Edit tour

Windows Analysis Report
18112024_Dokman_1 Kas_m 2024- Avans_T24-2112184_dekont.exe

Overview

General Information

Sample name:	18112024_Dokman_1 Kas_m 2024- Avans_T24-2112184_dekont.exe
Analysis ID:	1559138
MD5:	c559b0a76b256e3537598031eaf17c34
SHA1:	3d079a42ee7110ec7389bb4b28bd572a8244bf52
SHA256:	08e931e2b4a954a57c72df289fbe2e4971a912e453b71f19d1859f1a350f9fba
Tags:	AgentTeslaexeuser-abuse_ch
Infos:

Detection

AgentTesla

Score:	100
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

Found malware configuration

Malicious sample detected (through community Yara rule)

Multi AV Scanner detection for submitted file

Yara detected AgentTesla

AI detected suspicious sample

Binary is likely a compiled AutoIt script file

Contains functionality to log keystrokes (.Net Source)

Contains functionality to register a low level keyboard hook

Installs a global keyboard hook

Machine Learning detection for sample

Maps a DLL or memory area into another process

Queries sensitive network adapter information (via WMI, Win32_NetworkAdapter, often done to detect virtual machines)

Switches to a custom stack to bypass stack traces

Tries to harvest and steal Putty / WinSCP information (sessions, passwords, etc)

Tries to harvest and steal browser information (history, passwords, etc)

Tries to harvest and steal ftp login credentials

Tries to steal Mail credentials (via file / registry access)

Writes to foreign memory regions

Contains functionality for read data from the clipboard

Contains functionality to block mouse and keyboard input (often used to hinder debugging)

Contains functionality to check if a debugger is running (IsDebuggerPresent)

Contains functionality to check if a debugger is running (OutputDebugString,GetLastError)

Contains functionality to check if a window is minimized (may be used to check if an application is visible)

Contains functionality to communicate with device drivers

Contains functionality to dynamically determine API calls

Contains functionality to execute programs as a different user

Contains functionality to launch a process as a different user

Contains functionality to launch a program with higher privileges

Contains functionality to modify clipboard data

Contains functionality to open a port and listen for incoming connection (possibly a backdoor)

Contains functionality to query CPU information (cpuid)

Contains functionality to read the PEB

Contains functionality to read the clipboard data

Contains functionality to retrieve information about pressed keystrokes

Contains functionality to shutdown / reboot the system

Contains functionality to simulate keystroke presses

Contains functionality to simulate mouse events

Contains functionality which may be used to detect a debugger (GetProcessHeap)

Contains long sleeps (>= 3 min)

Creates a process in suspended mode (likely to inject code)

Detected TCP or UDP traffic on non-standard ports

Detected potential crypto function

Extensive use of GetProcAddress (often used to hide API calls)

Found a high number of Window / User specific system calls (may be a loop to detect user behavior)

Found evaded block containing many API calls

Found large amount of non-executed APIs

Found potential string decryption / allocating functions

IP address seen in connection with other malware

OS version to string mapping found (often used in BOTs)

Queries sensitive BIOS Information (via WMI, Win32_Bios & Win32_BaseBoard, often done to detect virtual machines)

Queries sensitive processor information (via WMI, Win32_Processor, often done to detect virtual machines)

Queries the volume information (name, serial number etc) of a device

Sample file is different than original file name gathered from version info

Sigma detected: Suspicious Outbound SMTP Connections

Uses 32bit PE files

Uses SMTP (mail sending)

Uses code obfuscation techniques (call, push, ret)

Yara detected Credential Stealer

Yara signature match

Classification

Process Tree

System is w10x64

18112024_Dokman_1 Kas_m 2024- Avans_T24-2112184_dekont.exe (PID: 3812 cmdline: "C:\Users\user\Desktop\18112024_Dokman_1 Kas_m 2024- Avans_T24-2112184_dekont.exe" MD5: C559B0A76B256E3537598031EAF17C34)

RegSvcs.exe (PID: 6004 cmdline: "C:\Users\user\Desktop\18112024_Dokman_1 Kas_m 2024- Avans_T24-2112184_dekont.exe" MD5: 9D352BC46709F0CB5EC974633A0C3C94)

cleanup

Malware Threat Intel

Provided by

Name	Description	Attribution	Blogpost URLs	Link
Agent Tesla, AgentTesla	A .NET based information stealer readily available to actors due to leaked builders. The malware is able to log keystrokes, can access the host's clipboard and crawls the disk for credentials or other valuable information. It has the capability to send information back to its C&C via HTTP(S), SMTP, FTP, or towards a Telegram channel.	SWEED	http://blog.nsfocus.net/sweed-611/ http://l1v1ngc0d3.wordpress.com/2021/11/12/agenttesla-dropped-via-nsis-installer/ http://ropgadget.com/posts/originlogger.html http://www.secureworks.com/research/threat-profiles/gold-galleon https://0xmrmagnezi.github.io/malware%20analysis/AgentTesla/	https://malpedia.caad.fkie.fraunhofer.de/details/win.agent_tesla

Malware Configuration

Threatname: Agenttesla

{"Exfil Mode": "SMTP", "Port": "587", "Host": "zqamcx.com", "Username": "sender@zqamcx.com", "Password": "Methodman991"}

Yara Signatures

Memory Dumps

Source	Rule	Description	Author	Strings
00000002.00000002.3710089637.0000000002AF8000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
00000002.00000002.3710089637.0000000002ACE000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
00000002.00000002.3708338527.0000000000402000.00000040.80000000.00040000.00000000.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
00000002.00000002.3708338527.0000000000402000.00000040.80000000.00040000.00000000.sdmp	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
00000000.00000002.1263016513.0000000001060000.00000004.00001000.00020000.00000000.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
00000000.00000002.1263016513.0000000001060000.00000004.00001000.00020000.00000000.sdmp	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
00000000.00000002.1263016513.0000000001060000.00000004.00001000.00020000.00000000.sdmp	INDICATOR_SUSPICIOUS_EXE_VaultSchemaGUID	Detects executables referencing Windows vault credential objects. Observed in infostealers	ditekSHen	0x35005:$s1: 2F1A6504-0641-44CF-8BB5-3612D865F2E5 0x35077:$s2: 3CCD5499-87A8-4B10-A215-608888DD3B55 0x35101:$s3: 154E23D0-C644-4E6F-8CE6-5069272F999F 0x35193:$s4: 4BF4C442-9B8A-41A0-B380-DD4A704DDB28 0x351fd:$s5: 77BC582B-F0A6-4E15-4E80-61736B6F3B29 0x3526f:$s6: E69D7838-91B5-4FC9-89D5-230D4D4CC2BC 0x35305:$s7: 3E0E35BE-1B77-43E7-B873-AED901B6275B 0x35395:$s8: 3C886FF3-2669-4AA2-A8FB-3F6759A77548
00000002.00000002.3710089637.0000000002A81000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
00000002.00000002.3710089637.0000000002A81000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
Process Memory Space: 18112024_Dokman_1 Kas_m 2024- Avans_T24-2112184_dekont.exe PID: 3812	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
Process Memory Space: 18112024_Dokman_1 Kas_m 2024- Avans_T24-2112184_dekont.exe PID: 3812	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
Process Memory Space: RegSvcs.exe PID: 6004	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
Process Memory Space: RegSvcs.exe PID: 6004	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
Click to see the 8 entries

Unpacked PEs

Source	Rule	Description	Author	Strings
0.2.18112024_Dokman_1 Kas_m 2024- Avans_T24-2112184_dekont.exe.1060000.1.raw.unpack	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
0.2.18112024_Dokman_1 Kas_m 2024- Avans_T24-2112184_dekont.exe.1060000.1.raw.unpack	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
0.2.18112024_Dokman_1 Kas_m 2024- Avans_T24-2112184_dekont.exe.1060000.1.raw.unpack	INDICATOR_SUSPICIOUS_EXE_VaultSchemaGUID	Detects executables referencing Windows vault credential objects. Observed in infostealers	ditekSHen	0x35005:$s1: 2F1A6504-0641-44CF-8BB5-3612D865F2E5 0x35077:$s2: 3CCD5499-87A8-4B10-A215-608888DD3B55 0x35101:$s3: 154E23D0-C644-4E6F-8CE6-5069272F999F 0x35193:$s4: 4BF4C442-9B8A-41A0-B380-DD4A704DDB28 0x351fd:$s5: 77BC582B-F0A6-4E15-4E80-61736B6F3B29 0x3526f:$s6: E69D7838-91B5-4FC9-89D5-230D4D4CC2BC 0x35305:$s7: 3E0E35BE-1B77-43E7-B873-AED901B6275B 0x35395:$s8: 3C886FF3-2669-4AA2-A8FB-3F6759A77548
0.2.18112024_Dokman_1 Kas_m 2024- Avans_T24-2112184_dekont.exe.1060000.1.unpack	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
0.2.18112024_Dokman_1 Kas_m 2024- Avans_T24-2112184_dekont.exe.1060000.1.unpack	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
0.2.18112024_Dokman_1 Kas_m 2024- Avans_T24-2112184_dekont.exe.1060000.1.unpack	INDICATOR_SUSPICIOUS_EXE_VaultSchemaGUID	Detects executables referencing Windows vault credential objects. Observed in infostealers	ditekSHen	0x33205:$s1: 2F1A6504-0641-44CF-8BB5-3612D865F2E5 0x33277:$s2: 3CCD5499-87A8-4B10-A215-608888DD3B55 0x33301:$s3: 154E23D0-C644-4E6F-8CE6-5069272F999F 0x33393:$s4: 4BF4C442-9B8A-41A0-B380-DD4A704DDB28 0x333fd:$s5: 77BC582B-F0A6-4E15-4E80-61736B6F3B29 0x3346f:$s6: E69D7838-91B5-4FC9-89D5-230D4D4CC2BC 0x33505:$s7: 3E0E35BE-1B77-43E7-B873-AED901B6275B 0x33595:$s8: 3C886FF3-2669-4AA2-A8FB-3F6759A77548
2.2.RegSvcs.exe.400000.0.unpack	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
2.2.RegSvcs.exe.400000.0.unpack	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
2.2.RegSvcs.exe.400000.0.unpack	INDICATOR_SUSPICIOUS_EXE_VaultSchemaGUID	Detects executables referencing Windows vault credential objects. Observed in infostealers	ditekSHen	0x35005:$s1: 2F1A6504-0641-44CF-8BB5-3612D865F2E5 0x35077:$s2: 3CCD5499-87A8-4B10-A215-608888DD3B55 0x35101:$s3: 154E23D0-C644-4E6F-8CE6-5069272F999F 0x35193:$s4: 4BF4C442-9B8A-41A0-B380-DD4A704DDB28 0x351fd:$s5: 77BC582B-F0A6-4E15-4E80-61736B6F3B29 0x3526f:$s6: E69D7838-91B5-4FC9-89D5-230D4D4CC2BC 0x35305:$s7: 3E0E35BE-1B77-43E7-B873-AED901B6275B 0x35395:$s8: 3C886FF3-2669-4AA2-A8FB-3F6759A77548
Click to see the 4 entries

Sigma Signatures

System Summary

Sigma detected: Suspicious Outbound SMTP Connections

Source: Network Connection

Author: frack113: Data: DestinationIp: 78.110.166.82, DestinationIsIpv6: false, DestinationPort: 587, EventID: 3, Image: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe, Initiated: true, ProcessId: 6004, Protocol: tcp, SourceIp: 192.168.2.7, SourceIsIpv6: false, SourcePort: 49699

Suricata Signatures

⊘No Suricata rule has matched

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

AV Detection

Found malware configuration

Source: 2.2.RegSvcs.exe.400000.0.unpack

Malware Configuration Extractor: Agenttesla {"Exfil Mode": "SMTP", "Port": "587", "Host": "zqamcx.com", "Username": "sender@zqamcx.com", "Password": "Methodman991"}

Multi AV Scanner detection for submitted file

Source: 18112024_Dokman_1 Kas_m 2024- Avans_T24-2112184_dekont.exe

ReversingLabs: Detection: 50%

AI detected suspicious sample

Source: Submited Sample

Integrated Neural Analysis Model: Matched 99.9% probability

Machine Learning detection for sample

Source: 18112024_Dokman_1 Kas_m 2024- Avans_T24-2112184_dekont.exe

Joe Sandbox ML: detected

Source: 18112024_Dokman_1 Kas_m 2024- Avans_T24-2112184_dekont.exe

Static PE information: EXECUTABLE_IMAGE, LARGE_ADDRESS_AWARE, 32BIT_MACHINE

Source:	Binary string: wntdll.pdbUGP source: 18112024_Dokman_1 Kas_m 2024- Avans_T24-2112184_dekont.exe, 00000000.00000003.1261801092.0000000003BB0000.00000004.00001000.00020000.00000000.sdmp, 18112024_Dokman_1 Kas_m 2024- Avans_T24-2112184_dekont.exe, 00000000.00000003.1257205191.0000000003A10000.00000004.00001000.00020000.00000000.sdmp
Source:	Binary string: wntdll.pdb source: 18112024_Dokman_1 Kas_m 2024- Avans_T24-2112184_dekont.exe, 00000000.00000003.1261801092.0000000003BB0000.00000004.00001000.00020000.00000000.sdmp, 18112024_Dokman_1 Kas_m 2024- Avans_T24-2112184_dekont.exe, 00000000.00000003.1257205191.0000000003A10000.00000004.00001000.00020000.00000000.sdmp

Source: C:\Users\user\Desktop\18112024_Dokman_1 Kas_m 2024- Avans_T24-2112184_dekont.exe	Code function: 0_2_00E56CA9 GetFileAttributesW,FindFirstFileW,FindClose,	0_2_00E56CA9
Source: C:\Users\user\Desktop\18112024_Dokman_1 Kas_m 2024- Avans_T24-2112184_dekont.exe	Code function: 0_2_00E560DD _wcscat,_wcscat,__wsplitpath,FindFirstFileW,DeleteFileW,_wcscpy,_wcscat,_wcscat,lstrcmpiW,DeleteFileW,MoveFileW,MoveFileW,CopyFileW,DeleteFileW,CopyFileW,FindNextFileW,FindClose,FindClose,	0_2_00E560DD
Source: C:\Users\user\Desktop\18112024_Dokman_1 Kas_m 2024- Avans_T24-2112184_dekont.exe	Code function: 0_2_00E563F9 _wcscat,__wsplitpath,FindFirstFileW,_wcscpy,_wcscat,_wcscat,DeleteFileW,FindNextFileW,FindClose,	0_2_00E563F9
Source: C:\Users\user\Desktop\18112024_Dokman_1 Kas_m 2024- Avans_T24-2112184_dekont.exe	Code function: 0_2_00E5EB60 FindFirstFileW,_wcscmp,_wcscmp,FindNextFileW,FindClose,	0_2_00E5EB60
Source: C:\Users\user\Desktop\18112024_Dokman_1 Kas_m 2024- Avans_T24-2112184_dekont.exe	Code function: 0_2_00E5F5FA FindFirstFileW,FindClose,FileTimeToLocalFileTime,FileTimeToLocalFileTime,FileTimeToLocalFileTime,FileTimeToSystemTime,__swprintf,__swprintf,__swprintf,__swprintf,__swprintf,__swprintf,__swprintf,	0_2_00E5F5FA
Source: C:\Users\user\Desktop\18112024_Dokman_1 Kas_m 2024- Avans_T24-2112184_dekont.exe	Code function: 0_2_00E5F56F FindFirstFileW,FindClose,	0_2_00E5F56F
Source: C:\Users\user\Desktop\18112024_Dokman_1 Kas_m 2024- Avans_T24-2112184_dekont.exe	Code function: 0_2_00E61B2F SetCurrentDirectoryW,FindFirstFileW,FindFirstFileW,_wcscmp,_wcscmp,GetFileAttributesW,SetFileAttributesW,FindNextFileW,FindClose,FindFirstFileW,SetCurrentDirectoryW,_wcscmp,_wcscmp,SetCurrentDirectoryW,SetCurrentDirectoryW,FindNextFileW,FindClose,FindClose,	0_2_00E61B2F
Source: C:\Users\user\Desktop\18112024_Dokman_1 Kas_m 2024- Avans_T24-2112184_dekont.exe	Code function: 0_2_00E61C8A SetCurrentDirectoryW,FindFirstFileW,FindFirstFileW,_wcscmp,_wcscmp,FindNextFileW,FindClose,FindFirstFileW,SetCurrentDirectoryW,_wcscmp,_wcscmp,SetCurrentDirectoryW,SetCurrentDirectoryW,FindNextFileW,FindClose,FindClose,	0_2_00E61C8A
Source: C:\Users\user\Desktop\18112024_Dokman_1 Kas_m 2024- Avans_T24-2112184_dekont.exe	Code function: 0_2_00E61F94 FindFirstFileW,Sleep,_wcscmp,_wcscmp,FindNextFileW,FindClose,	0_2_00E61F94

Source: global traffic

TCP traffic: 192.168.2.7:49699 -> 78.110.166.82:587

Source: Joe Sandbox View

IP Address: 78.110.166.82 78.110.166.82

Source: global traffic

TCP traffic: 192.168.2.7:49699 -> 78.110.166.82:587

Source: unknown

UDP traffic detected without corresponding DNS query: 1.1.1.1

Source: C:\Users\user\Desktop\18112024_Dokman_1 Kas_m 2024- Avans_T24-2112184_dekont.exe

Code function: 0_2_00E64EB5 InternetReadFile,InternetQueryDataAvailable,InternetReadFile,

0_2_00E64EB5

Source: global traffic

DNS traffic detected: DNS query: zqamcx.com

Source: RegSvcs.exe, 00000002.00000002.3709303674.0000000000E62000.00000004.00000020.00020000.00000000.sdmp, RegSvcs.exe, 00000002.00000002.3712114621.0000000005DF0000.00000004.00000020.00020000.00000000.sdmp, RegSvcs.exe, 00000002.00000002.3710089637.0000000002ACE000.00000004.00000800.00020000.00000000.sdmp, RegSvcs.exe, 00000002.00000002.3710089637.0000000002B7F000.00000004.00000800.00020000.00000000.sdmp, RegSvcs.exe, 00000002.00000002.3712114621.0000000005E1D000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://r11.i.lencr.org/0#
Source: RegSvcs.exe, 00000002.00000002.3709303674.0000000000E62000.00000004.00000020.00020000.00000000.sdmp, RegSvcs.exe, 00000002.00000002.3712114621.0000000005DF0000.00000004.00000020.00020000.00000000.sdmp, RegSvcs.exe, 00000002.00000002.3710089637.0000000002ACE000.00000004.00000800.00020000.00000000.sdmp, RegSvcs.exe, 00000002.00000002.3710089637.0000000002B7F000.00000004.00000800.00020000.00000000.sdmp, RegSvcs.exe, 00000002.00000002.3712114621.0000000005E1D000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://r11.o.lencr.org0#
Source: RegSvcs.exe, 00000002.00000002.3709303674.0000000000E62000.00000004.00000020.00020000.00000000.sdmp, RegSvcs.exe, 00000002.00000002.3712114621.0000000005DF0000.00000004.00000020.00020000.00000000.sdmp, RegSvcs.exe, 00000002.00000002.3710089637.0000000002ACE000.00000004.00000800.00020000.00000000.sdmp, RegSvcs.exe, 00000002.00000002.3710089637.0000000002B7F000.00000004.00000800.00020000.00000000.sdmp, RegSvcs.exe, 00000002.00000002.3712114621.0000000005E1D000.00000004.00000020.00020000.00000000.sdmp, RegSvcs.exe, 00000002.00000002.3709303674.0000000000E27000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://x1.c.lencr.org/0
Source: RegSvcs.exe, 00000002.00000002.3709303674.0000000000E62000.00000004.00000020.00020000.00000000.sdmp, RegSvcs.exe, 00000002.00000002.3712114621.0000000005DF0000.00000004.00000020.00020000.00000000.sdmp, RegSvcs.exe, 00000002.00000002.3710089637.0000000002ACE000.00000004.00000800.00020000.00000000.sdmp, RegSvcs.exe, 00000002.00000002.3710089637.0000000002B7F000.00000004.00000800.00020000.00000000.sdmp, RegSvcs.exe, 00000002.00000002.3712114621.0000000005E1D000.00000004.00000020.00020000.00000000.sdmp, RegSvcs.exe, 00000002.00000002.3709303674.0000000000E27000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://x1.i.lencr.org/0
Source: RegSvcs.exe, 00000002.00000002.3710089637.0000000002ACE000.00000004.00000800.00020000.00000000.sdmp, RegSvcs.exe, 00000002.00000002.3710089637.0000000002B7F000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://zqamcx.com
Source: 18112024_Dokman_1 Kas_m 2024- Avans_T24-2112184_dekont.exe, 00000000.00000002.1263016513.0000000001060000.00000004.00001000.00020000.00000000.sdmp, RegSvcs.exe, 00000002.00000002.3708338527.0000000000402000.00000040.80000000.00040000.00000000.sdmp	String found in binary or memory: https://account.dyn.com/

Key, Mouse, Clipboard, Microphone and Screen Capturing

Contains functionality to log keystrokes (.Net Source)

Source: 0.2.18112024_Dokman_1 Kas_m 2024- Avans_T24-2112184_dekont.exe.1060000.1.raw.unpack, O9KGcRw9bkp.cs

.Net Code: KAZ

Contains functionality to register a low level keyboard hook

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe

Code function: 2_2_05EE0CA8 SetWindowsHookExA 0000000D,00000000,?,?,?,?,?,?,?,?,?,05EE25D8,00000000,00000000

2_2_05EE0CA8

Installs a global keyboard hook

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe

Windows user hook set: 0 keyboard low level C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe

Jump to behavior

Source: C:\Users\user\Desktop\18112024_Dokman_1 Kas_m 2024- Avans_T24-2112184_dekont.exe

Code function: 0_2_00E66B0C OpenClipboard,IsClipboardFormatAvailable,IsClipboardFormatAvailable,GetClipboardData,CloseClipboard,GlobalLock,CloseClipboard,GlobalUnlock,IsClipboardFormatAvailable,GetClipboardData,GlobalLock,GlobalUnlock,IsClipboardFormatAvailable,GetClipboardData,GlobalLock,DragQueryFileW,DragQueryFileW,DragQueryFileW,GlobalUnlock,CountClipboardFormats,CloseClipboard,

0_2_00E66B0C

Source: C:\Users\user\Desktop\18112024_Dokman_1 Kas_m 2024- Avans_T24-2112184_dekont.exe

Code function: 0_2_00E66D07 OpenClipboard,EmptyClipboard,GlobalAlloc,GlobalLock,_wcscpy,GlobalUnlock,OpenClipboard,EmptyClipboard,SetClipboardData,CloseClipboard,

0_2_00E66D07

Source: C:\Users\user\Desktop\18112024_Dokman_1 Kas_m 2024- Avans_T24-2112184_dekont.exe

0_2_00E66B0C

Source: C:\Users\user\Desktop\18112024_Dokman_1 Kas_m 2024- Avans_T24-2112184_dekont.exe

Code function: 0_2_00E52B37 GetKeyboardState,GetAsyncKeyState,GetKeyState,GetKeyState,GetAsyncKeyState,GetKeyState,GetAsyncKeyState,GetKeyState,GetAsyncKeyState,GetKeyState,GetAsyncKeyState,GetKeyState,

0_2_00E52B37

System Summary

Malicious sample detected (through community Yara rule)

Source: 0.2.18112024_Dokman_1 Kas_m 2024- Avans_T24-2112184_dekont.exe.1060000.1.raw.unpack, type: UNPACKEDPE	Matched rule: Detects executables referencing Windows vault credential objects. Observed in infostealers Author: ditekSHen
Source: 0.2.18112024_Dokman_1 Kas_m 2024- Avans_T24-2112184_dekont.exe.1060000.1.unpack, type: UNPACKEDPE	Matched rule: Detects executables referencing Windows vault credential objects. Observed in infostealers Author: ditekSHen
Source: 2.2.RegSvcs.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: Detects executables referencing Windows vault credential objects. Observed in infostealers Author: ditekSHen
Source: 00000000.00000002.1263016513.0000000001060000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: Detects executables referencing Windows vault credential objects. Observed in infostealers Author: ditekSHen

Binary is likely a compiled AutoIt script file

Source: C:\Users\user\Desktop\18112024_Dokman_1 Kas_m 2024- Avans_T24-2112184_dekont.exe	Code function: This is a third-party compiled AutoIt script.	0_2_00E13D19
Source: 18112024_Dokman_1 Kas_m 2024- Avans_T24-2112184_dekont.exe	String found in binary or memory: This is a third-party compiled AutoIt script.
Source: 18112024_Dokman_1 Kas_m 2024- Avans_T24-2112184_dekont.exe, 00000000.00000002.1262808979.0000000000EBE000.00000002.00000001.01000000.00000003.sdmp	String found in binary or memory: This is a third-party compiled AutoIt script.	memstr_e245c927-0
Source: 18112024_Dokman_1 Kas_m 2024- Avans_T24-2112184_dekont.exe, 00000000.00000002.1262808979.0000000000EBE000.00000002.00000001.01000000.00000003.sdmp	String found in binary or memory: SDSOFTWARE\Classes\\CLSID\\\IPC$This is a third-party compiled AutoIt script."runasError allocating memory.SeAssignPrimaryTokenPrivilegeSeIncreaseQuotaPrivilegeSeBackupPrivilegeSeRestorePrivilegewinsta0defaultwinsta0\defaultComboBoxListBox\|SHELLDLL_DefViewlargeiconsdetailssmalliconslistCLASSCLASSNNREGEXPCLASSIDNAMEXYWHINSTANCETEXT%s%u%s%dLAST[LASTACTIVE[ACTIVEHANDLE=[HANDLE:REGEXP=[REGEXPTITLE:CLASSNAME=[CLASS:ALL[ALL]HANDLEREGEXPTITLETITLEThumbnailClassAutoIt3GUIContainer	memstr_16925dda-5
Source: 18112024_Dokman_1 Kas_m 2024- Avans_T24-2112184_dekont.exe	String found in binary or memory: This is a third-party compiled AutoIt script.	memstr_ba24bdaa-6
Source: 18112024_Dokman_1 Kas_m 2024- Avans_T24-2112184_dekont.exe	String found in binary or memory: CSDSOFTWARE\Classes\\CLSID\\\IPC$This is a third-party compiled AutoIt script."runasError allocating memory.SeAssignPrimaryTokenPrivilegeSeIncreaseQuotaPrivilegeSeBackupPrivilegeSeRestorePrivilegewinsta0defaultwinsta0\defaultComboBoxListBox\|SHELLDLL_DefViewlargeiconsdetailssmalliconslistCLASSCLASSNNREGEXPCLASSIDNAMEXYWHINSTANCETEXT%s%u%s%dLAST[LASTACTIVE[ACTIVEHANDLE=[HANDLE:REGEXP=[REGEXPTITLE:CLASSNAME=[CLASS:ALL[ALL]HANDLEREGEXPTITLETITLEThumbnailClassAutoIt3GUIContainer	memstr_bdd2f195-a

Source: C:\Users\user\Desktop\18112024_Dokman_1 Kas_m 2024- Avans_T24-2112184_dekont.exe

Code function: 0_2_00E56685: CreateFileW,DeviceIoControl,CloseHandle,

0_2_00E56685

Source: C:\Users\user\Desktop\18112024_Dokman_1 Kas_m 2024- Avans_T24-2112184_dekont.exe

Code function: 0_2_00E4ACC5 _memset,DuplicateTokenEx,CloseHandle,OpenWindowStationW,GetProcessWindowStation,SetProcessWindowStation,OpenDesktopW,_wcscpy,LoadUserProfileW,CreateEnvironmentBlock,CreateProcessAsUserW,UnloadUserProfile,CloseWindowStation,CloseDesktop,SetProcessWindowStation,CloseHandle,DestroyEnvironmentBlock,

0_2_00E4ACC5

Source: C:\Users\user\Desktop\18112024_Dokman_1 Kas_m 2024- Avans_T24-2112184_dekont.exe

Code function: 0_2_00E579D3 ExitWindowsEx,InitiateSystemShutdownExW,SetSystemPowerState,

0_2_00E579D3

Source: C:\Users\user\Desktop\18112024_Dokman_1 Kas_m 2024- Avans_T24-2112184_dekont.exe	Code function: 0_2_00E3B043	0_2_00E3B043
Source: C:\Users\user\Desktop\18112024_Dokman_1 Kas_m 2024- Avans_T24-2112184_dekont.exe	Code function: 0_2_00E23200	0_2_00E23200
Source: C:\Users\user\Desktop\18112024_Dokman_1 Kas_m 2024- Avans_T24-2112184_dekont.exe	Code function: 0_2_00E23B70	0_2_00E23B70
Source: C:\Users\user\Desktop\18112024_Dokman_1 Kas_m 2024- Avans_T24-2112184_dekont.exe	Code function: 0_2_00E4410F	0_2_00E4410F
Source: C:\Users\user\Desktop\18112024_Dokman_1 Kas_m 2024- Avans_T24-2112184_dekont.exe	Code function: 0_2_00E302A4	0_2_00E302A4
Source: C:\Users\user\Desktop\18112024_Dokman_1 Kas_m 2024- Avans_T24-2112184_dekont.exe	Code function: 0_2_00E1E3B0	0_2_00E1E3B0
Source: C:\Users\user\Desktop\18112024_Dokman_1 Kas_m 2024- Avans_T24-2112184_dekont.exe	Code function: 0_2_00E4038E	0_2_00E4038E
Source: C:\Users\user\Desktop\18112024_Dokman_1 Kas_m 2024- Avans_T24-2112184_dekont.exe	Code function: 0_2_00E306D9	0_2_00E306D9
Source: C:\Users\user\Desktop\18112024_Dokman_1 Kas_m 2024- Avans_T24-2112184_dekont.exe	Code function: 0_2_00E4467F	0_2_00E4467F
Source: C:\Users\user\Desktop\18112024_Dokman_1 Kas_m 2024- Avans_T24-2112184_dekont.exe	Code function: 0_2_00E7AACE	0_2_00E7AACE
Source: C:\Users\user\Desktop\18112024_Dokman_1 Kas_m 2024- Avans_T24-2112184_dekont.exe	Code function: 0_2_00E44BEF	0_2_00E44BEF
Source: C:\Users\user\Desktop\18112024_Dokman_1 Kas_m 2024- Avans_T24-2112184_dekont.exe	Code function: 0_2_00E3CCC1	0_2_00E3CCC1
Source: C:\Users\user\Desktop\18112024_Dokman_1 Kas_m 2024- Avans_T24-2112184_dekont.exe	Code function: 0_2_00E1AF50	0_2_00E1AF50
Source: C:\Users\user\Desktop\18112024_Dokman_1 Kas_m 2024- Avans_T24-2112184_dekont.exe	Code function: 0_2_00E16F07	0_2_00E16F07
Source: C:\Users\user\Desktop\18112024_Dokman_1 Kas_m 2024- Avans_T24-2112184_dekont.exe	Code function: 0_2_00E3D1B9	0_2_00E3D1B9
Source: C:\Users\user\Desktop\18112024_Dokman_1 Kas_m 2024- Avans_T24-2112184_dekont.exe	Code function: 0_2_00E731BC	0_2_00E731BC
Source: C:\Users\user\Desktop\18112024_Dokman_1 Kas_m 2024- Avans_T24-2112184_dekont.exe	Code function: 0_2_00E2B11F	0_2_00E2B11F
Source: C:\Users\user\Desktop\18112024_Dokman_1 Kas_m 2024- Avans_T24-2112184_dekont.exe	Code function: 0_2_00E4724D	0_2_00E4724D
Source: C:\Users\user\Desktop\18112024_Dokman_1 Kas_m 2024- Avans_T24-2112184_dekont.exe	Code function: 0_2_00E3123A	0_2_00E3123A
Source: C:\Users\user\Desktop\18112024_Dokman_1 Kas_m 2024- Avans_T24-2112184_dekont.exe	Code function: 0_2_00E193F0	0_2_00E193F0
Source: C:\Users\user\Desktop\18112024_Dokman_1 Kas_m 2024- Avans_T24-2112184_dekont.exe	Code function: 0_2_00E513CA	0_2_00E513CA
Source: C:\Users\user\Desktop\18112024_Dokman_1 Kas_m 2024- Avans_T24-2112184_dekont.exe	Code function: 0_2_00E2F563	0_2_00E2F563
Source: C:\Users\user\Desktop\18112024_Dokman_1 Kas_m 2024- Avans_T24-2112184_dekont.exe	Code function: 0_2_00E196C0	0_2_00E196C0
Source: C:\Users\user\Desktop\18112024_Dokman_1 Kas_m 2024- Avans_T24-2112184_dekont.exe	Code function: 0_2_00E5B6CC	0_2_00E5B6CC
Source: C:\Users\user\Desktop\18112024_Dokman_1 Kas_m 2024- Avans_T24-2112184_dekont.exe	Code function: 0_2_00E177B0	0_2_00E177B0
Source: C:\Users\user\Desktop\18112024_Dokman_1 Kas_m 2024- Avans_T24-2112184_dekont.exe	Code function: 0_2_00E479C9	0_2_00E479C9
Source: C:\Users\user\Desktop\18112024_Dokman_1 Kas_m 2024- Avans_T24-2112184_dekont.exe	Code function: 0_2_00E2FA57	0_2_00E2FA57
Source: C:\Users\user\Desktop\18112024_Dokman_1 Kas_m 2024- Avans_T24-2112184_dekont.exe	Code function: 0_2_00E19B60	0_2_00E19B60
Source: C:\Users\user\Desktop\18112024_Dokman_1 Kas_m 2024- Avans_T24-2112184_dekont.exe	Code function: 0_2_00E17D19	0_2_00E17D19
Source: C:\Users\user\Desktop\18112024_Dokman_1 Kas_m 2024- Avans_T24-2112184_dekont.exe	Code function: 0_2_00E39ED0	0_2_00E39ED0
Source: C:\Users\user\Desktop\18112024_Dokman_1 Kas_m 2024- Avans_T24-2112184_dekont.exe	Code function: 0_2_00E2FE6F	0_2_00E2FE6F
Source: C:\Users\user\Desktop\18112024_Dokman_1 Kas_m 2024- Avans_T24-2112184_dekont.exe	Code function: 0_2_00E17FA3	0_2_00E17FA3
Source: C:\Users\user\Desktop\18112024_Dokman_1 Kas_m 2024- Avans_T24-2112184_dekont.exe	Code function: 0_2_01117418	0_2_01117418
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 2_2_02939380	2_2_02939380
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 2_2_0293F4B8	2_2_0293F4B8
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 2_2_02934A88	2_2_02934A88
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 2_2_02939B40	2_2_02939B40
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 2_2_02933E70	2_2_02933E70
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 2_2_0293CDC0	2_2_0293CDC0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 2_2_029341B8	2_2_029341B8
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 2_2_02931E40	2_2_02931E40
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 2_2_05EEC900	2_2_05EEC900
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 2_2_05EE13E8	2_2_05EE13E8
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 2_2_05F0DDA8	2_2_05F0DDA8
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 2_2_05F08C20	2_2_05F08C20
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 2_2_05F05768	2_2_05F05768
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 2_2_05F03F40	2_2_05F03F40
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 2_2_05F00040	2_2_05F00040
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 2_2_05F02B08	2_2_05F02B08
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 2_2_05F0BD98	2_2_05F0BD98
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 2_2_05F049F0	2_2_05F049F0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 2_2_05F05070	2_2_05F05070
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 2_2_05F03248	2_2_05F03248

Source: C:\Users\user\Desktop\18112024_Dokman_1 Kas_m 2024- Avans_T24-2112184_dekont.exe	Code function: String function: 00E2EC2F appears 68 times
Source: C:\Users\user\Desktop\18112024_Dokman_1 Kas_m 2024- Avans_T24-2112184_dekont.exe	Code function: String function: 00E3F8A0 appears 35 times
Source: C:\Users\user\Desktop\18112024_Dokman_1 Kas_m 2024- Avans_T24-2112184_dekont.exe	Code function: String function: 00E36AC0 appears 42 times

Source: 18112024_Dokman_1 Kas_m 2024- Avans_T24-2112184_dekont.exe, 00000000.00000003.1254236955.0000000003AE3000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamentdll.dllj% vs 18112024_Dokman_1 Kas_m 2024- Avans_T24-2112184_dekont.exe
Source: 18112024_Dokman_1 Kas_m 2024- Avans_T24-2112184_dekont.exe, 00000000.00000003.1257363223.0000000003CDD000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamentdll.dllj% vs 18112024_Dokman_1 Kas_m 2024- Avans_T24-2112184_dekont.exe
Source: 18112024_Dokman_1 Kas_m 2024- Avans_T24-2112184_dekont.exe, 00000000.00000002.1263016513.0000000001060000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameb9cb78e8-c1d3-4ab9-8530-a3a5b5ca79e5.exe4 vs 18112024_Dokman_1 Kas_m 2024- Avans_T24-2112184_dekont.exe

Source: 18112024_Dokman_1 Kas_m 2024- Avans_T24-2112184_dekont.exe

Static PE information: EXECUTABLE_IMAGE, LARGE_ADDRESS_AWARE, 32BIT_MACHINE

Source: 0.2.18112024_Dokman_1 Kas_m 2024- Avans_T24-2112184_dekont.exe.1060000.1.raw.unpack, type: UNPACKEDPE	Matched rule: INDICATOR_SUSPICIOUS_EXE_VaultSchemaGUID author = ditekSHen, description = Detects executables referencing Windows vault credential objects. Observed in infostealers
Source: 0.2.18112024_Dokman_1 Kas_m 2024- Avans_T24-2112184_dekont.exe.1060000.1.unpack, type: UNPACKEDPE	Matched rule: INDICATOR_SUSPICIOUS_EXE_VaultSchemaGUID author = ditekSHen, description = Detects executables referencing Windows vault credential objects. Observed in infostealers
Source: 2.2.RegSvcs.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: INDICATOR_SUSPICIOUS_EXE_VaultSchemaGUID author = ditekSHen, description = Detects executables referencing Windows vault credential objects. Observed in infostealers
Source: 00000000.00000002.1263016513.0000000001060000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: INDICATOR_SUSPICIOUS_EXE_VaultSchemaGUID author = ditekSHen, description = Detects executables referencing Windows vault credential objects. Observed in infostealers

Source: 0.2.18112024_Dokman_1 Kas_m 2024- Avans_T24-2112184_dekont.exe.1060000.1.raw.unpack, CMa60k.cs	Cryptographic APIs: 'TransformFinalBlock'
Source: 0.2.18112024_Dokman_1 Kas_m 2024- Avans_T24-2112184_dekont.exe.1060000.1.raw.unpack, CMa60k.cs	Cryptographic APIs: 'TransformFinalBlock'
Source: 0.2.18112024_Dokman_1 Kas_m 2024- Avans_T24-2112184_dekont.exe.1060000.1.raw.unpack, CMa60k.cs	Cryptographic APIs: 'TransformFinalBlock'
Source: 0.2.18112024_Dokman_1 Kas_m 2024- Avans_T24-2112184_dekont.exe.1060000.1.raw.unpack, CMa60k.cs	Cryptographic APIs: 'TransformFinalBlock'
Source: 0.2.18112024_Dokman_1 Kas_m 2024- Avans_T24-2112184_dekont.exe.1060000.1.raw.unpack, EgTglEucnUn.cs	Cryptographic APIs: 'TransformFinalBlock'
Source: 0.2.18112024_Dokman_1 Kas_m 2024- Avans_T24-2112184_dekont.exe.1060000.1.raw.unpack, EgTglEucnUn.cs	Cryptographic APIs: 'TransformFinalBlock'
Source: 0.2.18112024_Dokman_1 Kas_m 2024- Avans_T24-2112184_dekont.exe.1060000.1.raw.unpack, MmVR.cs	Cryptographic APIs: 'TransformFinalBlock'
Source: 0.2.18112024_Dokman_1 Kas_m 2024- Avans_T24-2112184_dekont.exe.1060000.1.raw.unpack, MmVR.cs	Cryptographic APIs: 'TransformFinalBlock', 'CreateDecryptor'

Source: classification engine

Classification label: mal100.troj.spyw.evad.winEXE@3/2@1/1

Source: C:\Users\user\Desktop\18112024_Dokman_1 Kas_m 2024- Avans_T24-2112184_dekont.exe

Code function: 0_2_00E5CE7A GetLastError,FormatMessageW,

0_2_00E5CE7A

Source: C:\Users\user\Desktop\18112024_Dokman_1 Kas_m 2024- Avans_T24-2112184_dekont.exe	Code function: 0_2_00E4AB84 AdjustTokenPrivileges,CloseHandle,		0_2_00E4AB84
Source: C:\Users\user\Desktop\18112024_Dokman_1 Kas_m 2024- Avans_T24-2112184_dekont.exe	Code function: 0_2_00E4B134 LookupPrivilegeValueW,AdjustTokenPrivileges,GetLastError,		0_2_00E4B134

Source: C:\Users\user\Desktop\18112024_Dokman_1 Kas_m 2024- Avans_T24-2112184_dekont.exe

Code function: 0_2_00E5E1FD SetErrorMode,GetDiskFreeSpaceExW,SetErrorMode,

0_2_00E5E1FD

Source: C:\Users\user\Desktop\18112024_Dokman_1 Kas_m 2024- Avans_T24-2112184_dekont.exe

Code function: 0_2_00E56532 CreateToolhelp32Snapshot,Process32FirstW,Process32NextW,__wsplitpath,_wcscat,CloseHandle,

0_2_00E56532

Source: C:\Users\user\Desktop\18112024_Dokman_1 Kas_m 2024- Avans_T24-2112184_dekont.exe

Code function: 0_2_00E6C18C CoInitializeSecurity,_memset,_memset,CoCreateInstanceEx,CoTaskMemFree,CoSetProxyBlanket,

0_2_00E6C18C

Source: C:\Users\user\Desktop\18112024_Dokman_1 Kas_m 2024- Avans_T24-2112184_dekont.exe

Code function: 0_2_00E1406B CreateStreamOnHGlobal,FindResourceExW,LoadResource,SizeofResource,LockResource,

0_2_00E1406B

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe

Mutant created: NULL

Source: C:\Users\user\Desktop\18112024_Dokman_1 Kas_m 2024- Avans_T24-2112184_dekont.exe

File created: C:\Users\user~1\AppData\Local\Temp\aut745C.tmp

Jump to behavior

Source: 18112024_Dokman_1 Kas_m 2024- Avans_T24-2112184_dekont.exe

Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_Processor
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe

File read: C:\Users\user\AppData\Roaming\Mozilla\Firefox\profiles.ini

Jump to behavior

Source: C:\Users\user\Desktop\18112024_Dokman_1 Kas_m 2024- Avans_T24-2112184_dekont.exe

Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: 18112024_Dokman_1 Kas_m 2024- Avans_T24-2112184_dekont.exe

ReversingLabs: Detection: 50%

Source: unknown	Process created: C:\Users\user\Desktop\18112024_Dokman_1 Kas_m 2024- Avans_T24-2112184_dekont.exe "C:\Users\user\Desktop\18112024_Dokman_1 Kas_m 2024- Avans_T24-2112184_dekont.exe"
Source: C:\Users\user\Desktop\18112024_Dokman_1 Kas_m 2024- Avans_T24-2112184_dekont.exe	Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe "C:\Users\user\Desktop\18112024_Dokman_1 Kas_m 2024- Avans_T24-2112184_dekont.exe"
Source: C:\Users\user\Desktop\18112024_Dokman_1 Kas_m 2024- Avans_T24-2112184_dekont.exe	Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe "C:\Users\user\Desktop\18112024_Dokman_1 Kas_m 2024- Avans_T24-2112184_dekont.exe"	Jump to behavior

Source: C:\Users\user\Desktop\18112024_Dokman_1 Kas_m 2024- Avans_T24-2112184_dekont.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\Desktop\18112024_Dokman_1 Kas_m 2024- Avans_T24-2112184_dekont.exe	Section loaded: wsock32.dll	Jump to behavior
Source: C:\Users\user\Desktop\18112024_Dokman_1 Kas_m 2024- Avans_T24-2112184_dekont.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Users\user\Desktop\18112024_Dokman_1 Kas_m 2024- Avans_T24-2112184_dekont.exe	Section loaded: winmm.dll	Jump to behavior
Source: C:\Users\user\Desktop\18112024_Dokman_1 Kas_m 2024- Avans_T24-2112184_dekont.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Users\user\Desktop\18112024_Dokman_1 Kas_m 2024- Avans_T24-2112184_dekont.exe	Section loaded: wininet.dll	Jump to behavior
Source: C:\Users\user\Desktop\18112024_Dokman_1 Kas_m 2024- Avans_T24-2112184_dekont.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\18112024_Dokman_1 Kas_m 2024- Avans_T24-2112184_dekont.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Users\user\Desktop\18112024_Dokman_1 Kas_m 2024- Avans_T24-2112184_dekont.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Users\user\Desktop\18112024_Dokman_1 Kas_m 2024- Avans_T24-2112184_dekont.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\Desktop\18112024_Dokman_1 Kas_m 2024- Avans_T24-2112184_dekont.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Users\user\Desktop\18112024_Dokman_1 Kas_m 2024- Avans_T24-2112184_dekont.exe	Section loaded: wldp.dll	Jump to behavior

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{CF4CC405-E2C5-4DDD-B3CE-5E7582D8C9FA}\InprocServer32

Jump to behavior

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe

Key opened: HKEY_CURRENT_USER\Software\Microsoft\Office\11.0\Outlook\Profiles

Jump to behavior

Source: 18112024_Dokman_1 Kas_m 2024- Avans_T24-2112184_dekont.exe

Static file information: File size 1275392 > 1048576

Source: 18112024_Dokman_1 Kas_m 2024- Avans_T24-2112184_dekont.exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_IMPORT
Source: 18112024_Dokman_1 Kas_m 2024- Avans_T24-2112184_dekont.exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_RESOURCE
Source: 18112024_Dokman_1 Kas_m 2024- Avans_T24-2112184_dekont.exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_BASERELOC
Source: 18112024_Dokman_1 Kas_m 2024- Avans_T24-2112184_dekont.exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_DEBUG
Source: 18112024_Dokman_1 Kas_m 2024- Avans_T24-2112184_dekont.exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG
Source: 18112024_Dokman_1 Kas_m 2024- Avans_T24-2112184_dekont.exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_IAT

Source: 18112024_Dokman_1 Kas_m 2024- Avans_T24-2112184_dekont.exe

Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_DEBUG

Source:	Binary string: wntdll.pdbUGP source: 18112024_Dokman_1 Kas_m 2024- Avans_T24-2112184_dekont.exe, 00000000.00000003.1261801092.0000000003BB0000.00000004.00001000.00020000.00000000.sdmp, 18112024_Dokman_1 Kas_m 2024- Avans_T24-2112184_dekont.exe, 00000000.00000003.1257205191.0000000003A10000.00000004.00001000.00020000.00000000.sdmp
Source:	Binary string: wntdll.pdb source: 18112024_Dokman_1 Kas_m 2024- Avans_T24-2112184_dekont.exe, 00000000.00000003.1261801092.0000000003BB0000.00000004.00001000.00020000.00000000.sdmp, 18112024_Dokman_1 Kas_m 2024- Avans_T24-2112184_dekont.exe, 00000000.00000003.1257205191.0000000003A10000.00000004.00001000.00020000.00000000.sdmp

Source: 18112024_Dokman_1 Kas_m 2024- Avans_T24-2112184_dekont.exe	Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_IMPORT is in: .rdata
Source: 18112024_Dokman_1 Kas_m 2024- Avans_T24-2112184_dekont.exe	Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_RESOURCE is in: .rsrc
Source: 18112024_Dokman_1 Kas_m 2024- Avans_T24-2112184_dekont.exe	Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_BASERELOC is in: .reloc
Source: 18112024_Dokman_1 Kas_m 2024- Avans_T24-2112184_dekont.exe	Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG is in: .rdata
Source: 18112024_Dokman_1 Kas_m 2024- Avans_T24-2112184_dekont.exe	Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_IAT is in: .rdata

Source: C:\Users\user\Desktop\18112024_Dokman_1 Kas_m 2024- Avans_T24-2112184_dekont.exe

Code function: 0_2_00E2E01E LoadLibraryA,GetProcAddress,

0_2_00E2E01E

Source: C:\Users\user\Desktop\18112024_Dokman_1 Kas_m 2024- Avans_T24-2112184_dekont.exe	Code function: 0_2_00E36B05 push ecx; ret		0_2_00E36B18
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 2_2_05F03AD7 push ebx; retf		2_2_05F03ADA

Source: C:\Users\user\Desktop\18112024_Dokman_1 Kas_m 2024- Avans_T24-2112184_dekont.exe	Code function: 0_2_00E78111 IsWindowVisible,IsWindowEnabled,GetForegroundWindow,IsIconic,IsZoomed,		0_2_00E78111
Source: C:\Users\user\Desktop\18112024_Dokman_1 Kas_m 2024- Avans_T24-2112184_dekont.exe	Code function: 0_2_00E2EB42 GetForegroundWindow,FindWindowW,IsIconic,ShowWindow,SetForegroundWindow,GetWindowThreadProcessId,GetWindowThreadProcessId,GetCurrentThreadId,GetWindowThreadProcessId,AttachThreadInput,AttachThreadInput,AttachThreadInput,AttachThreadInput,SetForegroundWindow,MapVirtualKeyW,MapVirtualKeyW,keybd_event,keybd_event,MapVirtualKeyW,keybd_event,MapVirtualKeyW,keybd_event,MapVirtualKeyW,keybd_event,SetForegroundWindow,AttachThreadInput,AttachThreadInput,AttachThreadInput,AttachThreadInput,		0_2_00E2EB42

Source: C:\Users\user\Desktop\18112024_Dokman_1 Kas_m 2024- Avans_T24-2112184_dekont.exe

Code function: 0_2_00E3123A __initp_misc_winsig,GetModuleHandleW,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,

0_2_00E3123A

Source: C:\Users\user\Desktop\18112024_Dokman_1 Kas_m 2024- Avans_T24-2112184_dekont.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\18112024_Dokman_1 Kas_m 2024- Avans_T24-2112184_dekont.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior

Malware Analysis System Evasion

Queries sensitive network adapter information (via WMI, Win32_NetworkAdapter, often done to detect virtual machines)

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe

WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_NetworkAdapterConfiguration

Switches to a custom stack to bypass stack traces

Source: C:\Users\user\Desktop\18112024_Dokman_1 Kas_m 2024- Avans_T24-2112184_dekont.exe

API/Special instruction interceptor: Address: 111703C

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe

Thread delayed: delay time: 922337203685477

Jump to behavior

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Window / User API: threadDelayed 2169			Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Window / User API: threadDelayed 7631			Jump to behavior

Source: C:\Users\user\Desktop\18112024_Dokman_1 Kas_m 2024- Avans_T24-2112184_dekont.exe

Evaded block: after key decision

graph_0-95118

Source: C:\Users\user\Desktop\18112024_Dokman_1 Kas_m 2024- Avans_T24-2112184_dekont.exe

API coverage: 4.6 %

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe

WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_BaseBoard

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_Processor
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor

Source: C:\Users\user\Desktop\18112024_Dokman_1 Kas_m 2024- Avans_T24-2112184_dekont.exe	Code function: 0_2_00E56CA9 GetFileAttributesW,FindFirstFileW,FindClose,	0_2_00E56CA9
Source: C:\Users\user\Desktop\18112024_Dokman_1 Kas_m 2024- Avans_T24-2112184_dekont.exe	Code function: 0_2_00E560DD _wcscat,_wcscat,__wsplitpath,FindFirstFileW,DeleteFileW,_wcscpy,_wcscat,_wcscat,lstrcmpiW,DeleteFileW,MoveFileW,MoveFileW,CopyFileW,DeleteFileW,CopyFileW,FindNextFileW,FindClose,FindClose,	0_2_00E560DD
Source: C:\Users\user\Desktop\18112024_Dokman_1 Kas_m 2024- Avans_T24-2112184_dekont.exe	Code function: 0_2_00E563F9 _wcscat,__wsplitpath,FindFirstFileW,_wcscpy,_wcscat,_wcscat,DeleteFileW,FindNextFileW,FindClose,	0_2_00E563F9
Source: C:\Users\user\Desktop\18112024_Dokman_1 Kas_m 2024- Avans_T24-2112184_dekont.exe	Code function: 0_2_00E5EB60 FindFirstFileW,_wcscmp,_wcscmp,FindNextFileW,FindClose,	0_2_00E5EB60
Source: C:\Users\user\Desktop\18112024_Dokman_1 Kas_m 2024- Avans_T24-2112184_dekont.exe	Code function: 0_2_00E5F5FA FindFirstFileW,FindClose,FileTimeToLocalFileTime,FileTimeToLocalFileTime,FileTimeToLocalFileTime,FileTimeToSystemTime,__swprintf,__swprintf,__swprintf,__swprintf,__swprintf,__swprintf,__swprintf,	0_2_00E5F5FA
Source: C:\Users\user\Desktop\18112024_Dokman_1 Kas_m 2024- Avans_T24-2112184_dekont.exe	Code function: 0_2_00E5F56F FindFirstFileW,FindClose,	0_2_00E5F56F
Source: C:\Users\user\Desktop\18112024_Dokman_1 Kas_m 2024- Avans_T24-2112184_dekont.exe	Code function: 0_2_00E61B2F SetCurrentDirectoryW,FindFirstFileW,FindFirstFileW,_wcscmp,_wcscmp,GetFileAttributesW,SetFileAttributesW,FindNextFileW,FindClose,FindFirstFileW,SetCurrentDirectoryW,_wcscmp,_wcscmp,SetCurrentDirectoryW,SetCurrentDirectoryW,FindNextFileW,FindClose,FindClose,	0_2_00E61B2F
Source: C:\Users\user\Desktop\18112024_Dokman_1 Kas_m 2024- Avans_T24-2112184_dekont.exe	Code function: 0_2_00E61C8A SetCurrentDirectoryW,FindFirstFileW,FindFirstFileW,_wcscmp,_wcscmp,FindNextFileW,FindClose,FindFirstFileW,SetCurrentDirectoryW,_wcscmp,_wcscmp,SetCurrentDirectoryW,SetCurrentDirectoryW,FindNextFileW,FindClose,FindClose,	0_2_00E61C8A
Source: C:\Users\user\Desktop\18112024_Dokman_1 Kas_m 2024- Avans_T24-2112184_dekont.exe	Code function: 0_2_00E61F94 FindFirstFileW,Sleep,_wcscmp,_wcscmp,FindNextFileW,FindClose,	0_2_00E61F94

Source: C:\Users\user\Desktop\18112024_Dokman_1 Kas_m 2024- Avans_T24-2112184_dekont.exe

Code function: 0_2_00E2DDC0 GetVersionExW,GetCurrentProcess,FreeLibrary,GetNativeSystemInfo,FreeLibrary,FreeLibrary,GetSystemInfo,GetSystemInfo,

0_2_00E2DDC0

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 100000	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 99891	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 99766	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 99641	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 99531	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 99399	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 99295	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 99172	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 99036	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 98890	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 98781	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 98672	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 98562	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 98453	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 98344	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 98234	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 98125	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 98014	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 97906	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 97797	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 97682	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 97578	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 97469	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 97359	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 97250	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 97141	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 97031	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 96922	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 96812	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 96628	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 99875	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 99657	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 99532	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 99407	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 99282	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 99171	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 99063	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 98938	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 98813	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 98688	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 98563	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 98454	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 98329	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 98204	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 98079	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 97954	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 97829	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 97704	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 97579	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 97454	Jump to behavior

Source: RegSvcs.exe, 00000002.00000002.3712114621.0000000005DF0000.00000004.00000020.00020000.00000000.sdmp

Binary or memory string: Hyper-V RAW%SystemRoot%\system32\mswsock.dll

Source: C:\Users\user\Desktop\18112024_Dokman_1 Kas_m 2024- Avans_T24-2112184_dekont.exe	API call chain: ExitProcess graph end node			graph_0-94105
Source: C:\Users\user\Desktop\18112024_Dokman_1 Kas_m 2024- Avans_T24-2112184_dekont.exe	API call chain: ExitProcess graph end node			graph_0-95228

Source: C:\Users\user\Desktop\18112024_Dokman_1 Kas_m 2024- Avans_T24-2112184_dekont.exe

Code function: 0_2_00E66AAF BlockInput,

0_2_00E66AAF

Source: C:\Users\user\Desktop\18112024_Dokman_1 Kas_m 2024- Avans_T24-2112184_dekont.exe

Code function: 0_2_00E13D19 GetCurrentDirectoryW,IsDebuggerPresent,GetFullPathNameW,SetCurrentDirectoryW,MessageBoxA,SetCurrentDirectoryW,GetForegroundWindow,ShellExecuteW,

0_2_00E13D19

Source: C:\Users\user\Desktop\18112024_Dokman_1 Kas_m 2024- Avans_T24-2112184_dekont.exe

Code function: 0_2_00E43920 LoadLibraryExW,GetLastError,LoadLibraryW,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,IsDebuggerPresent,OutputDebugStringW,

0_2_00E43920

Source: C:\Users\user\Desktop\18112024_Dokman_1 Kas_m 2024- Avans_T24-2112184_dekont.exe

Code function: 0_2_00E2E01E LoadLibraryA,GetProcAddress,

0_2_00E2E01E

Source: C:\Users\user\Desktop\18112024_Dokman_1 Kas_m 2024- Avans_T24-2112184_dekont.exe	Code function: 0_2_01117308 mov eax, dword ptr fs:[00000030h]	0_2_01117308
Source: C:\Users\user\Desktop\18112024_Dokman_1 Kas_m 2024- Avans_T24-2112184_dekont.exe	Code function: 0_2_011172A8 mov eax, dword ptr fs:[00000030h]	0_2_011172A8
Source: C:\Users\user\Desktop\18112024_Dokman_1 Kas_m 2024- Avans_T24-2112184_dekont.exe	Code function: 0_2_01115C38 mov eax, dword ptr fs:[00000030h]	0_2_01115C38

Source: C:\Users\user\Desktop\18112024_Dokman_1 Kas_m 2024- Avans_T24-2112184_dekont.exe

Code function: 0_2_00E4A66C GetSecurityDescriptorDacl,_memset,GetAclInformation,GetLengthSid,GetAce,AddAce,GetLengthSid,GetProcessHeap,HeapAlloc,GetLengthSid,CopySid,AddAce,SetSecurityDescriptorDacl,SetUserObjectSecurity,

0_2_00E4A66C

Source: C:\Users\user\Desktop\18112024_Dokman_1 Kas_m 2024- Avans_T24-2112184_dekont.exe	Code function: 0_2_00E381AC SetUnhandledExceptionFilter,UnhandledExceptionFilter,		0_2_00E381AC
Source: C:\Users\user\Desktop\18112024_Dokman_1 Kas_m 2024- Avans_T24-2112184_dekont.exe	Code function: 0_2_00E38189 SetUnhandledExceptionFilter,		0_2_00E38189

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe

Memory allocated: page read and write | page guard

Jump to behavior

HIPS / PFW / Operating System Protection Evasion

Maps a DLL or memory area into another process

Source: C:\Users\user\Desktop\18112024_Dokman_1 Kas_m 2024- Avans_T24-2112184_dekont.exe

Section loaded: NULL target: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe protection: execute and read and write

Jump to behavior

Writes to foreign memory regions

Source: C:\Users\user\Desktop\18112024_Dokman_1 Kas_m 2024- Avans_T24-2112184_dekont.exe

Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe base: 99E008

Jump to behavior

Source: C:\Users\user\Desktop\18112024_Dokman_1 Kas_m 2024- Avans_T24-2112184_dekont.exe

Code function: 0_2_00E4B106 LogonUserW,

0_2_00E4B106

Source: C:\Users\user\Desktop\18112024_Dokman_1 Kas_m 2024- Avans_T24-2112184_dekont.exe

Code function: 0_2_00E13D19 GetCurrentDirectoryW,IsDebuggerPresent,GetFullPathNameW,SetCurrentDirectoryW,MessageBoxA,SetCurrentDirectoryW,GetForegroundWindow,ShellExecuteW,

0_2_00E13D19

Source: C:\Users\user\Desktop\18112024_Dokman_1 Kas_m 2024- Avans_T24-2112184_dekont.exe

Code function: 0_2_00E5411C SendInput,keybd_event,

0_2_00E5411C

Source: C:\Users\user\Desktop\18112024_Dokman_1 Kas_m 2024- Avans_T24-2112184_dekont.exe

Code function: 0_2_00E574E7 mouse_event,

0_2_00E574E7

Source: C:\Users\user\Desktop\18112024_Dokman_1 Kas_m 2024- Avans_T24-2112184_dekont.exe

Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe "C:\Users\user\Desktop\18112024_Dokman_1 Kas_m 2024- Avans_T24-2112184_dekont.exe"

Jump to behavior

Source: C:\Users\user\Desktop\18112024_Dokman_1 Kas_m 2024- Avans_T24-2112184_dekont.exe

0_2_00E4A66C

Source: C:\Users\user\Desktop\18112024_Dokman_1 Kas_m 2024- Avans_T24-2112184_dekont.exe

Code function: 0_2_00E571FA AllocateAndInitializeSid,CheckTokenMembership,FreeSid,

0_2_00E571FA

Source: 18112024_Dokman_1 Kas_m 2024- Avans_T24-2112184_dekont.exe	Binary or memory string: Shell_TrayWnd
Source: 18112024_Dokman_1 Kas_m 2024- Avans_T24-2112184_dekont.exe	Binary or memory string: Run Script:AutoIt script files (.au3, .a3x).au3;.a3xAll files (.).au3#include depth exceeded. Make sure there are no recursive includesError opening the file>>>AUTOIT SCRIPT<<<Bad directive syntax errorUnterminated stringCannot parse #includeUnterminated group of commentsONOFF0%d%dShell_TrayWndTHISREMOVEblankinfoquestionstopwarning

Source: C:\Users\user\Desktop\18112024_Dokman_1 Kas_m 2024- Avans_T24-2112184_dekont.exe

Code function: 0_2_00E365C4 cpuid

0_2_00E365C4

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Queries volume information: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe VolumeInformation	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Windows.Forms\v4.0_4.0.0.0__b77a5c561934e089\System.Windows.Forms.dll VolumeInformation	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Security\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Security.dll VolumeInformation	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.VisualBasic\v4.0_10.0.0.0__b03f5f7f11d50a3a\Microsoft.VisualBasic.dll VolumeInformation	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Drawing\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Drawing.dll VolumeInformation	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Accessibility\v4.0_4.0.0.0__b03f5f7f11d50a3a\Accessibility.dll VolumeInformation	Jump to behavior

Source: C:\Users\user\Desktop\18112024_Dokman_1 Kas_m 2024- Avans_T24-2112184_dekont.exe

Code function: 0_2_00E6091D GetLocalTime,SystemTimeToFileTime,LocalFileTimeToFileTime,__wsplitpath,_wcscat,_wcscat,GetCurrentDirectoryW,SetCurrentDirectoryW,SetCurrentDirectoryW,SetCurrentDirectoryW,SetCurrentDirectoryW,_wcscpy,SetCurrentDirectoryW,

0_2_00E6091D

Source: C:\Users\user\Desktop\18112024_Dokman_1 Kas_m 2024- Avans_T24-2112184_dekont.exe

Code function: 0_2_00E8B340 GetUserNameW,

0_2_00E8B340

Source: C:\Users\user\Desktop\18112024_Dokman_1 Kas_m 2024- Avans_T24-2112184_dekont.exe

Code function: 0_2_00E41E8E __lock,____lc_codepage_func,__getenv_helper_nolock,_free,_strlen,__malloc_crt,_strlen,__invoke_watson,_free,GetTimeZoneInformation,WideCharToMultiByte,WideCharToMultiByte,

0_2_00E41E8E

Source: C:\Users\user\Desktop\18112024_Dokman_1 Kas_m 2024- Avans_T24-2112184_dekont.exe

Code function: 0_2_00E2DDC0 GetVersionExW,GetCurrentProcess,FreeLibrary,GetNativeSystemInfo,FreeLibrary,FreeLibrary,GetSystemInfo,GetSystemInfo,

0_2_00E2DDC0

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid

Jump to behavior

Stealing of Sensitive Information

Yara detected AgentTesla

Source: Yara match	File source: 0.2.18112024_Dokman_1 Kas_m 2024- Avans_T24-2112184_dekont.exe.1060000.1.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.18112024_Dokman_1 Kas_m 2024- Avans_T24-2112184_dekont.exe.1060000.1.unpack, type: UNPACKEDPE
Source: Yara match	File source: 2.2.RegSvcs.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000002.00000002.3710089637.0000000002AF8000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000002.00000002.3710089637.0000000002ACE000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000002.00000002.3708338527.0000000000402000.00000040.80000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.1263016513.0000000001060000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000002.00000002.3710089637.0000000002A81000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: 18112024_Dokman_1 Kas_m 2024- Avans_T24-2112184_dekont.exe PID: 3812, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: RegSvcs.exe PID: 6004, type: MEMORYSTR

Tries to harvest and steal Putty / WinSCP information (sessions, passwords, etc)

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe

Key opened: HKEY_CURRENT_USER\SOFTWARE\Martin Prikryl\WinSCP 2\Sessions

Jump to behavior

Tries to harvest and steal browser information (history, passwords, etc)

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	File opened: C:\Users\user\AppData\Roaming\NETGATE Technologies\BlackHawk\profiles.ini	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Network\Cookies	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Login Data	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fu7wner3.default-release\cookies.sqlite	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\profiles.ini	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	File opened: C:\Users\user\AppData\Roaming\8pecxstudios\Cyberfox\profiles.ini	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Login Data	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Network\Cookies	Jump to behavior

Tries to harvest and steal ftp login credentials

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe

File opened: C:\FTP Navigator\Ftplist.txt

Jump to behavior

Tries to steal Mail credentials (via file / registry access)

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	File opened: C:\Users\user\AppData\Roaming\Thunderbird\profiles.ini	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	File opened: C:\Users\user\AppData\Roaming\Thunderbird\profiles.ini	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Key opened: HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Key opened: HKEY_CURRENT_USER\Software\IncrediMail\Identities	Jump to behavior

Source: 18112024_Dokman_1 Kas_m 2024- Avans_T24-2112184_dekont.exe	Binary or memory string: WIN_81
Source: 18112024_Dokman_1 Kas_m 2024- Avans_T24-2112184_dekont.exe	Binary or memory string: WIN_XP
Source: 18112024_Dokman_1 Kas_m 2024- Avans_T24-2112184_dekont.exe	Binary or memory string: %.3d%S%M%H%m%Y%jX86IA64X64WIN32_NTWIN_81WIN_2012R2WIN_2012WIN_8WIN_2008R2WIN_7WIN_2008WIN_VISTAWIN_2003WIN_XPeWIN_XPInstallLanguageSYSTEM\CurrentControlSet\Control\Nls\LanguageSchemeLangIDControl Panel\Appearance3, 3, 12, 0USERPROFILEUSERDOMAINUSERDNSDOMAINGetSystemWow64DirectoryWSeDebugPrivilege:winapistdcallubytep
Source: 18112024_Dokman_1 Kas_m 2024- Avans_T24-2112184_dekont.exe	Binary or memory string: WIN_XPe
Source: 18112024_Dokman_1 Kas_m 2024- Avans_T24-2112184_dekont.exe	Binary or memory string: WIN_VISTA
Source: 18112024_Dokman_1 Kas_m 2024- Avans_T24-2112184_dekont.exe	Binary or memory string: WIN_7
Source: 18112024_Dokman_1 Kas_m 2024- Avans_T24-2112184_dekont.exe	Binary or memory string: WIN_8

