY_CURRENT_USER, xrefs: 007C1570
HKEY_CLASSES_ROOT, xrefs: 007C1524
HKLM, xrefs: 007C150F
HKCU, xrefs: 007C1581
HKEY_USERS, xrefs: 007C1592
HKCR, xrefs: 007C1539
HKU, xrefs: 007C15A3
HKCC, xrefs: 007C155F
HKEY_LOCAL_MACHINE, xrefs: 007C14FA

Memory Dump Source

Source File: 0000000A.00000002.2894756195.0000000000741000.00000020.00000001.01000000.00000006.sdmp, Offset: 00740000, based on PE: true

Associated: 0000000A.00000002.2894716076.0000000000740000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.2894810207.00000000007D0000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.2894810207.00000000007F6000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.2894865972.0000000000800000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.2894887053.0000000000809000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_740000_Launches.jbxd

Similarity

API ID: BuffCharUpper
String ID: HKCC$HKCR$HKCU$HKEY_CLASSES_ROOT$HKEY_CURRENT_CONFIG$HKEY_CURRENT_USER$HKEY_LOCAL_MACHINE$HKEY_USERS$HKLM$HKU
API String ID: 3964851224-909552448
Opcode ID: a4dcae0c36c6dee5820b1595fb47ca702c6858ea753a61a255116a7337798c98
Instruction ID: 7582929d0cb797625ee0f8c28702ff367e9e541f0f67338630f85f7329cc1083
Opcode Fuzzy Hash: a4dcae0c36c6dee5820b1595fb47ca702c6858ea753a61a255116a7337798c98
Instruction Fuzzy Hash: EF413A7060025EDBDF01EF60E955BEA3724AF52300FA04569FC9257252DB78ED2ACBA0

Function 007A5882 Relevance: 19.3, APIs: 5, Strings: 6, Instructions: 74COMMON

Download Yara Rule

APIs

Part of subcall function 00751821: _memmove.LIBCMT ref: 0075185B

Part of subcall function 0075153B: _memmove.LIBCMT ref: 007515C4

mciSendStringW.WINMM(status PlayMe mode,?,00000100,00000000), ref: 007A58EB
mciSendStringW.WINMM(close PlayMe,00000000,00000000,00000000), ref: 007A5901
mciSendStringW.WINMM(?,00000000,00000000,00000000), ref: 007A5912
mciSendStringW.WINMM(play PlayMe wait,00000000,00000000,00000000), ref: 007A5924
mciSendStringW.WINMM(play PlayMe,00000000,00000000,00000000), ref: 007A5935

Strings

alias PlayMe, xrefs: 007A58C4
status PlayMe mode, xrefs: 007A58E6
close PlayMe, xrefs: 007A58FC, 007A5929
open , xrefs: 007A589A
play PlayMe, xrefs: 007A5930
play PlayMe wait, xrefs: 007A591F

Memory Dump Source

Source File: 0000000A.00000002.2894756195.0000000000741000.00000020.00000001.01000000.00000006.sdmp, Offset: 00740000, based on PE: true

Associated: 0000000A.00000002.2894716076.0000000000740000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.2894810207.00000000007D0000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.2894810207.00000000007F6000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.2894865972.0000000000800000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.2894887053.0000000000809000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_740000_Launches.jbxd

Similarity

API ID: SendString$_memmove
String ID: alias PlayMe$close PlayMe$open $play PlayMe$play PlayMe wait$status PlayMe mode
API String ID: 2279737902-1007645807
Opcode ID: 8234c3903da149fe7086174ae7893dd59f2084a2f2fd217084920ee89ccfa2d2
Instruction ID: d271e4cc65267eaaabaf5f7d6bbb71b9e112f3d831a56e9405bdc9c8b53aaa51
Opcode Fuzzy Hash: 8234c3903da149fe7086174ae7893dd59f2084a2f2fd217084920ee89ccfa2d2
Instruction Fuzzy Hash: 8911B67198015DF9D720A761DC4EEFF6B7CEFD2B61F8005297901961D0EAA82D04C5A0

Function 007A4C0C Relevance: 19.3, APIs: 10, Strings: 1, Instructions: 73networkCOMMON

Download Yara Rule

APIs

WSAStartup.WSOCK32(00000101,?), ref: 007A4C27
gethostname.WSOCK32(?,00000100), ref: 007A4C41
gethostbyname.WSOCK32(?), ref: 007A4C4E
_wcscpy.LIBCMT ref: 007A4C76
_memmove.LIBCMT ref: 007A4C89
inet_ntoa.WSOCK32(?), ref: 007A4C94
_strcat.LIBCMT ref: 007A4CA2
_wcscpy.LIBCMT ref: 007A4CB9
WSACleanup.WSOCK32 ref: 007A4CC7
_wcscpy.LIBCMT ref: 007A4CD5

Strings

0.0.0.0, xrefs: 007A4C70

Memory Dump Source

Source File: 0000000A.00000002.2894756195.0000000000741000.00000020.00000001.01000000.00000006.sdmp, Offset: 00740000, based on PE: true

Associated: 0000000A.00000002.2894716076.0000000000740000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.2894810207.00000000007D0000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.2894810207.00000000007F6000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.2894865972.0000000000800000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.2894887053.0000000000809000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_740000_Launches.jbxd

Similarity

API ID: _wcscpy$CleanupStartup_memmove_strcatgethostbynamegethostnameinet_ntoa
String ID: 0.0.0.0
API String ID: 208665112-3771769585
Opcode ID: 0d2e433d0712413e18e2f3aca31fdbc49d644bbd5354732b60183d92d7024d1c
Instruction ID: 68f142b3d2b6674845f9abeb39415016e706f112173ed8d17f9e8b34b8999345
Opcode Fuzzy Hash: 0d2e433d0712413e18e2f3aca31fdbc49d644bbd5354732b60183d92d7024d1c
Instruction Fuzzy Hash: FE113A31505108FBCB20A7609C4EEEA7BBCDFC2720F045266F44996192EFBD99818BB1

Function 007A5530 Relevance: 19.3, APIs: 10, Strings: 1, Instructions: 72sleepwindowtimeCOMMON

Download Yara Rule

APIs

timeGetTime.WINMM ref: 007A5535

Part of subcall function 0076083E: timeGetTime.WINMM(?,00000002,0074C22C), ref: 00760842

Sleep.KERNEL32(0000000A), ref: 007A5561
EnumThreadWindows.USER32(?,Function_000654E3,00000000), ref: 007A5585
FindWindowExW.USER32(00000000,00000000,BUTTON,00000000), ref: 007A55A7
SetActiveWindow.USER32 ref: 007A55C6
SendMessageW.USER32(00000000,000000F5,00000000,00000000), ref: 007A55D4
SendMessageW.USER32(00000010,00000000,00000000), ref: 007A55F3
Sleep.KERNEL32(000000FA), ref: 007A55FE
IsWindow.USER32 ref: 007A560A
EndDialog.USER32(00000000), ref: 007A561B

Strings

BUTTON, xrefs: 007A5599

Memory Dump Source

Source File: 0000000A.00000002.2894756195.0000000000741000.00000020.00000001.01000000.00000006.sdmp, Offset: 00740000, based on PE: true

Associated: 0000000A.00000002.2894716076.0000000000740000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.2894810207.00000000007D0000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.2894810207.00000000007F6000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.2894865972.0000000000800000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.2894887053.0000000000809000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_740000_Launches.jbxd

Similarity

API ID: Window$MessageSendSleepTimetime$ActiveDialogEnumFindThreadWindows
String ID: BUTTON
API String ID: 1194449130-3405671355
Opcode ID: 12e6094f99a35c29bdae27678058474217fcac0c1300cf7390a9c250c9d71a8e
Instruction ID: 775aea5baea451173e9d252969c908f011936ff3f976b9618bed68526ce837f7
Opcode Fuzzy Hash: 12e6094f99a35c29bdae27678058474217fcac0c1300cf7390a9c250c9d71a8e
Instruction Fuzzy Hash: 0521C2B0505604EFEB805B60EC89B293B7BFB85744F006115F542821A1DB799DA0CABA

Function 007ADBD0 Relevance: 18.3, APIs: 12, Instructions: 283comCOMMON

Download Yara Rule

APIs

Part of subcall function 00744D37: __itow.LIBCMT ref: 00744D62
Part of subcall function 00744D37: __swprintf.LIBCMT ref: 00744DAC

CoInitialize.OLE32(00000000), ref: 007ADC2D
SHGetSpecialFolderLocation.SHELL32(00000000,00000000,?), ref: 007ADCC0
SHGetDesktopFolder.SHELL32(?), ref: 007ADCD4
CoCreateInstance.OLE32(007D3D4C,00000000,00000001,007FB86C,?), ref: 007ADD20
SHCreateShellItem.SHELL32(00000000,00000000,?,00000003), ref: 007ADD8F
CoTaskMemFree.OLE32(?,?), ref: 007ADDE7
_memset.LIBCMT ref: 007ADE24
SHBrowseForFolderW.SHELL32(?), ref: 007ADE60
SHGetPathFromIDListW.SHELL32(00000000,?), ref: 007ADE83
CoTaskMemFree.OLE32(00000000), ref: 007ADE8A
CoTaskMemFree.OLE32(00000000,00000001,00000000), ref: 007ADEC1
CoUninitialize.OLE32(00000001,00000000), ref: 007ADEC3

Memory Dump Source

Source File: 0000000A.00000002.2894756195.0000000000741000.00000020.00000001.01000000.00000006.sdmp, Offset: 00740000, based on PE: true

Associated: 0000000A.00000002.2894716076.0000000000740000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.2894810207.00000000007D0000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.2894810207.00000000007F6000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.2894865972.0000000000800000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.2894887053.0000000000809000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_740000_Launches.jbxd

Similarity

API ID: FolderFreeTask$Create$BrowseDesktopFromInitializeInstanceItemListLocationPathShellSpecialUninitialize__itow__swprintf_memset
String ID:
API String ID: 1246142700-0
Opcode ID: a46037ed5f5feda8bb14d412c2aefc4045f3325cd5e3698be5f94d9413f1573f
Instruction ID: 12e7452c8d3384c35069490eb3b3beb5c10e1427fbc3cbc67b9cb96a76124813
Opcode Fuzzy Hash: a46037ed5f5feda8bb14d412c2aefc4045f3325cd5e3698be5f94d9413f1573f
Instruction Fuzzy Hash: F3B1FA75A00109EFDB14DFA4C888EAEBBB9FF89314F148159E906EB251DB34ED45CB90

Function 007A081B Relevance: 18.2, APIs: 12, Instructions: 186keyboardCOMMON

Download Yara Rule

APIs

GetKeyboardState.USER32(?), ref: 007A0896
SetKeyboardState.USER32(?), ref: 007A0901
GetAsyncKeyState.USER32(000000A0), ref: 007A0921
GetKeyState.USER32(000000A0), ref: 007A0938
GetAsyncKeyState.USER32(000000A1), ref: 007A0967
GetKeyState.USER32(000000A1), ref: 007A0978
GetAsyncKeyState.USER32(00000011), ref: 007A09A4
GetKeyState.USER32(00000011), ref: 007A09B2
GetAsyncKeyState.USER32(00000012), ref: 007A09DB
GetKeyState.USER32(00000012), ref: 007A09E9
GetAsyncKeyState.USER32(0000005B), ref: 007A0A12
GetKeyState.USER32(0000005B), ref: 007A0A20

Memory Dump Source

Source File: 0000000A.00000002.2894756195.0000000000741000.00000020.00000001.01000000.00000006.sdmp, Offset: 00740000, based on PE: true

Associated: 0000000A.00000002.2894716076.0000000000740000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.2894810207.00000000007D0000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.2894810207.00000000007F6000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.2894865972.0000000000800000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.2894887053.0000000000809000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_740000_Launches.jbxd

Similarity

API ID: State$Async$Keyboard
String ID:
API String ID: 541375521-0
Opcode ID: 5dcb5e488f9e6dbd95af7e2af29672af6b5a428d887d00034a8457af28775615
Instruction ID: bae77d8bdb0e6183aaae16696c26817faf72551bddad371eed815d20db654fe2
Opcode Fuzzy Hash: 5dcb5e488f9e6dbd95af7e2af29672af6b5a428d887d00034a8457af28775615
Instruction Fuzzy Hash: FF51DB24A0478459FB34DBB044147AABFB49F43380F488B9DC5C2575C3DA6CAA4CCBE5

Function 0079CE00 Relevance: 18.2, APIs: 12, Instructions: 174COMMON

Download Yara Rule

APIs

GetDlgItem.USER32(?,00000001), ref: 0079CE1C
GetWindowRect.USER32(00000000,?), ref: 0079CE2E
MoveWindow.USER32(00000001,0000000A,?,00000001,?,00000000), ref: 0079CE8C
GetDlgItem.USER32(?,00000002), ref: 0079CE97
GetWindowRect.USER32(00000000,?), ref: 0079CEA9
MoveWindow.USER32(00000001,?,00000000,00000001,?,00000000), ref: 0079CEFD
GetDlgItem.USER32(?,000003E9), ref: 0079CF0B
GetWindowRect.USER32(00000000,?), ref: 0079CF1C
MoveWindow.USER32(00000000,0000000A,00000000,?,?,00000000), ref: 0079CF5F
GetDlgItem.USER32(?,000003EA), ref: 0079CF6D
MoveWindow.USER32(00000000,0000000A,0000000A,?,-00000005,00000000), ref: 0079CF8A
InvalidateRect.USER32(?,00000000,00000001), ref: 0079CF97

Memory Dump Source

Source File: 0000000A.00000002.2894756195.0000000000741000.00000020.00000001.01000000.00000006.sdmp, Offset: 00740000, based on PE: true

Associated: 0000000A.00000002.2894716076.0000000000740000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.2894810207.00000000007D0000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.2894810207.00000000007F6000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.2894865972.0000000000800000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.2894887053.0000000000809000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_740000_Launches.jbxd

Similarity

API ID: Window$ItemMoveRect$Invalidate
String ID:
API String ID: 3096461208-0
Opcode ID: 0023e5f3ae6cdc5f144465b47903310a62b4c1eca2383452b3bec0a6d3d27147
Instruction ID: 3c6c90464b2b79604e3a6287c70506609a0248f8e4fdc04b37347530ccc3eb3a
Opcode Fuzzy Hash: 0023e5f3ae6cdc5f144465b47903310a62b4c1eca2383452b3bec0a6d3d27147
Instruction Fuzzy Hash: 78513E71B00205AFDF18CF69DD99BAEBBBAEB88710F148129F516E6290D774AD008B54

Function 00742581 Relevance: 18.1, APIs: 12, Instructions: 132COMMON

Download Yara Rule

APIs

Part of subcall function 007429AB: GetWindowLongW.USER32(?,000000EB), ref: 007429BC

GetSysColor.USER32(0000000F), ref: 007425AF

Memory Dump Source

Source File: 0000000A.00000002.2894756195.0000000000741000.00000020.00000001.01000000.00000006.sdmp, Offset: 00740000, based on PE: true

Associated: 0000000A.00000002.2894716076.0000000000740000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.2894810207.00000000007D0000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.2894810207.00000000007F6000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.2894865972.0000000000800000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.2894887053.0000000000809000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_740000_Launches.jbxd

Similarity

API ID: ColorLongWindow
String ID:
API String ID: 259745315-0
Opcode ID: 8d7221faf46003185edd4f820464beb575ac31efdb8ca332067177d45ae0fade
Instruction ID: b0c2ecd71c16721bee2feee3a0574da4d2e729bd91bb49fd53f2278c2c76cd21
Opcode Fuzzy Hash: 8d7221faf46003185edd4f820464beb575ac31efdb8ca332067177d45ae0fade
Instruction Fuzzy Hash: 9C41E530101144AFDB219F289C88BB93776FB0A371F5682A5FD658A1E3C7398C52DB66

Function 007529BE Relevance: 18.0, APIs: 4, Strings: 6, Instructions: 478COMMON

Download Yara Rule

APIs

Part of subcall function 00760B8B: GetCurrentDirectoryW.KERNEL32(00007FFF,?,?,?,00752A3E,?,00008000), ref: 00760BA7

Part of subcall function 00760284: GetFullPathNameW.KERNEL32(?,00007FFF,?,00000000,?,?,00752A58,?,00008000), ref: 007602A4

SetCurrentDirectoryW.KERNEL32(?,?,?,?,00000000), ref: 00752ADF
SetCurrentDirectoryW.KERNEL32(?), ref: 00752C2C

Part of subcall function 00753EBE: _wcscpy.LIBCMT ref: 00753EF6

Part of subcall function 0076386D: _iswctype.LIBCMT ref: 00763875

Strings

Error opening the file, xrefs: 0078FD33, 0078FDAA
AU3!, xrefs: 00752A93
EA06, xrefs: 0078FD48
Bad directive syntax error, xrefs: 0079008F
#include depth exceeded. Make sure there are no recursive includes, xrefs: 0078FD17
Unterminated string, xrefs: 007900D6

Memory Dump Source

Source File: 0000000A.00000002.2894756195.0000000000741000.00000020.00000001.01000000.00000006.sdmp, Offset: 00740000, based on PE: true

Associated: 0000000A.00000002.2894716076.0000000000740000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.2894810207.00000000007D0000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.2894810207.00000000007F6000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.2894865972.0000000000800000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.2894887053.0000000000809000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_740000_Launches.jbxd

Similarity

API ID: CurrentDirectory$FullNamePath_iswctype_wcscpy
String ID: #include depth exceeded. Make sure there are no recursive includes$AU3!$Bad directive syntax error$EA06$Error opening the file$Unterminated string
API String ID: 537147316-3738523708
Opcode ID: 2b28a0265fa9db71d8a2eaa62c366c376e1a4e24ff5f09a7f0823be7fb2e8880
Instruction ID: dbca00be56723b7876cd86904abf2221b10dfedb053f99205435f4606a12cd65
Opcode Fuzzy Hash: 2b28a0265fa9db71d8a2eaa62c366c376e1a4e24ff5f09a7f0823be7fb2e8880
Instruction Fuzzy Hash: 9102DF70108341DFC724EF24C855AAFBBE5BF89345F10491DF88A932A2DB78DA49CB52

Function 00744D37 Relevance: 17.6, APIs: 6, Strings: 4, Instructions: 146COMMON

Download Yara Rule

APIs

__itow.LIBCMT ref: 00744D62
__swprintf.LIBCMT ref: 00744DAC
__i64tow.LIBCMT ref: 0077DB3B

Strings

0x%p, xrefs: 0077DB1D
%.15g, xrefs: 00744DA6
False, xrefs: 0077DB03
True, xrefs: 0077DAFC

Memory Dump Source

Source File: 0000000A.00000002.2894756195.0000000000741000.00000020.00000001.01000000.00000006.sdmp, Offset: 00740000, based on PE: true

Associated: 0000000A.00000002.2894716076.0000000000740000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.2894810207.00000000007D0000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.2894810207.00000000007F6000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.2894865972.0000000000800000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.2894887053.0000000000809000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_740000_Launches.jbxd

Similarity

API ID: __i64tow__itow__swprintf
String ID: %.15g$0x%p$False$True
API String ID: 421087845-2263619337
Opcode ID: e565afab16d70d75221bb239f98acbe6dcd53efca8b06eee267ea3c5d74d3cab
Instruction ID: f8b73b3ea277205d5b376be29563bad46c1d2168354db6a660a6593bbeca6416
Opcode Fuzzy Hash: e565afab16d70d75221bb239f98acbe6dcd53efca8b06eee267ea3c5d74d3cab
Instruction Fuzzy Hash: CA41D171A04609EADB34DF24C946FBA73F8EF44340F20846AE64ED7292EA799D01DB10

Function 007C7777 Relevance: 17.6, APIs: 8, Strings: 2, Instructions: 103windowCOMMON

Download Yara Rule

APIs

_memset.LIBCMT ref: 007C778F
CreateMenu.USER32 ref: 007C77AA
SetMenu.USER32(?,00000000), ref: 007C77B9
GetMenuItemInfoW.USER32(?,000000FF,00000000,00000030), ref: 007C7846
IsMenu.USER32(?), ref: 007C785C
CreatePopupMenu.USER32 ref: 007C7866
InsertMenuItemW.USER32(?,?,00000001,00000030), ref: 007C7893
DrawMenuBar.USER32 ref: 007C789B

Strings

0, xrefs: 007C7785
F, xrefs: 007C7887

Memory Dump Source

Source File: 0000000A.00000002.2894756195.0000000000741000.00000020.00000001.01000000.00000006.sdmp, Offset: 00740000, based on PE: true

Associated: 0000000A.00000002.2894716076.0000000000740000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.2894810207.00000000007D0000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.2894810207.00000000007F6000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.2894865972.0000000000800000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.2894887053.0000000000809000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_740000_Launches.jbxd

Similarity

API ID: Menu$CreateItem$DrawInfoInsertPopup_memset
String ID: 0$F
API String ID: 176399719-3044882817
Opcode ID: fb2599356e5c5568d2142d53001dfaf07b610762128d2e3429d12467ee0afb6e
Instruction ID: 80e921067911cecd17bb6855074c199283d06e44bfc9b15859468c6636ab30df
Opcode Fuzzy Hash: fb2599356e5c5568d2142d53001dfaf07b610762128d2e3429d12467ee0afb6e
Instruction Fuzzy Hash: D3410474A05209EFDB14DF64D888F9ABBF5FB49310F14402DEA56A7360DB35A920CFA4

Function 007C7AE0 Relevance: 17.6, APIs: 9, Strings: 1, Instructions: 101windowCOMMON

Download Yara Rule

APIs

MoveWindow.USER32(?,?,?,000000FF,000000FF,00000000,?,?,000000FF,000000FF,?,?,static,00000000,00000000,?), ref: 007C7B83
CreateCompatibleDC.GDI32(00000000), ref: 007C7B8A
SendMessageW.USER32(?,00000173,00000000,00000000), ref: 007C7B9D
SelectObject.GDI32(00000000,00000000), ref: 007C7BA5
GetPixel.GDI32(00000000,00000000,00000000), ref: 007C7BB0
DeleteDC.GDI32(00000000), ref: 007C7BB9
GetWindowLongW.USER32(?,000000EC), ref: 007C7BC3
SetLayeredWindowAttributes.USER32(?,00000000,00000000,00000001), ref: 007C7BD7
DestroyWindow.USER32(?,?,?,000000FF,000000FF,?,?,static,00000000,00000000,?,?,00000000,00000000,?,?), ref: 007C7BE3

Strings

static, xrefs: 007C7B1B

Memory Dump Source

Source File: 0000000A.00000002.2894756195.0000000000741000.00000020.00000001.01000000.00000006.sdmp, Offset: 00740000, based on PE: true

Associated: 0000000A.00000002.2894716076.0000000000740000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.2894810207.00000000007D0000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.2894810207.00000000007F6000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.2894865972.0000000000800000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.2894887053.0000000000809000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_740000_Launches.jbxd

Similarity

API ID: Window$AttributesCompatibleCreateDeleteDestroyLayeredLongMessageMoveObjectPixelSelectSend
String ID: static
API String ID: 2559357485-2160076837
Opcode ID: 70d36cc3fdcbc108c729043a492a2594fc8c1127c12f64cefd8781a6b9eb0361
Instruction ID: b54560b7a8541868612f10579536a1a4020a04e2289dc17117ad3d6d85c3c621
Opcode Fuzzy Hash: 70d36cc3fdcbc108c729043a492a2594fc8c1127c12f64cefd8781a6b9eb0361
Instruction Fuzzy Hash: 2C318B72105218BBDF159F64DC49FDB3B79FF09320F10421AFA55A61A0CB39E820DBA4

Function 00767030 Relevance: 16.8, APIs: 11, Instructions: 258COMMON

Download Yara Rule

APIs

_memset.LIBCMT ref: 0076706B

Part of subcall function 00768D58: __getptd_noexit.LIBCMT ref: 00768D58

__gmtime64_s.LIBCMT ref: 00767104
__gmtime64_s.LIBCMT ref: 0076713A
__gmtime64_s.LIBCMT ref: 00767157
__allrem.LIBCMT ref: 007671AD
__ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z.LIBCMT ref: 007671C9
__allrem.LIBCMT ref: 007671E0
__ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z.LIBCMT ref: 007671FE
__allrem.LIBCMT ref: 00767215
__ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z.LIBCMT ref: 00767233
__invoke_watson.LIBCMT ref: 007672A4

Memory Dump Source

Source File: 0000000A.00000002.2894756195.0000000000741000.00000020.00000001.01000000.00000006.sdmp, Offset: 00740000, based on PE: true

Associated: 0000000A.00000002.2894716076.0000000000740000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.2894810207.00000000007D0000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.2894810207.00000000007F6000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.2894865972.0000000000800000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.2894887053.0000000000809000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_740000_Launches.jbxd

Similarity

API ID: Unothrow_t@std@@@__allrem__ehfuncinfo$??2@__gmtime64_s$__getptd_noexit__invoke_watson_memset
String ID:
API String ID: 384356119-0
Opcode ID: f1a8c047e8f29504aad4589f782c76ed1b73a3870b2d4d8a344ebdfc9c3668e8
Instruction ID: 755ad9b534cf5c1c0ddc16c310cb2965a1127e76c678892ca87f04dc07c47d5c
Opcode Fuzzy Hash: f1a8c047e8f29504aad4589f782c76ed1b73a3870b2d4d8a344ebdfc9c3668e8
Instruction Fuzzy Hash: EB71F871A04706EBEB189F79CC45B5AB3B9BF413A8F14822AFD15E6281E778D940C790

Function 007A2CCE Relevance: 16.7, APIs: 11, Instructions: 190windowsleepCOMMON

Download Yara Rule

APIs

_memset.LIBCMT ref: 007A2CE9
GetMenuItemInfoW.USER32(00807890,000000FF,00000000,00000030), ref: 007A2D4A
SetMenuItemInfoW.USER32(00807890,00000004,00000000,00000030), ref: 007A2D80
Sleep.KERNEL32(000001F4), ref: 007A2D92
GetMenuItemCount.USER32(?), ref: 007A2DD6
GetMenuItemID.USER32(?,00000000), ref: 007A2DF2
GetMenuItemID.USER32(?,-00000001), ref: 007A2E1C
GetMenuItemID.USER32(?,?), ref: 007A2E61
CheckMenuRadioItem.USER32(?,00000000,?,00000000,00000400), ref: 007A2EA7
GetMenuItemInfoW.USER32(?,000000FF,00000000,00000030), ref: 007A2EBB
SetMenuItemInfoW.USER32(?,000000FF,00000000,00000030), ref: 007A2EDC

Memory Dump Source

Source File: 0000000A.00000002.2894756195.0000000000741000.00000020.00000001.01000000.00000006.sdmp, Offset: 00740000, based on PE: true

Associated: 0000000A.00000002.2894716076.0000000000740000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.2894810207.00000000007D0000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.2894810207.00000000007F6000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.2894865972.0000000000800000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.2894887053.0000000000809000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_740000_Launches.jbxd

Similarity

API ID: ItemMenu$Info$CheckCountRadioSleep_memset
String ID:
API String ID: 4176008265-0
Opcode ID: 98bc4b1277de4d6fa2f0492f3bae2a0804132a57698f6c3a23c1c0458a4be9b0
Instruction ID: 63160e0b3754c6658467b9a12775472c1eb469a6ff00add55e234829caa1888a
Opcode Fuzzy Hash: 98bc4b1277de4d6fa2f0492f3bae2a0804132a57698f6c3a23c1c0458a4be9b0
Instruction Fuzzy Hash: F061BF70904249EFDB10CF68DC88EBE7BB9FB82304F144259F842A7252D739AD56DB60

Function 007C7548 Relevance: 16.7, APIs: 11, Instructions: 184windowCOMMON

Download Yara Rule

APIs

SendMessageW.USER32(?,0000101F,00000000,00000000), ref: 007C75CA
SendMessageW.USER32(00000000,?,0000101F,00000000), ref: 007C75CD
GetWindowLongW.USER32(?,000000F0), ref: 007C75F1
_memset.LIBCMT ref: 007C7602
SendMessageW.USER32(?,00001004,00000000,00000000), ref: 007C7614
SendMessageW.USER32(?,0000104D,00000000,00000007), ref: 007C768C

Memory Dump Source

Source File: 0000000A.00000002.2894756195.0000000000741000.00000020.00000001.01000000.00000006.sdmp, Offset: 00740000, based on PE: true

Associated: 0000000A.00000002.2894716076.0000000000740000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.2894810207.00000000007D0000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.2894810207.00000000007F6000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.2894865972.0000000000800000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.2894887053.0000000000809000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_740000_Launches.jbxd

Similarity

API ID: MessageSend$LongWindow_memset
String ID:
API String ID: 830647256-0
Opcode ID: 0fec02e2c4bb68cf791b260c1b77c3dec25e0d085ece75f708b688c719e4629c
Instruction ID: 79badb59a683389ea6a1b95c40d08822f1941a960d270e5ca760ee22eef8182a
Opcode Fuzzy Hash: 0fec02e2c4bb68cf791b260c1b77c3dec25e0d085ece75f708b688c719e4629c
Instruction Fuzzy Hash: 74616975904248AFDB10DFA8CC85FEE77B8EB09710F1041A9FA14A72A1DB74AE51DF60

Function 007977B6 Relevance: 16.6, APIs: 11, Instructions: 123memoryCOMMON

Download Yara Rule

APIs

SafeArrayAllocDescriptorEx.OLEAUT32(0000000C,?,?), ref: 007977DD
SafeArrayAllocData.OLEAUT32(?), ref: 00797836
VariantInit.OLEAUT32(?), ref: 00797848
SafeArrayAccessData.OLEAUT32(?,?), ref: 00797868
VariantCopy.OLEAUT32(?,?), ref: 007978BB
SafeArrayUnaccessData.OLEAUT32(?), ref: 007978CF
VariantClear.OLEAUT32(?), ref: 007978E4
SafeArrayDestroyData.OLEAUT32(?), ref: 007978F1
SafeArrayDestroyDescriptor.OLEAUT32(?), ref: 007978FA
VariantClear.OLEAUT32(?), ref: 0079790C
SafeArrayDestroyDescriptor.OLEAUT32(?), ref: 00797917

Memory Dump Source

Source File: 0000000A.00000002.2894756195.0000000000741000.00000020.00000001.01000000.00000006.sdmp, Offset: 00740000, based on PE: true

Associated: 0000000A.00000002.2894716076.0000000000740000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.2894810207.00000000007D0000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.2894810207.00000000007F6000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.2894865972.0000000000800000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.2894887053.0000000000809000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_740000_Launches.jbxd

Similarity

API ID: ArraySafe$DataVariant$DescriptorDestroy$AllocClear$AccessCopyInitUnaccess
String ID:
API String ID: 2706829360-0
Opcode ID: d2517fb83030f7f1dc34ac8136fc67941aa7649c93ff3f9070f152264f081fed
Instruction ID: 8d310643fd9a029f1d1025a07f7a7079559c46b77e9028084d195fa38247d2b4
Opcode Fuzzy Hash: d2517fb83030f7f1dc34ac8136fc67941aa7649c93ff3f9070f152264f081fed
Instruction Fuzzy Hash: B4415135A00219EFCF04DFA4D848EADBBB9FF49354F00C069E955A7261C738AA45CFA0

Function 007A0508 Relevance: 16.6, APIs: 11, Instructions: 120keyboardCOMMON

Download Yara Rule

APIs

GetKeyboardState.USER32(?), ref: 007A0530
GetAsyncKeyState.USER32(000000A0), ref: 007A05B1
GetKeyState.USER32(000000A0), ref: 007A05CC
GetAsyncKeyState.USER32(000000A1), ref: 007A05E6
GetKeyState.USER32(000000A1), ref: 007A05FB
GetAsyncKeyState.USER32(00000011), ref: 007A0613
GetKeyState.USER32(00000011), ref: 007A0625
GetAsyncKeyState.USER32(00000012), ref: 007A063D
GetKeyState.USER32(00000012), ref: 007A064F
GetAsyncKeyState.USER32(0000005B), ref: 007A0667
GetKeyState.USER32(0000005B), ref: 007A0679

Memory Dump Source

Source File: 0000000A.00000002.2894756195.0000000000741000.00000020.00000001.01000000.00000006.sdmp, Offset: 00740000, based on PE: true

Associated: 0000000A.00000002.2894716076.0000000000740000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.2894810207.00000000007D0000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.2894810207.00000000007F6000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.2894865972.0000000000800000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.2894887053.0000000000809000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_740000_Launches.jbxd

Similarity

API ID: State$Async$Keyboard
String ID:
API String ID: 541375521-0
Opcode ID: eb5b99ef79c751aac9deb9a04ea2246eb138a844ffc487294333cd24af7566cd
Instruction ID: 0b73ef88035d7e9373a92db61ec4dc4c651fe14cb80e220a9c80b8254b9197b9
Opcode Fuzzy Hash: eb5b99ef79c751aac9deb9a04ea2246eb138a844ffc487294333cd24af7566cd
Instruction Fuzzy Hash: 5D41C9249047C95DFF30866488047B5BFB06B93344F088A5AD9C6475C1EB9C99F8CFD6

Function 007B8AA5 Relevance: 15.9, APIs: 6, Strings: 3, Instructions: 197comCOMMON

Download Yara Rule

APIs

Part of subcall function 00744D37: __itow.LIBCMT ref: 00744D62
Part of subcall function 00744D37: __swprintf.LIBCMT ref: 00744DAC

CoInitialize.OLE32 ref: 007B8AED
CoUninitialize.OLE32 ref: 007B8AF8
CoCreateInstance.OLE32(?,00000000,00000017,007D3BBC,?), ref: 007B8B58
IIDFromString.OLE32(?,?), ref: 007B8BCB
VariantInit.OLEAUT32(?), ref: 007B8C65
VariantClear.OLEAUT32(?), ref: 007B8CC6

Strings

NULL Pointer assignment, xrefs: 007B8B9D
Invalid parameter, xrefs: 007B8BE4
Failed to create object, xrefs: 007B8B63, 007B8C19

Memory Dump Source

Source File: 0000000A.00000002.2894756195.0000000000741000.00000020.00000001.01000000.00000006.sdmp, Offset: 00740000, based on PE: true

Associated: 0000000A.00000002.2894716076.0000000000740000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.2894810207.00000000007D0000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.2894810207.00000000007F6000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.2894865972.0000000000800000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.2894887053.0000000000809000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_740000_Launches.jbxd

Similarity

API ID: Variant$ClearCreateFromInitInitializeInstanceStringUninitialize__itow__swprintf
String ID: Failed to create object$Invalid parameter$NULL Pointer assignment
API String ID: 834269672-1287834457
Opcode ID: 93147f0b515bedc933be771e661aa808df14f4949c2577cd69f2289056d5f269
Instruction ID: 5276843d99fbc5bd2d83837c2de53a422dd955917faa14fcc57177e8474695a9
Opcode Fuzzy Hash: 93147f0b515bedc933be771e661aa808df14f4949c2577cd69f2289056d5f269
Instruction Fuzzy Hash: 70618DB0205711DFC750DF24C889BABBBE8AF45714F10484AF9859B291DB78ED48CBA7

Function 007ABB06 Relevance: 15.8, APIs: 4, Strings: 5, Instructions: 98COMMON

Download Yara Rule

APIs

SetErrorMode.KERNEL32(00000001), ref: 007ABB13
GetDiskFreeSpaceW.KERNEL32(?,?,?,?,?,00000002,00000001), ref: 007ABB89
GetLastError.KERNEL32 ref: 007ABB93
SetErrorMode.KERNEL32(00000000,READY), ref: 007ABC00

Strings

NOTREADY, xrefs: 007ABBBF
INVALID, xrefs: 007ABBD2
READONLY, xrefs: 007ABBCB
READY, xrefs: 007ABBD9
UNKNOWN, xrefs: 007ABBB8

Memory Dump Source

Source File: 0000000A.00000002.2894756195.0000000000741000.00000020.00000001.01000000.00000006.sdmp, Offset: 00740000, based on PE: true

Associated: 0000000A.00000002.2894716076.0000000000740000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.2894810207.00000000007D0000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.2894810207.00000000007F6000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.2894865972.0000000000800000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.2894887053.0000000000809000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_740000_Launches.jbxd

Similarity

API ID: Error$Mode$DiskFreeLastSpace
String ID: INVALID$NOTREADY$READONLY$READY$UNKNOWN
API String ID: 4194297153-14809454
Opcode ID: cdf00cd439c7e5205722421a1c7e5efd85bee5853d3ae26e2eb8e521f20e3e80
Instruction ID: 14fc1f592883577d1ab317315d54630ee63154b2701c1e78b80de292ef74c5a9
Opcode Fuzzy Hash: cdf00cd439c7e5205722421a1c7e5efd85bee5853d3ae26e2eb8e521f20e3e80
Instruction Fuzzy Hash: 2431C675A00208DFCB10EF64C849FBDB7B4EF86310F54825AF905D7296DB79A941CBA1

Function 00799B47 Relevance: 15.8, APIs: 7, Strings: 2, Instructions: 82windowCOMMON

Download Yara Rule

APIs

Part of subcall function 00751A36: _memmove.LIBCMT ref: 00751A77

Part of subcall function 0079B79A: GetClassNameW.USER32(?,?,000000FF), ref: 0079B7BD

SendMessageW.USER32(?,0000018C,000000FF,00000002), ref: 00799BCC
GetDlgCtrlID.USER32 ref: 00799BD7
GetParent.USER32 ref: 00799BF3
SendMessageW.USER32(00000000,?,00000111,?), ref: 00799BF6
GetDlgCtrlID.USER32(?), ref: 00799BFF
GetParent.USER32(?), ref: 00799C1B
SendMessageW.USER32(00000000,?,?,00000111), ref: 00799C1E

Strings

ListBox, xrefs: 00799B89
ComboBox, xrefs: 00799B54

Memory Dump Source

Source File: 0000000A.00000002.2894756195.0000000000741000.00000020.00000001.01000000.00000006.sdmp, Offset: 00740000, based on PE: true

Associated: 0000000A.00000002.2894716076.0000000000740000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.2894810207.00000000007D0000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.2894810207.00000000007F6000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.2894865972.0000000000800000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.2894887053.0000000000809000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_740000_Launches.jbxd

Similarity

API ID: MessageSend$CtrlParent$ClassName_memmove
String ID: ComboBox$ListBox
API String ID: 1536045017-1403004172
Opcode ID: eea12d889c619eae58e06ae7033191bc685f61efba6d7dfbb35793c6b7a947a0
Instruction ID: d80f91de1566613415ec63405283e46cecdbf4fb531b549ff16c9477e61a2f47
Opcode Fuzzy Hash: eea12d889c619eae58e06ae7033191bc685f61efba6d7dfbb35793c6b7a947a0
Instruction Fuzzy Hash: FB21D1B4901108ABDF00ABA4DC89EFEBBB4EF95301F00411AF961932D1DB7D8828DA60

Function 00799C32 Relevance: 15.8, APIs: 7, Strings: 2, Instructions: 81windowCOMMON

Download Yara Rule

APIs

Part of subcall function 00751A36: _memmove.LIBCMT ref: 00751A77

Part of subcall function 0079B79A: GetClassNameW.USER32(?,?,000000FF), ref: 0079B7BD

SendMessageW.USER32(?,00000186,00000002,00000000), ref: 00799CB5
GetDlgCtrlID.USER32 ref: 00799CC0
GetParent.USER32 ref: 00799CDC
SendMessageW.USER32(00000000,?,00000111,?), ref: 00799CDF
GetDlgCtrlID.USER32(?), ref: 00799CE8
GetParent.USER32(?), ref: 00799D04
SendMessageW.USER32(00000000,?,?,00000111), ref: 00799D07

Strings

ListBox, xrefs: 00799C74
ComboBox, xrefs: 00799C3F

Memory Dump Source

Source File: 0000000A.00000002.2894756195.0000000000741000.00000020.00000001.01000000.00000006.sdmp, Offset: 00740000, based on PE: true

Associated: 0000000A.00000002.2894716076.0000000000740000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.2894810207.00000000007D0000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.2894810207.00000000007F6000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.2894865972.0000000000800000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.2894887053.0000000000809000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_740000_Launches.jbxd

Similarity

API ID: MessageSend$CtrlParent$ClassName_memmove
String ID: ComboBox$ListBox
API String ID: 1536045017-1403004172
Opcode ID: 11f7d611f7bcbabae38bd3cbd97819506d2e581a30fbecd9b586805cc6ed9d5b
Instruction ID: bdf6b95fa7fc40ed2afdf7d3f06038b7994b4fcc2966f1508f23d8409fd41c31
Opcode Fuzzy Hash: 11f7d611f7bcbabae38bd3cbd97819506d2e581a30fbecd9b586805cc6ed9d5b
Instruction Fuzzy Hash: AA21B0B5A01108FBDF14EBB4DC89EFEBBB9EF95300F104116B95193291DB7D8928DA60

Function 00799D1B Relevance: 15.8, APIs: 4, Strings: 5, Instructions: 72windowCOMMON

Download Yara Rule

APIs

GetParent.USER32 ref: 00799D27
GetClassNameW.USER32(00000000,?,00000100), ref: 00799D3C
_wcscmp.LIBCMT ref: 00799D4E
SendMessageW.USER32(00000000,00000111,0000702B,00000000), ref: 00799DC9

Strings

details, xrefs: 00799D77
list, xrefs: 00799DAB
smallicons, xrefs: 00799D91
largeicons, xrefs: 00799D5D
SHELLDLL_DefView, xrefs: 00799D48