Source: Yara match	File source: 0.2.18112024_Dokman_1 Kas_m 2024- Avans_T24-2112184_dekont.exe.1060000.1.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.18112024_Dokman_1 Kas_m 2024- Avans_T24-2112184_dekont.exe.1060000.1.unpack, type: UNPACKEDPE
Source: Yara match	File source: 2.2.RegSvcs.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000002.00000002.3708338527.0000000000402000.00000040.80000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.1263016513.0000000001060000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000002.00000002.3710089637.0000000002A81000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: 18112024_Dokman_1 Kas_m 2024- Avans_T24-2112184_dekont.exe PID: 3812, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: RegSvcs.exe PID: 6004, type: MEMORYSTR

Remote Access Functionality

Yara detected AgentTesla

Source: Yara match	File source: 0.2.18112024_Dokman_1 Kas_m 2024- Avans_T24-2112184_dekont.exe.1060000.1.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.18112024_Dokman_1 Kas_m 2024- Avans_T24-2112184_dekont.exe.1060000.1.unpack, type: UNPACKEDPE
Source: Yara match	File source: 2.2.RegSvcs.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000002.00000002.3710089637.0000000002AF8000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000002.00000002.3710089637.0000000002ACE000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000002.00000002.3708338527.0000000000402000.00000040.80000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.1263016513.0000000001060000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000002.00000002.3710089637.0000000002A81000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: 18112024_Dokman_1 Kas_m 2024- Avans_T24-2112184_dekont.exe PID: 3812, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: RegSvcs.exe PID: 6004, type: MEMORYSTR

Source: C:\Users\user\Desktop\18112024_Dokman_1 Kas_m 2024- Avans_T24-2112184_dekont.exe	Code function: 0_2_00E68C4F socket,WSAGetLastError,bind,listen,WSAGetLastError,closesocket,		0_2_00E68C4F
Source: C:\Users\user\Desktop\18112024_Dokman_1 Kas_m 2024- Avans_T24-2112184_dekont.exe	Code function: 0_2_00E6923B socket,WSAGetLastError,bind,WSAGetLastError,closesocket,		0_2_00E6923B

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	Acquire Infrastructure	2 Valid Accounts	121 Windows Management Instrumentation	1 DLL Side-Loading	1 Exploitation for Privilege Escalation	11 Disable or Modify Tools	2 OS Credential Dumping	2 System Time Discovery	Remote Services	11 Archive Collected Data	1 Ingress Tool Transfer	Exfiltration Over Other Network Medium	1 System Shutdown/Reboot
Credentials	Domains	Default Accounts	2 Native API	2 Valid Accounts	1 DLL Side-Loading	11 Deobfuscate/Decode Files or Information	311 Input Capture	1 Account Discovery	Remote Desktop Protocol	2 Data from Local System	1 Encrypted Channel	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	At	Logon Script (Windows)	2 Valid Accounts	2 Obfuscated Files or Information	1 Credentials in Registry	2 File and Directory Discovery	SMB/Windows Admin Shares	1 Email Collection	1 Non-Standard Port	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	Cron	Login Hook	21 Access Token Manipulation	1 DLL Side-Loading	NTDS	138 System Information Discovery	Distributed Component Object Model	311 Input Capture	1 Non-Application Layer Protocol	Traffic Duplication	Data Destruction
Gather Victim Network Information	Server	Cloud Accounts	Launchd	Network Logon Script	212 Process Injection	2 Valid Accounts	LSA Secrets	241 Security Software Discovery	SSH	3 Clipboard Data	11 Application Layer Protocol	Scheduled Transfer	Data Encrypted for Impact
Domain Properties	Botnet	Replication Through Removable Media	Scheduled Task	RC Scripts	RC Scripts	121 Virtualization/Sandbox Evasion	Cached Domain Credentials	121 Virtualization/Sandbox Evasion	VNC	GUI Input Capture	Multiband Communication	Data Transfer Size Limits	Service Stop
DNS	Web Services	External Remote Services	Systemd Timers	Startup Items	Startup Items	21 Access Token Manipulation	DCSync	2 Process Discovery	Windows Remote Management	Web Portal Capture	Commonly Used Port	Exfiltration Over C2 Channel	Inhibit System Recovery
Network Trust Dependencies	Serverless	Drive-by Compromise	Container Orchestration Job	Scheduled Task/Job	Scheduled Task/Job	212 Process Injection	Proc Filesystem	11 Application Window Discovery	Cloud Services	Credential API Hooking	Application Layer Protocol	Exfiltration Over Alternative Protocol	Defacement
Network Topology	Malvertising	Exploit Public-Facing Application	Command and Scripting Interpreter	At	At	HTML Smuggling	/etc/passwd and /etc/shadow	1 System Owner/User Discovery	Direct Cloud VM Connections	Data Staged	Web Protocols	Exfiltration Over Symmetric Encrypted Non-C2 Protocol	Internal Defacement

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Source	Detection	Scanner	Label	Link
18112024_Dokman_1 Kas_m 2024- Avans_T24-2112184_dekont.exe	50%	ReversingLabs	Win32.Trojan.AutoitInject
18112024_Dokman_1 Kas_m 2024- Avans_T24-2112184_dekont.exe	100%	Joe Sandbox ML

Name	IP	Active	Malicious	Antivirus Detection	Reputation
zqamcx.com	78.110.166.82	true	false		high

URLs from Memory and Binaries

Name	Source	Malicious	Reputation
http://zqamcx.com	RegSvcs.exe, 00000002.00000002.3710089637.0000000002ACE000.00000004.00000800.00020000.00000000.sdmp, RegSvcs.exe, 00000002.00000002.3710089637.0000000002B7F000.00000004.00000800.00020000.00000000.sdmp	false	high
https://account.dyn.com/	18112024_Dokman_1 Kas_m 2024- Avans_T24-2112184_dekont.exe, 00000000.00000002.1263016513.0000000001060000.00000004.00001000.00020000.00000000.sdmp, RegSvcs.exe, 00000002.00000002.3708338527.0000000000402000.00000040.80000000.00040000.00000000.sdmp	false	high
http://r11.o.lencr.org0#	RegSvcs.exe, 00000002.00000002.3709303674.0000000000E62000.00000004.00000020.00020000.00000000.sdmp, RegSvcs.exe, 00000002.00000002.3712114621.0000000005DF0000.00000004.00000020.00020000.00000000.sdmp, RegSvcs.exe, 00000002.00000002.3710089637.0000000002ACE000.00000004.00000800.00020000.00000000.sdmp, RegSvcs.exe, 00000002.00000002.3710089637.0000000002B7F000.00000004.00000800.00020000.00000000.sdmp, RegSvcs.exe, 00000002.00000002.3712114621.0000000005E1D000.00000004.00000020.00020000.00000000.sdmp	false	high
http://r11.i.lencr.org/0#	RegSvcs.exe, 00000002.00000002.3709303674.0000000000E62000.00000004.00000020.00020000.00000000.sdmp, RegSvcs.exe, 00000002.00000002.3712114621.0000000005DF0000.00000004.00000020.00020000.00000000.sdmp, RegSvcs.exe, 00000002.00000002.3710089637.0000000002ACE000.00000004.00000800.00020000.00000000.sdmp, RegSvcs.exe, 00000002.00000002.3710089637.0000000002B7F000.00000004.00000800.00020000.00000000.sdmp, RegSvcs.exe, 00000002.00000002.3712114621.0000000005E1D000.00000004.00000020.00020000.00000000.sdmp	false	high
http://x1.c.lencr.org/0	RegSvcs.exe, 00000002.00000002.3709303674.0000000000E62000.00000004.00000020.00020000.00000000.sdmp, RegSvcs.exe, 00000002.00000002.3712114621.0000000005DF0000.00000004.00000020.00020000.00000000.sdmp, RegSvcs.exe, 00000002.00000002.3710089637.0000000002ACE000.00000004.00000800.00020000.00000000.sdmp, RegSvcs.exe, 00000002.00000002.3710089637.0000000002B7F000.00000004.00000800.00020000.00000000.sdmp, RegSvcs.exe, 00000002.00000002.3712114621.0000000005E1D000.00000004.00000020.00020000.00000000.sdmp, RegSvcs.exe, 00000002.00000002.3709303674.0000000000E27000.00000004.00000020.00020000.00000000.sdmp	false	high
http://x1.i.lencr.org/0	RegSvcs.exe, 00000002.00000002.3709303674.0000000000E62000.00000004.00000020.00020000.00000000.sdmp, RegSvcs.exe, 00000002.00000002.3712114621.0000000005DF0000.00000004.00000020.00020000.00000000.sdmp, RegSvcs.exe, 00000002.00000002.3710089637.0000000002ACE000.00000004.00000800.00020000.00000000.sdmp, RegSvcs.exe, 00000002.00000002.3710089637.0000000002B7F000.00000004.00000800.00020000.00000000.sdmp, RegSvcs.exe, 00000002.00000002.3712114621.0000000005E1D000.00000004.00000020.00020000.00000000.sdmp, RegSvcs.exe, 00000002.00000002.3709303674.0000000000E27000.00000004.00000020.00020000.00000000.sdmp	false	high

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	Flag	ASN	ASN Name	Malicious
78.110.166.82	zqamcx.com	United Kingdom		42831	UKSERVERS-ASUKDedicatedServersHostingandCo-Location	false

General Information

Joe Sandbox version:	41.0.0 Charoite
Analysis ID:	1559138
Start date and time:	2024-11-20 08:23:30 +01:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 7m 59s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	15
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Sample name:	18112024_Dokman_1 Kas_m 2024- Avans_T24-2112184_dekont.exe
Detection:	MAL
Classification:	mal100.troj.spyw.evad.winEXE@3/2@1/1
EGA Information:	Successful, ratio: 100%
HCA Information:	Successful, ratio: 100% Number of executed functions: 59 Number of non-executed functions: 292
Cookbook Comments:	Found application associated with file extension: .exe Override analysis time to 240000 for current running targets taking high CPU consumption

Warnings

Exclude process from analysis (whitelisted): MpCmdRun.exe, dllhost.exe, sppsvc.exe, WMIADAP.exe, SIHClient.exe, SgrmBroker.exe, conhost.exe, backgroundTaskHost.exe, svchost.exe
Excluded domains from analysis (whitelisted): otelrules.azureedge.net, slscr.update.microsoft.com, ctldl.windowsupdate.com, time.windows.com, fe3cr.delivery.mp.microsoft.com
Not all processes where analyzed, report is missing behavior information
Report size exceeded maximum capacity and may have missing disassembly code.
Report size getting too big, too many NtOpenKeyEx calls found.
Report size getting too big, too many NtQueryValueKey calls found.
Report size getting too big, too many NtReadVirtualMemory calls found.
VT rate limit hit for: 18112024_Dokman_1 Kas_m 2024- Avans_T24-2112184_dekont.exe

Simulations

Behavior and APIs

Time	Type	Description
02:24:27	API Interceptor	10879543x Sleep call for process: RegSvcs.exe modified

Joe Sandbox View / Context

IPs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
78.110.166.82	COB756883.vbs	Get hash	malicious	CobaltStrike	Browse	windowsupdatesolutions.com/ServerCOB.txt
	Ingreso_SII_Abril_2021.cmd	Get hash	malicious	Unknown	Browse	www.emolcl.com/namaste/puma.php
	Ingreso_SII_Abril_2021.cmd	Get hash	malicious	Unknown	Browse	www.emolcl.com/namaste/puma.php

Domains

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
zqamcx.com	Musterino_94372478_Ekno_101_20241031410530_ekstre.exe	Get hash	malicious	AgentTesla	Browse	78.110.166.82
	Halkbank_Ekstre_20241118_081142_787116.exe	Get hash	malicious	AgentTesla	Browse	78.110.166.82
	PO NO170300999.exe	Get hash	malicious	AgentTesla	Browse	78.110.166.82
	Musterino_94372478_Ekno_101_20241031410530_ekstre.exe	Get hash	malicious	AgentTesla	Browse	78.110.166.82
	41570002689_20220814_05352297_HesapOzeti.exe	Get hash	malicious	AgentTesla	Browse	78.110.166.82
	29.10.2024-29.10.2024.exe	Get hash	malicious	AgentTesla	Browse	78.110.166.82

ASNs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
UKSERVERS-ASUKDedicatedServersHostingandCo-Location	Musterino_94372478_Ekno_101_20241031410530_ekstre.exe	Get hash	malicious	AgentTesla	Browse	78.110.166.82
	Halkbank_Ekstre_20241118_081142_787116.exe	Get hash	malicious	AgentTesla	Browse	78.110.166.82
	(#U0130TOSAM) 11 KASIM 2024 HAFTALIK EKONOM#U0130 B#U00dcLTEN#U0130.exe	Get hash	malicious	AgentTesla	Browse	78.110.166.82
	PO NO170300999.exe	Get hash	malicious	AgentTesla	Browse	78.110.166.82
	sora.mips.elf	Get hash	malicious	Mirai	Browse	78.157.201.124
	RKsVnThLLP.exe	Get hash	malicious	Njrat	Browse	94.46.207.10
	Musterino_94372478_Ekno_101_20241031410530_ekstre.exe	Get hash	malicious	AgentTesla	Browse	78.110.166.82
	New Order (2).exe	Get hash	malicious	AgentTesla	Browse	78.110.166.82
	41570002689_20220814_05352297_HesapOzeti.exe	Get hash	malicious	AgentTesla	Browse	78.110.166.82
	29.10.2024-29.10.2024.exe	Get hash	malicious	AgentTesla	Browse	78.110.166.82

Process:	C:\Users\user\Desktop\18112024_Dokman_1 Kas_m 2024- Avans_T24-2112184_dekont.exe
File Type:	data
Category:	dropped
Size (bytes):	162406
Entropy (8bit):	7.93877818582206
Encrypted:	false
SSDEEP:	3072:seXRxn7eUTLGnY66iikpnBHFvg7b65ZVFab4x9qiCEci4bW1blj:Nb7zTiJp1VFfC+k4j
MD5:	1549C34DEA9ADB9EE6C00F245C182A30
SHA1:	00DA45BFE2E2A695AC6A4F963D8DDCF9E772820F
SHA-256:	4495D265A2FCEC09A51F700D0815D0D8AD8F1A0C0C593C6DB4498238A192C247
SHA-512:	246814D878A25565F9CE6A5FBDC02F7BC34FBAF2B40207DE5B83012066969514F8276F07CF1CFA7D147A28B4224583966C514367E48B6FD92786C689885E3F17
Malicious:	false
Reputation:	low
Preview:	EA06.....X..j.B.X..S.>.iA.N+5.MF.P.T.....W..' .d.4....N...d.l.K.T)....z)..u.5:...I$.o+.....ZE[..S..I-.I.h../v.O..n.:..(.3... U9.f.s.L..5..P.s:.n.Q....)..f4.I.Z....44..b.Q...!...R......V....L...V....j....6.j.....%....z(T.X.....0.?..Q..y..;.....4:...o..T.q..6..<.L.....c?........'5iTz.?.H....0.l.Tf......6\|.!.B. ..j.z.^.........(.....(.{....... .lL....w.:...U....6.N(...?...m..<...?n..`..D..j.I.s.......t...b[..........q.];4.}..q......ov...1P.K.}-~S7..VR.<.!'..j../+...Y/4...>.g..}..]{.Kj.\....\.....Y.[..},.K..O....}>...rY..E0......'A......Vs6.....]".B..\m/..^.E.:..vn.zJ.6.P..1.." ....`..l....X..@.Q1V..(...2h..Y.C.@.q.W..lV.GC...C....s.H.y^}.ma.`r..F"ik.]<;..s...B..>.v.....Q.N...Ho.:.UL.......K.Lk..E.....}.zD.yI.Q........sW>-.s...q\|.Nk...4...k.u.p...U..2...n9....MP..w..wKmY...Y...M..U..n[<..c..,N.>.Vd 9x......z..V....D.m$..%Z...R'5jE>.L.Qf..0..B.S.4....}.V...uE..(4...I..jT.d...nI"....W..N)...".#.Rj...2.K...1...sV..z.Z.V].....+...j..).`0.f.m

C:\Users\user\AppData\Local\Temp\overfertilize

Download File

Process:	C:\Users\user\Desktop\18112024_Dokman_1 Kas_m 2024- Avans_T24-2112184_dekont.exe
File Type:	data
Category:	modified
Size (bytes):	247808
Entropy (8bit):	6.728478578185266
Encrypted:	false
SSDEEP:	6144:HTLo9a7mr2BWERa0xOttud5KfIvC/aHiIV:zLoTZ2xC+5Kf2C/CiA
MD5:	1BE7D6E6F65BB395BB95A5687F4ADE53
SHA1:	855198213978F6F68C16AF9FC948A99DDD9DACC6
SHA-256:	4C4A69948D94AAD35EC028438DDC7CC1905ABCFBB02B9871F2C432F3881C661A
SHA-512:	E55917BCD3ECF140AC06C9C153AD0DFDAA21726CA71552BAACB6553D1555D39D88C377F664E3A5545A9019163F562D3DC42F3A4B7DEE8159441260E67609E334
Malicious:	false
Reputation:	low
Preview:	.b.VTPYX=VJ0.4A.8YPIQCP.R6Y8DVWPYX9VJ08L4AJ8YPIQCPNR6Y8DVWP.X9VD/.B4.C.x.H..q.:_.4$87+9Tv)QV"[5jZ<p;$-p'<..w.v:?==.[G:.L4AJ8YP..CP.S5YPs.2PYX9VJ08.4CK3X[IQ.SNR>Y8DVWP..:VJ.8L4.I8YP.QCpNR6[8DRWPYX9VJ48L4AJ8YPiUCPLR6Y8DVUP..9VZ08\4AJ8IPIACPNR6Y(DVWPYX9VJ08..BJkYPIQ.SN.3Y8DVWPYX9VJ08L4AJ8YPMQOPNR6Y8DVWPYX9VJ08L4AJ8YPIQCPNR6Y8DVWPYX9VJ08L4AJ8YPIqCPFR6Y8DVWPYX9^j08.4AJ8YPIQCPN\|B<@0VWP].:VJ.8L4.I8YRIQCPNR6Y8DVWPYx9V.J?F"J8Y.LQCP.Q6Y>DVW.ZX9VJ08L4AJ8YP.QC.` S5W'VW\YX9VJ48L6AJ8.SIQCPNR6Y8DVWP.X9.J08L4AJ8YPIQCPNR.;DVWPY.9VJ28I4..:Y\rPCSNR6X8DPWPYX9VJ08L4AJ8YPIQCPNR6Y8DVWPYX9VJ08L4AJ8YPIQCPNO......n.%.\(7.j.&.;..Z..)..9.-.-C...[....f?>..I.L`...P....%.P</K....rXR!G9.'a]W.%....dyM...>".;....{.-Vj.....pt...uY>n`..5..:?$." >>Swk%06"0.;.K08L4........96.lt;KHcB!.....^L...7QCPR6YJDVW1YX9.J08#4AJVYPI/CPN,6Y8.VWP.X9V}08L.AJ84PIQgPNRHY8D._V..#C..4AJ8Ye..s.#..g.a..nH.4kZt.\....F..]^.O.....V..!\|.[f*L...NPETKP1];HkY....wH4<I6FN;UmG....s....o..)..cB.HAJ8YPI.CP.R6Y..V.PYX.V.0..4AJ..P.Q.P..Y

Static File Info

General

File type:	PE32 executable (GUI) Intel 80386, for MS Windows
Entropy (8bit):	6.668516435749186
TrID:	Win32 Executable (generic) a (10002005/4) 99.96% Generic Win/DOS Executable (2004/3) 0.02% DOS Executable Generic (2002/1) 0.02% Autodesk FLIC Image File (extensions: flc, fli, cel) (7/3) 0.00%
File name:	18112024_Dokman_1 Kas_m 2024- Avans_T24-2112184_dekont.exe
File size:	1'275'392 bytes
MD5:	c559b0a76b256e3537598031eaf17c34
SHA1:	3d079a42ee7110ec7389bb4b28bd572a8244bf52
SHA256:	08e931e2b4a954a57c72df289fbe2e4971a912e453b71f19d1859f1a350f9fba
SHA512:	4b8a8bf9ca6a6d41bc35a59beb056a578aeba82b8735ffbdde92cae3f360f36187dc6953f3e2eab410ab7798d87c4e52371bc1cc426e366c80bbc728b6fba9f2
SSDEEP:	24576:Atb20pkaCqT5TBWgNQ7aB4h0vmxQqfgy6A:JVg5tQ7aB4GQh5
TLSH:	5E45CF1333DD83A5D7725273792677556E7B7C2946B0F86B2FD8383DAA30122121EA23
File Content Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........d..............'.a.....H.k.....H.h.....H.i......}%......}5...............~.......k.......o.......1.......j.....Rich...........

File Icon


Icon Hash:	98e2a3b29b9ba181

Static PE Info

General

Entrypoint:	0x425f74
Entrypoint Section:	.text
Digitally signed:	false
Imagebase:	0x400000
Subsystem:	windows gui
Image File Characteristics:	EXECUTABLE_IMAGE, LARGE_ADDRESS_AWARE, 32BIT_MACHINE
DLL Characteristics:	DYNAMIC_BASE, TERMINAL_SERVER_AWARE
Time Stamp:	0x673C0B32 [Tue Nov 19 03:51:14 2024 UTC]
TLS Callbacks:
CLR (.Net) Version:
OS Version Major:	5
OS Version Minor:	1
File Version Major:	5
File Version Minor:	1
Subsystem Version Major:	5
Subsystem Version Minor:	1
Import Hash:	3d95adbf13bbe79dc24dccb401c12091

Entrypoint Preview

Instruction
call 00007FD1A8E2B8EFh
jmp 00007FD1A8E1E904h
int3
int3
push edi
push esi
mov esi, dword ptr [esp+10h]
mov ecx, dword ptr [esp+14h]
mov edi, dword ptr [esp+0Ch]
mov eax, ecx
mov edx, ecx
add eax, esi
cmp edi, esi
jbe 00007FD1A8E1EA8Ah
cmp edi, eax
jc 00007FD1A8E1EDEEh
bt dword ptr [004C0158h], 01h
jnc 00007FD1A8E1EA89h
rep movsb
jmp 00007FD1A8E1ED9Ch
cmp ecx, 00000080h
jc 00007FD1A8E1EC54h
mov eax, edi
xor eax, esi
test eax, 0000000Fh
jne 00007FD1A8E1EA90h
bt dword ptr [004BA370h], 01h
jc 00007FD1A8E1EF60h
bt dword ptr [004C0158h], 00000000h
jnc 00007FD1A8E1EC2Dh
test edi, 00000003h
jne 00007FD1A8E1EC3Eh
test esi, 00000003h
jne 00007FD1A8E1EC1Dh
bt edi, 02h
jnc 00007FD1A8E1EA8Fh
mov eax, dword ptr [esi]
sub ecx, 04h
lea esi, dword ptr [esi+04h]
mov dword ptr [edi], eax
lea edi, dword ptr [edi+04h]
bt edi, 03h
jnc 00007FD1A8E1EA93h
movq xmm1, qword ptr [esi]
sub ecx, 08h
lea esi, dword ptr [esi+08h]
movq qword ptr [edi], xmm1
lea edi, dword ptr [edi+08h]
test esi, 00000007h
je 00007FD1A8E1EAE5h
bt esi, 03h
jnc 00007FD1A8E1EB38h
movdqa xmm1, dqword ptr [esi+00h]

Rich Headers

Programming Language:

[ C ] VS2008 SP1 build 30729
[IMP] VS2008 SP1 build 30729
[ASM] VS2012 UPD4 build 61030
[RES] VS2012 UPD4 build 61030
[LNK] VS2012 UPD4 build 61030

Data Directories

Name	Virtual Address	Virtual Size	Is in Section
IMAGE_DIRECTORY_ENTRY_EXPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IMPORT	0xb7004	0x17c	.rdata
IMAGE_DIRECTORY_ENTRY_RESOURCE	0xc4000	0x6e4bc	.rsrc
IMAGE_DIRECTORY_ENTRY_EXCEPTION	0x0	0x0
IMAGE_DIRECTORY_ENTRY_SECURITY	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BASERELOC	0x133000	0x6c4c	.reloc
IMAGE_DIRECTORY_ENTRY_DEBUG	0x8d8d0	0x1c	.rdata
IMAGE_DIRECTORY_ENTRY_COPYRIGHT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_GLOBALPTR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_TLS	0x0	0x0
IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG	0xb2730	0x40	.rdata
IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IAT	0x8d000	0x860	.rdata
IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_RESERVED	0x0	0x0

Sections

Name	Virtual Address	Virtual Size	Raw Size	MD5	Xored PE	ZLIB Complexity	File Type	Entropy	Characteristics
.text	0x1000	0x8b54f	0x8b600	f437a6545e938612764dbb0a314376fc	False	0.5699499019058296	data	6.680413749210956	IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
.rdata	0x8d000	0x2cc42	0x2ce00	827ffd24759e8e420890ecf164be989e	False	0.330464397632312	data	5.770192333189168	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.data	0xba000	0x9d54	0x6200	e0a519f8e3a35fae0d9c2cfd5a4bacfc	False	0.16402264030612246	data	2.002691099965349	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.rsrc	0xc4000	0x6e4bc	0x6e600	f6f6a739492b5bc49cadc84161879508	False	0.5799675290203851	data	6.220292872057945	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.reloc	0x133000	0xa474	0xa600	0bc98f8631ef0bde830a7f83bb06ff08	False	0.5017884036144579	data	5.245426654116355	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_READ

Resources

Name	RVA	Size	Type	Language	Country	ZLIB Complexity
RT_ICON	0xc4458	0x128	Device independent bitmap graphic, 16 x 32 x 4, image size 192	English	Great Britain	0.7466216216216216
RT_ICON	0xc4580	0x128	Device independent bitmap graphic, 16 x 32 x 4, image size 128, 16 important colors	English	Great Britain	0.3277027027027027
RT_ICON	0xc46a8	0x128	Device independent bitmap graphic, 16 x 32 x 4, image size 192	English	Great Britain	0.3885135135135135
RT_ICON	0xc47d0	0x33428	Device independent bitmap graphic, 198 x 512 x 32, image size 202752, resolution 7874 x 7874 px/m	English	Great Britain	0.13495903981710802
RT_MENU	0xf7bf8	0x50	data	English	Great Britain	0.9
RT_STRING	0xf7c48	0x594	data	English	Great Britain	0.3333333333333333
RT_STRING	0xf81dc	0x68a	data	English	Great Britain	0.2747909199522103
RT_STRING	0xf8868	0x490	data	English	Great Britain	0.3715753424657534
RT_STRING	0xf8cf8	0x5fc	data	English	Great Britain	0.3087467362924282
RT_STRING	0xf92f4	0x65c	data	English	Great Britain	0.34336609336609336
RT_STRING	0xf9950	0x466	data	English	Great Britain	0.3605683836589698
RT_STRING	0xf9db8	0x158	Matlab v4 mat-file (little endian) n, numeric, rows 0, columns 0	English	Great Britain	0.502906976744186
RT_RCDATA	0xf9f10	0x380cd	data			1.000352816652946
RT_GROUP_ICON	0x131fe0	0x14	data	English	Great Britain	1.25
RT_GROUP_ICON	0x131ff4	0x14	data	English	Great Britain	1.25
RT_GROUP_ICON	0x132008	0x14	data	English	Great Britain	1.15
RT_GROUP_ICON	0x13201c	0x14	data	English	Great Britain	1.25
RT_VERSION	0x132030	0xdc	data	English	Great Britain	0.6181818181818182
RT_MANIFEST	0x13210c	0x3b0	ASCII text, with CRLF line terminators	English	Great Britain	0.5116525423728814

Imports

DLL	Import
WSOCK32.dll	__WSAFDIsSet, recv, send, setsockopt, ntohs, recvfrom, select, WSAStartup, htons, accept, listen, bind, closesocket, connect, WSACleanup, ioctlsocket, sendto, WSAGetLastError, inet_addr, gethostbyname, gethostname, socket
VERSION.dll	GetFileVersionInfoW, VerQueryValueW, GetFileVersionInfoSizeW
WINMM.dll	timeGetTime, waveOutSetVolume, mciSendStringW
COMCTL32.dll	ImageList_Destroy, ImageList_Remove, ImageList_SetDragCursorImage, ImageList_BeginDrag, ImageList_DragEnter, ImageList_DragLeave, ImageList_EndDrag, ImageList_DragMove, ImageList_Create, InitCommonControlsEx, ImageList_ReplaceIcon
MPR.dll	WNetUseConnectionW, WNetCancelConnection2W, WNetGetConnectionW, WNetAddConnection2W
WININET.dll	InternetReadFile, InternetCloseHandle, InternetOpenW, InternetSetOptionW, InternetCrackUrlW, HttpQueryInfoW, InternetQueryOptionW, HttpOpenRequestW, HttpSendRequestW, FtpOpenFileW, FtpGetFileSize, InternetOpenUrlW, InternetConnectW, InternetQueryDataAvailable
PSAPI.DLL	GetProcessMemoryInfo
IPHLPAPI.DLL	IcmpCreateFile, IcmpCloseHandle, IcmpSendEcho
USERENV.dll	UnloadUserProfile, DestroyEnvironmentBlock, CreateEnvironmentBlock, LoadUserProfileW
UxTheme.dll	IsThemeActive
KERNEL32.dll	HeapAlloc, GetProcessHeap, HeapFree, Sleep, GetCurrentThreadId, MultiByteToWideChar, MulDiv, GetVersionExW, GetSystemInfo, FreeLibrary, LoadLibraryA, GetProcAddress, SetErrorMode, GetModuleFileNameW, WideCharToMultiByte, lstrcpyW, lstrlenW, GetModuleHandleW, QueryPerformanceCounter, VirtualFreeEx, OpenProcess, VirtualAllocEx, WriteProcessMemory, ReadProcessMemory, CreateFileW, SetFilePointerEx, ReadFile, WriteFile, FlushFileBuffers, TerminateProcess, CreateToolhelp32Snapshot, Process32FirstW, Process32NextW, SetFileTime, GetFileAttributesW, FindFirstFileW, FindClose, GetLongPathNameW, GetCurrentThread, FindNextFileW, MoveFileW, CopyFileW, CreateDirectoryW, RemoveDirectoryW, SetSystemPowerState, QueryPerformanceFrequency, FindResourceW, LoadResource, LockResource, SizeofResource, EnumResourceNamesW, OutputDebugStringW, GetTempPathW, GetTempFileNameW, DeviceIoControl, GetLocalTime, CompareStringW, DeleteCriticalSection, WaitForSingleObject, LeaveCriticalSection, GetStdHandle, CreatePipe, InterlockedExchange, TerminateThread, LoadLibraryExW, FindResourceExW, VirtualFree, FormatMessageW, GetExitCodeProcess, GetPrivateProfileStringW, WritePrivateProfileStringW, GetPrivateProfileSectionW, WritePrivateProfileSectionW, GetPrivateProfileSectionNamesW, FileTimeToLocalFileTime, FileTimeToSystemTime, SystemTimeToFileTime, LocalFileTimeToFileTime, GetDriveTypeW, GetDiskFreeSpaceExW, GetDiskFreeSpaceW, GetVolumeInformationW, SetVolumeLabelW, CreateHardLinkW, SetFileAttributesW, GetShortPathNameW, CreateEventW, SetEvent, GetEnvironmentVariableW, SetEnvironmentVariableW, GlobalLock, GlobalUnlock, GlobalAlloc, GetFileSize, GlobalFree, GlobalMemoryStatusEx, Beep, GetSystemDirectoryW, GetComputerNameW, GetWindowsDirectoryW, GetCurrentProcessId, GetProcessIoCounters, CreateProcessW, SetPriorityClass, LoadLibraryW, VirtualAlloc, CloseHandle, GetLastError, GetFullPathNameW, SetCurrentDirectoryW, IsDebuggerPresent, GetCurrentDirectoryW, lstrcmpiW, RaiseException, InitializeCriticalSectionAndSpinCount, InterlockedDecrement, InterlockedIncrement, CreateThread, DuplicateHandle, EnterCriticalSection, GetCurrentProcess, ExitProcess, GetModuleHandleExW, ExitThread, GetSystemTimeAsFileTime, ResumeThread, GetCommandLineW, IsProcessorFeaturePresent, HeapSize, IsValidCodePage, GetACP, GetOEMCP, GetCPInfo, SetLastError, UnhandledExceptionFilter, SetUnhandledExceptionFilter, TlsAlloc, TlsGetValue, TlsSetValue, TlsFree, GetStartupInfoW, GetStringTypeW, SetStdHandle, GetFileType, GetConsoleCP, GetConsoleMode, RtlUnwind, ReadConsoleW, SetFilePointer, GetTimeZoneInformation, GetDateFormatW, GetTimeFormatW, LCMapStringW, GetEnvironmentStringsW, FreeEnvironmentStringsW, HeapReAlloc, WriteConsoleW, SetEndOfFile, DeleteFileW, SetEnvironmentVariableA
USER32.dll	SetWindowPos, GetCursorInfo, RegisterHotKey, ClientToScreen, GetKeyboardLayoutNameW, IsCharAlphaW, IsCharAlphaNumericW, IsCharLowerW, IsCharUpperW, GetMenuStringW, GetSubMenu, GetCaretPos, IsZoomed, MonitorFromPoint, GetMonitorInfoW, SetWindowLongW, SetLayeredWindowAttributes, FlashWindow, GetClassLongW, TranslateAcceleratorW, IsDialogMessageW, GetSysColor, InflateRect, DrawFocusRect, DrawTextW, FrameRect, DrawFrameControl, FillRect, PtInRect, DestroyAcceleratorTable, CreateAcceleratorTableW, SetCursor, GetWindowDC, GetSystemMetrics, DrawMenuBar, GetActiveWindow, CharNextW, wsprintfW, RedrawWindow, DestroyMenu, SetMenu, GetWindowTextLengthW, CreateMenu, IsDlgButtonChecked, DefDlgProcW, CallWindowProcW, ReleaseCapture, SetCapture, MonitorFromRect, LoadImageW, CreateIconFromResourceEx, mouse_event, ExitWindowsEx, SetActiveWindow, FindWindowExW, EnumThreadWindows, SetMenuDefaultItem, InsertMenuItemW, IsMenu, TrackPopupMenuEx, GetCursorPos, CopyImage, CheckMenuRadioItem, GetMenuItemID, GetMenuItemCount, SetMenuItemInfoW, GetMenuItemInfoW, SetForegroundWindow, IsIconic, FindWindowW, UnregisterHotKey, keybd_event, SendInput, GetAsyncKeyState, SetKeyboardState, GetKeyboardState, GetKeyState, VkKeyScanW, LoadStringW, DialogBoxParamW, MessageBeep, EndDialog, SendDlgItemMessageW, GetDlgItem, SetWindowTextW, CopyRect, ReleaseDC, GetDC, EndPaint, BeginPaint, GetClientRect, GetMenu, DestroyWindow, EnumWindows, GetDesktopWindow, IsWindow, IsWindowEnabled, IsWindowVisible, EnableWindow, InvalidateRect, GetWindowLongW, GetWindowThreadProcessId, AttachThreadInput, GetFocus, ScreenToClient, SendMessageTimeoutW, EnumChildWindows, CharUpperBuffW, GetClassNameW, GetParent, GetDlgCtrlID, SendMessageW, MapVirtualKeyW, PostMessageW, GetWindowRect, SetUserObjectSecurity, CloseDesktop, CloseWindowStation, OpenDesktopW, SetProcessWindowStation, GetProcessWindowStation, OpenWindowStationW, GetUserObjectSecurity, AdjustWindowRectEx, SetRect, SetClipboardData, EmptyClipboard, CountClipboardFormats, CloseClipboard, GetClipboardData, IsClipboardFormatAvailable, OpenClipboard, BlockInput, GetMessageW, LockWindowUpdate, DispatchMessageW, TranslateMessage, DeleteMenu, PeekMessageW, MessageBoxW, DefWindowProcW, MoveWindow, SetFocus, PostQuitMessage, KillTimer, CreatePopupMenu, RegisterWindowMessageW, SetTimer, ShowWindow, CreateWindowExW, RegisterClassExW, LoadIconW, LoadCursorW, GetSysColorBrush, GetForegroundWindow, MessageBoxA, DestroyIcon, SystemParametersInfoW, CharLowerBuffW, GetWindowTextW
GDI32.dll	SetPixel, DeleteObject, GetTextExtentPoint32W, ExtCreatePen, StrokeAndFillPath, StrokePath, GetDeviceCaps, CloseFigure, LineTo, AngleArc, CreateCompatibleBitmap, CreateCompatibleDC, MoveToEx, Ellipse, PolyDraw, BeginPath, SelectObject, StretchBlt, GetDIBits, DeleteDC, GetPixel, CreateDCW, GetStockObject, Rectangle, SetViewportOrgEx, GetObjectW, SetBkMode, RoundRect, SetBkColor, CreatePen, CreateSolidBrush, SetTextColor, CreateFontW, GetTextFaceW, EndPath
COMDLG32.dll	GetSaveFileNameW, GetOpenFileNameW
ADVAPI32.dll	GetAclInformation, RegEnumValueW, RegDeleteValueW, RegDeleteKeyW, RegEnumKeyExW, RegSetValueExW, RegCreateKeyExW, GetUserNameW, RegOpenKeyExW, RegCloseKey, RegQueryValueExW, RegConnectRegistryW, InitializeSecurityDescriptor, InitializeAcl, AdjustTokenPrivileges, OpenThreadToken, OpenProcessToken, LookupPrivilegeValueW, DuplicateTokenEx, CreateProcessAsUserW, CreateProcessWithLogonW, GetLengthSid, CopySid, InitiateSystemShutdownExW, LogonUserW, AllocateAndInitializeSid, CheckTokenMembership, FreeSid, GetTokenInformation, GetSecurityDescriptorDacl, SetSecurityDescriptorDacl, AddAce, GetAce
SHELL32.dll	DragQueryPoint, ShellExecuteExW, DragQueryFileW, SHEmptyRecycleBinW, SHGetPathFromIDListW, SHBrowseForFolderW, SHCreateShellItem, SHGetDesktopFolder, SHGetSpecialFolderLocation, SHGetFolderPathW, SHFileOperationW, ExtractIconExW, Shell_NotifyIconW, ShellExecuteW, DragFinish
ole32.dll	CoTaskMemAlloc, CoTaskMemFree, CLSIDFromString, ProgIDFromCLSID, CLSIDFromProgID, OleSetMenuDescriptor, MkParseDisplayName, OleSetContainedObject, CoCreateInstance, IIDFromString, StringFromGUID2, CreateStreamOnHGlobal, CoInitialize, CoUninitialize, GetRunningObjectTable, CoGetInstanceFromFile, CoGetObject, CoInitializeSecurity, CoCreateInstanceEx, CoSetProxyBlanket
OLEAUT32.dll	RegisterTypeLib, LoadTypeLibEx, VariantCopyInd, SysReAllocString, SysFreeString, SafeArrayDestroyDescriptor, SafeArrayDestroyData, SafeArrayUnaccessData, SafeArrayAccessData, SafeArrayAllocData, UnRegisterTypeLib, SafeArrayCreateVector, SysAllocString, SysStringLen, VariantTimeToSystemTime, VarR8FromDec, SafeArrayGetVartype, OleLoadPicture, QueryPathOfRegTypeLib, VariantCopy, VariantClear, CreateDispTypeInfo, CreateStdDispatch, DispCallFunc, VariantChangeType, SafeArrayAllocDescriptorEx, VariantInit

Possible Origin

Language of compilation system	Country where language is spoken	Map
English	Great Britain

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Nov 20, 2024 08:24:28.400037050 CET	49699	587	192.168.2.7	78.110.166.82
Nov 20, 2024 08:24:28.405121088 CET	587	49699	78.110.166.82	192.168.2.7
Nov 20, 2024 08:24:28.405230999 CET	49699	587	192.168.2.7	78.110.166.82
Nov 20, 2024 08:24:29.864047050 CET	587	49699	78.110.166.82	192.168.2.7
Nov 20, 2024 08:24:29.865000010 CET	49699	587	192.168.2.7	78.110.166.82
Nov 20, 2024 08:24:29.869884968 CET	587	49699	78.110.166.82	192.168.2.7
Nov 20, 2024 08:24:30.032813072 CET	587	49699	78.110.166.82	192.168.2.7
Nov 20, 2024 08:24:30.033088923 CET	49699	587	192.168.2.7	78.110.166.82
Nov 20, 2024 08:24:30.038002968 CET	587	49699	78.110.166.82	192.168.2.7
Nov 20, 2024 08:24:30.204315901 CET	587	49699	78.110.166.82	192.168.2.7
Nov 20, 2024 08:24:30.212476015 CET	49699	587	192.168.2.7	78.110.166.82
Nov 20, 2024 08:24:30.217420101 CET	587	49699	78.110.166.82	192.168.2.7
Nov 20, 2024 08:24:30.402932882 CET	587	49699	78.110.166.82	192.168.2.7
Nov 20, 2024 08:24:30.402946949 CET	587	49699	78.110.166.82	192.168.2.7
Nov 20, 2024 08:24:30.402959108 CET	587	49699	78.110.166.82	192.168.2.7
Nov 20, 2024 08:24:30.402970076 CET	587	49699	78.110.166.82	192.168.2.7
Nov 20, 2024 08:24:30.403017044 CET	49699	587	192.168.2.7	78.110.166.82
Nov 20, 2024 08:24:30.403062105 CET	49699	587	192.168.2.7	78.110.166.82
Nov 20, 2024 08:24:30.457806110 CET	49699	587	192.168.2.7	78.110.166.82
Nov 20, 2024 08:24:30.462730885 CET	587	49699	78.110.166.82	192.168.2.7
Nov 20, 2024 08:24:30.626019955 CET	587	49699	78.110.166.82	192.168.2.7
Nov 20, 2024 08:24:30.672511101 CET	49699	587	192.168.2.7	78.110.166.82
Nov 20, 2024 08:24:30.684148073 CET	49699	587	192.168.2.7	78.110.166.82
Nov 20, 2024 08:24:30.689001083 CET	587	49699	78.110.166.82	192.168.2.7
Nov 20, 2024 08:24:30.851521969 CET	587	49699	78.110.166.82	192.168.2.7
Nov 20, 2024 08:24:30.857295036 CET	49699	587	192.168.2.7	78.110.166.82
Nov 20, 2024 08:24:30.862159967 CET	587	49699	78.110.166.82	192.168.2.7
Nov 20, 2024 08:24:31.025281906 CET	587	49699	78.110.166.82	192.168.2.7
Nov 20, 2024 08:24:31.034543991 CET	49699	587	192.168.2.7	78.110.166.82
Nov 20, 2024 08:24:31.039463997 CET	587	49699	78.110.166.82	192.168.2.7
Nov 20, 2024 08:24:31.209530115 CET	587	49699	78.110.166.82	192.168.2.7
Nov 20, 2024 08:24:31.209856987 CET	49699	587	192.168.2.7	78.110.166.82
Nov 20, 2024 08:24:31.214903116 CET	587	49699	78.110.166.82	192.168.2.7
Nov 20, 2024 08:24:31.377892971 CET	587	49699	78.110.166.82	192.168.2.7
Nov 20, 2024 08:24:31.378186941 CET	49699	587	192.168.2.7	78.110.166.82
Nov 20, 2024 08:24:31.383194923 CET	587	49699	78.110.166.82	192.168.2.7
Nov 20, 2024 08:24:31.556847095 CET	587	49699	78.110.166.82	192.168.2.7
Nov 20, 2024 08:24:31.557161093 CET	49699	587	192.168.2.7	78.110.166.82
Nov 20, 2024 08:24:31.562062979 CET	587	49699	78.110.166.82	192.168.2.7
Nov 20, 2024 08:24:31.724595070 CET	587	49699	78.110.166.82	192.168.2.7
Nov 20, 2024 08:24:31.730668068 CET	49699	587	192.168.2.7	78.110.166.82
Nov 20, 2024 08:24:31.731333971 CET	49699	587	192.168.2.7	78.110.166.82
Nov 20, 2024 08:24:31.731460094 CET	49699	587	192.168.2.7	78.110.166.82
Nov 20, 2024 08:24:31.731499910 CET	49699	587	192.168.2.7	78.110.166.82
Nov 20, 2024 08:24:31.735661983 CET	587	49699	78.110.166.82	192.168.2.7
Nov 20, 2024 08:24:31.736259937 CET	587	49699	78.110.166.82	192.168.2.7
Nov 20, 2024 08:24:31.736454964 CET	587	49699	78.110.166.82	192.168.2.7
Nov 20, 2024 08:24:31.736484051 CET	587	49699	78.110.166.82	192.168.2.7
Nov 20, 2024 08:24:32.000945091 CET	587	49699	78.110.166.82	192.168.2.7
Nov 20, 2024 08:24:32.047732115 CET	49699	587	192.168.2.7	78.110.166.82
Nov 20, 2024 08:24:32.217220068 CET	49699	587	192.168.2.7	78.110.166.82
Nov 20, 2024 08:24:32.222172022 CET	587	49699	78.110.166.82	192.168.2.7
Nov 20, 2024 08:24:32.386246920 CET	587	49699	78.110.166.82	192.168.2.7
Nov 20, 2024 08:24:32.391762018 CET	49699	587	192.168.2.7	78.110.166.82
Nov 20, 2024 08:24:32.392927885 CET	49700	587	192.168.2.7	78.110.166.82
Nov 20, 2024 08:24:32.397939920 CET	587	49700	78.110.166.82	192.168.2.7
Nov 20, 2024 08:24:32.398015976 CET	49700	587	192.168.2.7	78.110.166.82
Nov 20, 2024 08:24:32.955137968 CET	587	49700	78.110.166.82	192.168.2.7
Nov 20, 2024 08:24:32.955328941 CET	49700	587	192.168.2.7	78.110.166.82
Nov 20, 2024 08:24:32.960382938 CET	587	49700	78.110.166.82	192.168.2.7
Nov 20, 2024 08:24:33.121617079 CET	587	49700	78.110.166.82	192.168.2.7
Nov 20, 2024 08:24:33.121831894 CET	49700	587	192.168.2.7	78.110.166.82
Nov 20, 2024 08:24:33.127262115 CET	587	49700	78.110.166.82	192.168.2.7
Nov 20, 2024 08:24:33.291547060 CET	587	49700	78.110.166.82	192.168.2.7
Nov 20, 2024 08:24:33.292045116 CET	49700	587	192.168.2.7	78.110.166.82
Nov 20, 2024 08:24:33.297043085 CET	587	49700	78.110.166.82	192.168.2.7
Nov 20, 2024 08:24:33.468373060 CET	587	49700	78.110.166.82	192.168.2.7
Nov 20, 2024 08:24:33.468399048 CET	587	49700	78.110.166.82	192.168.2.7
Nov 20, 2024 08:24:33.468410015 CET	587	49700	78.110.166.82	192.168.2.7
Nov 20, 2024 08:24:33.468416929 CET	587	49700	78.110.166.82	192.168.2.7
Nov 20, 2024 08:24:33.470062971 CET	49700	587	192.168.2.7	78.110.166.82
Nov 20, 2024 08:24:33.470062971 CET	49700	587	192.168.2.7	78.110.166.82
Nov 20, 2024 08:24:33.475064993 CET	587	49700	78.110.166.82	192.168.2.7
Nov 20, 2024 08:24:33.636941910 CET	587	49700	78.110.166.82	192.168.2.7
Nov 20, 2024 08:24:33.638293028 CET	49700	587	192.168.2.7	78.110.166.82
Nov 20, 2024 08:24:33.643213987 CET	587	49700	78.110.166.82	192.168.2.7
Nov 20, 2024 08:24:33.804538012 CET	587	49700	78.110.166.82	192.168.2.7
Nov 20, 2024 08:24:33.810261011 CET	49700	587	192.168.2.7	78.110.166.82
Nov 20, 2024 08:24:33.816344023 CET	587	49700	78.110.166.82	192.168.2.7
Nov 20, 2024 08:24:33.977756977 CET	587	49700	78.110.166.82	192.168.2.7
Nov 20, 2024 08:24:33.978051901 CET	49700	587	192.168.2.7	78.110.166.82
Nov 20, 2024 08:24:33.982897043 CET	587	49700	78.110.166.82	192.168.2.7
Nov 20, 2024 08:24:34.157805920 CET	587	49700	78.110.166.82	192.168.2.7
Nov 20, 2024 08:24:34.158137083 CET	49700	587	192.168.2.7	78.110.166.82
Nov 20, 2024 08:24:34.163047075 CET	587	49700	78.110.166.82	192.168.2.7
Nov 20, 2024 08:24:34.351262093 CET	587	49700	78.110.166.82	192.168.2.7
Nov 20, 2024 08:24:34.351502895 CET	49700	587	192.168.2.7	78.110.166.82
Nov 20, 2024 08:24:34.356522083 CET	587	49700	78.110.166.82	192.168.2.7
Nov 20, 2024 08:24:34.528769016 CET	587	49700	78.110.166.82	192.168.2.7
Nov 20, 2024 08:24:34.529068947 CET	49700	587	192.168.2.7	78.110.166.82
Nov 20, 2024 08:24:34.534041882 CET	587	49700	78.110.166.82	192.168.2.7
Nov 20, 2024 08:24:34.695082903 CET	587	49700	78.110.166.82	192.168.2.7
Nov 20, 2024 08:24:34.700251102 CET	49700	587	192.168.2.7	78.110.166.82
Nov 20, 2024 08:24:34.700324059 CET	49700	587	192.168.2.7	78.110.166.82
Nov 20, 2024 08:24:34.700376034 CET	49700	587	192.168.2.7	78.110.166.82
Nov 20, 2024 08:24:34.700423002 CET	49700	587	192.168.2.7	78.110.166.82
Nov 20, 2024 08:24:34.700469971 CET	49700	587	192.168.2.7	78.110.166.82
Nov 20, 2024 08:24:34.700505972 CET	49700	587	192.168.2.7	78.110.166.82
Nov 20, 2024 08:24:34.700557947 CET	49700	587	192.168.2.7	78.110.166.82
Nov 20, 2024 08:24:34.700572968 CET	49700	587	192.168.2.7	78.110.166.82
Nov 20, 2024 08:24:34.700597048 CET	49700	587	192.168.2.7	78.110.166.82
Nov 20, 2024 08:24:34.700620890 CET	49700	587	192.168.2.7	78.110.166.82
Nov 20, 2024 08:24:34.705353022 CET	587	49700	78.110.166.82	192.168.2.7
Nov 20, 2024 08:24:34.705384970 CET	587	49700	78.110.166.82	192.168.2.7
Nov 20, 2024 08:24:34.705416918 CET	587	49700	78.110.166.82	192.168.2.7
Nov 20, 2024 08:24:34.705471039 CET	587	49700	78.110.166.82	192.168.2.7
Nov 20, 2024 08:24:34.705498934 CET	587	49700	78.110.166.82	192.168.2.7
Nov 20, 2024 08:24:34.974519014 CET	587	49700	78.110.166.82	192.168.2.7
Nov 20, 2024 08:24:35.016361952 CET	49700	587	192.168.2.7	78.110.166.82
Nov 20, 2024 08:26:08.360621929 CET	49700	587	192.168.2.7	78.110.166.82
Nov 20, 2024 08:26:08.365633965 CET	587	49700	78.110.166.82	192.168.2.7
Nov 20, 2024 08:26:08.526612997 CET	587	49700	78.110.166.82	192.168.2.7
Nov 20, 2024 08:26:08.527249098 CET	49700	587	192.168.2.7	78.110.166.82

UDP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Nov 20, 2024 08:24:28.340078115 CET	62317	53	192.168.2.7	1.1.1.1
Nov 20, 2024 08:24:28.389579058 CET	53	62317	1.1.1.1	192.168.2.7
Nov 20, 2024 08:24:44.351644039 CET	53	63073	1.1.1.1	192.168.2.7

DNS Queries

Timestamp	Source IP	Dest IP	Trans ID	OP Code	Name	Type	Class	DNS over HTTPS
Nov 20, 2024 08:24:28.340078115 CET	192.168.2.7	1.1.1.1	0x4fd0	Standard query (0)	zqamcx.com	A (IP address)	IN (0x0001)	false

DNS Answers

Timestamp	Source IP	Dest IP	Trans ID	Reply Code	Name	CName	Address	Type	Class	DNS over HTTPS
Nov 20, 2024 08:24:28.389579058 CET	1.1.1.1	192.168.2.7	0x4fd0	No error (0)	zqamcx.com		78.110.166.82	A (IP address)	IN (0x0001)	false

SMTP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP	Commands
Nov 20, 2024 08:24:29.864047050 CET	587	49699	78.110.166.82	192.168.2.7	220-cphost14.qhoster.net ESMTP Exim 4.96.2 #2 Wed, 20 Nov 2024 07:24:29 +0000 220-We do not authorize the use of this system to transport unsolicited, 220 and/or bulk e-mail.
Nov 20, 2024 08:24:29.865000010 CET	49699	587	192.168.2.7	78.110.166.82	EHLO 287400
Nov 20, 2024 08:24:30.032813072 CET	587	49699	78.110.166.82	192.168.2.7	250-cphost14.qhoster.net Hello 287400 [8.46.123.75] 250-SIZE 52428800 250-8BITMIME 250-PIPELINING 250-PIPECONNECT 250-STARTTLS 250 HELP
Nov 20, 2024 08:24:30.033088923 CET	49699	587	192.168.2.7	78.110.166.82	STARTTLS
Nov 20, 2024 08:24:30.204315901 CET	587	49699	78.110.166.82	192.168.2.7	220 TLS go ahead
Nov 20, 2024 08:24:32.955137968 CET	587	49700	78.110.166.82	192.168.2.7	220-cphost14.qhoster.net ESMTP Exim 4.96.2 #2 Wed, 20 Nov 2024 07:24:32 +0000 220-We do not authorize the use of this system to transport unsolicited, 220 and/or bulk e-mail.
Nov 20, 2024 08:24:32.955328941 CET	49700	587	192.168.2.7	78.110.166.82	EHLO 287400
Nov 20, 2024 08:24:33.121617079 CET	587	49700	78.110.166.82	192.168.2.7	250-cphost14.qhoster.net Hello 287400 [8.46.123.75] 250-SIZE 52428800 250-8BITMIME 250-PIPELINING 250-PIPECONNECT 250-STARTTLS 250 HELP
Nov 20, 2024 08:24:33.121831894 CET	49700	587	192.168.2.7	78.110.166.82	STARTTLS
Nov 20, 2024 08:24:33.291547060 CET	587	49700	78.110.166.82	192.168.2.7	220 TLS go ahead

Target ID:	0
Start time:	02:24:23
Start date:	20/11/2024
Path:	C:\Users\user\Desktop\18112024_Dokman_1 Kas_m 2024- Avans_T24-2112184_dekont.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\Desktop\18112024_Dokman_1 Kas_m 2024- Avans_T24-2112184_dekont.exe"
Imagebase:	0xe10000
File size:	1'275'392 bytes
MD5 hash:	C559B0A76B256E3537598031EAF17C34
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 00000000.00000002.1263016513.0000000001060000.00000004.00001000.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_AgentTesla_1, Description: Yara detected AgentTesla, Source: 00000000.00000002.1263016513.0000000001060000.00000004.00001000.00020000.00000000.sdmp, Author: Joe Security Rule: INDICATOR_SUSPICIOUS_EXE_VaultSchemaGUID, Description: Detects executables referencing Windows vault credential objects. Observed in infostealers, Source: 00000000.00000002.1263016513.0000000001060000.00000004.00001000.00020000.00000000.sdmp, Author: ditekSHen
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	2
Start time:	02:24:24
Start date:	20/11/2024
Path:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\Desktop\18112024_Dokman_1 Kas_m 2024- Avans_T24-2112184_dekont.exe"
Imagebase:	0x700000
File size:	45'984 bytes
MD5 hash:	9D352BC46709F0CB5EC974633A0C3C94
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_AgentTesla_1, Description: Yara detected AgentTesla, Source: 00000002.00000002.3710089637.0000000002AF8000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_AgentTesla_1, Description: Yara detected AgentTesla, Source: 00000002.00000002.3710089637.0000000002ACE000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 00000002.00000002.3708338527.0000000000402000.00000040.80000000.00040000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_AgentTesla_1, Description: Yara detected AgentTesla, Source: 00000002.00000002.3708338527.0000000000402000.00000040.80000000.00040000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 00000002.00000002.3710089637.0000000002A81000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_AgentTesla_1, Description: Yara detected AgentTesla, Source: 00000002.00000002.3710089637.0000000002A81000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security
Reputation:	high
Has exited:	false

Show Windows behavior

Execution Graph

Execution Coverage:	4.1%
Dynamic/Decrypted Code Coverage:	1.5%
Signature Coverage:	9%
Total number of Nodes:	2000
Total number of Limit Nodes:	51

Executed Functions

Function 00E3B043 Relevance: 21.5, APIs: 14, Instructions: 537
COMMONLIBRARYCODE

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Memory Dump Source

Source File: 00000000.00000002.1262750966.0000000000E11000.00000020.00000001.01000000.00000003.sdmp, Offset: 00E10000, based on PE: true

Associated: 00000000.00000002.1262729095.0000000000E10000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1262808979.0000000000E9D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1262808979.0000000000EBE000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1262857687.0000000000ECA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1262878803.0000000000ED4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1262878803.0000000000F07000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_e10000_18112024_Dokman_1 Kas_m 2024- Avans_T24-2112184_dekont.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a698270c3bcf73dfd1913bda44c11ac860d90a2f187f416f56dd34a663f6354a
Instruction ID: eccae51effaab944373122fb15b6b7f136d8a7752286a24310cca7da89496a80
Opcode Fuzzy Hash: a698270c3bcf73dfd1913bda44c11ac860d90a2f187f416f56dd34a663f6354a
Instruction Fuzzy Hash: AA324975B022288FCB248F15DC896E9BBF5FB46314F1851DAE50AE7A91D7309E80CF52

Function 00E13D19 Relevance: 19.4, APIs: 8, Strings: 3, Instructions: 151
windowCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetCurrentDirectoryW.KERNEL32(00007FFF,?,00000000,00000001,?,?,00E13AA3,?), ref: 00E13D45
IsDebuggerPresent.KERNEL32(?,?,?,?,00E13AA3,?), ref: 00E13D57
GetFullPathNameW.KERNEL32(00007FFF,?,?,00ED1148,00ED1130,?,?,?,?,00E13AA3,?), ref: 00E13DC8

Part of subcall function 00E16430: GetFullPathNameW.KERNEL32(?,00007FFF,?,?,?,00E13DEE,00ED1148,?,?,?,?,?,00E13AA3,?), ref: 00E16471

SetCurrentDirectoryW.KERNEL32(?,?,?,00E13AA3,?), ref: 00E13E48
MessageBoxA.USER32(00000000,This is a third-party compiled AutoIt script.,00EC28F4,00000010), ref: 00E81CCE
SetCurrentDirectoryW.KERNEL32(?,00ED1148,?,?,?,?,?,00E13AA3,?), ref: 00E81D06
GetForegroundWindow.USER32(runas,?,?,?,00000001,?,00EADAB4,00ED1148,?,?,?,?,?,00E13AA3,?), ref: 00E81D89
ShellExecuteW.SHELL32(00000000,?,?,?,?,00E13AA3), ref: 00E81D90

Part of subcall function 00E13E6E: GetSysColorBrush.USER32(0000000F), ref: 00E13E79
Part of subcall function 00E13E6E: LoadCursorW.USER32(00000000,00007F00), ref: 00E13E88
Part of subcall function 00E13E6E: LoadIconW.USER32(00000063), ref: 00E13E9E
Part of subcall function 00E13E6E: LoadIconW.USER32(000000A4), ref: 00E13EB0
Part of subcall function 00E13E6E: LoadIconW.USER32(000000A2), ref: 00E13EC2
Part of subcall function 00E13E6E: RegisterClassExW.USER32(?), ref: 00E13F30

Part of subcall function 00E136B8: CreateWindowExW.USER32(00000000,AutoIt v3,AutoIt v3,00CF0000,80000000,80000000,0000012C,00000064,00000000,00000000,00000000,00000001), ref: 00E136E6
Part of subcall function 00E136B8: CreateWindowExW.USER32(00000000,edit,00000000,50B008C4,00000000,00000000,00000000,00000000,00000000,00000001,00000000), ref: 00E13707
Part of subcall function 00E136B8: ShowWindow.USER32(00000000,?,?,?,?,00E13AA3,?), ref: 00E1371B
Part of subcall function 00E136B8: ShowWindow.USER32(00000000,?,?,?,?,00E13AA3,?), ref: 00E13724

Part of subcall function 00E14FFC: _memset.LIBCMT ref: 00E15022
Part of subcall function 00E14FFC: Shell_NotifyIconW.SHELL32(00000000,?), ref: 00E150CB

Strings

runas, xrefs: 00E81D84
This is a third-party compiled AutoIt script., xrefs: 00E81CC8
(), xrefs: 00E81D49

Memory Dump Source

Source File: 00000000.00000002.1262750966.0000000000E11000.00000020.00000001.01000000.00000003.sdmp, Offset: 00E10000, based on PE: true

Associated: 00000000.00000002.1262729095.0000000000E10000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1262808979.0000000000E9D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1262808979.0000000000EBE000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1262857687.0000000000ECA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1262878803.0000000000ED4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1262878803.0000000000F07000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_e10000_18112024_Dokman_1 Kas_m 2024- Avans_T24-2112184_dekont.jbxd

Similarity

API ID: Window$IconLoad$CurrentDirectory$CreateFullNamePathShow$BrushClassColorCursorDebuggerExecuteForegroundMessageNotifyPresentRegisterShellShell__memset
String ID: ()$This is a third-party compiled AutoIt script.$runas
API String ID: 438480954-3074634049
Opcode ID: 94a46dc6753b801c68278593436f6032bc7e918432600a3b71e5a2f61c0000d3
Instruction ID: 58d90aba3fd4cca6d4d8302e75afaf43f122b9572e375f157652f7f437bfe2fe
Opcode Fuzzy Hash: 94a46dc6753b801c68278593436f6032bc7e918432600a3b71e5a2f61c0000d3
Instruction Fuzzy Hash: BA510931A06345BECF11BBF1EC42EED7BB9DB55744F0060ABF611B6192DA70468AC721

Function 00E2DDC0 Relevance: 10.7, APIs: 7, Instructions: 175
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetVersionExW.KERNEL32(?), ref: 00E2DDEC
GetCurrentProcess.KERNEL32(00000000,00EADC38,?,?), ref: 00E2DEAC
GetNativeSystemInfo.KERNEL32(?,00EADC38,?,?), ref: 00E2DF01
FreeLibrary.KERNEL32(00000000,?,?), ref: 00E2DF0C
FreeLibrary.KERNEL32(00000000,?,?), ref: 00E2DF1F
GetSystemInfo.KERNEL32(?,00EADC38,?,?), ref: 00E2DF29
GetSystemInfo.KERNEL32(?,00EADC38,?,?), ref: 00E2DF35

Memory Dump Source

Source File: 00000000.00000002.1262750966.0000000000E11000.00000020.00000001.01000000.00000003.sdmp, Offset: 00E10000, based on PE: true

Associated: 00000000.00000002.1262729095.0000000000E10000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1262808979.0000000000E9D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1262808979.0000000000EBE000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1262857687.0000000000ECA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1262878803.0000000000ED4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1262878803.0000000000F07000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_e10000_18112024_Dokman_1 Kas_m 2024- Avans_T24-2112184_dekont.jbxd

Similarity

API ID: InfoSystem$FreeLibrary$CurrentNativeProcessVersion
String ID:
API String ID: 3851250370-0
Opcode ID: 93e41d64ad331fa9296d8f06c1640d5e29114794d7f6c392f827da4ef2a1777e
Instruction ID: 66736b54e5a4dc50cbcbc783fd8428ee0553d2f70c4be4936747c6fa6ec41389
Opcode Fuzzy Hash: 93e41d64ad331fa9296d8f06c1640d5e29114794d7f6c392f827da4ef2a1777e
Instruction Fuzzy Hash: 8B61E3B190E394CFCF11DF68A8C11E97FB4AF29304B1999D9D949BF207C624C908CB69

Function 00E1406B Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 61
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateStreamOnHGlobal.COMBASE(00000000,00000001,?,?,?,?,?,00E1449E,?,?,00000000,00000001), ref: 00E1407B
FindResourceExW.KERNEL32(?,0000000A,SCRIPT,00000000,?,?,00E1449E,?,?,00000000,00000001), ref: 00E14092
LoadResource.KERNEL32(?,00000000,?,?,00E1449E,?,?,00000000,00000001,?,?,?,?,?,?,00E141FB), ref: 00E84F1A
SizeofResource.KERNEL32(?,00000000,?,?,00E1449E,?,?,00000000,00000001,?,?,?,?,?,?,00E141FB), ref: 00E84F2F
LockResource.KERNEL32(00E1449E,?,?,00E1449E,?,?,00000000,00000001,?,?,?,?,?,?,00E141FB,00000000), ref: 00E84F42

Strings

SCRIPT, xrefs: 00E14088

Memory Dump Source

Source File: 00000000.00000002.1262750966.0000000000E11000.00000020.00000001.01000000.00000003.sdmp, Offset: 00E10000, based on PE: true

Associated: 00000000.00000002.1262729095.0000000000E10000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1262808979.0000000000E9D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1262808979.0000000000EBE000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1262857687.0000000000ECA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1262878803.0000000000ED4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1262878803.0000000000F07000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_e10000_18112024_Dokman_1 Kas_m 2024- Avans_T24-2112184_dekont.jbxd

Similarity

API ID: Resource$CreateFindGlobalLoadLockSizeofStream
String ID: SCRIPT
API String ID: 3051347437-3967369404
Opcode ID: 586b44b125ddfe0bf1fc0d7b8a18f8227304de883994de58cdce8f8f76937331
Instruction ID: 1629515e3279d55d6c9622134b5c05957cc4f97831f2bad3b709159a5e529b5b
Opcode Fuzzy Hash: 586b44b125ddfe0bf1fc0d7b8a18f8227304de883994de58cdce8f8f76937331
Instruction Fuzzy Hash: B21173B0204711BFE7254B16EC48F677BB9EBC9755F20412DF601A62E0DB71DC448621

Function 00E56CA9 Relevance: 7.0, APIs: 3, Strings: 1, Instructions: 25fileCOMMON

Download Yara Rule

APIs

GetFileAttributesW.KERNEL32(?,I/), ref: 00E56CB9
FindFirstFileW.KERNEL32(?,?), ref: 00E56CCA
FindClose.KERNEL32(00000000), ref: 00E56CDA

Strings

I/, xrefs: 00E56CB5

Memory Dump Source

Source File: 00000000.00000002.1262750966.0000000000E11000.00000020.00000001.01000000.00000003.sdmp, Offset: 00E10000, based on PE: true

Associated: 00000000.00000002.1262729095.0000000000E10000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1262808979.0000000000E9D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1262808979.0000000000EBE000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1262857687.0000000000ECA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1262878803.0000000000ED4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1262878803.0000000000F07000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_e10000_18112024_Dokman_1 Kas_m 2024- Avans_T24-2112184_dekont.jbxd

Similarity

API ID: FileFind$AttributesCloseFirst
String ID: I/
API String ID: 48322524-530815126
Opcode ID: 2c702e541659f46bab167bf80dd52a3eb007de0cf8d352de354e0c79acf0c760
Instruction ID: b6410270af6b12d5a234c25dd5bba77437afef816511376daf415ccd018559a0
Opcode Fuzzy Hash: 2c702e541659f46bab167bf80dd52a3eb007de0cf8d352de354e0c79acf0c760
Instruction Fuzzy Hash: BAE0D8328154205B82106739EC0D4E9776CDB0533AF500B47F872E31E0E770DD4845D5

Function 00E23B70 Relevance: 5.9, Strings: 4, Instructions: 903COMMON

Download Yara Rule

Strings

, xrefs: 00E240EC
, xrefs: 00E8701F
@, xrefs: 00E24176
, xrefs: 00E240A4

Memory Dump Source

Source File: 00000000.00000002.1262750966.0000000000E11000.00000020.00000001.01000000.00000003.sdmp, Offset: 00E10000, based on PE: true

Associated: 00000000.00000002.1262729095.0000000000E10000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1262808979.0000000000E9D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1262808979.0000000000EBE000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1262857687.0000000000ECA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1262878803.0000000000ED4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1262878803.0000000000F07000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_e10000_18112024_Dokman_1 Kas_m 2024- Avans_T24-2112184_dekont.jbxd

Similarity

API ID: Exception@8Throwstd::exception::exception
String ID: @$ $ $
API String ID: 3728558374-1762808387
Opcode ID: 4230e86e3157e4e36c429ed93c32f9a8560497e63f1fea25a122244f100ab78a
Instruction ID: ea1a3f59469622e9430ab1092cad0a754864c4dd5a5bd45ff1732a7cf57dd5de
Opcode Fuzzy Hash: 4230e86e3157e4e36c429ed93c32f9a8560497e63f1fea25a122244f100ab78a
Instruction Fuzzy Hash: 0572A071E04218DFCB14EFA4D881AEEB7B5EF48304F24905AE909BB291D735EE45CB91

Function 00E23200 Relevance: 2.2, Strings: 1, Instructions: 986COMMON

Download Yara Rule

Strings

, xrefs: 00E8933E

Memory Dump Source

Source File: 00000000.00000002.1262750966.0000000000E11000.00000020.00000001.01000000.00000003.sdmp, Offset: 00E10000, based on PE: true

Associated: 00000000.00000002.1262729095.0000000000E10000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1262808979.0000000000E9D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1262808979.0000000000EBE000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1262857687.0000000000ECA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1262878803.0000000000ED4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1262878803.0000000000F07000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_e10000_18112024_Dokman_1 Kas_m 2024- Avans_T24-2112184_dekont.jbxd

Similarity

API ID: BuffCharUpper
String ID:
API String ID: 3964851224-3209568608
Opcode ID: d959a2af62a13625c7e4eb739f5cff8c203aa5505dc2d659b5e22cdd2f99a80b
Instruction ID: aa07324ead7f646ef04a3e3a4afa620926097ba0eae3a0356738c27b9d0f7cb8
Opcode Fuzzy Hash: d959a2af62a13625c7e4eb739f5cff8c203aa5505dc2d659b5e22cdd2f99a80b
Instruction Fuzzy Hash: 3D92AC706083118FD724DF28D480B6AB7E1BF88308F14A85DE99AAB362D775ED45CF52

Function 00E1E8D0 Relevance: 49.8, APIs: 24, Strings: 4, Instructions: 816windowsleeptimeCOMMON

Download Yara Rule

APIs

PeekMessageW.USER32(?,00000000,00000000,00000000,00000001), ref: 00E1E959
timeGetTime.WINMM ref: 00E1EBFA
PeekMessageW.USER32(?,00000000,00000000,00000000,00000001), ref: 00E1ED2E
TranslateMessage.USER32(?), ref: 00E1ED3F
DispatchMessageW.USER32(?), ref: 00E1ED4A
LockWindowUpdate.USER32(00000000), ref: 00E1ED79
DestroyWindow.USER32 ref: 00E1ED85
GetMessageW.USER32(?,00000000,00000000,00000000), ref: 00E1ED9F
Sleep.KERNEL32(0000000A), ref: 00E85270
TranslateMessage.USER32(?), ref: 00E859F7
DispatchMessageW.USER32(?), ref: 00E85A05
GetMessageW.USER32(?,00000000,00000000,00000000), ref: 00E85A19

Strings

@TRAY_ID, xrefs: 00E854C9
@GUI_CTRLID, xrefs: 00E85314
@GUI_CTRLHANDLE, xrefs: 00E853AC
@GUI_WINHANDLE, xrefs: 00E85360

Memory Dump Source

Source File: 00000000.00000002.1262750966.0000000000E11000.00000020.00000001.01000000.00000003.sdmp, Offset: 00E10000, based on PE: true

Associated: 00000000.00000002.1262729095.0000000000E10000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1262808979.0000000000E9D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1262808979.0000000000EBE000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1262857687.0000000000ECA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1262878803.0000000000ED4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1262878803.0000000000F07000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_e10000_18112024_Dokman_1 Kas_m 2024- Avans_T24-2112184_dekont.jbxd

Similarity

API ID: Message$DispatchPeekTranslateWindow$DestroyLockSleepTimeUpdatetime
String ID: @GUI_CTRLHANDLE$@GUI_CTRLID$@GUI_WINHANDLE$@TRAY_ID
API String ID: 2641332412-570651680
Opcode ID: dcc9dc7d9e3029b2e087ae386ccc74cd169216bcd6f0d75f64d2cbce2f4a8c72
Instruction ID: 8da2597614ca28046b4bbac7161f7582d2aea272c5cfa8b3d1d2b62cd2e8eb1a
Opcode Fuzzy Hash: dcc9dc7d9e3029b2e087ae386ccc74cd169216bcd6f0d75f64d2cbce2f4a8c72
Instruction Fuzzy Hash: D662B071508340DFDB24DF24C885BEA77E4BF44304F14696EF94ABB292DB759888CB52

Function 00E45C78 Relevance: 47.9, APIs: 26, Strings: 1, Instructions: 626fileCOMMONLIBRARYCODE

Download Yara Rule

APIs

___createFile.LIBCMT ref: 00E45EC3
___createFile.LIBCMT ref: 00E45F04
GetLastError.KERNEL32(?,?,?,?,?,00000000,00000109), ref: 00E45F2D
__dosmaperr.LIBCMT ref: 00E45F34
GetFileType.KERNEL32(00000000,?,?,?,?,?,00000000,00000109), ref: 00E45F47
GetLastError.KERNEL32(?,?,?,?,?,00000000,00000109), ref: 00E45F6A
__dosmaperr.LIBCMT ref: 00E45F73
CloseHandle.KERNEL32(00000000,?,?,?,?,?,00000000,00000109), ref: 00E45F7C
__set_osfhnd.LIBCMT ref: 00E45FAC
__lseeki64_nolock.LIBCMT ref: 00E46016
__close_nolock.LIBCMT ref: 00E4603C
__chsize_nolock.LIBCMT ref: 00E4606C
__lseeki64_nolock.LIBCMT ref: 00E4607E
__lseeki64_nolock.LIBCMT ref: 00E46176
__lseeki64_nolock.LIBCMT ref: 00E4618B
__close_nolock.LIBCMT ref: 00E461EB

Part of subcall function 00E3EA9C: CloseHandle.KERNEL32(00000000,00EBEEF4,00000000,?,00E46041,00EBEEF4,?,?,?,?,?,?,?,?,00000000,00000109), ref: 00E3EAEC
Part of subcall function 00E3EA9C: GetLastError.KERNEL32(?,00E46041,00EBEEF4,?,?,?,?,?,?,?,?,00000000,00000109), ref: 00E3EAF6
Part of subcall function 00E3EA9C: __free_osfhnd.LIBCMT ref: 00E3EB03
Part of subcall function 00E3EA9C: __dosmaperr.LIBCMT ref: 00E3EB25

Part of subcall function 00E37C0E: __getptd_noexit.LIBCMT ref: 00E37C0E

__lseeki64_nolock.LIBCMT ref: 00E4620D
CloseHandle.KERNEL32(00000000,?,?,?,?,?,00000000,00000109), ref: 00E46342
___createFile.LIBCMT ref: 00E46361
GetLastError.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,00000000,00000109), ref: 00E4636E
__dosmaperr.LIBCMT ref: 00E46375
__free_osfhnd.LIBCMT ref: 00E46395
__invoke_watson.LIBCMT ref: 00E463C3
__wsopen_helper.LIBCMT ref: 00E463DD

Strings

@, xrefs: 00E45F98

Memory Dump Source

Source File: 00000000.00000002.1262750966.0000000000E11000.00000020.00000001.01000000.00000003.sdmp, Offset: 00E10000, based on PE: true

Associated: 00000000.00000002.1262729095.0000000000E10000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1262808979.0000000000E9D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1262808979.0000000000EBE000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1262857687.0000000000ECA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1262878803.0000000000ED4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1262878803.0000000000F07000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_e10000_18112024_Dokman_1 Kas_m 2024- Avans_T24-2112184_dekont.jbxd

Similarity

API ID: __lseeki64_nolock$ErrorFileLast__dosmaperr$CloseHandle___create$__close_nolock__free_osfhnd$Type__chsize_nolock__getptd_noexit__invoke_watson__set_osfhnd__wsopen_helper
String ID: @
API String ID: 3896587723-2766056989
Opcode ID: 1c9e30a604a1661c8a58b3ca727f96f0987e9abb7afaf291334b1d893e62cf24
Instruction ID: 49b067c09ab68d07c325a34f9d40abd63da0e406c8a9db84c826d7b68288e92e
Opcode Fuzzy Hash: 1c9e30a604a1661c8a58b3ca727f96f0987e9abb7afaf291334b1d893e62cf24
Instruction Fuzzy Hash: AA222672D00505AFEB299F68EC45BEE7B61EF45328F246229E551BB2E2C3358D40C752

Function 00E5FA0C Relevance: 26.5, APIs: 13, Strings: 2, Instructions: 238
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

_wcscpy.LIBCMT ref: 00E5FA96
_wcschr.LIBCMT ref: 00E5FAA4
_wcscpy.LIBCMT ref: 00E5FABB
_wcscat.LIBCMT ref: 00E5FACA
_wcscat.LIBCMT ref: 00E5FAE8
_wcscpy.LIBCMT ref: 00E5FB09
__wsplitpath.LIBCMT ref: 00E5FBE6
_wcscpy.LIBCMT ref: 00E5FC0B
_wcscpy.LIBCMT ref: 00E5FC1D
_wcscpy.LIBCMT ref: 00E5FC32
_wcscat.LIBCMT ref: 00E5FC47
_wcscat.LIBCMT ref: 00E5FC59
_wcscat.LIBCMT ref: 00E5FC6E

Part of subcall function 00E5BFA4: _wcscmp.LIBCMT ref: 00E5C03E
Part of subcall function 00E5BFA4: __wsplitpath.LIBCMT ref: 00E5C083
Part of subcall function 00E5BFA4: _wcscpy.LIBCMT ref: 00E5C096
Part of subcall function 00E5BFA4: _wcscat.LIBCMT ref: 00E5C0A9
Part of subcall function 00E5BFA4: __wsplitpath.LIBCMT ref: 00E5C0CE
Part of subcall function 00E5BFA4: _wcscat.LIBCMT ref: 00E5C0E4
Part of subcall function 00E5BFA4: _wcscat.LIBCMT ref: 00E5C0F7

Strings

t2, xrefs: 00E5FC97
>>>AUTOIT SCRIPT<<<, xrefs: 00E5FA61

Memory Dump Source

Source File: 00000000.00000002.1262750966.0000000000E11000.00000020.00000001.01000000.00000003.sdmp, Offset: 00E10000, based on PE: true

Associated: 00000000.00000002.1262729095.0000000000E10000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1262808979.0000000000E9D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1262808979.0000000000EBE000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1262857687.0000000000ECA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1262878803.0000000000ED4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1262878803.0000000000F07000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_e10000_18112024_Dokman_1 Kas_m 2024- Avans_T24-2112184_dekont.jbxd

Similarity

API ID: _wcscat$_wcscpy$__wsplitpath$_wcschr_wcscmp
String ID: >>>AUTOIT SCRIPT<<<$t2
API String ID: 2955681530-945735720
Opcode ID: 422cac892d9f5c964530aebdae2643d2676054152d06ce81ab7b2aa8dc46634a
Instruction ID: 421d2ce7c16ce7b1f41626e96962f3a8968b57e92cbaf7288c2d2f74004c9606
Opcode Fuzzy Hash: 422cac892d9f5c964530aebdae2643d2676054152d06ce81ab7b2aa8dc46634a
Instruction Fuzzy Hash: 9391C471504305AFCB20EB50C855F9FB3E8BF84314F00686DF999A7292DB31EA48CB96

Function 00E3EE0E Relevance: 26.2, APIs: 17, Instructions: 664COMMONLIBRARYCODE

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1262750966.0000000000E11000.00000020.00000001.01000000.00000003.sdmp, Offset: 00E10000, based on PE: true

Associated: 00000000.00000002.1262729095.0000000000E10000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1262808979.0000000000E9D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1262808979.0000000000EBE000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1262857687.0000000000ECA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1262878803.0000000000ED4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1262878803.0000000000F07000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_e10000_18112024_Dokman_1 Kas_m 2024- Avans_T24-2112184_dekont.jbxd

Similarity

API ID: __getptd_noexit
String ID:
API String ID: 3074181302-0
Opcode ID: 5e712c09969ab7138f4317b037749a0058a0ce4ff47c56f391cdb50c5515c29a
Instruction ID: 4a5793b78a85f33d454e3556ff641edaf3b98702ec57e1ace5b75bf9eb646413
Opcode Fuzzy Hash: 5e712c09969ab7138f4317b037749a0058a0ce4ff47c56f391cdb50c5515c29a
Instruction Fuzzy Hash: 61324A71E04285DFDB218F68D848BBD7FB1EF85314F28616AE895BB292C7709C45CB60

Function 00E13F53 Relevance: 19.3, APIs: 7, Strings: 4, Instructions: 53
windowregistryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetSysColorBrush.USER32(0000000F), ref: 00E13F86
RegisterClassExW.USER32(00000030), ref: 00E13FB0
RegisterWindowMessageW.USER32(TaskbarCreated), ref: 00E13FC1
InitCommonControlsEx.COMCTL32(?), ref: 00E13FDE
ImageList_Create.COMCTL32(00000010,00000010,00000021,00000001,00000001), ref: 00E13FEE
LoadIconW.USER32(000000A9), ref: 00E14004
ImageList_ReplaceIcon.COMCTL32(000000FF,00000000), ref: 00E14013

Strings

+, xrefs: 00E13F6F
TaskbarCreated, xrefs: 00E13FB6
0, xrefs: 00E13F68
AutoIt v3 GUI, xrefs: 00E13FA2

Memory Dump Source

Source File: 00000000.00000002.1262750966.0000000000E11000.00000020.00000001.01000000.00000003.sdmp, Offset: 00E10000, based on PE: true

Associated: 00000000.00000002.1262729095.0000000000E10000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1262808979.0000000000E9D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1262808979.0000000000EBE000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1262857687.0000000000ECA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1262878803.0000000000ED4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1262878803.0000000000F07000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_e10000_18112024_Dokman_1 Kas_m 2024- Avans_T24-2112184_dekont.jbxd

Similarity

API ID: IconImageList_Register$BrushClassColorCommonControlsCreateInitLoadMessageReplaceWindow
String ID: +$0$AutoIt v3 GUI$TaskbarCreated
API String ID: 2914291525-1005189915
Opcode ID: a841781080bf4d7808d9e235f26dac4f26316c25b4fff8f7c22ea0fbdfb28d40
Instruction ID: 3fed22a9379eef382cd3853f18b572e5074a7949321f72b96b8b6b94e0052f1f
Opcode Fuzzy Hash: a841781080bf4d7808d9e235f26dac4f26316c25b4fff8f7c22ea0fbdfb28d40
Instruction Fuzzy Hash: 6421B2B5905318BFDB009FA6EC89BCDBBB5FB08700F00425BF621B62A0D7B545488F91

Function 00E5BFA4 Relevance: 18.3, APIs: 12, Instructions: 316
fileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 00E5BDB4: __time64.LIBCMT ref: 00E5BDBE

Part of subcall function 00E14517: _fseek.LIBCMT ref: 00E1452F

__wsplitpath.LIBCMT ref: 00E5C083

Part of subcall function 00E31DFC: __wsplitpath_helper.LIBCMT ref: 00E31E3C

_wcscpy.LIBCMT ref: 00E5C096
_wcscat.LIBCMT ref: 00E5C0A9
__wsplitpath.LIBCMT ref: 00E5C0CE
_wcscat.LIBCMT ref: 00E5C0E4
_wcscat.LIBCMT ref: 00E5C0F7
_wcscmp.LIBCMT ref: 00E5C03E

Part of subcall function 00E5C56D: _wcscmp.LIBCMT ref: 00E5C65D
Part of subcall function 00E5C56D: _wcscmp.LIBCMT ref: 00E5C670

DeleteFileW.KERNEL32(?,?,?,?,00000004,00000001,?,?,00000004,00000001,?,?,00000004,00000001,?,?), ref: 00E5C2A1
DeleteFileW.KERNEL32(?,?,?,?,?,?,00000004,00000001,?,?,00000004,00000001,?,?,00000004,00000001), ref: 00E5C338
CopyFileW.KERNEL32(?,?,00000000,?,?,?,00000004,00000001,?,?,00000004,00000001,?,?,00000004,00000001), ref: 00E5C34E
DeleteFileW.KERNEL32(?,?,?,00000004,00000001,?,?,00000004,00000001,?,?,00000004,00000001,?,?,00000004), ref: 00E5C35F
DeleteFileW.KERNEL32(?,?,?,00000004,00000001,?,?,00000004,00000001,?,?,00000004,00000001,?,?,00000004), ref: 00E5C371

Memory Dump Source

Source File: 00000000.00000002.1262750966.0000000000E11000.00000020.00000001.01000000.00000003.sdmp, Offset: 00E10000, based on PE: true

Associated: 00000000.00000002.1262729095.0000000000E10000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1262808979.0000000000E9D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1262808979.0000000000EBE000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1262857687.0000000000ECA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1262878803.0000000000ED4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1262878803.0000000000F07000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_e10000_18112024_Dokman_1 Kas_m 2024- Avans_T24-2112184_dekont.jbxd

Similarity

API ID: File$Delete$_wcscat_wcscmp$__wsplitpath$Copy__time64__wsplitpath_helper_fseek_wcscpy
String ID:
API String ID: 2378138488-0
Opcode ID: 2e03ac99bfcc56825ff465065d9ff151e197852b5e079b07a1e1ae84049bc01d
Instruction ID: 75dd19443e72f6714c5db672e78dd0534a23acd16dab9ad337810ac4b9f66051
Opcode Fuzzy Hash: 2e03ac99bfcc56825ff465065d9ff151e197852b5e079b07a1e1ae84049bc01d
Instruction Fuzzy Hash: 44C13BB1900219AFCF11DFA5CC85EDEBBB8AF49304F1054AAE609F6151DB709A888F61

Function 00E13742 Relevance: 15.9, APIs: 8, Strings: 1, Instructions: 151
windowtimeregistryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

DefWindowProcW.USER32(?,?,?,?), ref: 00E137B3
KillTimer.USER32(?,00000001), ref: 00E137DD
SetTimer.USER32(?,00000001,000002EE,00000000), ref: 00E13800
RegisterWindowMessageW.USER32(TaskbarCreated), ref: 00E1380B
CreatePopupMenu.USER32 ref: 00E1381F
PostQuitMessage.USER32(00000000), ref: 00E1382E

Strings

TaskbarCreated, xrefs: 00E13806

Memory Dump Source

Source File: 00000000.00000002.1262750966.0000000000E11000.00000020.00000001.01000000.00000003.sdmp, Offset: 00E10000, based on PE: true

Associated: 00000000.00000002.1262729095.0000000000E10000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1262808979.0000000000E9D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1262808979.0000000000EBE000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1262857687.0000000000ECA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1262878803.0000000000ED4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1262878803.0000000000F07000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_e10000_18112024_Dokman_1 Kas_m 2024- Avans_T24-2112184_dekont.jbxd

Similarity

API ID: MessageTimerWindow$CreateKillMenuPopupPostProcQuitRegister
String ID: TaskbarCreated
API String ID: 129472671-2362178303
Opcode ID: 11373fb2492dd1939e908b0b7bf8d677944c66b6e48a35f51aeae337f3644b07
Instruction ID: fbdbdd8c227cdfa68d789d215ec016bdb4482a329b7702881efd0b8835dccf3c
Opcode Fuzzy Hash: 11373fb2492dd1939e908b0b7bf8d677944c66b6e48a35f51aeae337f3644b07
Instruction Fuzzy Hash: A14123F5204216BFDB146B79AC4ABFB37A9FB40305F04215BF916B22E1CA209ED58761

Function 00E13E6E Relevance: 15.8, APIs: 6, Strings: 3, Instructions: 66
windowregistryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetSysColorBrush.USER32(0000000F), ref: 00E13E79
LoadCursorW.USER32(00000000,00007F00), ref: 00E13E88
LoadIconW.USER32(00000063), ref: 00E13E9E
LoadIconW.USER32(000000A4), ref: 00E13EB0
LoadIconW.USER32(000000A2), ref: 00E13EC2

Part of subcall function 00E14024: LoadImageW.USER32(00E10000,00000063,00000001,00000010,00000010,00000000), ref: 00E14048

RegisterClassExW.USER32(?), ref: 00E13F30

Part of subcall function 00E13F53: GetSysColorBrush.USER32(0000000F), ref: 00E13F86
Part of subcall function 00E13F53: RegisterClassExW.USER32(00000030), ref: 00E13FB0
Part of subcall function 00E13F53: RegisterWindowMessageW.USER32(TaskbarCreated), ref: 00E13FC1
Part of subcall function 00E13F53: InitCommonControlsEx.COMCTL32(?), ref: 00E13FDE
Part of subcall function 00E13F53: ImageList_Create.COMCTL32(00000010,00000010,00000021,00000001,00000001), ref: 00E13FEE
Part of subcall function 00E13F53: LoadIconW.USER32(000000A9), ref: 00E14004
Part of subcall function 00E13F53: ImageList_ReplaceIcon.COMCTL32(000000FF,00000000), ref: 00E14013

Strings

0, xrefs: 00E13F02
AutoIt v3, xrefs: 00E13F1F
#, xrefs: 00E13F09

Memory Dump Source

Source File: 00000000.00000002.1262750966.0000000000E11000.00000020.00000001.01000000.00000003.sdmp, Offset: 00E10000, based on PE: true

Associated: 00000000.00000002.1262729095.0000000000E10000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1262808979.0000000000E9D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1262808979.0000000000EBE000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1262857687.0000000000ECA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1262878803.0000000000ED4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1262878803.0000000000F07000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_e10000_18112024_Dokman_1 Kas_m 2024- Avans_T24-2112184_dekont.jbxd

Similarity

API ID: Load$Icon$ImageRegister$BrushClassColorList_$CommonControlsCreateCursorInitMessageReplaceWindow
String ID: #$0$AutoIt v3
API String ID: 423443420-4155596026
Opcode ID: fdfc4e8e16942b19a7a4b6013a1fbbb392475b828c336844519defdf1e79af22
Instruction ID: bb8bbf75ce5155ccbbc831a8c0eb5753adc53a4827d5d801559dc0de5a6a04a0
Opcode Fuzzy Hash: fdfc4e8e16942b19a7a4b6013a1fbbb392475b828c336844519defdf1e79af22
Instruction Fuzzy Hash: B3212CB0E06314BFDB00DFAAFD45A99BBF5EB48310F10416BE214B62A0D7754A888B91

Function 00E3ACB3 Relevance: 15.2, APIs: 10, Instructions: 219
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

__lock.LIBCMT ref: 00E3ACC1

Part of subcall function 00E37CF4: __mtinitlocknum.LIBCMT ref: 00E37D06
Part of subcall function 00E37CF4: EnterCriticalSection.KERNEL32(00000000,?,00E37ADD,0000000D), ref: 00E37D1F

__calloc_crt.LIBCMT ref: 00E3ACD2

Part of subcall function 00E36986: __calloc_impl.LIBCMT ref: 00E36995
Part of subcall function 00E36986: Sleep.KERNEL32(00000000,000003BC,00E2F507,?,0000000E), ref: 00E369AC

@_EH4_CallFilterFunc@8.LIBCMT ref: 00E3ACED
GetStartupInfoW.KERNEL32(?,00EC6E28,00000064,00E35E91,00EC6C70,00000014), ref: 00E3AD46
__calloc_crt.LIBCMT ref: 00E3AD91
GetFileType.KERNEL32(00000001), ref: 00E3ADD8
InitializeCriticalSectionAndSpinCount.KERNEL32(0000000D,00000FA0), ref: 00E3AE11

Memory Dump Source

Source File: 00000000.00000002.1262750966.0000000000E11000.00000020.00000001.01000000.00000003.sdmp, Offset: 00E10000, based on PE: true

Associated: 00000000.00000002.1262729095.0000000000E10000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1262808979.0000000000E9D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1262808979.0000000000EBE000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1262857687.0000000000ECA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1262878803.0000000000ED4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1262878803.0000000000F07000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_e10000_18112024_Dokman_1 Kas_m 2024- Avans_T24-2112184_dekont.jbxd

Similarity

API ID: CriticalSection__calloc_crt$CallCountEnterFileFilterFunc@8InfoInitializeSleepSpinStartupType__calloc_impl__lock__mtinitlocknum
String ID:
API String ID: 1426640281-0
Opcode ID: fdbc29cd0369f64076ab62d72382f91645c45fa127585d59b52a8376bb94657b
Instruction ID: 788104e6162b49807823c2aad073c7d3f107079c74cab33b538d619d2ca18fef
Opcode Fuzzy Hash: fdbc29cd0369f64076ab62d72382f91645c45fa127585d59b52a8376bb94657b
Instruction Fuzzy Hash: EE81D1709053458FCB14CF69C8485ADBFF0AF45328F28626EE4A6BB3D1C7349882CB56

Function 011163F8 Relevance: 10.7, APIs: 7, Instructions: 239
fileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateFileW.KERNEL32(00000000,?,80000000,00000007,00000000,00000003,00000080,00000000,?,00000000), ref: 011164C9
VirtualFree.KERNELBASE(00000000,00000000,00008000,00000000,00000000,00000000,00000000,?,?,00000000), ref: 011166EF

Memory Dump Source

Source File: 00000000.00000002.1263159453.0000000001113000.00000040.00000020.00020000.00000000.sdmp, Offset: 01113000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1113000_18112024_Dokman_1 Kas_m 2024- Avans_T24-2112184_dekont.jbxd

Similarity

API ID: CreateFileFreeVirtual
String ID:
API String ID: 204039940-0
Opcode ID: 640a513b0a1dc75cf27b9d1dcd7263df352c7e5bc7e4f1208c2f85c57f315c64
Instruction ID: 4951db234a7bf5dbcd5655e4a301b4a0075ea8256d97212853e194b1d06861a3
Opcode Fuzzy Hash: 640a513b0a1dc75cf27b9d1dcd7263df352c7e5bc7e4f1208c2f85c57f315c64
Instruction Fuzzy Hash: 27A10874E00209EBDB18CFA4C994BEEFBB5BF48304F208569E501BB284D7B69A41CF55

Function 00E149FB Relevance: 10.6, APIs: 4, Strings: 2, Instructions: 73
registryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

RegOpenKeyExW.KERNEL32(80000001,Software\AutoIt v3\AutoIt,00000000,00000001,?), ref: 00E14A1D
RegQueryValueExW.ADVAPI32(?,Include,00000000,00000000,00000000,?), ref: 00E841DB
RegQueryValueExW.ADVAPI32(?,Include,00000000,00000000,?,?,00000000), ref: 00E8421A
RegCloseKey.ADVAPI32(?), ref: 00E84249

Strings

Software\AutoIt v3\AutoIt, xrefs: 00E14A13
Include, xrefs: 00E841D3, 00E84212

Memory Dump Source

Source File: 00000000.00000002.1262750966.0000000000E11000.00000020.00000001.01000000.00000003.sdmp, Offset: 00E10000, based on PE: true

Associated: 00000000.00000002.1262729095.0000000000E10000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1262808979.0000000000E9D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1262808979.0000000000EBE000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1262857687.0000000000ECA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1262878803.0000000000ED4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1262878803.0000000000F07000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_e10000_18112024_Dokman_1 Kas_m 2024- Avans_T24-2112184_dekont.jbxd

Similarity

API ID: QueryValue$CloseOpen
String ID: Include$Software\AutoIt v3\AutoIt
API String ID: 1586453840-614718249
Opcode ID: e57955f062246174d7a0a472b4b155624faa4dedd4a7eee97a1159c687fc9c55
Instruction ID: a4d0cca0e9efd3f16b4e014405d77e085b46f053d020ed9579a2fd83a3ffe324
Opcode Fuzzy Hash: e57955f062246174d7a0a472b4b155624faa4dedd4a7eee97a1159c687fc9c55
Instruction Fuzzy Hash: F3114FB1605219BFEB04ABA4CD86DFF7BBCEF05354F002066B506F61A1EA70AE45DB50

Function 00E136B8 Relevance: 10.5, APIs: 4, Strings: 2, Instructions: 44
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateWindowExW.USER32(00000000,AutoIt v3,AutoIt v3,00CF0000,80000000,80000000,0000012C,00000064,00000000,00000000,00000000,00000001), ref: 00E136E6
CreateWindowExW.USER32(00000000,edit,00000000,50B008C4,00000000,00000000,00000000,00000000,00000000,00000001,00000000), ref: 00E13707
ShowWindow.USER32(00000000,?,?,?,?,00E13AA3,?), ref: 00E1371B
ShowWindow.USER32(00000000,?,?,?,?,00E13AA3,?), ref: 00E13724

Strings

AutoIt v3, xrefs: 00E136DE, 00E136E3, 00E136E4
edit, xrefs: 00E13701

Memory Dump Source

Source File: 00000000.00000002.1262750966.0000000000E11000.00000020.00000001.01000000.00000003.sdmp, Offset: 00E10000, based on PE: true

Associated: 00000000.00000002.1262729095.0000000000E10000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1262808979.0000000000E9D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1262808979.0000000000EBE000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1262857687.0000000000ECA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1262878803.0000000000ED4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1262878803.0000000000F07000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_e10000_18112024_Dokman_1 Kas_m 2024- Avans_T24-2112184_dekont.jbxd

Similarity

API ID: Window$CreateShow
String ID: AutoIt v3$edit
API String ID: 1584632944-3779509399
Opcode ID: 47d6c9050aa80418f0a5c511b3ac0964b96e01394b1236e4a06bdab08e8ffa0f
Instruction ID: ee4a80ccbb4d6298f581f32c500060c47d930619eb7772159cb7cf7a11ea03a4
Opcode Fuzzy Hash: 47d6c9050aa80418f0a5c511b3ac0964b96e01394b1236e4a06bdab08e8ffa0f
Instruction Fuzzy Hash: 96F0DA716492D47EE7316757BC09E7B2F7DD7C7F60F00005BBA05B61A0C5611899DAB0

Function 01116178 Relevance: 8.9, APIs: 4, Strings: 1, Instructions: 163
fileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 01116068: Sleep.KERNEL32(000001F4), ref: 01116079

CreateFileW.KERNEL32(?,80000000,00000007,00000000,00000003,00000080,00000000), ref: 011162E9

Strings

Y8DVWPYX9VJ08L4AJ8YPIQCPNR6, xrefs: 0111634F, 01116352

Memory Dump Source

Source File: 00000000.00000002.1263159453.0000000001113000.00000040.00000020.00020000.00000000.sdmp, Offset: 01113000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1113000_18112024_Dokman_1 Kas_m 2024- Avans_T24-2112184_dekont.jbxd

Similarity

API ID: CreateFileSleep
String ID: Y8DVWPYX9VJ08L4AJ8YPIQCPNR6
API String ID: 2694422964-530496097
Opcode ID: 36f332e7d79045a5b3c4819ee8a901069e45b9279fdbbde9a2db41ab0ed002d0
Instruction ID: 836de66299749baa5ed1cbfcc8b00d862c31e550b18239c303583f8a251808f9
Opcode Fuzzy Hash: 36f332e7d79045a5b3c4819ee8a901069e45b9279fdbbde9a2db41ab0ed002d0
Instruction Fuzzy Hash: 8B618230D14288DBEF15DBA4D844BEEBB75AF19304F044199E248BB2C1D7BA0B49CB66

Function 00E14A30 Relevance: 8.9, APIs: 2, Strings: 3, Instructions: 138COMMON

Download Yara Rule

APIs

Part of subcall function 00E15374: GetModuleFileNameW.KERNEL32(00000000,?,00007FFF,00ED1148,?,00E161FF,?,00000000,00000001,00000000), ref: 00E15392

Part of subcall function 00E149FB: RegOpenKeyExW.KERNEL32(80000001,Software\AutoIt v3\AutoIt,00000000,00000001,?), ref: 00E14A1D

_wcscat.LIBCMT ref: 00E82D80
_wcscat.LIBCMT ref: 00E82DB5

Strings

8!, xrefs: 00E14B1C
\Include\, xrefs: 00E14B0A
\, xrefs: 00E82DA2

Memory Dump Source

Source File: 00000000.00000002.1262750966.0000000000E11000.00000020.00000001.01000000.00000003.sdmp, Offset: 00E10000, based on PE: true

Associated: 00000000.00000002.1262729095.0000000000E10000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1262808979.0000000000E9D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1262808979.0000000000EBE000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1262857687.0000000000ECA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1262878803.0000000000ED4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1262878803.0000000000F07000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_e10000_18112024_Dokman_1 Kas_m 2024- Avans_T24-2112184_dekont.jbxd

Similarity

API ID: _wcscat$FileModuleNameOpen
String ID: 8!$\$\Include\
API String ID: 3592542968-2226600046
Opcode ID: 230c867f0d00e0acb74b82bb3199d895d102c9d3613a7866fb5b81869092ee15
Instruction ID: 0b61fdac608261852d309030c82aa0b23bdb7d6d12fd8f70bf5920ecd1b4f8c6
Opcode Fuzzy Hash: 230c867f0d00e0acb74b82bb3199d895d102c9d3613a7866fb5b81869092ee15
Instruction Fuzzy Hash: C051427140A3409FC714EF56E99289AB7F4FFA9300B40A92FF749B72A1DB309948CB51

Function 00E151AF Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 88windowCOMMON

Download Yara Rule

APIs

_memset.LIBCMT ref: 00E1522F
_wcscpy.LIBCMT ref: 00E15283
Shell_NotifyIconW.SHELL32(00000001,?), ref: 00E15293
LoadStringW.USER32(00000065,?,0000007F,00000104), ref: 00E83CB0

Strings

Line: , xrefs: 00E83CD9

Memory Dump Source

Source File: 00000000.00000002.1262750966.0000000000E11000.00000020.00000001.01000000.00000003.sdmp, Offset: 00E10000, based on PE: true

Associated: 00000000.00000002.1262729095.0000000000E10000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1262808979.0000000000E9D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1262808979.0000000000EBE000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1262857687.0000000000ECA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1262878803.0000000000ED4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1262878803.0000000000F07000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_e10000_18112024_Dokman_1 Kas_m 2024- Avans_T24-2112184_dekont.jbxd

Similarity

API ID: IconLoadNotifyShell_String_memset_wcscpy
String ID: Line:
API String ID: 1053898822-1585850449
Opcode ID: 3ccc1807c9df53c3f95fb792efccb3444150fbedec193652e004f6a56ddc1ea3
Instruction ID: 29941376669bbd28359c9a69d131ee3f9c52b9788b99a9d4be6ca07d3e49df39
Opcode Fuzzy Hash: 3ccc1807c9df53c3f95fb792efccb3444150fbedec193652e004f6a56ddc1ea3
Instruction Fuzzy Hash: E031B272109740BFD321EB60EC46FDE77E8AB84304F10551BF599B21A1DB70A688CB96

Function 00E14139 Relevance: 7.3, APIs: 2, Strings: 2, Instructions: 258COMMON

Download Yara Rule

APIs

Part of subcall function 00E141A9: LoadLibraryExW.KERNEL32(00000001,00000000,00000002,?,?,?,?,00E139FE,?,00000001), ref: 00E141DB

_free.LIBCMT ref: 00E836B7
_free.LIBCMT ref: 00E836FE

Part of subcall function 00E1C833: __wsplitpath.LIBCMT ref: 00E1C93E
Part of subcall function 00E1C833: _wcscpy.LIBCMT ref: 00E1C953
Part of subcall function 00E1C833: _wcscat.LIBCMT ref: 00E1C968
Part of subcall function 00E1C833: SetCurrentDirectoryW.KERNEL32(?,?,?,?,?,?,00000001,?,?,00000000), ref: 00E1C978

Strings

Bad directive syntax error, xrefs: 00E836E4
>>>AUTOIT SCRIPT<<<, xrefs: 00E83491

Memory Dump Source

Source File: 00000000.00000002.1262750966.0000000000E11000.00000020.00000001.01000000.00000003.sdmp, Offset: 00E10000, based on PE: true

Associated: 00000000.00000002.1262729095.0000000000E10000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1262808979.0000000000E9D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1262808979.0000000000EBE000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1262857687.0000000000ECA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1262878803.0000000000ED4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1262878803.0000000000F07000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_e10000_18112024_Dokman_1 Kas_m 2024- Avans_T24-2112184_dekont.jbxd

Similarity

API ID: _free$CurrentDirectoryLibraryLoad__wsplitpath_wcscat_wcscpy
String ID: >>>AUTOIT SCRIPT<<<$Bad directive syntax error
API String ID: 805182592-1757145024
Opcode ID: c283335332eb5d2fdde029026aec19a5cbf70d21e55bdc635700ddb76024d8d4
Instruction ID: ebe0fd498ffd18164e07b968faf7cf2747db2254505290fb2a2f4522612ee1fa
Opcode Fuzzy Hash: c283335332eb5d2fdde029026aec19a5cbf70d21e55bdc635700ddb76024d8d4
Instruction Fuzzy Hash: B1916071910219AFCF04EFA8DC919EDB7F4BF09714F106429F81ABB291EB70AA45CB50

Function 00E140E5 Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 64COMMON

Download Yara Rule

APIs

_memset.LIBCMT ref: 00E83725
GetOpenFileNameW.COMDLG32 ref: 00E8376F

Part of subcall function 00E1660F: GetFullPathNameW.KERNEL32(?,00007FFF,?,00000000,?,?,00E153B1,?,?,00E161FF,?,00000000,00000001,00000000), ref: 00E1662F

Part of subcall function 00E140A7: GetLongPathNameW.KERNEL32(?,?,00007FFF), ref: 00E140C6

Strings

t3, xrefs: 00E83745
X, xrefs: 00E8373E

Memory Dump Source

Source File: 00000000.00000002.1262750966.0000000000E11000.00000020.00000001.01000000.00000003.sdmp, Offset: 00E10000, based on PE: true

Associated: 00000000.00000002.1262729095.0000000000E10000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1262808979.0000000000E9D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1262808979.0000000000EBE000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1262857687.0000000000ECA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1262878803.0000000000ED4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1262878803.0000000000F07000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_e10000_18112024_Dokman_1 Kas_m 2024- Avans_T24-2112184_dekont.jbxd

Similarity

API ID: Name$Path$FileFullLongOpen_memset
String ID: X$t3
API String ID: 3777226403-2341782549
Opcode ID: faaff3f704aafeea03bbed8afd1206b2d7c3c7f731748cf6667d5b1a8d8d26be
Instruction ID: df1ff49ebdef53fb7702b4baa1365ec1f7830d6e2366522d5c6d5157d2e317db
Opcode Fuzzy Hash: faaff3f704aafeea03bbed8afd1206b2d7c3c7f731748cf6667d5b1a8d8d26be
Instruction Fuzzy Hash: 3D21D8B1A00198AFCF01DFA8D805BDE7BF99F89304F00905AE405B7281DBB59AC98F65

Function 00E334AE Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 61COMMON

Download Yara Rule

APIs

__getstream.LIBCMT ref: 00E334FE

Part of subcall function 00E37C0E: __getptd_noexit.LIBCMT ref: 00E37C0E

@_EH4_CallFilterFunc@8.LIBCMT ref: 00E33539
__wopenfile.LIBCMT ref: 00E33549

Strings

<G, xrefs: 00E334CD, 00E334F0, 00E334FC

Memory Dump Source

Source File: 00000000.00000002.1262750966.0000000000E11000.00000020.00000001.01000000.00000003.sdmp, Offset: 00E10000, based on PE: true

Associated: 00000000.00000002.1262729095.0000000000E10000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1262808979.0000000000E9D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1262808979.0000000000EBE000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1262857687.0000000000ECA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1262878803.0000000000ED4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1262878803.0000000000F07000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_e10000_18112024_Dokman_1 Kas_m 2024- Avans_T24-2112184_dekont.jbxd

Similarity

API ID: CallFilterFunc@8__getptd_noexit__getstream__wopenfile
String ID: <G
API String ID: 1820251861-2138716496
Opcode ID: 674d7c6fb8a91eef4bcc77ae5eec68a1bf5b3164977357642062781f075127b3
Instruction ID: 27821700e0d9d8948de5a141a9e695119bafea676ca1683556cb45c6a112ba26
Opcode Fuzzy Hash: 674d7c6fb8a91eef4bcc77ae5eec68a1bf5b3164977357642062781f075127b3
Instruction Fuzzy Hash: 0E110A71A00306BBDB21BF708C4AB6E7EE4AF45354F14A465E425F7281EB34CA01D7A1

Function 00E2D298 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 58registryCOMMON

Download Yara Rule

APIs

RegOpenKeyExW.KERNEL32(80000001,Control Panel\Mouse,00000000,00000001,00000000,00000003,00000000,80000001,80000001,?,00E2D28B,SwapMouseButtons,00000004,?), ref: 00E2D2BC
RegQueryValueExW.KERNEL32(00000000,00000000,00000000,00000000,?,?,?,?,00E2D28B,SwapMouseButtons,00000004,?,?,?,?,00E2C865), ref: 00E2D2DD
RegCloseKey.KERNEL32(00000000,?,?,00E2D28B,SwapMouseButtons,00000004,?,?,?,?,00E2C865), ref: 00E2D2FF

Strings

Control Panel\Mouse, xrefs: 00E2D2BA

Memory Dump Source

Source File: 00000000.00000002.1262750966.0000000000E11000.00000020.00000001.01000000.00000003.sdmp, Offset: 00E10000, based on PE: true

Associated: 00000000.00000002.1262729095.0000000000E10000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1262808979.0000000000E9D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1262808979.0000000000EBE000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1262857687.0000000000ECA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1262878803.0000000000ED4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1262878803.0000000000F07000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_e10000_18112024_Dokman_1 Kas_m 2024- Avans_T24-2112184_dekont.jbxd

Similarity

API ID: CloseOpenQueryValue
String ID: Control Panel\Mouse
API String ID: 3677997916-824357125
Opcode ID: 9f3a712ffb3e3328f9e312e21aca24789332220a5b8cb63ebf858b6020b81549
Instruction ID: 3c06efb50f48098f5311aeb4d1e47366b1b00a77a32bdf6a5c62e7b4710fc413
Opcode Fuzzy Hash: 9f3a712ffb3e3328f9e312e21aca24789332220a5b8cb63ebf858b6020b81549
Instruction Fuzzy Hash: F2115A76619228FFDB10CF64DC84EAE7BB8EF04744B00542AAA01E7120D671DE449B60

Function 01115068 Relevance: 6.7, APIs: 4, Instructions: 720processthreadCOMMON

Download Yara Rule

APIs

CreateProcessW.KERNEL32(?,00000000), ref: 01115895
Wow64GetThreadContext.KERNEL32(?,00010007), ref: 011158B9
ReadProcessMemory.KERNEL32(?,?,?,00000004,00000000), ref: 011158DB

Memory Dump Source

Source File: 00000000.00000002.1263159453.0000000001113000.00000040.00000020.00020000.00000000.sdmp, Offset: 01113000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1113000_18112024_Dokman_1 Kas_m 2024- Avans_T24-2112184_dekont.jbxd

Similarity

API ID: Process$ContextCreateMemoryReadThreadWow64
String ID:
API String ID: 2438371351-0
Opcode ID: 3007ae169ef8b9d8c61beb8ea063371979b6b354134e23f449e077085ff78b4f
Instruction ID: 85aaa2312a361c02b2ae4c9bd3b6ca19ee7430e76a5e37af1db295209fb69940
Opcode Fuzzy Hash: 3007ae169ef8b9d8c61beb8ea063371979b6b354134e23f449e077085ff78b4f
Instruction Fuzzy Hash: 56620C30A142589BEB28CFA4C840BDEB776FF59300F1091A9D10DEB394E7759E81CB5A

Function 00E3365B Relevance: 6.2, APIs: 4, Instructions: 162COMMONLIBRARYCODE

Download Yara Rule

APIs

_memset.LIBCMT ref: 00E336B7
_memcpy_s.LIBCMT ref: 00E33729
__filbuf.LIBCMT ref: 00E337AA
_memset.LIBCMT ref: 00E337EE

Part of subcall function 00E37C0E: __getptd_noexit.LIBCMT ref: 00E37C0E

Memory Dump Source

Source File: 00000000.00000002.1262750966.0000000000E11000.00000020.00000001.01000000.00000003.sdmp, Offset: 00E10000, based on PE: true

Associated: 00000000.00000002.1262729095.0000000000E10000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1262808979.0000000000E9D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1262808979.0000000000EBE000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1262857687.0000000000ECA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1262878803.0000000000ED4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1262878803.0000000000F07000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_e10000_18112024_Dokman_1 Kas_m 2024- Avans_T24-2112184_dekont.jbxd

Similarity

API ID: _memset$__filbuf__getptd_noexit_memcpy_s
String ID:
API String ID: 3877424927-0
Opcode ID: 25276d1f646da7b76298e578b8e053e7e3b96e54df01e447abe6ae266d0f960a
Instruction ID: 0c8da762155cd99a04ccaeefac773e31c1f6516b208f6ef4c31ed119c637ff2e
Opcode Fuzzy Hash: 25276d1f646da7b76298e578b8e053e7e3b96e54df01e447abe6ae266d0f960a
Instruction Fuzzy Hash: 275198B1A00205AFDB248F79888D9AF7FA5AF40324F24976AF825A62D0D7759F50CB41

Function 00E2EB83 Relevance: 6.1, APIs: 4, Instructions: 65timewindowCOMMON

Download Yara Rule

APIs

_memset.LIBCMT ref: 00E2EBB2

Part of subcall function 00E151AF: _memset.LIBCMT ref: 00E1522F
Part of subcall function 00E151AF: _wcscpy.LIBCMT ref: 00E15283
Part of subcall function 00E151AF: Shell_NotifyIconW.SHELL32(00000001,?), ref: 00E15293

KillTimer.USER32(?,00000001,?,?), ref: 00E2EC07
SetTimer.USER32(?,00000001,000002EE,00000000), ref: 00E2EC16
Shell_NotifyIconW.SHELL32(00000001,000003A8), ref: 00E83C88

Memory Dump Source

Source File: 00000000.00000002.1262750966.0000000000E11000.00000020.00000001.01000000.00000003.sdmp, Offset: 00E10000, based on PE: true

Associated: 00000000.00000002.1262729095.0000000000E10000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1262808979.0000000000E9D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1262808979.0000000000EBE000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1262857687.0000000000ECA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1262878803.0000000000ED4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1262878803.0000000000F07000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_e10000_18112024_Dokman_1 Kas_m 2024- Avans_T24-2112184_dekont.jbxd

Similarity

API ID: IconNotifyShell_Timer_memset$Kill_wcscpy
String ID:
API String ID: 1378193009-0
Opcode ID: 3854ca1e5a56913241e575c75f78ec15e977146ec95178babe2826d9457bb335
Instruction ID: 3c4296017e6a54912918df4236504648b8da4ac2cef653819f558f815c2030f6
Opcode Fuzzy Hash: 3854ca1e5a56913241e575c75f78ec15e977146ec95178babe2826d9457bb335
Instruction Fuzzy Hash: E821D7715047A4AFE7329B78DC59BE7FBEC9B41708F04148EE69E76281C3742A84CB51

Function 00E5C71A Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 15COMMON

Download Yara Rule

APIs

GetTempPathW.KERNEL32(00000104,?), ref: 00E5C72F
GetTempFileNameW.KERNEL32(?,aut,00000000,?), ref: 00E5C746

Strings

aut, xrefs: 00E5C740

Memory Dump Source

Source File: 00000000.00000002.1262750966.0000000000E11000.00000020.00000001.01000000.00000003.sdmp, Offset: 00E10000, based on PE: true

Associated: 00000000.00000002.1262729095.0000000000E10000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1262808979.0000000000E9D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1262808979.0000000000EBE000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1262857687.0000000000ECA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1262878803.0000000000ED4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1262878803.0000000000F07000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_e10000_18112024_Dokman_1 Kas_m 2024- Avans_T24-2112184_dekont.jbxd

Similarity

API ID: Temp$FileNamePath
String ID: aut
API String ID: 3285503233-3010740371
Opcode ID: 79966406a63da7aab653a545af87826958c325e945101590b253a0ac32db59e9
Instruction ID: 088f16bd389232fcff46e2e0770216476a3dc498be3cbeaf64458bbde7a7adb7
Opcode Fuzzy Hash: 79966406a63da7aab653a545af87826958c325e945101590b253a0ac32db59e9
Instruction Fuzzy Hash: 7CD05E7150031EAFDB10ABA0DC0EFCAB76C9700B04F0001A27A50B50B2DAB1E69A8B54

Function 00E6F8AE Relevance: 4.9, APIs: 3, Instructions: 385COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1262750966.0000000000E11000.00000020.00000001.01000000.00000003.sdmp, Offset: 00E10000, based on PE: true

Associated: 00000000.00000002.1262729095.0000000000E10000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1262808979.0000000000E9D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1262808979.0000000000EBE000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1262857687.0000000000ECA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1262878803.0000000000ED4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1262878803.0000000000F07000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_e10000_18112024_Dokman_1 Kas_m 2024- Avans_T24-2112184_dekont.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7a403ea44097d379d09deec31611e46d664b64b660daf45a2c61940c026fb63d
Instruction ID: 1806737d851cd2616a6cb239939397a174cf9c638334ccec3923529816ebf7c2
Opcode Fuzzy Hash: 7a403ea44097d379d09deec31611e46d664b64b660daf45a2c61940c026fb63d
Instruction Fuzzy Hash: 68F16A716083019FC710DF28D891B5AF7E5FF88314F14996EF999AB292DB30E945CB82

Function 00E14FFC Relevance: 4.6, APIs: 3, Instructions: 77windowCOMMON

Download Yara Rule

APIs

_memset.LIBCMT ref: 00E15022
Shell_NotifyIconW.SHELL32(00000000,?), ref: 00E150CB

Memory Dump Source

Source File: 00000000.00000002.1262750966.0000000000E11000.00000020.00000001.01000000.00000003.sdmp, Offset: 00E10000, based on PE: true

Associated: 00000000.00000002.1262729095.0000000000E10000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1262808979.0000000000E9D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1262808979.0000000000EBE000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1262857687.0000000000ECA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1262878803.0000000000ED4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1262878803.0000000000F07000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_e10000_18112024_Dokman_1 Kas_m 2024- Avans_T24-2112184_dekont.jbxd

Similarity

API ID: IconNotifyShell__memset
String ID:
API String ID: 928536360-0
Opcode ID: 30fe239bf2f5d6710f3d3abbe7cb34feeceb09dc39832706ebbc70c79c33a32a
Instruction ID: a914bbb41edd4428901966392db57b8554d3a6befea09c399d7f1990d5ac6ce4
Opcode Fuzzy Hash: 30fe239bf2f5d6710f3d3abbe7cb34feeceb09dc39832706ebbc70c79c33a32a
Instruction Fuzzy Hash: DC3180B1505701DFD721EF65E8456DBBBE4FF88308F00092EE59EA3281E7716988CB92

Function 00E3395C Relevance: 4.6, APIs: 3, Instructions: 59memoryCOMMONLIBRARYCODE

Download Yara Rule

APIs

__FF_MSGBANNER.LIBCMT ref: 00E33973

Part of subcall function 00E381C2: __NMSG_WRITE.LIBCMT ref: 00E381E9
Part of subcall function 00E381C2: __NMSG_WRITE.LIBCMT ref: 00E381F3

__NMSG_WRITE.LIBCMT ref: 00E3397A

Part of subcall function 00E3821F: GetModuleFileNameW.KERNEL32(00000000,00ED0312,00000104,00000000,00000001,00000000), ref: 00E382B1
Part of subcall function 00E3821F: ___crtMessageBoxW.LIBCMT ref: 00E3835F

Part of subcall function 00E31145: ___crtCorExitProcess.LIBCMT ref: 00E3114B
Part of subcall function 00E31145: ExitProcess.KERNEL32 ref: 00E31154

Part of subcall function 00E37C0E: __getptd_noexit.LIBCMT ref: 00E37C0E

RtlAllocateHeap.NTDLL(010D0000,00000000,00000001,00000001,00000000,?,?,00E2F507,?,0000000E), ref: 00E3399F

Memory Dump Source

Source File: 00000000.00000002.1262750966.0000000000E11000.00000020.00000001.01000000.00000003.sdmp, Offset: 00E10000, based on PE: true

Associated: 00000000.00000002.1262729095.0000000000E10000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1262808979.0000000000E9D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1262808979.0000000000EBE000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1262857687.0000000000ECA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1262878803.0000000000ED4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1262878803.0000000000F07000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_e10000_18112024_Dokman_1 Kas_m 2024- Avans_T24-2112184_dekont.jbxd

Similarity

API ID: ExitProcess___crt$AllocateFileHeapMessageModuleName__getptd_noexit
String ID:
API String ID: 1372826849-0
Opcode ID: c43396b1f6705fbb8ff16e1c35ca125cd28a31c885a2223f9842c3d07745f810
Instruction ID: 5dbab2045e8b5289177d89e6d50e50c473235d5feb9dfae9ed1b0168502b38c3
Opcode Fuzzy Hash: c43396b1f6705fbb8ff16e1c35ca125cd28a31c885a2223f9842c3d07745f810
Instruction Fuzzy Hash: 7C018431246211DEE6213B39AC5EF6A7B989BC5764F21306AF505B6196DEB0DD00C660

Function 00E5C6D9 Relevance: 4.5, APIs: 3, Instructions: 24filetimeCOMMON

Download Yara Rule

APIs

CreateFileW.KERNEL32(?,40000000,00000001,00000000,00000003,00000080,00000000,?,?,00E5C385,?,?,?,?,?,00000004), ref: 00E5C6F2
SetFileTime.KERNEL32(00000000,?,00000000,?,?,00E5C385,?,?,?,?,?,00000004,00000001,?,?,00000004), ref: 00E5C708
CloseHandle.KERNEL32(00000000,?,00E5C385,?,?,?,?,?,00000004,00000001,?,?,00000004,00000001,?,?), ref: 00E5C70F

Memory Dump Source

Source File: 00000000.00000002.1262750966.0000000000E11000.00000020.00000001.01000000.00000003.sdmp, Offset: 00E10000, based on PE: true

Associated: 00000000.00000002.1262729095.0000000000E10000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1262808979.0000000000E9D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1262808979.0000000000EBE000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1262857687.0000000000ECA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1262878803.0000000000ED4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1262878803.0000000000F07000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_e10000_18112024_Dokman_1 Kas_m 2024- Avans_T24-2112184_dekont.jbxd

Similarity

API ID: File$CloseCreateHandleTime
String ID:
API String ID: 3397143404-0
Opcode ID: 49ea2d32415a2745c52e0a1274bfe21030c452463f83f1280d75d740b3c6b29f
Instruction ID: 7f2c05c943543016aea8b85b7c93ac83bcb5b025531ae1d3a3a93b213bf0ae8b
Opcode Fuzzy Hash: 49ea2d32415a2745c52e0a1274bfe21030c452463f83f1280d75d740b3c6b29f
Instruction Fuzzy Hash: 21E08632145234BFD7211B66EC09FCA7B18AB05761F104113FB14790E097B125158798

Function 00E5BB64 Relevance: 4.5, APIs: 3, Instructions: 22COMMON

Download Yara Rule

APIs

_free.LIBCMT ref: 00E5BB72

Part of subcall function 00E31C9D: RtlFreeHeap.NTDLL(00000000,00000000,?,00E37A85), ref: 00E31CB1
Part of subcall function 00E31C9D: GetLastError.KERNEL32(00000000,?,00E37A85), ref: 00E31CC3

_free.LIBCMT ref: 00E5BB83
_free.LIBCMT ref: 00E5BB95

Memory Dump Source

Source File: 00000000.00000002.1262750966.0000000000E11000.00000020.00000001.01000000.00000003.sdmp, Offset: 00E10000, based on PE: true

Associated: 00000000.00000002.1262729095.0000000000E10000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1262808979.0000000000E9D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1262808979.0000000000EBE000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1262857687.0000000000ECA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1262878803.0000000000ED4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1262878803.0000000000F07000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_e10000_18112024_Dokman_1 Kas_m 2024- Avans_T24-2112184_dekont.jbxd

Similarity

API ID: _free$ErrorFreeHeapLast
String ID:
API String ID: 776569668-0
Opcode ID: 8d6c99314b0704041c66cbc9d98ad607d1a0ae96d99a55b8255782f8bd4ba31d
Instruction ID: e1e283367965bc4c9267bd76d8fb653e8d46e7763abb49f092ec0fe8e7f54ed2
Opcode Fuzzy Hash: 8d6c99314b0704041c66cbc9d98ad607d1a0ae96d99a55b8255782f8bd4ba31d
Instruction Fuzzy Hash: 86E0C7A160070082CA28A638AE48EB3A3CC0F04362B043C4EB829F3182CF60F840C8A8

Function 00E12322 Relevance: 3.9, APIs: 3, Instructions: 159COMMON

Download Yara Rule

APIs

Part of subcall function 00E122A4: RegisterWindowMessageW.USER32(WM_GETCONTROLNAME,?,00E124F1), ref: 00E12303

GetStdHandle.KERNEL32(000000F6,00000000,00000000), ref: 00E125A1
CoInitialize.OLE32(00000000), ref: 00E12618
CloseHandle.KERNEL32(00000000), ref: 00E8503A

Memory Dump Source

Source File: 00000000.00000002.1262750966.0000000000E11000.00000020.00000001.01000000.00000003.sdmp, Offset: 00E10000, based on PE: true

Associated: 00000000.00000002.1262729095.0000000000E10000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1262808979.0000000000E9D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1262808979.0000000000EBE000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1262857687.0000000000ECA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1262878803.0000000000ED4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1262878803.0000000000F07000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_e10000_18112024_Dokman_1 Kas_m 2024- Avans_T24-2112184_dekont.jbxd

Similarity

API ID: Handle$CloseInitializeMessageRegisterWindow
String ID:
API String ID: 3815369404-0
Opcode ID: e6f64c70f458fb28097833d0da56485f4ed568e94186e08042fec3fe9bed1bb3
Instruction ID: d5fa8d62bf7f62bd8970e82e32db4cbbe485c7b317264fffa98266a0fdff58ac
Opcode Fuzzy Hash: e6f64c70f458fb28097833d0da56485f4ed568e94186e08042fec3fe9bed1bb3
Instruction Fuzzy Hash: F9719CB4A06281AF8304EF9BBD91599BBE4F79934038061EFD119F73B2CB324449DB15

Function 00E5BBE8 Relevance: 3.6, APIs: 1, Strings: 1, Instructions: 50COMMON

Download Yara Rule

APIs

__fread_nolock.LIBCMT ref: 00E5BC18

Strings

EA06, xrefs: 00E5BC46

Memory Dump Source

Source File: 00000000.00000002.1262750966.0000000000E11000.00000020.00000001.01000000.00000003.sdmp, Offset: 00E10000, based on PE: true

Associated: 00000000.00000002.1262729095.0000000000E10000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1262808979.0000000000E9D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1262808979.0000000000EBE000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1262857687.0000000000ECA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1262878803.0000000000ED4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1262878803.0000000000F07000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_e10000_18112024_Dokman_1 Kas_m 2024- Avans_T24-2112184_dekont.jbxd

Similarity

API ID: __fread_nolock
String ID: EA06
API String ID: 2638373210-3962188686
Opcode ID: 993aceca03b8a61c86f369039c7b68f14db294b880f6ec2ad0a90b24ffcc737f
Instruction ID: 164b72432638ac822a62a5369a413c1a049fdf6ddfeb7d7bdb7e5007e5c5a503
Opcode Fuzzy Hash: 993aceca03b8a61c86f369039c7b68f14db294b880f6ec2ad0a90b24ffcc737f
Instruction Fuzzy Hash: 5E0175729042587EDB68C7A8C856FEEBFF89B15305F00455AF593E6181E9B4A708CB60

Function 00E70828 Relevance: 3.2, APIs: 2, Instructions: 232COMMON

Download Yara Rule

APIs

_strcat.LIBCMT ref: 00E708FD

Part of subcall function 00E1936C: __swprintf.LIBCMT ref: 00E193AB
Part of subcall function 00E1936C: __itow.LIBCMT ref: 00E193DF

_wcscpy.LIBCMT ref: 00E7098C

Memory Dump Source

Source File: 00000000.00000002.1262750966.0000000000E11000.00000020.00000001.01000000.00000003.sdmp, Offset: 00E10000, based on PE: true

Associated: 00000000.00000002.1262729095.0000000000E10000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1262808979.0000000000E9D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1262808979.0000000000EBE000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1262857687.0000000000ECA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1262878803.0000000000ED4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1262878803.0000000000F07000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_e10000_18112024_Dokman_1 Kas_m 2024- Avans_T24-2112184_dekont.jbxd

Similarity

API ID: __itow__swprintf_strcat_wcscpy
String ID:
API String ID: 1012013722-0
Opcode ID: 2f83832de96767f9446419930b6647b2c0234fba18995cad3ea0a242b34bb7e9
Instruction ID: e41f732139b87a5489bd3cae2359f44c29cd2ca0d4676049f5a50a0b3289db92
Opcode Fuzzy Hash: 2f83832de96767f9446419930b6647b2c0234fba18995cad3ea0a242b34bb7e9
Instruction Fuzzy Hash: BB913934A00605DFCB18DF28C5919A9BBE5FF49310B55E469E85AAF3A2DB30ED45CF80

Function 00E13A0F Relevance: 3.1, APIs: 2, Instructions: 59COMMON

Download Yara Rule

APIs

IsThemeActive.UXTHEME ref: 00E13A73

Part of subcall function 00E31405: __lock.LIBCMT ref: 00E3140B

Part of subcall function 00E13ADB: SystemParametersInfoW.USER32(00002000,00000000,?,00000000), ref: 00E13AF3
Part of subcall function 00E13ADB: SystemParametersInfoW.USER32(00002001,00000000,00000000,00000002), ref: 00E13B08

Part of subcall function 00E13D19: GetCurrentDirectoryW.KERNEL32(00007FFF,?,00000000,00000001,?,?,00E13AA3,?), ref: 00E13D45
Part of subcall function 00E13D19: IsDebuggerPresent.KERNEL32(?,?,?,?,00E13AA3,?), ref: 00E13D57
Part of subcall function 00E13D19: GetFullPathNameW.KERNEL32(00007FFF,?,?,00ED1148,00ED1130,?,?,?,?,00E13AA3,?), ref: 00E13DC8
Part of subcall function 00E13D19: SetCurrentDirectoryW.KERNEL32(?,?,?,00E13AA3,?), ref: 00E13E48

SystemParametersInfoW.USER32(00002001,00000000,00000000,00000002), ref: 00E13AB3

Memory Dump Source

Source File: 00000000.00000002.1262750966.0000000000E11000.00000020.00000001.01000000.00000003.sdmp, Offset: 00E10000, based on PE: true

Associated: 00000000.00000002.1262729095.0000000000E10000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1262808979.0000000000E9D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1262808979.0000000000EBE000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1262857687.0000000000ECA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1262878803.0000000000ED4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1262878803.0000000000F07000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_e10000_18112024_Dokman_1 Kas_m 2024- Avans_T24-2112184_dekont.jbxd

Similarity

API ID: InfoParametersSystem$CurrentDirectory$ActiveDebuggerFullNamePathPresentTheme__lock
String ID:
API String ID: 924797094-0
Opcode ID: 1ac3b59450990f4c704ccd178fbfb13c4f8f91a03b74811e048fefaff29c534d
Instruction ID: 3364480a0310191b8093bcc61506fa6a5a5f2efa01d99e121799a5a91f59b8d5
Opcode Fuzzy Hash: 1ac3b59450990f4c704ccd178fbfb13c4f8f91a03b74811e048fefaff29c534d
Instruction Fuzzy Hash: CA119D71909351AFC300EF6AFC4594AFBE8EF94750F008A5FF584A72A1DB709589CB92

Function 00E3E9D2 Relevance: 3.1, APIs: 2, Instructions: 52COMMONLIBRARYCODE

Download Yara Rule

APIs

___lock_fhandle.LIBCMT ref: 00E3EA29
__close_nolock.LIBCMT ref: 00E3EA42

Part of subcall function 00E37BDA: __getptd_noexit.LIBCMT ref: 00E37BDA

Part of subcall function 00E37C0E: __getptd_noexit.LIBCMT ref: 00E37C0E

Memory Dump Source

Source File: 00000000.00000002.1262750966.0000000000E11000.00000020.00000001.01000000.00000003.sdmp, Offset: 00E10000, based on PE: true