Memory Dump Source

Source File: 0000000A.00000002.2894756195.0000000000741000.00000020.00000001.01000000.00000006.sdmp, Offset: 00740000, based on PE: true

Associated: 0000000A.00000002.2894716076.0000000000740000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.2894810207.00000000007D0000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.2894810207.00000000007F6000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.2894865972.0000000000800000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.2894887053.0000000000809000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_740000_Launches.jbxd

Similarity

API ID: ClassMessageNameParentSend_wcscmp
String ID: SHELLDLL_DefView$details$largeicons$list$smallicons
API String ID: 1704125052-3381328864
Opcode ID: c3c68239b774474946d7d0c13fbb675c372c578c4c69e3b118e6e1930bee2593
Instruction ID: ebbb91ae73b9aa3632d531ebde73beab418eb6bdc8117ca405b1a2db667d2922
Opcode Fuzzy Hash: c3c68239b774474946d7d0c13fbb675c372c578c4c69e3b118e6e1930bee2593
Instruction Fuzzy Hash: E3110AF634830AF9FE042628FC4BDB6739CDF05320F20001AFB15A51D1FA5DA96155A5

Function 007B8F95 Relevance: 15.3, APIs: 10, Instructions: 324fileCOMMON

Download Yara Rule

APIs

VariantInit.OLEAUT32(?), ref: 007B8FC1
CoInitialize.OLE32(00000000), ref: 007B8FEE
CoUninitialize.OLE32 ref: 007B8FF8
GetRunningObjectTable.OLE32(00000000,?), ref: 007B90F8
SetErrorMode.KERNEL32(00000001,00000029), ref: 007B9225
CoGetInstanceFromFile.OLE32(00000000,?,00000000,00000015,00000002,?,00000001,007D3BDC), ref: 007B9259
CoGetObject.OLE32(?,00000000,007D3BDC,?), ref: 007B927C
SetErrorMode.KERNEL32(00000000), ref: 007B928F
SetErrorMode.KERNEL32(00000000,00000000,00000000,00000000,00000000), ref: 007B930F
VariantClear.OLEAUT32(?), ref: 007B931F

Memory Dump Source

Source File: 0000000A.00000002.2894756195.0000000000741000.00000020.00000001.01000000.00000006.sdmp, Offset: 00740000, based on PE: true

Associated: 0000000A.00000002.2894716076.0000000000740000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.2894810207.00000000007D0000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.2894810207.00000000007F6000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.2894865972.0000000000800000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.2894887053.0000000000809000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_740000_Launches.jbxd

Similarity

API ID: ErrorMode$ObjectVariant$ClearFileFromInitInitializeInstanceRunningTableUninitialize
String ID:
API String ID: 2395222682-0
Opcode ID: 56675fbced29e5217303555bea4af1c975a3a994715b1cb39889268854991330
Instruction ID: 016838958b47610432e422f78f79b3e21ca31669d30ce6079482f0687dbfdd13
Opcode Fuzzy Hash: 56675fbced29e5217303555bea4af1c975a3a994715b1cb39889268854991330
Instruction Fuzzy Hash: 22C116B1604305EFD700DF68C888AAAB7E9FF89708F00491DF6999B251DB75ED05CB92

Function 007A19CD Relevance: 15.1, APIs: 10, Instructions: 89threadCOMMON

Download Yara Rule

APIs

GetCurrentThreadId.KERNEL32 ref: 007A19EF
GetForegroundWindow.USER32(00000000,?,?,?,?,?,007A0A67,?,00000001), ref: 007A1A03
GetWindowThreadProcessId.USER32(00000000), ref: 007A1A0A
AttachThreadInput.USER32(00000000,00000000,00000001,?,?,?,?,?,007A0A67,?,00000001), ref: 007A1A19
GetWindowThreadProcessId.USER32(?,00000000), ref: 007A1A2B
AttachThreadInput.USER32(00000000,00000000,00000001,?,?,?,?,?,007A0A67,?,00000001), ref: 007A1A44
AttachThreadInput.USER32(00000000,00000000,00000001,?,?,?,?,?,007A0A67,?,00000001), ref: 007A1A56
AttachThreadInput.USER32(00000000,00000000,?,?,?,?,?,007A0A67,?,00000001), ref: 007A1A9B
AttachThreadInput.USER32(00000000,00000000,00000000,?,?,?,?,?,007A0A67,?,00000001), ref: 007A1AB0
AttachThreadInput.USER32(00000000,00000000,00000000,?,?,?,?,?,007A0A67,?,00000001), ref: 007A1ABB

Memory Dump Source

Source File: 0000000A.00000002.2894756195.0000000000741000.00000020.00000001.01000000.00000006.sdmp, Offset: 00740000, based on PE: true

Associated: 0000000A.00000002.2894716076.0000000000740000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.2894810207.00000000007D0000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.2894810207.00000000007F6000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.2894865972.0000000000800000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.2894887053.0000000000809000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_740000_Launches.jbxd

Similarity

API ID: Thread$AttachInput$Window$Process$CurrentForeground
String ID:
API String ID: 2156557900-0
Opcode ID: 6fa4a230b80eb2662e170fad08d618c80e1c7768847ecbf05a87619c883aa482
Instruction ID: e4e0e7e70d62a58801f2a44e8235185994d76ae1f0cdca129169bd40773b7da9
Opcode Fuzzy Hash: 6fa4a230b80eb2662e170fad08d618c80e1c7768847ecbf05a87619c883aa482
Instruction Fuzzy Hash: 4331C175606205FFEB10DF24DC44B6977BAFB96355F90C216F900C6190DB789D808F54

Function 0077C0E3 Relevance: 15.1, APIs: 10, Instructions: 59windowCOMMON

Download Yara Rule

APIs

GetSysColor.USER32(00000008), ref: 0074260D
SetTextColor.GDI32(?,000000FF), ref: 00742617
SetBkMode.GDI32(?,00000001), ref: 0074262C
GetStockObject.GDI32(00000005), ref: 00742634
GetClientRect.USER32(?), ref: 0077C0FC
SendMessageW.USER32(?,00001328,00000000,?), ref: 0077C113
GetWindowDC.USER32(?), ref: 0077C11F
GetPixel.GDI32(00000000,?,?), ref: 0077C12E
ReleaseDC.USER32(?,00000000), ref: 0077C140
GetSysColor.USER32(00000005), ref: 0077C15E

Memory Dump Source

Source File: 0000000A.00000002.2894756195.0000000000741000.00000020.00000001.01000000.00000006.sdmp, Offset: 00740000, based on PE: true

Associated: 0000000A.00000002.2894716076.0000000000740000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.2894810207.00000000007D0000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.2894810207.00000000007F6000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.2894865972.0000000000800000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.2894887053.0000000000809000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_740000_Launches.jbxd

Similarity

API ID: Color$ClientMessageModeObjectPixelRectReleaseSendStockTextWindow
String ID:
API String ID: 3430376129-0
Opcode ID: eb99c83ed1427a21dba04d0febb48222f7a8882ea23e6ec6576f741780788e45
Instruction ID: 62dbb8cc5030d9a6885e1a3c848139191d9cc8fde0341dc7eb81a6398939dcce
Opcode Fuzzy Hash: eb99c83ed1427a21dba04d0febb48222f7a8882ea23e6ec6576f741780788e45
Instruction Fuzzy Hash: 62117231501205BFDB615FB4EC08BA97B71FB08321F508266FA66950E2CB390961EF55

Function 0079AD69 Relevance: 14.2, APIs: 2, Strings: 6, Instructions: 241COMMON

Download Yara Rule

APIs

EnumChildWindows.USER32(?,0079B13A), ref: 0079B078

Strings

INSTANCE, xrefs: 0079AF86
NAME, xrefs: 0079AEAA
CLASSNN, xrefs: 0079AE1A
CLASS, xrefs: 0079ADF7
REGEXPCLASS, xrefs: 0079AE3D
TEXT, xrefs: 0079AFAF

Memory Dump Source

Source File: 0000000A.00000002.2894756195.0000000000741000.00000020.00000001.01000000.00000006.sdmp, Offset: 00740000, based on PE: true

Associated: 0000000A.00000002.2894716076.0000000000740000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.2894810207.00000000007D0000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.2894810207.00000000007F6000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.2894865972.0000000000800000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.2894887053.0000000000809000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_740000_Launches.jbxd

Similarity

API ID: ChildEnumWindows
String ID: CLASS$CLASSNN$INSTANCE$NAME$REGEXPCLASS$TEXT
API String ID: 3555792229-1603158881
Opcode ID: 8e2877c69ced934cf6a3bc7b75301f74c5c5d230d45bba0eebb593320d793038
Instruction ID: 104e9a7af984e84bb67205af4a6f1f5cedafa082da8776f5d4ba9268e31bc112
Opcode Fuzzy Hash: 8e2877c69ced934cf6a3bc7b75301f74c5c5d230d45bba0eebb593320d793038
Instruction Fuzzy Hash: 29917F70A0050AFACF08EF60D486BEEFB75BF14300F548119E95AA7251DF38A959DBE1

Function 007431F6 Relevance: 14.2, APIs: 7, Strings: 1, Instructions: 186windowCOMMON

Download Yara Rule

APIs

SetWindowLongW.USER32(?,000000EB), ref: 0074327E

Part of subcall function 0074218F: GetClientRect.USER32(?,?), ref: 007421B8
Part of subcall function 0074218F: GetWindowRect.USER32(?,?), ref: 007421F9
Part of subcall function 0074218F: ScreenToClient.USER32(?,?), ref: 00742221

GetDC.USER32 ref: 0077D073
SendMessageW.USER32(?,00000031,00000000,00000000), ref: 0077D086
SelectObject.GDI32(00000000,00000000), ref: 0077D094
SelectObject.GDI32(00000000,00000000), ref: 0077D0A9
ReleaseDC.USER32(?,00000000), ref: 0077D0B1
MoveWindow.USER32(?,?,?,?,?,?,?,00000031,00000000,00000000), ref: 0077D13C

Strings

U, xrefs: 0077D011

Memory Dump Source

Source File: 0000000A.00000002.2894756195.0000000000741000.00000020.00000001.01000000.00000006.sdmp, Offset: 00740000, based on PE: true

Associated: 0000000A.00000002.2894716076.0000000000740000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.2894810207.00000000007D0000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.2894810207.00000000007F6000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.2894865972.0000000000800000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.2894887053.0000000000809000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_740000_Launches.jbxd

Similarity

API ID: Window$ClientObjectRectSelect$LongMessageMoveReleaseScreenSend
String ID: U
API String ID: 4009187628-3372436214
Opcode ID: b06590380ee447c902872c06881ae0eac1a77fe532c7968e09db2b8b7bc89dde
Instruction ID: 840ef1a0d7b786397927c237a9e5afcba9a7f040698587a02d8926f32ef53c40
Opcode Fuzzy Hash: b06590380ee447c902872c06881ae0eac1a77fe532c7968e09db2b8b7bc89dde
Instruction Fuzzy Hash: 2571E230500209EFCF31DF64C884AAA7BB5FF493A0F14826AED595A1A6C7799C51DF60

Function 007CC634 Relevance: 14.1, APIs: 6, Strings: 2, Instructions: 149windowCOMMON

Download Yara Rule

APIs

Part of subcall function 007429E2: GetWindowLongW.USER32(?,000000EB), ref: 007429F3

Part of subcall function 00742714: GetCursorPos.USER32(?), ref: 00742727
Part of subcall function 00742714: ScreenToClient.USER32(008077B0,?), ref: 00742744
Part of subcall function 00742714: GetAsyncKeyState.USER32(00000001), ref: 00742769
Part of subcall function 00742714: GetAsyncKeyState.USER32(00000002), ref: 00742777

ImageList_DragLeave.COMCTL32(00000000,00000000,00000001,?,?), ref: 007CC69C
ImageList_EndDrag.COMCTL32 ref: 007CC6A2
ReleaseCapture.USER32 ref: 007CC6A8
SetWindowTextW.USER32(?,00000000), ref: 007CC752
SendMessageW.USER32(?,000000B1,00000000,000000FF), ref: 007CC765
DefDlgProcW.USER32(?,00000202,?,?,00000000,00000001,?,?), ref: 007CC847

Strings

@GUI_DRAGFILE, xrefs: 007CC7DC
@GUI_DROPID, xrefs: 007CC799

Memory Dump Source

Source File: 0000000A.00000002.2894756195.0000000000741000.00000020.00000001.01000000.00000006.sdmp, Offset: 00740000, based on PE: true

Associated: 0000000A.00000002.2894716076.0000000000740000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.2894810207.00000000007D0000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.2894810207.00000000007F6000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.2894865972.0000000000800000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.2894887053.0000000000809000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_740000_Launches.jbxd

Similarity

API ID: AsyncDragImageList_StateWindow$CaptureClientCursorLeaveLongMessageProcReleaseScreenSendText
String ID: @GUI_DRAGFILE$@GUI_DROPID
API String ID: 1924731296-2107944366
Opcode ID: 6886f580d42aea27bd009e274ac2a340e5e21e33621d40de816edaacf0768dcb
Instruction ID: 324b83a0244390295f8142737599c354a365b865c43bd8edce368f71acbd4dbd
Opcode Fuzzy Hash: 6886f580d42aea27bd009e274ac2a340e5e21e33621d40de816edaacf0768dcb
Instruction Fuzzy Hash: 6A517A70608204EFD705EF14CC5AF6A7BE5FB84311F00852DF995872E2CB78A959CB92

Function 007B20E1 Relevance: 14.1, APIs: 7, Strings: 1, Instructions: 134networkCOMMON

Download Yara Rule

APIs

InternetConnectW.WININET(?,?,?,?,?,?,00000000,00000000), ref: 007B211C
HttpOpenRequestW.WININET(00000000,00000000,?,00000000,00000000,00000000,?,00000000), ref: 007B2148
InternetQueryOptionW.WININET(00000000,0000001F,00000000,?), ref: 007B218A
InternetSetOptionW.WININET(00000000,0000001F,00000100,00000004), ref: 007B219F
HttpSendRequestW.WININET(00000000,00000000,00000000,00000000,00000000), ref: 007B21AC
HttpQueryInfoW.WININET(00000000,00000005,?,?,00000000), ref: 007B21DC
InternetCloseHandle.WININET(00000000), ref: 007B2223

Part of subcall function 007B2B4F: GetLastError.KERNEL32(?,?,007B1EE3,00000000,00000000,00000001), ref: 007B2B64
Part of subcall function 007B2B4F: SetEvent.KERNEL32(?,?,007B1EE3,00000000,00000000,00000001), ref: 007B2B79

Strings

, xrefs: 007B21CD

Memory Dump Source

Source File: 0000000A.00000002.2894756195.0000000000741000.00000020.00000001.01000000.00000006.sdmp, Offset: 00740000, based on PE: true

Associated: 0000000A.00000002.2894716076.0000000000740000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.2894810207.00000000007D0000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.2894810207.00000000007F6000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.2894865972.0000000000800000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.2894887053.0000000000809000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_740000_Launches.jbxd

Similarity

API ID: Internet$Http$OptionQueryRequest$CloseConnectErrorEventHandleInfoLastOpenSend
String ID:
API String ID: 2603140658-3916222277
Opcode ID: ffbefab14851023bfcfad72f0a84ff7f7214188decd450f00436e6c9942c6b2f
Instruction ID: 82f4b7081bcad0d64696e1151dc78e3f085dfe858ee47c17e0fa89d3e64aadbe
Opcode Fuzzy Hash: ffbefab14851023bfcfad72f0a84ff7f7214188decd450f00436e6c9942c6b2f
Instruction Fuzzy Hash: 9E4150B1502208BFEB129F60CC89FFB7BACFF08354F004116FA059A152D7789D458BA4

Function 007B9330 Relevance: 13.9, APIs: 9, Instructions: 438COMMON

Download Yara Rule

APIs

GetModuleFileNameW.KERNEL32(?,?,00000104,?,007D0980), ref: 007B9412
FreeLibrary.KERNEL32(00000000,00000001,00000000,?,007D0980), ref: 007B9446
QueryPathOfRegTypeLib.OLEAUT32(?,?,?,?,?), ref: 007B95C0
SysFreeString.OLEAUT32(?), ref: 007B95EA

Memory Dump Source

Source File: 0000000A.00000002.2894756195.0000000000741000.00000020.00000001.01000000.00000006.sdmp, Offset: 00740000, based on PE: true

Associated: 0000000A.00000002.2894716076.0000000000740000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.2894810207.00000000007D0000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.2894810207.00000000007F6000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.2894865972.0000000000800000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.2894887053.0000000000809000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_740000_Launches.jbxd

Similarity

API ID: Free$FileLibraryModuleNamePathQueryStringType
String ID:
API String ID: 560350794-0
Opcode ID: ea4a034578cbf5ae566c8fbc230cbf1dae421cd70ee20a43fe2640e7af85a083
Instruction ID: 71d716deb025a3423f67a297134be2834608665545bad116818b550f54a322c1
Opcode Fuzzy Hash: ea4a034578cbf5ae566c8fbc230cbf1dae421cd70ee20a43fe2640e7af85a083
Instruction Fuzzy Hash: 99F10971A00209EFCB14DFA4C888EEEB7B9FF45314F148059F616AB291DB35AE45CB90

Function 007BFD7D Relevance: 13.9, APIs: 9, Instructions: 386processCOMMON

Download Yara Rule

APIs

_memset.LIBCMT ref: 007BFD9E
GetSystemDirectoryW.KERNEL32(00000000,00000000), ref: 007BFF31
GetSystemDirectoryW.KERNEL32(00000000,00000000), ref: 007BFF55
GetCurrentDirectoryW.KERNEL32(00000000,00000000), ref: 007BFF95
GetCurrentDirectoryW.KERNEL32(00000000,00000000), ref: 007BFFB7
CreateProcessW.KERNEL32(00000000,?,00000000,00000000,?,?,00000000,?,?,?), ref: 007C0133
GetLastError.KERNEL32(00000000,00000001,00000000), ref: 007C0165
CloseHandle.KERNEL32(?), ref: 007C0194
CloseHandle.KERNEL32(?), ref: 007C020B

Memory Dump Source

Source File: 0000000A.00000002.2894756195.0000000000741000.00000020.00000001.01000000.00000006.sdmp, Offset: 00740000, based on PE: true

Associated: 0000000A.00000002.2894716076.0000000000740000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.2894810207.00000000007D0000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.2894810207.00000000007F6000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.2894865972.0000000000800000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.2894887053.0000000000809000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_740000_Launches.jbxd

Similarity

API ID: Directory$CloseCurrentHandleSystem$CreateErrorLastProcess_memset
String ID:
API String ID: 4090791747-0
Opcode ID: 79b75e2454324f072303daff99d43fa2b3195ade2a988c89e3a5b65891f9d4da
Instruction ID: a11ccb8d2371c8a475186744d1d5137941b0c16951d1997636929ab3964a0ed2
Opcode Fuzzy Hash: 79b75e2454324f072303daff99d43fa2b3195ade2a988c89e3a5b65891f9d4da
Instruction Fuzzy Hash: B3E1B031604341DFC714EF24C899B6EBBE1AF85310F18846DF9859B2A2CB39EC45CB92

Function 007A527C Relevance: 13.7, APIs: 9, Instructions: 170filestringCOMMON

Download Yara Rule

APIs

Part of subcall function 007A4BC3: GetFullPathNameW.KERNEL32(00000000,00007FFF,?,?,?,?,?,?,007A3B8A,?), ref: 007A4BE0

Part of subcall function 007A4BC3: GetFullPathNameW.KERNEL32(?,00007FFF,?,?,?,?,?,007A3B8A,?), ref: 007A4BF9

Part of subcall function 007A4FEC: GetFileAttributesW.KERNEL32(?,007A3BFE), ref: 007A4FED

lstrcmpiW.KERNEL32(?,?), ref: 007A52FB
_wcscmp.LIBCMT ref: 007A5315
MoveFileW.KERNEL32(?,?), ref: 007A5330

Memory Dump Source

Source File: 0000000A.00000002.2894756195.0000000000741000.00000020.00000001.01000000.00000006.sdmp, Offset: 00740000, based on PE: true

Associated: 0000000A.00000002.2894716076.0000000000740000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.2894810207.00000000007D0000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.2894810207.00000000007F6000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.2894865972.0000000000800000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.2894887053.0000000000809000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_740000_Launches.jbxd

Similarity

API ID: FileFullNamePath$AttributesMove_wcscmplstrcmpi
String ID:
API String ID: 793581249-0
Opcode ID: 7070dd4973481116c8cf0d4d5550f3e9d0bcebc05f2576e2740d2e07f2a1e742
Instruction ID: 7406f509615593eb6101afd79c2de7090af7f5ee5b9b40896d96a143870a292c
Opcode Fuzzy Hash: 7070dd4973481116c8cf0d4d5550f3e9d0bcebc05f2576e2740d2e07f2a1e742
Instruction Fuzzy Hash: 505197B20087849BC764DB50D885ADFB3ECAFC5301F404A1EF589D3152EF79A689C766

Function 007C8C6A Relevance: 13.7, APIs: 9, Instructions: 168COMMON

Download Yara Rule

APIs

InvalidateRect.USER32(?,00000000,00000001,?,00000001), ref: 007C8D24

Memory Dump Source

Source File: 0000000A.00000002.2894756195.0000000000741000.00000020.00000001.01000000.00000006.sdmp, Offset: 00740000, based on PE: true

Associated: 0000000A.00000002.2894716076.0000000000740000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.2894810207.00000000007D0000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.2894810207.00000000007F6000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.2894865972.0000000000800000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.2894887053.0000000000809000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_740000_Launches.jbxd

Similarity

API ID: InvalidateRect
String ID:
API String ID: 634782764-0
Opcode ID: 646fefad3ae8d30617522db7efe2fe3e85b666645737071225616fac55cd443e
Instruction ID: ad64529df01b8713636a4d4192ca6fe2cebdb49d63c791635f9b0d7060bc2a52
Opcode Fuzzy Hash: 646fefad3ae8d30617522db7efe2fe3e85b666645737071225616fac55cd443e
Instruction Fuzzy Hash: 2951A030641204FFEFB09B24CC89F997B64BB05320F24455EFA15E61E1CF79A990DBA6

Function 00742F42 Relevance: 13.7, APIs: 9, Instructions: 161windowCOMMON

Download Yara Rule

APIs

LoadImageW.USER32(00000000,?,00000001,00000010,00000010,00000010), ref: 0077C638
ExtractIconExW.SHELL32(?,00000000,00000000,00000000,00000001), ref: 0077C65A
LoadImageW.USER32(00000000,?,00000001,00000000,00000000,00000050), ref: 0077C672
ExtractIconExW.SHELL32(?,00000000,?,00000000,00000001), ref: 0077C690
SendMessageW.USER32(00000000,00000080,00000000,00000000), ref: 0077C6B1
DestroyIcon.USER32(00000000), ref: 0077C6C0
SendMessageW.USER32(00000000,00000080,00000001,00000000), ref: 0077C6DD
DestroyIcon.USER32(?), ref: 0077C6EC

Part of subcall function 007CAAD4: DeleteObject.GDI32(00000000), ref: 007CAB0D

Memory Dump Source

Source File: 0000000A.00000002.2894756195.0000000000741000.00000020.00000001.01000000.00000006.sdmp, Offset: 00740000, based on PE: true

Associated: 0000000A.00000002.2894716076.0000000000740000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.2894810207.00000000007D0000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.2894810207.00000000007F6000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.2894865972.0000000000800000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.2894887053.0000000000809000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_740000_Launches.jbxd

Similarity

API ID: Icon$DestroyExtractImageLoadMessageSend$DeleteObject
String ID:
API String ID: 2819616528-0
Opcode ID: acec936b478454f1647b30e8d995c80d22bc49d11db4cc59cbfbafe72e7d2523
Instruction ID: 27373ea84cb77e8bd072376a78ad2e4a19bbcdd70c1f9b6e798868c7a56b9344
Opcode Fuzzy Hash: acec936b478454f1647b30e8d995c80d22bc49d11db4cc59cbfbafe72e7d2523
Instruction Fuzzy Hash: A9516A70600209EFDB20DF24CC89BAA7BB5FB48750F508529F906E7290DB79E9A1DB50

Function 0079A226 Relevance: 13.6, APIs: 9, Instructions: 66sleepkeyboardwindowCOMMON

Download Yara Rule

APIs

Part of subcall function 0079B52D: GetWindowThreadProcessId.USER32(?,00000000), ref: 0079B54D
Part of subcall function 0079B52D: GetCurrentThreadId.KERNEL32 ref: 0079B554
Part of subcall function 0079B52D: AttachThreadInput.USER32(00000000,?,0079A23B,?,00000001), ref: 0079B55B

MapVirtualKeyW.USER32(00000025,00000000), ref: 0079A246
PostMessageW.USER32(?,00000100,00000025,00000000), ref: 0079A263
Sleep.KERNEL32(00000000,?,00000100,00000025,00000000,?,00000001), ref: 0079A266
MapVirtualKeyW.USER32(00000025,00000000), ref: 0079A26F
PostMessageW.USER32(?,00000100,00000027,00000000), ref: 0079A28D
Sleep.KERNEL32(00000000,?,00000100,00000027,00000000,?,00000001), ref: 0079A290
MapVirtualKeyW.USER32(00000025,00000000), ref: 0079A299
PostMessageW.USER32(?,00000101,00000027,00000000), ref: 0079A2B0
Sleep.KERNEL32(00000000,?,00000100,00000027,00000000,?,00000001), ref: 0079A2B3

Memory Dump Source

Source File: 0000000A.00000002.2894756195.0000000000741000.00000020.00000001.01000000.00000006.sdmp, Offset: 00740000, based on PE: true

Associated: 0000000A.00000002.2894716076.0000000000740000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.2894810207.00000000007D0000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.2894810207.00000000007F6000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.2894865972.0000000000800000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.2894887053.0000000000809000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_740000_Launches.jbxd

Similarity

API ID: MessagePostSleepThreadVirtual$AttachCurrentInputProcessWindow
String ID:
API String ID: 2014098862-0
Opcode ID: f1d9d6a22ab51b66178ea638c16d9a25fe1e90595f89df4dbee3cdb3017e2cc0
Instruction ID: d09e86098b8863574f48dced7c0709cd6d032d4fc9161a9b5dd0db2cb234c8db
Opcode Fuzzy Hash: f1d9d6a22ab51b66178ea638c16d9a25fe1e90595f89df4dbee3cdb3017e2cc0
Instruction Fuzzy Hash: 5911E571551218FEFA106F60AC4DF6A3B2DEB8C750F115416F3406B0D0CAF75C509AE4

Function 007994D9 Relevance: 13.5, APIs: 9, Instructions: 49memorythreadCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32(00000008,0000000C,00000000,00000000,?,0079915A,00000B00,?,?), ref: 007994E2
HeapAlloc.KERNEL32(00000000,?,0079915A,00000B00,?,?), ref: 007994E9
GetCurrentProcess.KERNEL32(00000000,00000000,00000000,00000002,?,0079915A,00000B00,?,?), ref: 007994FE
GetCurrentProcess.KERNEL32(?,00000000,?,0079915A,00000B00,?,?), ref: 00799506
DuplicateHandle.KERNEL32(00000000,?,0079915A,00000B00,?,?), ref: 00799509
GetCurrentProcess.KERNEL32(00000008,00000000,00000000,00000002,?,0079915A,00000B00,?,?), ref: 00799519
GetCurrentProcess.KERNEL32(0079915A,00000000,?,0079915A,00000B00,?,?), ref: 00799521
DuplicateHandle.KERNEL32(00000000,?,0079915A,00000B00,?,?), ref: 00799524
CreateThread.KERNEL32(00000000,00000000,0079954A,00000000,00000000,00000000), ref: 0079953E

Memory Dump Source

Source File: 0000000A.00000002.2894756195.0000000000741000.00000020.00000001.01000000.00000006.sdmp, Offset: 00740000, based on PE: true

Associated: 0000000A.00000002.2894716076.0000000000740000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.2894810207.00000000007D0000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.2894810207.00000000007F6000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.2894865972.0000000000800000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.2894887053.0000000000809000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_740000_Launches.jbxd

Similarity

API ID: Process$Current$DuplicateHandleHeap$AllocCreateThread
String ID:
API String ID: 1957940570-0
Opcode ID: 1d033d95f295af03c39cf2f9da4da508467e4dca1d8dca4767d8b57ea236d8d6
Instruction ID: bbfc2724993c865c103bd7b1cccb0f1747c7bc9587e4b425190337a54eb81f69
Opcode Fuzzy Hash: 1d033d95f295af03c39cf2f9da4da508467e4dca1d8dca4767d8b57ea236d8d6
Instruction Fuzzy Hash: 7A01BBB5241308BFE710ABA5DC4DF6B7BACEB89711F519412FA05DB1A1CA759C00CB64

Function 007BA20D Relevance: 12.6, APIs: 5, Strings: 2, Instructions: 352COMMON

Download Yara Rule

Strings

NULL Pointer assignment, xrefs: 007BA28E, 007BA5B2
Not an Object type, xrefs: 007BA265

Memory Dump Source

Source File: 0000000A.00000002.2894756195.0000000000741000.00000020.00000001.01000000.00000006.sdmp, Offset: 00740000, based on PE: true

Associated: 0000000A.00000002.2894716076.0000000000740000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.2894810207.00000000007D0000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.2894810207.00000000007F6000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.2894865972.0000000000800000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.2894887053.0000000000809000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_740000_Launches.jbxd

Similarity

API ID:
String ID: NULL Pointer assignment$Not an Object type
API String ID: 0-572801152
Opcode ID: 03b53fc29e48cb999a0191fac44495b5460a1e4be5d0e9e374bdd480cb01c7b4
Instruction ID: 184a0abe2c3dfcadf888d9a699e8aecf8bd5046e94bc5492353d3218838b2f0d
Opcode Fuzzy Hash: 03b53fc29e48cb999a0191fac44495b5460a1e4be5d0e9e374bdd480cb01c7b4
Instruction Fuzzy Hash: EFC18271A0021AAFDF24DF98D885BEEB7F5FF48310F148469E905AB280E7789D45CB91

Function 007B97FD Relevance: 12.5, APIs: 5, Strings: 2, Instructions: 263COMMON

Download Yara Rule

APIs

_memset.LIBCMT ref: 007B9851
VariantInit.OLEAUT32(?), ref: 007B9922
VariantInit.OLEAUT32(?), ref: 007B9A23
VariantClear.OLEAUT32(?), ref: 007B9A2D
VariantClear.OLEAUT32(?), ref: 007B9A8A

Strings

Incorrect Object type in FOR..IN loop, xrefs: 007B9A06
Null Object assignment in FOR..IN loop, xrefs: 007B98B2, 007B99E0, 007B9A98

Memory Dump Source

Source File: 0000000A.00000002.2894756195.0000000000741000.00000020.00000001.01000000.00000006.sdmp, Offset: 00740000, based on PE: true

Associated: 0000000A.00000002.2894716076.0000000000740000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.2894810207.00000000007D0000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.2894810207.00000000007F6000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.2894865972.0000000000800000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.2894887053.0000000000809000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_740000_Launches.jbxd

Similarity

API ID: Variant$ClearInit$_memset
String ID: Incorrect Object type in FOR..IN loop$Null Object assignment in FOR..IN loop
API String ID: 2862541840-625585964
Opcode ID: bc89bc40dde12b294f4ec64d8627041f350158e936d0c19604161a364113c1f9
Instruction ID: da73d53f925b8fe38586c914cf102bcbfa9111135bf3793b8ea6ff7d16b373b5
Opcode Fuzzy Hash: bc89bc40dde12b294f4ec64d8627041f350158e936d0c19604161a364113c1f9
Instruction Fuzzy Hash: D2915F71A00219ABDF24CFA5C848FEEB7B8EF85710F10855DF725AB251D778A944CBA0

Function 007C73A5 Relevance: 12.4, APIs: 6, Strings: 1, Instructions: 143windowCOMMON

Download Yara Rule

APIs

SendMessageW.USER32(00000000,00001036,00000010,00000010), ref: 007C7449
SendMessageW.USER32(?,00001036,00000000,?), ref: 007C745D
SetWindowPos.USER32(?,00000000,00000000,00000000,00000000,00000000,00000013), ref: 007C7477
_wcscat.LIBCMT ref: 007C74D2
SendMessageW.USER32(?,00001057,00000000,?), ref: 007C74E9
SendMessageW.USER32(?,00001061,?,0000000F), ref: 007C7517

Strings

SysListView32, xrefs: 007C741B

Memory Dump Source

Source File: 0000000A.00000002.2894756195.0000000000741000.00000020.00000001.01000000.00000006.sdmp, Offset: 00740000, based on PE: true

Associated: 0000000A.00000002.2894716076.0000000000740000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.2894810207.00000000007D0000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.2894810207.00000000007F6000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.2894865972.0000000000800000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.2894887053.0000000000809000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_740000_Launches.jbxd

Similarity

API ID: MessageSend$Window_wcscat
String ID: SysListView32
API String ID: 307300125-78025650
Opcode ID: 7c57ba93293f7ed8ee2f83ed072e590dd132fc4c34f9527ddd2253dfac4acd70
Instruction ID: e62250db04c30af3630dbd9015854403ea23d4bf7f0a4ef9027cfeeaeab41831
Opcode Fuzzy Hash: 7c57ba93293f7ed8ee2f83ed072e590dd132fc4c34f9527ddd2253dfac4acd70
Instruction Fuzzy Hash: 23418271A04348EFDB259F64CC85FEE7BA8EF08350F10442EF945A7291D6799D84CB50

Function 007BF01C Relevance: 12.4, APIs: 6, Strings: 1, Instructions: 136COMMON

Download Yara Rule

APIs

Part of subcall function 007A4148: CreateToolhelp32Snapshot.KERNEL32 ref: 007A416D
Part of subcall function 007A4148: Process32FirstW.KERNEL32(00000000,?), ref: 007A417B
Part of subcall function 007A4148: CloseHandle.KERNEL32(00000000), ref: 007A4245

OpenProcess.KERNEL32(00000001,00000000,?), ref: 007BF08D
GetLastError.KERNEL32 ref: 007BF0A0
OpenProcess.KERNEL32(00000001,00000000,?), ref: 007BF0CF
TerminateProcess.KERNEL32(00000000,00000000), ref: 007BF14C
GetLastError.KERNEL32(00000000), ref: 007BF157
CloseHandle.KERNEL32(00000000), ref: 007BF18C

Strings

SeDebugPrivilege, xrefs: 007BF0AB

Memory Dump Source

Source File: 0000000A.00000002.2894756195.0000000000741000.00000020.00000001.01000000.00000006.sdmp, Offset: 00740000, based on PE: true

Associated: 0000000A.00000002.2894716076.0000000000740000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.2894810207.00000000007D0000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.2894810207.00000000007F6000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.2894865972.0000000000800000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.2894887053.0000000000809000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_740000_Launches.jbxd

Similarity

API ID: Process$CloseErrorHandleLastOpen$CreateFirstProcess32SnapshotTerminateToolhelp32
String ID: SeDebugPrivilege
API String ID: 2533919879-2896544425
Opcode ID: da16dad88b8a2e8a68fabc05d40c102564a1cec90a414fca3f6b6b1462e79b7c
Instruction ID: f3a9070bfb2014e684206032cf015043f5177b9598fe7e96bc571f5e36a6e02c
Opcode Fuzzy Hash: da16dad88b8a2e8a68fabc05d40c102564a1cec90a414fca3f6b6b1462e79b7c
Instruction Fuzzy Hash: D441BE31300209DFDB25EF28CC99FADB7A5AF84714F048419F9425B292DBB9A804CF95

Function 007A34DD Relevance: 12.3, APIs: 2, Strings: 5, Instructions: 82windowCOMMON

Download Yara Rule

APIs

LoadIconW.USER32(00000000,00007F03), ref: 007A357C

Strings

blank, xrefs: 007A34FE
question, xrefs: 007A3535
stop, xrefs: 007A354D
info, xrefs: 007A351D
warning, xrefs: 007A3565

Memory Dump Source

Source File: 0000000A.00000002.2894756195.0000000000741000.00000020.00000001.01000000.00000006.sdmp, Offset: 00740000, based on PE: true

Associated: 0000000A.00000002.2894716076.0000000000740000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.2894810207.00000000007D0000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.2894810207.00000000007F6000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.2894865972.0000000000800000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.2894887053.0000000000809000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_740000_Launches.jbxd

Similarity

API ID: IconLoad
String ID: blank$info$question$stop$warning
API String ID: 2457776203-404129466
Opcode ID: 4bb911d179b2a98d0213fdc26caa0a2197bab06562516ce218f5234914c07ab3
Instruction ID: 3ca423dfa6ea856b231140653c3010ebf1252fff2e82265b3053eee730177ae7
Opcode Fuzzy Hash: 4bb911d179b2a98d0213fdc26caa0a2197bab06562516ce218f5234914c07ab3
Instruction Fuzzy Hash: 6F113D71E0834EFEE7045E78DC96DBA779CDF47360B20011AFA1056281E76C6F5045A0

Function 007A47E8 Relevance: 12.3, APIs: 6, Strings: 1, Instructions: 47windowCOMMON

Download Yara Rule

APIs

GetModuleHandleW.KERNEL32(00000000,?,?,00000100,00000000), ref: 007A4802
LoadStringW.USER32(00000000), ref: 007A4809
GetModuleHandleW.KERNEL32(00000000,00001389,?,00000100), ref: 007A481F
LoadStringW.USER32(00000000), ref: 007A4826
_wprintf.LIBCMT ref: 007A484C
MessageBoxW.USER32(00000000,?,?,00011010), ref: 007A486A

Strings

%s (%d) : ==> %s: %s %s, xrefs: 007A4847

Memory Dump Source

Source File: 0000000A.00000002.2894756195.0000000000741000.00000020.00000001.01000000.00000006.sdmp, Offset: 00740000, based on PE: true

Associated: 0000000A.00000002.2894716076.0000000000740000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.2894810207.00000000007D0000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.2894810207.00000000007F6000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.2894865972.0000000000800000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.2894887053.0000000000809000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_740000_Launches.jbxd

Similarity

API ID: HandleLoadModuleString$Message_wprintf
String ID: %s (%d) : ==> %s: %s %s
API String ID: 3648134473-3128320259
Opcode ID: 8a57ec1f6519a73053105b7315acd6ac884ce0be56790b147c68d1014049aa52
Instruction ID: 4337d2bf03aeddf2f8a5138148a8f70fadf59aff1c1a7bf24a240bb2743f067d
Opcode Fuzzy Hash: 8a57ec1f6519a73053105b7315acd6ac884ce0be56790b147c68d1014049aa52
Instruction Fuzzy Hash: 610162F294120C7FE71197A0DD89FFA777CEB48300F4045A6BB49E2141EA799E848BB5

Function 007CDB04 Relevance: 12.3, APIs: 8, Instructions: 257windowCOMMON

Download Yara Rule

APIs

Part of subcall function 007429E2: GetWindowLongW.USER32(?,000000EB), ref: 007429F3

GetSystemMetrics.USER32(0000000F), ref: 007CDB42
GetSystemMetrics.USER32(0000000F), ref: 007CDB62
MoveWindow.USER32(00000003,?,?,?,?,00000000,?,?,?), ref: 007CDD9D
SendMessageW.USER32(00000003,00000142,00000000,0000FFFF), ref: 007CDDBB
SendMessageW.USER32(00000003,00000469,?,00000000), ref: 007CDDDC
ShowWindow.USER32(00000003,00000000), ref: 007CDDFB
InvalidateRect.USER32(?,00000000,00000001), ref: 007CDE20
DefDlgProcW.USER32(?,00000005,?,?), ref: 007CDE43

Memory Dump Source

Source File: 0000000A.00000002.2894756195.0000000000741000.00000020.00000001.01000000.00000006.sdmp, Offset: 00740000, based on PE: true

Associated: 0000000A.00000002.2894716076.0000000000740000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.2894810207.00000000007D0000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.2894810207.00000000007F6000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.2894865972.0000000000800000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.2894887053.0000000000809000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_740000_Launches.jbxd

Similarity

API ID: Window$MessageMetricsSendSystem$InvalidateLongMoveProcRectShow
String ID:
API String ID: 1211466189-0
Opcode ID: ecb9b6231ff4488d64728dd0c4bef031fbccc2c02730e54937bbeca84e916fb2
Instruction ID: e17017283c14428b9e3a2d05cdc1eccf1484b23f62c2914006794573beb39bd9
Opcode Fuzzy Hash: ecb9b6231ff4488d64728dd0c4bef031fbccc2c02730e54937bbeca84e916fb2
Instruction Fuzzy Hash: 14B18871A00215AFDF24CF69C989BA97BB1FF44701F08807EED499E295D738AD50CBA0

Function 007C0371 Relevance: 12.3, APIs: 8, Instructions: 256registryCOMMON

Download Yara Rule

APIs

Part of subcall function 00751A36: _memmove.LIBCMT ref: 00751A77

Part of subcall function 007C147A: CharUpperBuffW.USER32(?,?,?,?,?,?,?,007C040D,?,?), ref: 007C1491

RegConnectRegistryW.ADVAPI32(?,?,?), ref: 007C044E

Memory Dump Source

Source File: 0000000A.00000002.2894756195.0000000000741000.00000020.00000001.01000000.00000006.sdmp, Offset: 00740000, based on PE: true

Associated: 0000000A.00000002.2894716076.0000000000740000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.2894810207.00000000007D0000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.2894810207.00000000007F6000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.2894865972.0000000000800000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.2894887053.0000000000809000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_740000_Launches.jbxd

Similarity

API ID: BuffCharConnectRegistryUpper_memmove
String ID:
API String ID: 3479070676-0
Opcode ID: 5a25f50a45c0bba5d505954cb55cab662472c4879badf6a0b9f60171f657f1d1
Instruction ID: b103885e13b83c634e4a07419bc0cd5288bb3b8feaf5d0347c5b5f0ba6cc20e8
Opcode Fuzzy Hash: 5a25f50a45c0bba5d505954cb55cab662472c4879badf6a0b9f60171f657f1d1
Instruction Fuzzy Hash: BEA15530204201DFCB14EF24C889F6EB7E5AF84314F14891DF9969B2A2DB79E955CF86

Function 00742E2B Relevance: 12.1, APIs: 8, Instructions: 129COMMON

Download Yara Rule

APIs

ShowWindow.USER32(FFFFFFFF,?,00000000,00000000,?,0077C508,00000004,00000000,00000000,00000000), ref: 00742E9F
ShowWindow.USER32(FFFFFFFF,00000000,00000000,00000000,?,0077C508,00000004,00000000,00000000,00000000,000000FF), ref: 00742EE7
ShowWindow.USER32(FFFFFFFF,00000006,00000000,00000000,?,0077C508,00000004,00000000,00000000,00000000), ref: 0077C55B
ShowWindow.USER32(FFFFFFFF,?,00000000,00000000,?,0077C508,00000004,00000000,00000000,00000000), ref: 0077C5C7

Memory Dump Source

Source File: 0000000A.00000002.2894756195.0000000000741000.00000020.00000001.01000000.00000006.sdmp, Offset: 00740000, based on PE: true

Associated: 0000000A.00000002.2894716076.0000000000740000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.2894810207.00000000007D0000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.2894810207.00000000007F6000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.2894865972.0000000000800000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.2894887053.0000000000809000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_740000_Launches.jbxd

Similarity

API ID: ShowWindow
String ID:
API String ID: 1268545403-0
Opcode ID: 3bd1a06acc120808835b9188d62ea07ce5f17c03f9a0adce1bac432f31e8d05c
Instruction ID: 06c794b2fe8dcdef0f29c923f2e358f67de87562c5b8e8ae165d2ec74012ef25
Opcode Fuzzy Hash: 3bd1a06acc120808835b9188d62ea07ce5f17c03f9a0adce1bac432f31e8d05c
Instruction Fuzzy Hash: 52410930604690AACB368B28C88C77A7FA2AB85310FA8C50EF44746562C77DF962D765

Function 007A7681 Relevance: 12.1, APIs: 8, Instructions: 101fileCOMMON

Download Yara Rule

APIs

InterlockedExchange.KERNEL32(?,000001F5), ref: 007A7698

Part of subcall function 00760FE6: std::exception::exception.LIBCMT ref: 0076101C
Part of subcall function 00760FE6: __CxxThrowException@8.LIBCMT ref: 00761031

ReadFile.KERNEL32(0000FFFF,00000000,0000FFFF,?,00000000), ref: 007A76CF
EnterCriticalSection.KERNEL32(?), ref: 007A76EB
_memmove.LIBCMT ref: 007A7739
_memmove.LIBCMT ref: 007A7756
LeaveCriticalSection.KERNEL32(?), ref: 007A7765
ReadFile.KERNEL32(0000FFFF,00000000,0000FFFF,00000000,00000000), ref: 007A777A
InterlockedExchange.KERNEL32(?,000001F6), ref: 007A7799

Memory Dump Source

Source File: 0000000A.00000002.2894756195.0000000000741000.00000020.00000001.01000000.00000006.sdmp, Offset: 00740000, based on PE: true

Associated: 0000000A.00000002.2894716076.0000000000740000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.2894810207.00000000007D0000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.2894810207.00000000007F6000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.2894865972.0000000000800000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.2894887053.0000000000809000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_740000_Launches.jbxd

Similarity

API ID: CriticalExchangeFileInterlockedReadSection_memmove$EnterException@8LeaveThrowstd::exception::exception
String ID:
API String ID: 256516436-0
Opcode ID: 17d33e483b5a49785ee293a8f864359ce4e4d23650b8edb89eba05e31c2981a7
Instruction ID: f1f7abe244383471b9b5d1a091a6e94f6876cd1008ba16214088a1dac87d2c01
Opcode Fuzzy Hash: 17d33e483b5a49785ee293a8f864359ce4e4d23650b8edb89eba05e31c2981a7
Instruction Fuzzy Hash: 4E315E35904209EBCF10EF64DC89EAEB778EF45310F1881A6FD04AA256D7389A54DBA4

Function 007C67F8 Relevance: 12.1, APIs: 8, Instructions: 95windowCOMMON

Download Yara Rule

APIs

DeleteObject.GDI32(00000000), ref: 007C6810
GetDC.USER32(00000000), ref: 007C6818
GetDeviceCaps.GDI32(00000000,0000005A), ref: 007C6823
ReleaseDC.USER32(00000000,00000000), ref: 007C682F
CreateFontW.GDI32(?,00000000,00000000,00000000,?,00000000,00000000,00000000,00000001,00000004,00000000,?,00000000,?), ref: 007C686B
SendMessageW.USER32(?,00000030,00000000,00000001), ref: 007C687C
MoveWindow.USER32(?,?,?,?,?,00000000,?,?,007C964F,?,?,000000FF,00000000,?,000000FF,?), ref: 007C68B6
SendMessageW.USER32(?,00000142,00000000,00000000), ref: 007C68D6

Memory Dump Source

Source File: 0000000A.00000002.2894756195.0000000000741000.00000020.00000001.01000000.00000006.sdmp, Offset: 00740000, based on PE: true

Associated: 0000000A.00000002.2894716076.0000000000740000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.2894810207.00000000007D0000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.2894810207.00000000007F6000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.2894865972.0000000000800000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.2894887053.0000000000809000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_740000_Launches.jbxd

Similarity

API ID: MessageSend$CapsCreateDeleteDeviceFontMoveObjectReleaseWindow
String ID:
API String ID: 3864802216-0
Opcode ID: 01c19009af21e84132a479df60c2a4c36ea707d6713aa8d066f0899c1b7c5a52
Instruction ID: 9cff9a8db34c2f9be25c8910a44bedca494062148f432d6e94b61e0a60a9c57d
Opcode Fuzzy Hash: 01c19009af21e84132a479df60c2a4c36ea707d6713aa8d066f0899c1b7c5a52
Instruction Fuzzy Hash: 8C314D72101214BFEB118F50CC8AFAA3BA9EB49761F044059FE089A291D6799851CBB4

Function 0079C748 Relevance: 12.1, APIs: 8, Instructions: 92COMMON

Download Yara Rule

APIs

_memcmp.LIBCMT ref: 0079C75D
_memcmp.LIBCMT ref: 0079C77F
_memcmp.LIBCMT ref: 0079C797
_memcmp.LIBCMT ref: 0079C7AA
_memcmp.LIBCMT ref: 0079C7C4
_memcmp.LIBCMT ref: 0079C7D7
_memcmp.LIBCMT ref: 0079C7EF
_memcmp.LIBCMT ref: 0079C80A

Memory Dump Source

Source File: 0000000A.00000002.2894756195.0000000000741000.00000020.00000001.01000000.00000006.sdmp, Offset: 00740000, based on PE: true

Associated: 0000000A.00000002.2894716076.0000000000740000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.2894810207.00000000007D0000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.2894810207.00000000007F6000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.2894865972.0000000000800000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.2894887053.0000000000809000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_740000_Launches.jbxd

Similarity

API ID: _memcmp
String ID:
API String ID: 2931989736-0
Opcode ID: eafa04af87a1bb7acae9c390b531da9bdcde0787a932dce6a77625eb9efa3c0c
Instruction ID: d02413715a86a3a2bdd3f5c1913eeffea023e99e6f28708df7f06d3ee0775c3f
Opcode Fuzzy Hash: eafa04af87a1bb7acae9c390b531da9bdcde0787a932dce6a77625eb9efa3c0c
Instruction Fuzzy Hash: 34210AB6701105B79E01B550AE4AFBB376C9E20740B080021FD06A6382EB5DDE21C5A2

Function 007AF166 Relevance: 10.8, APIs: 5, Strings: 1, Instructions: 323COMMON

Download Yara Rule

APIs

Part of subcall function 00744D37: __itow.LIBCMT ref: 00744D62
Part of subcall function 00744D37: __swprintf.LIBCMT ref: 00744DAC

Part of subcall function 0075436A: _wcscpy.LIBCMT ref: 0075438D

_wcstok.LIBCMT ref: 007AF2D7
_wcscpy.LIBCMT ref: 007AF366
_memset.LIBCMT ref: 007AF399

Strings

X, xrefs: 007AF3D6

Memory Dump Source

Source File: 0000000A.00000002.2894756195.0000000000741000.00000020.00000001.01000000.00000006.sdmp, Offset: 00740000, based on PE: true

Associated: 0000000A.00000002.2894716076.0000000000740000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.2894810207.00000000007D0000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.2894810207.00000000007F6000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.2894865972.0000000000800000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.2894887053.0000000000809000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_740000_Launches.jbxd

Similarity

API ID: _wcscpy$__itow__swprintf_memset_wcstok
String ID: X
API String ID: 774024439-3081909835
Opcode ID: a86ef297689477d718f06613c5dce73dd3ad7b7982e9152c480084a11c61b883
Instruction ID: 9ace252d8f00f94b5c5227df1b96f85345bfd9f06f3406ff8d082cc58b956c9e
Opcode Fuzzy Hash: a86ef297689477d718f06613c5dce73dd3ad7b7982e9152c480084a11c61b883
Instruction Fuzzy Hash: 48C19F71604740DFC714EF64C849A9EB7E4BF85351F404A2DF899872A2DB78EC49CB92

Function 007B71EE Relevance: 10.8, APIs: 7, Instructions: 250networkCOMMON

Download Yara Rule

APIs

__WSAFDIsSet.WSOCK32(00000000,?,00000000,00000000,?,00000064,00000000), ref: 007B72EB
#17.WSOCK32(00000000,?,?,00000000,?,00000010), ref: 007B730C
WSAGetLastError.WSOCK32(00000000), ref: 007B731F
htons.WSOCK32(?,?,?,00000000,?), ref: 007B73D5
inet_ntoa.WSOCK32(?), ref: 007B7392

Part of subcall function 0079B4EA: _strlen.LIBCMT ref: 0079B4F4
Part of subcall function 0079B4EA: _memmove.LIBCMT ref: 0079B516

_strlen.LIBCMT ref: 007B742F
_memmove.LIBCMT ref: 007B7498

Memory Dump Source

Source File: 0000000A.00000002.2894756195.0000000000741000.00000020.00000001.01000000.00000006.sdmp, Offset: 00740000, based on PE: true

Associated: 0000000A.00000002.2894716076.0000000000740000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.2894810207.00000000007D0000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.2894810207.00000000007F6000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.2894865972.0000000000800000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.2894887053.0000000000809000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_740000_Launches.jbxd

Similarity

API ID: _memmove_strlen$ErrorLasthtonsinet_ntoa
String ID:
API String ID: 3619996494-0
Opcode ID: c54e68006bbfd5a4b53139681bbe4dd0ffaffc78aba8e944709c99f040a16283
Instruction ID: d8b7138d055af47f0e9efec49b0979e01e4781daeeeb4ef8f11ee49f6b374cce
Opcode Fuzzy Hash: c54e68006bbfd5a4b53139681bbe4dd0ffaffc78aba8e944709c99f040a16283
Instruction Fuzzy Hash: 2581C171108200EBC714EB24DC89FAAB7B8EFC4714F14451DF9569B2A2EB78DD05CBA1

Function 00741800 Relevance: 10.7, APIs: 7, Instructions: 219COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.2894756195.0000000000741000.00000020.00000001.01000000.00000006.sdmp, Offset: 00740000, based on PE: true

Associated: 0000000A.00000002.2894716076.0000000000740000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.2894810207.00000000007D0000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.2894810207.00000000007F6000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.2894865972.0000000000800000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.2894887053.0000000000809000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_740000_Launches.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3819be86410392740e9f1068a348bdaa9881c574ed2a8aafb0f2a0d72cb68e2e
Instruction ID: b2ecec09c9b51e9beb3c5d7a89571431f8c25bfaf0e7e4a43528d611ada4e0c0
Opcode Fuzzy Hash: 3819be86410392740e9f1068a348bdaa9881c574ed2a8aafb0f2a0d72cb68e2e
Instruction Fuzzy Hash: 8B715D30900109EFDB05EF58CC89EBEBB79FF86314F54C159F915AA251C738AA91CBA4

Function 007CB9C3 Relevance: 10.7, APIs: 7, Instructions: 199windowCOMMON

Download Yara Rule

APIs

IsWindow.USER32(019A8840), ref: 007CBA5D
IsWindowEnabled.USER32(019A8840), ref: 007CBA69
SendMessageW.USER32(00000000,0000041C,00000000,00000000), ref: 007CBB4D
SendMessageW.USER32(019A8840,000000B0,?,?), ref: 007CBB84
IsDlgButtonChecked.USER32(?,?), ref: 007CBBC1
GetWindowLongW.USER32(019A8840,000000EC), ref: 007CBBE3
SendMessageW.USER32(?,000000A1,00000002,00000000), ref: 007CBBFB

Memory Dump Source

Source File: 0000000A.00000002.2894756195.0000000000741000.00000020.00000001.01000000.00000006.sdmp, Offset: 00740000, based on PE: true

Associated: 0000000A.00000002.2894716076.0000000000740000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.2894810207.00000000007D0000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.2894810207.00000000007F6000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.2894865972.0000000000800000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.2894887053.0000000000809000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_740000_Launches.jbxd

Similarity

API ID: MessageSendWindow$ButtonCheckedEnabledLong
String ID:
API String ID: 4072528602-0
Opcode ID: 581bdfc29f38078dcfbbc774efab17ad5cee8d81a793be9e40a08910dee5a7dd
Instruction ID: da5013074c2bfeecb020c501b830024d7fb14379a267c87e9f804b5218d4dc1b
Opcode Fuzzy Hash: 581bdfc29f38078dcfbbc774efab17ad5cee8d81a793be9e40a08910dee5a7dd
Instruction Fuzzy Hash: 2271AD74A04245EFDB209F64C896FBE77B9EF49300F14805DFA8597291CB39AC50CB61

Function 007BFB07 Relevance: 10.7, APIs: 5, Strings: 1, Instructions: 177COMMON

Download Yara Rule

APIs

_memset.LIBCMT ref: 007BFB31
_memset.LIBCMT ref: 007BFBFA
ShellExecuteExW.SHELL32(?), ref: 007BFC3F

Part of subcall function 00744D37: __itow.LIBCMT ref: 00744D62
Part of subcall function 00744D37: __swprintf.LIBCMT ref: 00744DAC

Part of subcall function 0075436A: _wcscpy.LIBCMT ref: 0075438D

GetProcessId.KERNEL32(00000000), ref: 007BFCB6
CloseHandle.KERNEL32(00000000), ref: 007BFCE5

Strings

@, xrefs: 007BFC0E

Memory Dump Source

Source File: 0000000A.00000002.2894756195.0000000000741000.00000020.00000001.01000000.00000006.sdmp, Offset: 00740000, based on PE: true

Associated: 0000000A.00000002.2894716076.0000000000740000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.2894810207.00000000007D0000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.2894810207.00000000007F6000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.2894865972.0000000000800000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.2894887053.0000000000809000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_740000_Launches.jbxd

Similarity

API ID: _memset$CloseExecuteHandleProcessShell__itow__swprintf_wcscpy
String ID: @
API String ID: 3522835683-2766056989
Opcode ID: 2c11ab2c429a15533d7861144c1a823956689ac8df00f15117d179a25736cb12
Instruction ID: 445598a11e4367ab2a9cc7c41edde58c98d166d6c64890451c350e788aaca59e
Opcode Fuzzy Hash: 2c11ab2c429a15533d7861144c1a823956689ac8df00f15117d179a25736cb12
Instruction Fuzzy Hash: 8461D474A00619DFCB14EF64C895AAEBBF5FF48710F148469E806AB351CB38AD41CF90

Function 007A174C Relevance: 10.7, APIs: 7, Instructions: 166windowCOMMON

Download Yara Rule

APIs

GetParent.USER32(?), ref: 007A178B
GetKeyboardState.USER32(?), ref: 007A17A0
SetKeyboardState.USER32(?), ref: 007A1801
PostMessageW.USER32(?,00000101,00000010,?), ref: 007A182F
PostMessageW.USER32(?,00000101,00000011,?), ref: 007A184E
PostMessageW.USER32(?,00000101,00000012,?), ref: 007A1894
PostMessageW.USER32(?,00000101,0000005B,?), ref: 007A18B7

Memory Dump Source

Source File: 0000000A.00000002.2894756195.0000000000741000.00000020.00000001.01000000.00000006.sdmp, Offset: 00740000, based on PE: true

Associated: 0000000A.00000002.2894716076.0000000000740000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.2894810207.00000000007D0000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.2894810207.00000000007F6000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.2894865972.0000000000800000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.2894887053.0000000000809000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_740000_Launches.jbxd

Similarity

API ID: MessagePost$KeyboardState$Parent
String ID:
API String ID: 87235514-0
Opcode ID: c47902d571ca7fd11e09fbeaccd9c18dd360887c10d85cd417a2e7be8ddded05
Instruction ID: fe650f9700090c58ccc87983568fccb811f92648a349d1d470e4ee8305ad4446
Opcode Fuzzy Hash: c47902d571ca7fd11e09fbeaccd9c18dd360887c10d85cd417a2e7be8ddded05
Instruction Fuzzy Hash: 6B51E660A087D53DFB368234CC55BBA7FE95B87310F488689E0D9468C2C29CECD4D750

Function 007A1565 Relevance: 10.7, APIs: 7, Instructions: 165windowCOMMON

Download Yara Rule

APIs

GetParent.USER32(00000000), ref: 007A15A4
GetKeyboardState.USER32(?), ref: 007A15B9
SetKeyboardState.USER32(?), ref: 007A161A
PostMessageW.USER32(00000000,00000100,00000010,?), ref: 007A1646
PostMessageW.USER32(00000000,00000100,00000011,?), ref: 007A1663
PostMessageW.USER32(00000000,00000100,00000012,?), ref: 007A16A7
PostMessageW.USER32(00000000,00000100,0000005B,?), ref: 007A16C8

Memory Dump Source

Source File: 0000000A.00000002.2894756195.0000000000741000.00000020.00000001.01000000.00000006.sdmp, Offset: 00740000, based on PE: true

Associated: 0000000A.00000002.2894716076.0000000000740000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.2894810207.00000000007D0000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.2894810207.00000000007F6000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.2894865972.0000000000800000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.2894887053.0000000000809000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_740000_Launches.jbxd

Similarity

API ID: MessagePost$KeyboardState$Parent
String ID:
API String ID: 87235514-0
Opcode ID: 7dda3763b6ae865f3f8d153bb76ea51a9af6899bb67154a81875125d599294d7
Instruction ID: 5a85cce585a6196f307092fb1e954da4918847a5e121d09e5e03e3949b0cace6
Opcode Fuzzy Hash: 7dda3763b6ae865f3f8d153bb76ea51a9af6899bb67154a81875125d599294d7
Instruction Fuzzy Hash: 175106A09047D57DFB368764CC05BBA7FA95F87300F4C8689E0D9869C2C69CEC98E751

Function 007A5BB8 Relevance: 10.6, APIs: 7, Instructions: 138timeCOMMON

Download Yara Rule

APIs

GetLocalTime.KERNEL32 ref: 007A5BC5
_wcsncpy.LIBCMT ref: 007A5BFA
_wcsncpy.LIBCMT ref: 007A5C2C
_wcsncpy.LIBCMT ref: 007A5C5F
_wcsncpy.LIBCMT ref: 007A5CA1
_wcsncpy.LIBCMT ref: 007A5CDB
_wcsncpy.LIBCMT ref: 007A5D0A

Memory Dump Source

Source File: 0000000A.00000002.2894756195.0000000000741000.00000020.00000001.01000000.00000006.sdmp, Offset: 00740000, based on PE: true

Associated: 0000000A.00000002.2894716076.0000000000740000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.2894810207.00000000007D0000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.2894810207.00000000007F6000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.2894865972.0000000000800000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.2894887053.0000000000809000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_740000_Launches.jbxd

Similarity

API ID: _wcsncpy$LocalTime
String ID:
API String ID: 2945705084-0
Opcode ID: 224178f45724397b339c7213508baeea2a4702eed862bc0772d8749d424aea54
Instruction ID: cf5bd08febedccb1bfaf7ec933bab640c6c9f4f770736a4a9f42ce38cd45497c
Opcode Fuzzy Hash: 224178f45724397b339c7213508baeea2a4702eed862bc0772d8749d424aea54
Instruction Fuzzy Hash: 57418176D11618B5CB51EBB4CC8E9CFB3B8AF05310F508966F91AE3122E638E715C3A5

Function 007A3B64 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 111filestringCOMMON

Download Yara Rule

APIs

Part of subcall function 007A4BC3: GetFullPathNameW.KERNEL32(00000000,00007FFF,?,?,?,?,?,?,007A3B8A,?), ref: 007A4BE0

Part of subcall function 007A4BC3: GetFullPathNameW.KERNEL32(?,00007FFF,?,?,?,?,?,007A3B8A,?), ref: 007A4BF9

lstrcmpiW.KERNEL32(?,?), ref: 007A3BAA
_wcscmp.LIBCMT ref: 007A3BC6
MoveFileW.KERNEL32(?,?), ref: 007A3BDE
_wcscat.LIBCMT ref: 007A3C26
SHFileOperationW.SHELL32(?), ref: 007A3C92

Strings

\*.*, xrefs: 007A3C20

Memory Dump Source

Source File: 0000000A.00000002.2894756195.0000000000741000.00000020.00000001.01000000.00000006.sdmp, Offset: 00740000, based on PE: true

Associated: 0000000A.00000002.2894716076.0000000000740000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.2894810207.00000000007D0000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.2894810207.00000000007F6000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.2894865972.0000000000800000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.2894887053.0000000000809000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_740000_Launches.jbxd

Similarity

API ID: FileFullNamePath$MoveOperation_wcscat_wcscmplstrcmpi
String ID: \*.*
API String ID: 1377345388-1173974218
Opcode ID: 6a31ee77b048cb151c2f92c381350a481f7b337e36b6c328c86e0265e2879639
Instruction ID: cb8de09cc5b573293c1f8d4611120789e286631c5949cb5d97a167203ac65ae6
Opcode Fuzzy Hash: 6a31ee77b048cb151c2f92c381350a481f7b337e36b6c328c86e0265e2879639
Instruction Fuzzy Hash: 1B4150B1508344DAC752EF64C845ADBB7E8AFC9340F501A2EF48AC3191EB39D648C766

Function 007C78B6 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 103windowCOMMON

Download Yara Rule

APIs

_memset.LIBCMT ref: 007C78CF
GetMenuItemInfoW.USER32(?,000000FF,00000000,00000030), ref: 007C7976
IsMenu.USER32(?), ref: 007C798E
InsertMenuItemW.USER32(?,?,00000001,00000030), ref: 007C79D6
DrawMenuBar.USER32 ref: 007C79E9

Strings

0, xrefs: 007C78C3

Memory Dump Source

Source File: 0000000A.00000002.2894756195.0000000000741000.00000020.00000001.01000000.00000006.sdmp, Offset: 00740000, based on PE: true

Associated: 0000000A.00000002.2894716076.0000000000740000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.2894810207.00000000007D0000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.2894810207.00000000007F6000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.2894865972.0000000000800000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.2894887053.0000000000809000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_740000_Launches.jbxd

Similarity

API ID: Menu$Item$DrawInfoInsert_memset
String ID: 0
API String ID: 3866635326-4108050209
Opcode ID: 80227d3eb0548463e01675b6de8c359841e43d8d576fa51faa3ba3e84b1c8682
Instruction ID: 7ce8e16a3198b60fc2ccc97fad576e3fcd9e10b5a5ac01f0c6d4416340f48abd
Opcode Fuzzy Hash: 80227d3eb0548463e01675b6de8c359841e43d8d576fa51faa3ba3e84b1c8682
Instruction Fuzzy Hash: C6412575A08249EFDB24DF54E884FAABBB9FB09310F04812DE95597250DB38ED50CFA0

Function 007C1602 Relevance: 10.6, APIs: 7, Instructions: 101registryCOMMON

Download Yara Rule

APIs

RegEnumKeyExW.ADVAPI32(?,00000000,?,000000FF,00000000,00000000,00000000,?,?,?), ref: 007C1631
RegOpenKeyExW.ADVAPI32(?,?,00000000,?,?), ref: 007C165B
FreeLibrary.KERNEL32(00000000), ref: 007C1712

Part of subcall function 007C1602: RegCloseKey.ADVAPI32(?), ref: 007C1678
Part of subcall function 007C1602: FreeLibrary.KERNEL32(?), ref: 007C16CA
Part of subcall function 007C1602: RegEnumKeyExW.ADVAPI32(?,00000000,?,000000FF,00000000,00000000,00000000,?), ref: 007C16ED

RegDeleteKeyW.ADVAPI32(?,?), ref: 007C16B5

Memory Dump Source

Source File: 0000000A.00000002.2894756195.0000000000741000.00000020.00000001.01000000.00000006.sdmp, Offset: 00740000, based on PE: true

Associated: 0000000A.00000002.2894716076.0000000000740000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.2894810207.00000000007D0000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.2894810207.00000000007F6000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.2894865972.0000000000800000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.2894887053.0000000000809000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_740000_Launches.jbxd

Similarity

API ID: EnumFreeLibrary$CloseDeleteOpen
String ID:
API String ID: 395352322-0
Opcode ID: 2b5b8dfe865a825f1a77016179fc7e588fe3168c4418d7658f2f90136ebb87e6
Instruction ID: 526495f94a9050d70c1628b9691958c614b964493712b8b7779225034923c998
Opcode Fuzzy Hash: 2b5b8dfe865a825f1a77016179fc7e588fe3168c4418d7658f2f90136ebb87e6
Instruction Fuzzy Hash: B53138B1901209BFDB14DB90DC89FFEB7BCEF09300F50416EE916E2141EA789E459AA4

Function 007C68F2 Relevance: 10.6, APIs: 7, Instructions: 99windowCOMMON

Download Yara Rule

APIs

SendMessageW.USER32(?,000000F0,00000000,00000000), ref: 007C6911
GetWindowLongW.USER32(019A8840,000000F0), ref: 007C6944
GetWindowLongW.USER32(019A8840,000000F0), ref: 007C6979
SendMessageW.USER32(?,000000F1,00000000,00000000), ref: 007C69AB
SendMessageW.USER32(?,000000F1,00000001,00000000), ref: 007C69D5
GetWindowLongW.USER32(?,000000F0), ref: 007C69E6
SetWindowLongW.USER32(?,000000F0,00000000), ref: 007C6A00

Memory Dump Source

Source File: 0000000A.00000002.2894756195.0000000000741000.00000020.00000001.01000000.00000006.sdmp, Offset: 00740000, based on PE: true

Associated: 0000000A.00000002.2894716076.0000000000740000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.2894810207.00000000007D0000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.2894810207.00000000007F6000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.2894865972.0000000000800000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.2894887053.0000000000809000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_740000_Launches.jbxd

Similarity

API ID: LongWindow$MessageSend
String ID:
API String ID: 2178440468-0
Opcode ID: 5f33e85337e75d39fdf2fbc8aef6a91779006b3aae9792d02c9270b4d3baa20b
Instruction ID: ebcf2df848e6a30a6d0e8939a9be15f660fa8216ea5073341f9ed29ad731ad13
Opcode Fuzzy Hash: 5f33e85337e75d39fdf2fbc8aef6a91779006b3aae9792d02c9270b4d3baa20b
Instruction Fuzzy Hash: 4D310F30604190AFDB208F18DC88F6437E1FB4A711F1992ACF5058B2A1CB7AB840CB94

Function 0079E287 Relevance: 10.6, APIs: 7, Instructions: 95memoryCOMMON

Download Yara Rule

APIs

MultiByteToWideChar.KERNEL32(00000000,00000000,?,000000FF,00000000,00000000), ref: 0079E2CA
MultiByteToWideChar.KERNEL32(00000000,00000000,?,000000FF,00000000,00000000), ref: 0079E2F0
SysAllocString.OLEAUT32(00000000), ref: 0079E2F3
SysAllocString.OLEAUT32(?), ref: 0079E311
SysFreeString.OLEAUT32(?), ref: 0079E31A
StringFromGUID2.OLE32(?,?,00000028), ref: 0079E33F
SysAllocString.OLEAUT32(?), ref: 0079E34D

Memory Dump Source

Source File: 0000000A.00000002.2894756195.0000000000741000.00000020.00000001.01000000.00000006.sdmp, Offset: 00740000, based on PE: true

Associated: 0000000A.00000002.2894716076.0000000000740000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.2894810207.00000000007D0000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.2894810207.00000000007F6000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.2894865972.0000000000800000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.2894887053.0000000000809000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_740000_Launches.jbxd

Similarity

API ID: String$Alloc$ByteCharMultiWide$FreeFrom
String ID:
API String ID: 3761583154-0
Opcode ID: c63700e4b9ad01da95c89c6660414ecd0a1c6119672cd9fa43a01301d71797f4
Instruction ID: 2001bfa348f8506c3ade3764a13495792e581b7e2c29baa879885941bdc1476d
Opcode Fuzzy Hash: c63700e4b9ad01da95c89c6660414ecd0a1c6119672cd9fa43a01301d71797f4
Instruction Fuzzy Hash: 8421B732601219BF9F10DFA8DC88DBF77BCEB09360B448125FA18DB250D678DC4187A4

Function 007B685E Relevance: 10.6, APIs: 7, Instructions: 94networkCOMMON

Download Yara Rule

APIs

Part of subcall function 007B8475: inet_addr.WSOCK32(00000000,?,00000000,?,?,?,00000000), ref: 007B84A0

socket.WSOCK32(00000002,00000001,00000006,?,?,00000000), ref: 007B68B1
WSAGetLastError.WSOCK32(00000000), ref: 007B68C0
ioctlsocket.WSOCK32(00000000,8004667E,00000000), ref: 007B68F9
connect.WSOCK32(00000000,?,00000010), ref: 007B6902
WSAGetLastError.WSOCK32 ref: 007B690C
closesocket.WSOCK32(00000000), ref: 007B6935
ioctlsocket.WSOCK32(00000000,8004667E,00000000), ref: 007B694E

Memory Dump Source

Source File: 0000000A.00000002.2894756195.0000000000741000.00000020.00000001.01000000.00000006.sdmp, Offset: 00740000, based on PE: true

Associated: 0000000A.00000002.2894716076.0000000000740000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.2894810207.00000000007D0000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.2894810207.00000000007F6000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.2894865972.0000000000800000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.2894887053.0000000000809000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_740000_Launches.jbxd

Similarity

API ID: ErrorLastioctlsocket$closesocketconnectinet_addrsocket
String ID:
API String ID: 910771015-0
Opcode ID: 9fa0e739180e49f49e80493449d1137f8b20c94013cb91d9978c2a66d3d9e439
Instruction ID: 2d040fe820521f45ccc3bb6d0f1a0fcf3c19a254d2baae715595df16b64391e7
Opcode Fuzzy Hash: 9fa0e739180e49f49e80493449d1137f8b20c94013cb91d9978c2a66d3d9e439
Instruction Fuzzy Hash: 22319371600218EFDB109F64CC89BFE77B9EB44725F048029FA05AB291DB7CAC049BE1

Function 0079E360 Relevance: 10.6, APIs: 7, Instructions: 90memoryCOMMON

Download Yara Rule

APIs

MultiByteToWideChar.KERNEL32(00000000,00000000,?,000000FF,00000000,00000000), ref: 0079E3A5
MultiByteToWideChar.KERNEL32(00000000,00000000,?,000000FF,00000000,00000000), ref: 0079E3CB
SysAllocString.OLEAUT32(00000000), ref: 0079E3CE
SysAllocString.OLEAUT32 ref: 0079E3EF
SysFreeString.OLEAUT32 ref: 0079E3F8
StringFromGUID2.OLE32(?,?,00000028), ref: 0079E412
SysAllocString.OLEAUT32(?), ref: 0079E420

Memory Dump Source

Source File: 0000000A.00000002.2894756195.0000000000741000.00000020.00000001.01000000.00000006.sdmp, Offset: 00740000, based on PE: true

Associated: 0000000A.00000002.2894716076.0000000000740000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.2894810207.00000000007D0000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.2894810207.00000000007F6000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.2894865972.0000000000800000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.2894887053.0000000000809000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_740000_Launches.jbxd

Similarity

API ID: String$Alloc$ByteCharMultiWide$FreeFrom
String ID:
API String ID: 3761583154-0
Opcode ID: 403397d3af5a9e33753ef53c447a4feb45efb6d5e5a84842d8aa4cafbb2dd2e3
Instruction ID: 4eb665848bb64379a5e38887142a6c81f01297a2dd21d1274f52c447252a9c65
Opcode Fuzzy Hash: 403397d3af5a9e33753ef53c447a4feb45efb6d5e5a84842d8aa4cafbb2dd2e3
Instruction Fuzzy Hash: A7218635605244BFAF10DFA8EC88DAF77ECEB49360B008125FA05CB260D678EC418BA4

Function 007C7BF2 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 75windowCOMMON

Download Yara Rule

APIs

Part of subcall function 00742111: CreateWindowExW.USER32(?,?,?,?,?,?,?,?,?,?,00000000,00000096), ref: 0074214F
Part of subcall function 00742111: GetStockObject.GDI32(00000011), ref: 00742163
Part of subcall function 00742111: SendMessageW.USER32(00000000,00000030,00000000), ref: 0074216D

SendMessageW.USER32(00000000,00002001,00000000,FF000000), ref: 007C7C57
SendMessageW.USER32(?,00000409,00000000,FF000000), ref: 007C7C64
SendMessageW.USER32(?,00000402,00000000,00000000), ref: 007C7C6F
SendMessageW.USER32(?,00000401,00000000,00640000), ref: 007C7C7E
SendMessageW.USER32(?,00000404,00000001,00000000), ref: 007C7C8A

Strings

Msctls_Progress32, xrefs: 007C7C28

Memory Dump Source

Source File: 0000000A.00000002.2894756195.0000000000741000.00000020.00000001.01000000.00000006.sdmp, Offset: 00740000, based on PE: true

Associated: 0000000A.00000002.2894716076.0000000000740000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.2894810207.00000000007D0000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.2894810207.00000000007F6000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.2894865972.0000000000800000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.2894887053.0000000000809000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_740000_Launches.jbxd

Similarity

API ID: MessageSend$CreateObjectStockWindow
String ID: Msctls_Progress32
API String ID: 1025951953-3636473452
Opcode ID: 63cf6e1e7b6a27de7fb3336fb1df364ce896ab8c36657d5014ffd3cc1b9e6a81
Instruction ID: 84b76f9dc87e8c1a109595384f9f79304f3637b2c2e4612594dee3fbb218c94f
Opcode Fuzzy Hash: 63cf6e1e7b6a27de7fb3336fb1df364ce896ab8c36657d5014ffd3cc1b9e6a81
Instruction Fuzzy Hash: A11163B115021DBEEF159F60CC85EE77F5DEF08798F014119BB04A6091DB759C21DBA4

Function 00769D16 Relevance: 10.5, APIs: 7, Instructions: 45threadCOMMON

Download Yara Rule

APIs

__init_pointers.LIBCMT ref: 00769D16

Part of subcall function 007633B7: EncodePointer.KERNEL32(00000000), ref: 007633BA
Part of subcall function 007633B7: __initp_misc_winsig.LIBCMT ref: 007633D5
Part of subcall function 007633B7: GetModuleHandleW.KERNEL32(kernel32.dll), ref: 0076A0D0
Part of subcall function 007633B7: GetProcAddress.KERNEL32(00000000,FlsAlloc), ref: 0076A0E4
Part of subcall function 007633B7: GetProcAddress.KERNEL32(00000000,FlsFree), ref: 0076A0F7
Part of subcall function 007633B7: GetProcAddress.KERNEL32(00000000,FlsGetValue), ref: 0076A10A
Part of subcall function 007633B7: GetProcAddress.KERNEL32(00000000,FlsSetValue), ref: 0076A11D
Part of subcall function 007633B7: GetProcAddress.KERNEL32(00000000,InitializeCriticalSectionEx), ref: 0076A130
Part of subcall function 007633B7: GetProcAddress.KERNEL32(00000000,CreateEventExW), ref: 0076A143
Part of subcall function 007633B7: GetProcAddress.KERNEL32(00000000,CreateSemaphoreExW), ref: 0076A156
Part of subcall function 007633B7: GetProcAddress.KERNEL32(00000000,SetThreadStackGuarantee), ref: 0076A169
Part of subcall function 007633B7: GetProcAddress.KERNEL32(00000000,CreateThreadpoolTimer), ref: 0076A17C
Part of subcall function 007633B7: GetProcAddress.KERNEL32(00000000,SetThreadpoolTimer), ref: 0076A18F
Part of subcall function 007633B7: GetProcAddress.KERNEL32(00000000,WaitForThreadpoolTimerCallbacks), ref: 0076A1A2
Part of subcall function 007633B7: GetProcAddress.KERNEL32(00000000,CloseThreadpoolTimer), ref: 0076A1B5
Part of subcall function 007633B7: GetProcAddress.KERNEL32(00000000,CreateThreadpoolWait), ref: 0076A1C8
Part of subcall function 007633B7: GetProcAddress.KERNEL32(00000000,SetThreadpoolWait), ref: 0076A1DB
Part of subcall function 007633B7: GetProcAddress.KERNEL32(00000000,CloseThreadpoolWait), ref: 0076A1EE

__mtinitlocks.LIBCMT ref: 00769D1B
__mtterm.LIBCMT ref: 00769D24

Part of subcall function 00769D8C: DeleteCriticalSection.KERNEL32(00000000,00000000,?,?,00769D29,00767EFD,007FCD38,00000014), ref: 00769E86
Part of subcall function 00769D8C: _free.LIBCMT ref: 00769E8D
Part of subcall function 00769D8C: DeleteCriticalSection.KERNEL32(00800C00,?,?,00769D29,00767EFD,007FCD38,00000014), ref: 00769EAF

__calloc_crt.LIBCMT ref: 00769D49
__initptd.LIBCMT ref: 00769D6B
GetCurrentThreadId.KERNEL32 ref: 00769D72

Memory Dump Source

Source File: 0000000A.00000002.2894756195.0000000000741000.00000020.00000001.01000000.00000006.sdmp, Offset: 00740000, based on PE: true

Associated: 0000000A.00000002.2894716076.0000000000740000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.2894810207.00000000007D0000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.2894810207.00000000007F6000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.2894865972.0000000000800000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.2894887053.0000000000809000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_740000_Launches.jbxd

Similarity

API ID: AddressProc$CriticalDeleteSection$CurrentEncodeHandleModulePointerThread__calloc_crt__init_pointers__initp_misc_winsig__initptd__mtinitlocks__mtterm_free
String ID:
API String ID: 3567560977-0
Opcode ID: 954628f4220662e9eee4450653ae42738d49cd41513214dd40859d7c8136b48c
Instruction ID: 02f757c777afe1fcac4056a8cabcddafc3f55bb69604f7a5259fceadcddf8747
Opcode Fuzzy Hash: 954628f4220662e9eee4450653ae42738d49cd41513214dd40859d7c8136b48c
Instruction Fuzzy Hash: A7F06D3260A711AAEA747B747C0B78A7ADCDF41730F21472AFE63D60D2EF3888014591

Function 007641B9 Relevance: 10.5, APIs: 4, Strings: 2, Instructions: 24libraryloaderCOMMONLIBRARYCODE

Download Yara Rule

APIs

LoadLibraryExW.KERNEL32(combase.dll,00000000,00000800,RoInitialize,00764282,?), ref: 007641D3
GetProcAddress.KERNEL32(00000000), ref: 007641DA
EncodePointer.KERNEL32(00000000), ref: 007641E6
DecodePointer.KERNEL32(00000001,00764282,?), ref: 00764203

Strings

RoInitialize, xrefs: 007641C2
combase.dll, xrefs: 007641CE

Memory Dump Source

Source File: 0000000A.00000002.2894756195.0000000000741000.00000020.00000001.01000000.00000006.sdmp, Offset: 00740000, based on PE: true

Associated: 0000000A.00000002.2894716076.0000000000740000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.2894810207.00000000007D0000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.2894810207.00000000007F6000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.2894865972.0000000000800000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.2894887053.0000000000809000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_740000_Launches.jbxd

Similarity

API ID: Pointer$AddressDecodeEncodeLibraryLoadProc
String ID: RoInitialize$combase.dll
API String ID: 3489934621-340411864
Opcode ID: ffd88fc6c52da7d979d9a6b3a15849651227ff556ed623e391d206383ac5fedf
Instruction ID: 7835919ff44efe0b8c0f9d884fd2303c4a669fa379aad082dd83b310a213777f
Opcode Fuzzy Hash: ffd88fc6c52da7d979d9a6b3a15849651227ff556ed623e391d206383ac5fedf
Instruction Fuzzy Hash: 99E0DF70681301AFDB901F70ED0CB093BB5B711B06F609429F842D51E4CBBD0480CF68