Associated: 00000000.00000002.1262729095.0000000000E10000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1262808979.0000000000E9D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1262808979.0000000000EBE000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1262857687.0000000000ECA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1262878803.0000000000ED4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1262878803.0000000000F07000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_e10000_18112024_Dokman_1 Kas_m 2024- Avans_T24-2112184_dekont.jbxd

Similarity

API ID: __getptd_noexit$___lock_fhandle__close_nolock
String ID:
API String ID: 1046115767-0
Opcode ID: c588a0a64cafdbe8c579066d951770e1f1b2a1b053078e874de5bbaf5bd02d67
Instruction ID: 40892aefca0b91cf1092ce3816809b78a65748a03151bb87c1ead1b30113bc98
Opcode Fuzzy Hash: c588a0a64cafdbe8c579066d951770e1f1b2a1b053078e874de5bbaf5bd02d67
Instruction Fuzzy Hash: E511C6B24056149ED721BFA8D8493597EE16F81335F1A6380E4607F2E2D7B49940C6A5

Function 00E2F4EA Relevance: 3.0, APIs: 2, Instructions: 43COMMON

Download Yara Rule

APIs

Part of subcall function 00E3395C: __FF_MSGBANNER.LIBCMT ref: 00E33973
Part of subcall function 00E3395C: __NMSG_WRITE.LIBCMT ref: 00E3397A
Part of subcall function 00E3395C: RtlAllocateHeap.NTDLL(010D0000,00000000,00000001,00000001,00000000,?,?,00E2F507,?,0000000E), ref: 00E3399F

std::exception::exception.LIBCMT ref: 00E2F51E
__CxxThrowException@8.LIBCMT ref: 00E2F533

Part of subcall function 00E36805: RaiseException.KERNEL32(?,?,0000000E,00EC6A30,?,?,?,00E2F538,0000000E,00EC6A30,?,00000001), ref: 00E36856

Memory Dump Source

Source File: 00000000.00000002.1262750966.0000000000E11000.00000020.00000001.01000000.00000003.sdmp, Offset: 00E10000, based on PE: true

Associated: 00000000.00000002.1262729095.0000000000E10000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1262808979.0000000000E9D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1262808979.0000000000EBE000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1262857687.0000000000ECA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1262878803.0000000000ED4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1262878803.0000000000F07000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_e10000_18112024_Dokman_1 Kas_m 2024- Avans_T24-2112184_dekont.jbxd

Similarity

API ID: AllocateExceptionException@8HeapRaiseThrowstd::exception::exception
String ID:
API String ID: 3902256705-0
Opcode ID: 9303f1cbe6c1b34ef21d36725407e9780c501782afd0ee7b64f0e75d7d6af203
Instruction ID: 4903221bca489fb9dd50e43b51fd81da909b0f616f3fbf30792831eb9f86fc8d
Opcode Fuzzy Hash: 9303f1cbe6c1b34ef21d36725407e9780c501782afd0ee7b64f0e75d7d6af203
Instruction Fuzzy Hash: F3F0A43110422DB7DB04BFA8ED069DE7BF89F04354F60A539F908B2181DBF0DA50C6A5

Function 00E33839 Relevance: 3.0, APIs: 2, Instructions: 42COMMONLIBRARYCODE

Download Yara Rule

APIs

_memset.LIBCMT ref: 00E33868
__lock_file.LIBCMT ref: 00E33889

Memory Dump Source

Source File: 00000000.00000002.1262750966.0000000000E11000.00000020.00000001.01000000.00000003.sdmp, Offset: 00E10000, based on PE: true

Associated: 00000000.00000002.1262729095.0000000000E10000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1262808979.0000000000E9D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1262808979.0000000000EBE000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1262857687.0000000000ECA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1262878803.0000000000ED4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1262878803.0000000000F07000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_e10000_18112024_Dokman_1 Kas_m 2024- Avans_T24-2112184_dekont.jbxd

Similarity

API ID: __lock_file_memset
String ID:
API String ID: 26237723-0
Opcode ID: bdeb66e33f22feca3d6972a0a35e53adaa98ec474c7cd65faec6c5f0f187adc3
Instruction ID: e1fe8885ebbba2c13f2f5c0c9cbf43ce7f19b190e6dc1160845aad9d9d33b49a
Opcode Fuzzy Hash: bdeb66e33f22feca3d6972a0a35e53adaa98ec474c7cd65faec6c5f0f187adc3
Instruction Fuzzy Hash: B4014471800209BBCF26AFB5CD0AD9F7FB1AF40320F159219F8247A1A1D7758B61DB91

Function 00E335E4 Relevance: 3.0, APIs: 2, Instructions: 33COMMONLIBRARYCODE

Download Yara Rule

APIs

Part of subcall function 00E37C0E: __getptd_noexit.LIBCMT ref: 00E37C0E

__lock_file.LIBCMT ref: 00E33629

Part of subcall function 00E34E1C: __lock.LIBCMT ref: 00E34E3F

__fclose_nolock.LIBCMT ref: 00E33634

Memory Dump Source

Source File: 00000000.00000002.1262750966.0000000000E11000.00000020.00000001.01000000.00000003.sdmp, Offset: 00E10000, based on PE: true

Associated: 00000000.00000002.1262729095.0000000000E10000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1262808979.0000000000E9D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1262808979.0000000000EBE000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1262857687.0000000000ECA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1262878803.0000000000ED4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1262878803.0000000000F07000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_e10000_18112024_Dokman_1 Kas_m 2024- Avans_T24-2112184_dekont.jbxd

Similarity

API ID: __fclose_nolock__getptd_noexit__lock__lock_file
String ID:
API String ID: 2800547568-0
Opcode ID: 5c9c86f019222202f9ec50b5839ca8265942f4cab724528c1390de3e87100725
Instruction ID: 75eb47ff23e052bbee2193b900db758cc7719c3d91602089ab75e4348c2d5113
Opcode Fuzzy Hash: 5c9c86f019222202f9ec50b5839ca8265942f4cab724528c1390de3e87100725
Instruction Fuzzy Hash: 59F09671801204BED721AB75880FB9EBEE06F40335F25E148E410FB2C2C7788A41DA55

Function 01115065 Relevance: 1.9, APIs: 1, Instructions: 400processthreadCOMMON

Download Yara Rule

APIs

CreateProcessW.KERNEL32(?,00000000), ref: 01115895
Wow64GetThreadContext.KERNEL32(?,00010007), ref: 011158B9
ReadProcessMemory.KERNEL32(?,?,?,00000004,00000000), ref: 011158DB

Memory Dump Source

Source File: 00000000.00000002.1263159453.0000000001113000.00000040.00000020.00020000.00000000.sdmp, Offset: 01113000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1113000_18112024_Dokman_1 Kas_m 2024- Avans_T24-2112184_dekont.jbxd

Similarity

API ID: Process$ContextCreateMemoryReadThreadWow64
String ID:
API String ID: 2438371351-0
Opcode ID: df6a772f5278f9eae63f3a29a40672dfa4321236305f3f5d8c91d224ff423281
Instruction ID: 0f63a774628ec43385d6852e09257d76529b80a68b6dc673d7d0ede27573ec31
Opcode Fuzzy Hash: df6a772f5278f9eae63f3a29a40672dfa4321236305f3f5d8c91d224ff423281
Instruction Fuzzy Hash: D312DE24E24658C6EB24DF64D8507DEB232EF68300F1090E9910DEB7A5E77A4F81CF5A

Function 00E32957 Relevance: 1.6, APIs: 1, Instructions: 135COMMON

Download Yara Rule

APIs

__flush.LIBCMT ref: 00E32A0B

Part of subcall function 00E37C0E: __getptd_noexit.LIBCMT ref: 00E37C0E

Memory Dump Source

Source File: 00000000.00000002.1262750966.0000000000E11000.00000020.00000001.01000000.00000003.sdmp, Offset: 00E10000, based on PE: true

Associated: 00000000.00000002.1262729095.0000000000E10000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1262808979.0000000000E9D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1262808979.0000000000EBE000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1262857687.0000000000ECA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1262878803.0000000000ED4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1262878803.0000000000F07000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_e10000_18112024_Dokman_1 Kas_m 2024- Avans_T24-2112184_dekont.jbxd

Similarity

API ID: __flush__getptd_noexit
String ID:
API String ID: 4101623367-0
Opcode ID: ba1b573b9a1c5d238bdcc52ef1885e10968c5b94d85714b9232a10917baff8d1
Instruction ID: 0a71cfc05e54f0c3298a4964ec290eea9a67467641d83da5784ac17796a6c595
Opcode Fuzzy Hash: ba1b573b9a1c5d238bdcc52ef1885e10968c5b94d85714b9232a10917baff8d1
Instruction Fuzzy Hash: 0141A6717007069FDF288E69C8896AE7FB6AF84364F24A53DEAD5E7240D670DD41CB40

Function 00E2ED18 Relevance: 1.6, APIs: 1, Instructions: 94memoryCOMMON

Download Yara Rule

APIs

VirtualProtect.KERNEL32 ref: 00E2EDC7

Memory Dump Source

Source File: 00000000.00000002.1262750966.0000000000E11000.00000020.00000001.01000000.00000003.sdmp, Offset: 00E10000, based on PE: true

Associated: 00000000.00000002.1262729095.0000000000E10000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1262808979.0000000000E9D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1262808979.0000000000EBE000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1262857687.0000000000ECA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1262878803.0000000000ED4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1262878803.0000000000F07000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_e10000_18112024_Dokman_1 Kas_m 2024- Avans_T24-2112184_dekont.jbxd

Similarity

API ID: ProtectVirtual
String ID:
API String ID: 544645111-0
Opcode ID: 160be14eaa7db79452b6aeb530136e2f2731e3e0b6e758b09a27e7bca35b483d
Instruction ID: 63d22f2533ac87cceef465afe52806415a21d55cc456e522d7d8f4aa862c9a82
Opcode Fuzzy Hash: 160be14eaa7db79452b6aeb530136e2f2731e3e0b6e758b09a27e7bca35b483d
Instruction Fuzzy Hash: 4931F874A00125DBC718DF28E4809A9FBB6FF49344B64A6A5E409EB356DB30EDC1CB90

Function 00E7040F Relevance: 1.6, APIs: 1, Instructions: 93COMMON

Download Yara Rule

APIs

_free.LIBCMT ref: 00E70519

Memory Dump Source

Source File: 00000000.00000002.1262750966.0000000000E11000.00000020.00000001.01000000.00000003.sdmp, Offset: 00E10000, based on PE: true

Associated: 00000000.00000002.1262729095.0000000000E10000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1262808979.0000000000E9D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1262808979.0000000000EBE000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1262857687.0000000000ECA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1262878803.0000000000ED4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1262878803.0000000000F07000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_e10000_18112024_Dokman_1 Kas_m 2024- Avans_T24-2112184_dekont.jbxd

Similarity

API ID: _free
String ID:
API String ID: 269201875-0
Opcode ID: 246f83934174dc40f5fd3a41c6c0ea7140250b73d75e9a8ac6e589490b0200fb
Instruction ID: b5699fa4ec6ad89d54f3963a5e8a21b4f34e613a205848ea354ba17a54f2e6bd
Opcode Fuzzy Hash: 246f83934174dc40f5fd3a41c6c0ea7140250b73d75e9a8ac6e589490b0200fb
Instruction Fuzzy Hash: 4A31A275104524DFCB11EF10D0956AEBBB1FF89320F20E44AEA997B386D774A945CF81

Function 00E89A75 Relevance: 1.6, APIs: 1, Instructions: 88COMMON

Download Yara Rule

APIs

VariantClear.OLEAUT32 ref: 00E89A80

Memory Dump Source

Source File: 00000000.00000002.1262750966.0000000000E11000.00000020.00000001.01000000.00000003.sdmp, Offset: 00E10000, based on PE: true

Associated: 00000000.00000002.1262729095.0000000000E10000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1262808979.0000000000E9D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1262808979.0000000000EBE000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1262857687.0000000000ECA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1262878803.0000000000ED4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1262878803.0000000000F07000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_e10000_18112024_Dokman_1 Kas_m 2024- Avans_T24-2112184_dekont.jbxd

Similarity

API ID: ClearVariant
String ID:
API String ID: 1473721057-0
Opcode ID: 4b53dcf983b4f7d0aba9f8610253bd8c52ad8a320943649407aecb047144ac72
Instruction ID: 4ae2bb2d7a67423c8e3e98be4b6aed1a266e413b93a46ab52094ef8c43aa01f1
Opcode Fuzzy Hash: 4b53dcf983b4f7d0aba9f8610253bd8c52ad8a320943649407aecb047144ac72
Instruction Fuzzy Hash: 68416C705046118FDB24DF14D484B1ABBE0BF45308F1999ACE99A6B362C772FC45CF42

Function 00E3ED06 Relevance: 1.6, APIs: 1, Instructions: 66COMMONLIBRARYCODE

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1262750966.0000000000E11000.00000020.00000001.01000000.00000003.sdmp, Offset: 00E10000, based on PE: true

Associated: 00000000.00000002.1262729095.0000000000E10000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1262808979.0000000000E9D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1262808979.0000000000EBE000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1262857687.0000000000ECA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1262878803.0000000000ED4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1262878803.0000000000F07000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_e10000_18112024_Dokman_1 Kas_m 2024- Avans_T24-2112184_dekont.jbxd

Similarity

API ID: __getptd_noexit
String ID:
API String ID: 3074181302-0
Opcode ID: 6a93aa0a626ea351dbe082efa5d088e15a91a2b7856f9ffb5d9e26d9baf226e7
Instruction ID: 293cdd47da038dfa1aecebdba073c071ee96c2f8b5c44c08438dcd43f3b1ada4
Opcode Fuzzy Hash: 6a93aa0a626ea351dbe082efa5d088e15a91a2b7856f9ffb5d9e26d9baf226e7
Instruction Fuzzy Hash: 1E216FB28056409FD7227F79D84D7A97EE19F81336F656680E4B07B2E2DB748D00CBA1

Function 00E141A9 Relevance: 1.6, APIs: 1, Instructions: 63libraryCOMMON

Download Yara Rule

APIs

Part of subcall function 00E14214: FreeLibrary.KERNEL32(00000000,?), ref: 00E14247

LoadLibraryExW.KERNEL32(00000001,00000000,00000002,?,?,?,?,00E139FE,?,00000001), ref: 00E141DB

Part of subcall function 00E14291: FreeLibrary.KERNEL32(00000000), ref: 00E142C4

Memory Dump Source

Source File: 00000000.00000002.1262750966.0000000000E11000.00000020.00000001.01000000.00000003.sdmp, Offset: 00E10000, based on PE: true

Associated: 00000000.00000002.1262729095.0000000000E10000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1262808979.0000000000E9D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1262808979.0000000000EBE000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1262857687.0000000000ECA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1262878803.0000000000ED4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1262878803.0000000000F07000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_e10000_18112024_Dokman_1 Kas_m 2024- Avans_T24-2112184_dekont.jbxd

Similarity

API ID: Library$Free$Load
String ID:
API String ID: 2391024519-0
Opcode ID: 7e2da9a8e308ecfd231d1c4e0dd111655b7ebaba0da7481918184adb83efbd6d
Instruction ID: 66c436d9aec91e66c33a69ac319ec52436c6c18cfa5f362169525f6e8b2b6bd9
Opcode Fuzzy Hash: 7e2da9a8e308ecfd231d1c4e0dd111655b7ebaba0da7481918184adb83efbd6d
Instruction Fuzzy Hash: BF11C1B1600316AADB10BB74DC06FDE77E99F40700F10982DB996BA2D1EA70DA84DB60

Function 00E89B45 Relevance: 1.6, APIs: 1, Instructions: 62COMMON

Download Yara Rule

APIs

VariantClear.OLEAUT32(?), ref: 00E89B51

Memory Dump Source

Source File: 00000000.00000002.1262750966.0000000000E11000.00000020.00000001.01000000.00000003.sdmp, Offset: 00E10000, based on PE: true

Associated: 00000000.00000002.1262729095.0000000000E10000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1262808979.0000000000E9D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1262808979.0000000000EBE000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1262857687.0000000000ECA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1262878803.0000000000ED4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1262878803.0000000000F07000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_e10000_18112024_Dokman_1 Kas_m 2024- Avans_T24-2112184_dekont.jbxd

Similarity

API ID: ClearVariant
String ID:
API String ID: 1473721057-0
Opcode ID: 00980680bca6a817a8d23da7ed9bbf001ee9e9f8033cc427624a424e6727d19a
Instruction ID: 314bbb3c6425a3eef98739b25e96b61ff16fc50c966ac6d7a07f1845274b3a87
Opcode Fuzzy Hash: 00980680bca6a817a8d23da7ed9bbf001ee9e9f8033cc427624a424e6727d19a
Instruction Fuzzy Hash: 742127B05086118FDB24DF24D444B2ABBF1BF88304F185969F99A6B262C772F845CF52

Function 00E3AF61 Relevance: 1.6, APIs: 1, Instructions: 56COMMONLIBRARYCODE

Download Yara Rule

APIs

___lock_fhandle.LIBCMT ref: 00E3AFC0

Part of subcall function 00E37BDA: __getptd_noexit.LIBCMT ref: 00E37BDA

Part of subcall function 00E37C0E: __getptd_noexit.LIBCMT ref: 00E37C0E

Memory Dump Source

Source File: 00000000.00000002.1262750966.0000000000E11000.00000020.00000001.01000000.00000003.sdmp, Offset: 00E10000, based on PE: true

Associated: 00000000.00000002.1262729095.0000000000E10000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1262808979.0000000000E9D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1262808979.0000000000EBE000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1262857687.0000000000ECA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1262878803.0000000000ED4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1262878803.0000000000F07000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_e10000_18112024_Dokman_1 Kas_m 2024- Avans_T24-2112184_dekont.jbxd

Similarity

API ID: __getptd_noexit$___lock_fhandle
String ID:
API String ID: 1144279405-0
Opcode ID: 57b34a5e57d74d66f6381bde88263dde89acd21ab732f5d38c6df863b87b32dd
Instruction ID: a0e0c414d18d08d9c994d6e5bef37558f402485ec0689286cf43f2d3571f12c7
Opcode Fuzzy Hash: 57b34a5e57d74d66f6381bde88263dde89acd21ab732f5d38c6df863b87b32dd
Instruction Fuzzy Hash: BD1190B2805600DFD7266FA4D8497AA7EE19F81335F196280E5B53F1E2C7B48D40CBA1

Function 00E139DB Relevance: 1.5, APIs: 1, Instructions: 41COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1262750966.0000000000E11000.00000020.00000001.01000000.00000003.sdmp, Offset: 00E10000, based on PE: true

Associated: 00000000.00000002.1262729095.0000000000E10000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1262808979.0000000000E9D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1262808979.0000000000EBE000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1262857687.0000000000ECA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1262878803.0000000000ED4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1262878803.0000000000F07000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_e10000_18112024_Dokman_1 Kas_m 2024- Avans_T24-2112184_dekont.jbxd

Similarity

API ID: LibraryLoad
String ID:
API String ID: 1029625771-0
Opcode ID: e908df7db2011151d19b897d4a4948494f90a1a3426dd436a38c65c5f4b6a17e
Instruction ID: 7d6e02695aca71cba8c48da613c5cfa428b2630bec36515c983a85740cf2d41a
Opcode Fuzzy Hash: e908df7db2011151d19b897d4a4948494f90a1a3426dd436a38c65c5f4b6a17e
Instruction Fuzzy Hash: BE01367150010DAECF05EF64C8918EEBFB4AF11344F109069B555B71E5EA309A89DB60

Function 00E32AAE Relevance: 1.5, APIs: 1, Instructions: 35COMMON

Download Yara Rule

APIs

__lock_file.LIBCMT ref: 00E32AED

Part of subcall function 00E37C0E: __getptd_noexit.LIBCMT ref: 00E37C0E

Memory Dump Source

Source File: 00000000.00000002.1262750966.0000000000E11000.00000020.00000001.01000000.00000003.sdmp, Offset: 00E10000, based on PE: true

Associated: 00000000.00000002.1262729095.0000000000E10000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1262808979.0000000000E9D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1262808979.0000000000EBE000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1262857687.0000000000ECA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1262878803.0000000000ED4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1262878803.0000000000F07000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_e10000_18112024_Dokman_1 Kas_m 2024- Avans_T24-2112184_dekont.jbxd

Similarity

API ID: __getptd_noexit__lock_file
String ID:
API String ID: 2597487223-0
Opcode ID: aa947db271e75bbeecd1d8a7b1a944f69eb6ff463291f4ba9f5b67de061112aa
Instruction ID: bb49d9c165602ee882874610e6eb7f5a72716bf3b808f901b254fdd96ace7be0
Opcode Fuzzy Hash: aa947db271e75bbeecd1d8a7b1a944f69eb6ff463291f4ba9f5b67de061112aa
Instruction Fuzzy Hash: FEF0CD31900205ABDF31AF75CC0E79F7EE1BF80324F14A419B550BA191C7788A12DB41

Function 00E14252 Relevance: 1.5, APIs: 1, Instructions: 28COMMON

Download Yara Rule

APIs

FreeLibrary.KERNEL32(?,?,?,?,?,00E139FE,?,00000001), ref: 00E14286

Memory Dump Source

Source File: 00000000.00000002.1262750966.0000000000E11000.00000020.00000001.01000000.00000003.sdmp, Offset: 00E10000, based on PE: true

Associated: 00000000.00000002.1262729095.0000000000E10000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1262808979.0000000000E9D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1262808979.0000000000EBE000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1262857687.0000000000ECA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1262878803.0000000000ED4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1262878803.0000000000F07000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_e10000_18112024_Dokman_1 Kas_m 2024- Avans_T24-2112184_dekont.jbxd

Similarity

API ID: FreeLibrary
String ID:
API String ID: 3664257935-0
Opcode ID: 61144acc14b7909fe1daf73e67eca58780b0e67bbedcf280e1567b38715b933c
Instruction ID: dfe1ac8cf3eb5aa5d0aee7bb9dcd4b72c7c857f4d9bbe5eb4e4ca3798f76a868
Opcode Fuzzy Hash: 61144acc14b7909fe1daf73e67eca58780b0e67bbedcf280e1567b38715b933c
Instruction Fuzzy Hash: 52F0A9B1409302CFCB348F60D880892BBE0BF1032A3209A3FF1D6A2660C33299C0CF40

Function 00E140A7 Relevance: 1.5, APIs: 1, Instructions: 23COMMON

Download Yara Rule

APIs

GetLongPathNameW.KERNEL32(?,?,00007FFF), ref: 00E140C6

Memory Dump Source

Source File: 00000000.00000002.1262750966.0000000000E11000.00000020.00000001.01000000.00000003.sdmp, Offset: 00E10000, based on PE: true

Associated: 00000000.00000002.1262729095.0000000000E10000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1262808979.0000000000E9D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1262808979.0000000000EBE000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1262857687.0000000000ECA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1262878803.0000000000ED4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1262878803.0000000000F07000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_e10000_18112024_Dokman_1 Kas_m 2024- Avans_T24-2112184_dekont.jbxd

Similarity

API ID: LongNamePath
String ID:
API String ID: 82841172-0
Opcode ID: f5060181c3fc909d9249636c2e642934f665a8c0eb453578fd970726a3ef19ca
Instruction ID: 0f4931e1d184ab601891ce087aacc465091eb20e3d07417faf405181c62d43b5
Opcode Fuzzy Hash: f5060181c3fc909d9249636c2e642934f665a8c0eb453578fd970726a3ef19ca
Instruction Fuzzy Hash: A2E0C237A002245BCB11A659CC46FEA77EDDF886A0F0900B6F909F7254DA64A9C18690

Function 00E5BCF4 Relevance: 1.5, APIs: 1, Instructions: 22COMMON

Download Yara Rule

APIs

__fread_nolock.LIBCMT ref: 00E5BD16

Memory Dump Source

Source File: 00000000.00000002.1262750966.0000000000E11000.00000020.00000001.01000000.00000003.sdmp, Offset: 00E10000, based on PE: true

Associated: 00000000.00000002.1262729095.0000000000E10000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1262808979.0000000000E9D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1262808979.0000000000EBE000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1262857687.0000000000ECA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1262878803.0000000000ED4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1262878803.0000000000F07000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_e10000_18112024_Dokman_1 Kas_m 2024- Avans_T24-2112184_dekont.jbxd

Similarity

API ID: __fread_nolock
String ID:
API String ID: 2638373210-0
Opcode ID: 3cca4198d2bc13ecada8dba30311a83a0df564d107d747b73ddd6f796e1577fd
Instruction ID: ae5a525d98fcb9ab55bf3ccaa79d6577a8c60feb82b0c9fb83c88509f94fa65e
Opcode Fuzzy Hash: 3cca4198d2bc13ecada8dba30311a83a0df564d107d747b73ddd6f796e1577fd
Instruction Fuzzy Hash: 63E092B0504B449BD7388B24D800BE377E1EB05309F000C1CF69A93242EB627845C759

Function 01116064 Relevance: 1.3, APIs: 1, Instructions: 21sleepCOMMON

Download Yara Rule

APIs

Sleep.KERNEL32(000001F4), ref: 01116079

Memory Dump Source

Source File: 00000000.00000002.1263159453.0000000001113000.00000040.00000020.00020000.00000000.sdmp, Offset: 01113000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1113000_18112024_Dokman_1 Kas_m 2024- Avans_T24-2112184_dekont.jbxd

Similarity

API ID: Sleep
String ID:
API String ID: 3472027048-0
Opcode ID: 647f186050b41918f79179839cbc1a488579cc5f77474145a25b6e124dddc6ea
Instruction ID: 7606ecf35c909e82105413a498e436d005dc542e5b44a38e964abddea72962c2
Opcode Fuzzy Hash: 647f186050b41918f79179839cbc1a488579cc5f77474145a25b6e124dddc6ea
Instruction Fuzzy Hash: D8E09A7494120DAFDB10DFA4D54969D7BB4EF04301F1005A1FD0596680DB719A548A62

Function 01116068 Relevance: 1.3, APIs: 1, Instructions: 18sleepCOMMON

Download Yara Rule

APIs

Sleep.KERNEL32(000001F4), ref: 01116079

Memory Dump Source

Source File: 00000000.00000002.1263159453.0000000001113000.00000040.00000020.00020000.00000000.sdmp, Offset: 01113000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1113000_18112024_Dokman_1 Kas_m 2024- Avans_T24-2112184_dekont.jbxd

Similarity

API ID: Sleep
String ID:
API String ID: 3472027048-0
Opcode ID: 368835ae2f5fba710e6c01549c2017e46dd928bc4d187f44ede00cceab054826
Instruction ID: 35508f3f052001e80c1453737deb0a645a627ca75c8f3f5a8c93ada95719dda4
Opcode Fuzzy Hash: 368835ae2f5fba710e6c01549c2017e46dd928bc4d187f44ede00cceab054826
Instruction Fuzzy Hash: 68E0E67494120DDFDB00DFB4D54969D7BB4EF04301F100161FD05D2280D7719D50CA62

Non-executed Functions

Function 00E7AACE Relevance: 60.1, APIs: 33, Strings: 1, Instructions: 574windowCOMMON

Download Yara Rule

APIs

SendMessageW.USER32(?,00000400,00000000,00000000), ref: 00E7B1CD

Strings

%d/%02d/%02d, xrefs: 00E7AEFC

Memory Dump Source

Source File: 00000000.00000002.1262750966.0000000000E11000.00000020.00000001.01000000.00000003.sdmp, Offset: 00E10000, based on PE: true

Associated: 00000000.00000002.1262729095.0000000000E10000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1262808979.0000000000E9D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1262808979.0000000000EBE000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1262857687.0000000000ECA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1262878803.0000000000ED4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1262878803.0000000000F07000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_e10000_18112024_Dokman_1 Kas_m 2024- Avans_T24-2112184_dekont.jbxd

Similarity

API ID: MessageSend
String ID: %d/%02d/%02d
API String ID: 3850602802-328681919
Opcode ID: 98b4fac9ee9122649f4a28697d434b76e44d5d59ce8c57d65e0146a79cc08d0c
Instruction ID: 51a408b377e888a677a8ed53eb300130b6e54f6959485e084b606f4a47f1b703
Opcode Fuzzy Hash: 98b4fac9ee9122649f4a28697d434b76e44d5d59ce8c57d65e0146a79cc08d0c
Instruction Fuzzy Hash: EF12DB71600218AFEB259F65CC59FAE7BF8EF84314F14912AF91ABB2D1DB708941CB11

Function 00E2EB42 Relevance: 43.9, APIs: 24, Strings: 1, Instructions: 130keyboardthreadwindowCOMMON

Download Yara Rule

APIs

GetForegroundWindow.USER32(00000000,00000000), ref: 00E2EB4A
FindWindowW.USER32(Shell_TrayWnd,00000000), ref: 00E83AEA
IsIconic.USER32(000000FF), ref: 00E83AF3
ShowWindow.USER32(000000FF,00000009), ref: 00E83B00
SetForegroundWindow.USER32(000000FF), ref: 00E83B0A
GetWindowThreadProcessId.USER32(00000000,00000000), ref: 00E83B20
GetCurrentThreadId.KERNEL32 ref: 00E83B27
GetWindowThreadProcessId.USER32(000000FF,00000000), ref: 00E83B33
AttachThreadInput.USER32(000000FF,00000000,00000001), ref: 00E83B44
AttachThreadInput.USER32(000000FF,00000000,00000001), ref: 00E83B4C
AttachThreadInput.USER32(00000000,?,00000001), ref: 00E83B54
SetForegroundWindow.USER32(000000FF), ref: 00E83B57
MapVirtualKeyW.USER32(00000012,00000000), ref: 00E83B6C
keybd_event.USER32(00000012,00000000), ref: 00E83B77
MapVirtualKeyW.USER32(00000012,00000000), ref: 00E83B81
keybd_event.USER32(00000012,00000000), ref: 00E83B86
MapVirtualKeyW.USER32(00000012,00000000), ref: 00E83B8F
keybd_event.USER32(00000012,00000000), ref: 00E83B94
MapVirtualKeyW.USER32(00000012,00000000), ref: 00E83B9E
keybd_event.USER32(00000012,00000000), ref: 00E83BA3
SetForegroundWindow.USER32(000000FF), ref: 00E83BA6
AttachThreadInput.USER32(000000FF,?,00000000), ref: 00E83BCD

Strings

Shell_TrayWnd, xrefs: 00E83AE5

Memory Dump Source

Source File: 00000000.00000002.1262750966.0000000000E11000.00000020.00000001.01000000.00000003.sdmp, Offset: 00E10000, based on PE: true

Associated: 00000000.00000002.1262729095.0000000000E10000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1262808979.0000000000E9D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1262808979.0000000000EBE000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1262857687.0000000000ECA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1262878803.0000000000ED4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1262878803.0000000000F07000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_e10000_18112024_Dokman_1 Kas_m 2024- Avans_T24-2112184_dekont.jbxd

Similarity

API ID: Window$Thread$AttachForegroundInputVirtualkeybd_event$Process$CurrentFindIconicShow
String ID: Shell_TrayWnd
API String ID: 4125248594-2988720461
Opcode ID: 4f40dd69188c27b099cd3e479fe5c9b93a44bab265eaa4ce278ca121157ee354
Instruction ID: 3b8749d67cdb87a4330b31e320790eb958fb680e6d5704321ad1e2a77b6994b0
Opcode Fuzzy Hash: 4f40dd69188c27b099cd3e479fe5c9b93a44bab265eaa4ce278ca121157ee354
Instruction Fuzzy Hash: 153193B1A44328BFEB216BB68C49F7E3E6CEB44B54F114017FA09FA1D1D6B05D009BA0

Function 00E4ACC5 Relevance: 37.0, APIs: 17, Strings: 4, Instructions: 223COMMON

Download Yara Rule

APIs

Part of subcall function 00E4B134: LookupPrivilegeValueW.ADVAPI32(00000000,00000000,00000004), ref: 00E4B180
Part of subcall function 00E4B134: AdjustTokenPrivileges.ADVAPI32(?,00000000,00000000,?,00000000,?), ref: 00E4B1AD
Part of subcall function 00E4B134: GetLastError.KERNEL32 ref: 00E4B1BA

_memset.LIBCMT ref: 00E4AD08
DuplicateTokenEx.ADVAPI32(?,00000000,00000000,00000002,00000001,?,?,?,?,00000001,?,?), ref: 00E4AD5A
CloseHandle.KERNEL32(?), ref: 00E4AD6B
OpenWindowStationW.USER32(winsta0,00000000,00060000), ref: 00E4AD82
GetProcessWindowStation.USER32 ref: 00E4AD9B
SetProcessWindowStation.USER32(00000000), ref: 00E4ADA5
OpenDesktopW.USER32(default,00000000,00000000,00060081), ref: 00E4ADBF

Part of subcall function 00E4AB84: AdjustTokenPrivileges.ADVAPI32(?,00000000,?,00000000,00000000,00000000,?,00E4ACC0), ref: 00E4AB99
Part of subcall function 00E4AB84: CloseHandle.KERNEL32(?,?,00E4ACC0), ref: 00E4ABAB

Strings

, xrefs: 00E4AD17
default, xrefs: 00E4ADBA
H*, xrefs: 00E4AE40
winsta0, xrefs: 00E4AD7D

Memory Dump Source

Source File: 00000000.00000002.1262750966.0000000000E11000.00000020.00000001.01000000.00000003.sdmp, Offset: 00E10000, based on PE: true

Associated: 00000000.00000002.1262729095.0000000000E10000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1262808979.0000000000E9D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1262808979.0000000000EBE000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1262857687.0000000000ECA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1262878803.0000000000ED4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1262878803.0000000000F07000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_e10000_18112024_Dokman_1 Kas_m 2024- Avans_T24-2112184_dekont.jbxd

Similarity

API ID: StationTokenWindow$AdjustCloseHandleOpenPrivilegesProcess$DesktopDuplicateErrorLastLookupPrivilegeValue_memset
String ID: $H*$default$winsta0
API String ID: 2063423040-3938961404
Opcode ID: b7afff28e597c1467a9c54864c414032d0dd2db311d3dcee5e4a554343859b79
Instruction ID: 4b585b25e5efaba2f6ae4ce0d1ac39b81ad5594d7886cc93a3397ace801df704
Opcode Fuzzy Hash: b7afff28e597c1467a9c54864c414032d0dd2db311d3dcee5e4a554343859b79
Instruction Fuzzy Hash: FA819F71940209BFDF11DFA4EC49AEE7BB9EF08318F08512AF924B2161D7318E55DB21

Function 00E560DD Relevance: 31.7, APIs: 17, Strings: 1, Instructions: 174filestringCOMMON

Download Yara Rule

APIs

Part of subcall function 00E56EBB: GetFullPathNameW.KERNEL32(00000000,00007FFF,?,?,?,?,?,?,00E55FA6,?), ref: 00E56ED8

Part of subcall function 00E56EBB: GetFullPathNameW.KERNEL32(?,00007FFF,?,?,?,?,?,00E55FA6,?), ref: 00E56EF1

Part of subcall function 00E5725E: __wsplitpath.LIBCMT ref: 00E5727B
Part of subcall function 00E5725E: __wsplitpath.LIBCMT ref: 00E5728E

Part of subcall function 00E572CB: GetFileAttributesW.KERNEL32(?,00E56019), ref: 00E572CC

_wcscat.LIBCMT ref: 00E56149
_wcscat.LIBCMT ref: 00E56167
__wsplitpath.LIBCMT ref: 00E5618E
FindFirstFileW.KERNEL32(?,?), ref: 00E561A4
_wcscpy.LIBCMT ref: 00E56209
_wcscat.LIBCMT ref: 00E5621C
_wcscat.LIBCMT ref: 00E5622F
lstrcmpiW.KERNEL32(?,?), ref: 00E5625D
DeleteFileW.KERNEL32(?), ref: 00E5626E
MoveFileW.KERNEL32(?,?), ref: 00E56289
MoveFileW.KERNEL32(?,?), ref: 00E56298
CopyFileW.KERNEL32(?,?,00000000), ref: 00E562AD
DeleteFileW.KERNEL32(?), ref: 00E562BE
FindNextFileW.KERNEL32(00000000,00000010), ref: 00E562E1
FindClose.KERNEL32(00000000), ref: 00E562FD
FindClose.KERNEL32(00000000), ref: 00E5630B

Strings

\*.*, xrefs: 00E56138, 00E56147, 00E56165

Memory Dump Source

Source File: 00000000.00000002.1262750966.0000000000E11000.00000020.00000001.01000000.00000003.sdmp, Offset: 00E10000, based on PE: true

Associated: 00000000.00000002.1262729095.0000000000E10000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1262808979.0000000000E9D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1262808979.0000000000EBE000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1262857687.0000000000ECA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1262878803.0000000000ED4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1262878803.0000000000F07000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_e10000_18112024_Dokman_1 Kas_m 2024- Avans_T24-2112184_dekont.jbxd

Similarity

API ID: File$Find_wcscat$__wsplitpath$CloseDeleteFullMoveNamePath$AttributesCopyFirstNext_wcscpylstrcmpi
String ID: \*.*
API String ID: 1917200108-1173974218
Opcode ID: b87721c260b678bb4e2e7d533965e333422bdfd5b90feb6b5591b28c8aa32e20
Instruction ID: 61bf27f453309afb7f1ec7a2003fd321aeaa5f1371c137146419c2ac088f843b
Opcode Fuzzy Hash: b87721c260b678bb4e2e7d533965e333422bdfd5b90feb6b5591b28c8aa32e20
Instruction Fuzzy Hash: 54513FB280912C6ACB21EBA1CC459EBB7FCAF05305F4515E6E985F3111DA32978D8F94

Function 00E66B0C Relevance: 30.2, APIs: 20, Instructions: 167clipboardCOMMON

Download Yara Rule

APIs

OpenClipboard.USER32(00EADC00), ref: 00E66B36
IsClipboardFormatAvailable.USER32(0000000D), ref: 00E66B44
GetClipboardData.USER32(0000000D), ref: 00E66B4C
CloseClipboard.USER32 ref: 00E66B58
GlobalLock.KERNEL32(00000000), ref: 00E66B74
CloseClipboard.USER32 ref: 00E66B7E
GlobalUnlock.KERNEL32(00000000), ref: 00E66B93
IsClipboardFormatAvailable.USER32(00000001), ref: 00E66BA0
GetClipboardData.USER32(00000001), ref: 00E66BA8
GlobalLock.KERNEL32(00000000), ref: 00E66BB5
GlobalUnlock.KERNEL32(00000000), ref: 00E66BE9
CloseClipboard.USER32 ref: 00E66CF6

Memory Dump Source

Source File: 00000000.00000002.1262750966.0000000000E11000.00000020.00000001.01000000.00000003.sdmp, Offset: 00E10000, based on PE: true

Associated: 00000000.00000002.1262729095.0000000000E10000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1262808979.0000000000E9D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1262808979.0000000000EBE000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1262857687.0000000000ECA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1262878803.0000000000ED4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1262878803.0000000000F07000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_e10000_18112024_Dokman_1 Kas_m 2024- Avans_T24-2112184_dekont.jbxd

Similarity

API ID: Clipboard$Global$Close$AvailableDataFormatLockUnlock$Open
String ID:
API String ID: 3222323430-0
Opcode ID: ee70c9a92c0bade7e6259886615cee9c55d8442ca789c3c8204e26219f60bf3a
Instruction ID: 04b413992aea5a3ed2e2cffc679195e7db52b7193df798af4732a7b695b8ae32
Opcode Fuzzy Hash: ee70c9a92c0bade7e6259886615cee9c55d8442ca789c3c8204e26219f60bf3a
Instruction Fuzzy Hash: 3851A071288301AFD300AF61ED46FAE77E8AF84B50F00242AF556F61E1DF70D8098B62

Function 00E5F5FA Relevance: 28.3, APIs: 13, Strings: 3, Instructions: 278timefileCOMMON

Download Yara Rule

APIs

FindFirstFileW.KERNEL32(?,?), ref: 00E5F62B
FindClose.KERNEL32(00000000), ref: 00E5F67F
FileTimeToLocalFileTime.KERNEL32(?,?), ref: 00E5F6A4
FileTimeToLocalFileTime.KERNEL32(?,?), ref: 00E5F6BB
FileTimeToSystemTime.KERNEL32(?,?), ref: 00E5F6E2
__swprintf.LIBCMT ref: 00E5F72E
__swprintf.LIBCMT ref: 00E5F767
__swprintf.LIBCMT ref: 00E5F7BB

Part of subcall function 00E3172B: __woutput_l.LIBCMT ref: 00E31784

__swprintf.LIBCMT ref: 00E5F809
__swprintf.LIBCMT ref: 00E5F858
__swprintf.LIBCMT ref: 00E5F8A7
__swprintf.LIBCMT ref: 00E5F8F6

Strings

%4d%02d%02d%02d%02d%02d, xrefs: 00E5F728
%4d, xrefs: 00E5F761
%02d, xrefs: 00E5F7B0, 00E5F7B9, 00E5F807, 00E5F856, 00E5F8A5, 00E5F8F4

Memory Dump Source

Source File: 00000000.00000002.1262750966.0000000000E11000.00000020.00000001.01000000.00000003.sdmp, Offset: 00E10000, based on PE: true

Associated: 00000000.00000002.1262729095.0000000000E10000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1262808979.0000000000E9D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1262808979.0000000000EBE000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1262857687.0000000000ECA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1262878803.0000000000ED4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1262878803.0000000000F07000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_e10000_18112024_Dokman_1 Kas_m 2024- Avans_T24-2112184_dekont.jbxd

Similarity

API ID: __swprintf$FileTime$FindLocal$CloseFirstSystem__woutput_l
String ID: %02d$%4d$%4d%02d%02d%02d%02d%02d
API String ID: 835046349-2428617273
Opcode ID: d5c344dfe7a6d549de6afc3655ef49d232ce28af685ad22c8dacd2d9e4ba3f5e
Instruction ID: 11f482f6c32c58e1616b02d3b04f77156b81a1bcd20c196c29c516b1c3860a60
Opcode Fuzzy Hash: d5c344dfe7a6d549de6afc3655ef49d232ce28af685ad22c8dacd2d9e4ba3f5e
Instruction Fuzzy Hash: A3A11EB2408344ABC310EBA5CC95DAFB7ECAF98704F441D2EF595D2152EB34DA49C762

Function 00E61B2F Relevance: 28.1, APIs: 15, Strings: 1, Instructions: 118fileCOMMON

Download Yara Rule

APIs

FindFirstFileW.KERNEL32(?,?,771A8FB0,?,00000000), ref: 00E61B50
_wcscmp.LIBCMT ref: 00E61B65
_wcscmp.LIBCMT ref: 00E61B7C
GetFileAttributesW.KERNEL32(?), ref: 00E61B8E
SetFileAttributesW.KERNEL32(?,?), ref: 00E61BA8
FindNextFileW.KERNEL32(00000000,?), ref: 00E61BC0
FindClose.KERNEL32(00000000), ref: 00E61BCB
FindFirstFileW.KERNEL32(*.*,?), ref: 00E61BE7
_wcscmp.LIBCMT ref: 00E61C0E
_wcscmp.LIBCMT ref: 00E61C25
SetCurrentDirectoryW.KERNEL32(?), ref: 00E61C37
SetCurrentDirectoryW.KERNEL32(00EC39FC), ref: 00E61C55
FindNextFileW.KERNEL32(00000000,00000010), ref: 00E61C5F
FindClose.KERNEL32(00000000), ref: 00E61C6C
FindClose.KERNEL32(00000000), ref: 00E61C7C

Strings

*.*, xrefs: 00E61BE2

Memory Dump Source

Source File: 00000000.00000002.1262750966.0000000000E11000.00000020.00000001.01000000.00000003.sdmp, Offset: 00E10000, based on PE: true

Associated: 00000000.00000002.1262729095.0000000000E10000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1262808979.0000000000E9D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1262808979.0000000000EBE000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1262857687.0000000000ECA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1262878803.0000000000ED4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1262878803.0000000000F07000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_e10000_18112024_Dokman_1 Kas_m 2024- Avans_T24-2112184_dekont.jbxd

Similarity

API ID: Find$File$_wcscmp$Close$AttributesCurrentDirectoryFirstNext
String ID: *.*
API String ID: 1803514871-438819550
Opcode ID: 73bacc642ca825aeb2000081a6ee0d42aa69f97ad95be57a67a1d74a1a43286c
Instruction ID: 1fd77e5a94e2e496a60b56d8c65efba0e99e0b81f39f9be0de635baf058d1b17
Opcode Fuzzy Hash: 73bacc642ca825aeb2000081a6ee0d42aa69f97ad95be57a67a1d74a1a43286c
Instruction Fuzzy Hash: 2031F332685219AFCF15AFB5EC48BDE77AC9F493A4F0451D6E801F3090EB70DA858A64

Function 00E61C8A Relevance: 24.6, APIs: 13, Strings: 1, Instructions: 111fileCOMMON

Download Yara Rule

APIs

FindFirstFileW.KERNEL32(?,?,771A8FB0,?,00000000), ref: 00E61CAB
_wcscmp.LIBCMT ref: 00E61CC0
_wcscmp.LIBCMT ref: 00E61CD7

Part of subcall function 00E56BD4: CreateFileW.KERNEL32(?,40000000,00000001,00000000,00000003,02000080,00000000), ref: 00E56BEF

FindNextFileW.KERNEL32(00000000,?), ref: 00E61D06
FindClose.KERNEL32(00000000), ref: 00E61D11
FindFirstFileW.KERNEL32(*.*,?), ref: 00E61D2D
_wcscmp.LIBCMT ref: 00E61D54
_wcscmp.LIBCMT ref: 00E61D6B
SetCurrentDirectoryW.KERNEL32(?), ref: 00E61D7D
SetCurrentDirectoryW.KERNEL32(00EC39FC), ref: 00E61D9B
FindNextFileW.KERNEL32(00000000,00000010), ref: 00E61DA5
FindClose.KERNEL32(00000000), ref: 00E61DB2
FindClose.KERNEL32(00000000), ref: 00E61DC2

Strings

*.*, xrefs: 00E61D28

Memory Dump Source

Source File: 00000000.00000002.1262750966.0000000000E11000.00000020.00000001.01000000.00000003.sdmp, Offset: 00E10000, based on PE: true

Associated: 00000000.00000002.1262729095.0000000000E10000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1262808979.0000000000E9D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1262808979.0000000000EBE000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1262857687.0000000000ECA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1262878803.0000000000ED4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1262878803.0000000000F07000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_e10000_18112024_Dokman_1 Kas_m 2024- Avans_T24-2112184_dekont.jbxd

Similarity

API ID: Find$File$_wcscmp$Close$CurrentDirectoryFirstNext$Create
String ID: *.*
API String ID: 1824444939-438819550
Opcode ID: 5501fffff62f4cd9aed9924cb8a0f92b163cc929b3a8a6c2e60c4d7cce0610a2
Instruction ID: d0fb87d00053404000b4ca7b4f6859e7cae69114a9e07a922d597513ca181f16
Opcode Fuzzy Hash: 5501fffff62f4cd9aed9924cb8a0f92b163cc929b3a8a6c2e60c4d7cce0610a2
Instruction Fuzzy Hash: 9A31263254421A7ECF11ABA5EC09ADE77AC9F453A5F1865D6E801B3090DB30DE85CA64

Function 00E6091D Relevance: 22.9, APIs: 12, Strings: 1, Instructions: 185timeCOMMON

Download Yara Rule

APIs

GetLocalTime.KERNEL32(?), ref: 00E609DF
SystemTimeToFileTime.KERNEL32(?,?), ref: 00E609EF
LocalFileTimeToFileTime.KERNEL32(?,?), ref: 00E609FB
__wsplitpath.LIBCMT ref: 00E60A59
_wcscat.LIBCMT ref: 00E60A71
_wcscat.LIBCMT ref: 00E60A83
GetCurrentDirectoryW.KERNEL32(00007FFF,?), ref: 00E60A98
SetCurrentDirectoryW.KERNEL32(?), ref: 00E60AAC
SetCurrentDirectoryW.KERNEL32(?), ref: 00E60ADE
SetCurrentDirectoryW.KERNEL32(?), ref: 00E60AFF
_wcscpy.LIBCMT ref: 00E60B0B
SetCurrentDirectoryW.KERNEL32(?,?,?,?,?), ref: 00E60B4A

Strings

*.*, xrefs: 00E60B05

Memory Dump Source

Source File: 00000000.00000002.1262750966.0000000000E11000.00000020.00000001.01000000.00000003.sdmp, Offset: 00E10000, based on PE: true

Associated: 00000000.00000002.1262729095.0000000000E10000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1262808979.0000000000E9D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1262808979.0000000000EBE000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1262857687.0000000000ECA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1262878803.0000000000ED4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1262878803.0000000000F07000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_e10000_18112024_Dokman_1 Kas_m 2024- Avans_T24-2112184_dekont.jbxd

Similarity

API ID: CurrentDirectoryTime$File$Local_wcscat$System__wsplitpath_wcscpy
String ID: *.*
API String ID: 3566783562-438819550
Opcode ID: 6b44148999bf3ae3b5f85ba7c52f213faf171bf28edaa303829c4ec1f861942e
Instruction ID: dbb6be5f80e9537b98dec3e85f3a20371632c926deaed671af805dcc73d92317
Opcode Fuzzy Hash: 6b44148999bf3ae3b5f85ba7c52f213faf171bf28edaa303829c4ec1f861942e
Instruction Fuzzy Hash: 2C6178725082159FC710EF60D8449AFB3E8FF89324F04991EF999E7252DB31E949CB92

Function 00E4A66C Relevance: 21.2, APIs: 14, Instructions: 178memoryCOMMON

Download Yara Rule

APIs

Part of subcall function 00E4ABBB: GetUserObjectSecurity.USER32(?,?,?,00000000,?), ref: 00E4ABD7
Part of subcall function 00E4ABBB: GetLastError.KERNEL32(?,00E4A69F,?,?,?), ref: 00E4ABE1
Part of subcall function 00E4ABBB: GetProcessHeap.KERNEL32(00000008,?,?,00E4A69F,?,?,?), ref: 00E4ABF0
Part of subcall function 00E4ABBB: HeapAlloc.KERNEL32(00000000,?,00E4A69F,?,?,?), ref: 00E4ABF7
Part of subcall function 00E4ABBB: GetUserObjectSecurity.USER32(?,?,00000000,?,?), ref: 00E4AC0E

Part of subcall function 00E4AC56: GetProcessHeap.KERNEL32(00000008,00E4A6B5,00000000,00000000,?,00E4A6B5,?), ref: 00E4AC62
Part of subcall function 00E4AC56: HeapAlloc.KERNEL32(00000000,?,00E4A6B5,?), ref: 00E4AC69
Part of subcall function 00E4AC56: InitializeSecurityDescriptor.ADVAPI32(00000000,00000001,?,00E4A6B5,?), ref: 00E4AC7A

GetSecurityDescriptorDacl.ADVAPI32(?,?,?,?), ref: 00E4A6D0
_memset.LIBCMT ref: 00E4A6E5
GetAclInformation.ADVAPI32(?,?,0000000C,00000002), ref: 00E4A704
GetLengthSid.ADVAPI32(?), ref: 00E4A715
GetAce.ADVAPI32(?,00000000,?), ref: 00E4A752
AddAce.ADVAPI32(?,00000002,000000FF,?,?), ref: 00E4A76E
GetLengthSid.ADVAPI32(?), ref: 00E4A78B
GetProcessHeap.KERNEL32(00000008,-00000008), ref: 00E4A79A
HeapAlloc.KERNEL32(00000000), ref: 00E4A7A1
GetLengthSid.ADVAPI32(?,00000008,?), ref: 00E4A7C2
CopySid.ADVAPI32(00000000), ref: 00E4A7C9
AddAce.ADVAPI32(?,00000002,000000FF,00000000,?), ref: 00E4A7FA
SetSecurityDescriptorDacl.ADVAPI32(?,00000001,?,00000000), ref: 00E4A820
SetUserObjectSecurity.USER32(?,00000004,?), ref: 00E4A834

Memory Dump Source

Source File: 00000000.00000002.1262750966.0000000000E11000.00000020.00000001.01000000.00000003.sdmp, Offset: 00E10000, based on PE: true

Associated: 00000000.00000002.1262729095.0000000000E10000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1262808979.0000000000E9D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1262808979.0000000000EBE000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1262857687.0000000000ECA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1262878803.0000000000ED4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1262878803.0000000000F07000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_e10000_18112024_Dokman_1 Kas_m 2024- Avans_T24-2112184_dekont.jbxd

Similarity

API ID: HeapSecurity$AllocDescriptorLengthObjectProcessUser$Dacl$CopyErrorInformationInitializeLast_memset
String ID:
API String ID: 3996160137-0
Opcode ID: 517a6717c36afe3b09dcaa84625ea6ee186f46ed810ce342b59a56bacbdb1e95
Instruction ID: 8dc5aea3d6a344e3ccf783df17f6988a568c81a4dbdbe6be571745a34024e098
Opcode Fuzzy Hash: 517a6717c36afe3b09dcaa84625ea6ee186f46ed810ce342b59a56bacbdb1e95
Instruction Fuzzy Hash: A2516D71940219AFDF14DF92EC48AEEBBB9FF08314F08812AF911B7291D7349A05CB61

Function 00E16F07 Relevance: 20.9, Strings: 16, Instructions: 883COMMON

Download Yara Rule

Strings

ANY), xrefs: 00E92E60
LIMIT_RECURSION=, xrefs: 00E92D7E
ANYCRLF), xrefs: 00E92E7D
UTF16), xrefs: 00E92C56
, xrefs: 00E17096, 00E1709C
UTF), xrefs: 00E92C7C
BSR_UNICODE), xrefs: 00E92EBA
CRLF), xrefs: 00E92E43
CR), xrefs: 00E92E09
UCP), xrefs: 00E92C8F
NO_START_OPT), xrefs: 00E92CD1
LIMIT_MATCH=, xrefs: 00E92CF2
BSR_ANYCRLF), xrefs: 00E92EA0
LF), xrefs: 00E92E26
, xrefs: 00E16F77
NO_AUTO_POSSESS), xrefs: 00E92CB0

Memory Dump Source

Source File: 00000000.00000002.1262750966.0000000000E11000.00000020.00000001.01000000.00000003.sdmp, Offset: 00E10000, based on PE: true

Associated: 00000000.00000002.1262729095.0000000000E10000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1262808979.0000000000E9D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1262808979.0000000000EBE000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1262857687.0000000000ECA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1262878803.0000000000ED4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1262878803.0000000000F07000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_e10000_18112024_Dokman_1 Kas_m 2024- Avans_T24-2112184_dekont.jbxd

Similarity

API ID:
String ID: $ANY)$ANYCRLF)$BSR_ANYCRLF)$BSR_UNICODE)$CR)$CRLF)$LF)$LIMIT_MATCH=$LIMIT_RECURSION=$NO_AUTO_POSSESS)$NO_START_OPT)$UCP)$UTF)$UTF16)$
API String ID: 0-699356676
Opcode ID: 37591cfebcbb8bd04ba4627ed849d01332fe1eb5e87fb6373cd18262e8183f41
Instruction ID: 51d39adb3b9db8c54aedf3dcdcf04363e9d85667b57f6b0cf823ff0dd40bca99
Opcode Fuzzy Hash: 37591cfebcbb8bd04ba4627ed849d01332fe1eb5e87fb6373cd18262e8183f41
Instruction Fuzzy Hash: 3D728D71E042199BDF24CF58C880BEEB7B5BF48714F14916AE959FB280DB709E81DB90

Function 00E563F9 Relevance: 17.6, APIs: 9, Strings: 1, Instructions: 89fileCOMMON

Download Yara Rule

APIs

Part of subcall function 00E56EBB: GetFullPathNameW.KERNEL32(00000000,00007FFF,?,?,?,?,?,?,00E55FA6,?), ref: 00E56ED8

Part of subcall function 00E572CB: GetFileAttributesW.KERNEL32(?,00E56019), ref: 00E572CC

_wcscat.LIBCMT ref: 00E56441
__wsplitpath.LIBCMT ref: 00E5645F
FindFirstFileW.KERNEL32(?,?), ref: 00E56474
_wcscpy.LIBCMT ref: 00E564A3
_wcscat.LIBCMT ref: 00E564B8
_wcscat.LIBCMT ref: 00E564CA
DeleteFileW.KERNEL32(?), ref: 00E564DA
FindNextFileW.KERNEL32(00000000,00000010), ref: 00E564EB
FindClose.KERNEL32(00000000), ref: 00E56506

Strings

\*.*, xrefs: 00E5643B

Memory Dump Source

Source File: 00000000.00000002.1262750966.0000000000E11000.00000020.00000001.01000000.00000003.sdmp, Offset: 00E10000, based on PE: true

Associated: 00000000.00000002.1262729095.0000000000E10000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1262808979.0000000000E9D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1262808979.0000000000EBE000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1262857687.0000000000ECA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1262878803.0000000000ED4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1262878803.0000000000F07000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_e10000_18112024_Dokman_1 Kas_m 2024- Avans_T24-2112184_dekont.jbxd

Similarity

API ID: File$Find_wcscat$AttributesCloseDeleteFirstFullNameNextPath__wsplitpath_wcscpy
String ID: \*.*
API String ID: 2643075503-1173974218
Opcode ID: ebba2ff740af674123cbbaa997032d39828705dfd5dd5ef9be79f60a25bf442c
Instruction ID: 721bcd0ed49fb9ee59ced1ad9bc9143ffabb02c18b3fbb106543936ccffad953
Opcode Fuzzy Hash: ebba2ff740af674123cbbaa997032d39828705dfd5dd5ef9be79f60a25bf442c
Instruction Fuzzy Hash: F8318DB240C388AAC721DBA48889ADBB7DCAF55314F401D2AFAD8D3141EA35D50DC7A7

Function 00E731BC Relevance: 16.9, APIs: 11, Instructions: 397registryCOMMON

Download Yara Rule

APIs

Part of subcall function 00E73C06: CharUpperBuffW.USER32(?,?,?,?,?,?,?,00E72BB5,?,?), ref: 00E73C1D

RegConnectRegistryW.ADVAPI32(?,?,?), ref: 00E7328E

Part of subcall function 00E1936C: __swprintf.LIBCMT ref: 00E193AB
Part of subcall function 00E1936C: __itow.LIBCMT ref: 00E193DF

RegQueryValueExW.ADVAPI32(?,?,00000000,?,00000000,?), ref: 00E7332D
RegQueryValueExW.ADVAPI32(?,?,00000000,00000000,?,00000008), ref: 00E733C5
RegCloseKey.ADVAPI32(000000FE,000000FE,00000000,?,00000000), ref: 00E73604
RegCloseKey.ADVAPI32(00000000), ref: 00E73611

Memory Dump Source

Source File: 00000000.00000002.1262750966.0000000000E11000.00000020.00000001.01000000.00000003.sdmp, Offset: 00E10000, based on PE: true

Associated: 00000000.00000002.1262729095.0000000000E10000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1262808979.0000000000E9D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1262808979.0000000000EBE000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1262857687.0000000000ECA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1262878803.0000000000ED4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1262878803.0000000000F07000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_e10000_18112024_Dokman_1 Kas_m 2024- Avans_T24-2112184_dekont.jbxd

Similarity

API ID: CloseQueryValue$BuffCharConnectRegistryUpper__itow__swprintf
String ID:
API String ID: 1240663315-0
Opcode ID: 5a4f11a7ed6d48835ef38ec66d24945d055d03b0a60a6568dc326cf1e671af69
Instruction ID: d640db51a5523953d3f1fb4994e5ef2609e21c921bab28b21c437d6d7d453216
Opcode Fuzzy Hash: 5a4f11a7ed6d48835ef38ec66d24945d055d03b0a60a6568dc326cf1e671af69
Instruction Fuzzy Hash: 08E17D35604210AFCB14DF29C891E6ABBE9EF88314F04D96DF55AEB261DB30ED05CB51

Function 00E52B37 Relevance: 16.6, APIs: 11, Instructions: 119keyboardCOMMON

Download Yara Rule

APIs

GetKeyboardState.USER32(?), ref: 00E52B5F
GetAsyncKeyState.USER32(000000A0), ref: 00E52BE0
GetKeyState.USER32(000000A0), ref: 00E52BFB
GetAsyncKeyState.USER32(000000A1), ref: 00E52C15
GetKeyState.USER32(000000A1), ref: 00E52C2A
GetAsyncKeyState.USER32(00000011), ref: 00E52C42
GetKeyState.USER32(00000011), ref: 00E52C54
GetAsyncKeyState.USER32(00000012), ref: 00E52C6C
GetKeyState.USER32(00000012), ref: 00E52C7E
GetAsyncKeyState.USER32(0000005B), ref: 00E52C96
GetKeyState.USER32(0000005B), ref: 00E52CA8

Memory Dump Source

Source File: 00000000.00000002.1262750966.0000000000E11000.00000020.00000001.01000000.00000003.sdmp, Offset: 00E10000, based on PE: true

Associated: 00000000.00000002.1262729095.0000000000E10000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1262808979.0000000000E9D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1262808979.0000000000EBE000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1262857687.0000000000ECA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1262878803.0000000000ED4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1262878803.0000000000F07000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_e10000_18112024_Dokman_1 Kas_m 2024- Avans_T24-2112184_dekont.jbxd

Similarity

API ID: State$Async$Keyboard
String ID:
API String ID: 541375521-0
Opcode ID: 4141b63bf0018b6d0c63052882627960d9400a544dfa385353c93f34c71b605f
Instruction ID: 06b69a9e47c859ca05613750e575cbea756db262c507e1a0b41fe15d16b985f0
Opcode Fuzzy Hash: 4141b63bf0018b6d0c63052882627960d9400a544dfa385353c93f34c71b605f
Instruction Fuzzy Hash: 4041B3309047C96DFF309B6488043A9FEA06B13309F44985EDFC6762C2DB9599CCC7A2

Function 00E66D07 Relevance: 15.1, APIs: 10, Instructions: 83clipboardmemoryCOMMON

Download Yara Rule

APIs

OpenClipboard.USER32 ref: 00E66D2E
EmptyClipboard.USER32 ref: 00E66D34
GlobalAlloc.KERNEL32(00000002,?), ref: 00E66D49
CloseClipboard.USER32 ref: 00E66DE8

Memory Dump Source

Source File: 00000000.00000002.1262750966.0000000000E11000.00000020.00000001.01000000.00000003.sdmp, Offset: 00E10000, based on PE: true

Associated: 00000000.00000002.1262729095.0000000000E10000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1262808979.0000000000E9D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1262808979.0000000000EBE000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1262857687.0000000000ECA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1262878803.0000000000ED4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1262878803.0000000000F07000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_e10000_18112024_Dokman_1 Kas_m 2024- Avans_T24-2112184_dekont.jbxd

Similarity

API ID: Clipboard$AllocCloseEmptyGlobalOpen
String ID:
API String ID: 1737998785-0
Opcode ID: f59aadbebf9a3b89f325b6642f405a8af14aa9d71edf6d3d96df884fc819567a
Instruction ID: 3f5ffd8290767564e652c3081b1808b8a73a95843c3548d38ba6548e8326fd0f
Opcode Fuzzy Hash: f59aadbebf9a3b89f325b6642f405a8af14aa9d71edf6d3d96df884fc819567a
Instruction Fuzzy Hash: CF218D31304220AFDB11AF65ED59B6D77E8EF44751F00941BF90AFB2A1CB30E9048B54

Function 00E6C18C Relevance: 12.5, APIs: 6, Strings: 1, Instructions: 232COMMON

Download Yara Rule

APIs

Part of subcall function 00E49ABF: CLSIDFromProgID.OLE32 ref: 00E49ADC
Part of subcall function 00E49ABF: ProgIDFromCLSID.OLE32(?,00000000), ref: 00E49AF7
Part of subcall function 00E49ABF: lstrcmpiW.KERNEL32(?,00000000), ref: 00E49B05
Part of subcall function 00E49ABF: CoTaskMemFree.OLE32(00000000,?,00000000), ref: 00E49B15

CoInitializeSecurity.OLE32(00000000,000000FF,00000000,00000000,00000002,00000003,00000000,00000000,00000000,?,?,?), ref: 00E6C235
_memset.LIBCMT ref: 00E6C242
_memset.LIBCMT ref: 00E6C360
CoCreateInstanceEx.OLE32(?,00000000,00000015,?,00000001,00000001), ref: 00E6C38C
CoTaskMemFree.OLE32(?), ref: 00E6C397

Strings

NULL Pointer assignment, xrefs: 00E6C3E5

Memory Dump Source

Source File: 00000000.00000002.1262750966.0000000000E11000.00000020.00000001.01000000.00000003.sdmp, Offset: 00E10000, based on PE: true

Associated: 00000000.00000002.1262729095.0000000000E10000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1262808979.0000000000E9D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1262808979.0000000000EBE000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1262857687.0000000000ECA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1262878803.0000000000ED4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1262878803.0000000000F07000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_e10000_18112024_Dokman_1 Kas_m 2024- Avans_T24-2112184_dekont.jbxd

Similarity

API ID: FreeFromProgTask_memset$CreateInitializeInstanceSecuritylstrcmpi
String ID: NULL Pointer assignment
API String ID: 1300414916-2785691316
Opcode ID: 9ac6e54a06a9abe9379908130d92857a025160a065f90ce4a792cf0e5ed385c3
Instruction ID: 5387e7ec2fa10d93a4bb76511b4bd2dc5a5277fd8456cb0e834bcb86c8f45849
Opcode Fuzzy Hash: 9ac6e54a06a9abe9379908130d92857a025160a065f90ce4a792cf0e5ed385c3
Instruction Fuzzy Hash: EC913B71D40218ABDB10DF94EC95EEEBBB8EF08750F20915AF519B7281DB709A45CFA0

Function 00E579D3 Relevance: 10.6, APIs: 3, Strings: 3, Instructions: 58shutdownCOMMON

Download Yara Rule

APIs

Part of subcall function 00E4B134: LookupPrivilegeValueW.ADVAPI32(00000000,00000000,00000004), ref: 00E4B180
Part of subcall function 00E4B134: AdjustTokenPrivileges.ADVAPI32(?,00000000,00000000,?,00000000,?), ref: 00E4B1AD
Part of subcall function 00E4B134: GetLastError.KERNEL32 ref: 00E4B1BA

ExitWindowsEx.USER32(?,00000000), ref: 00E57A0F

Strings

SeShutdownPrivilege, xrefs: 00E579DD
, xrefs: 00E579FD
@, xrefs: 00E57A02

Memory Dump Source

Source File: 00000000.00000002.1262750966.0000000000E11000.00000020.00000001.01000000.00000003.sdmp, Offset: 00E10000, based on PE: true

Associated: 00000000.00000002.1262729095.0000000000E10000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1262808979.0000000000E9D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1262808979.0000000000EBE000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1262857687.0000000000ECA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1262878803.0000000000ED4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1262878803.0000000000F07000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_e10000_18112024_Dokman_1 Kas_m 2024- Avans_T24-2112184_dekont.jbxd