Function 0076428E Relevance: 10.5, APIs: 4, Strings: 2, Instructions: 19libraryloaderCOMMONLIBRARYCODE

Download Yara Rule

APIs

LoadLibraryExW.KERNEL32(combase.dll,00000000,00000800,RoUninitialize,007641A8), ref: 007642A8
GetProcAddress.KERNEL32(00000000), ref: 007642AF
EncodePointer.KERNEL32(00000000), ref: 007642BA
DecodePointer.KERNEL32(007641A8), ref: 007642D5

Strings

RoUninitialize, xrefs: 00764297
combase.dll, xrefs: 007642A3

Memory Dump Source

Source File: 0000000A.00000002.2894756195.0000000000741000.00000020.00000001.01000000.00000006.sdmp, Offset: 00740000, based on PE: true

Associated: 0000000A.00000002.2894716076.0000000000740000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.2894810207.00000000007D0000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.2894810207.00000000007F6000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.2894865972.0000000000800000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.2894887053.0000000000809000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_740000_Launches.jbxd

Similarity

API ID: Pointer$AddressDecodeEncodeLibraryLoadProc
String ID: RoUninitialize$combase.dll
API String ID: 3489934621-2819208100
Opcode ID: 12b120229e95da7833c039dafde0ef55d65333cc597855bdcc08e8c011b8702f
Instruction ID: c92ac2e1d235c9f3bc366412960165b17876103cabc40beefa2d82fae5eec4c0
Opcode Fuzzy Hash: 12b120229e95da7833c039dafde0ef55d65333cc597855bdcc08e8c011b8702f
Instruction Fuzzy Hash: D9E0B6B0652700AFDB909B60AD0DB463B75B705B02F60911BF441D51A0CBBD4604CE64

Function 0074218F Relevance: 9.3, APIs: 6, Instructions: 254COMMON

Download Yara Rule

APIs

GetClientRect.USER32(?,?), ref: 007421B8
GetWindowRect.USER32(?,?), ref: 007421F9
ScreenToClient.USER32(?,?), ref: 00742221
GetClientRect.USER32(?,?), ref: 00742350
GetWindowRect.USER32(?,?), ref: 00742369

Memory Dump Source

Source File: 0000000A.00000002.2894756195.0000000000741000.00000020.00000001.01000000.00000006.sdmp, Offset: 00740000, based on PE: true

Associated: 0000000A.00000002.2894716076.0000000000740000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.2894810207.00000000007D0000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.2894810207.00000000007F6000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.2894865972.0000000000800000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.2894887053.0000000000809000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_740000_Launches.jbxd

Similarity

API ID: Rect$Client$Window$Screen
String ID:
API String ID: 1296646539-0
Opcode ID: 029e5ccdc408adf7fb199f0321d19d31b08df2bae87393bea32011abd8c1b32f
Instruction ID: cc4f97edcc7b65168b2e3981d6d8935e7cabd39c68fdb7a48f9a24e4e2ab1ec8
Opcode Fuzzy Hash: 029e5ccdc408adf7fb199f0321d19d31b08df2bae87393bea32011abd8c1b32f
Instruction Fuzzy Hash: 1EB1AD39A00249DBDF10CFA8C8807EDB7B1FF08750F548129ED59EB215DB78AA61CB64

Function 007A6A73 Relevance: 9.2, APIs: 6, Instructions: 205COMMON

Download Yara Rule

APIs

_memmove.LIBCMT ref: 007A6BC6
_memmove.LIBCMT ref: 007A6B01

Part of subcall function 00744D37: __itow.LIBCMT ref: 00744D62
Part of subcall function 00744D37: __swprintf.LIBCMT ref: 00744DAC

_memmove.LIBCMT ref: 007A6B74
_memmove.LIBCMT ref: 007A6C5B
_memmove.LIBCMT ref: 007A6C74
_memmove.LIBCMT ref: 007A6C90

Memory Dump Source

Source File: 0000000A.00000002.2894756195.0000000000741000.00000020.00000001.01000000.00000006.sdmp, Offset: 00740000, based on PE: true

Associated: 0000000A.00000002.2894716076.0000000000740000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.2894810207.00000000007D0000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.2894810207.00000000007F6000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.2894865972.0000000000800000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.2894887053.0000000000809000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_740000_Launches.jbxd

Similarity

API ID: _memmove$__itow__swprintf
String ID:
API String ID: 3253778849-0
Opcode ID: 3e565685ac210e845bbe011017c515c4a5cf1181a4cbdb9c033d3fa72d8085da
Instruction ID: 2b06747548d978718ecfb40a5a8ef27f2d95c03a9477cca6d2af7527bd4ea688
Opcode Fuzzy Hash: 3e565685ac210e845bbe011017c515c4a5cf1181a4cbdb9c033d3fa72d8085da
Instruction Fuzzy Hash: 1C61BD7050029AEBCF11EF60CC89EFE37A4AF46308F484658FD565B192DB39AD05DB60

Function 007C0844 Relevance: 9.2, APIs: 6, Instructions: 167registryCOMMON

Download Yara Rule

APIs

Part of subcall function 00751A36: _memmove.LIBCMT ref: 00751A77

Part of subcall function 007C147A: CharUpperBuffW.USER32(?,?,?,?,?,?,?,007C040D,?,?), ref: 007C1491

RegConnectRegistryW.ADVAPI32(?,?,?), ref: 007C091D
RegOpenKeyExW.ADVAPI32(?,?,00000000,?,?), ref: 007C095D
RegCloseKey.ADVAPI32(?,00000001,00000000), ref: 007C0980
RegEnumValueW.ADVAPI32(?,-00000001,?,?,00000000,?,00000000,00000000), ref: 007C09A9
RegCloseKey.ADVAPI32(?,?,00000000), ref: 007C09EC
RegCloseKey.ADVAPI32(00000000), ref: 007C09F9

Memory Dump Source

Source File: 0000000A.00000002.2894756195.0000000000741000.00000020.00000001.01000000.00000006.sdmp, Offset: 00740000, based on PE: true

Associated: 0000000A.00000002.2894716076.0000000000740000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.2894810207.00000000007D0000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.2894810207.00000000007F6000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.2894865972.0000000000800000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.2894887053.0000000000809000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_740000_Launches.jbxd

Similarity

API ID: Close$BuffCharConnectEnumOpenRegistryUpperValue_memmove
String ID:
API String ID: 4046560759-0
Opcode ID: 185d926c6ce4d45ba8c1c964b13fe3b3287905642b5f1fc388a26359c7fddfb3
Instruction ID: 289973c74ea9aece773898951896fbce3c1a2c2459a6a9a47a8edf3baa752d59
Opcode Fuzzy Hash: 185d926c6ce4d45ba8c1c964b13fe3b3287905642b5f1fc388a26359c7fddfb3
Instruction Fuzzy Hash: 33515731208204EFD714EB64C889F6ABBA9FF85314F44491DF985872A2DB79E905CB92

Function 0079F688 Relevance: 9.2, APIs: 6, Instructions: 159COMMON

Download Yara Rule

APIs

VariantInit.OLEAUT32(?), ref: 0079F6A2
VariantClear.OLEAUT32(00000013), ref: 0079F714
VariantClear.OLEAUT32(00000000), ref: 0079F76F
_memmove.LIBCMT ref: 0079F799
VariantClear.OLEAUT32(?), ref: 0079F7E6
VariantChangeType.OLEAUT32(?,?,00000000,00000013), ref: 0079F814

Memory Dump Source

Source File: 0000000A.00000002.2894756195.0000000000741000.00000020.00000001.01000000.00000006.sdmp, Offset: 00740000, based on PE: true

Associated: 0000000A.00000002.2894716076.0000000000740000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.2894810207.00000000007D0000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.2894810207.00000000007F6000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.2894865972.0000000000800000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.2894887053.0000000000809000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_740000_Launches.jbxd

Similarity

API ID: Variant$Clear$ChangeInitType_memmove
String ID:
API String ID: 1101466143-0
Opcode ID: ef37cb2111ab22ef18a571b49ff57c84782902d3ad29045521adf8fa711085c6
Instruction ID: bba91117b05d3bb9d9e5ad80051814b59ef2b6833768c7ac51a35151f43497ba
Opcode Fuzzy Hash: ef37cb2111ab22ef18a571b49ff57c84782902d3ad29045521adf8fa711085c6
Instruction Fuzzy Hash: E85146B5A00209EFCB14CF58D884EAAB7B8FF48354B15856AED59DB310E734E911CBA0

Function 007A29B1 Relevance: 9.1, APIs: 6, Instructions: 138windowCOMMON

Download Yara Rule

APIs

_memset.LIBCMT ref: 007A29FF
GetMenuItemInfoW.USER32(?,000000FF,00000000,00000030), ref: 007A2A4A
IsMenu.USER32(00000000), ref: 007A2A6A
CreatePopupMenu.USER32 ref: 007A2A9E
GetMenuItemCount.USER32(000000FF), ref: 007A2AFC
InsertMenuItemW.USER32(00000000,?,00000001,00000030), ref: 007A2B2D

Memory Dump Source

Source File: 0000000A.00000002.2894756195.0000000000741000.00000020.00000001.01000000.00000006.sdmp, Offset: 00740000, based on PE: true

Associated: 0000000A.00000002.2894716076.0000000000740000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.2894810207.00000000007D0000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.2894810207.00000000007F6000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.2894865972.0000000000800000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.2894887053.0000000000809000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_740000_Launches.jbxd

Similarity

API ID: Menu$Item$CountCreateInfoInsertPopup_memset
String ID:
API String ID: 3311875123-0
Opcode ID: c45bf09c144b69c6e83231769b6ba4ba961f0cab8d1efa2d60c5e4fd77d3f290
Instruction ID: 6830e8fe1b447224daccc7cd58469090aa1d53fa2538f80afb241dc0aa46cd76
Opcode Fuzzy Hash: c45bf09c144b69c6e83231769b6ba4ba961f0cab8d1efa2d60c5e4fd77d3f290
Instruction Fuzzy Hash: 3651C470600349DFCF25CF6CD888B9EBBF4AF86314F108219E811972A2E7789946CB61

Function 00741B41 Relevance: 9.1, APIs: 6, Instructions: 113COMMON

Download Yara Rule

APIs

Part of subcall function 007429E2: GetWindowLongW.USER32(?,000000EB), ref: 007429F3

BeginPaint.USER32(?,?,?,?,?,?), ref: 00741B76
GetWindowRect.USER32(?,?), ref: 00741BDA
ScreenToClient.USER32(?,?), ref: 00741BF7
SetViewportOrgEx.GDI32(00000000,?,?,00000000), ref: 00741C08
EndPaint.USER32(?,?), ref: 00741C52

Memory Dump Source

Source File: 0000000A.00000002.2894756195.0000000000741000.00000020.00000001.01000000.00000006.sdmp, Offset: 00740000, based on PE: true

Associated: 0000000A.00000002.2894716076.0000000000740000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.2894810207.00000000007D0000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.2894810207.00000000007F6000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.2894865972.0000000000800000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.2894887053.0000000000809000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_740000_Launches.jbxd

Similarity

API ID: PaintWindow$BeginClientLongRectScreenViewport
String ID:
API String ID: 1827037458-0
Opcode ID: 44cf12cdff3e97a8f533a8ce1701ddc69e70bc88c7d40efc47c92e23230c1ce4
Instruction ID: 3d5f2011038b8907b289847073b283fbe9950e66b6bbe9dc143d634032819932
Opcode Fuzzy Hash: 44cf12cdff3e97a8f533a8ce1701ddc69e70bc88c7d40efc47c92e23230c1ce4
Instruction Fuzzy Hash: 75419F70604200EFD711EF24CC88FBA7BF8FB45364F144669F9A9862B1C739A885DB65

Function 007CBD10 Relevance: 9.1, APIs: 6, Instructions: 109windowCOMMON

Download Yara Rule

APIs

ShowWindow.USER32(008077B0,00000000,019A8840,?,?,008077B0,?,007CBC1A,?,?), ref: 007CBD84
EnableWindow.USER32(?,00000000), ref: 007CBDA8
ShowWindow.USER32(008077B0,00000000,019A8840,?,?,008077B0,?,007CBC1A,?,?), ref: 007CBE08
ShowWindow.USER32(?,00000004,?,007CBC1A,?,?), ref: 007CBE1A
EnableWindow.USER32(?,00000001), ref: 007CBE3E
SendMessageW.USER32(?,0000130C,?,00000000), ref: 007CBE61

Memory Dump Source

Source File: 0000000A.00000002.2894756195.0000000000741000.00000020.00000001.01000000.00000006.sdmp, Offset: 00740000, based on PE: true

Associated: 0000000A.00000002.2894716076.0000000000740000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.2894810207.00000000007D0000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.2894810207.00000000007F6000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.2894865972.0000000000800000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.2894887053.0000000000809000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_740000_Launches.jbxd

Similarity

API ID: Window$Show$Enable$MessageSend
String ID:
API String ID: 642888154-0
Opcode ID: 54904cda0fd3d1b13c7d1f4a8c961ce122f44347d40d6788f6fcd9d9a6cb28f8
Instruction ID: e6e58fd706c30e5e0688dffe619c72965a5ef65a50218ce044d70a16ca07509f
Opcode Fuzzy Hash: 54904cda0fd3d1b13c7d1f4a8c961ce122f44347d40d6788f6fcd9d9a6cb28f8
Instruction Fuzzy Hash: A3414934601145AFDB22CF68C48AF957BF1FF05714F1881ADFA498F2A2C739A845CBA1

Function 007B7788 Relevance: 9.1, APIs: 6, Instructions: 97COMMON

Download Yara Rule

APIs

GetForegroundWindow.USER32(?,?,?,?,?,?,007B550C,?,?,00000000,00000001), ref: 007B7796

Part of subcall function 007B406C: GetWindowRect.USER32(?,?), ref: 007B407F

GetDesktopWindow.USER32 ref: 007B77C0
GetWindowRect.USER32(00000000), ref: 007B77C7
mouse_event.USER32(00008001,?,?,00000001,00000001), ref: 007B77F9

Part of subcall function 007A57FF: Sleep.KERNEL32(?,00000000,?,?,?,?,?,?,?,?,?,?), ref: 007A5877

GetCursorPos.USER32(?), ref: 007B7825
mouse_event.USER32(00008001,?,?,00000000,00000000), ref: 007B7883

Memory Dump Source

Source File: 0000000A.00000002.2894756195.0000000000741000.00000020.00000001.01000000.00000006.sdmp, Offset: 00740000, based on PE: true

Associated: 0000000A.00000002.2894716076.0000000000740000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.2894810207.00000000007D0000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.2894810207.00000000007F6000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.2894865972.0000000000800000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.2894887053.0000000000809000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_740000_Launches.jbxd

Similarity

API ID: Window$Rectmouse_event$CursorDesktopForegroundSleep
String ID:
API String ID: 4137160315-0
Opcode ID: 40260ba207e8da690c190b196aa93432a5e07ff3d93c068a6f231ad920df2780
Instruction ID: 9a6aab5f192be60f8bcdb86844fd424c664c52e2e547c78adee56a0b9c63924d
Opcode Fuzzy Hash: 40260ba207e8da690c190b196aa93432a5e07ff3d93c068a6f231ad920df2780
Instruction Fuzzy Hash: EF31B272509305ABD724DF14D849F9BB7EAFFC8314F00491AF585A7191CA38E918CBD6

Function 00799431 Relevance: 9.1, APIs: 6, Instructions: 69memoryCOMMON

Download Yara Rule

APIs

Part of subcall function 00798CC7: GetTokenInformation.ADVAPI32(?,00000002,?,00000000,?), ref: 00798CDE
Part of subcall function 00798CC7: GetLastError.KERNEL32(?,00000002,?,00000000,?), ref: 00798CE8
Part of subcall function 00798CC7: GetProcessHeap.KERNEL32(00000008,?,?,00000002,?,00000000,?), ref: 00798CF7
Part of subcall function 00798CC7: HeapAlloc.KERNEL32(00000000,?,00000002,?,00000000,?), ref: 00798CFE
Part of subcall function 00798CC7: GetTokenInformation.ADVAPI32(?,00000002,00000000,?,?,?,00000002,?,00000000,?), ref: 00798D14

GetLengthSid.ADVAPI32(?,00000000,0079904D), ref: 00799482
GetProcessHeap.KERNEL32(00000008,00000000), ref: 0079948E
HeapAlloc.KERNEL32(00000000), ref: 00799495
CopySid.ADVAPI32(00000000,00000000,?), ref: 007994AE
GetProcessHeap.KERNEL32(00000000,00000000,0079904D), ref: 007994C2
HeapFree.KERNEL32(00000000), ref: 007994C9

Memory Dump Source

Source File: 0000000A.00000002.2894756195.0000000000741000.00000020.00000001.01000000.00000006.sdmp, Offset: 00740000, based on PE: true

Associated: 0000000A.00000002.2894716076.0000000000740000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.2894810207.00000000007D0000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.2894810207.00000000007F6000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.2894865972.0000000000800000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.2894887053.0000000000809000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_740000_Launches.jbxd

Similarity

API ID: Heap$Process$AllocInformationToken$CopyErrorFreeLastLength
String ID:
API String ID: 3008561057-0
Opcode ID: 69a9569812fee9dcd1f4568c80347dfd38d1f72c3c8bebba0a08aee78683fe11
Instruction ID: e53818728fa4a068d4a406f8aa3cd31b5af3a9f68453a3b89bd6a98d9ec2e083
Opcode Fuzzy Hash: 69a9569812fee9dcd1f4568c80347dfd38d1f72c3c8bebba0a08aee78683fe11
Instruction Fuzzy Hash: 16118C71501608EBEF119BA8EC09BAF7BB9EB45316F108059E98597220D73A99018BA0

Function 007991CF Relevance: 9.1, APIs: 6, Instructions: 65processCOMMON

Download Yara Rule

APIs

GetCurrentProcess.KERNEL32(0000000A,00000004), ref: 00799200
OpenProcessToken.ADVAPI32(00000000), ref: 00799207
CreateEnvironmentBlock.USERENV(?,00000004,00000001), ref: 00799216
CloseHandle.KERNEL32(00000004), ref: 00799221
CreateProcessWithLogonW.ADVAPI32(?,?,?,00000000,00000000,?,?,00000000,?,?,?), ref: 00799250
DestroyEnvironmentBlock.USERENV(00000000), ref: 00799264

Memory Dump Source

Source File: 0000000A.00000002.2894756195.0000000000741000.00000020.00000001.01000000.00000006.sdmp, Offset: 00740000, based on PE: true

Associated: 0000000A.00000002.2894716076.0000000000740000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.2894810207.00000000007D0000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.2894810207.00000000007F6000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.2894865972.0000000000800000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.2894887053.0000000000809000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_740000_Launches.jbxd

Similarity

API ID: Process$BlockCreateEnvironment$CloseCurrentDestroyHandleLogonOpenTokenWith
String ID:
API String ID: 1413079979-0
Opcode ID: 23adaa041061b23a084c1882a3893e77f38eb1b2e292ea1df6c02f6ac006609b
Instruction ID: 698418738566356d049fbabc0616f238972b2e5d9da0fbde28080d26d9642654
Opcode Fuzzy Hash: 23adaa041061b23a084c1882a3893e77f38eb1b2e292ea1df6c02f6ac006609b
Instruction Fuzzy Hash: 99114A7250120EBBEF018F98ED49BDE7BB9FB08304F048019FA04A2160D2799D60DBA0

Function 0079C329 Relevance: 9.0, APIs: 6, Instructions: 49COMMON

Download Yara Rule

APIs

GetDC.USER32(00000000), ref: 0079C34E
GetDeviceCaps.GDI32(00000000,00000058), ref: 0079C35F
GetDeviceCaps.GDI32(00000000,0000005A), ref: 0079C366
ReleaseDC.USER32(00000000,00000000), ref: 0079C36E
MulDiv.KERNEL32(000009EC,?,00000000), ref: 0079C385
MulDiv.KERNEL32(000009EC,?,?), ref: 0079C397

Memory Dump Source

Source File: 0000000A.00000002.2894756195.0000000000741000.00000020.00000001.01000000.00000006.sdmp, Offset: 00740000, based on PE: true

Associated: 0000000A.00000002.2894716076.0000000000740000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.2894810207.00000000007D0000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.2894810207.00000000007F6000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.2894865972.0000000000800000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.2894887053.0000000000809000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_740000_Launches.jbxd

Similarity

API ID: CapsDevice$Release
String ID:
API String ID: 1035833867-0
Opcode ID: fb989c437ad7c349e8adb3017f46d985f35fc992989e6c6e2a60141a77ab3e57
Instruction ID: 7e374f42eb7f6815826c48a77d48d51f3157cd03e79b2f886d4df2301e45a137
Opcode Fuzzy Hash: fb989c437ad7c349e8adb3017f46d985f35fc992989e6c6e2a60141a77ab3e57
Instruction Fuzzy Hash: CD016775E01318BBEF109BB59C49B5EBFB8EF48751F008066FA04AB280D6759D10CFA5

Function 007CC552 Relevance: 9.0, APIs: 6, Instructions: 49COMMON

Download Yara Rule

APIs

Part of subcall function 007416CF: ExtCreatePen.GDI32(?,?,00000000,00000000,00000000,?,00000000), ref: 00741729
Part of subcall function 007416CF: SelectObject.GDI32(?,00000000), ref: 00741738
Part of subcall function 007416CF: BeginPath.GDI32(?), ref: 0074174F
Part of subcall function 007416CF: SelectObject.GDI32(?,00000000), ref: 00741778

MoveToEx.GDI32(00000000,-00000002,?,00000000), ref: 007CC57C
LineTo.GDI32(00000000,00000003,?), ref: 007CC590
MoveToEx.GDI32(00000000,00000000,?,00000000), ref: 007CC59E
LineTo.GDI32(00000000,00000000,?), ref: 007CC5AE
EndPath.GDI32(00000000), ref: 007CC5BE
StrokePath.GDI32(00000000), ref: 007CC5CE

Memory Dump Source

Source File: 0000000A.00000002.2894756195.0000000000741000.00000020.00000001.01000000.00000006.sdmp, Offset: 00740000, based on PE: true

Associated: 0000000A.00000002.2894716076.0000000000740000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.2894810207.00000000007D0000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.2894810207.00000000007F6000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.2894865972.0000000000800000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.2894887053.0000000000809000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_740000_Launches.jbxd

Similarity

API ID: Path$LineMoveObjectSelect$BeginCreateStroke
String ID:
API String ID: 43455801-0
Opcode ID: cdcbfc4ec155c2af08fcca6d1a500ad631c7000520cbeebeac0468ddf5468c87
Instruction ID: fc8217c057bda61eca2dd1e31313c927b536d25dd860a6b26ccbf0e078454dd7
Opcode Fuzzy Hash: cdcbfc4ec155c2af08fcca6d1a500ad631c7000520cbeebeac0468ddf5468c87
Instruction Fuzzy Hash: FA11097240010DBFDB029F90DC88FAA7FADFB08354F048026FA585A160D775AE55DBA4

Function 007607BB Relevance: 9.0, APIs: 6, Instructions: 44keyboardCOMMON

Download Yara Rule

APIs

MapVirtualKeyW.USER32(0000005B,00000000), ref: 007607EC
MapVirtualKeyW.USER32(00000010,00000000), ref: 007607F4
MapVirtualKeyW.USER32(000000A0,00000000), ref: 007607FF
MapVirtualKeyW.USER32(000000A1,00000000), ref: 0076080A
MapVirtualKeyW.USER32(00000011,00000000), ref: 00760812
MapVirtualKeyW.USER32(00000012,00000000), ref: 0076081A

Memory Dump Source

Source File: 0000000A.00000002.2894756195.0000000000741000.00000020.00000001.01000000.00000006.sdmp, Offset: 00740000, based on PE: true

Associated: 0000000A.00000002.2894716076.0000000000740000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.2894810207.00000000007D0000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.2894810207.00000000007F6000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.2894865972.0000000000800000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.2894887053.0000000000809000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_740000_Launches.jbxd

Similarity

API ID: Virtual
String ID:
API String ID: 4278518827-0
Opcode ID: 518fbe4bf0c0b3c3ae8a48f394d5b31ad38cd4ea1db486fb76b934590865b5d5
Instruction ID: 2d05aa6df9a8c931014dae1fb397dd0d40fe42c6b419b4a4ea83212fc593d18e
Opcode Fuzzy Hash: 518fbe4bf0c0b3c3ae8a48f394d5b31ad38cd4ea1db486fb76b934590865b5d5
Instruction Fuzzy Hash: 0E016CB0902759BDE3008F5A8C85B52FFB8FF59354F00411BA15C47941C7F5A864CBE5

Function 007A59A4 Relevance: 9.0, APIs: 6, Instructions: 43windowtimethreadCOMMON

Download Yara Rule

APIs

PostMessageW.USER32(?,00000010,00000000,00000000), ref: 007A59B4
SendMessageTimeoutW.USER32(?,00000010,00000000,00000000,00000002,000001F4,?), ref: 007A59CA
GetWindowThreadProcessId.USER32(?,?), ref: 007A59D9
OpenProcess.KERNEL32(001F0FFF,00000000,?,?,?,?,00000010,00000000,00000000,00000002,000001F4,?,?,00000010,00000000,00000000), ref: 007A59E8
TerminateProcess.KERNEL32(00000000,00000000,?,?,?,00000010,00000000,00000000,00000002,000001F4,?,?,00000010,00000000,00000000), ref: 007A59F2
CloseHandle.KERNEL32(00000000,?,?,?,00000010,00000000,00000000,00000002,000001F4,?,?,00000010,00000000,00000000), ref: 007A59F9

Memory Dump Source

Source File: 0000000A.00000002.2894756195.0000000000741000.00000020.00000001.01000000.00000006.sdmp, Offset: 00740000, based on PE: true

Associated: 0000000A.00000002.2894716076.0000000000740000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.2894810207.00000000007D0000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.2894810207.00000000007F6000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.2894865972.0000000000800000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.2894887053.0000000000809000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_740000_Launches.jbxd

Similarity

API ID: Process$Message$CloseHandleOpenPostSendTerminateThreadTimeoutWindow
String ID:
API String ID: 839392675-0
Opcode ID: d960e86124d79cc627f0748f90189ee502200ded22ee6650a189be47c501f62d
Instruction ID: 771f2705ae9998e991008b691579be74161b1eeed8e1cc19ca8f90f0cd0a3b8d
Opcode Fuzzy Hash: d960e86124d79cc627f0748f90189ee502200ded22ee6650a189be47c501f62d
Instruction Fuzzy Hash: CCF01D36242158BBE7215B929C0DFEF7F7CEBC7B11F00415AFA0591050D7A95A1186F9

Function 007A77EB Relevance: 9.0, APIs: 6, Instructions: 33synchronizationthreadCOMMONLIBRARYCODE

Download Yara Rule

APIs

InterlockedExchange.KERNEL32(?,?), ref: 007A77FE
EnterCriticalSection.KERNEL32(?,?,0074C2B6,?,?), ref: 007A780F
TerminateThread.KERNEL32(00000000,000001F6,?,0074C2B6,?,?), ref: 007A781C
WaitForSingleObject.KERNEL32(00000000,000003E8,?,0074C2B6,?,?), ref: 007A7829

Part of subcall function 007A71F0: CloseHandle.KERNEL32(00000000,?,007A7836,?,0074C2B6,?,?), ref: 007A71FA

InterlockedExchange.KERNEL32(?,000001F6), ref: 007A783C
LeaveCriticalSection.KERNEL32(?,?,0074C2B6,?,?), ref: 007A7843

Memory Dump Source

Source File: 0000000A.00000002.2894756195.0000000000741000.00000020.00000001.01000000.00000006.sdmp, Offset: 00740000, based on PE: true

Associated: 0000000A.00000002.2894716076.0000000000740000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.2894810207.00000000007D0000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.2894810207.00000000007F6000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.2894865972.0000000000800000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.2894887053.0000000000809000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_740000_Launches.jbxd

Similarity

API ID: CriticalExchangeInterlockedSection$CloseEnterHandleLeaveObjectSingleTerminateThreadWait
String ID:
API String ID: 3495660284-0
Opcode ID: 40d3e77d546685363844045f9b49428ddc28a86eb3590c71df759de66c091d36
Instruction ID: 99aa663a4d3d7b5fcdf5a0923a65ecc20e0a5c700e2f37589e45eca8db2e161a
Opcode Fuzzy Hash: 40d3e77d546685363844045f9b49428ddc28a86eb3590c71df759de66c091d36
Instruction Fuzzy Hash: 43F05E36147212AFD7152B64EC8DBAF7779FF86302F54A526F202950A0CBBD6801CBA4

Function 0079954A Relevance: 9.0, APIs: 6, Instructions: 23memorysynchronizationCOMMON

Download Yara Rule

APIs

WaitForSingleObject.KERNEL32(?,000000FF), ref: 00799555
UnloadUserProfile.USERENV(?,?), ref: 00799561
CloseHandle.KERNEL32(?), ref: 0079956A
CloseHandle.KERNEL32(?), ref: 00799572
GetProcessHeap.KERNEL32(00000000,?), ref: 0079957B
HeapFree.KERNEL32(00000000), ref: 00799582

Memory Dump Source

Source File: 0000000A.00000002.2894756195.0000000000741000.00000020.00000001.01000000.00000006.sdmp, Offset: 00740000, based on PE: true

Associated: 0000000A.00000002.2894716076.0000000000740000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.2894810207.00000000007D0000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.2894810207.00000000007F6000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.2894865972.0000000000800000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.2894887053.0000000000809000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_740000_Launches.jbxd

Similarity

API ID: CloseHandleHeap$FreeObjectProcessProfileSingleUnloadUserWait
String ID:
API String ID: 146765662-0
Opcode ID: 3b55c670f155db47a672efbc58bee215bd10eeb4f54745f224078fd97273bec4
Instruction ID: 95659e0571b44dda0d487f1538d4fa79740eb201d8d1b35dcdf280d0e027b682
Opcode Fuzzy Hash: 3b55c670f155db47a672efbc58bee215bd10eeb4f54745f224078fd97273bec4
Instruction Fuzzy Hash: 03E0E536105105FBDB012FE1EC0CA5ABF39FF89722F509222F21581070CB3AA860DB98

Function 007B8CD7 Relevance: 9.0, APIs: 3, Strings: 2, Instructions: 225COMMON

Download Yara Rule

APIs

VariantInit.OLEAUT32(?), ref: 007B8CFD
CharUpperBuffW.USER32(?,?), ref: 007B8E0C
VariantClear.OLEAUT32(?), ref: 007B8F84

Part of subcall function 007A7B1D: VariantInit.OLEAUT32(00000000), ref: 007A7B5D
Part of subcall function 007A7B1D: VariantCopy.OLEAUT32(00000000,?), ref: 007A7B66
Part of subcall function 007A7B1D: VariantClear.OLEAUT32(00000000), ref: 007A7B72

Strings

Incorrect Parameter format, xrefs: 007B8D35, 007B8EF7
AUTOIT.ERROR, xrefs: 007B8E12

Memory Dump Source

Source File: 0000000A.00000002.2894756195.0000000000741000.00000020.00000001.01000000.00000006.sdmp, Offset: 00740000, based on PE: true

Associated: 0000000A.00000002.2894716076.0000000000740000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.2894810207.00000000007D0000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.2894810207.00000000007F6000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.2894865972.0000000000800000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.2894887053.0000000000809000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_740000_Launches.jbxd

Similarity

API ID: Variant$ClearInit$BuffCharCopyUpper
String ID: AUTOIT.ERROR$Incorrect Parameter format
API String ID: 4237274167-1221869570
Opcode ID: d930703e91b4b59ebecf9c251c14976a46e0944dc09b8515636bb0afacc40d9d
Instruction ID: 6e3269b8e98c5cce30868ba569ecdd085af8b47b501d3d7c5973431a29e27838
Opcode Fuzzy Hash: d930703e91b4b59ebecf9c251c14976a46e0944dc09b8515636bb0afacc40d9d
Instruction Fuzzy Hash: 0F917E74604301DFC750DF24C484A9AB7F9EF89314F14896EF9998B361DB39E905CB92

Function 007A323D Relevance: 8.9, APIs: 4, Strings: 1, Instructions: 195windowCOMMON

Download Yara Rule

APIs

Part of subcall function 0075436A: _wcscpy.LIBCMT ref: 0075438D

_memset.LIBCMT ref: 007A332E
GetMenuItemInfoW.USER32(?,?,00000000,?), ref: 007A335D
SetMenuItemInfoW.USER32(?,?,00000000,?), ref: 007A3410
SetMenuDefaultItem.USER32(?,000000FF,00000000), ref: 007A343E

Strings

0, xrefs: 007A331A

Memory Dump Source

Source File: 0000000A.00000002.2894756195.0000000000741000.00000020.00000001.01000000.00000006.sdmp, Offset: 00740000, based on PE: true

Associated: 0000000A.00000002.2894716076.0000000000740000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.2894810207.00000000007D0000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.2894810207.00000000007F6000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.2894865972.0000000000800000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.2894887053.0000000000809000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_740000_Launches.jbxd

Similarity

API ID: ItemMenu$Info$Default_memset_wcscpy
String ID: 0
API String ID: 4152858687-4108050209
Opcode ID: d2ff4204887d0767f233cd305cabb4dab9ae4aa355eb5efb0b45ace84f98f78f
Instruction ID: 3c868c2d3fcc0b27978b8b6a4b1674e6563d873bed8891dafb4cec4756e8d5aa
Opcode Fuzzy Hash: d2ff4204887d0767f233cd305cabb4dab9ae4aa355eb5efb0b45ace84f98f78f
Instruction Fuzzy Hash: C351B0316083419BD7159F28D849B7BBBE4AF8A360F044B2DF895D31E1DB68DE44C752

Function 007A2EFA Relevance: 8.9, APIs: 4, Strings: 1, Instructions: 114windowCOMMON

Download Yara Rule

APIs

_memset.LIBCMT ref: 007A2F67
GetMenuItemInfoW.USER32(00000004,00000000,00000000,?), ref: 007A2F83
DeleteMenu.USER32(?,00000007,00000000), ref: 007A2FC9
DeleteMenu.USER32(?,00000000,00000000,?,00000000,00000000,00807890,00000000), ref: 007A3012

Strings

0, xrefs: 007A2F5C

Memory Dump Source

Source File: 0000000A.00000002.2894756195.0000000000741000.00000020.00000001.01000000.00000006.sdmp, Offset: 00740000, based on PE: true

Associated: 0000000A.00000002.2894716076.0000000000740000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.2894810207.00000000007D0000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.2894810207.00000000007F6000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.2894865972.0000000000800000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.2894887053.0000000000809000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_740000_Launches.jbxd

Similarity

API ID: Menu$Delete$InfoItem_memset
String ID: 0
API String ID: 1173514356-4108050209
Opcode ID: cd2fda0216ea8b27144471d72b9db2cc596f988412d264d408d56b2d497127a8
Instruction ID: c5c3737c16c5857f664e7844cf7001b791fac03e6596f644b6a3eeff9a99ebf4
Opcode Fuzzy Hash: cd2fda0216ea8b27144471d72b9db2cc596f988412d264d408d56b2d497127a8
Instruction Fuzzy Hash: 3941B1712043419FD724DF28C888B5BBBE5AFC6310F144B1EF96697292D778EA05CB62

Function 00799A48 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 94windowCOMMON

Download Yara Rule

APIs

Part of subcall function 00751A36: _memmove.LIBCMT ref: 00751A77

Part of subcall function 0079B79A: GetClassNameW.USER32(?,?,000000FF), ref: 0079B7BD

SendMessageW.USER32(?,00000188,00000000,00000000), ref: 00799ACC
SendMessageW.USER32(?,0000018A,00000000,00000000), ref: 00799ADF
SendMessageW.USER32(?,00000189,?,00000000), ref: 00799B0F

Part of subcall function 00751821: _memmove.LIBCMT ref: 0075185B

Strings

ListBox, xrefs: 00799A8B
ComboBox, xrefs: 00799A56

Memory Dump Source

Source File: 0000000A.00000002.2894756195.0000000000741000.00000020.00000001.01000000.00000006.sdmp, Offset: 00740000, based on PE: true

Associated: 0000000A.00000002.2894716076.0000000000740000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.2894810207.00000000007D0000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.2894810207.00000000007F6000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.2894865972.0000000000800000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.2894887053.0000000000809000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_740000_Launches.jbxd

Similarity

API ID: MessageSend$_memmove$ClassName
String ID: ComboBox$ListBox
API String ID: 365058703-1403004172
Opcode ID: 27c59cd3cb8d024dbd315c5d23da61a3918effc3dcefc233af54c9a823436c58
Instruction ID: 31172e665803230fbbf3c3e45e01bde3a8c873d93f69945873e5839bf13a4996
Opcode Fuzzy Hash: 27c59cd3cb8d024dbd315c5d23da61a3918effc3dcefc233af54c9a823436c58
Instruction Fuzzy Hash: 962101B1901108BEEF24EBB4EC4AEFEB778DF41360F50821AF925932D0DB3D49098660

Function 007C6A0C Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 80windowlibraryCOMMON

Download Yara Rule

APIs

Part of subcall function 00742111: CreateWindowExW.USER32(?,?,?,?,?,?,?,?,?,?,00000000,00000096), ref: 0074214F
Part of subcall function 00742111: GetStockObject.GDI32(00000011), ref: 00742163
Part of subcall function 00742111: SendMessageW.USER32(00000000,00000030,00000000), ref: 0074216D

SendMessageW.USER32(00000000,00000467,00000000,?), ref: 007C6A86
LoadLibraryW.KERNEL32(?), ref: 007C6A8D
SendMessageW.USER32(?,00000467,00000000,00000000), ref: 007C6AA2
DestroyWindow.USER32(?), ref: 007C6AAA

Strings

SysAnimate32, xrefs: 007C6A61

Memory Dump Source

Source File: 0000000A.00000002.2894756195.0000000000741000.00000020.00000001.01000000.00000006.sdmp, Offset: 00740000, based on PE: true

Associated: 0000000A.00000002.2894716076.0000000000740000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.2894810207.00000000007D0000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.2894810207.00000000007F6000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.2894865972.0000000000800000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.2894887053.0000000000809000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_740000_Launches.jbxd

Similarity

API ID: MessageSend$Window$CreateDestroyLibraryLoadObjectStock
String ID: SysAnimate32
API String ID: 4146253029-1011021900
Opcode ID: 2a5502d131da54385d2534f98190332d0b052c5ec4973c794190324050e6d9e8
Instruction ID: f737034179b266a27f753605b43c680c2724fcd14b5543bc063c55ebfc4430e7
Opcode Fuzzy Hash: 2a5502d131da54385d2534f98190332d0b052c5ec4973c794190324050e6d9e8
Instruction Fuzzy Hash: 64218871200209AFEF108EA49C80FBF77ADEB99324F10D62DFE50A2190D739DC5197A4

Function 007A7357 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 79filepipeCOMMON

Download Yara Rule

APIs

GetStdHandle.KERNEL32(0000000C), ref: 007A7377
CreatePipe.KERNEL32(?,?,0000000C,00000000), ref: 007A73AA
GetStdHandle.KERNEL32(0000000C), ref: 007A73BC
CreateFileW.KERNEL32(nul,40000000,00000002,0000000C,00000003,00000080,00000000), ref: 007A73F6

Strings

nul, xrefs: 007A73F1

Memory Dump Source

Source File: 0000000A.00000002.2894756195.0000000000741000.00000020.00000001.01000000.00000006.sdmp, Offset: 00740000, based on PE: true

Associated: 0000000A.00000002.2894716076.0000000000740000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.2894810207.00000000007D0000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.2894810207.00000000007F6000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.2894865972.0000000000800000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.2894887053.0000000000809000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_740000_Launches.jbxd

Similarity

API ID: CreateHandle$FilePipe
String ID: nul
API String ID: 4209266947-2873401336
Opcode ID: 3e567bdfe60f3fa918140fa2bdec631050a3e17aca6b49555c6d6347850b185f
Instruction ID: 34acdb3a7277b344de91b8d1402a9cfb56e02932e941f03bf4598f203c57596c
Opcode Fuzzy Hash: 3e567bdfe60f3fa918140fa2bdec631050a3e17aca6b49555c6d6347850b185f
Instruction Fuzzy Hash: C321A17050834AABDF248F68DC48B9A7BB4BF86721F204B29FCA1D72D0D7749850DB90

Function 007A7425 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 79filepipeCOMMON

Download Yara Rule

APIs

GetStdHandle.KERNEL32(000000F6), ref: 007A7444
CreatePipe.KERNEL32(?,?,0000000C,00000000), ref: 007A7476
GetStdHandle.KERNEL32(000000F6), ref: 007A7487
CreateFileW.KERNEL32(nul,80000000,00000001,0000000C,00000003,00000080,00000000), ref: 007A74C1

Strings

nul, xrefs: 007A74BC

Memory Dump Source

Source File: 0000000A.00000002.2894756195.0000000000741000.00000020.00000001.01000000.00000006.sdmp, Offset: 00740000, based on PE: true

Associated: 0000000A.00000002.2894716076.0000000000740000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.2894810207.00000000007D0000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.2894810207.00000000007F6000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.2894865972.0000000000800000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.2894887053.0000000000809000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_740000_Launches.jbxd

Similarity

API ID: CreateHandle$FilePipe
String ID: nul
API String ID: 4209266947-2873401336
Opcode ID: d79b05910c87fabf671e9b6a68bdf77d60a5c271108de15c0daa32c9ed56c59e
Instruction ID: f9570c712d8bd31d21b18088387323ac11f2030a09666e2984f2f603ee4f0028
Opcode Fuzzy Hash: d79b05910c87fabf671e9b6a68bdf77d60a5c271108de15c0daa32c9ed56c59e
Instruction Fuzzy Hash: 2521B0756082469BDB249F688C48B9A7BB8AF8A720F204B19FDA0D72D0DB749C40CB50

Function 007AB283 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 73COMMON

Download Yara Rule

APIs

SetErrorMode.KERNEL32(00000001), ref: 007AB297
GetVolumeInformationW.KERNEL32(?,?,00007FFF,?,00000000,00000000,00000000,00000000), ref: 007AB2EB
__swprintf.LIBCMT ref: 007AB304
SetErrorMode.KERNEL32(00000000,00000001,00000000,007D0980), ref: 007AB342

Strings

%lu, xrefs: 007AB2FE

Memory Dump Source

Source File: 0000000A.00000002.2894756195.0000000000741000.00000020.00000001.01000000.00000006.sdmp, Offset: 00740000, based on PE: true

Associated: 0000000A.00000002.2894716076.0000000000740000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.2894810207.00000000007D0000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.2894810207.00000000007F6000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.2894865972.0000000000800000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.2894887053.0000000000809000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_740000_Launches.jbxd

Similarity

API ID: ErrorMode$InformationVolume__swprintf
String ID: %lu
API String ID: 3164766367-685833217
Opcode ID: bc64cc89081f268acbfaae83d245202fb35f504aa1689c8c15efad6b0b2c5ae3
Instruction ID: 1d9067abde1ea60069e27d789e538b0a98895a3f32daf90c4e2148b3703f4a15
Opcode Fuzzy Hash: bc64cc89081f268acbfaae83d245202fb35f504aa1689c8c15efad6b0b2c5ae3
Instruction Fuzzy Hash: 69214174A00109EFCB10DF65CC49EAEB7B8EF89704F108069F909D7252DB75EA45DB61

Function 0079AC05 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 68windowCOMMON

Download Yara Rule

APIs

Part of subcall function 00751821: _memmove.LIBCMT ref: 0075185B

Part of subcall function 0079AA52: SendMessageTimeoutW.USER32(?,00000000,00000000,00000000,00000002,00001388,00000001), ref: 0079AA6F
Part of subcall function 0079AA52: GetWindowThreadProcessId.USER32(?,00000000), ref: 0079AA82
Part of subcall function 0079AA52: GetCurrentThreadId.KERNEL32 ref: 0079AA89
Part of subcall function 0079AA52: AttachThreadInput.USER32(00000000), ref: 0079AA90

GetFocus.USER32 ref: 0079AC2A

Part of subcall function 0079AA9B: GetParent.USER32(?), ref: 0079AAA9

GetClassNameW.USER32(?,?,00000100), ref: 0079AC73
EnumChildWindows.USER32(?,0079ACEB), ref: 0079AC9B
__swprintf.LIBCMT ref: 0079ACB5

Strings

%s%d, xrefs: 0079ACAF

Memory Dump Source

Source File: 0000000A.00000002.2894756195.0000000000741000.00000020.00000001.01000000.00000006.sdmp, Offset: 00740000, based on PE: true

Associated: 0000000A.00000002.2894716076.0000000000740000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.2894810207.00000000007D0000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.2894810207.00000000007F6000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.2894865972.0000000000800000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.2894887053.0000000000809000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_740000_Launches.jbxd

Similarity

API ID: Thread$AttachChildClassCurrentEnumFocusInputMessageNameParentProcessSendTimeoutWindowWindows__swprintf_memmove
String ID: %s%d
API String ID: 1941087503-1110647743
Opcode ID: 6b6337ac9ca873ae893342ccb3334570f444c2111cebd322d44328c961d717ce
Instruction ID: 9aac3fa9556a89c9df2e6d8051b4d565df6148627fee14b131e93e40a0db1b3b
Opcode Fuzzy Hash: 6b6337ac9ca873ae893342ccb3334570f444c2111cebd322d44328c961d717ce
Instruction Fuzzy Hash: 2211D574201205BBCF11BFA0AD89FEE377CEB44310F008075FE089A142CA796945DBB5

Function 007A22E7 Relevance: 8.8, APIs: 1, Strings: 4, Instructions: 49COMMON

Download Yara Rule

APIs

CharUpperBuffW.USER32(?,?), ref: 007A2318

Strings

APPEND, xrefs: 007A2351
KEYS, xrefs: 007A232F
EXISTS, xrefs: 007A2340
REMOVE, xrefs: 007A231E

Memory Dump Source

Source File: 0000000A.00000002.2894756195.0000000000741000.00000020.00000001.01000000.00000006.sdmp, Offset: 00740000, based on PE: true

Associated: 0000000A.00000002.2894716076.0000000000740000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.2894810207.00000000007D0000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.2894810207.00000000007F6000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.2894865972.0000000000800000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.2894887053.0000000000809000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_740000_Launches.jbxd

Similarity

API ID: BuffCharUpper
String ID: APPEND$EXISTS$KEYS$REMOVE
API String ID: 3964851224-769500911
Opcode ID: 660dbc2ac5495c96f41b1ae5defe31d6d63956278e94936e12dd31995b11ac9d
Instruction ID: 9082927f29385d3b7fa6ae4685cfcf24207f58e086be3ffe30142252c34a229f
Opcode Fuzzy Hash: 660dbc2ac5495c96f41b1ae5defe31d6d63956278e94936e12dd31995b11ac9d
Instruction Fuzzy Hash: 19117C3090011CDBCF00EFA4C8545FEB3B4FF56304B5081A9D811A7252EB3A5D0ACB90

Function 007BF23E Relevance: 7.7, APIs: 5, Instructions: 247COMMON

Download Yara Rule

APIs

OpenProcess.KERNEL32(00000410,00000000,00000000), ref: 007BF2F0
GetProcessIoCounters.KERNEL32(00000000,?), ref: 007BF320
GetProcessMemoryInfo.PSAPI(00000000,?,00000028), ref: 007BF453
CloseHandle.KERNEL32(?), ref: 007BF4D4

Memory Dump Source

Source File: 0000000A.00000002.2894756195.0000000000741000.00000020.00000001.01000000.00000006.sdmp, Offset: 00740000, based on PE: true

Associated: 0000000A.00000002.2894716076.0000000000740000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.2894810207.00000000007D0000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.2894810207.00000000007F6000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.2894865972.0000000000800000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.2894887053.0000000000809000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_740000_Launches.jbxd

Similarity

API ID: Process$CloseCountersHandleInfoMemoryOpen
String ID:
API String ID: 2364364464-0
Opcode ID: b05f290b04ab1600c54771393e457602d851dacc953600269ba63f44e3e1ab26
Instruction ID: 90b8afdab49cba1d092a8f5ef002151f1dfc422e27cfdc6c3c9e4c5faf78ed06
Opcode Fuzzy Hash: b05f290b04ab1600c54771393e457602d851dacc953600269ba63f44e3e1ab26
Instruction Fuzzy Hash: C38162756047009FD720EF28DC86F6AB7E5AF44B10F14891DF999DB292D7B8AC408F91

Function 007C0697 Relevance: 7.6, APIs: 5, Instructions: 144registryCOMMON

Download Yara Rule

APIs

Part of subcall function 00751A36: _memmove.LIBCMT ref: 00751A77

Part of subcall function 007C147A: CharUpperBuffW.USER32(?,?,?,?,?,?,?,007C040D,?,?), ref: 007C1491

RegConnectRegistryW.ADVAPI32(?,?,?), ref: 007C075D
RegOpenKeyExW.ADVAPI32(?,?,00000000,?,?), ref: 007C079C
RegEnumKeyExW.ADVAPI32(?,-00000001,?,?,00000000,00000000,00000000,?), ref: 007C07E3
RegCloseKey.ADVAPI32(?,?), ref: 007C080F
RegCloseKey.ADVAPI32(00000000), ref: 007C081C

Memory Dump Source

Source File: 0000000A.00000002.2894756195.0000000000741000.00000020.00000001.01000000.00000006.sdmp, Offset: 00740000, based on PE: true

Associated: 0000000A.00000002.2894716076.0000000000740000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.2894810207.00000000007D0000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.2894810207.00000000007F6000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.2894865972.0000000000800000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.2894887053.0000000000809000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_740000_Launches.jbxd

Similarity

API ID: Close$BuffCharConnectEnumOpenRegistryUpper_memmove
String ID:
API String ID: 3440857362-0
Opcode ID: 7d5e355d43ce648266e919cd471387983cbd2f032e81f8e84bc66e6c74fe40ce
Instruction ID: ca238020865166f7cb0c7256fc13c0564a2d60446aef3b37fade1f0f8cacdda5
Opcode Fuzzy Hash: 7d5e355d43ce648266e919cd471387983cbd2f032e81f8e84bc66e6c74fe40ce
Instruction Fuzzy Hash: BD515A71208204EFD704EF64C885F6AB7E9FF84705F44891DF995872A2DB79E908CB92

Function 007AEBB4 Relevance: 7.6, APIs: 5, Instructions: 135COMMON

Download Yara Rule

APIs

GetPrivateProfileSectionW.KERNEL32(00000003,?,00007FFF,?), ref: 007AEC62
GetPrivateProfileSectionW.KERNEL32(?,00000001,00000003,?), ref: 007AEC8B
WritePrivateProfileSectionW.KERNEL32(?,?,?), ref: 007AECCA

Part of subcall function 00744D37: __itow.LIBCMT ref: 00744D62
Part of subcall function 00744D37: __swprintf.LIBCMT ref: 00744DAC

WritePrivateProfileStringW.KERNEL32(00000003,00000000,00000000,?), ref: 007AECEF
WritePrivateProfileStringW.KERNEL32(00000000,00000000,00000000,?), ref: 007AECF7

Memory Dump Source

Source File: 0000000A.00000002.2894756195.0000000000741000.00000020.00000001.01000000.00000006.sdmp, Offset: 00740000, based on PE: true

Associated: 0000000A.00000002.2894716076.0000000000740000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.2894810207.00000000007D0000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.2894810207.00000000007F6000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.2894865972.0000000000800000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.2894887053.0000000000809000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_740000_Launches.jbxd

Similarity

API ID: PrivateProfile$SectionWrite$String$__itow__swprintf
String ID:
API String ID: 1389676194-0
Opcode ID: 63d230686b65502142b28bc3839ea0ab16cb26ab106d353bf77e6df71404ed13
Instruction ID: 6047cff7ea97c0d7d89c2341a52fc0aeecd0bd5d2847956479b33a001d937627
Opcode Fuzzy Hash: 63d230686b65502142b28bc3839ea0ab16cb26ab106d353bf77e6df71404ed13
Instruction Fuzzy Hash: DE512C35A00105DFCB01EF64C989AAEBBF5FF49314B148099E949AB361CB39ED51DFA0

Function 007CA67B Relevance: 7.6, APIs: 5, Instructions: 130COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.2894756195.0000000000741000.00000020.00000001.01000000.00000006.sdmp, Offset: 00740000, based on PE: true

Associated: 0000000A.00000002.2894716076.0000000000740000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.2894810207.00000000007D0000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.2894810207.00000000007F6000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.2894865972.0000000000800000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.2894887053.0000000000809000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_740000_Launches.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4d9a9607897ef5c2f9e774a40d5b861684dca4d6afe0ce7a33c352ccf2eab3c3
Instruction ID: de1643128eefca8b2b2978dac9e3dfe3c7fc977d2637e23658aa3be4f8d2a9fa
Opcode Fuzzy Hash: 4d9a9607897ef5c2f9e774a40d5b861684dca4d6afe0ce7a33c352ccf2eab3c3
Instruction Fuzzy Hash: BF41D235900118BFD710DB28CC88FA9BBB8FB09326F14426DF916A72D1C778AD51DA91

Function 00742714 Relevance: 7.6, APIs: 5, Instructions: 111keyboardCOMMON

Download Yara Rule

APIs

GetCursorPos.USER32(?), ref: 00742727
ScreenToClient.USER32(008077B0,?), ref: 00742744
GetAsyncKeyState.USER32(00000001), ref: 00742769
GetAsyncKeyState.USER32(00000002), ref: 00742777

Memory Dump Source

Source File: 0000000A.00000002.2894756195.0000000000741000.00000020.00000001.01000000.00000006.sdmp, Offset: 00740000, based on PE: true

Associated: 0000000A.00000002.2894716076.0000000000740000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.2894810207.00000000007D0000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.2894810207.00000000007F6000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.2894865972.0000000000800000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.2894887053.0000000000809000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_740000_Launches.jbxd

Similarity

API ID: AsyncState$ClientCursorScreen
String ID:
API String ID: 4210589936-0
Opcode ID: 823cf0915fc286ca63056d638d5eba0ec0232e62ad211d73849b163ca0c71b64
Instruction ID: daae11c2114f64e26e015ebc70b15f1e99582ec7a0a1d272d5cb79696f424587
Opcode Fuzzy Hash: 823cf0915fc286ca63056d638d5eba0ec0232e62ad211d73849b163ca0c71b64
Instruction Fuzzy Hash: 5F418235504109FFDF169F68C848FE9BB74FB09364F50831AF928A6291CB38AD60DB91

Function 007995D7 Relevance: 7.6, APIs: 5, Instructions: 89sleepwindowCOMMON

Download Yara Rule

APIs

GetWindowRect.USER32(?,?), ref: 007995E8
PostMessageW.USER32(?,00000201,00000001), ref: 00799692
Sleep.KERNEL32(00000000,?,00000201,00000001,?,?,?), ref: 0079969A
PostMessageW.USER32(?,00000202,00000000), ref: 007996A8
Sleep.KERNEL32(00000000,?,00000202,00000000,?,?,00000201,00000001,?,?,?), ref: 007996B0

Memory Dump Source

Source File: 0000000A.00000002.2894756195.0000000000741000.00000020.00000001.01000000.00000006.sdmp, Offset: 00740000, based on PE: true

Associated: 0000000A.00000002.2894716076.0000000000740000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.2894810207.00000000007D0000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.2894810207.00000000007F6000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.2894865972.0000000000800000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.2894887053.0000000000809000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_740000_Launches.jbxd

Similarity

API ID: MessagePostSleep$RectWindow
String ID:
API String ID: 3382505437-0
Opcode ID: 68d2852f89d84571c93361a92edf8fc77fbeec6206c28389c5bc0277ee3b92ec
Instruction ID: 42623b83532d1a488a64135c0e3279a903aa7f82fb7adf5e62d87cda78d6b4f3
Opcode Fuzzy Hash: 68d2852f89d84571c93361a92edf8fc77fbeec6206c28389c5bc0277ee3b92ec
Instruction Fuzzy Hash: C731BC71900219EBEF14CF6CE94CB9E7BB5EB44315F108259FA24AA2D0C3B8D924DB90

Function 007CB7BD Relevance: 7.6, APIs: 5, Instructions: 85COMMON

Download Yara Rule

APIs

Part of subcall function 007429E2: GetWindowLongW.USER32(?,000000EB), ref: 007429F3

GetWindowLongW.USER32(?,000000F0), ref: 007CB804
SetWindowLongW.USER32(00000000,000000F0,00000001), ref: 007CB829
SetWindowLongW.USER32(00000000,000000EC,000000FF), ref: 007CB841
GetSystemMetrics.USER32(00000004), ref: 007CB86A
SetWindowPos.USER32(00000000,00000000,00000000,00000000,00000000,00000000,00000047,?,?,?,?,?,?,?,007B155C,00000000), ref: 007CB888

Memory Dump Source

Source File: 0000000A.00000002.2894756195.0000000000741000.00000020.00000001.01000000.00000006.sdmp, Offset: 00740000, based on PE: true

Associated: 0000000A.00000002.2894716076.0000000000740000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.2894810207.00000000007D0000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.2894810207.00000000007F6000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.2894865972.0000000000800000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.2894887053.0000000000809000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_740000_Launches.jbxd

Similarity

API ID: Window$Long$MetricsSystem
String ID:
API String ID: 2294984445-0
Opcode ID: 52240323e32978722ab29d9183a125143e41d10ca81fb282e921d7c351e75fd8
Instruction ID: 82503a8065cbdd4443998d9ac68a5eec71bbe31757d3f9edea4461d7ac865c69
Opcode Fuzzy Hash: 52240323e32978722ab29d9183a125143e41d10ca81fb282e921d7c351e75fd8
Instruction Fuzzy Hash: 0A215A71A14255AFCB249F389C09F6A3BA8FB05724F15873DF926D62E0E7349860CAD0

Function 007B6138 Relevance: 7.6, APIs: 5, Instructions: 70COMMON

Download Yara Rule

APIs

IsWindow.USER32(00000000), ref: 007B6159
GetForegroundWindow.USER32 ref: 007B6170
GetDC.USER32(00000000), ref: 007B61AC
GetPixel.GDI32(00000000,?,00000003), ref: 007B61B8
ReleaseDC.USER32(00000000,00000003), ref: 007B61F3

Memory Dump Source

Source File: 0000000A.00000002.2894756195.0000000000741000.00000020.00000001.01000000.00000006.sdmp, Offset: 00740000, based on PE: true

Associated: 0000000A.00000002.2894716076.0000000000740000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.2894810207.00000000007D0000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.2894810207.00000000007F6000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.2894865972.0000000000800000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.2894887053.0000000000809000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_740000_Launches.jbxd

Similarity

API ID: Window$ForegroundPixelRelease
String ID:
API String ID: 4156661090-0
Opcode ID: b216153b84a9d976094ae17b76c26a43909efa22408d7cadd7b5e0f49a2bf2d4
Instruction ID: 39b5d2f9dcbf162ea5030288dd09cf7bb9319b3275c11a3c21481cca47b6f341
Opcode Fuzzy Hash: b216153b84a9d976094ae17b76c26a43909efa22408d7cadd7b5e0f49a2bf2d4
Instruction Fuzzy Hash: 17215375A01104DFD714EF65DD88BAAB7F9EF89310F048469E94997252CB38AC00DB90

Function 007416CF Relevance: 7.6, APIs: 5, Instructions: 67COMMON

Download Yara Rule

APIs

ExtCreatePen.GDI32(?,?,00000000,00000000,00000000,?,00000000), ref: 00741729
SelectObject.GDI32(?,00000000), ref: 00741738
BeginPath.GDI32(?), ref: 0074174F
SelectObject.GDI32(?,00000000), ref: 00741778

Memory Dump Source

Source File: 0000000A.00000002.2894756195.0000000000741000.00000020.00000001.01000000.00000006.sdmp, Offset: 00740000, based on PE: true

Associated: 0000000A.00000002.2894716076.0000000000740000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.2894810207.00000000007D0000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.2894810207.00000000007F6000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.2894865972.0000000000800000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.2894887053.0000000000809000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_740000_Launches.jbxd

Similarity

API ID: ObjectSelect$BeginCreatePath
String ID:
API String ID: 3225163088-0
Opcode ID: 2d5e206bbf6a75004dd89ceeedf27995b4016873be5b8e571a16f40ea975bd82
Instruction ID: 304545256378af9d9e643f35004ec66d49852f539b0654b793fd076ed211a002
Opcode Fuzzy Hash: 2d5e206bbf6a75004dd89ceeedf27995b4016873be5b8e571a16f40ea975bd82
Instruction Fuzzy Hash: 46217C30A05208EBDB51AF24DD48B697BB9FB00321F54C226F825962B0D779E991CF99

Function 0079C837 Relevance: 7.6, APIs: 5, Instructions: 61COMMON

Download Yara Rule

APIs

_memcmp.LIBCMT ref: 0079C84C
_memcmp.LIBCMT ref: 0079C86A
_memcmp.LIBCMT ref: 0079C87D
_memcmp.LIBCMT ref: 0079C895
_memcmp.LIBCMT ref: 0079C8AD

Memory Dump Source

Source File: 0000000A.00000002.2894756195.0000000000741000.00000020.00000001.01000000.00000006.sdmp, Offset: 00740000, based on PE: true

Associated: 0000000A.00000002.2894716076.0000000000740000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.2894810207.00000000007D0000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.2894810207.00000000007F6000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.2894865972.0000000000800000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.2894887053.0000000000809000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_740000_Launches.jbxd

Similarity

API ID: _memcmp
String ID:
API String ID: 2931989736-0
Opcode ID: 8dc68f7ddf906ccb3227e4e40b83aeefb54d75e7ce95a96d6b3b7fcea6f3fe37
Instruction ID: f0229d23d7f305c255f3a031b21dd6e8c1c34b64d224aa59d55c0d2a0f01ba1d
Opcode Fuzzy Hash: 8dc68f7ddf906ccb3227e4e40b83aeefb54d75e7ce95a96d6b3b7fcea6f3fe37
Instruction Fuzzy Hash: 0D01B5A2A401057BDE15A511AD8AFBB736C9B60384F084026FE0796741EBACDE2182E1

Function 007A504E Relevance: 7.6, APIs: 5, Instructions: 56synchronizationthreadwindowCOMMON

Download Yara Rule

APIs

GetCurrentThreadId.KERNEL32 ref: 007A5075
__beginthreadex.LIBCMT ref: 007A5093
MessageBoxW.USER32(?,?,?,?), ref: 007A50A8
WaitForSingleObject.KERNEL32(00000000,000000FF,?,?,?,?), ref: 007A50BE
CloseHandle.KERNEL32(00000000,?,?,?,?), ref: 007A50C5

Memory Dump Source

Source File: 0000000A.00000002.2894756195.0000000000741000.00000020.00000001.01000000.00000006.sdmp, Offset: 00740000, based on PE: true

Associated: 0000000A.00000002.2894716076.0000000000740000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.2894810207.00000000007D0000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.2894810207.00000000007F6000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.2894865972.0000000000800000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.2894887053.0000000000809000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_740000_Launches.jbxd

Similarity

API ID: CloseCurrentHandleMessageObjectSingleThreadWait__beginthreadex
String ID:
API String ID: 3824534824-0
Opcode ID: fb031f937b530cc14c48d6ea4f771905f26fd6f7e46eb11a607ee745b12a40ca
Instruction ID: 74803fbb7221b2b4e42b62ca458cd715f75897f885bea432e69827034329fa59
Opcode Fuzzy Hash: fb031f937b530cc14c48d6ea4f771905f26fd6f7e46eb11a607ee745b12a40ca
Instruction Fuzzy Hash: EB1104B6D09618BFC7419BA89C08B9F7FACEB86320F14435AF915D3350D67A990087F1

Function 00798E20 Relevance: 7.5, APIs: 5, Instructions: 49memoryCOMMON

Download Yara Rule

APIs

GetUserObjectSecurity.USER32(?,00000004,?,00000000,?), ref: 00798E3C
GetLastError.KERNEL32(?,00798900,?,?,?), ref: 00798E46
GetProcessHeap.KERNEL32(00000008,?,?,00798900,?,?,?), ref: 00798E55
HeapAlloc.KERNEL32(00000000,?,00798900,?,?,?), ref: 00798E5C
GetUserObjectSecurity.USER32(?,00000004,00000000,?,?), ref: 00798E73

Memory Dump Source

Source File: 0000000A.00000002.2894756195.0000000000741000.00000020.00000001.01000000.00000006.sdmp, Offset: 00740000, based on PE: true

Associated: 0000000A.00000002.2894716076.0000000000740000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.2894810207.00000000007D0000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.2894810207.00000000007F6000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.2894865972.0000000000800000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.2894887053.0000000000809000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_740000_Launches.jbxd

Similarity

API ID: HeapObjectSecurityUser$AllocErrorLastProcess
String ID:
API String ID: 842720411-0
Opcode ID: db746e91f0ccf93be8ccbfab519e9edb3339a8aee1aeb3e6ef0430d33d586e2a
Instruction ID: 43c16aa50042919a8f6bc0561fbddd323fe0f6ff64514fec5bfcd58a2fd7eb21
Opcode Fuzzy Hash: db746e91f0ccf93be8ccbfab519e9edb3339a8aee1aeb3e6ef0430d33d586e2a
Instruction Fuzzy Hash: DC011271601244BFDB104FA5EC58E6B7FBDEF86755B10456AF845C2210DA35DC10CAA5

Function 00797D28 Relevance: 7.5, APIs: 5, Instructions: 48stringCOMMON

Download Yara Rule

APIs

CLSIDFromProgID.OLE32(?,?,00000000,?,00000000,?,?,-C0000018,00000001,?,00797C62,80070057,?,?,?,00798073), ref: 00797D45
ProgIDFromCLSID.OLE32(?,00000000,?,?,00000000,?,00000000,?,?,-C0000018,00000001,?,00797C62,80070057,?,?), ref: 00797D60
lstrcmpiW.KERNEL32(?,00000000,?,?,00000000,?,00000000,?,?,-C0000018,00000001,?,00797C62,80070057,?,?), ref: 00797D6E
CoTaskMemFree.OLE32(00000000,?,00000000,?,?,00000000,?,00000000,?,?,-C0000018,00000001,?,00797C62,80070057,?), ref: 00797D7E
CLSIDFromString.OLE32(?,?,?,?,00000000,?,00000000,?,?,-C0000018,00000001,?,00797C62,80070057,?,?), ref: 00797D8A

Memory Dump Source

Source File: 0000000A.00000002.2894756195.0000000000741000.00000020.00000001.01000000.00000006.sdmp, Offset: 00740000, based on PE: true

Associated: 0000000A.00000002.2894716076.0000000000740000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.2894810207.00000000007D0000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.2894810207.00000000007F6000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.2894865972.0000000000800000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.2894887053.0000000000809000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_740000_Launches.jbxd

Similarity

API ID: From$Prog$FreeStringTasklstrcmpi
String ID:
API String ID: 3897988419-0
Opcode ID: d784da85073896458cebf899c848dca6ef72b0811fc3851dafed2820b3957667
Instruction ID: 41d7464893c1ce6bc54e7778061a72ec749b5fffc639e2d7060ec1bd9fef9b07
Opcode Fuzzy Hash: d784da85073896458cebf899c848dca6ef72b0811fc3851dafed2820b3957667
Instruction Fuzzy Hash: 22017C72716214ABDB154F64EC44BAA7BBDEF44762F149029F908D6210E779ED00EBE0

Function 00798CC7 Relevance: 7.5, APIs: 5, Instructions: 45memoryCOMMON

Download Yara Rule

APIs

GetTokenInformation.ADVAPI32(?,00000002,?,00000000,?), ref: 00798CDE
GetLastError.KERNEL32(?,00000002,?,00000000,?), ref: 00798CE8
GetProcessHeap.KERNEL32(00000008,?,?,00000002,?,00000000,?), ref: 00798CF7
HeapAlloc.KERNEL32(00000000,?,00000002,?,00000000,?), ref: 00798CFE
GetTokenInformation.ADVAPI32(?,00000002,00000000,?,?,?,00000002,?,00000000,?), ref: 00798D14

Memory Dump Source

Source File: 0000000A.00000002.2894756195.0000000000741000.00000020.00000001.01000000.00000006.sdmp, Offset: 00740000, based on PE: true

Associated: 0000000A.00000002.2894716076.0000000000740000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.2894810207.00000000007D0000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.2894810207.00000000007F6000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.2894865972.0000000000800000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.2894887053.0000000000809000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_740000_Launches.jbxd

Similarity

API ID: HeapInformationToken$AllocErrorLastProcess
String ID:
API String ID: 44706859-0
Opcode ID: 75e262e871915c4fb67389c1c56c27af0849f15308c7b53650208f42c309786e
Instruction ID: fc12d1f6982eba9aa64cddb282cc025eca1b2c74db90aab266d0eddb36b9a246
Opcode Fuzzy Hash: 75e262e871915c4fb67389c1c56c27af0849f15308c7b53650208f42c309786e
Instruction Fuzzy Hash: DEF08C34301208BFEF100FA4AC8CF6B3BACEF8A754F50802AF94482190CA699C00DBA1

Function 00798D28 Relevance: 7.5, APIs: 5, Instructions: 45memoryCOMMON

Download Yara Rule

APIs

GetTokenInformation.ADVAPI32(?,00000003(TokenIntegrityLevel),?,00000000,?), ref: 00798D3F
GetLastError.KERNEL32(?,TokenIntegrityLevel,?,00000000,?), ref: 00798D49
GetProcessHeap.KERNEL32(00000008,?,?,TokenIntegrityLevel,?,00000000,?), ref: 00798D58
HeapAlloc.KERNEL32(00000000,?,TokenIntegrityLevel,?,00000000,?), ref: 00798D5F
GetTokenInformation.ADVAPI32(?,00000003(TokenIntegrityLevel),00000000,?,?,?,TokenIntegrityLevel,?,00000000,?), ref: 00798D75

Memory Dump Source

Source File: 0000000A.00000002.2894756195.0000000000741000.00000020.00000001.01000000.00000006.sdmp, Offset: 00740000, based on PE: true

Associated: 0000000A.00000002.2894716076.0000000000740000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.2894810207.00000000007D0000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.2894810207.00000000007F6000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.2894865972.0000000000800000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.2894887053.0000000000809000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_740000_Launches.jbxd

Similarity

API ID: HeapInformationToken$AllocErrorLastProcess
String ID:
API String ID: 44706859-0
Opcode ID: f86daa2dcf69dec4c83905e2af68875b63cf6b32f5ce4bdbf88992f3709b08e3
Instruction ID: bf24940ee65c5d05a28f8046e409f00b61b3d2faa3e769c70664e8176f63cd1d
Opcode Fuzzy Hash: f86daa2dcf69dec4c83905e2af68875b63cf6b32f5ce4bdbf88992f3709b08e3
Instruction Fuzzy Hash: 38F08C35201204AFEB510FA4EC88F6B3BACEF8A754F44411AF94482190CA699D00DAA1

Function 0079CD7C Relevance: 7.5, APIs: 5, Instructions: 41windowtimeCOMMON

Download Yara Rule

APIs

GetDlgItem.USER32(?,000003E9), ref: 0079CD90
GetWindowTextW.USER32(00000000,?,00000100), ref: 0079CDA7
MessageBeep.USER32(00000000), ref: 0079CDBF
KillTimer.USER32(?,0000040A), ref: 0079CDDB
EndDialog.USER32(?,00000001), ref: 0079CDF5

Memory Dump Source

Source File: 0000000A.00000002.2894756195.0000000000741000.00000020.00000001.01000000.00000006.sdmp, Offset: 00740000, based on PE: true

Associated: 0000000A.00000002.2894716076.0000000000740000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.2894810207.00000000007D0000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.2894810207.00000000007F6000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.2894865972.0000000000800000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.2894887053.0000000000809000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_740000_Launches.jbxd

Similarity

API ID: BeepDialogItemKillMessageTextTimerWindow
String ID:
API String ID: 3741023627-0
Opcode ID: 8d8721dbd56ffcee82a9e284465c4037fd2ebf9bc3cb1f7efda4bc137b5095b6
Instruction ID: 37f5d737164560f87d517c8c4bb1b563c9557da5714090ba9eaee975d433cd26
Opcode Fuzzy Hash: 8d8721dbd56ffcee82a9e284465c4037fd2ebf9bc3cb1f7efda4bc137b5095b6
Instruction Fuzzy Hash: DA018630641704ABEF215F60ED5EBA67B78FB00715F00466AF582A10E1DBF8A9548BD5

Function 0074178C Relevance: 7.5, APIs: 5, Instructions: 29COMMON

Download Yara Rule

APIs

EndPath.GDI32(?), ref: 0074179B
StrokeAndFillPath.GDI32(?,?,0077BBC9,00000000,?), ref: 007417B7
SelectObject.GDI32(?,00000000), ref: 007417CA
DeleteObject.GDI32 ref: 007417DD
StrokePath.GDI32(?), ref: 007417F8

Memory Dump Source

Source File: 0000000A.00000002.2894756195.0000000000741000.00000020.00000001.01000000.00000006.sdmp, Offset: 00740000, based on PE: true

Associated: 0000000A.00000002.2894716076.0000000000740000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.2894810207.00000000007D0000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.2894810207.00000000007F6000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.2894865972.0000000000800000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.2894887053.0000000000809000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_740000_Launches.jbxd

Similarity

API ID: Path$ObjectStroke$DeleteFillSelect
String ID:
API String ID: 2625713937-0
Opcode ID: fdb03c9dc5e2b738cdd39b14e1a07891e537ae9b81212216e891cfe2717c4e0c
Instruction ID: d1fe9f43702f9ceea23db6a0d061fd944058acfc515a2cae8221cda435000b33
Opcode Fuzzy Hash: fdb03c9dc5e2b738cdd39b14e1a07891e537ae9b81212216e891cfe2717c4e0c
Instruction Fuzzy Hash: 41F01930409248BBDB526F25EC0C7683BB4B700326F44C225E469441F0C739A995DF68

Function 007AC9DA Relevance: 7.3, APIs: 3, Strings: 1, Instructions: 279comCOMMON

Download Yara Rule

APIs

CoInitialize.OLE32(00000000), ref: 007ACA75
CoCreateInstance.OLE32(007D3D3C,00000000,00000001,007D3BAC,?), ref: 007ACA8D

Part of subcall function 00751A36: _memmove.LIBCMT ref: 00751A77

CoUninitialize.OLE32 ref: 007ACCFA

Strings

.lnk, xrefs: 007ACA09, 007ACA31, 007ACA3B

Memory Dump Source

Source File: 0000000A.00000002.2894756195.0000000000741000.00000020.00000001.01000000.00000006.sdmp, Offset: 00740000, based on PE: true

Associated: 0000000A.00000002.2894716076.0000000000740000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.2894810207.00000000007D0000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.2894810207.00000000007F6000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.2894865972.0000000000800000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.2894887053.0000000000809000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_740000_Launches.jbxd

Similarity

API ID: CreateInitializeInstanceUninitialize_memmove
String ID: .lnk
API String ID: 2683427295-24824748
Opcode ID: ecb0ca072961d15cc51673b7b9d2c9149095b042622b8e713da438ac1a2dbf39
Instruction ID: 32645165b79b1eb0f9efde7970bec782a924aca9f05b2901322da42a2009f0e4
Opcode Fuzzy Hash: ecb0ca072961d15cc51673b7b9d2c9149095b042622b8e713da438ac1a2dbf39
Instruction Fuzzy Hash: 4CA15BB1204205AFD300EF64C885EABB7ECEF94715F40491DF55597292EBB4EE09CBA2

Function 0074E3C6 Relevance: 7.3, APIs: 3, Strings: 1, Instructions: 265COMMON

Download Yara Rule

APIs

Part of subcall function 00760FE6: std::exception::exception.LIBCMT ref: 0076101C
Part of subcall function 00760FE6: __CxxThrowException@8.LIBCMT ref: 00761031

Part of subcall function 00751A36: _memmove.LIBCMT ref: 00751A77

Part of subcall function 00751680: _memmove.LIBCMT ref: 007516DB

__swprintf.LIBCMT ref: 0074E598

Strings

\\[\\nrt]|%%|%[-+ 0#]?([0-9]*|\*)?(\.[0-9]*|\.\*)?[hlL]?[diouxXeEfgGs], xrefs: 0074E431

Memory Dump Source

Source File: 0000000A.00000002.2894756195.0000000000741000.00000020.00000001.01000000.00000006.sdmp, Offset: 00740000, based on PE: true

Associated: 0000000A.00000002.2894716076.0000000000740000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.2894810207.00000000007D0000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.2894810207.00000000007F6000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.2894865972.0000000000800000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.2894887053.0000000000809000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_740000_Launches.jbxd

Similarity

API ID: _memmove$Exception@8Throw__swprintfstd::exception::exception
String ID: \\[\\nrt]|%%|%[-+ 0#]?([0-9]*|\*)?(\.[0-9]*|\.\*)?[hlL]?[diouxXeEfgGs]
API String ID: 1943609520-557222456
Opcode ID: 6fd3b1d31a945f8fae161d23bb5bd15c49fa4edc81190ed4d73711fdb5d0c875
Instruction ID: aa574bded7a634c914c0d1db3a2524dc0660d85a7bc938de66c49dff375e35a0
Opcode Fuzzy Hash: 6fd3b1d31a945f8fae161d23bb5bd15c49fa4edc81190ed4d73711fdb5d0c875
Instruction Fuzzy Hash: 15919D71208201DFC714FF24C899DAEB7A4FF95711F40491DF886972A1EB68EE48CB92

Function 0076523D Relevance: 7.2, APIs: 3, Strings: 1, Instructions: 180COMMON

Download Yara Rule

APIs

__startOneArgErrorHandling.LIBCMT ref: 007652CD

Part of subcall function 00770320: __87except.LIBCMT ref: 0077035B

Strings

pow, xrefs: 007652A5, 007652C2

Memory Dump Source

Source File: 0000000A.00000002.2894756195.0000000000741000.00000020.00000001.01000000.00000006.sdmp, Offset: 00740000, based on PE: true

Associated: 0000000A.00000002.2894716076.0000000000740000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.2894810207.00000000007D0000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.2894810207.00000000007F6000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.2894865972.0000000000800000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.2894887053.0000000000809000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_740000_Launches.jbxd

Similarity

API ID: ErrorHandling__87except__start
String ID: pow
API String ID: 2905807303-2276729525
Opcode ID: 7468501b000daa791ffa8016e4c80568e181addea6778c4aa2036916581138ae
Instruction ID: 4476fd0eb0060701cdd7d2fdb5268f102331666ea7cd13011d3b75e6143383ee
Opcode Fuzzy Hash: 7468501b000daa791ffa8016e4c80568e181addea6778c4aa2036916581138ae
Instruction Fuzzy Hash: 3B518DA1A09641DBCF117714C91137A3B90AB01B94F34CD59E8CB862E5EE7C8CD4BAD6

Function 00760654 Relevance: 7.2, APIs: 2, Strings: 2, Instructions: 163COMMON

Download Yara Rule

Strings

+, xrefs: 00760690
#, xrefs: 00760699

Memory Dump Source

Source File: 0000000A.00000002.2894756195.0000000000741000.00000020.00000001.01000000.00000006.sdmp, Offset: 00740000, based on PE: true

Associated: 0000000A.00000002.2894716076.0000000000740000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.2894810207.00000000007D0000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.2894810207.00000000007F6000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.2894865972.0000000000800000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.2894887053.0000000000809000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_740000_Launches.jbxd

Similarity

API ID:
String ID: #$+
API String ID: 0-2552117581
Opcode ID: d40e9294e7684dbe3101c594ed40331f00cfe3f39ae28894e9157858fb90f064
Instruction ID: 1d2d46836f6bcb77008207cf33e25797a7a769ac0b3918979b953e796803689f
Opcode Fuzzy Hash: d40e9294e7684dbe3101c594ed40331f00cfe3f39ae28894e9157858fb90f064
Instruction Fuzzy Hash: 4C513375400246CFDF15EF68D844AFA7BA4EF59310F144155EC92AB290D73CAC46CBA0

Function 0074E7F7 Relevance: 7.2, APIs: 3, Strings: 1, Instructions: 161COMMON

Download Yara Rule

APIs

_memmove.LIBCMT ref: 0074E937
_memmove.LIBCMT ref: 0074E9D0
_free.LIBCMT ref: 0074E9F6
_memmove.LIBCMT ref: 0074EAA9

Strings

#Vu, xrefs: 0074E9E2

Memory Dump Source

Source File: 0000000A.00000002.2894756195.0000000000741000.00000020.00000001.01000000.00000006.sdmp, Offset: 00740000, based on PE: true

Associated: 0000000A.00000002.2894716076.0000000000740000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.2894810207.00000000007D0000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.2894810207.00000000007F6000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.2894865972.0000000000800000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.2894887053.0000000000809000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_740000_Launches.jbxd

Similarity

API ID: _memmove$_free
String ID: #Vu
API String ID: 2620147621-163864266
Opcode ID: 11a5ccb48d542ab8b3a802e20fab38151776f45190e42353a1b85b9cbf74efa8
Instruction ID: 3d9a0cb8637c06ec4642d6b4debc67ceef02e6b7541db7c46756c6ad66726f59
Opcode Fuzzy Hash: 11a5ccb48d542ab8b3a802e20fab38151776f45190e42353a1b85b9cbf74efa8
Instruction Fuzzy Hash: D7514AB16087419FDB24CF28C494B6FBBE5FF85324F54892DE98A87251E739E801CB52

Function 0075CF0C Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 143COMMON

Download Yara Rule

APIs

_memset.LIBCMT ref: 0075CFC2
_memmove.LIBCMT ref: 0075D060
_memset.LIBCMT ref: 0075D084

Strings

ERCP, xrefs: 0075CF2D

Memory Dump Source

Source File: 0000000A.00000002.2894756195.0000000000741000.00000020.00000001.01000000.00000006.sdmp, Offset: 00740000, based on PE: true

Associated: 0000000A.00000002.2894716076.0000000000740000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.2894810207.00000000007D0000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.2894810207.00000000007F6000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.2894865972.0000000000800000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.2894887053.0000000000809000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_740000_Launches.jbxd

Similarity

API ID: _memset$_memmove
String ID: ERCP
API String ID: 2532777613-1384759551
Opcode ID: d452bf6cb799d2c8fb4f3600c17fe5b6eab3af12a0d1a27e583da7593937a139
Instruction ID: 6d3abeeb0cc4be75ae135be05f221b9e190ac5c61b97566916c319d42b9049f5
Opcode Fuzzy Hash: d452bf6cb799d2c8fb4f3600c17fe5b6eab3af12a0d1a27e583da7593937a139
Instruction Fuzzy Hash: 2651A371900309DFDB35CF64C8857EABBE4EF04311F14856EE94ADB280E778A999CB40