Similarity

API ID: AdjustErrorExitLastLookupPrivilegePrivilegesTokenValueWindows
String ID: $@$SeShutdownPrivilege
API String ID: 2234035333-194228
Opcode ID: 11a2b7986363842a2ecb0a48da1edf7fa1affe2bb02ff78faab792f1c73450ec
Instruction ID: d64fbc384cb22926dd67d3b49d6c0bc457cf35add10d23d96f063f9055b82681
Opcode Fuzzy Hash: 11a2b7986363842a2ecb0a48da1edf7fa1affe2bb02ff78faab792f1c73450ec
Instruction Fuzzy Hash: A601A7716592216EF7285678BC5ABFF72589B00746F243C25FD83B20D3DA619E2881B0

Function 00E68C4F Relevance: 9.1, APIs: 6, Instructions: 83networkCOMMON

Download Yara Rule

APIs

socket.WSOCK32(00000002,00000001,00000006), ref: 00E68CA8
WSAGetLastError.WSOCK32(00000000), ref: 00E68CB7
bind.WSOCK32(00000000,?,00000010), ref: 00E68CD3
listen.WSOCK32(00000000,00000005), ref: 00E68CE2
WSAGetLastError.WSOCK32(00000000), ref: 00E68CFC
closesocket.WSOCK32(00000000), ref: 00E68D10

Memory Dump Source

Source File: 00000000.00000002.1262750966.0000000000E11000.00000020.00000001.01000000.00000003.sdmp, Offset: 00E10000, based on PE: true

Associated: 00000000.00000002.1262729095.0000000000E10000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1262808979.0000000000E9D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1262808979.0000000000EBE000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1262857687.0000000000ECA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1262878803.0000000000ED4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1262878803.0000000000F07000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_e10000_18112024_Dokman_1 Kas_m 2024- Avans_T24-2112184_dekont.jbxd

Similarity

API ID: ErrorLast$bindclosesocketlistensocket
String ID:
API String ID: 1279440585-0
Opcode ID: 7a6c6c426a7d64515c64bf2352ee83ecf1d840b55b86264dc8737906e6de22e9
Instruction ID: 73a56969a64b45bec20a127d7dc95f45d98ae37387d22180a6ef4fa55668d1c8
Opcode Fuzzy Hash: 7a6c6c426a7d64515c64bf2352ee83ecf1d840b55b86264dc8737906e6de22e9
Instruction Fuzzy Hash: EA21E4316002109FCB10EF68DD85B6EB7E9EF48364F14525AF956B72D2CB30AD45CB61

Function 00E56532 Relevance: 9.1, APIs: 6, Instructions: 71processCOMMON

Download Yara Rule

APIs

CreateToolhelp32Snapshot.KERNEL32(00000002,00000000,?,00000000), ref: 00E56554
Process32FirstW.KERNEL32(00000000,0000022C), ref: 00E56564
Process32NextW.KERNEL32(00000000,0000022C), ref: 00E56583
__wsplitpath.LIBCMT ref: 00E565A7
_wcscat.LIBCMT ref: 00E565BA
CloseHandle.KERNEL32(00000000,?,00000000), ref: 00E565F9

Memory Dump Source

Source File: 00000000.00000002.1262750966.0000000000E11000.00000020.00000001.01000000.00000003.sdmp, Offset: 00E10000, based on PE: true

Associated: 00000000.00000002.1262729095.0000000000E10000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1262808979.0000000000E9D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1262808979.0000000000EBE000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1262857687.0000000000ECA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1262878803.0000000000ED4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1262878803.0000000000F07000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_e10000_18112024_Dokman_1 Kas_m 2024- Avans_T24-2112184_dekont.jbxd

Similarity

API ID: Process32$CloseCreateFirstHandleNextSnapshotToolhelp32__wsplitpath_wcscat
String ID:
API String ID: 1605983538-0
Opcode ID: a34d563397e59a47e435d8cef8a84905cd0201c3a1d734c9c08ddda5cb4f1a37
Instruction ID: a76101d678564dcfaf2a4d601b6a07f003ab9c43ab361862fb2504e180beef47
Opcode Fuzzy Hash: a34d563397e59a47e435d8cef8a84905cd0201c3a1d734c9c08ddda5cb4f1a37
Instruction Fuzzy Hash: 5E2195B1904218AFDB10ABA5CC88BDEBBFCAB04305F5018E6E905F7141E7719F89CB60

Function 00E513CA Relevance: 8.1, APIs: 1, Strings: 4, Instructions: 560stringCOMMON

Download Yara Rule

APIs

lstrlenW.KERNEL32(?,?,?,00000000), ref: 00E513DC

Strings

<2, xrefs: 00E516FA
(, xrefs: 00E51422
|, xrefs: 00E5140C
,2, xrefs: 00E516B1

Memory Dump Source

Source File: 00000000.00000002.1262750966.0000000000E11000.00000020.00000001.01000000.00000003.sdmp, Offset: 00E10000, based on PE: true

Associated: 00000000.00000002.1262729095.0000000000E10000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1262808979.0000000000E9D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1262808979.0000000000EBE000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1262857687.0000000000ECA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1262878803.0000000000ED4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1262878803.0000000000F07000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_e10000_18112024_Dokman_1 Kas_m 2024- Avans_T24-2112184_dekont.jbxd

Similarity

API ID: lstrlen
String ID: ($,2$<2$|
API String ID: 1659193697-916407979
Opcode ID: 31668ac9d7ebf6651c83313648b045e1f24db347c82c2fbbd46341f3dd3b716c
Instruction ID: 964ffcad8c4bccd534791330ed205f77f392cc710881acd12d353de93ea8e39a
Opcode Fuzzy Hash: 31668ac9d7ebf6651c83313648b045e1f24db347c82c2fbbd46341f3dd3b716c
Instruction Fuzzy Hash: 5F323A75A007059FC728DF19D480A6AB7F0FF48314B15D8AEE99AEB3A1D770E941CB44

Function 00E6923B Relevance: 7.6, APIs: 5, Instructions: 146networkCOMMON

Download Yara Rule

APIs

Part of subcall function 00E6A82C: inet_addr.WSOCK32(00000000), ref: 00E6A84E

socket.WSOCK32(00000002,00000002,00000011), ref: 00E69296
WSAGetLastError.WSOCK32(00000000,00000000), ref: 00E692B9

Memory Dump Source

Source File: 00000000.00000002.1262750966.0000000000E11000.00000020.00000001.01000000.00000003.sdmp, Offset: 00E10000, based on PE: true

Associated: 00000000.00000002.1262729095.0000000000E10000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1262808979.0000000000E9D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1262808979.0000000000EBE000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1262857687.0000000000ECA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1262878803.0000000000ED4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1262878803.0000000000F07000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_e10000_18112024_Dokman_1 Kas_m 2024- Avans_T24-2112184_dekont.jbxd

Similarity

API ID: ErrorLastinet_addrsocket
String ID:
API String ID: 4170576061-0
Opcode ID: de27064a010bdbb8a183b2383c4142864c74aa975447a0e618698bd3301c5533
Instruction ID: d048049ae774f95fc21aa517e43e979e9d6923b28245607d69f5ecfcef988855
Opcode Fuzzy Hash: de27064a010bdbb8a183b2383c4142864c74aa975447a0e618698bd3301c5533
Instruction Fuzzy Hash: 68410070A00210AFDB10AB68DC92EBEB7EDEF44364F14554DF916BB3D2CA749E418B91

Function 00E5EB60 Relevance: 7.6, APIs: 5, Instructions: 125fileCOMMON

Download Yara Rule

APIs

FindFirstFileW.KERNEL32(?,?), ref: 00E5EB8A
_wcscmp.LIBCMT ref: 00E5EBBA
_wcscmp.LIBCMT ref: 00E5EBCF
FindNextFileW.KERNEL32(00000000,?), ref: 00E5EBE0
FindClose.KERNEL32(00000000,00000001,00000000), ref: 00E5EC0E

Memory Dump Source

Source File: 00000000.00000002.1262750966.0000000000E11000.00000020.00000001.01000000.00000003.sdmp, Offset: 00E10000, based on PE: true

Associated: 00000000.00000002.1262729095.0000000000E10000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1262808979.0000000000E9D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1262808979.0000000000EBE000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1262857687.0000000000ECA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1262878803.0000000000ED4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1262878803.0000000000F07000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_e10000_18112024_Dokman_1 Kas_m 2024- Avans_T24-2112184_dekont.jbxd

Similarity

API ID: Find$File_wcscmp$CloseFirstNext
String ID:
API String ID: 2387731787-0
Opcode ID: f18b7eb0f3b315ce6a7d649acfde9dad5338d6c5285c83b5a011472ccfa81a8e
Instruction ID: 49858d901f79eb835fec4a65599c42dc49e8b8070dd6fba0319447a57d475a03
Opcode Fuzzy Hash: f18b7eb0f3b315ce6a7d649acfde9dad5338d6c5285c83b5a011472ccfa81a8e
Instruction Fuzzy Hash: 4A41B1356043019FC718DF28C491A99B7E4FF49324F10595EE95AAB3A1DB31EA44CB51

Function 00E78111 Relevance: 7.6, APIs: 5, Instructions: 69windowCOMMON

Download Yara Rule

APIs

IsWindowVisible.USER32 ref: 00E78160
IsWindowEnabled.USER32 ref: 00E7816E
GetForegroundWindow.USER32(?,?,00000001), ref: 00E7817B
IsIconic.USER32 ref: 00E78189
IsZoomed.USER32 ref: 00E78197

Memory Dump Source

Source File: 00000000.00000002.1262750966.0000000000E11000.00000020.00000001.01000000.00000003.sdmp, Offset: 00E10000, based on PE: true

Associated: 00000000.00000002.1262729095.0000000000E10000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1262808979.0000000000E9D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1262808979.0000000000EBE000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1262857687.0000000000ECA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1262878803.0000000000ED4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1262878803.0000000000F07000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_e10000_18112024_Dokman_1 Kas_m 2024- Avans_T24-2112184_dekont.jbxd

Similarity

API ID: Window$EnabledForegroundIconicVisibleZoomed
String ID:
API String ID: 292994002-0
Opcode ID: 389deed940e807751e1636f6e1ed38ad04b0a71c2f205e1b78a11707cf5dad72
Instruction ID: 66f1e2c5875afbd12e29b3263c54ca8638547399fbdf42720525d588544312ee
Opcode Fuzzy Hash: 389deed940e807751e1636f6e1ed38ad04b0a71c2f205e1b78a11707cf5dad72
Instruction Fuzzy Hash: C211B2313412206FE7215F26DD48E6FBB9CEF64764B44942AF94DF7241CF30990286A0

Function 00E19B60 Relevance: 7.3, Strings: 5, Instructions: 1055COMMON

Download Yara Rule

Strings

VUUU, xrefs: 00E19EA7
VUUU, xrefs: 00E19E95
VUUU, xrefs: 00E19ED4
VUUU, xrefs: 00E9BE14
ERCP, xrefs: 00E19C32

Memory Dump Source

Source File: 00000000.00000002.1262750966.0000000000E11000.00000020.00000001.01000000.00000003.sdmp, Offset: 00E10000, based on PE: true

Associated: 00000000.00000002.1262729095.0000000000E10000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1262808979.0000000000E9D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1262808979.0000000000EBE000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1262857687.0000000000ECA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1262878803.0000000000ED4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1262878803.0000000000F07000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_e10000_18112024_Dokman_1 Kas_m 2024- Avans_T24-2112184_dekont.jbxd

Similarity

API ID:
String ID: ERCP$VUUU$VUUU$VUUU$VUUU
API String ID: 0-1546025612
Opcode ID: 8711e64c0d069d8aa2459de525fe7de2984e0423819275309421c18b21c496ef
Instruction ID: c48326931dffa7e9413e322d8d23b805f929075d8910c79eaa515b4859f0f2df
Opcode Fuzzy Hash: 8711e64c0d069d8aa2459de525fe7de2984e0423819275309421c18b21c496ef
Instruction Fuzzy Hash: 6E927B71A0121ACBDF24DF58C9907FDB7B1BB54318F24A1AAE816BB281D7709DC1CB91

Function 00E2E01E Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 15libraryloaderCOMMON

Download Yara Rule

APIs

LoadLibraryA.KERNEL32(kernel32.dll,?,00E2E014,771B0AE0,00E2DEF1,00EADC38,?,?), ref: 00E2E02C
GetProcAddress.KERNEL32(00000000,GetNativeSystemInfo), ref: 00E2E03E

Strings

kernel32.dll, xrefs: 00E2E027
GetNativeSystemInfo, xrefs: 00E2E038

Memory Dump Source

Source File: 00000000.00000002.1262750966.0000000000E11000.00000020.00000001.01000000.00000003.sdmp, Offset: 00E10000, based on PE: true

Associated: 00000000.00000002.1262729095.0000000000E10000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1262808979.0000000000E9D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1262808979.0000000000EBE000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1262857687.0000000000ECA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1262878803.0000000000ED4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1262878803.0000000000F07000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_e10000_18112024_Dokman_1 Kas_m 2024- Avans_T24-2112184_dekont.jbxd

Similarity

API ID: AddressLibraryLoadProc
String ID: GetNativeSystemInfo$kernel32.dll
API String ID: 2574300362-192647395
Opcode ID: 738eee921ac8fa81052ca3049e96a4c72482e6d4fcb42612c7e962cd7726879f
Instruction ID: 734c0baec18bf7e18d6a26b86cdfeab8399dde24bb3cc6cbb3dbaadc26339153
Opcode Fuzzy Hash: 738eee921ac8fa81052ca3049e96a4c72482e6d4fcb42612c7e962cd7726879f
Instruction Fuzzy Hash: AFD05E714047329EC7224B62FD08B5276E4AB00304F18541FA491B2250DAB4D8868650

Function 00E2B11F Relevance: 4.9, APIs: 3, Instructions: 377COMMON

Download Yara Rule

APIs

Part of subcall function 00E2B34E: GetWindowLongW.USER32(?,000000EB), ref: 00E2B35F

DefDlgProcW.USER32(?,?,?,?,?), ref: 00E2B22F

Part of subcall function 00E2B55D: DefDlgProcW.USER32(?,00000020,?,00000000), ref: 00E2B5A5

Memory Dump Source

Source File: 00000000.00000002.1262750966.0000000000E11000.00000020.00000001.01000000.00000003.sdmp, Offset: 00E10000, based on PE: true

Associated: 00000000.00000002.1262729095.0000000000E10000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1262808979.0000000000E9D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1262808979.0000000000EBE000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1262857687.0000000000ECA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1262878803.0000000000ED4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1262878803.0000000000F07000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_e10000_18112024_Dokman_1 Kas_m 2024- Avans_T24-2112184_dekont.jbxd

Similarity

API ID: Proc$LongWindow
String ID:
API String ID: 2749884682-0
Opcode ID: de8f91247ca8d83f1c442e23a7ccabd51f469dc29282c89ceac327bf0dbd89d8
Instruction ID: 182ba4533c85d51c87d69f17ca3d3eec24e3c322b50aaf5883a9e24f335dbfce
Opcode Fuzzy Hash: de8f91247ca8d83f1c442e23a7ccabd51f469dc29282c89ceac327bf0dbd89d8
Instruction Fuzzy Hash: 1FA15C71114225FAD728BB2A7C89DBF2BACEB46358B14711AF44DF62A2DF149C00D372

Function 00E64EB5 Relevance: 4.7, APIs: 3, Instructions: 155networkfileCOMMON

Download Yara Rule

APIs

InternetQueryDataAvailable.WININET(?,?,00000000,00000000,00000000,?,?,?,?,?,?,?,?,00E643BF,00000000), ref: 00E64FA6
InternetReadFile.WININET(00000001,00000000,00000001,00000001), ref: 00E64FD2

Memory Dump Source

Source File: 00000000.00000002.1262750966.0000000000E11000.00000020.00000001.01000000.00000003.sdmp, Offset: 00E10000, based on PE: true

Associated: 00000000.00000002.1262729095.0000000000E10000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1262808979.0000000000E9D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1262808979.0000000000EBE000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1262857687.0000000000ECA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1262878803.0000000000ED4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1262878803.0000000000F07000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_e10000_18112024_Dokman_1 Kas_m 2024- Avans_T24-2112184_dekont.jbxd

Similarity

API ID: Internet$AvailableDataFileQueryRead
String ID:
API String ID: 599397726-0
Opcode ID: 931cd5016d5d67d9b900785978620cd88c3abe34227bf6a9a93f79bda42b6fa3
Instruction ID: cefcb64cd9128791a8e8859586e7508a41be68260d33371891fdfc12a628084a
Opcode Fuzzy Hash: 931cd5016d5d67d9b900785978620cd88c3abe34227bf6a9a93f79bda42b6fa3
Instruction Fuzzy Hash: 4241C9B2684709BFEB209E94EC85EBF77FCEB40798F10602EF605B6181D6719E41D690

Function 00E177B0 Relevance: 4.6, APIs: 1, Strings: 1, Instructions: 1076COMMON

Download Yara Rule

APIs

_memmove.LIBCMT ref: 00E17921

Strings

\Q, xrefs: 00E91028

Memory Dump Source

Source File: 00000000.00000002.1262750966.0000000000E11000.00000020.00000001.01000000.00000003.sdmp, Offset: 00E10000, based on PE: true

Associated: 00000000.00000002.1262729095.0000000000E10000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1262808979.0000000000E9D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1262808979.0000000000EBE000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1262857687.0000000000ECA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1262878803.0000000000ED4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1262878803.0000000000F07000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_e10000_18112024_Dokman_1 Kas_m 2024- Avans_T24-2112184_dekont.jbxd

Similarity

API ID: _memmove
String ID: \Q
API String ID: 4104443479-1011046347
Opcode ID: 348af3bc6db0e820d0d709de0b36eaf6ffd51be6f0ec89c52c64e948a66cc7b9
Instruction ID: 0a67a643cff659b764da4236b02862170a920d814241cd6df5e872a1d455f286
Opcode Fuzzy Hash: 348af3bc6db0e820d0d709de0b36eaf6ffd51be6f0ec89c52c64e948a66cc7b9
Instruction Fuzzy Hash: CDA23871A04219DFDF24CF58C4806EDBBB1BF48714F2591AAE899BB390D7309E81DB90

Function 00E5E1FD Relevance: 4.6, APIs: 3, Instructions: 72COMMON

Download Yara Rule

APIs

SetErrorMode.KERNEL32(00000001), ref: 00E5E20D
GetDiskFreeSpaceExW.KERNEL32(?,?,?,?), ref: 00E5E267
SetErrorMode.KERNEL32(00000000,00000001,00000000), ref: 00E5E2B4

Memory Dump Source

Source File: 00000000.00000002.1262750966.0000000000E11000.00000020.00000001.01000000.00000003.sdmp, Offset: 00E10000, based on PE: true

Associated: 00000000.00000002.1262729095.0000000000E10000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1262808979.0000000000E9D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1262808979.0000000000EBE000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1262857687.0000000000ECA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1262878803.0000000000ED4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1262878803.0000000000F07000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_e10000_18112024_Dokman_1 Kas_m 2024- Avans_T24-2112184_dekont.jbxd

Similarity

API ID: ErrorMode$DiskFreeSpace
String ID:
API String ID: 1682464887-0
Opcode ID: 3e57af1ddb62ba335a5d5c0745ca2fa0b3f970d72bf2e4fa2911c2dcec9fac0f
Instruction ID: 29ab048dbb85b750e3c141abe07e286250a8f2ebd07ceacef65cad04750b131e
Opcode Fuzzy Hash: 3e57af1ddb62ba335a5d5c0745ca2fa0b3f970d72bf2e4fa2911c2dcec9fac0f
Instruction Fuzzy Hash: 3B212A35A00218EFCB00EFA5D885AEDBBF8FF48314F1484AAE905E7255DB319949CB54

Function 00E4B134 Relevance: 4.6, APIs: 3, Instructions: 67COMMON

Download Yara Rule

APIs

Part of subcall function 00E2F4EA: std::exception::exception.LIBCMT ref: 00E2F51E
Part of subcall function 00E2F4EA: __CxxThrowException@8.LIBCMT ref: 00E2F533

LookupPrivilegeValueW.ADVAPI32(00000000,00000000,00000004), ref: 00E4B180
AdjustTokenPrivileges.ADVAPI32(?,00000000,00000000,?,00000000,?), ref: 00E4B1AD
GetLastError.KERNEL32 ref: 00E4B1BA

Memory Dump Source

Source File: 00000000.00000002.1262750966.0000000000E11000.00000020.00000001.01000000.00000003.sdmp, Offset: 00E10000, based on PE: true

Associated: 00000000.00000002.1262729095.0000000000E10000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1262808979.0000000000E9D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1262808979.0000000000EBE000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1262857687.0000000000ECA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1262878803.0000000000ED4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1262878803.0000000000F07000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_e10000_18112024_Dokman_1 Kas_m 2024- Avans_T24-2112184_dekont.jbxd

Similarity

API ID: AdjustErrorException@8LastLookupPrivilegePrivilegesThrowTokenValuestd::exception::exception
String ID:
API String ID: 1922334811-0
Opcode ID: 4eaf8807132ceb27d373cf89f39e2c6715b23b0cfe54531fdcd8403bb525f06f
Instruction ID: e5ffbfc28962b5c671f16df6c698618157241a9a5b6c02155280326e148862ea
Opcode Fuzzy Hash: 4eaf8807132ceb27d373cf89f39e2c6715b23b0cfe54531fdcd8403bb525f06f
Instruction Fuzzy Hash: 63119EB2504205AFE718AF64ECD6D6BB7FDFB44710B20852EE456A7240EB70FC458A60

Function 00E56685 Relevance: 4.6, APIs: 3, Instructions: 61fileCOMMON

Download Yara Rule

APIs

CreateFileW.KERNEL32(?,00000080,00000003,00000000,00000003,00000080,00000000), ref: 00E566AF
DeviceIoControl.KERNEL32(00000000,002D1400,?,0000000C,?,0000000C,?,00000000), ref: 00E566EC
CloseHandle.KERNEL32(00000000,?,?,00000080,00000003,00000000,00000003,00000080,00000000), ref: 00E566F5

Memory Dump Source

Source File: 00000000.00000002.1262750966.0000000000E11000.00000020.00000001.01000000.00000003.sdmp, Offset: 00E10000, based on PE: true

Associated: 00000000.00000002.1262729095.0000000000E10000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1262808979.0000000000E9D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1262808979.0000000000EBE000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1262857687.0000000000ECA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1262878803.0000000000ED4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1262878803.0000000000F07000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_e10000_18112024_Dokman_1 Kas_m 2024- Avans_T24-2112184_dekont.jbxd

Similarity

API ID: CloseControlCreateDeviceFileHandle
String ID:
API String ID: 33631002-0
Opcode ID: eb0046a1ddc994bc15cf6aa249b3fe28ac0c87fde65d7321ba8df70262ef675a
Instruction ID: 6c3a813f169a7b1f7ef8ed9a06594ecb16d32a49be76735bea5da7526ef1f77c
Opcode Fuzzy Hash: eb0046a1ddc994bc15cf6aa249b3fe28ac0c87fde65d7321ba8df70262ef675a
Instruction Fuzzy Hash: 381182B1901228BFE7108BA9DC45FAFBBACEB08718F004557FD01F7190D2B49A088BA5

Function 00E571FA Relevance: 4.5, APIs: 3, Instructions: 42memoryCOMMON

Download Yara Rule

APIs

AllocateAndInitializeSid.ADVAPI32(?,00000002,00000020,00000220,00000000,00000000,00000000,00000000,00000000,00000000,?,?), ref: 00E57223
CheckTokenMembership.ADVAPI32(00000000,?,?), ref: 00E5723A
FreeSid.ADVAPI32(?), ref: 00E5724A

Memory Dump Source

Source File: 00000000.00000002.1262750966.0000000000E11000.00000020.00000001.01000000.00000003.sdmp, Offset: 00E10000, based on PE: true

Associated: 00000000.00000002.1262729095.0000000000E10000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1262808979.0000000000E9D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1262808979.0000000000EBE000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1262857687.0000000000ECA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1262878803.0000000000ED4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1262878803.0000000000F07000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_e10000_18112024_Dokman_1 Kas_m 2024- Avans_T24-2112184_dekont.jbxd

Similarity

API ID: AllocateCheckFreeInitializeMembershipToken
String ID:
API String ID: 3429775523-0
Opcode ID: b4a9add4dbd381013bb0d9cbab0abde5d93f4791cdabd4bd1e9092a62b8d40ae
Instruction ID: fd7054b9109a582a220db20999141e4ac63979b751b806c4fd3eae16f0f6e252
Opcode Fuzzy Hash: b4a9add4dbd381013bb0d9cbab0abde5d93f4791cdabd4bd1e9092a62b8d40ae
Instruction Fuzzy Hash: DDF06275904218BFDF00DFE4DC89AEDBBB9EF08205F40446AA502E3191E23056049B10

Function 00E5F56F Relevance: 3.1, APIs: 2, Instructions: 52fileCOMMON

Download Yara Rule

APIs

FindFirstFileW.KERNEL32(?,?), ref: 00E5F599
FindClose.KERNEL32(00000000), ref: 00E5F5C9

Memory Dump Source

Source File: 00000000.00000002.1262750966.0000000000E11000.00000020.00000001.01000000.00000003.sdmp, Offset: 00E10000, based on PE: true

Associated: 00000000.00000002.1262729095.0000000000E10000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1262808979.0000000000E9D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1262808979.0000000000EBE000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1262857687.0000000000ECA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1262878803.0000000000ED4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1262878803.0000000000F07000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_e10000_18112024_Dokman_1 Kas_m 2024- Avans_T24-2112184_dekont.jbxd

Similarity

API ID: Find$CloseFileFirst
String ID:
API String ID: 2295610775-0
Opcode ID: c70c3a83fc2b5a702cf8a139fc19f4ffbe133136e9817a11cca3605885d8fb7a
Instruction ID: 44b9ca6db8f4fd4a100d5e3b47cf9d14197b454e79aeab3419cd7ff57966408c
Opcode Fuzzy Hash: c70c3a83fc2b5a702cf8a139fc19f4ffbe133136e9817a11cca3605885d8fb7a
Instruction Fuzzy Hash: DF11C0326042109FD710EF29D845A2EF3E8FF84325F008A1EF9A9E7291DB30AD048B81

Function 00E5CE7A Relevance: 3.0, APIs: 2, Instructions: 30windowCOMMON

Download Yara Rule

APIs

GetLastError.KERNEL32(00000000,?,00000FFF,00000000,00000016,?,00E6BE6A,?,?,00000000,?), ref: 00E5CEA7
FormatMessageW.KERNEL32(00001000,00000000,000000FF,00000000,?,00000FFF,00000000,00000016,?,00E6BE6A,?,?,00000000,?), ref: 00E5CEB9

Memory Dump Source

Source File: 00000000.00000002.1262750966.0000000000E11000.00000020.00000001.01000000.00000003.sdmp, Offset: 00E10000, based on PE: true

Associated: 00000000.00000002.1262729095.0000000000E10000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1262808979.0000000000E9D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1262808979.0000000000EBE000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1262857687.0000000000ECA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1262878803.0000000000ED4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1262878803.0000000000F07000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_e10000_18112024_Dokman_1 Kas_m 2024- Avans_T24-2112184_dekont.jbxd

Similarity

API ID: ErrorFormatLastMessage
String ID:
API String ID: 3479602957-0
Opcode ID: 111d64acac93fab11b08faae48e1118b18e14bd19351f772c62ad81e32830671
Instruction ID: be634c444c0add02b171e883ce5cd20b71b228a52ee2ee2454520f3439f9b5f9
Opcode Fuzzy Hash: 111d64acac93fab11b08faae48e1118b18e14bd19351f772c62ad81e32830671
Instruction Fuzzy Hash: 30F08231504329FFDB109BA4DC49FFA776DBF08365F004566F919E6191DA309A44CBA1

Function 00E5411C Relevance: 3.0, APIs: 2, Instructions: 29keyboardCOMMON

Download Yara Rule

APIs

SendInput.USER32(00000001,?,0000001C,?,?,00000002), ref: 00E54153
keybd_event.USER32(?,75A4C0D0,?,00000000), ref: 00E54166

Memory Dump Source

Source File: 00000000.00000002.1262750966.0000000000E11000.00000020.00000001.01000000.00000003.sdmp, Offset: 00E10000, based on PE: true

Associated: 00000000.00000002.1262729095.0000000000E10000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1262808979.0000000000E9D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1262808979.0000000000EBE000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1262857687.0000000000ECA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1262878803.0000000000ED4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1262878803.0000000000F07000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_e10000_18112024_Dokman_1 Kas_m 2024- Avans_T24-2112184_dekont.jbxd

Similarity

API ID: InputSendkeybd_event
String ID:
API String ID: 3536248340-0
Opcode ID: 32f2b1d97bb6495a703e1da7daf21d516151c20e846a5fa0ec22249cc2e6530e
Instruction ID: 270e4f98cc2ec0981c445a044b3dfef07c0ae175dc887591af2e2aa9038f07fe
Opcode Fuzzy Hash: 32f2b1d97bb6495a703e1da7daf21d516151c20e846a5fa0ec22249cc2e6530e
Instruction Fuzzy Hash: 66F06D7080434DAFDB058FA1CD05BFE7BB0EF00309F00840AF965A6192D7798656DFA0

Function 00E4AB84 Relevance: 3.0, APIs: 2, Instructions: 22COMMON

Download Yara Rule

APIs

AdjustTokenPrivileges.ADVAPI32(?,00000000,?,00000000,00000000,00000000,?,00E4ACC0), ref: 00E4AB99
CloseHandle.KERNEL32(?,?,00E4ACC0), ref: 00E4ABAB

Memory Dump Source

Source File: 00000000.00000002.1262750966.0000000000E11000.00000020.00000001.01000000.00000003.sdmp, Offset: 00E10000, based on PE: true

Associated: 00000000.00000002.1262729095.0000000000E10000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1262808979.0000000000E9D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1262808979.0000000000EBE000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1262857687.0000000000ECA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1262878803.0000000000ED4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1262878803.0000000000F07000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_e10000_18112024_Dokman_1 Kas_m 2024- Avans_T24-2112184_dekont.jbxd

Similarity

API ID: AdjustCloseHandlePrivilegesToken
String ID:
API String ID: 81990902-0
Opcode ID: 0cc3cd9a8d1838050295901ac3c4af9f511ba6164c03c83bb6822608e34ba070
Instruction ID: 3b1a7017c4b2b2842a2c9be1827e7be2ac7fb9afd68f210c8156073d88a829e6
Opcode Fuzzy Hash: 0cc3cd9a8d1838050295901ac3c4af9f511ba6164c03c83bb6822608e34ba070
Instruction Fuzzy Hash: 1CE0E671004520AFE7252F65FC09D77B7F9EF04321710843AF89991470D7625C94DB50

Function 00E381AC Relevance: 3.0, APIs: 2, Instructions: 8COMMONLIBRARYCODE

Download Yara Rule

APIs

SetUnhandledExceptionFilter.KERNEL32(00000000,0000000E,00E36DB3,-0000031A,?,?,00000001), ref: 00E381B1
UnhandledExceptionFilter.KERNEL32(?,?,?,00000001), ref: 00E381BA

Memory Dump Source

Source File: 00000000.00000002.1262750966.0000000000E11000.00000020.00000001.01000000.00000003.sdmp, Offset: 00E10000, based on PE: true

Associated: 00000000.00000002.1262729095.0000000000E10000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1262808979.0000000000E9D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1262808979.0000000000EBE000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1262857687.0000000000ECA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1262878803.0000000000ED4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1262878803.0000000000F07000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_e10000_18112024_Dokman_1 Kas_m 2024- Avans_T24-2112184_dekont.jbxd

Similarity

API ID: ExceptionFilterUnhandled
String ID:
API String ID: 3192549508-0
Opcode ID: 8ee5ecba375cdd3c297a637eb35d18d597fcb40780244d9260eeb363cfc98f7d
Instruction ID: fb68344f986e37b6096f180e4068b545d16ed2b3585611f56f9ecb95f95a3616
Opcode Fuzzy Hash: 8ee5ecba375cdd3c297a637eb35d18d597fcb40780244d9260eeb363cfc98f7d
Instruction Fuzzy Hash: 65B09231048618BFDB006BA2EC09B987F68EB08663F004013F60D540618B7254248A92

Function 00E3D1B9 Relevance: 2.1, APIs: 1, Instructions: 645COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1262750966.0000000000E11000.00000020.00000001.01000000.00000003.sdmp, Offset: 00E10000, based on PE: true

Associated: 00000000.00000002.1262729095.0000000000E10000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1262808979.0000000000E9D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1262808979.0000000000EBE000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1262857687.0000000000ECA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1262878803.0000000000ED4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1262878803.0000000000F07000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_e10000_18112024_Dokman_1 Kas_m 2024- Avans_T24-2112184_dekont.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: aaf9ee9d6afbbaac9b97ba54e8820d1c68d7eed8c789067911408306ccc95ff9
Instruction ID: dec9813d05486e77d3746b25e4aae59cae6fabc554be6d8d7f10e2da99c17298
Opcode Fuzzy Hash: aaf9ee9d6afbbaac9b97ba54e8820d1c68d7eed8c789067911408306ccc95ff9
Instruction Fuzzy Hash: 64323522D29F414DD7239639DC26335A688EFB73C4F15E727F819B5EA6EB28D4838100

Function 00E196C0 Relevance: 2.1, APIs: 1, Instructions: 573COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1262750966.0000000000E11000.00000020.00000001.01000000.00000003.sdmp, Offset: 00E10000, based on PE: true

Associated: 00000000.00000002.1262729095.0000000000E10000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1262808979.0000000000E9D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1262808979.0000000000EBE000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1262857687.0000000000ECA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1262878803.0000000000ED4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1262878803.0000000000F07000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_e10000_18112024_Dokman_1 Kas_m 2024- Avans_T24-2112184_dekont.jbxd

Similarity

API ID: __itow__swprintf
String ID:
API String ID: 674341424-0
Opcode ID: 283dc952fd86a2366627edaf600dbc6d66f71cb6a10759a1f7a75834fbd14c9c
Instruction ID: 1816a5ec900df64b6e24fe1c8f5c55fbc6bd1c0ddc2047bc5d9f12fb76a5cb05
Opcode Fuzzy Hash: 283dc952fd86a2366627edaf600dbc6d66f71cb6a10759a1f7a75834fbd14c9c
Instruction Fuzzy Hash: 0922AE715083009FD724DF24C8A1BAFB7E4BF85314F10691DF99AA7292DB71E984CB92

Function 00E4038E Relevance: 1.8, APIs: 1, Instructions: 294COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1262750966.0000000000E11000.00000020.00000001.01000000.00000003.sdmp, Offset: 00E10000, based on PE: true

Associated: 00000000.00000002.1262729095.0000000000E10000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1262808979.0000000000E9D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1262808979.0000000000EBE000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1262857687.0000000000ECA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1262878803.0000000000ED4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1262878803.0000000000F07000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_e10000_18112024_Dokman_1 Kas_m 2024- Avans_T24-2112184_dekont.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 872b497b00e62d5c7eef59f367587ae7de6189c38b80b9b73619c86b4720c7e6
Instruction ID: 7d6121c713de5cba9b6268969a9344f12dd1b6447e421539c70eca6ef1e6a1fe
Opcode Fuzzy Hash: 872b497b00e62d5c7eef59f367587ae7de6189c38b80b9b73619c86b4720c7e6
Instruction Fuzzy Hash: 12B11321D2AF404DD323963A9871336B65CAFBB2D5F92D71BFC2A70D22EB2195874180

Function 00E5B6CC Relevance: 1.6, APIs: 1, Instructions: 71COMMON

Download Yara Rule

APIs

__time64.LIBCMT ref: 00E5B6DF

Part of subcall function 00E3344A: GetSystemTimeAsFileTime.KERNEL32(00000000,?,?,?,00E5BDC3,00000000,?,?,?,?,00E5BF70,00000000,?), ref: 00E33453
Part of subcall function 00E3344A: __aulldiv.LIBCMT ref: 00E33473

Memory Dump Source

Source File: 00000000.00000002.1262750966.0000000000E11000.00000020.00000001.01000000.00000003.sdmp, Offset: 00E10000, based on PE: true

Associated: 00000000.00000002.1262729095.0000000000E10000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1262808979.0000000000E9D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1262808979.0000000000EBE000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1262857687.0000000000ECA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1262878803.0000000000ED4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1262878803.0000000000F07000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_e10000_18112024_Dokman_1 Kas_m 2024- Avans_T24-2112184_dekont.jbxd

Similarity

API ID: Time$FileSystem__aulldiv__time64
String ID:
API String ID: 2893107130-0
Opcode ID: e0ff295e1f6027c4337c27d57eb62b74d2524ca646c5f1cfcc4171d563c7d2f8
Instruction ID: cc94121cce091c3e42fd0a5421614f0178f2bff477b96ffe2e4542d8f1abc855
Opcode Fuzzy Hash: e0ff295e1f6027c4337c27d57eb62b74d2524ca646c5f1cfcc4171d563c7d2f8
Instruction Fuzzy Hash: CA21C072630510CFC729CF39C481A52B7E1EB95311B248E7DE4E5DB2C0CB74A909CB54

Function 00E66AAF Relevance: 1.5, APIs: 1, Instructions: 25keyboardCOMMON

Download Yara Rule

APIs

BlockInput.USER32(00000001), ref: 00E66ACA

Memory Dump Source

Source File: 00000000.00000002.1262750966.0000000000E11000.00000020.00000001.01000000.00000003.sdmp, Offset: 00E10000, based on PE: true

Associated: 00000000.00000002.1262729095.0000000000E10000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1262808979.0000000000E9D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1262808979.0000000000EBE000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1262857687.0000000000ECA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1262878803.0000000000ED4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1262878803.0000000000F07000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_e10000_18112024_Dokman_1 Kas_m 2024- Avans_T24-2112184_dekont.jbxd

Similarity

API ID: BlockInput
String ID:
API String ID: 3456056419-0
Opcode ID: 4818f0b9b90b4821d118dd3a634ea87f93cf7efac210df55be5d855fad5209d7
Instruction ID: 59e336daf832956c5417fe9aae0901a328f3e129b6e323de9326898cb46995c2
Opcode Fuzzy Hash: 4818f0b9b90b4821d118dd3a634ea87f93cf7efac210df55be5d855fad5209d7
Instruction Fuzzy Hash: 95E048362542146FC700EFA9E805D96F7EDAFB4751F04D417FA45E7251DAB0F8448B90

Function 00E574E7 Relevance: 1.5, APIs: 1, Instructions: 24COMMON

Download Yara Rule

APIs

mouse_event.USER32(00000004,00000000,00000000,00000000,00000000), ref: 00E5750A

Memory Dump Source

Source File: 00000000.00000002.1262750966.0000000000E11000.00000020.00000001.01000000.00000003.sdmp, Offset: 00E10000, based on PE: true

Associated: 00000000.00000002.1262729095.0000000000E10000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1262808979.0000000000E9D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1262808979.0000000000EBE000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1262857687.0000000000ECA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1262878803.0000000000ED4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1262878803.0000000000F07000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_e10000_18112024_Dokman_1 Kas_m 2024- Avans_T24-2112184_dekont.jbxd

Similarity

API ID: mouse_event
String ID:
API String ID: 2434400541-0
Opcode ID: eaa3def02e8b0e21a6aa6db307ecfbc3bf51abdbf183cdd7e6e8fa3f71015036
Instruction ID: 13d3690db1d1bedf228f771365018f2be3140e5f51598512d10acbc6a7a54c76
Opcode Fuzzy Hash: eaa3def02e8b0e21a6aa6db307ecfbc3bf51abdbf183cdd7e6e8fa3f71015036
Instruction Fuzzy Hash: 1DD067A416C60569E9190724BC1BFB61608A300787FD4694A7A92B91C0B8946D69E031

Function 00E4B106 Relevance: 1.5, APIs: 1, Instructions: 18COMMON

Download Yara Rule

APIs

LogonUserW.ADVAPI32(?,00000001,?,?,00000000,00E4AD3E), ref: 00E4B124

Memory Dump Source

Source File: 00000000.00000002.1262750966.0000000000E11000.00000020.00000001.01000000.00000003.sdmp, Offset: 00E10000, based on PE: true

Associated: 00000000.00000002.1262729095.0000000000E10000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1262808979.0000000000E9D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1262808979.0000000000EBE000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1262857687.0000000000ECA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1262878803.0000000000ED4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1262878803.0000000000F07000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_e10000_18112024_Dokman_1 Kas_m 2024- Avans_T24-2112184_dekont.jbxd

Similarity

API ID: LogonUser
String ID:
API String ID: 1244722697-0
Opcode ID: 344917d821848f269afa456a123cf1aabb2b8b04c800d3b762d5291c8879ed5b
Instruction ID: 505bfa246f20e856e0031de46fdd0e3d8009ae5e646670c15e7f45352047cbbd
Opcode Fuzzy Hash: 344917d821848f269afa456a123cf1aabb2b8b04c800d3b762d5291c8879ed5b
Instruction Fuzzy Hash: 1DD05E320A460EAEDF024FA4DC02EAE3F6AEB04700F408111FA11D50A0C671D531AB50

Function 00E8B340 Relevance: 1.5, APIs: 1, Instructions: 7COMMON

Download Yara Rule

APIs

GetUserNameW.ADVAPI32 ref: 00E8B352

Memory Dump Source

Source File: 00000000.00000002.1262750966.0000000000E11000.00000020.00000001.01000000.00000003.sdmp, Offset: 00E10000, based on PE: true

Associated: 00000000.00000002.1262729095.0000000000E10000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1262808979.0000000000E9D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1262808979.0000000000EBE000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1262857687.0000000000ECA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1262878803.0000000000ED4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1262878803.0000000000F07000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_e10000_18112024_Dokman_1 Kas_m 2024- Avans_T24-2112184_dekont.jbxd

Similarity

API ID: NameUser
String ID:
API String ID: 2645101109-0
Opcode ID: f8d21b81c9c3131215f273b245cce593c6a09e1a648edaa39b0c71f0823f6206
Instruction ID: fbc0f1426bf861e4ddbe3c66a97afb45be7446096aae4921f104bda5cb2df0fa
Opcode Fuzzy Hash: f8d21b81c9c3131215f273b245cce593c6a09e1a648edaa39b0c71f0823f6206
Instruction Fuzzy Hash: C2C04CB1404119DFD751DBC0CD849EEB7BCAB04301F1450939109F1110D7709B459B72

Function 00E38189 Relevance: 1.5, APIs: 1, Instructions: 6COMMON

Download Yara Rule

APIs

SetUnhandledExceptionFilter.KERNEL32(?), ref: 00E3818F

Memory Dump Source

Source File: 00000000.00000002.1262750966.0000000000E11000.00000020.00000001.01000000.00000003.sdmp, Offset: 00E10000, based on PE: true

Associated: 00000000.00000002.1262729095.0000000000E10000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1262808979.0000000000E9D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1262808979.0000000000EBE000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1262857687.0000000000ECA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1262878803.0000000000ED4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1262878803.0000000000F07000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_e10000_18112024_Dokman_1 Kas_m 2024- Avans_T24-2112184_dekont.jbxd

Similarity

API ID: ExceptionFilterUnhandled
String ID:
API String ID: 3192549508-0
Opcode ID: 74d48dc913982af244a961f14e0c72a0015385c76fe8bd2afb056cf7de5788d2
Instruction ID: 1f9de73f4734595a3479697bc977b5602257f676dd0d9231473788caf4449fa1
Opcode Fuzzy Hash: 74d48dc913982af244a961f14e0c72a0015385c76fe8bd2afb056cf7de5788d2
Instruction Fuzzy Hash: 98A0113000820CBB8F002B82EC088883F2CEB002A2B000022F80C000208B22A8208A82

Function 00E1E3B0 Relevance: .5, Instructions: 540COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1262750966.0000000000E11000.00000020.00000001.01000000.00000003.sdmp, Offset: 00E10000, based on PE: true

Associated: 00000000.00000002.1262729095.0000000000E10000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1262808979.0000000000E9D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1262808979.0000000000EBE000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1262857687.0000000000ECA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1262878803.0000000000ED4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1262878803.0000000000F07000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_e10000_18112024_Dokman_1 Kas_m 2024- Avans_T24-2112184_dekont.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 73217596036bef1a27ac676038f98cc7b0cc5bcf8c351690385cba29940a8ada
Instruction ID: 9848cd888d18aeea67877f7d2cb25f972626f6a436eaa4a35a0a7eb597151ca7
Opcode Fuzzy Hash: 73217596036bef1a27ac676038f98cc7b0cc5bcf8c351690385cba29940a8ada
Instruction Fuzzy Hash: 2322BE709042158FDB24DF54C490AEAB7F1FF18308F28906AED9ABB351E335AD81CB91

Function 00E193F0 Relevance: .5, Instructions: 531COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1262750966.0000000000E11000.00000020.00000001.01000000.00000003.sdmp, Offset: 00E10000, based on PE: true

Associated: 00000000.00000002.1262729095.0000000000E10000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1262808979.0000000000E9D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1262808979.0000000000EBE000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1262857687.0000000000ECA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1262878803.0000000000ED4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1262878803.0000000000F07000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_e10000_18112024_Dokman_1 Kas_m 2024- Avans_T24-2112184_dekont.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0bfad328dd4b1ddf2b8d07ff8fafbacf7526b45a944338ce084b877f5235d5db
Instruction ID: ff3dffee3c6437b815d327fc79c089d5ea2d9ad884bd551d2cb888664e773fd2
Opcode Fuzzy Hash: 0bfad328dd4b1ddf2b8d07ff8fafbacf7526b45a944338ce084b877f5235d5db
Instruction Fuzzy Hash: 1C128B70A002199FDF04DFA5D991AEEB7F5FF48300F106529E81AF7291EB36A951CB60

Function 00E1AF50 Relevance: .5, Instructions: 514COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1262750966.0000000000E11000.00000020.00000001.01000000.00000003.sdmp, Offset: 00E10000, based on PE: true

Associated: 00000000.00000002.1262729095.0000000000E10000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1262808979.0000000000E9D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1262808979.0000000000EBE000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1262857687.0000000000ECA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1262878803.0000000000ED4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1262878803.0000000000F07000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_e10000_18112024_Dokman_1 Kas_m 2024- Avans_T24-2112184_dekont.jbxd

Similarity

API ID: Exception@8Throwstd::exception::exception
String ID:
API String ID: 3728558374-0
Opcode ID: 809b14a7e570f89fca5e42e99d45e1a42a3ad287d60e0627e65088bc81c3430a
Instruction ID: c81b0dd187f08196bb7063ef3b45d9123fadbf2c7c7a33e174b772fb5e6a7a0a
Opcode Fuzzy Hash: 809b14a7e570f89fca5e42e99d45e1a42a3ad287d60e0627e65088bc81c3430a
Instruction Fuzzy Hash: 0E02A170A00109DFCF04EF68D991AAEBBF5EF48300F119469E90AFB255EB31DA55CB91

Function 00E302A4 Relevance: .3, Instructions: 345COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1262750966.0000000000E11000.00000020.00000001.01000000.00000003.sdmp, Offset: 00E10000, based on PE: true

Associated: 00000000.00000002.1262729095.0000000000E10000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1262808979.0000000000E9D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1262808979.0000000000EBE000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1262857687.0000000000ECA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1262878803.0000000000ED4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1262878803.0000000000F07000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_e10000_18112024_Dokman_1 Kas_m 2024- Avans_T24-2112184_dekont.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6bcf19402166b509fafb4c50a64371ef2a93877f8d810bfc08732e8a9195a1a8
Instruction ID: 75d07ab56ddff3ce4e00bbb2fc6ce287f74f25bdbf2547807c73cbc894ddb833
Opcode Fuzzy Hash: 6bcf19402166b509fafb4c50a64371ef2a93877f8d810bfc08732e8a9195a1a8
Instruction Fuzzy Hash: 1EC1C5322051A70ADF2E4A3A843943EBFB15E91BB971A277DD4B3DB4D5EF20C524D620

Function 00E306D9 Relevance: .3, Instructions: 341COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1262750966.0000000000E11000.00000020.00000001.01000000.00000003.sdmp, Offset: 00E10000, based on PE: true

Associated: 00000000.00000002.1262729095.0000000000E10000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1262808979.0000000000E9D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1262808979.0000000000EBE000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1262857687.0000000000ECA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1262878803.0000000000ED4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1262878803.0000000000F07000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_e10000_18112024_Dokman_1 Kas_m 2024- Avans_T24-2112184_dekont.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2d76c3bdd49f8e00aad6e71f29a941d673537f809e9b181fbd8d4251c6dfdf40
Instruction ID: ce801b3d7a8b6b1bdc162c04a9a8fd86bf2af90b33177b683e141a54b4ddcd56
Opcode Fuzzy Hash: 2d76c3bdd49f8e00aad6e71f29a941d673537f809e9b181fbd8d4251c6dfdf40
Instruction Fuzzy Hash: ABC1F5322051A709DF2E4639D43953EBFA15EA2BB970B237DD4B2EB4D5EF20C524D620

Function 00E2FA57 Relevance: .3, Instructions: 323COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1262750966.0000000000E11000.00000020.00000001.01000000.00000003.sdmp, Offset: 00E10000, based on PE: true

Associated: 00000000.00000002.1262729095.0000000000E10000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1262808979.0000000000E9D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1262808979.0000000000EBE000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1262857687.0000000000ECA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1262878803.0000000000ED4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1262878803.0000000000F07000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_e10000_18112024_Dokman_1 Kas_m 2024- Avans_T24-2112184_dekont.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b18fb967447e529c76739499a87999de3f08bdf72590393fa5476362680146d7
Instruction ID: 1601748e80ea174e7b57d2c907d2a1b6182677b7a77061c9b13a4b5ff4db7745
Opcode Fuzzy Hash: b18fb967447e529c76739499a87999de3f08bdf72590393fa5476362680146d7
Instruction Fuzzy Hash: B5C1B0322050A709DF2E4A39E43153EBBB15AA2BB931B277DD4B3DB5D5EF20C524D620

Function 01117418 Relevance: .1, Instructions: 92COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1263159453.0000000001113000.00000040.00000020.00020000.00000000.sdmp, Offset: 01113000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1113000_18112024_Dokman_1 Kas_m 2024- Avans_T24-2112184_dekont.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 424b499c86482d5e2cad33d2eb2b77d7085f14ac4781241b47b3debc7e1ef18c
Instruction ID: ab563c09e1328ed7dfd3982955f15674dab7e8500c1f75053408dbf9c29df506
Opcode Fuzzy Hash: 424b499c86482d5e2cad33d2eb2b77d7085f14ac4781241b47b3debc7e1ef18c
Instruction Fuzzy Hash: 4C41C271D1051CEBCF48CFADC991AAEFBF2AF88201F548299D516AB345D730AB41DB80

Function 01117308 Relevance: .0, Instructions: 35COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1263159453.0000000001113000.00000040.00000020.00020000.00000000.sdmp, Offset: 01113000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1113000_18112024_Dokman_1 Kas_m 2024- Avans_T24-2112184_dekont.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2824983519b781728331ca74e43d8f1b114060d413125894b627f2317d3cf6f3
Instruction ID: 403dfda6ec7594c1d9f6d84a2a16f6658a4275dab052ac59212af210ea159145
Opcode Fuzzy Hash: 2824983519b781728331ca74e43d8f1b114060d413125894b627f2317d3cf6f3
Instruction Fuzzy Hash: B3019278A14109EFCB48DF98C5919AEF7F5FB48310F2085A9EC09A7345D730AE41DB80

Function 011172A8 Relevance: .0, Instructions: 35COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1263159453.0000000001113000.00000040.00000020.00020000.00000000.sdmp, Offset: 01113000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1113000_18112024_Dokman_1 Kas_m 2024- Avans_T24-2112184_dekont.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6091d3ab8c142cd01bdaf95ad615aaddba634de501579065cef803e1d5150a63
Instruction ID: 967540c85063a691e246e3c70af581e47f7307088936c7c65f620226866f358d
Opcode Fuzzy Hash: 6091d3ab8c142cd01bdaf95ad615aaddba634de501579065cef803e1d5150a63
Instruction Fuzzy Hash: C2019278A04109EFCB49DF98C5909AEF7F5FB48310F2085A9EC09A7745D730AE42DB80

Function 01115C38 Relevance: .0, Instructions: 6COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1263159453.0000000001113000.00000040.00000020.00020000.00000000.sdmp, Offset: 01113000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1113000_18112024_Dokman_1 Kas_m 2024- Avans_T24-2112184_dekont.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e1f80ac41b4fc2d45690e214ca5193b9bf4f67450f61a2a701b7f1fb86cd8f4e
Instruction ID: 2052e7d0eb43af8a57a5c2d707c06396f1b84aee57587abda472ed480d51124b
Opcode Fuzzy Hash: e1f80ac41b4fc2d45690e214ca5193b9bf4f67450f61a2a701b7f1fb86cd8f4e
Instruction Fuzzy Hash: 1AB012310527488BC2118B89E008B1073ECA308E04F1000B0D40C07B01827874008D48

Function 00E6A2A9 Relevance: 77.5, APIs: 40, Strings: 4, Instructions: 490filecommemoryCOMMON

Download Yara Rule

APIs

DeleteObject.GDI32(00000000), ref: 00E6A2FE
DeleteObject.GDI32(00000000), ref: 00E6A310
DestroyWindow.USER32 ref: 00E6A31E
GetDesktopWindow.USER32 ref: 00E6A338
GetWindowRect.USER32(00000000), ref: 00E6A33F
SetRect.USER32(?,00000000,00000000,000001F4,00000190), ref: 00E6A480
AdjustWindowRectEx.USER32(?,88C00000,00000000,00000002), ref: 00E6A490
CreateWindowExW.USER32(00000002,AutoIt v3,?,88C00000,000000FF,000000FF,?,?,00000000,00000000,00000000), ref: 00E6A4D8
GetClientRect.USER32(00000000,?), ref: 00E6A4E4
CreateWindowExW.USER32(00000000,static,00000000,5000000E,00000000,00000000,?,?,00000000,00000000,00000000), ref: 00E6A51E
CreateFileW.KERNEL32(?,80000000,00000000,00000000,00000003,00000000,00000000,?,88C00000,000000FF,000000FF,?,?,00000000,00000000,00000000), ref: 00E6A540
GetFileSize.KERNEL32(00000000,00000000,?,88C00000,000000FF,000000FF,?,?,00000000,00000000,00000000), ref: 00E6A553
GlobalAlloc.KERNEL32(00000002,00000000,?,88C00000,000000FF,000000FF,?,?,00000000,00000000,00000000), ref: 00E6A55E
GlobalLock.KERNEL32(00000000), ref: 00E6A567
ReadFile.KERNEL32(00000000,00000000,00000000,00000190,00000000,?,88C00000,000000FF,000000FF,?,?,00000000,00000000,00000000), ref: 00E6A576
GlobalUnlock.KERNEL32(00000000), ref: 00E6A57F
CloseHandle.KERNEL32(00000000,?,88C00000,000000FF,000000FF,?,?,00000000,00000000,00000000), ref: 00E6A586
GlobalFree.KERNEL32(00000000), ref: 00E6A591
CreateStreamOnHGlobal.OLE32(00000000,00000001,88C00000,?,88C00000,000000FF,000000FF,?,?,00000000,00000000,00000000), ref: 00E6A5A3
OleLoadPicture.OLEAUT32(88C00000,00000000,00000000,00E9D9BC,00000000), ref: 00E6A5B9
GlobalFree.KERNEL32(00000000), ref: 00E6A5C9
CopyImage.USER32(000001F4,00000000,00000000,00000000,00002000), ref: 00E6A5EF
SendMessageW.USER32(?,00000172,00000000,000001F4), ref: 00E6A60E
SetWindowPos.USER32(?,00000000,00000000,00000000,?,?,00000020,?,88C00000,000000FF,000000FF,?,?,00000000,00000000,00000000), ref: 00E6A630
ShowWindow.USER32(00000004,?,88C00000,000000FF,000000FF,?,?,00000000,00000000,00000000), ref: 00E6A81D

Strings

static, xrefs: 00E6A518, 00E6A66F
, xrefs: 00E6A7A3
AutoIt v3, xrefs: 00E6A4D0
DISPLAY, xrefs: 00E6A680

Memory Dump Source

Source File: 00000000.00000002.1262750966.0000000000E11000.00000020.00000001.01000000.00000003.sdmp, Offset: 00E10000, based on PE: true

Associated: 00000000.00000002.1262729095.0000000000E10000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1262808979.0000000000E9D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1262808979.0000000000EBE000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1262857687.0000000000ECA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1262878803.0000000000ED4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1262878803.0000000000F07000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_e10000_18112024_Dokman_1 Kas_m 2024- Avans_T24-2112184_dekont.jbxd

Similarity

API ID: Window$Global$CreateRect$File$DeleteFreeObject$AdjustAllocClientCloseCopyDesktopDestroyHandleImageLoadLockMessagePictureReadSendShowSizeStreamUnlock
String ID: $AutoIt v3$DISPLAY$static
API String ID: 2211948467-2373415609
Opcode ID: 1af84effca7a7d416dfb4146ca44a291d66746c9d2389dc86db19c7071b74f38
Instruction ID: 80e7eef9c0c575f152ee5381636bba22f4f60ff7b144192b5e67acc37ad7c377
Opcode Fuzzy Hash: 1af84effca7a7d416dfb4146ca44a291d66746c9d2389dc86db19c7071b74f38
Instruction Fuzzy Hash: E102AB71900214EFCB14DFA5DD88EAE7BB9EB48350F04815AF915BB2A1CB30AD45CF60

Function 00E7D285 Relevance: 49.8, APIs: 33, Instructions: 260COMMON

Download Yara Rule

APIs

SetTextColor.GDI32(?,00000000), ref: 00E7D2DB
GetSysColorBrush.USER32(0000000F), ref: 00E7D30C
GetSysColor.USER32(0000000F), ref: 00E7D318
SetBkColor.GDI32(?,000000FF), ref: 00E7D332
SelectObject.GDI32(?,00000000), ref: 00E7D341
InflateRect.USER32(?,000000FF,000000FF), ref: 00E7D36C
GetSysColor.USER32(00000010), ref: 00E7D374
CreateSolidBrush.GDI32(00000000), ref: 00E7D37B
FrameRect.USER32(?,?,00000000), ref: 00E7D38A
DeleteObject.GDI32(00000000), ref: 00E7D391
InflateRect.USER32(?,000000FE,000000FE), ref: 00E7D3DC
FillRect.USER32(?,?,00000000), ref: 00E7D40E
GetWindowLongW.USER32(?,000000F0), ref: 00E7D439

Part of subcall function 00E7D575: GetSysColor.USER32(00000012), ref: 00E7D5AE
Part of subcall function 00E7D575: SetTextColor.GDI32(?,?), ref: 00E7D5B2
Part of subcall function 00E7D575: GetSysColorBrush.USER32(0000000F), ref: 00E7D5C8
Part of subcall function 00E7D575: GetSysColor.USER32(0000000F), ref: 00E7D5D3
Part of subcall function 00E7D575: GetSysColor.USER32(00000011), ref: 00E7D5F0
Part of subcall function 00E7D575: CreatePen.GDI32(00000000,00000001,00743C00), ref: 00E7D5FE
Part of subcall function 00E7D575: SelectObject.GDI32(?,00000000), ref: 00E7D60F
Part of subcall function 00E7D575: SetBkColor.GDI32(?,00000000), ref: 00E7D618
Part of subcall function 00E7D575: SelectObject.GDI32(?,?), ref: 00E7D625
Part of subcall function 00E7D575: InflateRect.USER32(?,000000FF,000000FF), ref: 00E7D644
Part of subcall function 00E7D575: RoundRect.GDI32(?,?,?,?,?,00000005,00000005), ref: 00E7D65B
Part of subcall function 00E7D575: GetWindowLongW.USER32(00000000,000000F0), ref: 00E7D670
Part of subcall function 00E7D575: SendMessageW.USER32(00000000,0000000E,00000000,00000000), ref: 00E7D698

Memory Dump Source

Source File: 00000000.00000002.1262750966.0000000000E11000.00000020.00000001.01000000.00000003.sdmp, Offset: 00E10000, based on PE: true

Associated: 00000000.00000002.1262729095.0000000000E10000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1262808979.0000000000E9D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1262808979.0000000000EBE000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1262857687.0000000000ECA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1262878803.0000000000ED4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1262878803.0000000000F07000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_e10000_18112024_Dokman_1 Kas_m 2024- Avans_T24-2112184_dekont.jbxd

Similarity

API ID: Color$Rect$Object$BrushInflateSelect$CreateLongTextWindow$DeleteFillFrameMessageRoundSendSolid
String ID:
API String ID: 3521893082-0
Opcode ID: c3bf9aff0a0c86f8a6784bf60702055657ebf0a7864a38d06b3a65d63a48b6ea
Instruction ID: 605306da13047f58e452d85e5644b62b0e1807430d8316b07eef58defd13d7bc
Opcode Fuzzy Hash: c3bf9aff0a0c86f8a6784bf60702055657ebf0a7864a38d06b3a65d63a48b6ea
Instruction Fuzzy Hash: B8919C7200D315FFCB109F65DC08A6BBBB9FF89325F105A1AF966A61A0D730D948CB52

Function 00E2B8FD Relevance: 49.5, APIs: 27, Strings: 1, Instructions: 491windowCOMMON

Download Yara Rule

APIs

DestroyWindow.USER32 ref: 00E2B98B
DeleteObject.GDI32(00000000), ref: 00E2B9CD
DeleteObject.GDI32(00000000), ref: 00E2B9D8
DestroyIcon.USER32(00000000), ref: 00E2B9E3
DestroyWindow.USER32(00000000), ref: 00E2B9EE
SendMessageW.USER32(?,00001308,?,00000000), ref: 00E8D2AA
ImageList_Remove.COMCTL32(?,000000FF,?), ref: 00E8D2E3
MoveWindow.USER32(00000000,?,?,?,?,00000000), ref: 00E8D711

Part of subcall function 00E2B9FF: InvalidateRect.USER32(?,00000000,00000001,?,?,?,00E2B759,?,00000000,?,?,?,?,00E2B72B,00000000,?), ref: 00E2BA58

SendMessageW.USER32 ref: 00E8D758
SendMessageW.USER32(?,00001008,000000FF,00000000), ref: 00E8D76F
ImageList_Destroy.COMCTL32(00000000), ref: 00E8D785
ImageList_Destroy.COMCTL32(00000000), ref: 00E8D790

Strings

0, xrefs: 00E8D5A5

Memory Dump Source

Source File: 00000000.00000002.1262750966.0000000000E11000.00000020.00000001.01000000.00000003.sdmp, Offset: 00E10000, based on PE: true

Associated: 00000000.00000002.1262729095.0000000000E10000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1262808979.0000000000E9D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1262808979.0000000000EBE000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1262857687.0000000000ECA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1262878803.0000000000ED4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1262878803.0000000000F07000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_e10000_18112024_Dokman_1 Kas_m 2024- Avans_T24-2112184_dekont.jbxd

Similarity

API ID: Destroy$ImageList_MessageSendWindow$DeleteObject$IconInvalidateMoveRectRemove
String ID: 0
API String ID: 464785882-4108050209
Opcode ID: 001639fd05e720a6c7ad1353b5cc732e342880f64567522f21cae2eff34c70cc
Instruction ID: 5f9bbd52e6a92c4a95b6cbed8816fb5432ee89195407e9804b3a76ed328e3c6f
Opcode Fuzzy Hash: 001639fd05e720a6c7ad1353b5cc732e342880f64567522f21cae2eff34c70cc
Instruction Fuzzy Hash: 1A127E30108211DFDB15EF14D884BA9B7E5FF45308F14656AEA9DEB2A2C731E885CB51

Function 00E5DBC4 Relevance: 45.7, APIs: 3, Strings: 23, Instructions: 187COMMON

Download Yara Rule

APIs

SetErrorMode.KERNEL32(00000001), ref: 00E5DBD6
GetDriveTypeW.KERNEL32(?,00EADC54,?,\\.\,00EADC00), ref: 00E5DCC3
SetErrorMode.KERNEL32(00000000,00EADC54,?,\\.\,00EADC00), ref: 00E5DE29

Strings

CDROM, xrefs: 00E5DCF7
\\.\, xrefs: 00E5DC2B
SAS, xrefs: 00E5DDD2
FileBackedVirtual, xrefs: 00E5DDF5
SATA, xrefs: 00E5DDD9
ATAPI, xrefs: 00E5DD9A
ATA, xrefs: 00E5DDA1
RAMDisk, xrefs: 00E5DCED
MMC, xrefs: 00E5DDE7
Virtual, xrefs: 00E5DDEE
RAID, xrefs: 00E5DDC4
1394, xrefs: 00E5DDA8
SSA, xrefs: 00E5DDAF
SCSI, xrefs: 00E5DD93
Fixed, xrefs: 00E5DD0B
iSCSI, xrefs: 00E5DDCB
Network, xrefs: 00E5DD01
SSD, xrefs: 00E5DD50
PhysicalDrive, xrefs: 00E5DC67
USB, xrefs: 00E5DDBD
Fibre, xrefs: 00E5DDB6
Removable, xrefs: 00E5DD15
Unknown, xrefs: 00E5DCE3, 00E5DD8C

Memory Dump Source

Source File: 00000000.00000002.1262750966.0000000000E11000.00000020.00000001.01000000.00000003.sdmp, Offset: 00E10000, based on PE: true

Associated: 00000000.00000002.1262729095.0000000000E10000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1262808979.0000000000E9D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1262808979.0000000000EBE000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1262857687.0000000000ECA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1262878803.0000000000ED4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1262878803.0000000000F07000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_e10000_18112024_Dokman_1 Kas_m 2024- Avans_T24-2112184_dekont.jbxd

Similarity

API ID: ErrorMode$DriveType
String ID: 1394$ATA$ATAPI$CDROM$Fibre$FileBackedVirtual$Fixed$MMC$Network$PhysicalDrive$RAID$RAMDisk$Removable$SAS$SATA$SCSI$SSA$SSD$USB$Unknown$Virtual$\\.\$iSCSI
API String ID: 2907320926-4222207086
Opcode ID: e0186429b9c3d2e56286e5734197b45613013b5c7ca6138a17b937b87f837ce5
Instruction ID: a9d23535583f92e1caee7e333db9237a7e68e2f4db7d4851c0158aaafef06547
Opcode Fuzzy Hash: e0186429b9c3d2e56286e5734197b45613013b5c7ca6138a17b937b87f837ce5
Instruction Fuzzy Hash: 0A51633064C3029BC620DB20CD42DA9B7F1FB9570AB20BE1EF817B7291DA61DD4AD742

Function 00E1CC24 Relevance: 44.0, APIs: 12, Strings: 13, Instructions: 267COMMON