Function 0079A3AD Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 122windowCOMMON

Download Yara Rule

APIs

Part of subcall function 007A1CBB: WriteProcessMemory.KERNEL32(?,?,?,00000000,00000000,00000000,?,00799E4E,?,?,00000034,00000800,?,00000034), ref: 007A1CE5

SendMessageW.USER32(?,00001104,00000000,00000000), ref: 0079A3F7

Part of subcall function 007A1C86: ReadProcessMemory.KERNEL32(?,?,?,00000000,00000000,00000000,?,00799E7D,?,?,00000800,?,00001073,00000000,?,?), ref: 007A1CB0

Part of subcall function 007A1BDD: GetWindowThreadProcessId.USER32(?,?), ref: 007A1C08
Part of subcall function 007A1BDD: OpenProcess.KERNEL32(00000438,00000000,?,?,?,00799E12,00000034,?,?,00001004,00000000,00000000), ref: 007A1C18
Part of subcall function 007A1BDD: VirtualAllocEx.KERNEL32(00000000,00000000,?,00001000,00000004,?,?,00799E12,00000034,?,?,00001004,00000000,00000000), ref: 007A1C2E

SendMessageW.USER32(?,00001111,00000000,00000000), ref: 0079A464
SendMessageW.USER32(?,00001111,00000000,00000000), ref: 0079A4B1

Strings

@, xrefs: 0079A4C9

Memory Dump Source

Source File: 0000000A.00000002.2894756195.0000000000741000.00000020.00000001.01000000.00000006.sdmp, Offset: 00740000, based on PE: true

Associated: 0000000A.00000002.2894716076.0000000000740000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.2894810207.00000000007D0000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.2894810207.00000000007F6000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.2894865972.0000000000800000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.2894887053.0000000000809000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_740000_Launches.jbxd

Similarity

API ID: Process$MessageSend$Memory$AllocOpenReadThreadVirtualWindowWrite
String ID: @
API String ID: 4150878124-2766056989
Opcode ID: 8ffbb8a5ce2695d60fbc4e74a9c67ed5488925d6d9ad58bcc6975663b21c60ea
Instruction ID: 87ae5fa80727438c8a8231ac2780aa8ee77f3d02987385422196e08e4c955d3e
Opcode Fuzzy Hash: 8ffbb8a5ce2695d60fbc4e74a9c67ed5488925d6d9ad58bcc6975663b21c60ea
Instruction Fuzzy Hash: 2C416A7290121CBFDF10DBA8CD89ADEBBB8EF49300F004195FA45B7190DA746E85CBA1

Function 007C79FE Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 90windowCOMMON

Download Yara Rule

APIs

SendMessageW.USER32(00000000,00001009,00000000,?), ref: 007C7A86
SetWindowPos.USER32(?,00000000,?,?,?,?,00000004), ref: 007C7A9A
SendMessageW.USER32(?,00001002,00000000,?), ref: 007C7ABE

Strings

SysMonthCal32, xrefs: 007C7A51

Memory Dump Source

Source File: 0000000A.00000002.2894756195.0000000000741000.00000020.00000001.01000000.00000006.sdmp, Offset: 00740000, based on PE: true

Associated: 0000000A.00000002.2894716076.0000000000740000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.2894810207.00000000007D0000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.2894810207.00000000007F6000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.2894865972.0000000000800000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.2894887053.0000000000809000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_740000_Launches.jbxd

Similarity

API ID: MessageSend$Window
String ID: SysMonthCal32
API String ID: 2326795674-1439706946
Opcode ID: 0f21e205722654d9266b5e5ba9139aecf29655d2aabfbbddf08ee6d43eadacaa
Instruction ID: d3dc9e3dd71a2485b7344fcf2f3074a365b7899f60a18ed00b0d0a33b2b03cd7
Opcode Fuzzy Hash: 0f21e205722654d9266b5e5ba9139aecf29655d2aabfbbddf08ee6d43eadacaa
Instruction Fuzzy Hash: E3219F32600218BBDF258F54CC86FEE3B69EB48724F114218FE156B190DAB9A851CBA0

Function 007C81B8 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 88windowCOMMON

Download Yara Rule

APIs

SendMessageW.USER32(00000000,00000469,?,00000000), ref: 007C826F
SendMessageW.USER32(00000000,00000465,00000000,80017FFF), ref: 007C827D
DestroyWindow.USER32(00000000,00000000,?,?,?,00000000,msctls_updown32,00000000,00000000,00000000,00000000,00000000,00000000,?,?,00000000), ref: 007C8284

Strings

msctls_updown32, xrefs: 007C81E9

Memory Dump Source

Source File: 0000000A.00000002.2894756195.0000000000741000.00000020.00000001.01000000.00000006.sdmp, Offset: 00740000, based on PE: true

Associated: 0000000A.00000002.2894716076.0000000000740000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.2894810207.00000000007D0000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.2894810207.00000000007F6000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.2894865972.0000000000800000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.2894887053.0000000000809000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_740000_Launches.jbxd

Similarity

API ID: MessageSend$DestroyWindow
String ID: msctls_updown32
API String ID: 4014797782-2298589950
Opcode ID: db65f00d0d03df5e2b06ec48ea3a536eb03d1b5ece31381a5ad0185d5cd9dc78
Instruction ID: cad18b271b2263e4a47088bd98cced51a5272619f529db311654d00f05bcf2bb
Opcode Fuzzy Hash: db65f00d0d03df5e2b06ec48ea3a536eb03d1b5ece31381a5ad0185d5cd9dc78
Instruction Fuzzy Hash: FD218EB1A04208AFDB50DF54CC89EA737EDFB4A394B08405DFA019B291CB74EC11CBA1

Function 007C72D5 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 84windowCOMMON

Download Yara Rule

APIs

SendMessageW.USER32(00000000,00000180,00000000,?), ref: 007C7360
SendMessageW.USER32(?,00000186,00000000,00000000), ref: 007C7370
MoveWindow.USER32(?,?,?,?,?,00000000,?,?,Listbox,00000000,00000000,?,?,?,?,?), ref: 007C7395

Strings

Listbox, xrefs: 007C732D

Memory Dump Source

Source File: 0000000A.00000002.2894756195.0000000000741000.00000020.00000001.01000000.00000006.sdmp, Offset: 00740000, based on PE: true

Associated: 0000000A.00000002.2894716076.0000000000740000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.2894810207.00000000007D0000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.2894810207.00000000007F6000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.2894865972.0000000000800000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.2894887053.0000000000809000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_740000_Launches.jbxd

Similarity

API ID: MessageSend$MoveWindow
String ID: Listbox
API String ID: 3315199576-2633736733
Opcode ID: cd3d7b06eac62b1f0a5fd624f8df14ca2d310efb4b38afb400fc415bb83d8d9f
Instruction ID: 811382ee1f1349d4364fbe651acd4079bd7d94c007bc15bc1f382dd6b5652319
Opcode Fuzzy Hash: cd3d7b06eac62b1f0a5fd624f8df14ca2d310efb4b38afb400fc415bb83d8d9f
Instruction Fuzzy Hash: C621A132604158ABDF168F54CC45FBF37AAEB89750F01812CF9009B190CA75AC51DBA0

Function 007C7D33 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 66windowCOMMON

Download Yara Rule

APIs

SendMessageW.USER32(00000000,00000405,00000000,00000000), ref: 007C7D97
SendMessageW.USER32(?,00000406,00000000,00640000), ref: 007C7DAC
SendMessageW.USER32(?,00000414,0000000A,00000000), ref: 007C7DB9

Strings

msctls_trackbar32, xrefs: 007C7D6E

Memory Dump Source

Source File: 0000000A.00000002.2894756195.0000000000741000.00000020.00000001.01000000.00000006.sdmp, Offset: 00740000, based on PE: true

Associated: 0000000A.00000002.2894716076.0000000000740000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.2894810207.00000000007D0000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.2894810207.00000000007F6000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.2894865972.0000000000800000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.2894887053.0000000000809000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_740000_Launches.jbxd

Similarity

API ID: MessageSend
String ID: msctls_trackbar32
API String ID: 3850602802-1010561917
Opcode ID: a8d24db13a7b9ab0891d404f526ae7d7ca1f0d1bccdf024eea430a3b8e99d100
Instruction ID: a55e0a8f1884d270248fa1dc7c43bcc4afb09842c2567fb911355244d987be39
Opcode Fuzzy Hash: a8d24db13a7b9ab0891d404f526ae7d7ca1f0d1bccdf024eea430a3b8e99d100
Instruction Fuzzy Hash: E211E372244209BADF249F64CC06FEB7BADEF88B54F11451CFB41A6090D675E811CB60

Function 0077B4F1 Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 22COMMON

Download Yara Rule

APIs

Part of subcall function 0077B544: _memset.LIBCMT ref: 0077B551

Part of subcall function 00760B74: InitializeCriticalSectionAndSpinCount.KERNEL32(?,00000000,?,0077B520,?,?,?,0074100A), ref: 00760B79

IsDebuggerPresent.KERNEL32(?,?,?,0074100A), ref: 0077B524
OutputDebugStringW.KERNEL32(ERROR : Unable to initialize critical section in CAtlBaseModule,?,?,?,0074100A), ref: 0077B533

Strings

ERROR : Unable to initialize critical section in CAtlBaseModule, xrefs: 0077B52E
=~, xrefs: 0077B514

Memory Dump Source

Source File: 0000000A.00000002.2894756195.0000000000741000.00000020.00000001.01000000.00000006.sdmp, Offset: 00740000, based on PE: true

Associated: 0000000A.00000002.2894716076.0000000000740000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.2894810207.00000000007D0000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.2894810207.00000000007F6000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.2894865972.0000000000800000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.2894887053.0000000000809000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_740000_Launches.jbxd

Similarity

API ID: CountCriticalDebugDebuggerInitializeOutputPresentSectionSpinString_memset
String ID: ERROR : Unable to initialize critical section in CAtlBaseModule$=~
API String ID: 3158253471-1125109550
Opcode ID: c223d67c237b31211d3758f6e9d66f231eb171a825c5f7c8d4b9fcaf4568cfbd
Instruction ID: 99d9fbd8e8d4761790ab894f052ccce5275ea3dcbfc4fa2a1d45aceb240dccdc
Opcode Fuzzy Hash: c223d67c237b31211d3758f6e9d66f231eb171a825c5f7c8d4b9fcaf4568cfbd
Instruction Fuzzy Hash: 4FE06DB02013518BD7209F3AE8087027BE0BF04344F10C92EE48AC3350DBBCE504CB91

Function 007BC6D9 Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 19libraryloaderCOMMON

Download Yara Rule

APIs

LoadLibraryA.KERNEL32(kernel32.dll,?,0078027A,?), ref: 007BC6E7
GetProcAddress.KERNEL32(00000000,GetSystemWow64DirectoryW), ref: 007BC6F9

Strings

kernel32.dll, xrefs: 007BC6E2
GetSystemWow64DirectoryW, xrefs: 007BC6F3

Memory Dump Source

Source File: 0000000A.00000002.2894756195.0000000000741000.00000020.00000001.01000000.00000006.sdmp, Offset: 00740000, based on PE: true

Associated: 0000000A.00000002.2894716076.0000000000740000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.2894810207.00000000007D0000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.2894810207.00000000007F6000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.2894865972.0000000000800000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.2894887053.0000000000809000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_740000_Launches.jbxd

Similarity

API ID: AddressLibraryLoadProc
String ID: GetSystemWow64DirectoryW$kernel32.dll
API String ID: 2574300362-1816364905
Opcode ID: fd48f4edcd1e2bdf86cafd83ad1bb27f3eb2c740a99302674072e8cfb5846641
Instruction ID: 37a295624954c470b6650e381e3011a7345ff33dedc57973f767c7dece3767fd
Opcode Fuzzy Hash: fd48f4edcd1e2bdf86cafd83ad1bb27f3eb2c740a99302674072e8cfb5846641
Instruction Fuzzy Hash: E9E08C781003038BEB224B25DC48B9A76E8AB04345F80D42AE885C2310DB7CD8408B90

Function 00754B77 Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 18libraryloaderCOMMON

Download Yara Rule

APIs

LoadLibraryA.KERNEL32(kernel32.dll,?,00754B44,?,007549D4,?,?,007527AF,?,00000001), ref: 00754B85
GetProcAddress.KERNEL32(00000000,Wow64DisableWow64FsRedirection), ref: 00754B97

Strings

Wow64DisableWow64FsRedirection, xrefs: 00754B91
kernel32.dll, xrefs: 00754B80

Memory Dump Source

Source File: 0000000A.00000002.2894756195.0000000000741000.00000020.00000001.01000000.00000006.sdmp, Offset: 00740000, based on PE: true

Associated: 0000000A.00000002.2894716076.0000000000740000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.2894810207.00000000007D0000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.2894810207.00000000007F6000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.2894865972.0000000000800000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.2894887053.0000000000809000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_740000_Launches.jbxd

Similarity

API ID: AddressLibraryLoadProc
String ID: Wow64DisableWow64FsRedirection$kernel32.dll
API String ID: 2574300362-3689287502
Opcode ID: 4380131637f80fbb7b6fad9a0d940a5da3ab280b612846bf778b0f067de3b277
Instruction ID: ed54ce040dfa30984541446387085b3bd61a03c8437c3a3c4c66511884ebadf2
Opcode Fuzzy Hash: 4380131637f80fbb7b6fad9a0d940a5da3ab280b612846bf778b0f067de3b277
Instruction Fuzzy Hash: 2ED012B15107168FD7215F31EC5874A77E4AF04355F11D82AD895D2650DBB8E4C1C654

Function 00754BAA Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 18libraryloaderCOMMON

Download Yara Rule

APIs

LoadLibraryA.KERNEL32(kernel32.dll,?,00754AF7,?), ref: 00754BB8
GetProcAddress.KERNEL32(00000000,Wow64RevertWow64FsRedirection), ref: 00754BCA

Strings

kernel32.dll, xrefs: 00754BB3
Wow64RevertWow64FsRedirection, xrefs: 00754BC4

Memory Dump Source

Source File: 0000000A.00000002.2894756195.0000000000741000.00000020.00000001.01000000.00000006.sdmp, Offset: 00740000, based on PE: true

Associated: 0000000A.00000002.2894716076.0000000000740000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.2894810207.00000000007D0000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.2894810207.00000000007F6000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.2894865972.0000000000800000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.2894887053.0000000000809000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_740000_Launches.jbxd

Similarity

API ID: AddressLibraryLoadProc
String ID: Wow64RevertWow64FsRedirection$kernel32.dll
API String ID: 2574300362-1355242751
Opcode ID: a1a2556e9a7dce360ec84fb4bab5638b40aa777033ffa8bc64ee80ac484af714
Instruction ID: 6926ee2d900a786e8745ee90cd333ed1900721de097978c4dba7395380c1d554
Opcode Fuzzy Hash: a1a2556e9a7dce360ec84fb4bab5638b40aa777033ffa8bc64ee80ac484af714
Instruction Fuzzy Hash: D3D017B05107178FDB209F31EC08B8A76E9AF04356F11ED6AD896D2654EBB8D8D0CA90

Function 007C1447 Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 18libraryloaderCOMMON

Download Yara Rule

APIs

LoadLibraryA.KERNEL32(advapi32.dll,?,007C1696), ref: 007C1455
GetProcAddress.KERNEL32(00000000,RegDeleteKeyExW), ref: 007C1467

Strings

RegDeleteKeyExW, xrefs: 007C1461
advapi32.dll, xrefs: 007C1450

Memory Dump Source

Source File: 0000000A.00000002.2894756195.0000000000741000.00000020.00000001.01000000.00000006.sdmp, Offset: 00740000, based on PE: true

Associated: 0000000A.00000002.2894716076.0000000000740000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.2894810207.00000000007D0000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.2894810207.00000000007F6000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.2894865972.0000000000800000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.2894887053.0000000000809000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_740000_Launches.jbxd

Similarity

API ID: AddressLibraryLoadProc
String ID: RegDeleteKeyExW$advapi32.dll
API String ID: 2574300362-4033151799
Opcode ID: 40a143ebea3ba100867bcd772bdc2abfbaf013a3c600c8bd8bdfcefddf0b3214
Instruction ID: bace16b6fee139655c52dea08ac205a7912138d0ee394d318d3ae0c601543dee
Opcode Fuzzy Hash: 40a143ebea3ba100867bcd772bdc2abfbaf013a3c600c8bd8bdfcefddf0b3214
Instruction Fuzzy Hash: 22D0C7B040131B8FE3208F30C908B0A73E8AF02382F00C83E94E2D2260EB78D8C0CB80

Function 007555F0 Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 18libraryloaderCOMMON

Download Yara Rule

APIs

LoadLibraryA.KERNEL32(kernel32.dll,?,00755E3D), ref: 007555FE
GetProcAddress.KERNEL32(00000000,GetNativeSystemInfo), ref: 00755610

Strings

kernel32.dll, xrefs: 007555F9
GetNativeSystemInfo, xrefs: 0075560A

Memory Dump Source

Source File: 0000000A.00000002.2894756195.0000000000741000.00000020.00000001.01000000.00000006.sdmp, Offset: 00740000, based on PE: true

Associated: 0000000A.00000002.2894716076.0000000000740000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.2894810207.00000000007D0000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.2894810207.00000000007F6000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.2894865972.0000000000800000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.2894887053.0000000000809000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_740000_Launches.jbxd

Similarity

API ID: AddressLibraryLoadProc
String ID: GetNativeSystemInfo$kernel32.dll
API String ID: 2574300362-192647395
Opcode ID: d23cfffb2fdd654bf718e34561322fe17b91c85690abd117773518c93e91e4f4
Instruction ID: 79d759857a3196939b423a3eee23322ec45667b958a45f7c9909396c729a13d8
Opcode Fuzzy Hash: d23cfffb2fdd654bf718e34561322fe17b91c85690abd117773518c93e91e4f4
Instruction Fuzzy Hash: 47D012745117128FD7205F31D81875A76F4EF04756F11E82BD895D2251D7B8D480CAD4

Function 007B97CA Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 18libraryloaderCOMMON

Download Yara Rule

APIs

LoadLibraryA.KERNEL32(kernel32.dll,00000001,007B93DE,?,007D0980), ref: 007B97D8
GetProcAddress.KERNEL32(00000000,GetModuleHandleExW), ref: 007B97EA

Strings

kernel32.dll, xrefs: 007B97D3
GetModuleHandleExW, xrefs: 007B97E4

Memory Dump Source

Source File: 0000000A.00000002.2894756195.0000000000741000.00000020.00000001.01000000.00000006.sdmp, Offset: 00740000, based on PE: true

Associated: 0000000A.00000002.2894716076.0000000000740000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.2894810207.00000000007D0000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.2894810207.00000000007F6000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.2894865972.0000000000800000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.2894887053.0000000000809000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_740000_Launches.jbxd

Similarity

API ID: AddressLibraryLoadProc
String ID: GetModuleHandleExW$kernel32.dll
API String ID: 2574300362-199464113
Opcode ID: 2e5c393d414284d5630894b9a174852c4796fb505db2cab1192fca5794366fbc
Instruction ID: 865313fe9dabe54188b9de145956c7b6ea81cfb84290b719261cc971f8895a42
Opcode Fuzzy Hash: 2e5c393d414284d5630894b9a174852c4796fb505db2cab1192fca5794366fbc
Instruction Fuzzy Hash: 2BD012705107178FD7205F31ED8879A76E4AF04391F11D82AD595D2250EF78D480C651

Function 007BE713 Relevance: 6.3, APIs: 4, Instructions: 307memoryCOMMON

Download Yara Rule

APIs

CharLowerBuffW.USER32(?,?), ref: 007BE7A7
CharLowerBuffW.USER32(?,?), ref: 007BE7EA

Part of subcall function 007BDE8E: CharLowerBuffW.USER32(?,?,?,?,00000000,?,?), ref: 007BDEAE

VirtualAlloc.KERNEL32(00000000,00000077,00003000,00000040), ref: 007BE9EA
_memmove.LIBCMT ref: 007BE9FD

Memory Dump Source

Source File: 0000000A.00000002.2894756195.0000000000741000.00000020.00000001.01000000.00000006.sdmp, Offset: 00740000, based on PE: true

Associated: 0000000A.00000002.2894716076.0000000000740000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.2894810207.00000000007D0000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.2894810207.00000000007F6000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.2894865972.0000000000800000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.2894887053.0000000000809000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_740000_Launches.jbxd

Similarity

API ID: BuffCharLower$AllocVirtual_memmove
String ID:
API String ID: 3659485706-0
Opcode ID: e7dccee09ab3a83fbaaf9c8113beec7ee7044bcecca3fd03bd000c3638439252
Instruction ID: 90a7ca9c7911d07878aa3466de0ce49e9472e81c964b1f8f10594405de382758
Opcode Fuzzy Hash: e7dccee09ab3a83fbaaf9c8113beec7ee7044bcecca3fd03bd000c3638439252
Instruction Fuzzy Hash: 96C15871A08301DFC714DF28C484AAABBE4FF89714F14896EF8999B351D739E945CB82

Function 007B877D Relevance: 6.3, APIs: 4, Instructions: 267COMMON

Download Yara Rule

APIs

CoInitialize.OLE32(00000000), ref: 007B87AD
CoUninitialize.OLE32 ref: 007B87B8

Part of subcall function 007CDF09: CoCreateInstance.OLE32(00000018,00000000,00000005,00000028,?,?,?,?,?,00000000,00000000,00000000,?,007B8A0E,?,00000000), ref: 007CDF71

VariantInit.OLEAUT32(?), ref: 007B87C3
VariantClear.OLEAUT32(?), ref: 007B8A94

Memory Dump Source

Source File: 0000000A.00000002.2894756195.0000000000741000.00000020.00000001.01000000.00000006.sdmp, Offset: 00740000, based on PE: true

Associated: 0000000A.00000002.2894716076.0000000000740000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.2894810207.00000000007D0000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.2894810207.00000000007F6000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.2894865972.0000000000800000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.2894887053.0000000000809000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_740000_Launches.jbxd

Similarity

API ID: Variant$ClearCreateInitInitializeInstanceUninitialize
String ID:
API String ID: 780911581-0
Opcode ID: 31d6bb58b3160de1a72f73c26d021858ca5eaf43c90549844031525ac8ac95f2
Instruction ID: 57526055f914f18ce989d4f9b43f7d5c297957451010712d399565c95357e48a
Opcode Fuzzy Hash: 31d6bb58b3160de1a72f73c26d021858ca5eaf43c90549844031525ac8ac95f2
Instruction Fuzzy Hash: 0AA15975604701DFDB50DF64C485B6AB7E8BF88310F148949FA959B3A1CB38ED00DB92

Function 0079814E Relevance: 6.2, APIs: 4, Instructions: 231COMMON

Download Yara Rule

APIs

ProgIDFromCLSID.OLE32(?,00000000,?,00000000,00000800,00000000,?,007D3C4C,?), ref: 00798308
CoTaskMemFree.OLE32(00000000,00000000,?,00000000,00000800,00000000,?,007D3C4C,?), ref: 00798320
CLSIDFromProgID.OLE32(?,?,00000000,007D0988,000000FF,?,00000000,00000800,00000000,?,007D3C4C,?), ref: 00798345
_memcmp.LIBCMT ref: 00798366

Memory Dump Source

Source File: 0000000A.00000002.2894756195.0000000000741000.00000020.00000001.01000000.00000006.sdmp, Offset: 00740000, based on PE: true

Associated: 0000000A.00000002.2894716076.0000000000740000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.2894810207.00000000007D0000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.2894810207.00000000007F6000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.2894865972.0000000000800000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.2894887053.0000000000809000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_740000_Launches.jbxd

Similarity

API ID: FromProg$FreeTask_memcmp
String ID:
API String ID: 314563124-0
Opcode ID: e70ff2966df95c47be990287ad627e7cd22a9505c27e7e5ceb5778f0d0e33884
Instruction ID: 793bb823aa1f4941b7aa63d4ddb97e1be06620d30497c0cab3a4d07e2b545ce9
Opcode Fuzzy Hash: e70ff2966df95c47be990287ad627e7cd22a9505c27e7e5ceb5778f0d0e33884
Instruction Fuzzy Hash: DC812A71A00109EFCF04DF94C888EEEB7B9FF89315F204599E506AB250DB75AE05CB61

Function 0079749B Relevance: 6.2, APIs: 4, Instructions: 202memoryCOMMON

Download Yara Rule

APIs

VariantInit.OLEAUT32(?), ref: 007974AC
SysAllocString.OLEAUT32(00000000), ref: 00797555
VariantCopy.OLEAUT32 ref: 00797584
VariantClear.OLEAUT32(?), ref: 007975AB

Memory Dump Source

Source File: 0000000A.00000002.2894756195.0000000000741000.00000020.00000001.01000000.00000006.sdmp, Offset: 00740000, based on PE: true

Associated: 0000000A.00000002.2894716076.0000000000740000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.2894810207.00000000007D0000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.2894810207.00000000007F6000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.2894865972.0000000000800000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.2894887053.0000000000809000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_740000_Launches.jbxd

Similarity

API ID: Variant$AllocClearCopyInitString
String ID:
API String ID: 2808897238-0
Opcode ID: 45dbc963302b6dab3fc4c834011051666fec85f0d515d2717b32d6e44da7611a
Instruction ID: f81f1e444804a6e1f2b18734a43d71cb957caf0c0c417518098a6e9517561cb4
Opcode Fuzzy Hash: 45dbc963302b6dab3fc4c834011051666fec85f0d515d2717b32d6e44da7611a
Instruction Fuzzy Hash: 9651BA30628701DBDF289F79E899B2DB3E5EF45310F24981FE556CB2A2EB389840C715

Function 007BF4F6 Relevance: 6.2, APIs: 4, Instructions: 164processCOMMON

Download Yara Rule

APIs

CreateToolhelp32Snapshot.KERNEL32 ref: 007BF526
Process32FirstW.KERNEL32(00000000,?), ref: 007BF534

Part of subcall function 00751A36: _memmove.LIBCMT ref: 00751A77

Process32NextW.KERNEL32(00000000,?), ref: 007BF5F4
CloseHandle.KERNEL32(00000000,?,?,?), ref: 007BF603

Memory Dump Source

Source File: 0000000A.00000002.2894756195.0000000000741000.00000020.00000001.01000000.00000006.sdmp, Offset: 00740000, based on PE: true

Associated: 0000000A.00000002.2894716076.0000000000740000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.2894810207.00000000007D0000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.2894810207.00000000007F6000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.2894865972.0000000000800000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.2894887053.0000000000809000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_740000_Launches.jbxd

Similarity

API ID: Process32$CloseCreateFirstHandleNextSnapshotToolhelp32_memmove
String ID:
API String ID: 2576544623-0
Opcode ID: 4b90c8ded6eac5657ef3c929eba24ca43006a6d3ecf16a74a371f3506fbc4798
Instruction ID: 45f6fdc95acfdbe6c88d674e88fd13db41bf6d4b6fa7035453469f5289d853a9
Opcode Fuzzy Hash: 4b90c8ded6eac5657ef3c929eba24ca43006a6d3ecf16a74a371f3506fbc4798
Instruction Fuzzy Hash: 95516E715043159FD320EF24DC49FABB7E8EF94700F40492DF99597251EB74A908CB92

Function 0076492A Relevance: 6.1, APIs: 4, Instructions: 136COMMON

Download Yara Rule

APIs

_memmove.LIBCMT ref: 007649C0
__flush.LIBCMT ref: 007649E0
__write.LIBCMT ref: 00764A13
__flsbuf.LIBCMT ref: 00764A41

Part of subcall function 00768D58: __getptd_noexit.LIBCMT ref: 00768D58

Memory Dump Source

Source File: 0000000A.00000002.2894756195.0000000000741000.00000020.00000001.01000000.00000006.sdmp, Offset: 00740000, based on PE: true

Associated: 0000000A.00000002.2894716076.0000000000740000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.2894810207.00000000007D0000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.2894810207.00000000007F6000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.2894865972.0000000000800000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.2894887053.0000000000809000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_740000_Launches.jbxd

Similarity

API ID: __flsbuf__flush__getptd_noexit__write_memmove
String ID:
API String ID: 2782032738-0
Opcode ID: a7c34a093fdd5ab58b6ffc98053f9d5ae49c5acda348f4cccab4e545be81f79d
Instruction ID: 2b4eaa290815f84e5770ae96a4d21166c1c27179362ec6b5e2f98a2effb369cf
Opcode Fuzzy Hash: a7c34a093fdd5ab58b6ffc98053f9d5ae49c5acda348f4cccab4e545be81f79d
Instruction Fuzzy Hash: 7441D575740706ABDF28DEA9C8949AF7BA5AF40360B24C23DEC57C7640EB78AD408B44

Function 0079A638 Relevance: 6.1, APIs: 4, Instructions: 129windowCOMMON

Download Yara Rule

APIs

SendMessageW.USER32(?,0000110A,00000004,00000000), ref: 0079A68A
__itow.LIBCMT ref: 0079A6BB

Part of subcall function 0079A90B: SendMessageW.USER32(?,0000113E,00000000,00000000), ref: 0079A976

SendMessageW.USER32(?,0000110A,00000001,?), ref: 0079A724
__itow.LIBCMT ref: 0079A77B

Memory Dump Source

Source File: 0000000A.00000002.2894756195.0000000000741000.00000020.00000001.01000000.00000006.sdmp, Offset: 00740000, based on PE: true

Associated: 0000000A.00000002.2894716076.0000000000740000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.2894810207.00000000007D0000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.2894810207.00000000007F6000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.2894865972.0000000000800000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.2894887053.0000000000809000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_740000_Launches.jbxd

Similarity

API ID: MessageSend$__itow
String ID:
API String ID: 3379773720-0
Opcode ID: 56f8332b44d7c7743b93f51940d668377c6732cc7eec700bdf8b42061740e157
Instruction ID: 70a05d18726495c0b9fffe72cb21bb55d1d0cafce5d7bdc2a18f9b5d7bdeb300
Opcode Fuzzy Hash: 56f8332b44d7c7743b93f51940d668377c6732cc7eec700bdf8b42061740e157
Instruction Fuzzy Hash: 39418074A01209BBDF11EF54D84ABEE7BB9EF44752F440029F905A3281DB789948CBE2

Function 007B7095 Relevance: 6.1, APIs: 4, Instructions: 127networkCOMMON

Download Yara Rule

APIs

socket.WSOCK32(00000002,00000002,00000011), ref: 007B70BC
WSAGetLastError.WSOCK32(00000000), ref: 007B70CC

Part of subcall function 00744D37: __itow.LIBCMT ref: 00744D62
Part of subcall function 00744D37: __swprintf.LIBCMT ref: 00744DAC

#21.WSOCK32(?,0000FFFF,00000020,00000002,00000004), ref: 007B7130
WSAGetLastError.WSOCK32(00000000), ref: 007B713C

Memory Dump Source

Source File: 0000000A.00000002.2894756195.0000000000741000.00000020.00000001.01000000.00000006.sdmp, Offset: 00740000, based on PE: true

Associated: 0000000A.00000002.2894716076.0000000000740000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.2894810207.00000000007D0000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.2894810207.00000000007F6000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.2894865972.0000000000800000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.2894887053.0000000000809000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_740000_Launches.jbxd

Similarity

API ID: ErrorLast$__itow__swprintfsocket
String ID:
API String ID: 2214342067-0
Opcode ID: 8af7c46a9819d37d85aff0529d330cf7248f1902c395af21c10aa50608516129
Instruction ID: 72d0176c48d973a88c58442ef4597c02bf6e61ad1c271f793b1bada7286f418b
Opcode Fuzzy Hash: 8af7c46a9819d37d85aff0529d330cf7248f1902c395af21c10aa50608516129
Instruction Fuzzy Hash: AA41B475740204AFEB24AF28DC8BF6A77E4EB44B14F048458FA199F3D2DB789C009B91

Function 007B6B05 Relevance: 6.1, APIs: 4, Instructions: 116COMMON

Download Yara Rule

APIs

#16.WSOCK32(?,?,00000000,00000000,00000000,00000000,?,?,00000000,007D0980), ref: 007B6B92
_strlen.LIBCMT ref: 007B6BC4

Memory Dump Source

Source File: 0000000A.00000002.2894756195.0000000000741000.00000020.00000001.01000000.00000006.sdmp, Offset: 00740000, based on PE: true

Associated: 0000000A.00000002.2894716076.0000000000740000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.2894810207.00000000007D0000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.2894810207.00000000007F6000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.2894865972.0000000000800000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.2894887053.0000000000809000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_740000_Launches.jbxd

Similarity

API ID: _strlen
String ID:
API String ID: 4218353326-0
Opcode ID: aaabc33b3d825f49afc57bb81afa627f9ae9b8e23ae6502ed49127bb457f65b7
Instruction ID: 7e004aa881750ee026f7a5544607dfacdcd66353d83e3881629cacc6a8dd1096
Opcode Fuzzy Hash: aaabc33b3d825f49afc57bb81afa627f9ae9b8e23ae6502ed49127bb457f65b7
Instruction Fuzzy Hash: 4E41A471600108EBCB14EB64DC99FEEB7B9EF54310F148155F91A9B292DB3CAD45CBA0

Function 007C8E76 Relevance: 6.1, APIs: 4, Instructions: 109COMMON

Download Yara Rule

APIs

InvalidateRect.USER32(?,00000000,00000001,?,?,?), ref: 007C8F03

Memory Dump Source

Source File: 0000000A.00000002.2894756195.0000000000741000.00000020.00000001.01000000.00000006.sdmp, Offset: 00740000, based on PE: true

Associated: 0000000A.00000002.2894716076.0000000000740000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.2894810207.00000000007D0000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.2894810207.00000000007F6000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.2894865972.0000000000800000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.2894887053.0000000000809000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_740000_Launches.jbxd

Similarity

API ID: InvalidateRect
String ID:
API String ID: 634782764-0
Opcode ID: d6a225fb028c67842adbef1b89e2f60b25bdd070bb453a1b96105ca19f6767e5
Instruction ID: b1b43974785694ecb599ab2272fc8954a22819ffec49b9c99b87ed3b2a968ec3
Opcode Fuzzy Hash: d6a225fb028c67842adbef1b89e2f60b25bdd070bb453a1b96105ca19f6767e5
Instruction Fuzzy Hash: 0B31B034605118EEEFA09A18CC49FAD37A6EB06320F14451EFA11E61E1CF79EA50DB93

Function 007CB1A9 Relevance: 6.1, APIs: 4, Instructions: 106windowCOMMON

Download Yara Rule

APIs

ClientToScreen.USER32(?,?), ref: 007CB1D2
GetWindowRect.USER32(?,?), ref: 007CB248
PtInRect.USER32(?,?,007CC6BC), ref: 007CB258
MessageBeep.USER32(00000000), ref: 007CB2C9

Memory Dump Source

Source File: 0000000A.00000002.2894756195.0000000000741000.00000020.00000001.01000000.00000006.sdmp, Offset: 00740000, based on PE: true

Associated: 0000000A.00000002.2894716076.0000000000740000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.2894810207.00000000007D0000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.2894810207.00000000007F6000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.2894865972.0000000000800000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.2894887053.0000000000809000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_740000_Launches.jbxd

Similarity

API ID: Rect$BeepClientMessageScreenWindow
String ID:
API String ID: 1352109105-0
Opcode ID: 1c98d2de92a7154008a09b83120b13d7583d3a0293d7a92f16f1f8c3bb07b53d
Instruction ID: 80484a0021da088b6653a4766d6c258e7fedd0114aa48a7c853bd79fc25e79a1
Opcode Fuzzy Hash: 1c98d2de92a7154008a09b83120b13d7583d3a0293d7a92f16f1f8c3bb07b53d
Instruction Fuzzy Hash: 52414930A04159DFDB11CFA8C886FAD7BF5FB49311F1881ADF8189B261D734A941CB90

Function 007A12D5 Relevance: 6.1, APIs: 4, Instructions: 105keyboardwindowCOMMON

Download Yara Rule

APIs

GetKeyboardState.USER32(?,00000000,?,00000001), ref: 007A1326
SetKeyboardState.USER32(00000080,?,00000001), ref: 007A1342
PostMessageW.USER32(00000000,00000102,00000001,00000001), ref: 007A13A8
SendInput.USER32(00000001,00000000,0000001C,00000000,?,00000001), ref: 007A13FA

Memory Dump Source

Source File: 0000000A.00000002.2894756195.0000000000741000.00000020.00000001.01000000.00000006.sdmp, Offset: 00740000, based on PE: true

Associated: 0000000A.00000002.2894716076.0000000000740000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.2894810207.00000000007D0000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.2894810207.00000000007F6000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.2894865972.0000000000800000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.2894887053.0000000000809000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_740000_Launches.jbxd

Similarity

API ID: KeyboardState$InputMessagePostSend
String ID:
API String ID: 432972143-0
Opcode ID: 11bd18b28f9cb17b52f7950251f4174d2327506bff46c9a4817e9ab427bbbc1a
Instruction ID: be434639f5f003eab88c4cb7b5f8aaba6a2aef58af9d60ceb5360e6d871fe95b
Opcode Fuzzy Hash: 11bd18b28f9cb17b52f7950251f4174d2327506bff46c9a4817e9ab427bbbc1a
Instruction Fuzzy Hash: 35316830944208AEFF30CE258C09BFEBBB9ABC7320F84831AF491526D0C37C89519B95

Function 007A1410 Relevance: 6.1, APIs: 4, Instructions: 101keyboardwindowCOMMON

Download Yara Rule

APIs

GetKeyboardState.USER32(?,75C0C0D0,?,00008000), ref: 007A1465
SetKeyboardState.USER32(00000080,?,00008000), ref: 007A1481
PostMessageW.USER32(00000000,00000101,00000000), ref: 007A14E0
SendInput.USER32(00000001,?,0000001C,75C0C0D0,?,00008000), ref: 007A1532

Memory Dump Source

Source File: 0000000A.00000002.2894756195.0000000000741000.00000020.00000001.01000000.00000006.sdmp, Offset: 00740000, based on PE: true

Associated: 0000000A.00000002.2894716076.0000000000740000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.2894810207.00000000007D0000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.2894810207.00000000007F6000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.2894865972.0000000000800000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.2894887053.0000000000809000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_740000_Launches.jbxd

Similarity

API ID: KeyboardState$InputMessagePostSend
String ID:
API String ID: 432972143-0
Opcode ID: 737b39e471614ba0c31e6edcef4b1a2d4be44fac765dcb96072b27d1dc59127d
Instruction ID: 67dcc9e8b228e3ee252475ebe07ae7e0f8760571251f3ad079f4a6d935c88d5e
Opcode Fuzzy Hash: 737b39e471614ba0c31e6edcef4b1a2d4be44fac765dcb96072b27d1dc59127d
Instruction Fuzzy Hash: 1C313C30D402589EFF34CA699C04BFABB75ABCB310F88831BE481521D1C37C89559BA5

Function 007763F5 Relevance: 6.1, APIs: 4, Instructions: 97COMMONLIBRARYCODE

Download Yara Rule

APIs

_LocaleUpdate::_LocaleUpdate.LIBCMT ref: 0077642B
__isleadbyte_l.LIBCMT ref: 00776459
MultiByteToWideChar.KERNEL32(00000080,00000009,00000002,00000001,00000000,00000000,?,00000000,00000000,?,?), ref: 00776487
MultiByteToWideChar.KERNEL32(00000080,00000009,00000002,00000001,00000000,00000000,?,00000000,00000000,?,?), ref: 007764BD

Memory Dump Source

Source File: 0000000A.00000002.2894756195.0000000000741000.00000020.00000001.01000000.00000006.sdmp, Offset: 00740000, based on PE: true

Associated: 0000000A.00000002.2894716076.0000000000740000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.2894810207.00000000007D0000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.2894810207.00000000007F6000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.2894865972.0000000000800000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.2894887053.0000000000809000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_740000_Launches.jbxd

Similarity

API ID: ByteCharLocaleMultiWide$UpdateUpdate::___isleadbyte_l
String ID:
API String ID: 3058430110-0
Opcode ID: 13d151db6ffec070ab8775d54194517d83d2b19ce4e1217f03bcb8b78c210c86
Instruction ID: 8c5bcf84a6b2595d7bf27f648dd8409f8101b00a17151f8cee6b36f614cafb67
Opcode Fuzzy Hash: 13d151db6ffec070ab8775d54194517d83d2b19ce4e1217f03bcb8b78c210c86
Instruction Fuzzy Hash: 8131F230600696AFDF258F64CC44BBA7BA5FF40390F158529E82887195EB39EA50DB90

Function 007C552B Relevance: 6.1, APIs: 4, Instructions: 95COMMON

Download Yara Rule

APIs

GetForegroundWindow.USER32 ref: 007C553F

Part of subcall function 007A3B34: GetWindowThreadProcessId.USER32(00000000,00000000), ref: 007A3B4E
Part of subcall function 007A3B34: GetCurrentThreadId.KERNEL32 ref: 007A3B55
Part of subcall function 007A3B34: AttachThreadInput.USER32(00000000,?,007A55C0), ref: 007A3B5C

GetCaretPos.USER32(?), ref: 007C5550
ClientToScreen.USER32(00000000,?), ref: 007C558B
GetForegroundWindow.USER32 ref: 007C5591