Download Yara Rule

APIs

__wcsnicmp.LIBCMT ref: 00E1CC68
__wcsnicmp.LIBCMT ref: 00E1CC80
__wcsnicmp.LIBCMT ref: 00E1CC98
__wcsnicmp.LIBCMT ref: 00E1CCB0
__wcsnicmp.LIBCMT ref: 00E1CCC8
__wcsnicmp.LIBCMT ref: 00E1CCE0
__wcsnicmp.LIBCMT ref: 00E1CCF8
__wcsnicmp.LIBCMT ref: 00E1CD0C
__wcsnicmp.LIBCMT ref: 00E1CD4D
__wcsnicmp.LIBCMT ref: 00E1CD61
__wcsnicmp.LIBCMT ref: 00E1CD75
__wcsnicmp.LIBCMT ref: 00E1CD89

Strings

#cs, xrefs: 00E1CD06, 00E1CD5B
#requireadmin, xrefs: 00E1CC92
#pragma compile, xrefs: 00E1CC62
Cannot parse #include, xrefs: 00E82FA1
#comments-end, xrefs: 00E1CD6F
#include, xrefs: 00E1CCDA
#OnAutoItStartRegister, xrefs: 00E1CCAA
#comments-start, xrefs: 00E1CCF2, 00E1CD47
Unterminated group of comments, xrefs: 00E82FB4
#ce, xrefs: 00E1CD83
Bad directive syntax error, xrefs: 00E82ECB
#notrayicon, xrefs: 00E1CC7A
#include-once, xrefs: 00E1CCC2

Memory Dump Source

Source File: 00000000.00000002.1262750966.0000000000E11000.00000020.00000001.01000000.00000003.sdmp, Offset: 00E10000, based on PE: true

Associated: 00000000.00000002.1262729095.0000000000E10000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1262808979.0000000000E9D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1262808979.0000000000EBE000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1262857687.0000000000ECA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1262878803.0000000000ED4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1262878803.0000000000F07000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_e10000_18112024_Dokman_1 Kas_m 2024- Avans_T24-2112184_dekont.jbxd

Similarity

API ID: __wcsnicmp
String ID: #OnAutoItStartRegister$#ce$#comments-end$#comments-start$#cs$#include$#include-once$#notrayicon$#pragma compile$#requireadmin$Bad directive syntax error$Cannot parse #include$Unterminated group of comments
API String ID: 1038674560-86951937
Opcode ID: 942fe6a0f72e8e4199460965788a80c041c059005013404722c2f936bf961d7e
Instruction ID: c8f49211a42ba3351ae7069633b1f1ce16662ac2748e34787a056cd7e163c99a
Opcode Fuzzy Hash: 942fe6a0f72e8e4199460965788a80c041c059005013404722c2f936bf961d7e
Instruction Fuzzy Hash: F781FA706803156BCB15BA64DC46FEE7BB8AF15304F14702DFA0AFA1C2EB61D981C395

Function 00E7C6E9 Relevance: 42.4, APIs: 23, Strings: 1, Instructions: 447windowCOMMON

Download Yara Rule

APIs

SetWindowPos.USER32(?,00000000,00000000,00000000,00000000,00000000,00000013,?,?,?), ref: 00E7C788
SendMessageW.USER32(?,0000113F,00000000,00000008), ref: 00E7C83E
SendMessageW.USER32(?,00001102,00000002,?), ref: 00E7C859
SendMessageW.USER32(?,000000F1,?,00000000), ref: 00E7CB15

Strings

0, xrefs: 00E7C89C

Memory Dump Source

Source File: 00000000.00000002.1262750966.0000000000E11000.00000020.00000001.01000000.00000003.sdmp, Offset: 00E10000, based on PE: true

Associated: 00000000.00000002.1262729095.0000000000E10000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1262808979.0000000000E9D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1262808979.0000000000EBE000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1262857687.0000000000ECA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1262878803.0000000000ED4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1262878803.0000000000F07000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_e10000_18112024_Dokman_1 Kas_m 2024- Avans_T24-2112184_dekont.jbxd

Similarity

API ID: MessageSend$Window
String ID: 0
API String ID: 2326795674-4108050209
Opcode ID: 43da58543160b58a3e7c1657ac92e0754b23f3df3af32d8c17a735de9ba78911
Instruction ID: 0148d1778d816c4d5241f7352463a3c18ed4ee11bd03cdc7fe3dfd98788b0587
Opcode Fuzzy Hash: 43da58543160b58a3e7c1657ac92e0754b23f3df3af32d8c17a735de9ba78911
Instruction Fuzzy Hash: BCF1D571108311AFD7158F24CC45BAABBE8FF49318F24991EF59DB62A1C774D844CB92

Function 00E7638D Relevance: 42.4, APIs: 1, Strings: 23, Instructions: 352COMMON

Download Yara Rule

APIs

CharUpperBuffW.USER32(?,?,00EADC00), ref: 00E76449

Strings

UNCHECK, xrefs: 00E766A1
SETCURRENTSELECTION, xrefs: 00E765D6
TABLEFT, xrefs: 00E764A7
DELSTRING, xrefs: 00E76569
ISCHECKED, xrefs: 00E76659
ADDSTRING, xrefs: 00E76536
HIDEDROPDOWN, xrefs: 00E76520
ISVISIBLE, xrefs: 00E76455
SHOWDROPDOWN, xrefs: 00E76500
GETLINECOUNT, xrefs: 00E766E4
EDITPASTE, xrefs: 00E7675B
CHECK, xrefs: 00E7668B
CURRENTTAB, xrefs: 00E764DD
TABRIGHT, xrefs: 00E764BD
GETLINE, xrefs: 00E7678B
ISENABLED, xrefs: 00E7648C
GETCURRENTCOL, xrefs: 00E76724
SENDCOMMANDID, xrefs: 00E767CA
FINDSTRING, xrefs: 00E76596
GETCURRENTLINE, xrefs: 00E76704
GETSELECTED, xrefs: 00E766C1
GETCURRENTSELECTION, xrefs: 00E76603
SELECTSTRING, xrefs: 00E76626

Memory Dump Source

Source File: 00000000.00000002.1262750966.0000000000E11000.00000020.00000001.01000000.00000003.sdmp, Offset: 00E10000, based on PE: true

Associated: 00000000.00000002.1262729095.0000000000E10000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1262808979.0000000000E9D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1262808979.0000000000EBE000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1262857687.0000000000ECA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1262878803.0000000000ED4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1262878803.0000000000F07000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_e10000_18112024_Dokman_1 Kas_m 2024- Avans_T24-2112184_dekont.jbxd

Similarity

API ID: BuffCharUpper
String ID: ADDSTRING$CHECK$CURRENTTAB$DELSTRING$EDITPASTE$FINDSTRING$GETCURRENTCOL$GETCURRENTLINE$GETCURRENTSELECTION$GETLINE$GETLINECOUNT$GETSELECTED$HIDEDROPDOWN$ISCHECKED$ISENABLED$ISVISIBLE$SELECTSTRING$SENDCOMMANDID$SETCURRENTSELECTION$SHOWDROPDOWN$TABLEFT$TABRIGHT$UNCHECK
API String ID: 3964851224-45149045
Opcode ID: abd51ca049da403edec1a272770179de7450b95fc07a54d5537412cdd2128e9b
Instruction ID: 4516204a9f7dee71c9c8843ea892c35df2af3ecc793ee20bfdc20cc6618c355b
Opcode Fuzzy Hash: abd51ca049da403edec1a272770179de7450b95fc07a54d5537412cdd2128e9b
Instruction Fuzzy Hash: D6C195702046558BCB04EF50D552AAEB7E5AF94348F00A85DF85A7B3D2DB21ED4BCB42

Function 00E7D575 Relevance: 39.2, APIs: 26, Instructions: 186windowCOMMON

Download Yara Rule

APIs

GetSysColor.USER32(00000012), ref: 00E7D5AE
SetTextColor.GDI32(?,?), ref: 00E7D5B2
GetSysColorBrush.USER32(0000000F), ref: 00E7D5C8
GetSysColor.USER32(0000000F), ref: 00E7D5D3
CreateSolidBrush.GDI32(?), ref: 00E7D5D8
GetSysColor.USER32(00000011), ref: 00E7D5F0
CreatePen.GDI32(00000000,00000001,00743C00), ref: 00E7D5FE
SelectObject.GDI32(?,00000000), ref: 00E7D60F
SetBkColor.GDI32(?,00000000), ref: 00E7D618
SelectObject.GDI32(?,?), ref: 00E7D625
InflateRect.USER32(?,000000FF,000000FF), ref: 00E7D644
RoundRect.GDI32(?,?,?,?,?,00000005,00000005), ref: 00E7D65B
GetWindowLongW.USER32(00000000,000000F0), ref: 00E7D670
SendMessageW.USER32(00000000,0000000E,00000000,00000000), ref: 00E7D698
GetWindowTextW.USER32(00000000,00000000,00000001), ref: 00E7D6BF
InflateRect.USER32(?,000000FD,000000FD), ref: 00E7D6DD
DrawFocusRect.USER32(?,?), ref: 00E7D6E8
GetSysColor.USER32(00000011), ref: 00E7D6F6
SetTextColor.GDI32(?,00000000), ref: 00E7D6FE
DrawTextW.USER32(?,00000000,000000FF,?,?), ref: 00E7D712
SelectObject.GDI32(?,00E7D2A5), ref: 00E7D729
DeleteObject.GDI32(?), ref: 00E7D734
SelectObject.GDI32(?,?), ref: 00E7D73A
DeleteObject.GDI32(?), ref: 00E7D73F
SetTextColor.GDI32(?,?), ref: 00E7D745
SetBkColor.GDI32(?,?), ref: 00E7D74F

Memory Dump Source

Source File: 00000000.00000002.1262750966.0000000000E11000.00000020.00000001.01000000.00000003.sdmp, Offset: 00E10000, based on PE: true

Associated: 00000000.00000002.1262729095.0000000000E10000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1262808979.0000000000E9D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1262808979.0000000000EBE000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1262857687.0000000000ECA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1262878803.0000000000ED4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1262878803.0000000000F07000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_e10000_18112024_Dokman_1 Kas_m 2024- Avans_T24-2112184_dekont.jbxd

Similarity

API ID: Color$Object$Text$RectSelect$BrushCreateDeleteDrawInflateWindow$FocusLongMessageRoundSendSolid
String ID:
API String ID: 1996641542-0
Opcode ID: 8a017b38e2d650056cf356a91beefcf6a0a831a4666c6cc14c28b205fb95a11f
Instruction ID: 1a34b2e0c9874eb2480c5df171f9373cbdced58c644099e6c72913f631b94e11
Opcode Fuzzy Hash: 8a017b38e2d650056cf356a91beefcf6a0a831a4666c6cc14c28b205fb95a11f
Instruction Fuzzy Hash: 6D515972905218EFDF10AFA9DC48EAEBBB9EF08324F114116F915BB2A1D7719A40CB50

Function 00E7B6C4 Relevance: 38.9, APIs: 21, Strings: 1, Instructions: 400windowCOMMON

Download Yara Rule

APIs

SendMessageW.USER32(?,00000158,000000FF,0000014E), ref: 00E7B7B0
SendMessageW.USER32(?,0000014E,00000000,00000000), ref: 00E7B7C1
CharNextW.USER32(0000014E), ref: 00E7B7F0
SendMessageW.USER32(?,0000014B,00000000,00000000), ref: 00E7B831
SendMessageW.USER32(?,00000158,000000FF,00000158), ref: 00E7B847
SendMessageW.USER32(?,0000014E,00000000,00000000), ref: 00E7B858
SendMessageW.USER32(?,000000C2,00000001,0000014E), ref: 00E7B875
SetWindowTextW.USER32(?,0000014E), ref: 00E7B8C7
SendMessageW.USER32(?,000000B1,000F4240,000F423F), ref: 00E7B8DD
SendMessageW.USER32(?,00001002,00000000,?), ref: 00E7B90E
_memset.LIBCMT ref: 00E7B933
SendMessageW.USER32(00000000,00001060,00000001,00000004), ref: 00E7B97C
_memset.LIBCMT ref: 00E7B9DB
SendMessageW.USER32 ref: 00E7BA05
SendMessageW.USER32(?,00001074,?,00000001), ref: 00E7BA5D
SendMessageW.USER32(?,0000133D,?,?), ref: 00E7BB0A
InvalidateRect.USER32(?,00000000,00000001), ref: 00E7BB2C
GetMenuItemInfoW.USER32(?), ref: 00E7BB76
SetMenuItemInfoW.USER32(?,?,00000000,00000030), ref: 00E7BBA3
DrawMenuBar.USER32(?), ref: 00E7BBB2
SetWindowTextW.USER32(?,0000014E), ref: 00E7BBDA

Strings

0, xrefs: 00E7BB4F

Memory Dump Source

Source File: 00000000.00000002.1262750966.0000000000E11000.00000020.00000001.01000000.00000003.sdmp, Offset: 00E10000, based on PE: true

Associated: 00000000.00000002.1262729095.0000000000E10000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1262808979.0000000000E9D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1262808979.0000000000EBE000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1262857687.0000000000ECA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1262878803.0000000000ED4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1262878803.0000000000F07000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_e10000_18112024_Dokman_1 Kas_m 2024- Avans_T24-2112184_dekont.jbxd

Similarity

API ID: MessageSend$Menu$InfoItemTextWindow_memset$CharDrawInvalidateNextRect
String ID: 0
API String ID: 1073566785-4108050209
Opcode ID: 608ebb65aa803186b27da32f60876dfb272b55c6310c921369fa7d16b87a06b0
Instruction ID: ca68ef953351feeb6770b9c59620aa89f1ceb1364b96140f9ef4ead8f8cd8a89
Opcode Fuzzy Hash: 608ebb65aa803186b27da32f60876dfb272b55c6310c921369fa7d16b87a06b0
Instruction Fuzzy Hash: 27E16971900218AFDF209FA5DC84FEE7BB8EF05714F149156FA29BA291DB708A45CF60

Function 00E12EC0 Relevance: 37.1, APIs: 8, Strings: 13, Instructions: 346COMMON

Download Yara Rule

APIs

GetForegroundWindow.USER32 ref: 00E12F7A
IsWindow.USER32(?), ref: 00E822FD

Strings

L+, xrefs: 00E821B2
P+, xrefs: 00E821E0
ACTIVE, xrefs: 00E820CC
ALL, xrefs: 00E82264
H+, xrefs: 00E82184
LAST, xrefs: 00E820B6
INSTANCE, xrefs: 00E8223C
T+, xrefs: 00E8220E
REGEXPTITLE, xrefs: 00E820F8
HANDLE, xrefs: 00E820E2
TITLE, xrefs: 00E82292
CLASS, xrefs: 00E82128
REGEXPCLASS, xrefs: 00E82149

Memory Dump Source

Source File: 00000000.00000002.1262750966.0000000000E11000.00000020.00000001.01000000.00000003.sdmp, Offset: 00E10000, based on PE: true

Associated: 00000000.00000002.1262729095.0000000000E10000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1262808979.0000000000E9D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1262808979.0000000000EBE000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1262857687.0000000000ECA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1262878803.0000000000ED4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1262878803.0000000000F07000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_e10000_18112024_Dokman_1 Kas_m 2024- Avans_T24-2112184_dekont.jbxd

Similarity

API ID: Window$Foreground
String ID: ACTIVE$ALL$CLASS$H+$HANDLE$INSTANCE$L+$LAST$P+$REGEXPCLASS$REGEXPTITLE$T+$TITLE
API String ID: 62970417-993842312
Opcode ID: 94c64fb8bcf7f882a0d344b1b98991a8e7322cb977749ed4c5ea9d9db34c8d35
Instruction ID: 47f7bb735db763f2e186f88a5f9420a17e8bebd4575ff10a1855b670846dfde7
Opcode Fuzzy Hash: 94c64fb8bcf7f882a0d344b1b98991a8e7322cb977749ed4c5ea9d9db34c8d35
Instruction Fuzzy Hash: 14D1B6305086469BCB04EF60C981ADAFBF0BF94344F106A1DF55EB75A1DB30E99ACB91

Function 00E7764F Relevance: 37.0, APIs: 18, Strings: 3, Instructions: 290windowCOMMON

Download Yara Rule

APIs

GetCursorPos.USER32(?), ref: 00E7778A
GetDesktopWindow.USER32 ref: 00E7779F
GetWindowRect.USER32(00000000), ref: 00E777A6
GetWindowLongW.USER32(?,000000F0), ref: 00E77808
DestroyWindow.USER32(?), ref: 00E77834
CreateWindowExW.USER32(00000008,tooltips_class32,00000000,00000003,80000000,80000000,80000000,80000000,00000000,00000000,00000000,00000000), ref: 00E7785D
SendMessageW.USER32(00000000,00000432,00000000,00000030), ref: 00E7787B
SendMessageW.USER32(?,00000439,00000000,00000030), ref: 00E778A1
SendMessageW.USER32(?,00000421,?,?), ref: 00E778B6
SendMessageW.USER32(?,0000041D,00000000,00000000), ref: 00E778C9
IsWindowVisible.USER32(?), ref: 00E778E9
SendMessageW.USER32(?,00000412,00000000,D8F0D8F0), ref: 00E77904
SendMessageW.USER32(?,00000411,00000001,00000030), ref: 00E77918
GetWindowRect.USER32(?,?), ref: 00E77930
MonitorFromPoint.USER32(?,?,00000002), ref: 00E77956
GetMonitorInfoW.USER32 ref: 00E77970
CopyRect.USER32(?,?), ref: 00E77987
SendMessageW.USER32(?,00000412,00000000), ref: 00E779F2

Strings

0, xrefs: 00E77735
(, xrefs: 00E77965
tooltips_class32, xrefs: 00E77856

Memory Dump Source

Source File: 00000000.00000002.1262750966.0000000000E11000.00000020.00000001.01000000.00000003.sdmp, Offset: 00E10000, based on PE: true

Associated: 00000000.00000002.1262729095.0000000000E10000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1262808979.0000000000E9D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1262808979.0000000000EBE000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1262857687.0000000000ECA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1262878803.0000000000ED4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1262878803.0000000000F07000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_e10000_18112024_Dokman_1 Kas_m 2024- Avans_T24-2112184_dekont.jbxd

Similarity

API ID: MessageSendWindow$Rect$Monitor$CopyCreateCursorDesktopDestroyFromInfoLongPointVisible
String ID: ($0$tooltips_class32
API String ID: 698492251-4156429822
Opcode ID: 8acd6d6b6bebc232595cf1a05d17ed2c72d7bb59bed722dc554fa23a7f7523ce
Instruction ID: 763ce90f4646f553af1940fe8a1241d38dd40ad05e42d8342f3cad90a7bdb295
Opcode Fuzzy Hash: 8acd6d6b6bebc232595cf1a05d17ed2c72d7bb59bed722dc554fa23a7f7523ce
Instruction Fuzzy Hash: FEB19C71608310AFDB04DF65C948B6ABBE5FF88314F00991EF59DAB291DB70E845CB92

Function 00E56CE9 Relevance: 36.9, APIs: 16, Strings: 5, Instructions: 178COMMON

Download Yara Rule

APIs

GetFileVersionInfoSizeW.VERSION(?,?), ref: 00E56CFB
GetFileVersionInfoW.VERSION(?,00000000,00000000,00000000,?,?), ref: 00E56D21
_wcscpy.LIBCMT ref: 00E56D4F
_wcscmp.LIBCMT ref: 00E56D5A
_wcscat.LIBCMT ref: 00E56D70
_wcsstr.LIBCMT ref: 00E56D7B
VerQueryValueW.VERSION(?,\VarFileInfo\Translation,?,?,?,?,?,?,00000000,?,?), ref: 00E56D97
_wcscat.LIBCMT ref: 00E56DE0
_wcscat.LIBCMT ref: 00E56DE7
_wcsncpy.LIBCMT ref: 00E56E12

Strings

04090000, xrefs: 00E56DCD
%u.%u.%u.%u, xrefs: 00E56E75
DefaultLangCodepage, xrefs: 00E56DFA
\VarFileInfo\Translation, xrefs: 00E56D8F
StringFileInfo\, xrefs: 00E56D6A

Memory Dump Source

Source File: 00000000.00000002.1262750966.0000000000E11000.00000020.00000001.01000000.00000003.sdmp, Offset: 00E10000, based on PE: true

Associated: 00000000.00000002.1262729095.0000000000E10000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1262808979.0000000000E9D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1262808979.0000000000EBE000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1262857687.0000000000ECA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1262878803.0000000000ED4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1262878803.0000000000F07000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_e10000_18112024_Dokman_1 Kas_m 2024- Avans_T24-2112184_dekont.jbxd

Similarity

API ID: _wcscat$FileInfoVersion$QuerySizeValue_wcscmp_wcscpy_wcsncpy_wcsstr
String ID: %u.%u.%u.%u$04090000$DefaultLangCodepage$StringFileInfo\$\VarFileInfo\Translation
API String ID: 699586101-1459072770
Opcode ID: c61e718567ab78fef0676a110ffc9006e408e4e29fe570f06013e93012839497
Instruction ID: 1812a5e219570c17ca3c6ffbf1eee17661b4858d23c74f783361e7ffa41d609f
Opcode Fuzzy Hash: c61e718567ab78fef0676a110ffc9006e408e4e29fe570f06013e93012839497
Instruction Fuzzy Hash: D941F371644210BBEB00BB64CC4BEBF7BBCDF45314F44246AF901B6182EE75AA05D7A1

Function 00E2A856 Relevance: 33.5, APIs: 18, Strings: 1, Instructions: 285windowtimeCOMMON

Download Yara Rule

APIs

SystemParametersInfoW.USER32(00000030,00000000,000000FF,00000000), ref: 00E2A939
GetSystemMetrics.USER32(00000007), ref: 00E2A941
SystemParametersInfoW.USER32(00000030,00000000,000000FF,00000000), ref: 00E2A96C
GetSystemMetrics.USER32(00000008), ref: 00E2A974
GetSystemMetrics.USER32(00000004), ref: 00E2A999
SetRect.USER32(000000FF,00000000,00000000,000000FF,000000FF), ref: 00E2A9B6
AdjustWindowRectEx.USER32(000000FF,00000000,00000000,00000000), ref: 00E2A9C6
CreateWindowExW.USER32(00000000,AutoIt v3 GUI,?,00000000,?,000000FF,000000FF,000000FF,?,00000000,00000000), ref: 00E2A9F9
SetWindowLongW.USER32(00000000,000000EB,00000000), ref: 00E2AA0D
GetClientRect.USER32(00000000,000000FF), ref: 00E2AA2B
GetStockObject.GDI32(00000011), ref: 00E2AA47
SendMessageW.USER32(00000000,00000030,00000000), ref: 00E2AA52

Part of subcall function 00E2B63C: GetCursorPos.USER32(000000FF), ref: 00E2B64F
Part of subcall function 00E2B63C: ScreenToClient.USER32(00000000,000000FF), ref: 00E2B66C
Part of subcall function 00E2B63C: GetAsyncKeyState.USER32(00000001), ref: 00E2B691
Part of subcall function 00E2B63C: GetAsyncKeyState.USER32(00000002), ref: 00E2B69F

SetTimer.USER32(00000000,00000000,00000028,00E2AB87), ref: 00E2AA79

Strings

AutoIt v3 GUI, xrefs: 00E2A9F1

Memory Dump Source

Source File: 00000000.00000002.1262750966.0000000000E11000.00000020.00000001.01000000.00000003.sdmp, Offset: 00E10000, based on PE: true

Associated: 00000000.00000002.1262729095.0000000000E10000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1262808979.0000000000E9D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1262808979.0000000000EBE000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1262857687.0000000000ECA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1262878803.0000000000ED4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1262878803.0000000000F07000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_e10000_18112024_Dokman_1 Kas_m 2024- Avans_T24-2112184_dekont.jbxd

Similarity

API ID: System$MetricsRectWindow$AsyncClientInfoParametersState$AdjustCreateCursorLongMessageObjectScreenSendStockTimer
String ID: AutoIt v3 GUI
API String ID: 1458621304-248962490
Opcode ID: 40c181b1ebcb33d25a3b631e9c31efe3cd85cedba2f8fc6aece616d52edae0f0
Instruction ID: dab8f4476b9951e7767895af1c8cf38a1f313b7fb42e241aeead6af99a3730df
Opcode Fuzzy Hash: 40c181b1ebcb33d25a3b631e9c31efe3cd85cedba2f8fc6aece616d52edae0f0
Instruction Fuzzy Hash: 87B19B71A0421AEFDB04DFA9EC45BAE7BB4FB48314F15522AFA19B62D0DB70D840CB51

Function 00E73639 Relevance: 26.7, APIs: 9, Strings: 6, Instructions: 477registryCOMMON

Download Yara Rule

APIs

RegConnectRegistryW.ADVAPI32(?,?,?), ref: 00E73735
RegCreateKeyExW.ADVAPI32(?,?,00000000,00EADC00,00000000,?,00000000,?,?), ref: 00E737A3
RegCloseKey.ADVAPI32(00000000,00000001,00000000,00000000,00000000), ref: 00E737EB
RegSetValueExW.ADVAPI32(00000001,?,00000000,00000002,?), ref: 00E73874
RegCloseKey.ADVAPI32(?), ref: 00E73B94
RegCloseKey.ADVAPI32(00000000), ref: 00E73BA1

Strings

REG_QWORD, xrefs: 00E73AE2
REG_EXPAND_SZ, xrefs: 00E73811
REG_MULTI_SZ, xrefs: 00E7395C
REG_SZ, xrefs: 00E738B2
REG_DWORD, xrefs: 00E73A65
REG_BINARY, xrefs: 00E73B2F

Memory Dump Source

Source File: 00000000.00000002.1262750966.0000000000E11000.00000020.00000001.01000000.00000003.sdmp, Offset: 00E10000, based on PE: true

Associated: 00000000.00000002.1262729095.0000000000E10000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1262808979.0000000000E9D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1262808979.0000000000EBE000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1262857687.0000000000ECA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1262878803.0000000000ED4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1262878803.0000000000F07000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_e10000_18112024_Dokman_1 Kas_m 2024- Avans_T24-2112184_dekont.jbxd

Similarity

API ID: Close$ConnectCreateRegistryValue
String ID: REG_BINARY$REG_DWORD$REG_EXPAND_SZ$REG_MULTI_SZ$REG_QWORD$REG_SZ
API String ID: 536824911-966354055
Opcode ID: 3e1255147331d04a6ddff76d7b1be902d4de0f8406a910bb3d78bc2a42ed8db3
Instruction ID: badd841013c4e28a316614139829ef0c04de819e283b971eaa6d3769ffacd80f
Opcode Fuzzy Hash: 3e1255147331d04a6ddff76d7b1be902d4de0f8406a910bb3d78bc2a42ed8db3
Instruction Fuzzy Hash: D3028B756046019FCB14EF24C855E6AB7E5FF88720F04945DF99AAB3A2CB30EE45CB81

Function 00E76BC9 Relevance: 26.5, APIs: 2, Strings: 13, Instructions: 281windowCOMMON

Download Yara Rule

APIs

CharUpperBuffW.USER32(?,?), ref: 00E76C56
SendMessageW.USER32(?,00001032,00000000,00000000), ref: 00E76D16

Strings

FINDITEM, xrefs: 00E76E81
ISSELECTED, xrefs: 00E76D21
GETITEMCOUNT, xrefs: 00E76C84
GETTEXT, xrefs: 00E76CBF
SELECTCLEAR, xrefs: 00E76D8D
SELECTINVERT, xrefs: 00E76DDE
SELECTALL, xrefs: 00E76D75
SELECT, xrefs: 00E76DA8
VIEWCHANGE, xrefs: 00E76ECD
GETSUBITEMCOUNT, xrefs: 00E76CA1
DESELECT, xrefs: 00E76DFC
GETSELECTED, xrefs: 00E76E3C
GETSELECTEDCOUNT, xrefs: 00E76CF9

Memory Dump Source

Source File: 00000000.00000002.1262750966.0000000000E11000.00000020.00000001.01000000.00000003.sdmp, Offset: 00E10000, based on PE: true

Associated: 00000000.00000002.1262729095.0000000000E10000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1262808979.0000000000E9D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1262808979.0000000000EBE000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1262857687.0000000000ECA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1262878803.0000000000ED4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1262878803.0000000000F07000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_e10000_18112024_Dokman_1 Kas_m 2024- Avans_T24-2112184_dekont.jbxd

Similarity

API ID: BuffCharMessageSendUpper
String ID: DESELECT$FINDITEM$GETITEMCOUNT$GETSELECTED$GETSELECTEDCOUNT$GETSUBITEMCOUNT$GETTEXT$ISSELECTED$SELECT$SELECTALL$SELECTCLEAR$SELECTINVERT$VIEWCHANGE
API String ID: 3974292440-719923060
Opcode ID: 51a9ece01cd9ec5c8756f19620b6b3dbb4729533a34700fe06482d821b058484
Instruction ID: 074728a3c078723a2f7c5941e812bb548da4799b1faae4925bc4588a98d37675
Opcode Fuzzy Hash: 51a9ece01cd9ec5c8756f19620b6b3dbb4729533a34700fe06482d821b058484
Instruction Fuzzy Hash: D1A170302046519FCB14EF10D952AAAB3E5FF84318F10A96DB86A7B3D2DB31ED06CB51

Function 00E4CF50 Relevance: 26.5, APIs: 14, Strings: 1, Instructions: 273windowtimeCOMMON

Download Yara Rule

APIs

GetClassNameW.USER32(?,?,00000100), ref: 00E4CF91
__swprintf.LIBCMT ref: 00E4D032
_wcscmp.LIBCMT ref: 00E4D045
SendMessageTimeoutW.USER32(?,?,00000101,00000000,00000002,00001388,?), ref: 00E4D09A
_wcscmp.LIBCMT ref: 00E4D0D6
GetClassNameW.USER32(?,?,00000400), ref: 00E4D10D
GetDlgCtrlID.USER32(?), ref: 00E4D15F
GetWindowRect.USER32(?,?), ref: 00E4D195
GetParent.USER32(?), ref: 00E4D1B3
ScreenToClient.USER32(00000000), ref: 00E4D1BA
GetClassNameW.USER32(?,?,00000100), ref: 00E4D234
_wcscmp.LIBCMT ref: 00E4D248
GetWindowTextW.USER32(?,?,00000400), ref: 00E4D26E
_wcscmp.LIBCMT ref: 00E4D282

Strings

%s%u, xrefs: 00E4D02C

Memory Dump Source

Source File: 00000000.00000002.1262750966.0000000000E11000.00000020.00000001.01000000.00000003.sdmp, Offset: 00E10000, based on PE: true

Associated: 00000000.00000002.1262729095.0000000000E10000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1262808979.0000000000E9D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1262808979.0000000000EBE000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1262857687.0000000000ECA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1262878803.0000000000ED4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1262878803.0000000000F07000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_e10000_18112024_Dokman_1 Kas_m 2024- Avans_T24-2112184_dekont.jbxd

Similarity

API ID: _wcscmp$ClassName$Window$ClientCtrlMessageParentRectScreenSendTextTimeout__swprintf
String ID: %s%u
API String ID: 3119225716-679674701
Opcode ID: c08e91fb6b5b228866032723467e95be1344cec33e581bbe8b4a1f23b68291c5
Instruction ID: 7edf7ea9ea5f3cd73c0d5eea6d5ab23a12260672a63bb8ad65c15794b0bda761
Opcode Fuzzy Hash: c08e91fb6b5b228866032723467e95be1344cec33e581bbe8b4a1f23b68291c5
Instruction Fuzzy Hash: D1A1C071608302AFD715DF64DC84BAAB7E8FF44318F00951AF999E3191DB70EA49CB91

Function 00E4D8A7 Relevance: 26.5, APIs: 13, Strings: 2, Instructions: 249COMMON

Download Yara Rule

APIs

GetClassNameW.USER32(00000008,?,00000400), ref: 00E4D8EB
_wcscmp.LIBCMT ref: 00E4D8FC
GetWindowTextW.USER32(00000001,?,00000400), ref: 00E4D924
CharUpperBuffW.USER32(?,00000000), ref: 00E4D941
_wcscmp.LIBCMT ref: 00E4D95F
_wcsstr.LIBCMT ref: 00E4D970
GetClassNameW.USER32(00000018,?,00000400), ref: 00E4D9A8
_wcscmp.LIBCMT ref: 00E4D9B8
GetWindowTextW.USER32(00000002,?,00000400), ref: 00E4D9DF
GetClassNameW.USER32(00000018,?,00000400), ref: 00E4DA28
_wcscmp.LIBCMT ref: 00E4DA38
GetClassNameW.USER32(00000010,?,00000400), ref: 00E4DA60
GetWindowRect.USER32(00000004,?), ref: 00E4DAC9

Strings

ThumbnailClass, xrefs: 00E4D9B3, 00E4DA33
@, xrefs: 00E4D8C6

Memory Dump Source

Source File: 00000000.00000002.1262750966.0000000000E11000.00000020.00000001.01000000.00000003.sdmp, Offset: 00E10000, based on PE: true

Associated: 00000000.00000002.1262729095.0000000000E10000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1262808979.0000000000E9D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1262808979.0000000000EBE000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1262857687.0000000000ECA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1262878803.0000000000ED4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1262878803.0000000000F07000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_e10000_18112024_Dokman_1 Kas_m 2024- Avans_T24-2112184_dekont.jbxd

Similarity

API ID: ClassName_wcscmp$Window$Text$BuffCharRectUpper_wcsstr
String ID: @$ThumbnailClass
API String ID: 1788623398-1539354611
Opcode ID: d10083618a38c40d611b1741403e1dab325c3bf7ec0c378f28d283936d61730b
Instruction ID: e52a1b73b5a2447cc543921bba4bcfd5bc8e2428b96d3803e99fe15e8f695e33
Opcode Fuzzy Hash: d10083618a38c40d611b1741403e1dab325c3bf7ec0c378f28d283936d61730b
Instruction Fuzzy Hash: 3281A07100C3059BDB05DF10DD85FAA7BE8EF84718F04A4AAFD89AA096DB70D945CBA1

Function 00E4D6F4 Relevance: 26.4, APIs: 3, Strings: 12, Instructions: 104COMMON

Download Yara Rule

APIs

__wcsnicmp.LIBCMT ref: 00E4D753

Strings

HANDLE=, xrefs: 00E4D74C
[LAST, xrefs: 00E4D800
[REGEXPTITLE:, xrefs: 00E4D77B
[ACTIVE, xrefs: 00E4D740
[HANDLE:, xrefs: 00E4D75F
[CLASS:, xrefs: 00E4D7A3
LAST, xrefs: 00E4D718
ACTIVE, xrefs: 00E4D72E
REGEXP=, xrefs: 00E4D768
[ALL, xrefs: 00E4D7F9
ALL, xrefs: 00E4D7E7
CLASSNAME=, xrefs: 00E4D790

Memory Dump Source

Source File: 00000000.00000002.1262750966.0000000000E11000.00000020.00000001.01000000.00000003.sdmp, Offset: 00E10000, based on PE: true

Associated: 00000000.00000002.1262729095.0000000000E10000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1262808979.0000000000E9D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1262808979.0000000000EBE000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1262857687.0000000000ECA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1262878803.0000000000ED4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1262878803.0000000000F07000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_e10000_18112024_Dokman_1 Kas_m 2024- Avans_T24-2112184_dekont.jbxd

Similarity

API ID: __wcsnicmp
String ID: ACTIVE$ALL$CLASSNAME=$HANDLE=$LAST$REGEXP=$[ACTIVE$[ALL$[CLASS:$[HANDLE:$[LAST$[REGEXPTITLE:
API String ID: 1038674560-1810252412
Opcode ID: d47955a64aed20a33dfc8e3368c04929633866d101336f50cd733c5b5731b8c5
Instruction ID: 0f1ce3189b2b304c81e2c32197d3305a88c6ca7f2602c0829d26022972d9140b
Opcode Fuzzy Hash: d47955a64aed20a33dfc8e3368c04929633866d101336f50cd733c5b5731b8c5
Instruction Fuzzy Hash: 5131AC32A48309AADB19EA60EE57FEEB3B49F20704F20312DF501B10D1EB52AE45C611

Function 00E4EA9D Relevance: 25.7, APIs: 17, Instructions: 168windowtimeCOMMON

Download Yara Rule

APIs

LoadIconW.USER32(00000063), ref: 00E4EAB0
SendMessageW.USER32(?,00000080,00000000,00000000), ref: 00E4EAC2
SetWindowTextW.USER32(?,?), ref: 00E4EAD9
GetDlgItem.USER32(?,000003EA), ref: 00E4EAEE
SetWindowTextW.USER32(00000000,?), ref: 00E4EAF4
GetDlgItem.USER32(?,000003E9), ref: 00E4EB04
SetWindowTextW.USER32(00000000,?), ref: 00E4EB0A
SendDlgItemMessageW.USER32(?,000003E9,000000CC,?,00000000), ref: 00E4EB2B
SendDlgItemMessageW.USER32(?,000003E9,000000C5,00000000,00000000), ref: 00E4EB45
GetWindowRect.USER32(?,?), ref: 00E4EB4E
SetWindowTextW.USER32(?,?), ref: 00E4EBB9
GetDesktopWindow.USER32 ref: 00E4EBBF
GetWindowRect.USER32(00000000), ref: 00E4EBC6
MoveWindow.USER32(?,?,?,?,00000000,00000000), ref: 00E4EC12
GetClientRect.USER32(?,?), ref: 00E4EC1F
PostMessageW.USER32(?,00000005,00000000,00000000), ref: 00E4EC44
SetTimer.USER32(?,0000040A,00000000,00000000), ref: 00E4EC6F

Memory Dump Source

Source File: 00000000.00000002.1262750966.0000000000E11000.00000020.00000001.01000000.00000003.sdmp, Offset: 00E10000, based on PE: true

Associated: 00000000.00000002.1262729095.0000000000E10000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1262808979.0000000000E9D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1262808979.0000000000EBE000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1262857687.0000000000ECA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1262878803.0000000000ED4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1262878803.0000000000F07000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_e10000_18112024_Dokman_1 Kas_m 2024- Avans_T24-2112184_dekont.jbxd

Similarity

API ID: Window$ItemMessageText$RectSend$ClientDesktopIconLoadMovePostTimer
String ID:
API String ID: 3869813825-0
Opcode ID: 4c83d1831827f1605212be6812d2e1de6e6e2603fe3027c0a1b070d0952dfbaf
Instruction ID: ea4c225c215e5ce0ae58ee9013ed6bb8c6a9c3e6d71f26fcc3c012b2029f716e
Opcode Fuzzy Hash: 4c83d1831827f1605212be6812d2e1de6e6e2603fe3027c0a1b070d0952dfbaf
Instruction Fuzzy Hash: 68513D71900709EFDB219FA9DD89F6EBBF5FF04708F004919E586B26A1C774A948CB10

Function 00E679B0 Relevance: 25.6, APIs: 17, Instructions: 109COMMON

Download Yara Rule

APIs

LoadCursorW.USER32(00000000,00007F8A), ref: 00E679C6
LoadCursorW.USER32(00000000,00007F00), ref: 00E679D1
LoadCursorW.USER32(00000000,00007F03), ref: 00E679DC
LoadCursorW.USER32(00000000,00007F8B), ref: 00E679E7
LoadCursorW.USER32(00000000,00007F01), ref: 00E679F2
LoadCursorW.USER32(00000000,00007F81), ref: 00E679FD
LoadCursorW.USER32(00000000,00007F88), ref: 00E67A08
LoadCursorW.USER32(00000000,00007F80), ref: 00E67A13
LoadCursorW.USER32(00000000,00007F86), ref: 00E67A1E
LoadCursorW.USER32(00000000,00007F83), ref: 00E67A29
LoadCursorW.USER32(00000000,00007F85), ref: 00E67A34
LoadCursorW.USER32(00000000,00007F82), ref: 00E67A3F
LoadCursorW.USER32(00000000,00007F84), ref: 00E67A4A
LoadCursorW.USER32(00000000,00007F04), ref: 00E67A55
LoadCursorW.USER32(00000000,00007F02), ref: 00E67A60
LoadCursorW.USER32(00000000,00007F89), ref: 00E67A6B
GetCursorInfo.USER32(?), ref: 00E67A7B

Memory Dump Source

Source File: 00000000.00000002.1262750966.0000000000E11000.00000020.00000001.01000000.00000003.sdmp, Offset: 00E10000, based on PE: true

Associated: 00000000.00000002.1262729095.0000000000E10000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1262808979.0000000000E9D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1262808979.0000000000EBE000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1262857687.0000000000ECA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1262878803.0000000000ED4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1262878803.0000000000F07000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_e10000_18112024_Dokman_1 Kas_m 2024- Avans_T24-2112184_dekont.jbxd

Similarity

API ID: Cursor$Load$Info
String ID:
API String ID: 2577412497-0
Opcode ID: 3f3f528f8116828bb83e74670dc80a1ca516586d86acf9dea8e74205ceb36955
Instruction ID: d4673d6745576efe26af0eae8649eb0a5f41d4aff9d51c49677df32fd1971807
Opcode Fuzzy Hash: 3f3f528f8116828bb83e74670dc80a1ca516586d86acf9dea8e74205ceb36955
Instruction Fuzzy Hash: 873112B0D4831A6ADB109FF69C8999FBEE8FF04754F50452BE54DF7280DA78A5008FA1

Function 00E1C833 Relevance: 25.0, APIs: 7, Strings: 7, Instructions: 479COMMON

Download Yara Rule

APIs

Part of subcall function 00E2E968: GetCurrentDirectoryW.KERNEL32(00007FFF,?,?,?,00E1C8B7,?,00002000,?,?,00000000,?,00E1419E,?,?,?,00EADC00), ref: 00E2E984

Part of subcall function 00E1660F: GetFullPathNameW.KERNEL32(?,00007FFF,?,00000000,?,?,00E153B1,?,?,00E161FF,?,00000000,00000001,00000000), ref: 00E1662F

__wsplitpath.LIBCMT ref: 00E1C93E

Part of subcall function 00E31DFC: __wsplitpath_helper.LIBCMT ref: 00E31E3C

_wcscpy.LIBCMT ref: 00E1C953
_wcscat.LIBCMT ref: 00E1C968
SetCurrentDirectoryW.KERNEL32(?,?,?,?,?,?,00000001,?,?,00000000), ref: 00E1C978
SetCurrentDirectoryW.KERNEL32(?), ref: 00E1CABE

Part of subcall function 00E1B337: _wcscpy.LIBCMT ref: 00E1B36F

Strings

#include depth exceeded. Make sure there are no recursive includes, xrefs: 00E83098
AU3!, xrefs: 00E1C90C
Bad directive syntax error, xrefs: 00E83429
Unterminated string, xrefs: 00E83470
>>>AUTOIT SCRIPT<<<, xrefs: 00E8311B
EA06, xrefs: 00E830C9
Error opening the file, xrefs: 00E830B4, 00E8313D

Memory Dump Source

Source File: 00000000.00000002.1262750966.0000000000E11000.00000020.00000001.01000000.00000003.sdmp, Offset: 00E10000, based on PE: true

Associated: 00000000.00000002.1262729095.0000000000E10000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1262808979.0000000000E9D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1262808979.0000000000EBE000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1262857687.0000000000ECA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1262878803.0000000000ED4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1262878803.0000000000F07000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_e10000_18112024_Dokman_1 Kas_m 2024- Avans_T24-2112184_dekont.jbxd

Similarity

API ID: CurrentDirectory$_wcscpy$FullNamePath__wsplitpath__wsplitpath_helper_wcscat
String ID: #include depth exceeded. Make sure there are no recursive includes$>>>AUTOIT SCRIPT<<<$AU3!$Bad directive syntax error$EA06$Error opening the file$Unterminated string
API String ID: 2258743419-1018226102
Opcode ID: 4ad66a05de03536f347c89e1a254e64452f490233fc65a988dfbefcfed2430a2
Instruction ID: a9ea1987051d4e37491046fec525fcc659e0e911220cc17b2a275357eba11b17
Opcode Fuzzy Hash: 4ad66a05de03536f347c89e1a254e64452f490233fc65a988dfbefcfed2430a2
Instruction Fuzzy Hash: 0F129F715083419FC724EF24C841AEFBBE5AF99704F10691EF59AB3261DB30DA89CB52

Function 00E7CE58 Relevance: 24.7, APIs: 12, Strings: 2, Instructions: 205windowCOMMON

Download Yara Rule

APIs

_memset.LIBCMT ref: 00E7CEFB
DestroyWindow.USER32(?,?), ref: 00E7CF73
CreateWindowExW.USER32(00000008,tooltips_class32,00000000,?,80000000,80000000,80000000,80000000,?,00000000,00000000,?), ref: 00E7CFF4
SendMessageW.USER32(00000000,00000433,00000000,00000030), ref: 00E7D016
SendMessageW.USER32(00000000,00000432,00000000,00000030), ref: 00E7D025
DestroyWindow.USER32(?), ref: 00E7D042
CreateWindowExW.USER32(00000008,tooltips_class32,00000000,?,80000000,80000000,80000000,80000000,?,00000000,00E10000,00000000), ref: 00E7D075
SendMessageW.USER32(00000000,00000432,00000000,00000030), ref: 00E7D094
GetDesktopWindow.USER32 ref: 00E7D0A9
GetWindowRect.USER32(00000000), ref: 00E7D0B0
SendMessageW.USER32(00000000,00000418,00000000,?), ref: 00E7D0C2
SendMessageW.USER32(00000000,00000421,?,00000000), ref: 00E7D0DA

Part of subcall function 00E2B526: GetWindowLongW.USER32(?,000000EB), ref: 00E2B537

Strings

0, xrefs: 00E7CF1B
tooltips_class32, xrefs: 00E7CFED, 00E7D06E

Memory Dump Source

Source File: 00000000.00000002.1262750966.0000000000E11000.00000020.00000001.01000000.00000003.sdmp, Offset: 00E10000, based on PE: true

Associated: 00000000.00000002.1262729095.0000000000E10000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1262808979.0000000000E9D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1262808979.0000000000EBE000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1262857687.0000000000ECA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1262878803.0000000000ED4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1262878803.0000000000F07000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_e10000_18112024_Dokman_1 Kas_m 2024- Avans_T24-2112184_dekont.jbxd

Similarity

API ID: Window$MessageSend$CreateDestroy$DesktopLongRect_memset
String ID: 0$tooltips_class32
API String ID: 3877571568-3619404913
Opcode ID: a5ac02a37c7117ed549f3e90234d1376ee0322e49053cba90b0b55543f7c5d11
Instruction ID: 253f62f0f1c498561684af978cc1707701d75fea6a4c446737e4fabf03e1a199
Opcode Fuzzy Hash: a5ac02a37c7117ed549f3e90234d1376ee0322e49053cba90b0b55543f7c5d11
Instruction Fuzzy Hash: 4871B170148305AFD720DF28DC45F6677FAEB88708F04A55EF999A72A1D730E946CB22

Function 00E7F351 Relevance: 24.7, APIs: 11, Strings: 3, Instructions: 178windowfileCOMMON

Download Yara Rule

APIs

Part of subcall function 00E2B34E: GetWindowLongW.USER32(?,000000EB), ref: 00E2B35F

DragQueryPoint.SHELL32(?,?), ref: 00E7F37A

Part of subcall function 00E7D7DE: ClientToScreen.USER32(?,?), ref: 00E7D807
Part of subcall function 00E7D7DE: GetWindowRect.USER32(?,?), ref: 00E7D87D
Part of subcall function 00E7D7DE: PtInRect.USER32(?,?,00E7ED5A), ref: 00E7D88D

SendMessageW.USER32(?,000000B0,?,?), ref: 00E7F3E3
DragQueryFileW.SHELL32(?,000000FF,00000000,00000000), ref: 00E7F3EE
DragQueryFileW.SHELL32(?,00000000,?,00000104), ref: 00E7F411
_wcscat.LIBCMT ref: 00E7F441
SendMessageW.USER32(?,000000C2,00000001,?), ref: 00E7F458
SendMessageW.USER32(?,000000B0,?,?), ref: 00E7F471
SendMessageW.USER32(?,000000B1,?,?), ref: 00E7F488
SendMessageW.USER32(?,000000B1,?,?), ref: 00E7F4AA
DragFinish.SHELL32(?), ref: 00E7F4B1
DefDlgProcW.USER32(?,00000233,?,00000000,?,?,?), ref: 00E7F59C

Strings

@GUI_DROPID, xrefs: 00E7F4D1
@GUI_DRAGID, xrefs: 00E7F510
@GUI_DRAGFILE, xrefs: 00E7F54B

Memory Dump Source

Source File: 00000000.00000002.1262750966.0000000000E11000.00000020.00000001.01000000.00000003.sdmp, Offset: 00E10000, based on PE: true

Associated: 00000000.00000002.1262729095.0000000000E10000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1262808979.0000000000E9D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1262808979.0000000000EBE000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1262857687.0000000000ECA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1262878803.0000000000ED4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1262878803.0000000000F07000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_e10000_18112024_Dokman_1 Kas_m 2024- Avans_T24-2112184_dekont.jbxd

Similarity

API ID: MessageSend$Drag$Query$FileRectWindow$ClientFinishLongPointProcScreen_wcscat
String ID: @GUI_DRAGFILE$@GUI_DRAGID$@GUI_DROPID
API String ID: 169749273-3440237614
Opcode ID: 3f163cdde010bac75196e7bb90d4582e2f5c6d6c30c95c23ae2833c19c743b16
Instruction ID: 13d7b6d4376db83a6bf5b23c3a4571d5f5f73c5c827f716b1e779c32dd986ad7
Opcode Fuzzy Hash: 3f163cdde010bac75196e7bb90d4582e2f5c6d6c30c95c23ae2833c19c743b16
Instruction Fuzzy Hash: 6F613971108300AFC711DF64DC85EAFBBF8EF89710F005A1EF695A21A1DB709A49CB52

Function 00E526BC Relevance: 24.6, APIs: 8, Strings: 6, Instructions: 137windowCOMMON

Download Yara Rule

APIs

GetModuleHandleW.KERNEL32(00000000,?,00000FFF,00000016,00000000,?,?,00E83973,00000016,0000138C,00000016,?,00000016,00EADDB4,00000000,?), ref: 00E526F1
LoadStringW.USER32(00000000,?,00E83973,00000016), ref: 00E526FA
GetModuleHandleW.KERNEL32(00000000,00000016,?,00000FFF,?,?,00E83973,00000016,0000138C,00000016,?,00000016,00EADDB4,00000000,?,00000016), ref: 00E5271C
LoadStringW.USER32(00000000,?,00E83973,00000016), ref: 00E5271F
__swprintf.LIBCMT ref: 00E5276F
__swprintf.LIBCMT ref: 00E52780
_wprintf.LIBCMT ref: 00E52829
MessageBoxW.USER32(00000000,?,?,00011010), ref: 00E52840

Strings

Line %d (File "%s"):, xrefs: 00E52769
Error: , xrefs: 00E527F7
Line %d:, xrefs: 00E5277A
s9, xrefs: 00E52728
%s (%d) : ==> %s: %s %s, xrefs: 00E52824
^ ERROR, xrefs: 00E527D5

Memory Dump Source

Source File: 00000000.00000002.1262750966.0000000000E11000.00000020.00000001.01000000.00000003.sdmp, Offset: 00E10000, based on PE: true

Associated: 00000000.00000002.1262729095.0000000000E10000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1262808979.0000000000E9D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1262808979.0000000000EBE000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1262857687.0000000000ECA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1262878803.0000000000ED4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1262878803.0000000000F07000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_e10000_18112024_Dokman_1 Kas_m 2024- Avans_T24-2112184_dekont.jbxd

Similarity

API ID: HandleLoadModuleString__swprintf$Message_wprintf
String ID: Error: $%s (%d) : ==> %s: %s %s$Line %d (File "%s"):$Line %d:$^ ERROR$s9
API String ID: 618562835-2846937808
Opcode ID: aadf5f410a52430738251d84d9be0ad556273842197a05a2a0103e1f9322f106
Instruction ID: a643862eccc2d27f800689ac381b3f58969b93be78fdfd7728765267e8ba513d
Opcode Fuzzy Hash: aadf5f410a52430738251d84d9be0ad556273842197a05a2a0103e1f9322f106
Instruction Fuzzy Hash: 3A416672900218BACF15FBE0DD87EEEB7B8AF55341F501469B601B6092DB316F89CB61

Function 00E5AAF8 Relevance: 23.1, APIs: 11, Strings: 2, Instructions: 374timeCOMMON

Download Yara Rule

APIs

VariantInit.OLEAUT32(00000000), ref: 00E5AB3D
VariantCopy.OLEAUT32(?,?), ref: 00E5AB46
VariantClear.OLEAUT32(?), ref: 00E5AB52
VariantTimeToSystemTime.OLEAUT32(?,?,?), ref: 00E5AC40
__swprintf.LIBCMT ref: 00E5AC70
VarR8FromDec.OLEAUT32(?,?), ref: 00E5AC9C
VariantInit.OLEAUT32(?), ref: 00E5AD4D
SysFreeString.OLEAUT32(00000016), ref: 00E5ADDF
VariantClear.OLEAUT32(?), ref: 00E5AE35
VariantClear.OLEAUT32(?), ref: 00E5AE44
VariantInit.OLEAUT32(00000000), ref: 00E5AE80

Strings

%4d%02d%02d%02d%02d%02d, xrefs: 00E5AC6A
Default, xrefs: 00E5ACFD

Memory Dump Source

Source File: 00000000.00000002.1262750966.0000000000E11000.00000020.00000001.01000000.00000003.sdmp, Offset: 00E10000, based on PE: true

Associated: 00000000.00000002.1262729095.0000000000E10000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1262808979.0000000000E9D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1262808979.0000000000EBE000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1262857687.0000000000ECA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1262878803.0000000000ED4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1262878803.0000000000F07000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_e10000_18112024_Dokman_1 Kas_m 2024- Avans_T24-2112184_dekont.jbxd

Similarity

API ID: Variant$ClearInit$Time$CopyFreeFromStringSystem__swprintf
String ID: %4d%02d%02d%02d%02d%02d$Default
API String ID: 3730832054-3931177956
Opcode ID: 212b08e1449ba7c7c7718e3d44cdebd04803d4fead183810ed2919ea3ebb3920
Instruction ID: 7abfc9975eb86798a68a502a1293e3ac39c0cb6e09a1cf9caa9df148c8fd91e8
Opcode Fuzzy Hash: 212b08e1449ba7c7c7718e3d44cdebd04803d4fead183810ed2919ea3ebb3920
Instruction Fuzzy Hash: 95D10231604615DBCB109F65D885BADB7F5FF04702F18AA76E815BB181CB70EC88DBA2

Function 00E7716A Relevance: 23.0, APIs: 2, Strings: 11, Instructions: 244windowCOMMON

Download Yara Rule

APIs

CharUpperBuffW.USER32(?,?), ref: 00E771FC
SendMessageW.USER32(?,00001105,00000000,00000000), ref: 00E77247

Strings

COLLAPSE, xrefs: 00E7728D
UNCHECK, xrefs: 00E7740B
SELECT, xrefs: 00E773E0
EXPAND, xrefs: 00E772E1
GETTOTALCOUNT, xrefs: 00E7722A
ISCHECKED, xrefs: 00E773B2
GETITEMCOUNT, xrefs: 00E77311
EXISTS, xrefs: 00E772B0
GETTEXT, xrefs: 00E77382
GETSELECTED, xrefs: 00E7733F
CHECK, xrefs: 00E77267

Memory Dump Source

Source File: 00000000.00000002.1262750966.0000000000E11000.00000020.00000001.01000000.00000003.sdmp, Offset: 00E10000, based on PE: true

Associated: 00000000.00000002.1262729095.0000000000E10000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1262808979.0000000000E9D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1262808979.0000000000EBE000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1262857687.0000000000ECA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1262878803.0000000000ED4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1262878803.0000000000F07000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_e10000_18112024_Dokman_1 Kas_m 2024- Avans_T24-2112184_dekont.jbxd

Similarity

API ID: BuffCharMessageSendUpper
String ID: CHECK$COLLAPSE$EXISTS$EXPAND$GETITEMCOUNT$GETSELECTED$GETTEXT$GETTOTALCOUNT$ISCHECKED$SELECT$UNCHECK
API String ID: 3974292440-4258414348
Opcode ID: 4060a3227ec079279e13708a54118104f538c47c95d7e206d40c3ee63a83130a
Instruction ID: d256f31a7ecbe56dd83576d1b12e298bf8cb399cbe820b6829c5365badd4293e
Opcode Fuzzy Hash: 4060a3227ec079279e13708a54118104f538c47c95d7e206d40c3ee63a83130a
Instruction Fuzzy Hash: E89163746087519BCB04EF10D851AAEB7E1AF94314F10A85DF8AA773A3DB31ED46CB81

Function 00E4CB82 Relevance: 23.0, APIs: 2, Strings: 11, Instructions: 239COMMON

Download Yara Rule

APIs

EnumChildWindows.USER32(?,00E4CF50), ref: 00E4CE90

Strings

NAME, xrefs: 00E4CCC2
4+, xrefs: 00E4CC96
TEXT, xrefs: 00E4CDC7
H+, xrefs: 00E4CCE8
INSTANCE, xrefs: 00E4CD9E
CLASSNN, xrefs: 00E4CC33
P+, xrefs: 00E4CD43
L+, xrefs: 00E4CD14
T+, xrefs: 00E4CD72
CLASS, xrefs: 00E4CC10
REGEXPCLASS, xrefs: 00E4CC56

Memory Dump Source

Source File: 00000000.00000002.1262750966.0000000000E11000.00000020.00000001.01000000.00000003.sdmp, Offset: 00E10000, based on PE: true

Associated: 00000000.00000002.1262729095.0000000000E10000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1262808979.0000000000E9D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1262808979.0000000000EBE000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1262857687.0000000000ECA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1262878803.0000000000ED4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1262878803.0000000000F07000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_e10000_18112024_Dokman_1 Kas_m 2024- Avans_T24-2112184_dekont.jbxd

Similarity

API ID: ChildEnumWindows
String ID: 4+$CLASS$CLASSNN$H+$INSTANCE$L+$NAME$P+$REGEXPCLASS$T+$TEXT
API String ID: 3555792229-2655548891
Opcode ID: 00081d78c9960867e1a8aeadcdfadd04d329d8c552ad858ed6dd276b60a0b55f
Instruction ID: 0287c05c7e97470d8bc9fa92feb6ae1af259ef56d97f92cb81da6a4d24ff9fd7
Opcode Fuzzy Hash: 00081d78c9960867e1a8aeadcdfadd04d329d8c552ad858ed6dd276b60a0b55f
Instruction Fuzzy Hash: 6891D830A016169BCB58DFA0D482BEAFBB4BF04304F60A519D549B7151DF30BD9AC7D0

Function 00E7E4F5 Relevance: 22.9, APIs: 10, Strings: 3, Instructions: 199windowlibraryCOMMON

Download Yara Rule

APIs

LoadImageW.USER32(00000000,?,00000001,?,?,00002010), ref: 00E7E5AB
LoadLibraryExW.KERNEL32(?,00000000,00000032,00000000,?,?,?,?,?,00E7BEAF), ref: 00E7E607
LoadImageW.USER32(?,?,00000001,?,?,00000000), ref: 00E7E647
LoadImageW.USER32(?,?,00000001,?,?,00000000), ref: 00E7E68C
LoadImageW.USER32(?,?,00000001,?,?,00000000), ref: 00E7E6C3
FreeLibrary.KERNEL32(?,00000004,?,?,?,?,00E7BEAF), ref: 00E7E6CF
ExtractIconExW.SHELL32(?,00000000,00000000,00000000,00000001), ref: 00E7E6DF
DestroyIcon.USER32(?,?,?,?,?,00E7BEAF), ref: 00E7E6EE
SendMessageW.USER32(?,00000170,00000000,00000000), ref: 00E7E70B
SendMessageW.USER32(?,00000064,00000172,00000001), ref: 00E7E717

Part of subcall function 00E30FA7: __wcsicmp_l.LIBCMT ref: 00E31030

Strings

.exe, xrefs: 00E7E541
.dll, xrefs: 00E7E564
.icl, xrefs: 00E7E521

Memory Dump Source

Source File: 00000000.00000002.1262750966.0000000000E11000.00000020.00000001.01000000.00000003.sdmp, Offset: 00E10000, based on PE: true

Associated: 00000000.00000002.1262729095.0000000000E10000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1262808979.0000000000E9D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1262808979.0000000000EBE000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1262857687.0000000000ECA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1262878803.0000000000ED4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1262878803.0000000000F07000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_e10000_18112024_Dokman_1 Kas_m 2024- Avans_T24-2112184_dekont.jbxd

Similarity

API ID: Load$Image$IconLibraryMessageSend$DestroyExtractFree__wcsicmp_l
String ID: .dll$.exe$.icl
API String ID: 1212759294-1154884017
Opcode ID: 20541a26dad4e53d9918ff1742960bd78fbe40fc50c9711007537b63734aa0de
Instruction ID: 055cc0fc123768dc126340b988d8edf438b09128aa6d1d5a02c3acee9c5eeac6
Opcode Fuzzy Hash: 20541a26dad4e53d9918ff1742960bd78fbe40fc50c9711007537b63734aa0de
Instruction Fuzzy Hash: 8A619F71500219BEEB24DFA4CC46FEA7BA8BB18724F109146F919F61D1EB70A994CB60

Function 00E5D219 Relevance: 22.9, APIs: 5, Strings: 8, Instructions: 138COMMON

Download Yara Rule

APIs

Part of subcall function 00E1936C: __swprintf.LIBCMT ref: 00E193AB
Part of subcall function 00E1936C: __itow.LIBCMT ref: 00E193DF

CharLowerBuffW.USER32(?,?), ref: 00E5D292
GetDriveTypeW.KERNEL32 ref: 00E5D2DF
mciSendStringW.WINMM(?,00000000,00000000,00000000), ref: 00E5D327
mciSendStringW.WINMM(?,00000000,00000000,00000000), ref: 00E5D35E
mciSendStringW.WINMM(?,00000000,00000000,00000000), ref: 00E5D38C

Strings

open, xrefs: 00E5D2B9
close, xrefs: 00E5D298
type cdaudio alias cd wait, xrefs: 00E5D30A
open , xrefs: 00E5D2EE
set cd door , xrefs: 00E5D32D
closed, xrefs: 00E5D2A6, 00E5D2AF
wait, xrefs: 00E5D349
close cd wait, xrefs: 00E5D377

Memory Dump Source

Source File: 00000000.00000002.1262750966.0000000000E11000.00000020.00000001.01000000.00000003.sdmp, Offset: 00E10000, based on PE: true

Associated: 00000000.00000002.1262729095.0000000000E10000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1262808979.0000000000E9D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1262808979.0000000000EBE000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1262857687.0000000000ECA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1262878803.0000000000ED4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1262878803.0000000000F07000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_e10000_18112024_Dokman_1 Kas_m 2024- Avans_T24-2112184_dekont.jbxd

Similarity

API ID: SendString$BuffCharDriveLowerType__itow__swprintf
String ID: type cdaudio alias cd wait$ wait$close$close cd wait$closed$open$open $set cd door
API String ID: 1148790751-4113822522
Opcode ID: b87b1e41ee142fb8a21208e80d5d34e135379af88e16788093392d6d7fcb7af9
Instruction ID: b0c069549ad20a12a941cad7c6f056f5524b9107748000dcbf0b483b12474990
Opcode Fuzzy Hash: b87b1e41ee142fb8a21208e80d5d34e135379af88e16788093392d6d7fcb7af9
Instruction Fuzzy Hash: BB513D71504305AFC700EF21D98199EB7E4EF94718F10A95DF895B7251DB31EE4ACB42

Function 00E5D0B8 Relevance: 22.9, APIs: 10, Strings: 3, Instructions: 101fileCOMMON

Download Yara Rule

APIs

GetFullPathNameW.KERNEL32(?,00007FFF,?,?), ref: 00E5D0D8
__swprintf.LIBCMT ref: 00E5D0FA
CreateDirectoryW.KERNEL32(?,00000000), ref: 00E5D137
CreateFileW.KERNEL32(?,40000000,00000000,00000000,00000003,02200000,00000000), ref: 00E5D15C
_memset.LIBCMT ref: 00E5D17B
_wcsncpy.LIBCMT ref: 00E5D1B7
DeviceIoControl.KERNEL32(00000000,000900A4,?,?,00000000,00000000,?,00000000), ref: 00E5D1EC
CloseHandle.KERNEL32(00000000), ref: 00E5D1F7
RemoveDirectoryW.KERNEL32(?), ref: 00E5D200
CloseHandle.KERNEL32(00000000), ref: 00E5D20A

Strings

:, xrefs: 00E5D11B
\??\%s, xrefs: 00E5D0F4
\, xrefs: 00E5D110

Memory Dump Source

Source File: 00000000.00000002.1262750966.0000000000E11000.00000020.00000001.01000000.00000003.sdmp, Offset: 00E10000, based on PE: true

Associated: 00000000.00000002.1262729095.0000000000E10000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1262808979.0000000000E9D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1262808979.0000000000EBE000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1262857687.0000000000ECA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1262878803.0000000000ED4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1262878803.0000000000F07000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_e10000_18112024_Dokman_1 Kas_m 2024- Avans_T24-2112184_dekont.jbxd

Similarity

API ID: CloseCreateDirectoryHandle$ControlDeviceFileFullNamePathRemove__swprintf_memset_wcsncpy
String ID: :$\$\??\%s
API String ID: 2733774712-3457252023
Opcode ID: 584f543d2c79484cd60532f2110b5305b1058d19c72c86781ea70b695ac514c1
Instruction ID: f9e23acaf6cb2dd82f17573715d3ec71aea7293c513dd54ca57a25f118239c9b
Opcode Fuzzy Hash: 584f543d2c79484cd60532f2110b5305b1058d19c72c86781ea70b695ac514c1
Instruction Fuzzy Hash: 9131C3B6504119ABDB21DFA1CC48FEB77BCEF89705F1050BAF909E2160E77096498B24

Function 00E7E731 Relevance: 22.6, APIs: 15, Instructions: 129filecommemoryCOMMON