Memory Dump Source

Source File: 0000000A.00000002.2894756195.0000000000741000.00000020.00000001.01000000.00000006.sdmp, Offset: 00740000, based on PE: true

Associated: 0000000A.00000002.2894716076.0000000000740000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.2894810207.00000000007D0000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.2894810207.00000000007F6000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.2894865972.0000000000800000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.2894887053.0000000000809000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_740000_Launches.jbxd

Similarity

API ID: ThreadWindow$Foreground$AttachCaretClientCurrentInputProcessScreen
String ID:
API String ID: 2759813231-0
Opcode ID: db1d068e6fc8924908ae13a40ee2f116986a567e4ee1090a971538f099ad77b4
Instruction ID: 19a5c431925fc8390cc27f14f8c7cd5a15bb9082748445617e4f7bd27b0f41fb
Opcode Fuzzy Hash: db1d068e6fc8924908ae13a40ee2f116986a567e4ee1090a971538f099ad77b4
Instruction Fuzzy Hash: DE312F71E00108AFDB10EFA5D885EEFB7F9EF94704F10406AE515E7241EB79AE408BA0

Function 007CCB40 Relevance: 6.1, APIs: 4, Instructions: 83windowCOMMON

Download Yara Rule

APIs

Part of subcall function 007429E2: GetWindowLongW.USER32(?,000000EB), ref: 007429F3

GetCursorPos.USER32(?), ref: 007CCB7A
TrackPopupMenuEx.USER32(?,00000000,?,?,?,00000000,?,0077BCEC,?,?,?,?,?), ref: 007CCB8F
GetCursorPos.USER32(?), ref: 007CCBDC
DefDlgProcW.USER32(?,0000007B,?,?,?,?,?,?,?,?,?,?,0077BCEC,?,?,?), ref: 007CCC16

Memory Dump Source

Source File: 0000000A.00000002.2894756195.0000000000741000.00000020.00000001.01000000.00000006.sdmp, Offset: 00740000, based on PE: true

Associated: 0000000A.00000002.2894716076.0000000000740000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.2894810207.00000000007D0000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.2894810207.00000000007F6000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.2894865972.0000000000800000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.2894887053.0000000000809000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_740000_Launches.jbxd

Similarity

API ID: Cursor$LongMenuPopupProcTrackWindow
String ID:
API String ID: 2864067406-0
Opcode ID: bf60b1e7239c9895020fe25e2a805c93ccba6d6ec40a928ecd36efae46c72ba6
Instruction ID: 97686327fac24adb21afab2ba26b0f1e4a4cfab908c72ab55209e18bfbb74437
Opcode Fuzzy Hash: bf60b1e7239c9895020fe25e2a805c93ccba6d6ec40a928ecd36efae46c72ba6
Instruction Fuzzy Hash: 29319175600058AFCB168F94CC59FBA7BB9FB49310F0480ADF90997261C739AD61EFA0

Function 00760BC0 Relevance: 6.1, APIs: 4, Instructions: 79COMMON

Download Yara Rule

APIs

__setmode.LIBCMT ref: 00760BE2

Part of subcall function 0075402A: WideCharToMultiByte.KERNEL32(00000000,00000000,?,00000001,00000000,00000000,00000000,00000000,00000000,00000000,?,007A7E51,?,?,00000000), ref: 00754041
Part of subcall function 0075402A: WideCharToMultiByte.KERNEL32(00000000,00000000,?,00000001,00000000,?,00000000,00000000,?,?,007A7E51,?,?,00000000,?,?), ref: 00754065

_fprintf.LIBCMT ref: 00760C19
OutputDebugStringW.KERNEL32(?), ref: 0079694C

Part of subcall function 00764CCA: _flsall.LIBCMT ref: 00764CE3

__setmode.LIBCMT ref: 00760C4E

Memory Dump Source

Source File: 0000000A.00000002.2894756195.0000000000741000.00000020.00000001.01000000.00000006.sdmp, Offset: 00740000, based on PE: true

Associated: 0000000A.00000002.2894716076.0000000000740000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.2894810207.00000000007D0000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.2894810207.00000000007F6000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.2894865972.0000000000800000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.2894887053.0000000000809000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_740000_Launches.jbxd

Similarity

API ID: ByteCharMultiWide__setmode$DebugOutputString_flsall_fprintf
String ID:
API String ID: 521402451-0
Opcode ID: 53a8cc3107c59e7dd43ab31ed33dda64be544979e638637b8e3a260ce0904bb0
Instruction ID: df53762beea40adaf03550b602d395d493ef145374a713500e1aa67a3d10a210
Opcode Fuzzy Hash: 53a8cc3107c59e7dd43ab31ed33dda64be544979e638637b8e3a260ce0904bb0
Instruction Fuzzy Hash: BF112771905204FACB08B7B4EC4AAFE7769DF41321F10025AFA06562C2DF6E5C8697B1

Function 00799274 Relevance: 6.1, APIs: 4, Instructions: 79memoryCOMMON

Download Yara Rule

APIs

Part of subcall function 00798D28: GetTokenInformation.ADVAPI32(?,00000003(TokenIntegrityLevel),?,00000000,?), ref: 00798D3F
Part of subcall function 00798D28: GetLastError.KERNEL32(?,TokenIntegrityLevel,?,00000000,?), ref: 00798D49
Part of subcall function 00798D28: GetProcessHeap.KERNEL32(00000008,?,?,TokenIntegrityLevel,?,00000000,?), ref: 00798D58
Part of subcall function 00798D28: HeapAlloc.KERNEL32(00000000,?,TokenIntegrityLevel,?,00000000,?), ref: 00798D5F
Part of subcall function 00798D28: GetTokenInformation.ADVAPI32(?,00000003(TokenIntegrityLevel),00000000,?,?,?,TokenIntegrityLevel,?,00000000,?), ref: 00798D75

LookupPrivilegeValueW.ADVAPI32(00000000,?,?), ref: 007992C1
_memcmp.LIBCMT ref: 007992E4
GetProcessHeap.KERNEL32(00000000,00000000), ref: 0079931A
HeapFree.KERNEL32(00000000), ref: 00799321

Memory Dump Source

Source File: 0000000A.00000002.2894756195.0000000000741000.00000020.00000001.01000000.00000006.sdmp, Offset: 00740000, based on PE: true

Associated: 0000000A.00000002.2894716076.0000000000740000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.2894810207.00000000007D0000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.2894810207.00000000007F6000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.2894865972.0000000000800000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.2894887053.0000000000809000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_740000_Launches.jbxd

Similarity

API ID: Heap$InformationProcessToken$AllocErrorFreeLastLookupPrivilegeValue_memcmp
String ID:
API String ID: 1592001646-0
Opcode ID: 2a6926edbc6f31321e009f1c7e9bca7564ce4a30c37c269ab5ad996685f4a511
Instruction ID: 8342a2ec9d4f1afa5b19a7ac1279bd6b01b7c63bca85218ae07347a1c0f3c47f
Opcode Fuzzy Hash: 2a6926edbc6f31321e009f1c7e9bca7564ce4a30c37c269ab5ad996685f4a511
Instruction Fuzzy Hash: 4D218131E41108EFDF20DF98D949BEEB7B8FF44301F044059E545A7251D779AA04CBA0

Function 007C634E Relevance: 6.1, APIs: 4, Instructions: 69COMMON

Download Yara Rule

APIs

GetWindowLongW.USER32(?,000000EC), ref: 007C63BD
SetWindowLongW.USER32(?,000000EC,00000000), ref: 007C63D7
SetWindowLongW.USER32(?,000000EC,00000000), ref: 007C63E5
SetLayeredWindowAttributes.USER32(?,00000000,?,00000002), ref: 007C63F3

Memory Dump Source

Source File: 0000000A.00000002.2894756195.0000000000741000.00000020.00000001.01000000.00000006.sdmp, Offset: 00740000, based on PE: true

Associated: 0000000A.00000002.2894716076.0000000000740000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.2894810207.00000000007D0000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.2894810207.00000000007F6000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.2894865972.0000000000800000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.2894887053.0000000000809000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_740000_Launches.jbxd

Similarity

API ID: Window$Long$AttributesLayered
String ID:
API String ID: 2169480361-0
Opcode ID: 262f6a3e3bf91360c564b6bc1853b03051c8ec170194f9e3b03d6562e9478346
Instruction ID: 187b0bd1690ca1c60c2d5c7bdd12a04fb4caf4b0540b5a20e2c7943ca3955f02
Opcode Fuzzy Hash: 262f6a3e3bf91360c564b6bc1853b03051c8ec170194f9e3b03d6562e9478346
Instruction Fuzzy Hash: C0119335305514AFDB04AB24DC89FBA77A9EF85320F14821DF916C72E2CB78AD01CB95

Function 0079E45A Relevance: 6.1, APIs: 3, Strings: 1, Instructions: 68stringCOMMON

Download Yara Rule

APIs

Part of subcall function 0079F858: lstrlenW.KERNEL32(?,00000002,?,?,000000EF,?,0079E46F,?,?,?,0079F262,00000000,000000EF,00000119,?,?), ref: 0079F867
Part of subcall function 0079F858: lstrcpyW.KERNEL32(00000000,?,?,0079E46F,?,?,?,0079F262,00000000,000000EF,00000119,?,?,00000000), ref: 0079F88D
Part of subcall function 0079F858: lstrcmpiW.KERNEL32(00000000,?,0079E46F,?,?,?,0079F262,00000000,000000EF,00000119,?,?), ref: 0079F8BE

lstrlenW.KERNEL32(?,00000002,?,?,?,?,0079F262,00000000,000000EF,00000119,?,?,00000000), ref: 0079E488
lstrcpyW.KERNEL32(00000000,?,?,0079F262,00000000,000000EF,00000119,?,?,00000000), ref: 0079E4AE
lstrcmpiW.KERNEL32(00000002,cdecl,?,0079F262,00000000,000000EF,00000119,?,?,00000000), ref: 0079E4E2

Strings

cdecl, xrefs: 0079E4D9

Memory Dump Source

Source File: 0000000A.00000002.2894756195.0000000000741000.00000020.00000001.01000000.00000006.sdmp, Offset: 00740000, based on PE: true

Associated: 0000000A.00000002.2894716076.0000000000740000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.2894810207.00000000007D0000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.2894810207.00000000007F6000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.2894865972.0000000000800000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.2894887053.0000000000809000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_740000_Launches.jbxd

Similarity

API ID: lstrcmpilstrcpylstrlen
String ID: cdecl
API String ID: 4031866154-3896280584
Opcode ID: 5f006ce84257582f6edb8279a1d4d3d79ae1a0b91035fa69e495031e8aaee3b8
Instruction ID: 2cb115a730cc930fbab5e33a9b983e31c301b06fbcd2165e5118fc6f0ed1d7b9
Opcode Fuzzy Hash: 5f006ce84257582f6edb8279a1d4d3d79ae1a0b91035fa69e495031e8aaee3b8
Instruction Fuzzy Hash: 6A11B136100345EFCF259F24EC49D7A77B8FF45350B40802AF80ACB2A0EB399951C791

Function 00775312 Relevance: 6.1, APIs: 4, Instructions: 67COMMONLIBRARYCODE

Download Yara Rule

APIs

_free.LIBCMT ref: 00775331

Part of subcall function 0076593C: __FF_MSGBANNER.LIBCMT ref: 00765953
Part of subcall function 0076593C: __NMSG_WRITE.LIBCMT ref: 0076595A
Part of subcall function 0076593C: RtlAllocateHeap.NTDLL(01990000,00000000,00000001,?,00000004,?,?,00761003,?), ref: 0076597F

Memory Dump Source

Source File: 0000000A.00000002.2894756195.0000000000741000.00000020.00000001.01000000.00000006.sdmp, Offset: 00740000, based on PE: true

Associated: 0000000A.00000002.2894716076.0000000000740000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.2894810207.00000000007D0000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.2894810207.00000000007F6000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.2894865972.0000000000800000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.2894887053.0000000000809000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_740000_Launches.jbxd

Similarity

API ID: AllocateHeap_free
String ID:
API String ID: 614378929-0
Opcode ID: 173b32d3d2b3fc8b401aab4d2df416f6ca15b8e4ec9582bc61d43bd1409bafcc
Instruction ID: a3f2406e32bf037d851c262ebcda927989c07bf2d96689111502b29995e4b4b0
Opcode Fuzzy Hash: 173b32d3d2b3fc8b401aab4d2df416f6ca15b8e4ec9582bc61d43bd1409bafcc
Instruction Fuzzy Hash: DF11C432505E15EFCF602F74AC0965A3794AF143E4F10862AFC1E9A1B1DFFC894087A1

Function 007A4365 Relevance: 6.1, APIs: 4, Instructions: 65fileCOMMON

Download Yara Rule

APIs

CreateFileW.KERNEL32(?,C0000000,00000003,00000000,00000003,00000080,00000000), ref: 007A4385
_memset.LIBCMT ref: 007A43A6
DeviceIoControl.KERNEL32(00000000,0004D02C,?,00000200,?,00000200,?,00000000), ref: 007A43F8
CloseHandle.KERNEL32(00000000), ref: 007A4401

Memory Dump Source

Source File: 0000000A.00000002.2894756195.0000000000741000.00000020.00000001.01000000.00000006.sdmp, Offset: 00740000, based on PE: true

Associated: 0000000A.00000002.2894716076.0000000000740000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.2894810207.00000000007D0000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.2894810207.00000000007F6000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.2894865972.0000000000800000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.2894887053.0000000000809000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_740000_Launches.jbxd

Similarity

API ID: CloseControlCreateDeviceFileHandle_memset
String ID:
API String ID: 1157408455-0
Opcode ID: 28b38ec9c5e2ef05cb590265c81b2162445858b2d752d27e69590fa3ae4248ca
Instruction ID: 981869f7cae968fc34ffb5688786d5c7689b66136d66ece29dca73496cc4fc42
Opcode Fuzzy Hash: 28b38ec9c5e2ef05cb590265c81b2162445858b2d752d27e69590fa3ae4248ca
Instruction Fuzzy Hash: 0A1101719022287AD73097A5AC4DFEFBB7CEF85720F10469AF904E7180D2744E40C7A4

Function 007B6A54 Relevance: 6.1, APIs: 4, Instructions: 61networkCOMMON

Download Yara Rule

APIs

Part of subcall function 0075402A: WideCharToMultiByte.KERNEL32(00000000,00000000,?,00000001,00000000,00000000,00000000,00000000,00000000,00000000,?,007A7E51,?,?,00000000), ref: 00754041
Part of subcall function 0075402A: WideCharToMultiByte.KERNEL32(00000000,00000000,?,00000001,00000000,?,00000000,00000000,?,?,007A7E51,?,?,00000000,?,?), ref: 00754065

gethostbyname.WSOCK32(?,?,?), ref: 007B6A84
WSAGetLastError.WSOCK32(00000000), ref: 007B6A8F
_memmove.LIBCMT ref: 007B6ABC
inet_ntoa.WSOCK32(?), ref: 007B6AC7

Memory Dump Source

Source File: 0000000A.00000002.2894756195.0000000000741000.00000020.00000001.01000000.00000006.sdmp, Offset: 00740000, based on PE: true

Associated: 0000000A.00000002.2894716076.0000000000740000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.2894810207.00000000007D0000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.2894810207.00000000007F6000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.2894865972.0000000000800000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.2894887053.0000000000809000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_740000_Launches.jbxd

Similarity

API ID: ByteCharMultiWide$ErrorLast_memmovegethostbynameinet_ntoa
String ID:
API String ID: 1504782959-0
Opcode ID: bdbc41227753c9f2272afa9c9f48a58350261900f49a0a286ae868d39db24042
Instruction ID: 1417c88c33beb0a7f96ddc642d672a4fa2a8ed55a655c4d4fb3d2f672f725a9f
Opcode Fuzzy Hash: bdbc41227753c9f2272afa9c9f48a58350261900f49a0a286ae868d39db24042
Instruction Fuzzy Hash: 01116671500108DFCB04FBA4CD4AEEEB7B8EF04311B548055F906A72A2DF799E14DBA1

Function 0074166C Relevance: 6.1, APIs: 4, Instructions: 59COMMON

Download Yara Rule

APIs

Part of subcall function 007429E2: GetWindowLongW.USER32(?,000000EB), ref: 007429F3

DefDlgProcW.USER32(?,00000020,?), ref: 007416B4
GetClientRect.USER32(?,?), ref: 0077B93C
GetCursorPos.USER32(?), ref: 0077B946
ScreenToClient.USER32(?,?), ref: 0077B951

Memory Dump Source

Source File: 0000000A.00000002.2894756195.0000000000741000.00000020.00000001.01000000.00000006.sdmp, Offset: 00740000, based on PE: true

Associated: 0000000A.00000002.2894716076.0000000000740000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.2894810207.00000000007D0000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.2894810207.00000000007F6000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.2894865972.0000000000800000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.2894887053.0000000000809000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_740000_Launches.jbxd

Similarity

API ID: Client$CursorLongProcRectScreenWindow
String ID:
API String ID: 4127811313-0
Opcode ID: 85e9c5daccf934f9b187222ae9c28ed2d4344920278eb71b6429601533b1b4cf
Instruction ID: a06421a01efdd402567582f37764f706bd4c176b70760cc9cec86fa1cd55d510
Opcode Fuzzy Hash: 85e9c5daccf934f9b187222ae9c28ed2d4344920278eb71b6429601533b1b4cf
Instruction Fuzzy Hash: E0114975901019EBCB00EF54D889EBE77B8FB05300F444456F941E7140CB38FA91CBA6

Function 007996F9 Relevance: 6.1, APIs: 4, Instructions: 59windowCOMMON

Download Yara Rule

APIs

SendMessageW.USER32(?,000000B0,?,?), ref: 00799719
SendMessageW.USER32(?,000000C9,?,00000000), ref: 0079972B
SendMessageW.USER32(?,000000C9,?,00000000), ref: 00799741
SendMessageW.USER32(?,000000C9,?,00000000), ref: 0079975C

Memory Dump Source

Source File: 0000000A.00000002.2894756195.0000000000741000.00000020.00000001.01000000.00000006.sdmp, Offset: 00740000, based on PE: true

Associated: 0000000A.00000002.2894716076.0000000000740000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.2894810207.00000000007D0000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.2894810207.00000000007F6000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.2894865972.0000000000800000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.2894887053.0000000000809000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_740000_Launches.jbxd

Similarity

API ID: MessageSend
String ID:
API String ID: 3850602802-0
Opcode ID: 19631a52ebdbcfd9fc66bf4df62e4aeadfa95441c94d0709d220a05cb2703d90
Instruction ID: 675d89111bbb3b20c8b6ef5490e56968445032c6cd74dc8231860fdbd6053542
Opcode Fuzzy Hash: 19631a52ebdbcfd9fc66bf4df62e4aeadfa95441c94d0709d220a05cb2703d90
Instruction Fuzzy Hash: E6111879901218FFEF11DF99C985E9DBBB8FB48710F204095EA04B7290DA71AE11DB94

Function 00742111 Relevance: 6.1, APIs: 4, Instructions: 53windowCOMMON

Download Yara Rule

APIs

CreateWindowExW.USER32(?,?,?,?,?,?,?,?,?,?,00000000,00000096), ref: 0074214F
GetStockObject.GDI32(00000011), ref: 00742163
SendMessageW.USER32(00000000,00000030,00000000), ref: 0074216D

Memory Dump Source

Source File: 0000000A.00000002.2894756195.0000000000741000.00000020.00000001.01000000.00000006.sdmp, Offset: 00740000, based on PE: true

Associated: 0000000A.00000002.2894716076.0000000000740000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.2894810207.00000000007D0000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.2894810207.00000000007F6000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.2894865972.0000000000800000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.2894887053.0000000000809000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_740000_Launches.jbxd

Similarity

API ID: CreateMessageObjectSendStockWindow
String ID:
API String ID: 3970641297-0
Opcode ID: 7f1e333becef2361e5e4d447ed21f6f4acdb11ff1a3c3664721c12d031fee751
Instruction ID: e0c45007d6d0baa6d88901989ecde92bbd397a386ced90f65645196a7cca7a42
Opcode Fuzzy Hash: 7f1e333becef2361e5e4d447ed21f6f4acdb11ff1a3c3664721c12d031fee751
Instruction Fuzzy Hash: DF118B7250214DBFDF025FA09C44EEABB69EF583A4F444112FA0452111C779DC619BA1

Function 007A1941 Relevance: 6.1, APIs: 4, Instructions: 51sleepCOMMON

Download Yara Rule

APIs

QueryPerformanceCounter.KERNEL32(?,?,?,?,?,?,?,007A04EC,?,007A153F,?,00008000), ref: 007A195E
Sleep.KERNEL32(00000000,?,?,?,?,?,?,007A04EC,?,007A153F,?,00008000), ref: 007A1983
QueryPerformanceCounter.KERNEL32(?,?,?,?,?,?,?,007A04EC,?,007A153F,?,00008000), ref: 007A198D
Sleep.KERNEL32(?,?,?,?,?,?,?,007A04EC,?,007A153F,?,00008000), ref: 007A19C0

Memory Dump Source

Source File: 0000000A.00000002.2894756195.0000000000741000.00000020.00000001.01000000.00000006.sdmp, Offset: 00740000, based on PE: true

Associated: 0000000A.00000002.2894716076.0000000000740000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.2894810207.00000000007D0000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.2894810207.00000000007F6000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.2894865972.0000000000800000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.2894887053.0000000000809000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_740000_Launches.jbxd

Similarity

API ID: CounterPerformanceQuerySleep
String ID:
API String ID: 2875609808-0
Opcode ID: 87c987695f8450558a88fb078f759ac9ec400116a119549b2c93a5bd7a6d8d1a
Instruction ID: 104a515c9f973c03e3dbe6339a925f1cf8e909bcceb098b43f676e03843d49c7
Opcode Fuzzy Hash: 87c987695f8450558a88fb078f759ac9ec400116a119549b2c93a5bd7a6d8d1a
Instruction Fuzzy Hash: BF114831C0566CEBDF00DFA4D958BEEBB78BF4A711F408246E980B6240CB39A650CBD5

Function 007CE1CE Relevance: 6.0, APIs: 4, Instructions: 50registryCOMMON

Download Yara Rule

APIs

GetModuleFileNameW.KERNEL32(?,?,00000104,00000000,00000000), ref: 007CE1EA
LoadTypeLibEx.OLEAUT32(?,00000002,0000000C), ref: 007CE201
RegisterTypeLib.OLEAUT32(0000000C,?,00000000), ref: 007CE216
RegisterTypeLibForUser.OLEAUT32(0000000C,?,00000000), ref: 007CE234

Memory Dump Source

Source File: 0000000A.00000002.2894756195.0000000000741000.00000020.00000001.01000000.00000006.sdmp, Offset: 00740000, based on PE: true

Associated: 0000000A.00000002.2894716076.0000000000740000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.2894810207.00000000007D0000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.2894810207.00000000007F6000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.2894865972.0000000000800000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.2894887053.0000000000809000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_740000_Launches.jbxd

Similarity

API ID: Type$Register$FileLoadModuleNameUser
String ID:
API String ID: 1352324309-0
Opcode ID: 6bcfdd4bc3815ccfdc5a598a8e5b07e84cdf659ae602ccc023fdf17bbb867696
Instruction ID: a456500f830e8e5806540dd59261e74445ea56cbf1e920dc6ae07fd0e55bfb3e
Opcode Fuzzy Hash: 6bcfdd4bc3815ccfdc5a598a8e5b07e84cdf659ae602ccc023fdf17bbb867696
Instruction Fuzzy Hash: 761161B5206B049BE3308F51DD0CF93BBBCFB00B10F10855EAA56D6050D7B8F504ABA1

Function 007771E7 Relevance: 6.0, APIs: 4, Instructions: 48COMMONLIBRARYCODE

Download Yara Rule

APIs

__cftof_l.LIBCMT ref: 0077720B

Part of subcall function 007778F2: __fltout2.LIBCMT ref: 0077791B

__cftog_l.LIBCMT ref: 00777231
__cftoe_l.LIBCMT ref: 00777263

Memory Dump Source

Source File: 0000000A.00000002.2894756195.0000000000741000.00000020.00000001.01000000.00000006.sdmp, Offset: 00740000, based on PE: true

Associated: 0000000A.00000002.2894716076.0000000000740000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.2894810207.00000000007D0000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.2894810207.00000000007F6000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.2894865972.0000000000800000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.2894887053.0000000000809000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_740000_Launches.jbxd

Similarity

API ID: __cftoe_l__cftof_l__cftog_l__fltout2
String ID:
API String ID: 3016257755-0
Opcode ID: a65d1881d29c7e947f5b32dbcea64912f89e558cad637ae539af3f1adf23f7b4
Instruction ID: 3ad41b7916e55ea8759cbe5daac679a73eeed8e4c34f1483237b3159034e73dd
Opcode Fuzzy Hash: a65d1881d29c7e947f5b32dbcea64912f89e558cad637ae539af3f1adf23f7b4
Instruction Fuzzy Hash: C2017E3204814AFBCF1A5E84CC058ED3F32BB19384B48C515FA2C98532C63AC9B1EB81

Function 007CB937 Relevance: 6.0, APIs: 4, Instructions: 47COMMON

Download Yara Rule

APIs

GetWindowRect.USER32(?,?), ref: 007CB956
ScreenToClient.USER32(?,?), ref: 007CB96E
ScreenToClient.USER32(?,?), ref: 007CB992
InvalidateRect.USER32(?,?,?,?,?,?,?,?,?,?,?,?), ref: 007CB9AD

Memory Dump Source

Source File: 0000000A.00000002.2894756195.0000000000741000.00000020.00000001.01000000.00000006.sdmp, Offset: 00740000, based on PE: true

Associated: 0000000A.00000002.2894716076.0000000000740000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.2894810207.00000000007D0000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.2894810207.00000000007F6000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.2894865972.0000000000800000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.2894887053.0000000000809000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_740000_Launches.jbxd

Similarity

API ID: ClientRectScreen$InvalidateWindow
String ID:
API String ID: 357397906-0
Opcode ID: 25d880d4d351ea25fa1ff7cb25ae82113624d2b90dbdf57182e359568d29f06b
Instruction ID: 446c98e5f9426f130b0c3613ddaee216fc44f0009736a44359267a1f280078ba
Opcode Fuzzy Hash: 25d880d4d351ea25fa1ff7cb25ae82113624d2b90dbdf57182e359568d29f06b
Instruction Fuzzy Hash: B01144B9D00209EFDB41CF98D984AEEBBF9FF48310F109156E914E3610D735AA658F94

Function 007CBCA7 Relevance: 6.0, APIs: 4, Instructions: 40processCOMMON

Download Yara Rule

APIs

_memset.LIBCMT ref: 007CBCB6
_memset.LIBCMT ref: 007CBCC5
CreateProcessW.KERNEL32(00000000,?,00000000,00000000,00000000,00000020,00000000,00000000,00808F20,00808F64), ref: 007CBCF4
CloseHandle.KERNEL32 ref: 007CBD06

Memory Dump Source

Source File: 0000000A.00000002.2894756195.0000000000741000.00000020.00000001.01000000.00000006.sdmp, Offset: 00740000, based on PE: true

Associated: 0000000A.00000002.2894716076.0000000000740000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.2894810207.00000000007D0000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.2894810207.00000000007F6000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.2894865972.0000000000800000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.2894887053.0000000000809000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_740000_Launches.jbxd

Similarity

API ID: _memset$CloseCreateHandleProcess
String ID:
API String ID: 3277943733-0
Opcode ID: f80d82d81e1684ba24285edcb6b7a299559e514c7f6a81fb6c931cd2cd29a573
Instruction ID: a50eb3c8db61b86d7b7ef542a01cb925881a0256051b09fb7baf5fd6f87a343c
Opcode Fuzzy Hash: f80d82d81e1684ba24285edcb6b7a299559e514c7f6a81fb6c931cd2cd29a573
Instruction Fuzzy Hash: 65F05EB2640305FFE29027B1AC0AFBB3B5EFB08750F005425BB49E51A2DF79486087AC

Function 007A7195 Relevance: 6.0, APIs: 4, Instructions: 33COMMON

Download Yara Rule

APIs

EnterCriticalSection.KERNEL32(?), ref: 007A71A1

Part of subcall function 007A7C7F: _memset.LIBCMT ref: 007A7CB4

_memmove.LIBCMT ref: 007A71C4
_memset.LIBCMT ref: 007A71D1
LeaveCriticalSection.KERNEL32(?), ref: 007A71E1

Memory Dump Source

Source File: 0000000A.00000002.2894756195.0000000000741000.00000020.00000001.01000000.00000006.sdmp, Offset: 00740000, based on PE: true

Associated: 0000000A.00000002.2894716076.0000000000740000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.2894810207.00000000007D0000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.2894810207.00000000007F6000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.2894865972.0000000000800000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.2894887053.0000000000809000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_740000_Launches.jbxd

Similarity

API ID: CriticalSection_memset$EnterLeave_memmove
String ID:
API String ID: 48991266-0
Opcode ID: 02b8a87217dd8df7af098d7f82ced8ee8fc1ec553adcfd853b894c8bdfc93190
Instruction ID: 654c6e468a845247d3cb7f1580128531730e2381804d8c929e12f3feeeae2d7a
Opcode Fuzzy Hash: 02b8a87217dd8df7af098d7f82ced8ee8fc1ec553adcfd853b894c8bdfc93190
Instruction Fuzzy Hash: D7F0543A101100ABCF416F55DC89B4ABB29EF45320F08C055FE095E21AC735A911DBB4

Function 007CC3C4 Relevance: 6.0, APIs: 4, Instructions: 31COMMON

Download Yara Rule

APIs

Part of subcall function 007416CF: ExtCreatePen.GDI32(?,?,00000000,00000000,00000000,?,00000000), ref: 00741729
Part of subcall function 007416CF: SelectObject.GDI32(?,00000000), ref: 00741738
Part of subcall function 007416CF: BeginPath.GDI32(?), ref: 0074174F
Part of subcall function 007416CF: SelectObject.GDI32(?,00000000), ref: 00741778

MoveToEx.GDI32(00000000,00000000,?,00000000), ref: 007CC3E8
LineTo.GDI32(00000000,?,?), ref: 007CC3F5
EndPath.GDI32(00000000), ref: 007CC405
StrokePath.GDI32(00000000), ref: 007CC413

Memory Dump Source

Source File: 0000000A.00000002.2894756195.0000000000741000.00000020.00000001.01000000.00000006.sdmp, Offset: 00740000, based on PE: true

Associated: 0000000A.00000002.2894716076.0000000000740000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.2894810207.00000000007D0000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.2894810207.00000000007F6000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.2894865972.0000000000800000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.2894887053.0000000000809000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_740000_Launches.jbxd

Similarity

API ID: Path$ObjectSelect$BeginCreateLineMoveStroke
String ID:
API String ID: 1539411459-0
Opcode ID: 808468ba39a18659465931146015ac92cbb7df811132479f5d1abf064ca1b816
Instruction ID: d177b776921fbe863aee625d8d3620f4c24484c15c7bcd4277ee807589b2b6e5
Opcode Fuzzy Hash: 808468ba39a18659465931146015ac92cbb7df811132479f5d1abf064ca1b816
Instruction Fuzzy Hash: A6F0BE32006259BADB132F50AC0DFCE3F69AF05310F18C005FA51210E187786650DBED

Function 0079AA52 Relevance: 6.0, APIs: 4, Instructions: 30threadwindowtimeCOMMON

Download Yara Rule

APIs

SendMessageTimeoutW.USER32(?,00000000,00000000,00000000,00000002,00001388,00000001), ref: 0079AA6F
GetWindowThreadProcessId.USER32(?,00000000), ref: 0079AA82
GetCurrentThreadId.KERNEL32 ref: 0079AA89
AttachThreadInput.USER32(00000000), ref: 0079AA90

Memory Dump Source

Source File: 0000000A.00000002.2894756195.0000000000741000.00000020.00000001.01000000.00000006.sdmp, Offset: 00740000, based on PE: true

Associated: 0000000A.00000002.2894716076.0000000000740000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.2894810207.00000000007D0000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.2894810207.00000000007F6000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.2894865972.0000000000800000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.2894887053.0000000000809000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_740000_Launches.jbxd

Similarity

API ID: Thread$AttachCurrentInputMessageProcessSendTimeoutWindow
String ID:
API String ID: 2710830443-0
Opcode ID: 5ef90e3976c0d31bf1fcbbaa782f272a0c43639067dd51e67e8ce8844676e938
Instruction ID: e8c5340c9398345fc720ae9466ff7fbe368f6900f1946f57d85d9f8d107ebc2d
Opcode Fuzzy Hash: 5ef90e3976c0d31bf1fcbbaa782f272a0c43639067dd51e67e8ce8844676e938
Instruction Fuzzy Hash: 90E03931542228BBDB215FA2AD0CFEB3F2CEF527A1F40C012F50984050C679C550CBE1

Function 007425F4 Relevance: 6.0, APIs: 4, Instructions: 23COMMON

Download Yara Rule

APIs

GetSysColor.USER32(00000008), ref: 0074260D
SetTextColor.GDI32(?,000000FF), ref: 00742617
SetBkMode.GDI32(?,00000001), ref: 0074262C
GetStockObject.GDI32(00000005), ref: 00742634
GetWindowDC.USER32(?,00000000), ref: 0077C1C4
GetPixel.GDI32(00000000,00000000,00000000), ref: 0077C1D1
GetPixel.GDI32(00000000,?,00000000), ref: 0077C1EA
GetPixel.GDI32(00000000,00000000,?), ref: 0077C203
GetPixel.GDI32(00000000,?,?), ref: 0077C223
ReleaseDC.USER32(?,00000000), ref: 0077C22E

Memory Dump Source

Source File: 0000000A.00000002.2894756195.0000000000741000.00000020.00000001.01000000.00000006.sdmp, Offset: 00740000, based on PE: true

Associated: 0000000A.00000002.2894716076.0000000000740000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.2894810207.00000000007D0000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.2894810207.00000000007F6000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.2894865972.0000000000800000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.2894887053.0000000000809000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_740000_Launches.jbxd

Similarity

API ID: Pixel$Color$ModeObjectReleaseStockTextWindow
String ID:
API String ID: 1946975507-0
Opcode ID: ab6aa8117085cf1c5d1c1a494cc68c9ab0b35a6cf7c41c9477a07216cf440257
Instruction ID: 637cd80d4ae5a4d7f977510e72a3da6adcd085df6955935b2f8925e049fe5f7d
Opcode Fuzzy Hash: ab6aa8117085cf1c5d1c1a494cc68c9ab0b35a6cf7c41c9477a07216cf440257
Instruction Fuzzy Hash: 35E06531505248BBDF225FB4BC09BDC3B21EB05331F04C367FA69480E287764990DB56

Function 00799330 Relevance: 6.0, APIs: 4, Instructions: 23threadCOMMON

Download Yara Rule

APIs

GetCurrentThread.KERNEL32 ref: 00799339
OpenThreadToken.ADVAPI32(00000000,?,?,?,00798F04), ref: 00799340
GetCurrentProcess.KERNEL32(00000028,?,?,?,?,00798F04), ref: 0079934D
OpenProcessToken.ADVAPI32(00000000,?,?,?,00798F04), ref: 00799354

Memory Dump Source

Source File: 0000000A.00000002.2894756195.0000000000741000.00000020.00000001.01000000.00000006.sdmp, Offset: 00740000, based on PE: true

Associated: 0000000A.00000002.2894716076.0000000000740000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.2894810207.00000000007D0000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.2894810207.00000000007F6000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.2894865972.0000000000800000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.2894887053.0000000000809000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_740000_Launches.jbxd

Similarity

API ID: CurrentOpenProcessThreadToken
String ID:
API String ID: 3974789173-0
Opcode ID: 09e335351716ec31d2695a2c3e323b6f952563af578544722a2f629308264082
Instruction ID: f2aa4aa8175f7f499957dab54521fc4b99b27112837888da57924e572b49b32b
Opcode Fuzzy Hash: 09e335351716ec31d2695a2c3e323b6f952563af578544722a2f629308264082
Instruction Fuzzy Hash: 07E04F32603211ABEB201FB56E0EB563B7CEF50791F118819A245C9090E63C9444C794

Function 00780679 Relevance: 6.0, APIs: 4, Instructions: 20COMMON

Download Yara Rule

APIs

GetDesktopWindow.USER32 ref: 00780679
GetDC.USER32(00000000), ref: 00780683
GetDeviceCaps.GDI32(00000000,0000000C), ref: 007806A3
ReleaseDC.USER32(?), ref: 007806C4

Memory Dump Source

Source File: 0000000A.00000002.2894756195.0000000000741000.00000020.00000001.01000000.00000006.sdmp, Offset: 00740000, based on PE: true

Associated: 0000000A.00000002.2894716076.0000000000740000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.2894810207.00000000007D0000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.2894810207.00000000007F6000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.2894865972.0000000000800000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.2894887053.0000000000809000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_740000_Launches.jbxd

Similarity

API ID: CapsDesktopDeviceReleaseWindow
String ID:
API String ID: 2889604237-0
Opcode ID: 0248395c9c4ed30a9dbe3736f1795e0e10de04af912e4e65a22ab61f76750da4
Instruction ID: 062eb585f0e9c90c3d7bd96863a0657c652d655992c63af0c5a3d580947989a5
Opcode Fuzzy Hash: 0248395c9c4ed30a9dbe3736f1795e0e10de04af912e4e65a22ab61f76750da4
Instruction Fuzzy Hash: DFE0EEB1901204EFCB519FB0D808BAD7BB1EB88310F11D00AF95AA7210DB3C85519F99

Function 0078068D Relevance: 6.0, APIs: 4, Instructions: 19COMMON

Download Yara Rule

APIs

GetDesktopWindow.USER32 ref: 0078068D
GetDC.USER32(00000000), ref: 00780697
GetDeviceCaps.GDI32(00000000,0000000C), ref: 007806A3
ReleaseDC.USER32(?), ref: 007806C4

Memory Dump Source

Source File: 0000000A.00000002.2894756195.0000000000741000.00000020.00000001.01000000.00000006.sdmp, Offset: 00740000, based on PE: true

Associated: 0000000A.00000002.2894716076.0000000000740000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.2894810207.00000000007D0000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.2894810207.00000000007F6000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.2894865972.0000000000800000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.2894887053.0000000000809000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_740000_Launches.jbxd

Similarity

API ID: CapsDesktopDeviceReleaseWindow
String ID:
API String ID: 2889604237-0
Opcode ID: f5118bd75592556013d6ff2bf7face3ebf6f5d52b923b8175d97f532948a5938
Instruction ID: e67792a472e5a2ead768ff2870ac48ecc247a96e7c662fa83aa9b67a18ebf3f4
Opcode Fuzzy Hash: f5118bd75592556013d6ff2bf7face3ebf6f5d52b923b8175d97f532948a5938
Instruction Fuzzy Hash: CBE0EEB1801204AFCB119FB0D808BAD7BB1EB88310F10C00AF95AA7210CB3C95519F98

Function 007AB5EF Relevance: 5.5, APIs: 2, Strings: 1, Instructions: 201shareCOMMON

Download Yara Rule

APIs

Part of subcall function 0075436A: _wcscpy.LIBCMT ref: 0075438D

Part of subcall function 00744D37: __itow.LIBCMT ref: 00744D62
Part of subcall function 00744D37: __swprintf.LIBCMT ref: 00744DAC

__wcsnicmp.LIBCMT ref: 007AB670
WNetUseConnectionW.MPR(00000000,?,?,00000000,?,?,00000100,?), ref: 007AB739

Strings

LPT, xrefs: 007AB66A

Memory Dump Source

Source File: 0000000A.00000002.2894756195.0000000000741000.00000020.00000001.01000000.00000006.sdmp, Offset: 00740000, based on PE: true

Associated: 0000000A.00000002.2894716076.0000000000740000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.2894810207.00000000007D0000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.2894810207.00000000007F6000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.2894865972.0000000000800000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.2894887053.0000000000809000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_740000_Launches.jbxd

Similarity

API ID: Connection__itow__swprintf__wcsnicmp_wcscpy
String ID: LPT
API String ID: 3222508074-1350329615
Opcode ID: 94785b478bb77cb9ab35becac4b2140b399a0ed612505dccb2267fab32c3754d
Instruction ID: fb9d17adc12c732907b925902c9ea70c239781160c3ed94e5728643310043885
Opcode Fuzzy Hash: 94785b478bb77cb9ab35becac4b2140b399a0ed612505dccb2267fab32c3754d
Instruction Fuzzy Hash: BD61A775A00219EFCB14DF94C895EAEB7B4EF89310F14815AF906AB392D778AE44CF50

Function 00787190 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 148COMMON

Download Yara Rule

APIs

_memmove.LIBCMT ref: 00787237
_memmove.LIBCMT ref: 00787291

Strings

#Vu, xrefs: 0078730B, 0078CAB3, 0078CACF

Memory Dump Source

Source File: 0000000A.00000002.2894756195.0000000000741000.00000020.00000001.01000000.00000006.sdmp, Offset: 00740000, based on PE: true

Associated: 0000000A.00000002.2894716076.0000000000740000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.2894810207.00000000007D0000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.2894810207.00000000007F6000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.2894865972.0000000000800000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.2894887053.0000000000809000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_740000_Launches.jbxd