Download Yara Rule

APIs

CreateFileW.KERNEL32(00000000,80000000,00000000,00000000,00000003,00000000,00000000,00000000,?,?,?,?,?,00E7BEF4,?,?), ref: 00E7E754
GetFileSize.KERNEL32(00000000,00000000,?,?,?,?,00E7BEF4,?,?,00000000,?), ref: 00E7E76B
GlobalAlloc.KERNEL32(00000002,00000000,?,?,?,?,00E7BEF4,?,?,00000000,?), ref: 00E7E776
CloseHandle.KERNEL32(00000000,?,?,?,?,00E7BEF4,?,?,00000000,?), ref: 00E7E783
GlobalLock.KERNEL32(00000000), ref: 00E7E78C
ReadFile.KERNEL32(00000000,00000000,00000000,00000000,00000000,?,?,?,?,00E7BEF4,?,?,00000000,?), ref: 00E7E79B
GlobalUnlock.KERNEL32(00000000), ref: 00E7E7A4
CloseHandle.KERNEL32(00000000,?,?,?,?,00E7BEF4,?,?,00000000,?), ref: 00E7E7AB
CreateStreamOnHGlobal.OLE32(00000000,00000001,?,?,?,?,?,00E7BEF4,?,?,00000000,?), ref: 00E7E7BC
OleLoadPicture.OLEAUT32(?,00000000,00000000,00E9D9BC,?), ref: 00E7E7D5
GlobalFree.KERNEL32(00000000), ref: 00E7E7E5
GetObjectW.GDI32(00000000,00000018,?), ref: 00E7E809
CopyImage.USER32(00000000,00000000,?,?,00002000), ref: 00E7E834
DeleteObject.GDI32(00000000), ref: 00E7E85C
SendMessageW.USER32(?,00000172,00000000,00000000), ref: 00E7E872

Memory Dump Source

Source File: 00000000.00000002.1262750966.0000000000E11000.00000020.00000001.01000000.00000003.sdmp, Offset: 00E10000, based on PE: true

Associated: 00000000.00000002.1262729095.0000000000E10000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1262808979.0000000000E9D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1262808979.0000000000EBE000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1262857687.0000000000ECA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1262878803.0000000000ED4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1262878803.0000000000F07000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_e10000_18112024_Dokman_1 Kas_m 2024- Avans_T24-2112184_dekont.jbxd

Similarity

API ID: Global$File$CloseCreateHandleObject$AllocCopyDeleteFreeImageLoadLockMessagePictureReadSendSizeStreamUnlock
String ID:
API String ID: 3840717409-0
Opcode ID: dde9c72baa5c3f821afb2ce9b093d293b9af7933994954e1fb0570ee2dc13af1
Instruction ID: 5f64cd56b38bdd23ab420fcd817bb9bb5dbccb86d886c169e1b3cc4d596e4885
Opcode Fuzzy Hash: dde9c72baa5c3f821afb2ce9b093d293b9af7933994954e1fb0570ee2dc13af1
Instruction Fuzzy Hash: A3417B71600214FFDB119F66CC88EAA7BB8FF89715F10809AF90AE7260C7309D05CB20

Function 00E605F8 Relevance: 21.2, APIs: 11, Strings: 1, Instructions: 230COMMON

Download Yara Rule

APIs

__wsplitpath.LIBCMT ref: 00E6076F
_wcscat.LIBCMT ref: 00E60787
_wcscat.LIBCMT ref: 00E60799
GetCurrentDirectoryW.KERNEL32(00007FFF,?), ref: 00E607AE
SetCurrentDirectoryW.KERNEL32(?), ref: 00E607C2
GetFileAttributesW.KERNEL32(?), ref: 00E607DA
SetFileAttributesW.KERNEL32(?,00000000), ref: 00E607F4
SetCurrentDirectoryW.KERNEL32(?), ref: 00E60806

Strings

*.*, xrefs: 00E60845

Memory Dump Source

Source File: 00000000.00000002.1262750966.0000000000E11000.00000020.00000001.01000000.00000003.sdmp, Offset: 00E10000, based on PE: true

Associated: 00000000.00000002.1262729095.0000000000E10000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1262808979.0000000000E9D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1262808979.0000000000EBE000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1262857687.0000000000ECA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1262878803.0000000000ED4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1262878803.0000000000F07000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_e10000_18112024_Dokman_1 Kas_m 2024- Avans_T24-2112184_dekont.jbxd

Similarity

API ID: CurrentDirectory$AttributesFile_wcscat$__wsplitpath
String ID: *.*
API String ID: 34673085-438819550
Opcode ID: 582e60e14ae2717882d3e8a5b23add1c4a639d9edcb4a93a4e53ccf327798d4f
Instruction ID: 715be47fe3db7a3ac53f83a0e5bb502e4abdf222d10c995c30392e2a1841242c
Opcode Fuzzy Hash: 582e60e14ae2717882d3e8a5b23add1c4a639d9edcb4a93a4e53ccf327798d4f
Instruction Fuzzy Hash: 9281A1715483119FCB24DF24D8459AFB7E8BBC8398F14A82EF885E7251E630E954CB92

Function 00E7EEEB Relevance: 21.2, APIs: 11, Strings: 1, Instructions: 229windowCOMMON

Download Yara Rule

APIs

Part of subcall function 00E2B34E: GetWindowLongW.USER32(?,000000EB), ref: 00E2B35F

PostMessageW.USER32(?,00000111,00000000,00000000), ref: 00E7EF3B
GetFocus.USER32 ref: 00E7EF4B
GetDlgCtrlID.USER32(00000000), ref: 00E7EF56
_memset.LIBCMT ref: 00E7F081
GetMenuItemInfoW.USER32 ref: 00E7F0AC
GetMenuItemCount.USER32(00000000), ref: 00E7F0CC
GetMenuItemID.USER32(?,00000000), ref: 00E7F0DF
GetMenuItemInfoW.USER32(00000000,-00000001,00000001,?), ref: 00E7F113
GetMenuItemInfoW.USER32(00000000,?,00000001,?), ref: 00E7F15B
CheckMenuRadioItem.USER32(?,00000000,?,00000000,00000400), ref: 00E7F193
DefDlgProcW.USER32(?,00000111,?,?,?,?,?,?,?), ref: 00E7F1C8

Strings

0, xrefs: 00E7F079

Memory Dump Source

Source File: 00000000.00000002.1262750966.0000000000E11000.00000020.00000001.01000000.00000003.sdmp, Offset: 00E10000, based on PE: true

Associated: 00000000.00000002.1262729095.0000000000E10000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1262808979.0000000000E9D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1262808979.0000000000EBE000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1262857687.0000000000ECA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1262878803.0000000000ED4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1262878803.0000000000F07000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_e10000_18112024_Dokman_1 Kas_m 2024- Avans_T24-2112184_dekont.jbxd

Similarity

API ID: ItemMenu$Info$CheckCountCtrlFocusLongMessagePostProcRadioWindow_memset
String ID: 0
API String ID: 1296962147-4108050209
Opcode ID: 61c86930b3a234caf479f76c8e9a65f1fb0d299a8d2ed8ea9e12b9e61c2b9d5a
Instruction ID: 2d2fbe10ef1e7b492bf538f072f2f91bf33fdb882c40513fdcd1aca6ac1df625
Opcode Fuzzy Hash: 61c86930b3a234caf479f76c8e9a65f1fb0d299a8d2ed8ea9e12b9e61c2b9d5a
Instruction Fuzzy Hash: 9D818D70209311EFD714CF15D884AABBBE8FF88318F40956EF998A7292D730D905CB52

Function 00E4A867 Relevance: 21.2, APIs: 14, Instructions: 178memoryCOMMON

Download Yara Rule

APIs

Part of subcall function 00E4ABBB: GetUserObjectSecurity.USER32(?,?,?,00000000,?), ref: 00E4ABD7
Part of subcall function 00E4ABBB: GetLastError.KERNEL32(?,00E4A69F,?,?,?), ref: 00E4ABE1
Part of subcall function 00E4ABBB: GetProcessHeap.KERNEL32(00000008,?,?,00E4A69F,?,?,?), ref: 00E4ABF0
Part of subcall function 00E4ABBB: HeapAlloc.KERNEL32(00000000,?,00E4A69F,?,?,?), ref: 00E4ABF7
Part of subcall function 00E4ABBB: GetUserObjectSecurity.USER32(?,?,00000000,?,?), ref: 00E4AC0E

Part of subcall function 00E4AC56: GetProcessHeap.KERNEL32(00000008,00E4A6B5,00000000,00000000,?,00E4A6B5,?), ref: 00E4AC62
Part of subcall function 00E4AC56: HeapAlloc.KERNEL32(00000000,?,00E4A6B5,?), ref: 00E4AC69
Part of subcall function 00E4AC56: InitializeSecurityDescriptor.ADVAPI32(00000000,00000001,?,00E4A6B5,?), ref: 00E4AC7A

GetSecurityDescriptorDacl.ADVAPI32(?,?,?,?), ref: 00E4A8CB
_memset.LIBCMT ref: 00E4A8E0
GetAclInformation.ADVAPI32(?,?,0000000C,00000002), ref: 00E4A8FF
GetLengthSid.ADVAPI32(?), ref: 00E4A910
GetAce.ADVAPI32(?,00000000,?), ref: 00E4A94D
AddAce.ADVAPI32(?,00000002,000000FF,?,?), ref: 00E4A969
GetLengthSid.ADVAPI32(?), ref: 00E4A986
GetProcessHeap.KERNEL32(00000008,-00000008), ref: 00E4A995
HeapAlloc.KERNEL32(00000000), ref: 00E4A99C
GetLengthSid.ADVAPI32(?,00000008,?), ref: 00E4A9BD
CopySid.ADVAPI32(00000000), ref: 00E4A9C4
AddAce.ADVAPI32(?,00000002,000000FF,00000000,?), ref: 00E4A9F5
SetSecurityDescriptorDacl.ADVAPI32(?,00000001,?,00000000), ref: 00E4AA1B
SetUserObjectSecurity.USER32(?,00000004,?), ref: 00E4AA2F

Memory Dump Source

Source File: 00000000.00000002.1262750966.0000000000E11000.00000020.00000001.01000000.00000003.sdmp, Offset: 00E10000, based on PE: true

Associated: 00000000.00000002.1262729095.0000000000E10000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1262808979.0000000000E9D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1262808979.0000000000EBE000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1262857687.0000000000ECA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1262878803.0000000000ED4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1262878803.0000000000F07000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_e10000_18112024_Dokman_1 Kas_m 2024- Avans_T24-2112184_dekont.jbxd

Similarity

API ID: HeapSecurity$AllocDescriptorLengthObjectProcessUser$Dacl$CopyErrorInformationInitializeLast_memset
String ID:
API String ID: 3996160137-0
Opcode ID: 72c016c21f33f42dec320865ba0664d7db811303b5edc8a22eaa23a928910367
Instruction ID: 630b67ede819d2880450f0b1f4bd9944612116cb25b5b6a55f77f523683f1970
Opcode Fuzzy Hash: 72c016c21f33f42dec320865ba0664d7db811303b5edc8a22eaa23a928910367
Instruction Fuzzy Hash: FB516D71900219AFDF00DF91ED85AEEBBBAFF04314F08912AF911B7290D7309A09DB61

Function 00E5CC5C Relevance: 21.2, APIs: 7, Strings: 5, Instructions: 155COMMON

Download Yara Rule

APIs

LoadStringW.USER32(00000066,?,00000FFF), ref: 00E5CCA3
LoadStringW.USER32(?,?,00000FFF,?), ref: 00E5CCC5
__swprintf.LIBCMT ref: 00E5CD1E
__swprintf.LIBCMT ref: 00E5CD37
_wprintf.LIBCMT ref: 00E5CDED
_wprintf.LIBCMT ref: 00E5CE0B

Strings

Line %d (File "%s"):, xrefs: 00E5CD18, 00E5CD31
Error: , xrefs: 00E5CDB5
^ ERROR, xrefs: 00E5CD8F
"%s" (%d) : ==> %s:, xrefs: 00E5CE06
"%s" (%d) : ==> %s:%s%s, xrefs: 00E5CDE8

Memory Dump Source

Source File: 00000000.00000002.1262750966.0000000000E11000.00000020.00000001.01000000.00000003.sdmp, Offset: 00E10000, based on PE: true

Associated: 00000000.00000002.1262729095.0000000000E10000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1262808979.0000000000E9D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1262808979.0000000000EBE000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1262857687.0000000000ECA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1262878803.0000000000ED4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1262878803.0000000000F07000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_e10000_18112024_Dokman_1 Kas_m 2024- Avans_T24-2112184_dekont.jbxd

Similarity

API ID: LoadString__swprintf_wprintf
String ID: Error: $"%s" (%d) : ==> %s:$"%s" (%d) : ==> %s:%s%s$Line %d (File "%s"):$^ ERROR
API String ID: 2889450990-2391861430
Opcode ID: 05fdb5350e346522b8151e4b9da9e1b1e1a1ca22daa90adcda8a45a5ad28cbab
Instruction ID: ed9d52eaf4efed2f3bb8037549c13b6e2569e957d052c4ad959448f31f4dc366
Opcode Fuzzy Hash: 05fdb5350e346522b8151e4b9da9e1b1e1a1ca22daa90adcda8a45a5ad28cbab
Instruction Fuzzy Hash: 24518331900209BACF15EBE0DD56EEEB7B8AF05304F205466F505B2062EB315F99DB61

Function 00E5CA48 Relevance: 21.2, APIs: 7, Strings: 5, Instructions: 151COMMON

Download Yara Rule

APIs

LoadStringW.USER32(00000066,?,00000FFF,00000016), ref: 00E5CA8F
LoadStringW.USER32(00000072,?,00000FFF,?), ref: 00E5CAB0
__swprintf.LIBCMT ref: 00E5CB09
__swprintf.LIBCMT ref: 00E5CB22
_wprintf.LIBCMT ref: 00E5CBCD
_wprintf.LIBCMT ref: 00E5CBEB

Strings

Line %d (File "%s"):, xrefs: 00E5CB03, 00E5CB1C
Error: , xrefs: 00E5CB95
^ ERROR , xrefs: 00E5CB64
"%s" (%d) : ==> %s:, xrefs: 00E5CBE6
"%s" (%d) : ==> %s:%s%s, xrefs: 00E5CBC8

Memory Dump Source

Source File: 00000000.00000002.1262750966.0000000000E11000.00000020.00000001.01000000.00000003.sdmp, Offset: 00E10000, based on PE: true

Associated: 00000000.00000002.1262729095.0000000000E10000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1262808979.0000000000E9D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1262808979.0000000000EBE000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1262857687.0000000000ECA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1262878803.0000000000ED4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1262878803.0000000000F07000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_e10000_18112024_Dokman_1 Kas_m 2024- Avans_T24-2112184_dekont.jbxd

Similarity

API ID: LoadString__swprintf_wprintf
String ID: Error: $"%s" (%d) : ==> %s:$"%s" (%d) : ==> %s:%s%s$Line %d (File "%s"):$^ ERROR
API String ID: 2889450990-3420473620
Opcode ID: 70a834906cf2c184576d7deeddb16b4bbf8a53a93a20a39b09f4f4d9b1225bb3
Instruction ID: b298066e92fa69d37d76ce61a142fed0a8c2fb5cd8a66d2e747f8e3df2a196fa
Opcode Fuzzy Hash: 70a834906cf2c184576d7deeddb16b4bbf8a53a93a20a39b09f4f4d9b1225bb3
Instruction Fuzzy Hash: 46518232900609BECF15EBE0DE56EEEB7B8AF04304F205456F505720A2EB716F99DB61

Function 00E73C06 Relevance: 21.1, APIs: 1, Strings: 11, Instructions: 109COMMON

Download Yara Rule

APIs

CharUpperBuffW.USER32(?,?,?,?,?,?,?,00E72BB5,?,?), ref: 00E73C1D

Strings

HKU, xrefs: 00E73D15
HKEY_CURRENT_USER, xrefs: 00E73CE2
HKCC, xrefs: 00E73CD1
HKEY_LOCAL_MACHINE, xrefs: 00E73C6C
HKEY_USERS, xrefs: 00E73D04
$E, xrefs: 00E73C36
HKLM, xrefs: 00E73C81
HKEY_CURRENT_CONFIG, xrefs: 00E73CC0
HKEY_CLASSES_ROOT, xrefs: 00E73C96
HKCR, xrefs: 00E73CAB
HKCU, xrefs: 00E73CF3

Memory Dump Source

Source File: 00000000.00000002.1262750966.0000000000E11000.00000020.00000001.01000000.00000003.sdmp, Offset: 00E10000, based on PE: true

Associated: 00000000.00000002.1262729095.0000000000E10000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1262808979.0000000000E9D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1262808979.0000000000EBE000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1262857687.0000000000ECA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1262878803.0000000000ED4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1262878803.0000000000F07000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_e10000_18112024_Dokman_1 Kas_m 2024- Avans_T24-2112184_dekont.jbxd

Similarity

API ID: BuffCharUpper
String ID: $E$HKCC$HKCR$HKCU$HKEY_CLASSES_ROOT$HKEY_CURRENT_CONFIG$HKEY_CURRENT_USER$HKEY_LOCAL_MACHINE$HKEY_USERS$HKLM$HKU
API String ID: 3964851224-1752687603
Opcode ID: f9216f55e965ffd7c31f270a1da63e682f098c314267c5eb0dd1cdefe15ac51d
Instruction ID: a4ee1350cb6a8ef057ab1172871d6bd94ef1ad5968953f11415f13b964c3d094
Opcode Fuzzy Hash: f9216f55e965ffd7c31f270a1da63e682f098c314267c5eb0dd1cdefe15ac51d
Instruction Fuzzy Hash: B14186701002998BCF50EF60E952AEB7365BF91344F50B818FD597B296EB719E0BDB10

Function 00E555BD Relevance: 19.7, APIs: 13, Instructions: 213windowCOMMON

Download Yara Rule

APIs

_memset.LIBCMT ref: 00E555D7
GetMenuItemInfoW.USER32(00000000,00000007,00000000,00000030), ref: 00E55664
GetMenuItemCount.USER32(00ED1708), ref: 00E556ED
DeleteMenu.USER32(00ED1708,00000005,00000000,000000F5,?,?), ref: 00E5577D
DeleteMenu.USER32(00ED1708,00000004,00000000), ref: 00E55785
DeleteMenu.USER32(00ED1708,00000006,00000000), ref: 00E5578D
DeleteMenu.USER32(00ED1708,00000003,00000000), ref: 00E55795
GetMenuItemCount.USER32(00ED1708), ref: 00E5579D
SetMenuItemInfoW.USER32(00ED1708,00000004,00000000,00000030), ref: 00E557D3
GetCursorPos.USER32(?), ref: 00E557DD
SetForegroundWindow.USER32(00000000), ref: 00E557E6
TrackPopupMenuEx.USER32(00ED1708,00000000,?,00000000,00000000,00000000), ref: 00E557F9
PostMessageW.USER32(00000000,00000000,00000000,00000000), ref: 00E55805

Memory Dump Source

Source File: 00000000.00000002.1262750966.0000000000E11000.00000020.00000001.01000000.00000003.sdmp, Offset: 00E10000, based on PE: true

Associated: 00000000.00000002.1262729095.0000000000E10000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1262808979.0000000000E9D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1262808979.0000000000EBE000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1262857687.0000000000ECA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1262878803.0000000000ED4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1262878803.0000000000F07000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_e10000_18112024_Dokman_1 Kas_m 2024- Avans_T24-2112184_dekont.jbxd

Similarity

API ID: Menu$DeleteItem$CountInfo$CursorForegroundMessagePopupPostTrackWindow_memset
String ID:
API String ID: 3993528054-0
Opcode ID: 1e6e39508b689100c21b560548c3378009015c4272842a1b55b8ea7bc7b30a21
Instruction ID: 5016a3bf12b78aa2ca3fc207f20a8bac3c2b22e0b51a50d224a36da96f06be19
Opcode Fuzzy Hash: 1e6e39508b689100c21b560548c3378009015c4272842a1b55b8ea7bc7b30a21
Instruction Fuzzy Hash: 0C714472640655FFEB208B15CC59FAABFA4FF04369F240606FA197A1D1C7B0AC18CB90

Function 00E4A14D Relevance: 19.4, APIs: 8, Strings: 3, Instructions: 127registryshareCOMMON

Download Yara Rule

APIs

_memset.LIBCMT ref: 00E4A1DC
WNetAddConnection2W.MPR(?,?,?,00000000), ref: 00E4A211
RegConnectRegistryW.ADVAPI32(?,80000002,?), ref: 00E4A22D
RegOpenKeyExW.ADVAPI32(?,?,00000000,00020019,?,?,SOFTWARE\Classes\), ref: 00E4A249
RegQueryValueExW.ADVAPI32(?,00000000,00000000,00000000,?,?,?,SOFTWARE\Classes\), ref: 00E4A273
CLSIDFromString.OLE32(?,?,?,SOFTWARE\Classes\), ref: 00E4A29B
RegCloseKey.ADVAPI32(?,?,SOFTWARE\Classes\), ref: 00E4A2A6
RegCloseKey.ADVAPI32(?,?,SOFTWARE\Classes\), ref: 00E4A2AB

Strings

\CLSID, xrefs: 00E4A193
\IPC$, xrefs: 00E4A1F3
SOFTWARE\Classes\, xrefs: 00E4A17D

Memory Dump Source

Source File: 00000000.00000002.1262750966.0000000000E11000.00000020.00000001.01000000.00000003.sdmp, Offset: 00E10000, based on PE: true

Associated: 00000000.00000002.1262729095.0000000000E10000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1262808979.0000000000E9D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1262808979.0000000000EBE000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1262857687.0000000000ECA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1262878803.0000000000ED4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1262878803.0000000000F07000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_e10000_18112024_Dokman_1 Kas_m 2024- Avans_T24-2112184_dekont.jbxd

Similarity

API ID: Close$ConnectConnection2FromOpenQueryRegistryStringValue_memset
String ID: SOFTWARE\Classes\$\CLSID$\IPC$
API String ID: 1687751970-22481851
Opcode ID: c888bf1c48a01516f64f1d0ae5a07c89d11141184893aae042554604d8fc3d26
Instruction ID: efebfa18e9d963c2f7a1b033d97ae74b4109b4df3fc95486ee22c8f925640996
Opcode Fuzzy Hash: c888bf1c48a01516f64f1d0ae5a07c89d11141184893aae042554604d8fc3d26
Instruction Fuzzy Hash: 96410576C10229AFDF25EBA4EC85DEEB7B8BF04314F04506AE901B31A1EB719E45CB50

Function 00E567E9 Relevance: 19.4, APIs: 10, Strings: 1, Instructions: 107windowCOMMON

Download Yara Rule

APIs

__swprintf.LIBCMT ref: 00E567FD
__swprintf.LIBCMT ref: 00E5680A

Part of subcall function 00E3172B: __woutput_l.LIBCMT ref: 00E31784

FindResourceW.KERNEL32(?,?,0000000E), ref: 00E56834
LoadResource.KERNEL32(?,00000000), ref: 00E56840
LockResource.KERNEL32(00000000), ref: 00E5684D
FindResourceW.KERNEL32(?,?,00000003), ref: 00E5686D
LoadResource.KERNEL32(?,00000000), ref: 00E5687F
SizeofResource.KERNEL32(?,00000000), ref: 00E5688E
LockResource.KERNEL32(?), ref: 00E5689A
CreateIconFromResourceEx.USER32(?,?,00000001,00030000,00000000,00000000,00000000), ref: 00E568F9

Strings

5, xrefs: 00E567F6

Memory Dump Source

Source File: 00000000.00000002.1262750966.0000000000E11000.00000020.00000001.01000000.00000003.sdmp, Offset: 00E10000, based on PE: true

Associated: 00000000.00000002.1262729095.0000000000E10000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1262808979.0000000000E9D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1262808979.0000000000EBE000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1262857687.0000000000ECA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1262878803.0000000000ED4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1262878803.0000000000F07000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_e10000_18112024_Dokman_1 Kas_m 2024- Avans_T24-2112184_dekont.jbxd

Similarity

API ID: Resource$FindLoadLock__swprintf$CreateFromIconSizeof__woutput_l
String ID: 5
API String ID: 1433390588-3632891597
Opcode ID: 92b7a670b9ae04cdb7402ff82a67ca69a1ce9fcf71106a0fdae8a1db277828e9
Instruction ID: fad15f2a9b45526920b3bd4ce2c8f1937e929b81a9cf2af8715f052aa35e41f7
Opcode Fuzzy Hash: 92b7a670b9ae04cdb7402ff82a67ca69a1ce9fcf71106a0fdae8a1db277828e9
Instruction Fuzzy Hash: F231AE7190125AAFDB049F61ED49ABB7BA8EF08345F408826FD02F3150E730D919DB60

Function 00E525B5 Relevance: 19.3, APIs: 6, Strings: 5, Instructions: 74windowCOMMON

Download Yara Rule

APIs

GetModuleHandleW.KERNEL32(00000000,?,?,00000FFF,00000000,?,00E836F4,00000010,?,Bad directive syntax error,00EADC00,00000000,?,?,?,>>>AUTOIT SCRIPT<<<), ref: 00E525D6
LoadStringW.USER32(00000000,?,00E836F4,00000010), ref: 00E525DD
_wprintf.LIBCMT ref: 00E52610
__swprintf.LIBCMT ref: 00E52632
MessageBoxW.USER32(00000000,00000001,00000001,00011010), ref: 00E526A1

Strings

Line %d (File "%s"):, xrefs: 00E52647
%s (%d) : ==> %s.: %s %s, xrefs: 00E5260B
., xrefs: 00E52687
Line %d:, xrefs: 00E5262C
Error: , xrefs: 00E5266F

Memory Dump Source

Source File: 00000000.00000002.1262750966.0000000000E11000.00000020.00000001.01000000.00000003.sdmp, Offset: 00E10000, based on PE: true

Associated: 00000000.00000002.1262729095.0000000000E10000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1262808979.0000000000E9D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1262808979.0000000000EBE000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1262857687.0000000000ECA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1262878803.0000000000ED4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1262878803.0000000000F07000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_e10000_18112024_Dokman_1 Kas_m 2024- Avans_T24-2112184_dekont.jbxd

Similarity

API ID: HandleLoadMessageModuleString__swprintf_wprintf
String ID: Error: $%s (%d) : ==> %s.: %s %s$.$Line %d (File "%s"):$Line %d:
API String ID: 1080873982-4153970271
Opcode ID: 51051e8a5f1aa7d3c7dfcdacbbabc9603b3b060bed1618536d9cd3dd133fe0df
Instruction ID: a3e04bd1726b4a836bde98a52cb5b7582fdf1cf2b0548e39dac6fb9d3170dfe0
Opcode Fuzzy Hash: 51051e8a5f1aa7d3c7dfcdacbbabc9603b3b060bed1618536d9cd3dd133fe0df
Instruction Fuzzy Hash: 8F217E3290021AFFCF15BBA0CC0AFEE7BB8BF19304F04545AF505760A2DA71A659DB51

Function 00E57AD9 Relevance: 19.3, APIs: 5, Strings: 6, Instructions: 73COMMON

Download Yara Rule

APIs

mciSendStringW.WINMM(status PlayMe mode,?,00000100,00000000), ref: 00E57B42
mciSendStringW.WINMM(close PlayMe,00000000,00000000,00000000), ref: 00E57B58
mciSendStringW.WINMM(?,00000000,00000000,00000000), ref: 00E57B69
mciSendStringW.WINMM(play PlayMe wait,00000000,00000000,00000000), ref: 00E57B7B
mciSendStringW.WINMM(play PlayMe,00000000,00000000,00000000), ref: 00E57B8C

Strings

alias PlayMe, xrefs: 00E57B1B
play PlayMe, xrefs: 00E57B87
status PlayMe mode, xrefs: 00E57B3D
open , xrefs: 00E57AF1
play PlayMe wait, xrefs: 00E57B76
close PlayMe, xrefs: 00E57B53, 00E57B80

Memory Dump Source

Source File: 00000000.00000002.1262750966.0000000000E11000.00000020.00000001.01000000.00000003.sdmp, Offset: 00E10000, based on PE: true

Associated: 00000000.00000002.1262729095.0000000000E10000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1262808979.0000000000E9D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1262808979.0000000000EBE000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1262857687.0000000000ECA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1262878803.0000000000ED4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1262878803.0000000000F07000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_e10000_18112024_Dokman_1 Kas_m 2024- Avans_T24-2112184_dekont.jbxd

Similarity

API ID: SendString
String ID: alias PlayMe$close PlayMe$open $play PlayMe$play PlayMe wait$status PlayMe mode
API String ID: 890592661-1007645807
Opcode ID: 33504a58950a3318d246b50e4715efd18f0a6aa8ef94bbee7742082f8158c0f8
Instruction ID: e4365d825053ddc07212f5eadad1e0f4c6e5b0e8c48d1b6077bf1c1df7a77553
Opcode Fuzzy Hash: 33504a58950a3318d246b50e4715efd18f0a6aa8ef94bbee7742082f8158c0f8
Instruction Fuzzy Hash: B21198B165025979D720B771DD4AEFF7BBCEBD1B14F10281A7411B20D1DA711A89C5B0

Function 00E5778F Relevance: 19.3, APIs: 10, Strings: 1, Instructions: 72sleepwindowtimeCOMMON

Download Yara Rule

APIs

timeGetTime.WINMM ref: 00E57794

Part of subcall function 00E2DC38: timeGetTime.WINMM(?,75A4B400,00E858AB), ref: 00E2DC3C

Sleep.KERNEL32(0000000A), ref: 00E577C0
EnumThreadWindows.USER32(?,Function_00047744,00000000), ref: 00E577E4
FindWindowExW.USER32(?,00000000,BUTTON,00000000), ref: 00E57806
SetActiveWindow.USER32 ref: 00E57825
SendMessageW.USER32(00000000,000000F5,00000000,00000000), ref: 00E57833
SendMessageW.USER32(00000010,00000000,00000000), ref: 00E57852
Sleep.KERNEL32(000000FA), ref: 00E5785D
IsWindow.USER32 ref: 00E57869
EndDialog.USER32(00000000), ref: 00E5787A

Strings

BUTTON, xrefs: 00E577F8

Memory Dump Source

Source File: 00000000.00000002.1262750966.0000000000E11000.00000020.00000001.01000000.00000003.sdmp, Offset: 00E10000, based on PE: true

Associated: 00000000.00000002.1262729095.0000000000E10000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1262808979.0000000000E9D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1262808979.0000000000EBE000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1262857687.0000000000ECA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1262878803.0000000000ED4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1262878803.0000000000F07000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_e10000_18112024_Dokman_1 Kas_m 2024- Avans_T24-2112184_dekont.jbxd

Similarity

API ID: Window$MessageSendSleepTimetime$ActiveDialogEnumFindThreadWindows
String ID: BUTTON
API String ID: 1194449130-3405671355
Opcode ID: 8c41da6ac5154d33862990834ed9ffbd647f20205eb950158b4e2c615a22ea52
Instruction ID: 8b2a827fcab7a9ac03003a4c726c604ad4e6d477883825ddece653838fba6ad8
Opcode Fuzzy Hash: 8c41da6ac5154d33862990834ed9ffbd647f20205eb950158b4e2c615a22ea52
Instruction Fuzzy Hash: EC216F71209215AFE7045F32FD89B263F69FB4834AB002817F956B2172DB714C2CCB22

Function 00E602EE Relevance: 18.3, APIs: 12, Instructions: 282comCOMMON

Download Yara Rule

APIs

Part of subcall function 00E1936C: __swprintf.LIBCMT ref: 00E193AB
Part of subcall function 00E1936C: __itow.LIBCMT ref: 00E193DF

CoInitialize.OLE32(00000000), ref: 00E6034B
SHGetSpecialFolderLocation.SHELL32(00000000,00000000,?), ref: 00E603DE
SHGetDesktopFolder.SHELL32(?), ref: 00E603F2
CoCreateInstance.OLE32(00E9DA8C,00000000,00000001,00EC3CF8,?), ref: 00E6043E
SHCreateShellItem.SHELL32(00000000,00000000,?,00000003), ref: 00E604AD
CoTaskMemFree.OLE32(?,?), ref: 00E60505
_memset.LIBCMT ref: 00E60542
SHBrowseForFolderW.SHELL32(?), ref: 00E6057E
SHGetPathFromIDListW.SHELL32(00000000,?), ref: 00E605A1
CoTaskMemFree.OLE32(00000000), ref: 00E605A8
CoTaskMemFree.OLE32(00000000,00000001,00000000), ref: 00E605DF
CoUninitialize.OLE32(00000001,00000000), ref: 00E605E1

Memory Dump Source

Source File: 00000000.00000002.1262750966.0000000000E11000.00000020.00000001.01000000.00000003.sdmp, Offset: 00E10000, based on PE: true

Associated: 00000000.00000002.1262729095.0000000000E10000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1262808979.0000000000E9D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1262808979.0000000000EBE000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1262857687.0000000000ECA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1262878803.0000000000ED4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1262878803.0000000000F07000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_e10000_18112024_Dokman_1 Kas_m 2024- Avans_T24-2112184_dekont.jbxd

Similarity

API ID: FolderFreeTask$Create$BrowseDesktopFromInitializeInstanceItemListLocationPathShellSpecialUninitialize__itow__swprintf_memset
String ID:
API String ID: 1246142700-0
Opcode ID: 019c27d6b2685e9b77b34e86242590552eeaf1d93b2dd6864fcace87b74d5736
Instruction ID: 8680d9fa31a23b7119ad1450ba7514cfde2e126a7f4525502321c90d5e84cec3
Opcode Fuzzy Hash: 019c27d6b2685e9b77b34e86242590552eeaf1d93b2dd6864fcace87b74d5736
Instruction Fuzzy Hash: 5AB1F874A00218AFDB14DFA4D888DAEBBF9FF48344B149499E916EB251DB30ED45CB50

Function 00E52E5B Relevance: 18.2, APIs: 12, Instructions: 185keyboardCOMMON

Download Yara Rule

APIs

GetKeyboardState.USER32(?), ref: 00E52ED6
SetKeyboardState.USER32(?), ref: 00E52F41
GetAsyncKeyState.USER32(000000A0), ref: 00E52F61
GetKeyState.USER32(000000A0), ref: 00E52F78
GetAsyncKeyState.USER32(000000A1), ref: 00E52FA7
GetKeyState.USER32(000000A1), ref: 00E52FB8
GetAsyncKeyState.USER32(00000011), ref: 00E52FE4
GetKeyState.USER32(00000011), ref: 00E52FF2
GetAsyncKeyState.USER32(00000012), ref: 00E5301B
GetKeyState.USER32(00000012), ref: 00E53029
GetAsyncKeyState.USER32(0000005B), ref: 00E53052
GetKeyState.USER32(0000005B), ref: 00E53060

Memory Dump Source

Source File: 00000000.00000002.1262750966.0000000000E11000.00000020.00000001.01000000.00000003.sdmp, Offset: 00E10000, based on PE: true

Associated: 00000000.00000002.1262729095.0000000000E10000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1262808979.0000000000E9D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1262808979.0000000000EBE000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1262857687.0000000000ECA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1262878803.0000000000ED4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1262878803.0000000000F07000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_e10000_18112024_Dokman_1 Kas_m 2024- Avans_T24-2112184_dekont.jbxd

Similarity

API ID: State$Async$Keyboard
String ID:
API String ID: 541375521-0
Opcode ID: aee4623feca2e4a9eba9e35fc9c148afe486748c16576618ed3bddef063f7180
Instruction ID: 0ca2b67c680c210addfca0cad8e0d56ef883580cd32515e5a650200fc1a02faa
Opcode Fuzzy Hash: aee4623feca2e4a9eba9e35fc9c148afe486748c16576618ed3bddef063f7180
Instruction Fuzzy Hash: 9651EA60A0879429FB35DB7488117EABFF45F12389F085D9ECAC2761C2DE549B8CC761

Function 00E4ED02 Relevance: 18.2, APIs: 12, Instructions: 174COMMON

Download Yara Rule

APIs

GetDlgItem.USER32(?,00000001), ref: 00E4ED1E
GetWindowRect.USER32(00000000,?), ref: 00E4ED30
MoveWindow.USER32(00000001,0000000A,?,00000001,?,00000000), ref: 00E4ED8E
GetDlgItem.USER32(?,00000002), ref: 00E4ED99
GetWindowRect.USER32(00000000,?), ref: 00E4EDAB
MoveWindow.USER32(00000001,?,00000000,00000001,?,00000000), ref: 00E4EE01
GetDlgItem.USER32(?,000003E9), ref: 00E4EE0F
GetWindowRect.USER32(00000000,?), ref: 00E4EE20
MoveWindow.USER32(00000000,0000000A,00000000,?,?,00000000), ref: 00E4EE63
GetDlgItem.USER32(?,000003EA), ref: 00E4EE71
MoveWindow.USER32(00000000,0000000A,0000000A,?,-00000005,00000000), ref: 00E4EE8E
InvalidateRect.USER32(?,00000000,00000001), ref: 00E4EE9B

Memory Dump Source

Source File: 00000000.00000002.1262750966.0000000000E11000.00000020.00000001.01000000.00000003.sdmp, Offset: 00E10000, based on PE: true

Associated: 00000000.00000002.1262729095.0000000000E10000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1262808979.0000000000E9D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1262808979.0000000000EBE000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1262857687.0000000000ECA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1262878803.0000000000ED4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1262878803.0000000000F07000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_e10000_18112024_Dokman_1 Kas_m 2024- Avans_T24-2112184_dekont.jbxd

Similarity

API ID: Window$ItemMoveRect$Invalidate
String ID:
API String ID: 3096461208-0
Opcode ID: f85ee47e30e8fc537342537110a8265725c7d4af395e4f9d876c129a1b595559
Instruction ID: 8c855be52726f463cea2fc84156db89aebb2c9d397d4211b0d469011f18d96be
Opcode Fuzzy Hash: f85ee47e30e8fc537342537110a8265725c7d4af395e4f9d876c129a1b595559
Instruction Fuzzy Hash: 475112B1B00215AFDB18CF79DD85AAEBBBAFB88714F14812EF519E7291D7709D048B10

Function 00E2B73E Relevance: 18.2, APIs: 12, Instructions: 170timeCOMMON

Download Yara Rule

APIs

Part of subcall function 00E2B9FF: InvalidateRect.USER32(?,00000000,00000001,?,?,?,00E2B759,?,00000000,?,?,?,?,00E2B72B,00000000,?), ref: 00E2BA58

DestroyWindow.USER32(?,?,?,?,?,?,?,?,?,?,00000000,?,?,?,?,00E2B72B), ref: 00E2B7F6
KillTimer.USER32(00000000,?,00000000,?,?,?,?,00E2B72B,00000000,?,?,00E2B2EF,?,?), ref: 00E2B88D
DestroyAcceleratorTable.USER32(00000000), ref: 00E8D8A6
ImageList_Destroy.COMCTL32(00000000,?,00000000,?,?,?,?,00E2B72B,00000000,?,?,00E2B2EF,?,?), ref: 00E8D8D7
ImageList_Destroy.COMCTL32(00000000,?,00000000,?,?,?,?,00E2B72B,00000000,?,?,00E2B2EF,?,?), ref: 00E8D8EE
ImageList_Destroy.COMCTL32(00000000,?,00000000,?,?,?,?,00E2B72B,00000000,?,?,00E2B2EF,?,?), ref: 00E8D90A
DeleteObject.GDI32(00000000), ref: 00E8D91C

Memory Dump Source

Source File: 00000000.00000002.1262750966.0000000000E11000.00000020.00000001.01000000.00000003.sdmp, Offset: 00E10000, based on PE: true

Associated: 00000000.00000002.1262729095.0000000000E10000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1262808979.0000000000E9D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1262808979.0000000000EBE000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1262857687.0000000000ECA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1262878803.0000000000ED4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1262878803.0000000000F07000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_e10000_18112024_Dokman_1 Kas_m 2024- Avans_T24-2112184_dekont.jbxd

Similarity

API ID: Destroy$ImageList_$AcceleratorDeleteInvalidateKillObjectRectTableTimerWindow
String ID:
API String ID: 641708696-0
Opcode ID: 96c100cafd58c4f4af4e18e8e1fe6a2eb8f0abfe730601e32923f2a5ea8ddc5e
Instruction ID: 9fec0e4c70d08a8a9630133e07ed94f3c9c031694e033b11ba710450fe9ddda2
Opcode Fuzzy Hash: 96c100cafd58c4f4af4e18e8e1fe6a2eb8f0abfe730601e32923f2a5ea8ddc5e
Instruction Fuzzy Hash: 5C61AC30505620EFDB299F16FD88B65B7F5FF84319F14215BE04AB7AA0C770A894CB40

Function 00E2B40A Relevance: 18.1, APIs: 12, Instructions: 131COMMON

Download Yara Rule

APIs

Part of subcall function 00E2B526: GetWindowLongW.USER32(?,000000EB), ref: 00E2B537

GetSysColor.USER32(0000000F), ref: 00E2B438

Memory Dump Source

Source File: 00000000.00000002.1262750966.0000000000E11000.00000020.00000001.01000000.00000003.sdmp, Offset: 00E10000, based on PE: true

Associated: 00000000.00000002.1262729095.0000000000E10000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1262808979.0000000000E9D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1262808979.0000000000EBE000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1262857687.0000000000ECA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1262878803.0000000000ED4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1262878803.0000000000F07000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_e10000_18112024_Dokman_1 Kas_m 2024- Avans_T24-2112184_dekont.jbxd

Similarity

API ID: ColorLongWindow
String ID:
API String ID: 259745315-0
Opcode ID: 7813427ba5f93582e5c5a8d0d0759230683cf3cda7ea91758376c10728b62e70
Instruction ID: 36aad738a1a385709ef9e16402920c5fcb2aff6ab0f1a087e81026fa93285235
Opcode Fuzzy Hash: 7813427ba5f93582e5c5a8d0d0759230683cf3cda7ea91758376c10728b62e70
Instruction Fuzzy Hash: 1141B231145124AFDB206F29EC89BB93B66EB06734F145262FD79AE1E6E7308C41D721

Function 00E5690B Relevance: 18.1, APIs: 12, Instructions: 113COMMON

Download Yara Rule

APIs

_wcschr.LIBCMT ref: 00E56923
_wcscpy.LIBCMT ref: 00E56934
__wsplitpath.LIBCMT ref: 00E56958
__wsplitpath.LIBCMT ref: 00E56979
_wcscpy.LIBCMT ref: 00E5699B
_wcscpy.LIBCMT ref: 00E569B9
_wcscpy.LIBCMT ref: 00E569C7
_wcscat.LIBCMT ref: 00E569D6
_wcscat.LIBCMT ref: 00E56A2B
_wcscat.LIBCMT ref: 00E56A61
_wcscat.LIBCMT ref: 00E56A73

Memory Dump Source

Source File: 00000000.00000002.1262750966.0000000000E11000.00000020.00000001.01000000.00000003.sdmp, Offset: 00E10000, based on PE: true

Associated: 00000000.00000002.1262729095.0000000000E10000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1262808979.0000000000E9D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1262808979.0000000000EBE000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1262857687.0000000000ECA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1262878803.0000000000ED4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1262878803.0000000000F07000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_e10000_18112024_Dokman_1 Kas_m 2024- Avans_T24-2112184_dekont.jbxd

Similarity

API ID: _wcscat_wcscpy$__wsplitpath$_wcschr
String ID:
API String ID: 136442275-0
Opcode ID: b7a2a4f02fbf51dad35bd1b2324fa702912141cb50a33f92733ab14a7f5ce16b
Instruction ID: 0abaaa52b4e34a883c7fdcc3207855ec6541a23c20532ff7ade18976955f8ced
Opcode Fuzzy Hash: b7a2a4f02fbf51dad35bd1b2324fa702912141cb50a33f92733ab14a7f5ce16b
Instruction Fuzzy Hash: A0412C7684511CAECF61EB90CC55DCAB7BCAF44300F4065A6BA49B2051EA30ABE8CF54

Function 00E5D76A Relevance: 17.7, APIs: 3, Strings: 7, Instructions: 180COMMON

Download Yara Rule

APIs

CharLowerBuffW.USER32(00EADC00,00EADC00,00EADC00), ref: 00E5D7CE
GetDriveTypeW.KERNEL32(?,00EC3A70,00000061), ref: 00E5D898
_wcscpy.LIBCMT ref: 00E5D8C2

Strings

all, xrefs: 00E5D7D4
cdrom, xrefs: 00E5D7EA
network, xrefs: 00E5D82C
ramdisk, xrefs: 00E5D842
fixed, xrefs: 00E5D816
removable, xrefs: 00E5D800
unknown, xrefs: 00E5D859

Memory Dump Source

Source File: 00000000.00000002.1262750966.0000000000E11000.00000020.00000001.01000000.00000003.sdmp, Offset: 00E10000, based on PE: true

Associated: 00000000.00000002.1262729095.0000000000E10000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1262808979.0000000000E9D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1262808979.0000000000EBE000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1262857687.0000000000ECA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1262878803.0000000000ED4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1262878803.0000000000F07000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_e10000_18112024_Dokman_1 Kas_m 2024- Avans_T24-2112184_dekont.jbxd

Similarity

API ID: BuffCharDriveLowerType_wcscpy
String ID: all$cdrom$fixed$network$ramdisk$removable$unknown
API String ID: 2820617543-1000479233
Opcode ID: 22cb6482c8a6430eb2725c73387e3bbd32d92bfd477e1c8bbec9c5ad9310c5e0
Instruction ID: ff95ce6bb2ea599544a107c1bde88d5add9c1949a8cfa4c2a0248df2aed4709e
Opcode Fuzzy Hash: 22cb6482c8a6430eb2725c73387e3bbd32d92bfd477e1c8bbec9c5ad9310c5e0
Instruction Fuzzy Hash: 4F518031108340AFC714EF14DC92AAAB7E5EF84315F10A92DF99A772A2DB71DD49CA42

Function 00E1936C Relevance: 17.6, APIs: 6, Strings: 4, Instructions: 145COMMON

Download Yara Rule

APIs

__swprintf.LIBCMT ref: 00E193AB
__itow.LIBCMT ref: 00E193DF

Part of subcall function 00E31557: _xtow@16.LIBCMT ref: 00E31578

Strings

0x%p, xrefs: 00E84CAD
%.15g, xrefs: 00E193A5
True, xrefs: 00E84C8C
False, xrefs: 00E84C93

Memory Dump Source

Source File: 00000000.00000002.1262750966.0000000000E11000.00000020.00000001.01000000.00000003.sdmp, Offset: 00E10000, based on PE: true

Associated: 00000000.00000002.1262729095.0000000000E10000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1262808979.0000000000E9D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1262808979.0000000000EBE000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1262857687.0000000000ECA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1262878803.0000000000ED4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1262878803.0000000000F07000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_e10000_18112024_Dokman_1 Kas_m 2024- Avans_T24-2112184_dekont.jbxd

Similarity

API ID: __itow__swprintf_xtow@16
String ID: %.15g$0x%p$False$True
API String ID: 1502193981-2263619337
Opcode ID: 958fced730a491c27d3f76f970f5fd063175467917ac2bd928d670f8ad159cba
Instruction ID: 50ac4bd0303b82df8c981b987074a177b3648881fabb90423b620dd9b77fadb9
Opcode Fuzzy Hash: 958fced730a491c27d3f76f970f5fd063175467917ac2bd928d670f8ad159cba
Instruction Fuzzy Hash: 9641F571500205ABEB24EB74D951EEAB7F8EF44304F20646EE55EF71C2EA319981CB10

Function 00E7A1B6 Relevance: 17.6, APIs: 9, Strings: 1, Instructions: 101windowCOMMON

Download Yara Rule

APIs

MoveWindow.USER32(?,?,?,000000FF,000000FF,00000000,?,?,000000FF,000000FF,?,?,static,00000000,00000000,?), ref: 00E7A259
CreateCompatibleDC.GDI32(00000000), ref: 00E7A260
SendMessageW.USER32(?,00000173,00000000,00000000), ref: 00E7A273
SelectObject.GDI32(00000000,00000000), ref: 00E7A27B
GetPixel.GDI32(00000000,00000000,00000000), ref: 00E7A286
DeleteDC.GDI32(00000000), ref: 00E7A28F
GetWindowLongW.USER32(?,000000EC), ref: 00E7A299
SetLayeredWindowAttributes.USER32(?,00000000,00000000,00000001), ref: 00E7A2AD
DestroyWindow.USER32(?,?,?,000000FF,000000FF,?,?,static,00000000,00000000,?,?,00000000,00000000,?,?), ref: 00E7A2B9

Strings

static, xrefs: 00E7A1F1

Memory Dump Source

Source File: 00000000.00000002.1262750966.0000000000E11000.00000020.00000001.01000000.00000003.sdmp, Offset: 00E10000, based on PE: true

Associated: 00000000.00000002.1262729095.0000000000E10000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1262808979.0000000000E9D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1262808979.0000000000EBE000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1262857687.0000000000ECA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1262878803.0000000000ED4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1262878803.0000000000F07000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_e10000_18112024_Dokman_1 Kas_m 2024- Avans_T24-2112184_dekont.jbxd

Similarity

API ID: Window$AttributesCompatibleCreateDeleteDestroyLayeredLongMessageMoveObjectPixelSelectSend
String ID: static
API String ID: 2559357485-2160076837
Opcode ID: ff0f2042178e41ce96426f5c512f840831876bb49d999d4d336f0a19e72631c3
Instruction ID: 9c5e83bdb543df0b46cb7446c5197999905c98d9a40b3bec633843fee19b4968
Opcode Fuzzy Hash: ff0f2042178e41ce96426f5c512f840831876bb49d999d4d336f0a19e72631c3
Instruction Fuzzy Hash: AF31AD32105224AFDF115FA5DC09FEE3B69FF49324F140226FA19B21A1C731D821DBA5

Function 00E56F02 Relevance: 17.6, APIs: 9, Strings: 1, Instructions: 72networkCOMMON

Download Yara Rule

APIs

WSAStartup.WSOCK32(00000101,?), ref: 00E56F1D
gethostname.WSOCK32(?,00000100), ref: 00E56F37
gethostbyname.WSOCK32(?), ref: 00E56F44
_wcscpy.LIBCMT ref: 00E56F6C
inet_ntoa.WSOCK32(?), ref: 00E56F8A
_strcat.LIBCMT ref: 00E56F98
_wcscpy.LIBCMT ref: 00E56FAF
WSACleanup.WSOCK32 ref: 00E56FBD
_wcscpy.LIBCMT ref: 00E56FCB

Strings

0.0.0.0, xrefs: 00E56F66

Memory Dump Source

Source File: 00000000.00000002.1262750966.0000000000E11000.00000020.00000001.01000000.00000003.sdmp, Offset: 00E10000, based on PE: true

Associated: 00000000.00000002.1262729095.0000000000E10000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1262808979.0000000000E9D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1262808979.0000000000EBE000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1262857687.0000000000ECA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1262878803.0000000000ED4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1262878803.0000000000F07000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_e10000_18112024_Dokman_1 Kas_m 2024- Avans_T24-2112184_dekont.jbxd

Similarity

API ID: _wcscpy$CleanupStartup_strcatgethostbynamegethostnameinet_ntoa
String ID: 0.0.0.0
API String ID: 2620052-3771769585
Opcode ID: 3177c18e185128116c0f512c2294d3102f6b22a1645049f9449817d6f857eacc
Instruction ID: e9dc49cc93e1fdaa5f1d1eb344953d32a4ee89a9a29ef2b40dbcb798a5bd20cb
Opcode Fuzzy Hash: 3177c18e185128116c0f512c2294d3102f6b22a1645049f9449817d6f857eacc
Instruction Fuzzy Hash: 66112772A08228AFCB24AB70EC09EDA77FCEF00715F411467F545B7091EF709A898B60

Function 00E3500E Relevance: 16.8, APIs: 11, Instructions: 257COMMON

Download Yara Rule

APIs

_memset.LIBCMT ref: 00E35047

Part of subcall function 00E37C0E: __getptd_noexit.LIBCMT ref: 00E37C0E

__gmtime64_s.LIBCMT ref: 00E350E0
__gmtime64_s.LIBCMT ref: 00E35116
__gmtime64_s.LIBCMT ref: 00E35133
__allrem.LIBCMT ref: 00E35189
__ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z.LIBCMT ref: 00E351A5
__allrem.LIBCMT ref: 00E351BC
__ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z.LIBCMT ref: 00E351DA
__allrem.LIBCMT ref: 00E351F1
__ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z.LIBCMT ref: 00E3520F
__invoke_watson.LIBCMT ref: 00E35280

Memory Dump Source

Source File: 00000000.00000002.1262750966.0000000000E11000.00000020.00000001.01000000.00000003.sdmp, Offset: 00E10000, based on PE: true

Associated: 00000000.00000002.1262729095.0000000000E10000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1262808979.0000000000E9D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1262808979.0000000000EBE000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1262857687.0000000000ECA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1262878803.0000000000ED4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1262878803.0000000000F07000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_e10000_18112024_Dokman_1 Kas_m 2024- Avans_T24-2112184_dekont.jbxd

Similarity

API ID: Unothrow_t@std@@@__allrem__ehfuncinfo$??2@__gmtime64_s$__getptd_noexit__invoke_watson_memset
String ID:
API String ID: 384356119-0
Opcode ID: d5e017027a87c5018ad803d53256558374d4b82fb585307daa6d96de3ac92c4c
Instruction ID: 08de9eed03d72bc9210751dcf37556dfe8a21a62e5d487e8f42d909b7c7a893e
Opcode Fuzzy Hash: d5e017027a87c5018ad803d53256558374d4b82fb585307daa6d96de3ac92c4c
Instruction Fuzzy Hash: 7171C573A01F16ABD7149E68DC45B6ABBF8AF44764F14622AF510F6381E770D940CBD0

Function 00E54DDD Relevance: 16.7, APIs: 11, Instructions: 189windowsleepCOMMON

Download Yara Rule

APIs

_memset.LIBCMT ref: 00E54DF8
GetMenuItemInfoW.USER32(00ED1708,000000FF,00000000,00000030), ref: 00E54E59
SetMenuItemInfoW.USER32(00ED1708,00000004,00000000,00000030), ref: 00E54E8F
Sleep.KERNEL32(000001F4), ref: 00E54EA1
GetMenuItemCount.USER32(?), ref: 00E54EE5
GetMenuItemID.USER32(?,00000000), ref: 00E54F01
GetMenuItemID.USER32(?,-00000001), ref: 00E54F2B
GetMenuItemID.USER32(?,?), ref: 00E54F70
CheckMenuRadioItem.USER32(?,00000000,?,00000000,00000400), ref: 00E54FB6
GetMenuItemInfoW.USER32(?,000000FF,00000000,00000030), ref: 00E54FCA
SetMenuItemInfoW.USER32(?,000000FF,00000000,00000030), ref: 00E54FEB

Memory Dump Source

Source File: 00000000.00000002.1262750966.0000000000E11000.00000020.00000001.01000000.00000003.sdmp, Offset: 00E10000, based on PE: true

Associated: 00000000.00000002.1262729095.0000000000E10000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1262808979.0000000000E9D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1262808979.0000000000EBE000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1262857687.0000000000ECA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1262878803.0000000000ED4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1262878803.0000000000F07000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_e10000_18112024_Dokman_1 Kas_m 2024- Avans_T24-2112184_dekont.jbxd

Similarity

API ID: ItemMenu$Info$CheckCountRadioSleep_memset
String ID:
API String ID: 4176008265-0
Opcode ID: 00249b9b7f5487ccfe16ecdd40aa36788bc3fc8b406e7fc78502e12316fdcb50
Instruction ID: 71b7f140bf736e47215386d8312346e0850eab67be12ab725facdebe71390620
Opcode Fuzzy Hash: 00249b9b7f5487ccfe16ecdd40aa36788bc3fc8b406e7fc78502e12316fdcb50
Instruction Fuzzy Hash: B16183B1600259AFDB11CF68DD849AE7BB9FB4130DF14285AF841B7291D7319D89CB20

Function 00E79C16 Relevance: 16.7, APIs: 11, Instructions: 183windowCOMMON

Download Yara Rule

APIs

SendMessageW.USER32(?,0000101F,00000000,00000000), ref: 00E79C98
SendMessageW.USER32(00000000,?,0000101F,00000000), ref: 00E79C9B
GetWindowLongW.USER32(?,000000F0), ref: 00E79CBF
_memset.LIBCMT ref: 00E79CD0
SendMessageW.USER32(?,00001004,00000000,00000000), ref: 00E79CE2
SendMessageW.USER32(?,0000104D,00000000,00000007), ref: 00E79D5A

Memory Dump Source

Source File: 00000000.00000002.1262750966.0000000000E11000.00000020.00000001.01000000.00000003.sdmp, Offset: 00E10000, based on PE: true

Associated: 00000000.00000002.1262729095.0000000000E10000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1262808979.0000000000E9D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1262808979.0000000000EBE000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1262857687.0000000000ECA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1262878803.0000000000ED4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1262878803.0000000000F07000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_e10000_18112024_Dokman_1 Kas_m 2024- Avans_T24-2112184_dekont.jbxd

Similarity

API ID: MessageSend$LongWindow_memset
String ID:
API String ID: 830647256-0
Opcode ID: 0a1dedb7d317c9fccc65d4af9e097396e0f08102630dcca81b7f0bad200a526a
Instruction ID: 0bc763e2e8c100900aab14cbff38bf18425673e8f8540d223326898e27b0b439
Opcode Fuzzy Hash: 0a1dedb7d317c9fccc65d4af9e097396e0f08102630dcca81b7f0bad200a526a
Instruction Fuzzy Hash: AF617D75900208AFDB21DFA4DC81EEEB7B8EF09714F14419AFA18B7292D770AD46DB50

Function 00E494E1 Relevance: 16.6, APIs: 11, Instructions: 109memoryCOMMON

Download Yara Rule

APIs

SafeArrayAllocDescriptorEx.OLEAUT32(0000000C,00000000,?), ref: 00E494FE
SafeArrayAllocData.OLEAUT32(?), ref: 00E49549
VariantInit.OLEAUT32(?), ref: 00E4955B
SafeArrayAccessData.OLEAUT32(?,?), ref: 00E4957B
VariantCopy.OLEAUT32(?,?), ref: 00E495BE
SafeArrayUnaccessData.OLEAUT32(?), ref: 00E495D2
VariantClear.OLEAUT32(?), ref: 00E495E7
SafeArrayDestroyData.OLEAUT32(?), ref: 00E495F4
SafeArrayDestroyDescriptor.OLEAUT32(?), ref: 00E495FD
VariantClear.OLEAUT32(?), ref: 00E4960F
SafeArrayDestroyDescriptor.OLEAUT32(?), ref: 00E4961A

Memory Dump Source

Source File: 00000000.00000002.1262750966.0000000000E11000.00000020.00000001.01000000.00000003.sdmp, Offset: 00E10000, based on PE: true

Associated: 00000000.00000002.1262729095.0000000000E10000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1262808979.0000000000E9D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1262808979.0000000000EBE000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1262857687.0000000000ECA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1262878803.0000000000ED4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1262878803.0000000000F07000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_e10000_18112024_Dokman_1 Kas_m 2024- Avans_T24-2112184_dekont.jbxd

Similarity

API ID: ArraySafe$DataVariant$DescriptorDestroy$AllocClear$AccessCopyInitUnaccess
String ID:
API String ID: 2706829360-0
Opcode ID: fed6591ead752eb4493b83a89bef6809f8ff2995bc9f319cb27639d7f83b93bc
Instruction ID: 7acd307ba5f36dce50421ed1e4ff511cfa1d07d1b28327000ea8a8b34db901b7
Opcode Fuzzy Hash: fed6591ead752eb4493b83a89bef6809f8ff2995bc9f319cb27639d7f83b93bc
Instruction Fuzzy Hash: C7416131904229AFCB01EFA5EC849DEBBB9FF48354F108066E511B7251DB35EA45CBA1

Function 00E6BB08 Relevance: 16.0, APIs: 5, Strings: 4, Instructions: 264COMMON

Download Yara Rule

APIs

_memset.LIBCMT ref: 00E6BB5C
VariantInit.OLEAUT32(?), ref: 00E6BC2D
VariantInit.OLEAUT32(?), ref: 00E6BD2E
VariantClear.OLEAUT32(?), ref: 00E6BD38
VariantClear.OLEAUT32(?), ref: 00E6BD99

Strings

Null Object assignment in FOR..IN loop, xrefs: 00E6BBBD, 00E6BCEB, 00E6BDA7
h?, xrefs: 00E6BBD7, 00E6BBDA
|?, xrefs: 00E6BBFE, 00E6BC01
Incorrect Object type in FOR..IN loop, xrefs: 00E6BD11

Memory Dump Source

Source File: 00000000.00000002.1262750966.0000000000E11000.00000020.00000001.01000000.00000003.sdmp, Offset: 00E10000, based on PE: true

Associated: 00000000.00000002.1262729095.0000000000E10000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1262808979.0000000000E9D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1262808979.0000000000EBE000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1262857687.0000000000ECA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1262878803.0000000000ED4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1262878803.0000000000F07000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_e10000_18112024_Dokman_1 Kas_m 2024- Avans_T24-2112184_dekont.jbxd

Similarity

API ID: Variant$ClearInit$_memset
String ID: Incorrect Object type in FOR..IN loop$Null Object assignment in FOR..IN loop$h?$|?
API String ID: 2862541840-300242882
Opcode ID: bce71df1f7048a6ea1ba0bb027c5af2aaeb0eff2cf18e7305d66e00555e8df18
Instruction ID: 8d5da0e44e01f3e9e23d0a61fca9d83a4e70194b4cf2e20bd22b1e614a054b55
Opcode Fuzzy Hash: bce71df1f7048a6ea1ba0bb027c5af2aaeb0eff2cf18e7305d66e00555e8df18
Instruction Fuzzy Hash: 8591A171A40219ABCF24CFA5D844FEEBBB8EF84354F10951AF515FB280D7709985CB90

Function 00E6ADAE Relevance: 15.9, APIs: 6, Strings: 3, Instructions: 197comCOMMON

Download Yara Rule

APIs

Part of subcall function 00E1936C: __swprintf.LIBCMT ref: 00E193AB
Part of subcall function 00E1936C: __itow.LIBCMT ref: 00E193DF

CoInitialize.OLE32 ref: 00E6ADF6
CoUninitialize.OLE32 ref: 00E6AE01
CoCreateInstance.OLE32(?,00000000,00000017,00E9D8FC,?), ref: 00E6AE61
IIDFromString.OLE32(?,?), ref: 00E6AED4
VariantInit.OLEAUT32(?), ref: 00E6AF6E
VariantClear.OLEAUT32(?), ref: 00E6AFCF

Strings

Invalid parameter, xrefs: 00E6AEED
NULL Pointer assignment, xrefs: 00E6AEA6
Failed to create object, xrefs: 00E6AE6C, 00E6AF22

Memory Dump Source

Source File: 00000000.00000002.1262750966.0000000000E11000.00000020.00000001.01000000.00000003.sdmp, Offset: 00E10000, based on PE: true

Associated: 00000000.00000002.1262729095.0000000000E10000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1262808979.0000000000E9D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1262808979.0000000000EBE000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1262857687.0000000000ECA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1262878803.0000000000ED4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1262878803.0000000000F07000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_e10000_18112024_Dokman_1 Kas_m 2024- Avans_T24-2112184_dekont.jbxd

Similarity

API ID: Variant$ClearCreateFromInitInitializeInstanceStringUninitialize__itow__swprintf
String ID: Failed to create object$Invalid parameter$NULL Pointer assignment
API String ID: 834269672-1287834457
Opcode ID: 5ea5a69423937497479d65fb9cba9597f9af60b968ec817378e79f7c928f7329
Instruction ID: 112196e90fcef4225addb0e4e9f173d30c08f0ee60041b1d0b5513db8c1ac527
Opcode Fuzzy Hash: 5ea5a69423937497479d65fb9cba9597f9af60b968ec817378e79f7c928f7329
Instruction Fuzzy Hash: 7161A270A483119FC710DF54E849BAAB7E8AF44754F04542EF985BB292C771ED88CB93

Function 00E68107 Relevance: 15.9, APIs: 8, Strings: 1, Instructions: 163networkfileCOMMON

Download Yara Rule

APIs

WSAStartup.WSOCK32(00000101,?), ref: 00E68168
inet_addr.WSOCK32(?), ref: 00E681AD
gethostbyname.WSOCK32(?), ref: 00E681B9
IcmpCreateFile.IPHLPAPI ref: 00E681C7
IcmpSendEcho.IPHLPAPI(?,?,?,00000005,00000000,?,00000029,00000FA0), ref: 00E68237
IcmpSendEcho.IPHLPAPI(00000000,00000000,?,00000005,00000000,?,00000029,00000FA0), ref: 00E6824D
IcmpCloseHandle.IPHLPAPI(00000000), ref: 00E682C2
WSACleanup.WSOCK32 ref: 00E682C8

Strings

Ping, xrefs: 00E681EB

Memory Dump Source

Source File: 00000000.00000002.1262750966.0000000000E11000.00000020.00000001.01000000.00000003.sdmp, Offset: 00E10000, based on PE: true

Associated: 00000000.00000002.1262729095.0000000000E10000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1262808979.0000000000E9D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1262808979.0000000000EBE000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1262857687.0000000000ECA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1262878803.0000000000ED4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1262878803.0000000000F07000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_e10000_18112024_Dokman_1 Kas_m 2024- Avans_T24-2112184_dekont.jbxd

Similarity

API ID: Icmp$EchoSend$CleanupCloseCreateFileHandleStartupgethostbynameinet_addr
String ID: Ping
API String ID: 1028309954-2246546115
Opcode ID: 30adbdd63181f9a21fd6ad4092a7bc725f5d18660f4ee821e8648752f7a6bdb3
Instruction ID: 0b72c2db0a5ae102f8fb1ae773ede607cf7f1db9e3915761c05353fdf4e7caf6
Opcode Fuzzy Hash: 30adbdd63181f9a21fd6ad4092a7bc725f5d18660f4ee821e8648752f7a6bdb3
Instruction Fuzzy Hash: 7551E2316443009FDB209F65ED55B6ABBE4FF48364F049A2AFA55F72A1DB30E804CB41

Function 00E5E389 Relevance: 15.8, APIs: 4, Strings: 5, Instructions: 97COMMON

Download Yara Rule

APIs

SetErrorMode.KERNEL32(00000001), ref: 00E5E396
GetDiskFreeSpaceW.KERNEL32(?,?,?,?,?,00000002,00000001), ref: 00E5E40C
GetLastError.KERNEL32 ref: 00E5E416
SetErrorMode.KERNEL32(00000000,READY), ref: 00E5E483

Strings

READY, xrefs: 00E5E45C
READONLY, xrefs: 00E5E44E
NOTREADY, xrefs: 00E5E442
UNKNOWN, xrefs: 00E5E43B
INVALID, xrefs: 00E5E455

Memory Dump Source

Source File: 00000000.00000002.1262750966.0000000000E11000.00000020.00000001.01000000.00000003.sdmp, Offset: 00E10000, based on PE: true

Associated: 00000000.00000002.1262729095.0000000000E10000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1262808979.0000000000E9D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1262808979.0000000000EBE000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1262857687.0000000000ECA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1262878803.0000000000ED4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1262878803.0000000000F07000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_e10000_18112024_Dokman_1 Kas_m 2024- Avans_T24-2112184_dekont.jbxd

Similarity

API ID: Error$Mode$DiskFreeLastSpace
String ID: INVALID$NOTREADY$READONLY$READY$UNKNOWN
API String ID: 4194297153-14809454
Opcode ID: e3a5fa0531e0eaf59ea37843195ab12fb2473b72b8630434ac0c8b9644975d95
Instruction ID: 8f992e0564bbda743cbaf8196ad7974b991344c040a53d5d74abb76ce55cd45a
Opcode Fuzzy Hash: e3a5fa0531e0eaf59ea37843195ab12fb2473b72b8630434ac0c8b9644975d95
Instruction Fuzzy Hash: C531C035A00209AFCB04EF64D945EEEB7B4EF08305F109816E915F7391D6719A4AC750

Function 00E4B907 Relevance: 15.8, APIs: 7, Strings: 2, Instructions: 81windowCOMMON

Download Yara Rule

APIs

SendMessageW.USER32(?,0000018C,000000FF,00000002), ref: 00E4B98C
GetDlgCtrlID.USER32 ref: 00E4B997
GetParent.USER32 ref: 00E4B9B3
SendMessageW.USER32(00000000,?,00000111,?), ref: 00E4B9B6
GetDlgCtrlID.USER32(?), ref: 00E4B9BF
GetParent.USER32(?), ref: 00E4B9DB
SendMessageW.USER32(00000000,?,?,00000111), ref: 00E4B9DE

Strings

ComboBox, xrefs: 00E4B911
ListBox, xrefs: 00E4B949

Memory Dump Source

Source File: 00000000.00000002.1262750966.0000000000E11000.00000020.00000001.01000000.00000003.sdmp, Offset: 00E10000, based on PE: true

Associated: 00000000.00000002.1262729095.0000000000E10000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1262808979.0000000000E9D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1262808979.0000000000EBE000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1262857687.0000000000ECA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1262878803.0000000000ED4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1262878803.0000000000F07000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_e10000_18112024_Dokman_1 Kas_m 2024- Avans_T24-2112184_dekont.jbxd

Similarity

API ID: MessageSend$CtrlParent
String ID: ComboBox$ListBox
API String ID: 1383977212-1403004172
Opcode ID: 8b982c2ceeebbc1d344df82d80eed79cc110849643e52e7a039be414cd6b168f
Instruction ID: f00ae459e3510b25d5f1fd8ba6be9ab1bfc03ebb9f49fb1211db493ef3b12bad
Opcode Fuzzy Hash: 8b982c2ceeebbc1d344df82d80eed79cc110849643e52e7a039be414cd6b168f
Instruction Fuzzy Hash: 7921C4B4900204BFCF04ABA1DC85EFEB7B4EB45310B10511AF651F32D2DB75981ADB20

Function 00E4B9F0 Relevance: 15.8, APIs: 7, Strings: 2, Instructions: 80windowCOMMON

Download Yara Rule

APIs

SendMessageW.USER32(?,00000186,00000002,00000000), ref: 00E4BA73
GetDlgCtrlID.USER32 ref: 00E4BA7E
GetParent.USER32 ref: 00E4BA9A
SendMessageW.USER32(00000000,?,00000111,?), ref: 00E4BA9D
GetDlgCtrlID.USER32(?), ref: 00E4BAA6
GetParent.USER32(?), ref: 00E4BAC2
SendMessageW.USER32(00000000,?,?,00000111), ref: 00E4BAC5

Strings

ComboBox, xrefs: 00E4B9FA
ListBox, xrefs: 00E4BA32

Memory Dump Source

Source File: 00000000.00000002.1262750966.0000000000E11000.00000020.00000001.01000000.00000003.sdmp, Offset: 00E10000, based on PE: true

Associated: 00000000.00000002.1262729095.0000000000E10000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1262808979.0000000000E9D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1262808979.0000000000EBE000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1262857687.0000000000ECA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1262878803.0000000000ED4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1262878803.0000000000F07000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_e10000_18112024_Dokman_1 Kas_m 2024- Avans_T24-2112184_dekont.jbxd

Similarity

API ID: MessageSend$CtrlParent
String ID: ComboBox$ListBox
API String ID: 1383977212-1403004172
Opcode ID: ba868754544a83af1bc2e8aa455ea4e82499d757ca63ced152601259a1988153
Instruction ID: c9b6a36904bca8eaf2ed11b2b041a3933cb894844d51fe0b317299a3a39e3479
Opcode Fuzzy Hash: ba868754544a83af1bc2e8aa455ea4e82499d757ca63ced152601259a1988153
Instruction Fuzzy Hash: 6F21C5B4940204BFDF00AB64DC85EFEB7B9EF45300F10101AF551F3192DB75995AAB20

Function 00E4BAD7 Relevance: 15.8, APIs: 4, Strings: 5, Instructions: 71windowCOMMON

Download Yara Rule

APIs

GetParent.USER32 ref: 00E4BAE3
GetClassNameW.USER32(00000000,?,00000100), ref: 00E4BAF8
_wcscmp.LIBCMT ref: 00E4BB0A
SendMessageW.USER32(00000000,00000111,0000702B,00000000), ref: 00E4BB85

Strings

smallicons, xrefs: 00E4BB4D
largeicons, xrefs: 00E4BB19
SHELLDLL_DefView, xrefs: 00E4BB04
list, xrefs: 00E4BB67
details, xrefs: 00E4BB33

Memory Dump Source

Source File: 00000000.00000002.1262750966.0000000000E11000.00000020.00000001.01000000.00000003.sdmp, Offset: 00E10000, based on PE: true

Associated: 00000000.00000002.1262729095.0000000000E10000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1262808979.0000000000E9D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1262808979.0000000000EBE000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1262857687.0000000000ECA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1262878803.0000000000ED4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1262878803.0000000000F07000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_e10000_18112024_Dokman_1 Kas_m 2024- Avans_T24-2112184_dekont.jbxd

Similarity

API ID: ClassMessageNameParentSend_wcscmp
String ID: SHELLDLL_DefView$details$largeicons$list$smallicons
API String ID: 1704125052-3381328864
Opcode ID: e39c5c52e00f9ccbb2aa2a9b5082b8174d53392c7336a777a10b2ea0b4aa094c
Instruction ID: 0305ca0f48e7ea74374ee160d65a64e829f63cbc1fd7e5a0264b5f4e920f7a33
Opcode Fuzzy Hash: e39c5c52e00f9ccbb2aa2a9b5082b8174d53392c7336a777a10b2ea0b4aa094c
Instruction Fuzzy Hash: 9F11C67664C307FEFA246635FC1AEE73B9CDB11724F20202AFA04F50D6EBA2E8519514

Function 00E6B2A9 Relevance: 15.3, APIs: 10, Instructions: 324fileCOMMON

Download Yara Rule

APIs

VariantInit.OLEAUT32(?), ref: 00E6B2D5
CoInitialize.OLE32(00000000), ref: 00E6B302
CoUninitialize.OLE32 ref: 00E6B30C
GetRunningObjectTable.OLE32(00000000,?), ref: 00E6B40C
SetErrorMode.KERNEL32(00000001,00000029), ref: 00E6B539
CoGetInstanceFromFile.OLE32(00000000,?,00000000,00000015,00000002), ref: 00E6B56D
CoGetObject.OLE32(?,00000000,00E9D91C,?), ref: 00E6B590
SetErrorMode.KERNEL32(00000000), ref: 00E6B5A3
SetErrorMode.KERNEL32(00000000,00000000,00000000,00000000,00000000), ref: 00E6B623
VariantClear.OLEAUT32(00E9D91C), ref: 00E6B633

Memory Dump Source

Source File: 00000000.00000002.1262750966.0000000000E11000.00000020.00000001.01000000.00000003.sdmp, Offset: 00E10000, based on PE: true

Associated: 00000000.00000002.1262729095.0000000000E10000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1262808979.0000000000E9D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1262808979.0000000000EBE000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1262857687.0000000000ECA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1262878803.0000000000ED4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1262878803.0000000000F07000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_e10000_18112024_Dokman_1 Kas_m 2024- Avans_T24-2112184_dekont.jbxd

Similarity

API ID: ErrorMode$ObjectVariant$ClearFileFromInitInitializeInstanceRunningTableUninitialize
String ID:
API String ID: 2395222682-0
Opcode ID: a67bb406c3b5afb6446e2b3a1b9462ba18415f1f0d5b877fff36e518bea69958
Instruction ID: dd92dce3698ccd7200b0179b485fcd7118bab1105416813d9e631e3ac5533e07
Opcode Fuzzy Hash: a67bb406c3b5afb6446e2b3a1b9462ba18415f1f0d5b877fff36e518bea69958
Instruction Fuzzy Hash: B7C13271608300AFC700DF69D88496BB7E9BF88348F00591DF98AEB251DB70ED85CB52

Function 00E54025 Relevance: 15.1, APIs: 10, Instructions: 88threadCOMMON

Download Yara Rule

APIs

GetCurrentThreadId.KERNEL32 ref: 00E54047
GetForegroundWindow.USER32(00000000,?,?,?,?,?,00E530A5,?,00000001), ref: 00E5405B
GetWindowThreadProcessId.USER32(00000000), ref: 00E54062
AttachThreadInput.USER32(00000000,00000000,00000001,?,?,?,?,?,00E530A5,?,00000001), ref: 00E54071
GetWindowThreadProcessId.USER32(?,00000000), ref: 00E54083
AttachThreadInput.USER32(?,00000000,00000001,?,?,?,?,?,00E530A5,?,00000001), ref: 00E5409C
AttachThreadInput.USER32(00000000,00000000,00000001,?,?,?,?,?,00E530A5,?,00000001), ref: 00E540AE
AttachThreadInput.USER32(00000000,00000000,?,?,?,?,?,00E530A5,?,00000001), ref: 00E540F3
AttachThreadInput.USER32(?,?,00000000,?,?,?,?,?,00E530A5,?,00000001), ref: 00E54108
AttachThreadInput.USER32(00000000,?,00000000,?,?,?,?,?,00E530A5,?,00000001), ref: 00E54113

Memory Dump Source

Source File: 00000000.00000002.1262750966.0000000000E11000.00000020.00000001.01000000.00000003.sdmp, Offset: 00E10000, based on PE: true

Associated: 00000000.00000002.1262729095.0000000000E10000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1262808979.0000000000E9D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1262808979.0000000000EBE000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1262857687.0000000000ECA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1262878803.0000000000ED4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1262878803.0000000000F07000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_e10000_18112024_Dokman_1 Kas_m 2024- Avans_T24-2112184_dekont.jbxd

Similarity

API ID: Thread$AttachInput$Window$Process$CurrentForeground
String ID:
API String ID: 2156557900-0
Opcode ID: 7ece738e26e9a3661c7a91c8f07fbcbae3d6edc878616b27606b664b5c46eed0
Instruction ID: 31ba613fb7bc1853c2d0319499ff1ce10b83e509ecd0805fbc0b43276194aa3d
Opcode Fuzzy Hash: 7ece738e26e9a3661c7a91c8f07fbcbae3d6edc878616b27606b664b5c46eed0
Instruction Fuzzy Hash: A731D1F1602210AFDB11CB66EC85B69B7B9EB5031AF109407FD04F62D0CBB49D888B62

Function 00E13093 Relevance: 14.2, APIs: 7, Strings: 1, Instructions: 210COMMON

Download Yara Rule

APIs

mciSendStringW.WINMM(close all,00000000,00000000,00000000), ref: 00E130DC
CoUninitialize.OLE32(?,00000000), ref: 00E13181
UnregisterHotKey.USER32(?), ref: 00E132A9
DestroyWindow.USER32(?), ref: 00E85079
FreeLibrary.KERNEL32(?), ref: 00E850F8
VirtualFree.KERNEL32(?,00000000,00008000), ref: 00E85125

Strings

close all, xrefs: 00E130D7

Memory Dump Source

Source File: 00000000.00000002.1262750966.0000000000E11000.00000020.00000001.01000000.00000003.sdmp, Offset: 00E10000, based on PE: true

Associated: 00000000.00000002.1262729095.0000000000E10000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1262808979.0000000000E9D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1262808979.0000000000EBE000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1262857687.0000000000ECA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1262878803.0000000000ED4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1262878803.0000000000F07000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_e10000_18112024_Dokman_1 Kas_m 2024- Avans_T24-2112184_dekont.jbxd

Similarity

API ID: Free$DestroyLibrarySendStringUninitializeUnregisterVirtualWindow
String ID: close all
API String ID: 469580280-3243417748
Opcode ID: a407811566ab5fd4146e58aebd44e2180406ed1e3d64313975f897782a7f905d
Instruction ID: 3a59516a7251eaa240cfd141e9992577404580feeda78d7c8141eea5f867a9be
Opcode Fuzzy Hash: a407811566ab5fd4146e58aebd44e2180406ed1e3d64313975f897782a7f905d
Instruction Fuzzy Hash: B39129756012129FC715EF24C895BA9F3E4FF04304F5462AAE50AB7262DF30AE9ACF54

Function 00E2CB8D Relevance: 14.2, APIs: 7, Strings: 1, Instructions: 185windowCOMMON

Download Yara Rule

APIs

SetWindowLongW.USER32(?,000000EB), ref: 00E2CC15

Part of subcall function 00E2CCCD: GetClientRect.USER32(?,?), ref: 00E2CCF6
Part of subcall function 00E2CCCD: GetWindowRect.USER32(?,?), ref: 00E2CD37
Part of subcall function 00E2CCCD: ScreenToClient.USER32(?,?), ref: 00E2CD5F

GetDC.USER32 ref: 00E8D137
SendMessageW.USER32(?,00000031,00000000,00000000), ref: 00E8D14A
SelectObject.GDI32(00000000,00000000), ref: 00E8D158
SelectObject.GDI32(00000000,00000000), ref: 00E8D16D
ReleaseDC.USER32(?,00000000), ref: 00E8D175
MoveWindow.USER32(?,?,?,?,?,?,?,00000031,00000000,00000000), ref: 00E8D200

Strings

U, xrefs: 00E8D0D5

Memory Dump Source

Source File: 00000000.00000002.1262750966.0000000000E11000.00000020.00000001.01000000.00000003.sdmp, Offset: 00E10000, based on PE: true

Associated: 00000000.00000002.1262729095.0000000000E10000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1262808979.0000000000E9D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1262808979.0000000000EBE000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1262857687.0000000000ECA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1262878803.0000000000ED4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1262878803.0000000000F07000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_e10000_18112024_Dokman_1 Kas_m 2024- Avans_T24-2112184_dekont.jbxd

Similarity

API ID: Window$ClientObjectRectSelect$LongMessageMoveReleaseScreenSend
String ID: U
API String ID: 4009187628-3372436214
Opcode ID: 7de0f5a715790d8a2febe601b14ec8a27850d7c748e566cd8e9f349139313f4f
Instruction ID: 75edbfaed3b177c5f12d643a4f52cef5d8b5fbe032027e3528fd81206aa74169
Opcode Fuzzy Hash: 7de0f5a715790d8a2febe601b14ec8a27850d7c748e566cd8e9f349139313f4f
Instruction Fuzzy Hash: B071C130405205EFCF21AF64DC85AEA7BB6FF48318F24666AED5D7A2A6C7318841DB50

Function 00E7ECD4 Relevance: 14.1, APIs: 6, Strings: 2, Instructions: 149windowCOMMON

Download Yara Rule

APIs

Part of subcall function 00E2B34E: GetWindowLongW.USER32(?,000000EB), ref: 00E2B35F

Part of subcall function 00E2B63C: GetCursorPos.USER32(000000FF), ref: 00E2B64F
Part of subcall function 00E2B63C: ScreenToClient.USER32(00000000,000000FF), ref: 00E2B66C
Part of subcall function 00E2B63C: GetAsyncKeyState.USER32(00000001), ref: 00E2B691
Part of subcall function 00E2B63C: GetAsyncKeyState.USER32(00000002), ref: 00E2B69F

ImageList_DragLeave.COMCTL32(00000000,00000000,00000001,?,?,?), ref: 00E7ED3C
ImageList_EndDrag.COMCTL32 ref: 00E7ED42
ReleaseCapture.USER32 ref: 00E7ED48
SetWindowTextW.USER32(?,00000000), ref: 00E7EDF0
SendMessageW.USER32(?,000000B1,00000000,000000FF), ref: 00E7EE03
DefDlgProcW.USER32(?,00000202,?,?,00000000,00000001,?,?,?), ref: 00E7EEDC

Strings

@GUI_DROPID, xrefs: 00E7EE33
@GUI_DRAGFILE, xrefs: 00E7EE77

Memory Dump Source

Source File: 00000000.00000002.1262750966.0000000000E11000.00000020.00000001.01000000.00000003.sdmp, Offset: 00E10000, based on PE: true

Associated: 00000000.00000002.1262729095.0000000000E10000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1262808979.0000000000E9D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1262808979.0000000000EBE000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1262857687.0000000000ECA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1262878803.0000000000ED4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1262878803.0000000000F07000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_e10000_18112024_Dokman_1 Kas_m 2024- Avans_T24-2112184_dekont.jbxd

Similarity

API ID: AsyncDragImageList_StateWindow$CaptureClientCursorLeaveLongMessageProcReleaseScreenSendText
String ID: @GUI_DRAGFILE$@GUI_DROPID
API String ID: 1924731296-2107944366
Opcode ID: 216a2655f9abb3acc238fca367de5309bdfdd7931ab17b852010905f13cf8e76
Instruction ID: cd9cbb6561b7120adb62106df9fbdfc7d3a97b56f7ffbdf96d2e3b47fa5399c5
Opcode Fuzzy Hash: 216a2655f9abb3acc238fca367de5309bdfdd7931ab17b852010905f13cf8e76
Instruction Fuzzy Hash: BB51AC70208300AFD710DF20EC96FAA77E4FB88714F14595EF599A72E2DB70A948CB52

Function 00E645C4 Relevance: 14.1, APIs: 7, Strings: 1, Instructions: 133networkCOMMON

Download Yara Rule

APIs

InternetConnectW.WININET(?,?,?,?,?,?,00000000,00000000), ref: 00E645FF
HttpOpenRequestW.WININET(00000000,00000000,?,00000000,00000000,00000000,?,00000000), ref: 00E6462B
InternetQueryOptionW.WININET(00000000,0000001F,00000000,?), ref: 00E6466D
InternetSetOptionW.WININET(00000000,0000001F,00000100,00000004), ref: 00E64682
HttpSendRequestW.WININET(00000000,00000000,00000000,00000000,00000000), ref: 00E6468F
HttpQueryInfoW.WININET(00000000,00000005,?,?,00000000), ref: 00E646BF
InternetCloseHandle.WININET(00000000), ref: 00E64706

Part of subcall function 00E65052: GetLastError.KERNEL32(?,?,00E643CC,00000000,00000000,00000001), ref: 00E65067

Strings

, xrefs: 00E646B8

Memory Dump Source

Source File: 00000000.00000002.1262750966.0000000000E11000.00000020.00000001.01000000.00000003.sdmp, Offset: 00E10000, based on PE: true

Associated: 00000000.00000002.1262729095.0000000000E10000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1262808979.0000000000E9D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1262808979.0000000000EBE000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1262857687.0000000000ECA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1262878803.0000000000ED4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1262878803.0000000000F07000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_e10000_18112024_Dokman_1 Kas_m 2024- Avans_T24-2112184_dekont.jbxd

Similarity

API ID: Internet$Http$OptionQueryRequest$CloseConnectErrorHandleInfoLastOpenSend
String ID:
API String ID: 1241431887-3916222277
Opcode ID: 980bebe236d4d40493e6c442cbb879b241af72521f37fb3517ac0575d1b20c99
Instruction ID: 01178196ea1502706c09933c9380517a1aeaaf8f871eae66e8aff51ff7b935ab
Opcode Fuzzy Hash: 980bebe236d4d40493e6c442cbb879b241af72521f37fb3517ac0575d1b20c99
Instruction Fuzzy Hash: 9D417CB2541219BFEB029F90DC89FFE77ACEF09398F005017FA05AA191D7B099448BA4

Function 00E6B644 Relevance: 13.9, APIs: 9, Instructions: 432COMMON

Download Yara Rule

APIs

GetModuleFileNameW.KERNEL32(?,?,00000104,?,00EADC00), ref: 00E6B715
FreeLibrary.KERNEL32(00000000,00000001,00000000,?,00EADC00), ref: 00E6B749
QueryPathOfRegTypeLib.OLEAUT32(?,?,?,?,?), ref: 00E6B8C1
SysFreeString.OLEAUT32(?), ref: 00E6B8EB

Memory Dump Source

Source File: 00000000.00000002.1262750966.0000000000E11000.00000020.00000001.01000000.00000003.sdmp, Offset: 00E10000, based on PE: true

Associated: 00000000.00000002.1262729095.0000000000E10000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1262808979.0000000000E9D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1262808979.0000000000EBE000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1262857687.0000000000ECA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1262878803.0000000000ED4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1262878803.0000000000F07000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_e10000_18112024_Dokman_1 Kas_m 2024- Avans_T24-2112184_dekont.jbxd

Similarity

API ID: Free$FileLibraryModuleNamePathQueryStringType
String ID:
API String ID: 560350794-0
Opcode ID: 384b2fd70d167f2099a6f961023de29df45eac2ed280aa5f63f6d8a1db450d58
Instruction ID: a5513e3a49824719d26d01c206429f591f6f36769aff3ae0337d0a9caf63b54e
Opcode Fuzzy Hash: 384b2fd70d167f2099a6f961023de29df45eac2ed280aa5f63f6d8a1db450d58
Instruction Fuzzy Hash: 9AF15871A00219AFCF04DF94D884EAEB7B9FF89355F108099F905EB250DB31AE85CB90

Function 00E724D4 Relevance: 13.9, APIs: 9, Instructions: 376processCOMMON

Download Yara Rule

APIs

_memset.LIBCMT ref: 00E724F5
GetSystemDirectoryW.KERNEL32(00000000,00000000), ref: 00E72688
GetSystemDirectoryW.KERNEL32(00000000,00000000), ref: 00E726AC
GetCurrentDirectoryW.KERNEL32(00000000,00000000), ref: 00E726EC
GetCurrentDirectoryW.KERNEL32(00000000,00000000), ref: 00E7270E
CreateProcessW.KERNEL32(00000000,?,00000000,00000000,?,?,00000000,?,?,?), ref: 00E7286F
GetLastError.KERNEL32(00000000,00000001,00000000), ref: 00E728A1
CloseHandle.KERNEL32(?), ref: 00E728D0
CloseHandle.KERNEL32(?), ref: 00E72947

Memory Dump Source

Source File: 00000000.00000002.1262750966.0000000000E11000.00000020.00000001.01000000.00000003.sdmp, Offset: 00E10000, based on PE: true

Associated: 00000000.00000002.1262729095.0000000000E10000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1262808979.0000000000E9D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1262808979.0000000000EBE000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1262857687.0000000000ECA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1262878803.0000000000ED4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1262878803.0000000000F07000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_e10000_18112024_Dokman_1 Kas_m 2024- Avans_T24-2112184_dekont.jbxd

Similarity

API ID: Directory$CloseCurrentHandleSystem$CreateErrorLastProcess_memset
String ID:
API String ID: 4090791747-0
Opcode ID: 8d0fd3915b9ebcb13c31cb5ee5d1a5db9fd4494c879739c3f645305b92941a94
Instruction ID: 38a14a862aa21473f60d8ac8a643b3905f707f0e8aa0ec5b93694aa301898bc0
Opcode Fuzzy Hash: 8d0fd3915b9ebcb13c31cb5ee5d1a5db9fd4494c879739c3f645305b92941a94
Instruction Fuzzy Hash: A5D1B031604300DFCB14EF24D891A6EBBE5BF85314F14A45DF999AB2A2DB31DC45CB52

Function 00E7B33A Relevance: 13.7, APIs: 9, Instructions: 167COMMON

Download Yara Rule

APIs

InvalidateRect.USER32(?,00000000,00000001,?,00000001), ref: 00E7B3F4

Memory Dump Source

Source File: 00000000.00000002.1262750966.0000000000E11000.00000020.00000001.01000000.00000003.sdmp, Offset: 00E10000, based on PE: true

Associated: 00000000.00000002.1262729095.0000000000E10000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1262808979.0000000000E9D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1262808979.0000000000EBE000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1262857687.0000000000ECA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1262878803.0000000000ED4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1262878803.0000000000F07000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_e10000_18112024_Dokman_1 Kas_m 2024- Avans_T24-2112184_dekont.jbxd

Similarity

API ID: InvalidateRect
String ID:
API String ID: 634782764-0
Opcode ID: 636946b5d950cdf263ff74754795727b288a5bef838d1a2e9b3c349c9c20d33a
Instruction ID: 9bc2bacb5263fa8167f833d78da53ce09157cd6d070214024b0581660864bb11
Opcode Fuzzy Hash: 636946b5d950cdf263ff74754795727b288a5bef838d1a2e9b3c349c9c20d33a
Instruction Fuzzy Hash: 85519630500214BFDF249F25DC85F9E3BA5AF05318F54A112F62DF61E2D7B1E9849B51

Function 00E2A699 Relevance: 13.7, APIs: 9, Instructions: 163windowCOMMON

Download Yara Rule

APIs

LoadImageW.USER32(00000000,?,00000001,00000010,00000010,00000010), ref: 00E8DB1B
ExtractIconExW.SHELL32(?,00000000,00000000,00000000,00000001), ref: 00E8DB3C
LoadImageW.USER32(00000000,?,00000001,00000000,00000000,00000050), ref: 00E8DB51
ExtractIconExW.SHELL32(?,00000000,?,00000000,00000001), ref: 00E8DB6E
SendMessageW.USER32(00000000,00000080,00000000,00000000), ref: 00E8DB95
DestroyIcon.USER32(00000000,?,?,?,?,?,?,00E2A67C,00000000,00000000,00000000,000000FF,00000000,000000FF,000000FF), ref: 00E8DBA0
SendMessageW.USER32(00000000,00000080,00000001,00000000), ref: 00E8DBBD
DestroyIcon.USER32(00000000,?,?,?,?,?,?,00E2A67C,00000000,00000000,00000000,000000FF,00000000,000000FF,000000FF), ref: 00E8DBC8

Memory Dump Source

Source File: 00000000.00000002.1262750966.0000000000E11000.00000020.00000001.01000000.00000003.sdmp, Offset: 00E10000, based on PE: true

Associated: 00000000.00000002.1262729095.0000000000E10000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1262808979.0000000000E9D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1262808979.0000000000EBE000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1262857687.0000000000ECA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1262878803.0000000000ED4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1262878803.0000000000F07000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_e10000_18112024_Dokman_1 Kas_m 2024- Avans_T24-2112184_dekont.jbxd

Similarity

API ID: Icon$DestroyExtractImageLoadMessageSend
String ID:
API String ID: 1268354404-0
Opcode ID: 0078363afebd6f772d80708ca0dbdf474fee38fb6383183f0dfe6bbbd7be4f5e
Instruction ID: 3e1910cd0ad9182f461327c68b4d78b1f827b32a62ae483a3dad76026120dba9
Opcode Fuzzy Hash: 0078363afebd6f772d80708ca0dbdf474fee38fb6383183f0dfe6bbbd7be4f5e
Instruction Fuzzy Hash: 38516570604218EFDB20DF69DC81FAA77F9EB48364F14152AF95AB62D0D7B0E890DB50

Function 00E57555 Relevance: 13.6, APIs: 9, Instructions: 142filestringCOMMON

Download Yara Rule

APIs

Part of subcall function 00E56EBB: GetFullPathNameW.KERNEL32(00000000,00007FFF,?,?,?,?,?,?,00E55FA6,?), ref: 00E56ED8

Part of subcall function 00E56EBB: GetFullPathNameW.KERNEL32(?,00007FFF,?,?,?,?,?,00E55FA6,?), ref: 00E56EF1

Part of subcall function 00E572CB: GetFileAttributesW.KERNEL32(?,00E56019), ref: 00E572CC

lstrcmpiW.KERNEL32(?,?), ref: 00E575CA
_wcscmp.LIBCMT ref: 00E575E2
MoveFileW.KERNEL32(?,?), ref: 00E575FB

Memory Dump Source

Source File: 00000000.00000002.1262750966.0000000000E11000.00000020.00000001.01000000.00000003.sdmp, Offset: 00E10000, based on PE: true

Associated: 00000000.00000002.1262729095.0000000000E10000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1262808979.0000000000E9D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1262808979.0000000000EBE000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1262857687.0000000000ECA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1262878803.0000000000ED4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1262878803.0000000000F07000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_e10000_18112024_Dokman_1 Kas_m 2024- Avans_T24-2112184_dekont.jbxd

Similarity

API ID: FileFullNamePath$AttributesMove_wcscmplstrcmpi
String ID:
API String ID: 793581249-0
Opcode ID: 5f7833aa12575a354fc31e5f2a6e743c41f2d709611f25c91f780166fc08ceef
Instruction ID: a579f866085f06a3c360ca91da1f4e0224f1d067eb7583ca3932a4c0722796d2
Opcode Fuzzy Hash: 5f7833aa12575a354fc31e5f2a6e743c41f2d709611f25c91f780166fc08ceef
Instruction Fuzzy Hash: DF513DB2A092299ADF60EB94E8459DE73BC9F08311F0054AAFA45F3441EA7097C9CB60

Function 00E2EA69 Relevance: 13.6, APIs: 9, Instructions: 135COMMON

Download Yara Rule

APIs

ShowWindow.USER32(00000000,000000FF,00000000,00000000,00000000,?,00E8DAD1,00000004,00000000,00000000), ref: 00E2EAEB
ShowWindow.USER32(00000000,00000000,00000000,00000000,00000000,?,00E8DAD1,00000004,00000000,00000000), ref: 00E2EB32
ShowWindow.USER32(00000000,00000006,00000000,00000000,00000000,?,00E8DAD1,00000004,00000000,00000000), ref: 00E8DC86
ShowWindow.USER32(00000000,000000FF,00000000,00000000,00000000,?,00E8DAD1,00000004,00000000,00000000), ref: 00E8DCF2

Memory Dump Source

Source File: 00000000.00000002.1262750966.0000000000E11000.00000020.00000001.01000000.00000003.sdmp, Offset: 00E10000, based on PE: true

Associated: 00000000.00000002.1262729095.0000000000E10000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1262808979.0000000000E9D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1262808979.0000000000EBE000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1262857687.0000000000ECA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1262878803.0000000000ED4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1262878803.0000000000F07000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_e10000_18112024_Dokman_1 Kas_m 2024- Avans_T24-2112184_dekont.jbxd

Similarity

API ID: ShowWindow
String ID:
API String ID: 1268545403-0
Opcode ID: 4e64a26d73faff5220ede6d5308f74950c747f9ffd2862a9b3eccc086b2aa73e
Instruction ID: 53352a1af35ec694e5debf876d5cfb353fcd79ae0bb891397adc197befd3418c
Opcode Fuzzy Hash: 4e64a26d73faff5220ede6d5308f74950c747f9ffd2862a9b3eccc086b2aa73e
Instruction Fuzzy Hash: 9441E67060D6B0AED7355B29ED8DB7ABB96EB41318F19340EE04FB67A1C6B0B844C311

Function 00E4B263 Relevance: 13.5, APIs: 9, Instructions: 49memorythreadCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32(00000008,0000000C,00000000,00000000,?,00E4AEF1,00000B00,?,?), ref: 00E4B26C
HeapAlloc.KERNEL32(00000000,?,00E4AEF1,00000B00,?,?), ref: 00E4B273
GetCurrentProcess.KERNEL32(00000000,00000000,00000000,00000002,?,00E4AEF1,00000B00,?,?), ref: 00E4B288
GetCurrentProcess.KERNEL32(?,00000000,?,00E4AEF1,00000B00,?,?), ref: 00E4B290
DuplicateHandle.KERNEL32(00000000,?,00E4AEF1,00000B00,?,?), ref: 00E4B293
GetCurrentProcess.KERNEL32(00000008,00000000,00000000,00000002,?,00E4AEF1,00000B00,?,?), ref: 00E4B2A3
GetCurrentProcess.KERNEL32(00E4AEF1,00000000,?,00E4AEF1,00000B00,?,?), ref: 00E4B2AB
DuplicateHandle.KERNEL32(00000000,?,00E4AEF1,00000B00,?,?), ref: 00E4B2AE
CreateThread.KERNEL32(00000000,00000000,00E4B2D4,00000000,00000000,00000000), ref: 00E4B2C8

Memory Dump Source

Source File: 00000000.00000002.1262750966.0000000000E11000.00000020.00000001.01000000.00000003.sdmp, Offset: 00E10000, based on PE: true

Associated: 00000000.00000002.1262729095.0000000000E10000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1262808979.0000000000E9D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1262808979.0000000000EBE000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1262857687.0000000000ECA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1262878803.0000000000ED4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1262878803.0000000000F07000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_e10000_18112024_Dokman_1 Kas_m 2024- Avans_T24-2112184_dekont.jbxd

Similarity

API ID: Process$Current$DuplicateHandleHeap$AllocCreateThread
String ID:
API String ID: 1957940570-0
Opcode ID: bd3dbb1ac4f42af46a23ffcb571e21ff762963ba39553e97a827d2a1b547a6a4
Instruction ID: 2662106e382b3dfa09c36319c1169391c5ed9ae8640c11ccda183183d7a014ad
Opcode Fuzzy Hash: bd3dbb1ac4f42af46a23ffcb571e21ff762963ba39553e97a827d2a1b547a6a4
Instruction Fuzzy Hash: DF01C275244304BFE710EFA6DC4DF5B7BACEB88B11F414412FA05DB1A1C6749804CB61

Function 00E6C43F Relevance: 12.7, APIs: 5, Strings: 2, Instructions: 401COMMON

Download Yara Rule

Strings

NULL Pointer assignment, xrefs: 00E6C876, 00E6C887
Not an Object type, xrefs: 00E6C49E

Memory Dump Source

Source File: 00000000.00000002.1262750966.0000000000E11000.00000020.00000001.01000000.00000003.sdmp, Offset: 00E10000, based on PE: true

Associated: 00000000.00000002.1262729095.0000000000E10000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1262808979.0000000000E9D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1262808979.0000000000EBE000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1262857687.0000000000ECA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1262878803.0000000000ED4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1262878803.0000000000F07000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_e10000_18112024_Dokman_1 Kas_m 2024- Avans_T24-2112184_dekont.jbxd

Similarity

API ID:
String ID: NULL Pointer assignment$Not an Object type
API String ID: 0-572801152
Opcode ID: 89d5dcdf623f8c27a05b0a1a1539ec4139e6e4c8aa124c6be2f5aefc58a10be2
Instruction ID: 9fd289483f0552343adb5acf74c00aea618ced2cba9bc15389eb535faa1280c1
Opcode Fuzzy Hash: 89d5dcdf623f8c27a05b0a1a1539ec4139e6e4c8aa124c6be2f5aefc58a10be2
Instruction Fuzzy Hash: 0AE1C371A40219AFCF14DFA4EC81AFE77B5EB48394F24902AE945BB281D770AD41CB90

Function 00E616DA Relevance: 12.6, APIs: 5, Strings: 2, Instructions: 309COMMON

Download Yara Rule

APIs

Part of subcall function 00E1936C: __swprintf.LIBCMT ref: 00E193AB
Part of subcall function 00E1936C: __itow.LIBCMT ref: 00E193DF

Part of subcall function 00E2C6F4: _wcscpy.LIBCMT ref: 00E2C717

_wcstok.LIBCMT ref: 00E6184E
_wcscpy.LIBCMT ref: 00E618DD
_memset.LIBCMT ref: 00E61910

Strings

X, xrefs: 00E61948
p2, xrefs: 00E61920

Memory Dump Source

Source File: 00000000.00000002.1262750966.0000000000E11000.00000020.00000001.01000000.00000003.sdmp, Offset: 00E10000, based on PE: true

Associated: 00000000.00000002.1262729095.0000000000E10000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1262808979.0000000000E9D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1262808979.0000000000EBE000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1262857687.0000000000ECA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1262878803.0000000000ED4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1262878803.0000000000F07000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_e10000_18112024_Dokman_1 Kas_m 2024- Avans_T24-2112184_dekont.jbxd

Similarity

API ID: _wcscpy$__itow__swprintf_memset_wcstok
String ID: X$p2
API String ID: 774024439-3332900272
Opcode ID: efe320d8f92739476c456f0f7a21770a45e58badb80873d6aa799f62b970b52d
Instruction ID: 760e9e84d4d702534521036713cbbb4c7f84db0b970acb9c1470a578893d0e17
Opcode Fuzzy Hash: efe320d8f92739476c456f0f7a21770a45e58badb80873d6aa799f62b970b52d
Instruction Fuzzy Hash: 33C1A2316083409FC724EF64D891A9EB7E0FF85354F04696DF999A72A2DB30ED45CB82

Function 00E79A75 Relevance: 12.4, APIs: 6, Strings: 1, Instructions: 142windowCOMMON

Download Yara Rule

APIs

SendMessageW.USER32(00000000,00001036,00000010,00000010), ref: 00E79B19
SendMessageW.USER32(?,00001036,00000000,?), ref: 00E79B2D
SetWindowPos.USER32(?,00000000,00000000,00000000,00000000,00000000,00000013), ref: 00E79B47
_wcscat.LIBCMT ref: 00E79BA2
SendMessageW.USER32(?,00001057,00000000,?), ref: 00E79BB9
SendMessageW.USER32(?,00001061,?,0000000F), ref: 00E79BE7

Strings

SysListView32, xrefs: 00E79AEB

Memory Dump Source

Source File: 00000000.00000002.1262750966.0000000000E11000.00000020.00000001.01000000.00000003.sdmp, Offset: 00E10000, based on PE: true

Associated: 00000000.00000002.1262729095.0000000000E10000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1262808979.0000000000E9D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1262808979.0000000000EBE000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1262857687.0000000000ECA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1262878803.0000000000ED4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1262878803.0000000000F07000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_e10000_18112024_Dokman_1 Kas_m 2024- Avans_T24-2112184_dekont.jbxd

Similarity

API ID: MessageSend$Window_wcscat
String ID: SysListView32
API String ID: 307300125-78025650
Opcode ID: 5198a9e2e5506230570f4946760778890ac77f2cacdeca35aded03b0ffa6c9df
Instruction ID: 6841f5ec3b8e484c0c7827e36df6928a7561fae43c5caf1ae324e8b25c2f586a
Opcode Fuzzy Hash: 5198a9e2e5506230570f4946760778890ac77f2cacdeca35aded03b0ffa6c9df
Instruction Fuzzy Hash: 3A419E70904308ABEB219FA4DC85BEA77E8EF08354F10542AF549B7292C6719D85CB64

Function 00E7172F Relevance: 12.4, APIs: 6, Strings: 1, Instructions: 135COMMON

Download Yara Rule

APIs

Part of subcall function 00E56532: CreateToolhelp32Snapshot.KERNEL32(00000002,00000000,?,00000000), ref: 00E56554
Part of subcall function 00E56532: Process32FirstW.KERNEL32(00000000,0000022C), ref: 00E56564
Part of subcall function 00E56532: CloseHandle.KERNEL32(00000000,?,00000000), ref: 00E565F9

OpenProcess.KERNEL32(00000001,00000000,?), ref: 00E7179A
GetLastError.KERNEL32 ref: 00E717AD
OpenProcess.KERNEL32(00000001,00000000,?), ref: 00E717D9
TerminateProcess.KERNEL32(00000000,00000000), ref: 00E71855
GetLastError.KERNEL32(00000000), ref: 00E71860
CloseHandle.KERNEL32(00000000), ref: 00E71895

Strings

SeDebugPrivilege, xrefs: 00E717B8

Memory Dump Source

Source File: 00000000.00000002.1262750966.0000000000E11000.00000020.00000001.01000000.00000003.sdmp, Offset: 00E10000, based on PE: true

Associated: 00000000.00000002.1262729095.0000000000E10000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1262808979.0000000000E9D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1262808979.0000000000EBE000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1262857687.0000000000ECA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1262878803.0000000000ED4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1262878803.0000000000F07000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_e10000_18112024_Dokman_1 Kas_m 2024- Avans_T24-2112184_dekont.jbxd

Similarity

API ID: Process$CloseErrorHandleLastOpen$CreateFirstProcess32SnapshotTerminateToolhelp32
String ID: SeDebugPrivilege
API String ID: 2533919879-2896544425
Opcode ID: b42692d9e8dc61420030aae73b8699e6edf9764624b81e5925540cf6372c8859
Instruction ID: 4e02e046a6660aadf4c061ced9bea11a7f6f6662063bb15a4e283ebf2ce19159
Opcode Fuzzy Hash: b42692d9e8dc61420030aae73b8699e6edf9764624b81e5925540cf6372c8859
Instruction Fuzzy Hash: 7441AF71600310AFDB19EF58CCA6FADB7E1AF44315F04949AF906BB282DB7499048B51

Function 00E55819 Relevance: 12.3, APIs: 2, Strings: 5, Instructions: 81windowCOMMON

Download Yara Rule

APIs

LoadIconW.USER32(00000000,00007F03), ref: 00E558B8

Strings

warning, xrefs: 00E558A1
question, xrefs: 00E55871
blank, xrefs: 00E5583A
info, xrefs: 00E55859
stop, xrefs: 00E55889

Memory Dump Source

Source File: 00000000.00000002.1262750966.0000000000E11000.00000020.00000001.01000000.00000003.sdmp, Offset: 00E10000, based on PE: true

Associated: 00000000.00000002.1262729095.0000000000E10000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1262808979.0000000000E9D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1262808979.0000000000EBE000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1262857687.0000000000ECA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1262878803.0000000000ED4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1262878803.0000000000F07000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_e10000_18112024_Dokman_1 Kas_m 2024- Avans_T24-2112184_dekont.jbxd

Similarity

API ID: IconLoad
String ID: blank$info$question$stop$warning
API String ID: 2457776203-404129466
Opcode ID: 541d699d6ce8e55f674ce26e5382fa8c42e9cb9a4cfd66012df835aa128731e4
Instruction ID: 20ad76844d92092791f6ecb961913a3d63cd1973123d14269bf0850be6c3bfe3
Opcode Fuzzy Hash: 541d699d6ce8e55f674ce26e5382fa8c42e9cb9a4cfd66012df835aa128731e4
Instruction Fuzzy Hash: CE113D3330DB42BEE7085B649CA2DEB67DC9F15324F20143FFD11F6281E761AA048664

Function 00E5A729 Relevance: 12.3, APIs: 8, Instructions: 317COMMON

Download Yara Rule

APIs

SafeArrayGetVartype.OLEAUT32(?,00000000), ref: 00E5A806

Memory Dump Source

Source File: 00000000.00000002.1262750966.0000000000E11000.00000020.00000001.01000000.00000003.sdmp, Offset: 00E10000, based on PE: true

Associated: 00000000.00000002.1262729095.0000000000E10000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1262808979.0000000000E9D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1262808979.0000000000EBE000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1262857687.0000000000ECA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1262878803.0000000000ED4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1262878803.0000000000F07000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_e10000_18112024_Dokman_1 Kas_m 2024- Avans_T24-2112184_dekont.jbxd

Similarity

API ID: ArraySafeVartype
String ID:
API String ID: 1725837607-0
Opcode ID: 07b3bdd76e90a869b88866ee691b045a6caeda6801cc6783be24bae544ad0a04
Instruction ID: b0d896e66c4a14a03c006c56896e0ab2c19eee999e2a1d4dbd51759954f060eb
Opcode Fuzzy Hash: 07b3bdd76e90a869b88866ee691b045a6caeda6801cc6783be24bae544ad0a04
Instruction Fuzzy Hash: D6C1AC71A0421ADFDB04CF98D481BAEB7F0EF08316F28593AEA15F7241D734A949CB91

Function 00E56B49 Relevance: 12.3, APIs: 6, Strings: 1, Instructions: 46windowCOMMON

Download Yara Rule

APIs

GetModuleHandleW.KERNEL32(00000000,?,?,00000100,00000000), ref: 00E56B63
LoadStringW.USER32(00000000), ref: 00E56B6A
GetModuleHandleW.KERNEL32(00000000,00001389,?,00000100), ref: 00E56B80
LoadStringW.USER32(00000000), ref: 00E56B87
_wprintf.LIBCMT ref: 00E56BAD
MessageBoxW.USER32(00000000,?,?,00011010), ref: 00E56BCB

Strings

%s (%d) : ==> %s: %s %s, xrefs: 00E56BA8

Memory Dump Source

Source File: 00000000.00000002.1262750966.0000000000E11000.00000020.00000001.01000000.00000003.sdmp, Offset: 00E10000, based on PE: true

Associated: 00000000.00000002.1262729095.0000000000E10000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1262808979.0000000000E9D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1262808979.0000000000EBE000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1262857687.0000000000ECA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1262878803.0000000000ED4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1262878803.0000000000F07000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_e10000_18112024_Dokman_1 Kas_m 2024- Avans_T24-2112184_dekont.jbxd

Similarity

API ID: HandleLoadModuleString$Message_wprintf
String ID: %s (%d) : ==> %s: %s %s
API String ID: 3648134473-3128320259
Opcode ID: 48990e4c42d7d39cbcf9cf9536c3366c8d4b0b36bb1ffd4d1756374333c6b0c2
Instruction ID: 94e4d864f7a9251ad2aa3093fc4758af8bfb2dac6fad65e0712552e667b098d4
Opcode Fuzzy Hash: 48990e4c42d7d39cbcf9cf9536c3366c8d4b0b36bb1ffd4d1756374333c6b0c2
Instruction Fuzzy Hash: 90016DF2904218BFEB51ABA59D89EE6776CD708305F4044A7B746F2041EA749E888B70

Function 00E72B19 Relevance: 12.3, APIs: 8, Instructions: 251registryCOMMON

Download Yara Rule

APIs

Part of subcall function 00E73C06: CharUpperBuffW.USER32(?,?,?,?,?,?,?,00E72BB5,?,?), ref: 00E73C1D

RegConnectRegistryW.ADVAPI32(?,?,?), ref: 00E72BF6

Memory Dump Source

Source File: 00000000.00000002.1262750966.0000000000E11000.00000020.00000001.01000000.00000003.sdmp, Offset: 00E10000, based on PE: true

Associated: 00000000.00000002.1262729095.0000000000E10000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1262808979.0000000000E9D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1262808979.0000000000EBE000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1262857687.0000000000ECA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1262878803.0000000000ED4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1262878803.0000000000F07000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_e10000_18112024_Dokman_1 Kas_m 2024- Avans_T24-2112184_dekont.jbxd

Similarity

API ID: BuffCharConnectRegistryUpper
String ID:
API String ID: 2595220575-0
Opcode ID: bb157ffc71cd8bb9e0c7d50018dfd36c21535ea38c8103b7aa9ea15b1d835635
Instruction ID: b7bc14c329d283fb1f424be3c4d6f876c55dcfd37e62134556ee3f8c9c9f64fc
Opcode Fuzzy Hash: bb157ffc71cd8bb9e0c7d50018dfd36c21535ea38c8103b7aa9ea15b1d835635
Instruction Fuzzy Hash: 94918E716043019FCB11EF54C891BAEB7E5FF88314F14A81DFA9AA72A1DB30E945CB42

Function 00E695BF Relevance: 12.2, APIs: 8, Instructions: 247networkCOMMON

Download Yara Rule

APIs

select.WSOCK32 ref: 00E69691
WSAGetLastError.WSOCK32(00000000), ref: 00E6969E
__WSAFDIsSet.WSOCK32(00000000,?), ref: 00E696C8
#17.WSOCK32(00000000,?,?,00000000,?,00000010), ref: 00E696E9
WSAGetLastError.WSOCK32(00000000), ref: 00E696F8
htons.WSOCK32(?), ref: 00E697AA
inet_ntoa.WSOCK32(?), ref: 00E69765

Part of subcall function 00E4D2FF: _strlen.LIBCMT ref: 00E4D309

_strlen.LIBCMT ref: 00E69800

Memory Dump Source

Source File: 00000000.00000002.1262750966.0000000000E11000.00000020.00000001.01000000.00000003.sdmp, Offset: 00E10000, based on PE: true

Associated: 00000000.00000002.1262729095.0000000000E10000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1262808979.0000000000E9D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1262808979.0000000000EBE000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1262857687.0000000000ECA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1262878803.0000000000ED4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1262878803.0000000000F07000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_e10000_18112024_Dokman_1 Kas_m 2024- Avans_T24-2112184_dekont.jbxd

Similarity

API ID: ErrorLast_strlen$htonsinet_ntoaselect
String ID:
API String ID: 3480843537-0
Opcode ID: e35c2b385d6ba46db93713a977c0de54f7d2a55e3a542dc59073a6dbf5643383
Instruction ID: d2232b4c1b78b2deba4bc5af3325184a24452cbbc080b4833f17c5c60505a68b
Opcode Fuzzy Hash: e35c2b385d6ba46db93713a977c0de54f7d2a55e3a542dc59073a6dbf5643383
Instruction Fuzzy Hash: 1981BE71508200AFC714EF64EC85EAFB7E8EB85714F105A1EF555AB2A2EB30DD44CB92

Function 00E3A979 Relevance: 12.1, APIs: 8, Instructions: 118COMMONLIBRARYCODE

Download Yara Rule

APIs

__mtinitlocknum.LIBCMT ref: 00E3A991

Part of subcall function 00E37D7C: __FF_MSGBANNER.LIBCMT ref: 00E37D91
Part of subcall function 00E37D7C: __NMSG_WRITE.LIBCMT ref: 00E37D98
Part of subcall function 00E37D7C: __malloc_crt.LIBCMT ref: 00E37DB8

__lock.LIBCMT ref: 00E3A9A4
__lock.LIBCMT ref: 00E3A9F0
InitializeCriticalSectionAndSpinCount.KERNEL32(8000000C,00000FA0,00EC6DE0,00000018,00E45E7B,?,00000000,00000109), ref: 00E3AA0C
EnterCriticalSection.KERNEL32(8000000C,00EC6DE0,00000018,00E45E7B,?,00000000,00000109), ref: 00E3AA29
LeaveCriticalSection.KERNEL32(8000000C), ref: 00E3AA39

Memory Dump Source

Source File: 00000000.00000002.1262750966.0000000000E11000.00000020.00000001.01000000.00000003.sdmp, Offset: 00E10000, based on PE: true

Associated: 00000000.00000002.1262729095.0000000000E10000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1262808979.0000000000E9D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1262808979.0000000000EBE000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1262857687.0000000000ECA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1262878803.0000000000ED4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1262878803.0000000000F07000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_e10000_18112024_Dokman_1 Kas_m 2024- Avans_T24-2112184_dekont.jbxd

Similarity

API ID: CriticalSection$__lock$CountEnterInitializeLeaveSpin__malloc_crt__mtinitlocknum
String ID:
API String ID: 1422805418-0
Opcode ID: 361db268bde143236e1063827f1893c9a69ee908cea2e505218960e0189f1b8c
Instruction ID: b90946e4b1fc3ae5cd6ffa56005087bbee73c035bd8a8042cf50ecfbf4d4616a
Opcode Fuzzy Hash: 361db268bde143236e1063827f1893c9a69ee908cea2e505218960e0189f1b8c
Instruction Fuzzy Hash: BD4137729002019FEB209F68DA4C79CBFB0AF41339F189339E4A5BB2D1D7749884CB85

Function 00E78ECC Relevance: 12.1, APIs: 8, Instructions: 95windowCOMMON

Download Yara Rule

APIs

DeleteObject.GDI32(00000000), ref: 00E78EE4
GetDC.USER32(00000000), ref: 00E78EEC
GetDeviceCaps.GDI32(00000000,0000005A), ref: 00E78EF7
ReleaseDC.USER32(00000000,00000000), ref: 00E78F03
CreateFontW.GDI32(?,00000000,00000000,00000000,00000000,?,?,?,00000001,00000004,00000000,?,00000000,?), ref: 00E78F3F
SendMessageW.USER32(?,00000030,00000000,00000001), ref: 00E78F50
MoveWindow.USER32(?,?,?,?,?,00000000,?,?,00E7BD19,?,?,000000FF,00000000,?,000000FF,?), ref: 00E78F8A
SendMessageW.USER32(?,00000142,00000000,00000000), ref: 00E78FAA

Memory Dump Source

Source File: 00000000.00000002.1262750966.0000000000E11000.00000020.00000001.01000000.00000003.sdmp, Offset: 00E10000, based on PE: true

Associated: 00000000.00000002.1262729095.0000000000E10000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1262808979.0000000000E9D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1262808979.0000000000EBE000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1262857687.0000000000ECA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1262878803.0000000000ED4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1262878803.0000000000F07000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_e10000_18112024_Dokman_1 Kas_m 2024- Avans_T24-2112184_dekont.jbxd

Similarity

API ID: MessageSend$CapsCreateDeleteDeviceFontMoveObjectReleaseWindow
String ID:
API String ID: 3864802216-0
Opcode ID: 69148209a0f91455af595ff9ab6f83b329899ff4178adfc97bb6a11bf31c492f
Instruction ID: a07527c1074daee724fc416ea37354ca8502ce91fccd7cd4a2257947127506d7
Opcode Fuzzy Hash: 69148209a0f91455af595ff9ab6f83b329899ff4178adfc97bb6a11bf31c492f
Instruction Fuzzy Hash: BF319F72244224BFEB148F61CD4AFEA3BAEEF49715F044066FE09EA192C6759841CB70

Function 00E80133 Relevance: 10.7, APIs: 7, Instructions: 245windowCOMMON

Download Yara Rule

APIs

Part of subcall function 00E2B34E: GetWindowLongW.USER32(?,000000EB), ref: 00E2B35F

GetSystemMetrics.USER32(0000000F), ref: 00E8016D
MoveWindow.USER32(00000003,?,00000000,00000001,00000000,00000000,?,?,?), ref: 00E8038D
SendMessageW.USER32(00000003,00000142,00000000,0000FFFF), ref: 00E803AB
InvalidateRect.USER32(?,00000000,00000001,?), ref: 00E803D6
SendMessageW.USER32(00000003,00000469,?,00000000), ref: 00E803FF
ShowWindow.USER32(00000003,00000000), ref: 00E80421
DefDlgProcW.USER32(?,00000005,?,?), ref: 00E80440

Memory Dump Source

Source File: 00000000.00000002.1262750966.0000000000E11000.00000020.00000001.01000000.00000003.sdmp, Offset: 00E10000, based on PE: true

Associated: 00000000.00000002.1262729095.0000000000E10000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1262808979.0000000000E9D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1262808979.0000000000EBE000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1262857687.0000000000ECA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1262878803.0000000000ED4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1262878803.0000000000F07000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_e10000_18112024_Dokman_1 Kas_m 2024- Avans_T24-2112184_dekont.jbxd

Similarity

API ID: Window$MessageSend$InvalidateLongMetricsMoveProcRectShowSystem
String ID:
API String ID: 3356174886-0
Opcode ID: b84dba17fda4e90837ffc7d1cc795c7c56576f56b763c2835a3682da2fcc9a88
Instruction ID: 8aa790a3d2c7065c6d3bf2e43a9251ddb02df48659b210fc6b48045a84716b8d
Opcode Fuzzy Hash: b84dba17fda4e90837ffc7d1cc795c7c56576f56b763c2835a3682da2fcc9a88
Instruction Fuzzy Hash: A7A1BB31600616EFDB58DF68C9897BDBBB1BF08704F049116E85CBB291D774AD58CB90

Function 00E2AE78 Relevance: 10.7, APIs: 7, Instructions: 218COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1262750966.0000000000E11000.00000020.00000001.01000000.00000003.sdmp, Offset: 00E10000, based on PE: true

Associated: 00000000.00000002.1262729095.0000000000E10000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1262808979.0000000000E9D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1262808979.0000000000EBE000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1262857687.0000000000ECA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1262878803.0000000000ED4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1262878803.0000000000F07000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_e10000_18112024_Dokman_1 Kas_m 2024- Avans_T24-2112184_dekont.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 287954a149caf1c8162174edcb1f1f777be766bd319bb6bd152d6c834091862a
Instruction ID: 641368330a10a4c3a00f270fb61bc25b2829733746179a7e51e510de85a00b82
Opcode Fuzzy Hash: 287954a149caf1c8162174edcb1f1f777be766bd319bb6bd152d6c834091862a
Instruction Fuzzy Hash: DC719BB0A04119EFDB04DF98DD89AAEBB79FF85314F248159F915BB250C334AA41CF61

Function 00E72230 Relevance: 10.7, APIs: 5, Strings: 1, Instructions: 191COMMON

Download Yara Rule

APIs

_memset.LIBCMT ref: 00E7225A
_memset.LIBCMT ref: 00E72323
ShellExecuteExW.SHELL32(?), ref: 00E72368

Part of subcall function 00E1936C: __swprintf.LIBCMT ref: 00E193AB
Part of subcall function 00E1936C: __itow.LIBCMT ref: 00E193DF

Part of subcall function 00E2C6F4: _wcscpy.LIBCMT ref: 00E2C717

CloseHandle.KERNEL32(00000000), ref: 00E7242F
FreeLibrary.KERNEL32(00000000), ref: 00E7243E

Strings

@, xrefs: 00E72334

Memory Dump Source

Source File: 00000000.00000002.1262750966.0000000000E11000.00000020.00000001.01000000.00000003.sdmp, Offset: 00E10000, based on PE: true

Associated: 00000000.00000002.1262729095.0000000000E10000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1262808979.0000000000E9D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1262808979.0000000000EBE000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1262857687.0000000000ECA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1262878803.0000000000ED4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1262878803.0000000000F07000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_e10000_18112024_Dokman_1 Kas_m 2024- Avans_T24-2112184_dekont.jbxd

Similarity

API ID: _memset$CloseExecuteFreeHandleLibraryShell__itow__swprintf_wcscpy
String ID: @
API String ID: 4082843840-2766056989
Opcode ID: d7cab027fc24b35d95d24495fc5f38462f67e75cc34606229f6ee5ec61ec4151
Instruction ID: 4facb898ee3fac51a000f7fca3583c01a4b403027103c427a503ed6b99e2da76
Opcode Fuzzy Hash: d7cab027fc24b35d95d24495fc5f38462f67e75cc34606229f6ee5ec61ec4151
Instruction Fuzzy Hash: F2715B70A006199FCF14EFA4D89199EBBF5FF48310F109459E96ABB391DB34AE41CB90

Function 00E53BC3 Relevance: 10.7, APIs: 7, Instructions: 164windowCOMMON

Download Yara Rule

APIs

GetParent.USER32(00000000), ref: 00E53C02
GetKeyboardState.USER32(?), ref: 00E53C17
SetKeyboardState.USER32(?), ref: 00E53C78
PostMessageW.USER32(00000000,00000100,00000010,?), ref: 00E53CA4
PostMessageW.USER32(00000000,00000100,00000011,?), ref: 00E53CC1
PostMessageW.USER32(00000000,00000100,00000012,?), ref: 00E53D05
PostMessageW.USER32(00000000,00000100,0000005B,?), ref: 00E53D26

Memory Dump Source

Source File: 00000000.00000002.1262750966.0000000000E11000.00000020.00000001.01000000.00000003.sdmp, Offset: 00E10000, based on PE: true

Associated: 00000000.00000002.1262729095.0000000000E10000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1262808979.0000000000E9D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1262808979.0000000000EBE000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1262857687.0000000000ECA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1262878803.0000000000ED4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1262878803.0000000000F07000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_e10000_18112024_Dokman_1 Kas_m 2024- Avans_T24-2112184_dekont.jbxd

Similarity

API ID: MessagePost$KeyboardState$Parent
String ID:
API String ID: 87235514-0
Opcode ID: b3e657cd19c8994e632de7b82deb9a026ecd72496821a3592730824e2378bb8d
Instruction ID: 2026bddd986abd11fbb4221dd92f8f47e5b63c1646e8b6abfc5078a7152314ba
Opcode Fuzzy Hash: b3e657cd19c8994e632de7b82deb9a026ecd72496821a3592730824e2378bb8d
Instruction Fuzzy Hash: 155109A15047D53DFB3283348C45B76BFB95B06349F08AC89E8D5764C2D294EE9CE760

Function 00E78FC8 Relevance: 10.6, APIs: 7, Instructions: 99windowCOMMON

Download Yara Rule

APIs

SendMessageW.USER32(00000000,000000F0,00000000,00000000), ref: 00E78FE7
GetWindowLongW.USER32(010ED598,000000F0), ref: 00E7901A
GetWindowLongW.USER32(010ED598,000000F0), ref: 00E7904F
SendMessageW.USER32(00000000,000000F1,00000000,00000000), ref: 00E79081
SendMessageW.USER32(00000000,000000F1,00000001,00000000), ref: 00E790AB
GetWindowLongW.USER32(00000000,000000F0), ref: 00E790BC
SetWindowLongW.USER32(00000000,000000F0,00000000), ref: 00E790D6

Memory Dump Source

Source File: 00000000.00000002.1262750966.0000000000E11000.00000020.00000001.01000000.00000003.sdmp, Offset: 00E10000, based on PE: true

Associated: 00000000.00000002.1262729095.0000000000E10000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1262808979.0000000000E9D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1262808979.0000000000EBE000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1262857687.0000000000ECA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1262878803.0000000000ED4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1262878803.0000000000F07000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_e10000_18112024_Dokman_1 Kas_m 2024- Avans_T24-2112184_dekont.jbxd

Similarity

API ID: LongWindow$MessageSend
String ID:
API String ID: 2178440468-0
Opcode ID: 0799b99ebcaec0feefd67aa2d0afba715ba9426bf8308a978458e2e1c60f4ae1
Instruction ID: 48f35b82c050c8c376acbf6f79bfb06825a4e1cc773800ec411a9ca03bb0814a
Opcode Fuzzy Hash: 0799b99ebcaec0feefd67aa2d0afba715ba9426bf8308a978458e2e1c60f4ae1
Instruction Fuzzy Hash: 90316535214224EFDB20CF59EC84F6433A5FF4A318F1491A6F529AB2B2CB71AC44DB41

Function 00E508AF Relevance: 10.6, APIs: 7, Instructions: 94memoryCOMMON

Download Yara Rule

APIs

MultiByteToWideChar.KERNEL32(00000000,00000000,?,000000FF,00000000,00000000), ref: 00E508F2
MultiByteToWideChar.KERNEL32(00000000,00000000,?,000000FF,00000000,00000000), ref: 00E50918
SysAllocString.OLEAUT32(00000000), ref: 00E5091B
SysAllocString.OLEAUT32(?), ref: 00E50939
SysFreeString.OLEAUT32(?), ref: 00E50942
StringFromGUID2.OLE32(?,?,00000028), ref: 00E50967
SysAllocString.OLEAUT32(?), ref: 00E50975

Memory Dump Source

Source File: 00000000.00000002.1262750966.0000000000E11000.00000020.00000001.01000000.00000003.sdmp, Offset: 00E10000, based on PE: true

Associated: 00000000.00000002.1262729095.0000000000E10000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1262808979.0000000000E9D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1262808979.0000000000EBE000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1262857687.0000000000ECA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1262878803.0000000000ED4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1262878803.0000000000F07000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_e10000_18112024_Dokman_1 Kas_m 2024- Avans_T24-2112184_dekont.jbxd

Similarity

API ID: String$Alloc$ByteCharMultiWide$FreeFrom
String ID:
API String ID: 3761583154-0
Opcode ID: ab70c95d22c1cb56e554f1dd15ce1c0ffae210ac6c1f4f528174106975fcf481
Instruction ID: e59223488fa6b682d6823bc1e5b1a0424d0a8a17dbdb1986e45811a66a3b661a
Opcode Fuzzy Hash: ab70c95d22c1cb56e554f1dd15ce1c0ffae210ac6c1f4f528174106975fcf481
Instruction Fuzzy Hash: E721F772600218AFEB109F79CC88DBB73ECEB49361B008522FD14EB155D670EC49CBA0

Function 00E52472 Relevance: 10.6, APIs: 3, Strings: 3, Instructions: 90COMMON

Download Yara Rule

APIs

__wcsnicmp.LIBCMT ref: 00E52485
__wcsnicmp.LIBCMT ref: 00E524A6
__wcsnicmp.LIBCMT ref: 00E524C0

Strings

#requireadmin, xrefs: 00E524A0
#OnAutoItStartRegister, xrefs: 00E524BA
#notrayicon, xrefs: 00E5247D

Memory Dump Source

Source File: 00000000.00000002.1262750966.0000000000E11000.00000020.00000001.01000000.00000003.sdmp, Offset: 00E10000, based on PE: true

Associated: 00000000.00000002.1262729095.0000000000E10000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1262808979.0000000000E9D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1262808979.0000000000EBE000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1262857687.0000000000ECA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1262878803.0000000000ED4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1262878803.0000000000F07000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_e10000_18112024_Dokman_1 Kas_m 2024- Avans_T24-2112184_dekont.jbxd

Similarity

API ID: __wcsnicmp
String ID: #OnAutoItStartRegister$#notrayicon$#requireadmin
API String ID: 1038674560-2734436370
Opcode ID: c2172fda7b5c50cde8b250d56152d8b46305f145de621a0971f56d8444b9e03c
Instruction ID: 35ff5a40b2dbac2164d6297e669a4485c916d8029f37ecb6c5136391e1157d45
Opcode Fuzzy Hash: c2172fda7b5c50cde8b250d56152d8b46305f145de621a0971f56d8444b9e03c
Instruction Fuzzy Hash: A8213A7224421167C234A624DC12FBB73E9EF66316F60682DFE46B7041F6519949C295

Function 00E50986 Relevance: 10.6, APIs: 7, Instructions: 89memoryCOMMON

Download Yara Rule

APIs

MultiByteToWideChar.KERNEL32(00000000,00000000,?,000000FF,00000000,00000000), ref: 00E509CB
MultiByteToWideChar.KERNEL32(00000000,00000000,?,000000FF,00000000,00000000), ref: 00E509F1
SysAllocString.OLEAUT32(00000000), ref: 00E509F4
SysAllocString.OLEAUT32 ref: 00E50A15
SysFreeString.OLEAUT32 ref: 00E50A1E
StringFromGUID2.OLE32(?,?,00000028), ref: 00E50A38
SysAllocString.OLEAUT32(?), ref: 00E50A46

Memory Dump Source

Source File: 00000000.00000002.1262750966.0000000000E11000.00000020.00000001.01000000.00000003.sdmp, Offset: 00E10000, based on PE: true

Associated: 00000000.00000002.1262729095.0000000000E10000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1262808979.0000000000E9D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1262808979.0000000000EBE000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1262857687.0000000000ECA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1262878803.0000000000ED4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1262878803.0000000000F07000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_e10000_18112024_Dokman_1 Kas_m 2024- Avans_T24-2112184_dekont.jbxd

Similarity

API ID: String$Alloc$ByteCharMultiWide$FreeFrom
String ID:
API String ID: 3761583154-0
Opcode ID: 122e013bce234a276e1216775c1dae2e18e0122e06f2f2b60ae6375bd9efa224
Instruction ID: 3dc381cc2a183f111e9ff29d35a1a8bc68c9d9625e6711a982d3fc92c26921ab
Opcode Fuzzy Hash: 122e013bce234