Similarity

API ID: _memmove
String ID: #Vu
API String ID: 4104443479-163864266
Opcode ID: acc293fdc3e06b4b666fc737dd1d691d3233f932bd1abc08b3e18a8d85250412
Instruction ID: 55e1f676d7d31f755e26df0f5cfa281c6713a5cf9432634d9886d65219ffdd46
Opcode Fuzzy Hash: acc293fdc3e06b4b666fc737dd1d691d3233f932bd1abc08b3e18a8d85250412
Instruction Fuzzy Hash: B0518170D44609DFCF28DF68C884AAEBBB1FF44314F248529E85AD7240E739E955CB91

Function 0074E00D Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 144sleepCOMMON

Download Yara Rule

APIs

Sleep.KERNEL32(00000000), ref: 0074E01E
GlobalMemoryStatusEx.KERNEL32(?), ref: 0074E037

Strings

@, xrefs: 0074E02B

Memory Dump Source

Source File: 0000000A.00000002.2894756195.0000000000741000.00000020.00000001.01000000.00000006.sdmp, Offset: 00740000, based on PE: true

Associated: 0000000A.00000002.2894716076.0000000000740000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.2894810207.00000000007D0000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.2894810207.00000000007F6000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.2894865972.0000000000800000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.2894887053.0000000000809000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_740000_Launches.jbxd

Similarity

API ID: GlobalMemorySleepStatus
String ID: @
API String ID: 2783356886-2766056989
Opcode ID: 910e45ba54d46291d47d785b671bd52b95036a7fece84c9b6400f3670c671de0
Instruction ID: 0a66d563bfdb92e3bab5cd8ae256d875d57c64c116938ae2645954a340724af4
Opcode Fuzzy Hash: 910e45ba54d46291d47d785b671bd52b95036a7fece84c9b6400f3670c671de0
Instruction Fuzzy Hash: 015149B1508748DBE320AF50E88ABAFBBF8FF84714F51884DF2D8411A1DB749529CB56

Function 007C8096 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 97windowCOMMON

Download Yara Rule

APIs

SendMessageW.USER32(00000027,00001132,00000000,?), ref: 007C8186
SendMessageW.USER32(?,00001105,00000000,00000000), ref: 007C819B

Strings

', xrefs: 007C80EF

Memory Dump Source

Source File: 0000000A.00000002.2894756195.0000000000741000.00000020.00000001.01000000.00000006.sdmp, Offset: 00740000, based on PE: true

Associated: 0000000A.00000002.2894716076.0000000000740000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.2894810207.00000000007D0000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.2894810207.00000000007F6000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.2894865972.0000000000800000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.2894887053.0000000000809000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_740000_Launches.jbxd

Similarity

API ID: MessageSend
String ID: '
API String ID: 3850602802-1997036262
Opcode ID: 45f1a13fa4942f25dceaafecdfac7c3b15a703dce0dfa710da692180cf7c1ad6
Instruction ID: 28f05ac8c2dda05bb407fef7af0fd0ac0bd352f2593dcac3dc849090ee2785db
Opcode Fuzzy Hash: 45f1a13fa4942f25dceaafecdfac7c3b15a703dce0dfa710da692180cf7c1ad6
Instruction Fuzzy Hash: 4E410774A012099FDB54CF68C881FEA7BF5FB09340F14416EE904AB351DB35A956CF91

Function 007B2C5A Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 97networkCOMMON

Download Yara Rule

APIs

_memset.LIBCMT ref: 007B2C6A
InternetCrackUrlW.WININET(?,00000000,00000000,0000007C), ref: 007B2CA0

Strings

|, xrefs: 007B2C71

Memory Dump Source

Source File: 0000000A.00000002.2894756195.0000000000741000.00000020.00000001.01000000.00000006.sdmp, Offset: 00740000, based on PE: true

Associated: 0000000A.00000002.2894716076.0000000000740000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.2894810207.00000000007D0000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.2894810207.00000000007F6000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.2894865972.0000000000800000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.2894887053.0000000000809000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_740000_Launches.jbxd

Similarity

API ID: CrackInternet_memset
String ID: |
API String ID: 1413715105-2343686810
Opcode ID: 2e681ee4ecdb127d34476b63840f27332e44316130f64b9f22f2d27a595d7213
Instruction ID: 3aee686c76adb9213c2a859797fbccdd9192217d62adfaf81f57847bfe588447
Opcode Fuzzy Hash: 2e681ee4ecdb127d34476b63840f27332e44316130f64b9f22f2d27a595d7213
Instruction Fuzzy Hash: BD310771D01219EBCF11EFA0CC89AEEBFB9FF08311F100059FC15A6262EA755956DBA0

Function 007C7088 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 95COMMON

Download Yara Rule

APIs

DestroyWindow.USER32(?,?,?,?), ref: 007C713C
MoveWindow.USER32(?,?,?,?,?,00000001,?,?,?), ref: 007C7178

Strings

static, xrefs: 007C70D8

Memory Dump Source

Source File: 0000000A.00000002.2894756195.0000000000741000.00000020.00000001.01000000.00000006.sdmp, Offset: 00740000, based on PE: true

Associated: 0000000A.00000002.2894716076.0000000000740000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.2894810207.00000000007D0000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.2894810207.00000000007F6000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.2894865972.0000000000800000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.2894887053.0000000000809000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_740000_Launches.jbxd

Similarity

API ID: Window$DestroyMove
String ID: static
API String ID: 2139405536-2160076837
Opcode ID: dcc8a32df79f5b64fc546b0904844469a6963b5eca810d097430eb3d344336c6
Instruction ID: afd9d4ac10fe43ea59ca4f5d41e991e6a22d0cdf1dc96e62b91009bbaaf7ae5c
Opcode Fuzzy Hash: dcc8a32df79f5b64fc546b0904844469a6963b5eca810d097430eb3d344336c6
Instruction Fuzzy Hash: 4A318D71100608AADB149F78CC85FFB73A9FF88720F10961DF9A597191DB38AC81DBA0

Function 007A3049 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 88windowCOMMON

Download Yara Rule

APIs

_memset.LIBCMT ref: 007A30B8
GetMenuItemInfoW.USER32(?,?,00000000,00000030), ref: 007A30F3

Strings

0, xrefs: 007A30B1

Memory Dump Source

Source File: 0000000A.00000002.2894756195.0000000000741000.00000020.00000001.01000000.00000006.sdmp, Offset: 00740000, based on PE: true

Associated: 0000000A.00000002.2894716076.0000000000740000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.2894810207.00000000007D0000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.2894810207.00000000007F6000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.2894865972.0000000000800000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.2894887053.0000000000809000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_740000_Launches.jbxd

Similarity

API ID: InfoItemMenu_memset
String ID: 0
API String ID: 2223754486-4108050209
Opcode ID: f6b7e372b5c6bcfbc71f839a9f9e44015560f4f65fb735e80ae717cfedb3374a
Instruction ID: 6531407898dc69ddbf1586f1399398a92d25a1df0a10e01d0470964d5cd162b9
Opcode Fuzzy Hash: f6b7e372b5c6bcfbc71f839a9f9e44015560f4f65fb735e80ae717cfedb3374a
Instruction Fuzzy Hash: AC31FB7160030DDBEB248F54C885FAEBBB9FF86350F144119FD85A6191E7789B44CB50

Function 007B40B5 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 84COMMON

Download Yara Rule

APIs

__snwprintf.LIBCMT ref: 007B4132

Part of subcall function 00751A36: _memmove.LIBCMT ref: 00751A77

Strings

, $, xrefs: 007B4172
AUTOITCALLVARIABLE%d, xrefs: 007B4124

Memory Dump Source

Source File: 0000000A.00000002.2894756195.0000000000741000.00000020.00000001.01000000.00000006.sdmp, Offset: 00740000, based on PE: true

Associated: 0000000A.00000002.2894716076.0000000000740000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.2894810207.00000000007D0000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.2894810207.00000000007F6000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.2894865972.0000000000800000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.2894887053.0000000000809000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_740000_Launches.jbxd

Similarity

API ID: __snwprintf_memmove
String ID: , $$AUTOITCALLVARIABLE%d
API String ID: 3506404897-2584243854
Opcode ID: d2a1371e3fc58a2fbbcb471fc8f45f3accfcf328aee8e309bee3eac7d6086e2e
Instruction ID: e9faa1d56b0aa2452dea406018f2272b66f1910ab8f622276e1251d1c5e0e4e1
Opcode Fuzzy Hash: d2a1371e3fc58a2fbbcb471fc8f45f3accfcf328aee8e309bee3eac7d6086e2e
Instruction Fuzzy Hash: 00217171A0021DEBCF10EF64C896FEE77B9AF54342F404455F905A7242EB78B945CBA1

Function 007C6CF9 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 72windowCOMMON

Download Yara Rule

APIs

SendMessageW.USER32(00000000,00000143,00000000,?), ref: 007C6D86
SendMessageW.USER32(?,0000014E,00000000,00000000), ref: 007C6D91

Strings

Combobox, xrefs: 007C6D53

Memory Dump Source

Source File: 0000000A.00000002.2894756195.0000000000741000.00000020.00000001.01000000.00000006.sdmp, Offset: 00740000, based on PE: true

Associated: 0000000A.00000002.2894716076.0000000000740000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.2894810207.00000000007D0000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.2894810207.00000000007F6000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.2894865972.0000000000800000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.2894887053.0000000000809000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_740000_Launches.jbxd

Similarity

API ID: MessageSend
String ID: Combobox
API String ID: 3850602802-2096851135
Opcode ID: c363e3a8cf39168ad426e285c3c3320b72ead15b589c29f21099058868e4df78
Instruction ID: c3b65630e80afdc65cfb3e8a4c6f885c7e5a333a346ac192f8aaf72a93fc94c2
Opcode Fuzzy Hash: c363e3a8cf39168ad426e285c3c3320b72ead15b589c29f21099058868e4df78
Instruction Fuzzy Hash: A311B271310208AFEF219E54DCC1FBB3B6AEB883A4F10412DF9159B291D639DC5187A0

Function 007C722C Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 68COMMON

Download Yara Rule

APIs

Part of subcall function 00742111: CreateWindowExW.USER32(?,?,?,?,?,?,?,?,?,?,00000000,00000096), ref: 0074214F
Part of subcall function 00742111: GetStockObject.GDI32(00000011), ref: 00742163
Part of subcall function 00742111: SendMessageW.USER32(00000000,00000030,00000000), ref: 0074216D

GetWindowRect.USER32(00000000,?), ref: 007C7296
GetSysColor.USER32(00000012), ref: 007C72B0

Strings

static, xrefs: 007C7273

Memory Dump Source

Source File: 0000000A.00000002.2894756195.0000000000741000.00000020.00000001.01000000.00000006.sdmp, Offset: 00740000, based on PE: true

Associated: 0000000A.00000002.2894716076.0000000000740000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.2894810207.00000000007D0000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.2894810207.00000000007F6000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.2894865972.0000000000800000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.2894887053.0000000000809000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_740000_Launches.jbxd

Similarity

API ID: Window$ColorCreateMessageObjectRectSendStock
String ID: static
API String ID: 1983116058-2160076837
Opcode ID: a452cec238689354477fe320289a9ac5c888059f116b52e183ab952f8fc26aef
Instruction ID: 1fef231b78bb0bbbdd2d08a56dd5c4c519ea898e86957d9a82c58952d078d34f
Opcode Fuzzy Hash: a452cec238689354477fe320289a9ac5c888059f116b52e183ab952f8fc26aef
Instruction Fuzzy Hash: DA21F47261420AAFDB04DFA8DC46EAA7BB8FB08314F005519BD55D3251DA39A861DBA0

Function 007C6F45 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 64windowCOMMON

Download Yara Rule

APIs

GetWindowTextLengthW.USER32(00000000), ref: 007C6FC7
SendMessageW.USER32(?,000000B1,00000000,00000000), ref: 007C6FD6

Strings

edit, xrefs: 007C6FAB

Memory Dump Source

Source File: 0000000A.00000002.2894756195.0000000000741000.00000020.00000001.01000000.00000006.sdmp, Offset: 00740000, based on PE: true

Associated: 0000000A.00000002.2894716076.0000000000740000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.2894810207.00000000007D0000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.2894810207.00000000007F6000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.2894865972.0000000000800000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.2894887053.0000000000809000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_740000_Launches.jbxd

Similarity

API ID: LengthMessageSendTextWindow
String ID: edit
API String ID: 2978978980-2167791130
Opcode ID: e5bb4c214cf5251a63cd334727ac187b2f681d5eda4a0175fb34e8da52ee5dd1
Instruction ID: 9e9a35653ccba8716e6e164fb577b6c249d9fcf9ae4806da4f8070d405ecd2a6
Opcode Fuzzy Hash: e5bb4c214cf5251a63cd334727ac187b2f681d5eda4a0175fb34e8da52ee5dd1
Instruction Fuzzy Hash: 3E114C71500208AFEB109E64EC85FFB3BAAEB45368F50471CFA65971E0C779DC519BA0

Function 007A3156 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 63windowCOMMON

Download Yara Rule

APIs

_memset.LIBCMT ref: 007A31C9
GetMenuItemInfoW.USER32(00000030,?,00000000,00000030), ref: 007A31E8

Strings

0, xrefs: 007A31BF

Memory Dump Source

Source File: 0000000A.00000002.2894756195.0000000000741000.00000020.00000001.01000000.00000006.sdmp, Offset: 00740000, based on PE: true

Associated: 0000000A.00000002.2894716076.0000000000740000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.2894810207.00000000007D0000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.2894810207.00000000007F6000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.2894865972.0000000000800000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.2894887053.0000000000809000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_740000_Launches.jbxd

Similarity

API ID: InfoItemMenu_memset
String ID: 0
API String ID: 2223754486-4108050209
Opcode ID: fa6a6aa202edad9c6ac407c8a65fcfc7a59182d5e1385c637445458f6cc431f9
Instruction ID: ed3950a30b18ce29904cc1d6048c091a286eb9f5f38f2ea5f52620bb32c66d31
Opcode Fuzzy Hash: fa6a6aa202edad9c6ac407c8a65fcfc7a59182d5e1385c637445458f6cc431f9
Instruction Fuzzy Hash: CE11E232E0151CABDB20DE98DC45B9D77B8AB87310F184222F916A72A0D778AF05CB91

Function 007434E4 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 63COMMON

Download Yara Rule

APIs

DeleteObject.GDI32(?), ref: 0074351D
DestroyWindow.USER32(?,?,00754E61), ref: 00743576

Strings

h}, xrefs: 007434E5

Memory Dump Source

Source File: 0000000A.00000002.2894756195.0000000000741000.00000020.00000001.01000000.00000006.sdmp, Offset: 00740000, based on PE: true

Associated: 0000000A.00000002.2894716076.0000000000740000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.2894810207.00000000007D0000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.2894810207.00000000007F6000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.2894865972.0000000000800000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.2894887053.0000000000809000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_740000_Launches.jbxd

Similarity

API ID: DeleteDestroyObjectWindow
String ID: h}
API String ID: 2587070983-1190393154
Opcode ID: 833e1f7f0af5c3292072b18afcc0bb594e246e1a7fe3d24029ead507d035f7ed
Instruction ID: 6a80ed31476377a60c7363bef390b9bf2a3b6db1c3ae4c4299cbea50e1fa4946
Opcode Fuzzy Hash: 833e1f7f0af5c3292072b18afcc0bb594e246e1a7fe3d24029ead507d035f7ed
Instruction Fuzzy Hash: E6214230A09200CFCB58EF28DC5872573F0BB44311B058169E40A8B3A1DB78EE50CF99

Function 007B28A2 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 62networkCOMMON

Download Yara Rule

APIs

InternetOpenW.WININET(?,00000000,00000000,00000000,00000000), ref: 007B28F8
InternetSetOptionW.WININET(00000000,00000032,?,00000008), ref: 007B2921

Strings

<local>, xrefs: 007B28E9

Memory Dump Source

Source File: 0000000A.00000002.2894756195.0000000000741000.00000020.00000001.01000000.00000006.sdmp, Offset: 00740000, based on PE: true

Associated: 0000000A.00000002.2894716076.0000000000740000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.2894810207.00000000007D0000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.2894810207.00000000007F6000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.2894865972.0000000000800000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.2894887053.0000000000809000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_740000_Launches.jbxd

Similarity

API ID: Internet$OpenOption
String ID: <local>
API String ID: 942729171-4266983199
Opcode ID: b98dc53a558b6b87a829742cf0b0945328317e6d7e42167e07d1bca8abbf5da7
Instruction ID: 59c6a29b4a06b96fb4f2e43b91575ee106a2a92e48358ae8c963568dec96a199
Opcode Fuzzy Hash: b98dc53a558b6b87a829742cf0b0945328317e6d7e42167e07d1bca8abbf5da7
Instruction Fuzzy Hash: 6611E070502225BAEB258F518C88FFBFBACFF15760F10852AF50956101E3786892DAE0

Function 007AD116 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 61COMMON

Download Yara Rule

APIs

_wcscmp.LIBCMT ref: 007AD180

Strings

L,}, xrefs: 007AD12E
0.0.0.0, xrefs: 007AD18E

Memory Dump Source

Source File: 0000000A.00000002.2894756195.0000000000741000.00000020.00000001.01000000.00000006.sdmp, Offset: 00740000, based on PE: true

Associated: 0000000A.00000002.2894716076.0000000000740000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.2894810207.00000000007D0000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.2894810207.00000000007F6000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.2894865972.0000000000800000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.2894887053.0000000000809000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_740000_Launches.jbxd

Similarity

API ID: _wcscmp
String ID: 0.0.0.0$L,}
API String ID: 856254489-2768579157
Opcode ID: 379a7cd7dc855774d281dd739c81e5f5d87cff60cafff8071cf5f30827872fa0
Instruction ID: 1e7f04157a4c615db3c0cf3d4565bb200b7bef52ceb6819cf0977d9b52c884b8
Opcode Fuzzy Hash: 379a7cd7dc855774d281dd739c81e5f5d87cff60cafff8071cf5f30827872fa0
Instruction Fuzzy Hash: 1811C475700208DFCB14EE14C885E59B3B5AF86714F158159FA0A5F3A1CA38FD46DB60

Function 007B8475 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 55networkCOMMON

Download Yara Rule

APIs

Part of subcall function 007B86E0: WideCharToMultiByte.KERNEL32(00000000,00000000,?,?,00000000,00000000,00000000,00000000,?,?,?,007B849D,?,00000000,?,?), ref: 007B86F7

inet_addr.WSOCK32(00000000,?,00000000,?,?,?,00000000), ref: 007B84A0
htons.WSOCK32(00000000,?,00000000), ref: 007B84DD

Strings

255.255.255.255, xrefs: 007B84B8

Memory Dump Source

Source File: 0000000A.00000002.2894756195.0000000000741000.00000020.00000001.01000000.00000006.sdmp, Offset: 00740000, based on PE: true

Associated: 0000000A.00000002.2894716076.0000000000740000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.2894810207.00000000007D0000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.2894810207.00000000007F6000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.2894865972.0000000000800000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.2894887053.0000000000809000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_740000_Launches.jbxd

Similarity

API ID: ByteCharMultiWidehtonsinet_addr
String ID: 255.255.255.255
API String ID: 2496851823-2422070025
Opcode ID: 37cd7c98c54afd3cc7d651cfdd4cf580e624738b759dd98eb47fec894dc7c8d4
Instruction ID: 9be93e5df6c0ef18b9c002d343e0b20a75dc5a922bc0b85626f20d1f22c7ece9
Opcode Fuzzy Hash: 37cd7c98c54afd3cc7d651cfdd4cf580e624738b759dd98eb47fec894dc7c8d4
Instruction Fuzzy Hash: C311A53560020AABDF14EF64DC46FEEB368FF04321F108517F915572D1DB75A814CA96

Function 007999BD Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 52windowCOMMON

Download Yara Rule

APIs

Part of subcall function 00751A36: _memmove.LIBCMT ref: 00751A77

Part of subcall function 0079B79A: GetClassNameW.USER32(?,?,000000FF), ref: 0079B7BD

SendMessageW.USER32(?,000001A2,000000FF,?), ref: 00799A2B

Strings

ListBox, xrefs: 007999F5
ComboBox, xrefs: 007999CA

Memory Dump Source

Source File: 0000000A.00000002.2894756195.0000000000741000.00000020.00000001.01000000.00000006.sdmp, Offset: 00740000, based on PE: true

Associated: 0000000A.00000002.2894716076.0000000000740000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.2894810207.00000000007D0000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.2894810207.00000000007F6000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.2894865972.0000000000800000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.2894887053.0000000000809000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_740000_Launches.jbxd

Similarity

API ID: ClassMessageNameSend_memmove
String ID: ComboBox$ListBox
API String ID: 372448540-1403004172
Opcode ID: 4a79d3acec6eda73d57dd211bbd5dabe960466a79e728996385c0a37e9e51e74
Instruction ID: c50294b853e2f267b2e01cd51869f901a7f9a14aedd5c7f9fdb0fb8dc4bbe1a6
Opcode Fuzzy Hash: 4a79d3acec6eda73d57dd211bbd5dabe960466a79e728996385c0a37e9e51e74
Instruction Fuzzy Hash: 9001D2B1A42118EB8F14EBB8DC569FE7369EF52321B404609F961572C1EE395808C660

Function 007A934C Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 51COMMON

Download Yara Rule

APIs

_memmove.LIBCMT ref: 007A9367
__fread_nolock.LIBCMT ref: 007A937C

Strings

EA06, xrefs: 007A93AE

Memory Dump Source

Source File: 0000000A.00000002.2894756195.0000000000741000.00000020.00000001.01000000.00000006.sdmp, Offset: 00740000, based on PE: true

Associated: 0000000A.00000002.2894716076.0000000000740000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.2894810207.00000000007D0000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.2894810207.00000000007F6000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.2894865972.0000000000800000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.2894887053.0000000000809000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_740000_Launches.jbxd

Similarity

API ID: __fread_nolock_memmove
String ID: EA06
API String ID: 1988441806-3962188686
Opcode ID: 15d88fbeef248fd9478c2b0753edb0c23552cf306dc0d8b3923b8fbe7a0cc771
Instruction ID: 9c8612646b6a2523f874f40193d487bfd54ccf15d1b895b279286ac70bd453ce
Opcode Fuzzy Hash: 15d88fbeef248fd9478c2b0753edb0c23552cf306dc0d8b3923b8fbe7a0cc771
Instruction Fuzzy Hash: 6501F972804258BEDF18C6A8CC5AEBEBBF89B02301F00429AF653D2581E579E6148B60

Function 007998B5 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 50windowCOMMON

Download Yara Rule

APIs

Part of subcall function 00751A36: _memmove.LIBCMT ref: 00751A77

Part of subcall function 0079B79A: GetClassNameW.USER32(?,?,000000FF), ref: 0079B7BD

SendMessageW.USER32(?,00000180,00000000,?), ref: 00799923

Strings

ListBox, xrefs: 007998ED
ComboBox, xrefs: 007998C2

Memory Dump Source

Source File: 0000000A.00000002.2894756195.0000000000741000.00000020.00000001.01000000.00000006.sdmp, Offset: 00740000, based on PE: true

Associated: 0000000A.00000002.2894716076.0000000000740000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.2894810207.00000000007D0000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.2894810207.00000000007F6000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.2894865972.0000000000800000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.2894887053.0000000000809000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_740000_Launches.jbxd

Similarity

API ID: ClassMessageNameSend_memmove
String ID: ComboBox$ListBox
API String ID: 372448540-1403004172
Opcode ID: cb2124e775e110ff543aef7d5ccc7f233719af6fef308ad4874d2c8d4b82b7ea
Instruction ID: be5ac923e922540e8c218ae6237f33af7c2ec585244aa65cb3db939fd06f6aea
Opcode Fuzzy Hash: cb2124e775e110ff543aef7d5ccc7f233719af6fef308ad4874d2c8d4b82b7ea
Instruction Fuzzy Hash: C401DFB6A42108ABDF14EBA4D956EFE73A89F51341F50011EB942A3281DA585E0CD6B1

Function 0079993A Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 49windowCOMMON

Download Yara Rule

APIs

Part of subcall function 00751A36: _memmove.LIBCMT ref: 00751A77

Part of subcall function 0079B79A: GetClassNameW.USER32(?,?,000000FF), ref: 0079B7BD

SendMessageW.USER32(?,00000182,?,00000000), ref: 007999A6

Strings

ListBox, xrefs: 00799972
ComboBox, xrefs: 00799947

Memory Dump Source

Source File: 0000000A.00000002.2894756195.0000000000741000.00000020.00000001.01000000.00000006.sdmp, Offset: 00740000, based on PE: true

Associated: 0000000A.00000002.2894716076.0000000000740000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.2894810207.00000000007D0000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.2894810207.00000000007F6000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.2894865972.0000000000800000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.2894887053.0000000000809000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_740000_Launches.jbxd

Similarity

API ID: ClassMessageNameSend_memmove
String ID: ComboBox$ListBox
API String ID: 372448540-1403004172
Opcode ID: b0facca8c229e46ed49d822d2d705599037baa7f57679b7e4948f450d1d5804d
Instruction ID: 39598cf056add746e969261e07325e896f6cd8e67ef2c3d04c09dff7e722b060
Opcode Fuzzy Hash: b0facca8c229e46ed49d822d2d705599037baa7f57679b7e4948f450d1d5804d
Instruction Fuzzy Hash: 4401F2B2A4210CAADF10EBB4DA06FFE73AC9F51351F50011ABD45A3281DA6D9E0CD6B1

Function 007A54E3 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 29COMMON

Download Yara Rule

APIs

GetClassNameW.USER32(?,?,00000100), ref: 007A5501
_wcscmp.LIBCMT ref: 007A5513

Strings

#32770, xrefs: 007A550D

Memory Dump Source

Source File: 0000000A.00000002.2894756195.0000000000741000.00000020.00000001.01000000.00000006.sdmp, Offset: 00740000, based on PE: true

Associated: 0000000A.00000002.2894716076.0000000000740000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.2894810207.00000000007D0000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.2894810207.00000000007F6000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.2894865972.0000000000800000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.2894887053.0000000000809000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_740000_Launches.jbxd

Similarity

API ID: ClassName_wcscmp
String ID: #32770
API String ID: 2292705959-463685578
Opcode ID: 9017fe780d33ed2a3517e4c3f8622bb6048f6784d04448a488ebaefe86bbe040
Instruction ID: 407579911bb125bc45b31b5350d0c91447194203d9209765267058b05ee01b9c
Opcode Fuzzy Hash: 9017fe780d33ed2a3517e4c3f8622bb6048f6784d04448a488ebaefe86bbe040
Instruction Fuzzy Hash: E1E06872A0022C6BD720AB99EC49FABFBBCEB55731F000017FD04D7051EA64EA4087E0

Function 00798892 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 22windowCOMMON

Download Yara Rule

APIs

MessageBoxW.USER32(00000000,Error allocating memory.,AutoIt,00000010), ref: 007988A0

Part of subcall function 00763588: _doexit.LIBCMT ref: 00763592

Strings

AutoIt, xrefs: 00798894
Error allocating memory., xrefs: 00798899

Memory Dump Source

Source File: 0000000A.00000002.2894756195.0000000000741000.00000020.00000001.01000000.00000006.sdmp, Offset: 00740000, based on PE: true

Associated: 0000000A.00000002.2894716076.0000000000740000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.2894810207.00000000007D0000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.2894810207.00000000007F6000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.2894865972.0000000000800000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.2894887053.0000000000809000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_740000_Launches.jbxd

Similarity

API ID: Message_doexit
String ID: AutoIt$Error allocating memory.
API String ID: 1993061046-4017498283
Opcode ID: 6f0e8c9b5c0448aa780dc145d54ab30ee3f6dfda3e40faee07c66a66d1452d5a
Instruction ID: e69cbf7ac17b22cbd9ff311e01699894678bb87d30790074f6ca043da2a96837
Opcode Fuzzy Hash: 6f0e8c9b5c0448aa780dc145d54ab30ee3f6dfda3e40faee07c66a66d1452d5a
Instruction Fuzzy Hash: 3CD0C2B138135872C21032A86C0EFEA2A488B05B51F004026BF08651C349DD899181E6

Function 00780251 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 21COMMON

Download Yara Rule

APIs

GetSystemDirectoryW.KERNEL32(?), ref: 00780091

Part of subcall function 007BC6D9: LoadLibraryA.KERNEL32(kernel32.dll,?,0078027A,?), ref: 007BC6E7
Part of subcall function 007BC6D9: GetProcAddress.KERNEL32(00000000,GetSystemWow64DirectoryW), ref: 007BC6F9

FreeLibrary.KERNEL32(00000000,?,?,?,?,?,?,?,?,?,?,?,?,?,00000104), ref: 00780289

Strings

WIN_XPe, xrefs: 007800A4

Memory Dump Source

Source File: 0000000A.00000002.2894756195.0000000000741000.00000020.00000001.01000000.00000006.sdmp, Offset: 00740000, based on PE: true

Associated: 0000000A.00000002.2894716076.0000000000740000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.2894810207.00000000007D0000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.2894810207.00000000007F6000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.2894865972.0000000000800000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000A.00000002.2894887053.0000000000809000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_740000_Launches.jbxd

Similarity

API ID: Library$AddressDirectoryFreeLoadProcSystem
String ID: WIN_XPe
API String ID: 582185067-3257408948
Opcode ID: 4b78adc430529c20b2234514a6db3ac1a6928e286018b119c9d4512a72129573
Instruction ID: 50b8b0d78890e36d793d88834e6e41787892e0c896889f8a11ac56fc8a7f44e2
Opcode Fuzzy Hash: 4b78adc430529c20b2234514a6db3ac1a6928e286018b119c9d4512a72129573
Instruction Fuzzy Hash: 2EF03971845109DFCB95EBA1C988BECBBB8AB08300F245085E146A2190CB794F88CF60

Description:	This technique has been deprecated. Please use Command and Scripting Interpreter where appropriate.
Tactics:	Defense Evasion, Execution
Data Sources:
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may obtain and abuse credentials of existing accounts as a means of gaining Initial Access, Persistence, Privilege Escalation, or Defense Evasion. Compromised credentials may be used to bypass access controls placed on various resources on systems within the network and may even be used for persistent access to remote systems and externally available services, such as VPNs, Outlook Web Access, network devices, and remote desktop.Compromised credentials may also grant an adversary increased privilege to specific systems or access to restricted areas of the network. Adversaries may choose not to use malware or tools in conjunction with the legitimate access those credentials provide to make it harder to detect their presence.
Tactics:	Defense Evasion, Initial Access, Persistence, Privilege Escalation
Data Sources:	Logon Session: Logon Session Creation, Logon Session: Logon Session Metadata, User Account: User Account Authentication
Platforms:	Azure AD, Containers, Google Workspace, IaaS, Linux, macOS, Network, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse Windows Management Instrumentation (WMI) to execute malicious commands and payloads. WMI is an administration feature that provides a uniform environment to access Windows system components. The WMI service enables both local and remote access, though the latter is facilitated by Remote Services such as Distributed Component Object Model (DCOM) and Windows Remote Management (WinRM).Remote WMI over DCOM operates using port 135, whereas WMI over WinRM operates over port 5985 when using HTTP and 5986 for HTTPS.
Tactics:	Execution
Data Sources:	Command: Command Execution, Network Traffic: Network Connection Creation, Process: Process Creation, WMI: WMI Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may interact with the native OS application programming interface (API) to execute behaviors. Native APIs provide a controlled means of calling low-level OS services within the kernel, such as those involving hardware/devices, memory, and processes.These native APIs are leveraged by the OS during system boot (when other system components are not yet initialized) as well as carrying out tasks and requests during routine operations.
Tactics:	Execution
Data Sources:	Module: Module Load, Process: OS API Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may execute their own malicious payloads by side-loading DLLs. Similar to DLL Search Order Hijacking , side-loading involves hijacking which DLL a program loads. But rather than just planting the DLL within the search order of a program then waiting for the victim application to be invoked, adversaries may directly side-load their payloads by planting then invoking a legitimate application that executes their payload(s).
Tactics:	Defense Evasion, Persistence, Privilege Escalation
Data Sources:	File: File Creation, File: File Modification, Module: Module Load, Process: Process Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may exploit software vulnerabilities in an attempt to elevate privileges. Exploitation of a software vulnerability occurs when an adversary takes advantage of a programming error in a program, service, or within the operating system software or kernel itself to execute adversary-controlled code. Security constructs such as permission levels will often hinder access to information and use of certain techniques, so adversaries will likely need to perform privilege escalation to include use of software exploitation to circumvent those restrictions.
Tactics:	Privilege Escalation
Data Sources:	Driver: Driver Load, Process: Process Creation
Platforms:	Containers, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may modify access tokens to operate under a different user or system security context to perform actions and bypass access controls. Windows uses access tokens to determine the ownership of a running process. A user can manipulate access tokens to make a running process appear as though it is the child of a different process or belongs to someone other than the user that started the process. When this occurs, the process also takes on the security context associated with the new token.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	Active Directory: Active Directory Object Modification, Command: Command Execution, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, User Account: User Account Metadata
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	File: File Metadata, File: File Modification, Module: Module Load, Process: OS API Execution, Process: Process Access, Process: Process Metadata, Process: Process Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may modify and/or disable security tools to avoid possible detection of their malware/tools and activities. This may take many forms, such as killing security software processes or services, modifying / deleting Registry keys or configuration files so that tools do not operate properly, or other methods to interfere with security tools scanning or reporting information. Adversaries may also disable updates to prevent the latest security patches from reaching tools on victim systems.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, Driver: Driver Load, Process: Process Creation, Process: Process Termination, Sensor Health: Host Status, Service: Service Metadata, Windows Registry: Windows Registry Key Deletion, Windows Registry: Windows Registry Key Modification
Platforms:	Containers, IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use Obfuscated Files or Information to hide artifacts of an intrusion from analysis. They may require separate mechanisms to decode or deobfuscate that information depending on how they intend to use it. Methods for doing that include built-in functionality of malware or by using utilities present on the system.
Tactics:	Defense Evasion
Data Sources:	File: File Modification, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit. This is common behavior that can be used across different platforms and the network to evade defenses.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Creation, File: File Metadata, Module: Module Load, Process: OS API Execution, Process: Process Creation, Script: Script Execution, WMI: WMI Creation, Windows Registry: Windows Registry Key Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may install a root certificate on a compromised system to avoid warnings when connecting to adversary controlled web servers. Root certificates are used in public key cryptography to identify a root certificate authority (CA). When a root certificate is installed, the system or application will trust certificates in the root's chain of trust that have been signed by the root certificate.Certificates are commonly used for establishing secure TLS/SSL communications within a web browser. When a user attempts to browse a website that presents a certificate that is not trusted an error message will be displayed to warn the user of the security risk. Depending on the security settings, the browser may not allow the user to establish a connection to the website.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, Process: Process Creation, Windows Registry: Windows Registry Key Creation, Windows Registry: Windows Registry Key Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to manipulate features of their artifacts to make them appear legitimate or benign to users and/or security tools. Masquerading occurs when the name or location of an object, legitimate or malicious, is manipulated or abused for the sake of evading defenses and observation. This may include manipulating file metadata, tricking users into misidentifying the file type, and giving legitimate task or service names.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Metadata, File: File Modification, Image: Image Metadata, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, Scheduled Job: Scheduled Job Metadata, Scheduled Job: Scheduled Job Modification, Service: Service Creation, Service: Service Metadata
Platforms:	Containers, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ various means to detect and avoid virtualization and analysis environments. This may include changing behaviors based on the results of checks for the presence of artifacts indicative of a virtual machine environment (VME) or sandbox. If the adversary detects a VME, they may alter their malware to disengage from the victim or conceal the core functions of the implant. They may also search for VME artifacts before dropping secondary or additional payloads. Adversaries may use the information learned from [Virtualization/Sandbox Evasion](https://attack.mitre.org/techniques/T1497) during automated discovery to shape follow-on behaviors.
Tactics:	Defense Evasion, Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use methods of capturing user input to obtain credentials or collect information. During normal system usage, users often provide credentials to various different locations, such as login pages/portals or system dialog boxes. Input capture mechanisms may be transparent to the user (e.g. Credential API Hooking ) or rely on deceiving the user into providing input into what they believe to be a genuine service (e.g. Web Portal Capture ).
Tactics:	Collection, Credential Access
Data Sources:	Driver: Driver Load, File: File Modification, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, Windows Registry: Windows Registry Key Modification
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may gather the system time and/or time zone from a local or remote system. The system time is set and stored by the Windows Time Service within a domain to maintain time synchronization between systems and services in an enterprise network.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of valid accounts, usernames, or email addresses on a system or within a compromised environment. This information can help adversaries determine which accounts exist, which can aid in follow-on behavior such as brute-forcing, spear-phishing attacks, or account takeovers (e.g., Valid Accounts ).
Tactics:	Discovery
Data Sources:	Command: Command Execution, File: File Access, Process: Process Creation
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may enumerate files and directories or may search in specific locations of a host or network share for certain information within a file system. Adversaries may use the information from File and Directory Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may interact with the Windows Registry to gather information about the system, configuration, and installed software.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation, Windows Registry: Windows Registry Key Access
Platforms:	Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report GOmRjFSKNz.exe

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Threat Intel

Malware Configuration

Threatname: RedLine

Yara Signatures

Memory Dumps

Unpacked PEs

Sigma Signatures

System Summary

HIPS / PFW / Operating System Protection Evasion

Suricata Signatures

Joe Sandbox Signatures

AV Detection

Compliance

Spreading

Networking

Key, Mouse, Clipboard, Microphone and Screen Capturing

E-Banking Fraud

System Summary

Data Obfuscation

Persistence and Installation Behavior

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

Anti Debugging

HIPS / PFW / Operating System Protection Evasion

Language, Device and Operating System Detection

Stealing of Sensitive Information

Remote Access Functionality

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

Contacted URLs

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

General Information

Warnings

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

C:\Users\Public\Desktop\Google Chrome.lnk

C:\Users\user\AppData\Local\Temp\72076\Launches.pif

C:\Users\user\AppData\Local\Temp\72076\RegAsm.exe

C:\Users\user\AppData\Local\Temp\72076\s

C:\Users\user\AppData\Local\Temp\An

C:\Users\user\AppData\Local\Temp\Carol

C:\Users\user\AppData\Local\Temp\Indoor

C:\Users\user\AppData\Local\Temp\Passed

C:\Users\user\AppData\Local\Temp\Pediatric

C:\Users\user\AppData\Local\Temp\Pediatric.bat (copy)

C:\Users\user\AppData\Local\Temp\Strap

C:\Users\user\AppData\Local\Temp\Tmp90E.tmp

Windows Analysis Report
GOmRjFSKNz.exe

Description:	Adversaries may attempt to get information about running processes on a system. Information obtained could be used to gain an understanding of common software/applications running on systems within the network. Adversaries may use the information from Process Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to identify the primary user, currently logged in user, set of users that commonly uses a system, or whether a user is actively using the system. They may do this, for example, by retrieving account usernames or by using OS Credential Dumping . The information may be collected in a number of different ways using other Discovery techniques, because user and username details are prevalent throughout a system and include running process ownership, file/directory ownership, session information, and system logs. Adversaries may use the information from [System Owner/User Discovery](https://attack.mitre.org/techniques/T1033) during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Active Directory: Active Directory Object Access, Command: Command Execution, File: File Access, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow, Process: OS API Execution, Process: Process Access, Process: Process Creation, Windows Registry: Windows Registry Key Access
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may compress and/or encrypt data that is collected prior to exfiltration. Compressing the data can help to obfuscate the collected data and minimize the amount of data sent over the network. Encryption can be used to hide information that is being exfiltrated from detection or make exfiltration less conspicuous upon inspection by a defender.
Tactics:	Collection
Data Sources:	Command: Command Execution, File: File Creation, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may collect data stored in the clipboard from users copying information within or between applications.
Tactics:	Collection
Data Sources:	Command: Command Execution, Process: OS API Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may transfer tools or other files from an external system into a compromised environment. Tools or files may be copied from an external adversary-controlled system to the victim network through the command and control channel or through alternate protocols such as ftp . Once present, adversaries may also transfer/spread tools between victim devices within a compromised environment (i.e. Lateral Tool Transfer ).
Tactics:	Command and Control
Data Sources:	Command: Command Execution, File: File Creation, Network Traffic: Network Connection Creation, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ a known encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Despite the use of a secure algorithm, these implementations may be vulnerable to reverse engineering if secret keys are encoded and/or generated within malware samples/configuration files.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using a protocol and port pairing that are typically not associated. For example, HTTPS over port 8088or port 587as opposed to the traditional port 443. Adversaries may make changes to the standard port used by a protocol to bypass filtering or muddle analysis/parsing of network data.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use an OSI non-application layer protocol for communication between host and C2 server or among infected hosts within a network. The list of possible protocols is extensive.Specific examples include use of network layer protocols, such as the Internet Control Message Protocol (ICMP), transport layer protocols, such as the User Datagram Protocol (UDP), session layer protocols, such as Socket Secure (SOCKS), as well as redirected/tunneled protocols, such as Serial over LAN (SOL).
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using OSI application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may shutdown/reboot systems to interrupt access to, or aid in the destruction of, those systems. Operating systems may contain commands to initiate a shutdown/reboot of a machine or network device. In some cases, these commands may also be used to initiate a shutdown/reboot of a remote computer or network device via Network Device CLI (e.g. `reload` ).
Tactics:	Impact
Data Sources:	Command: Command Execution, Process: Process Creation, Sensor Health: Host Status
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre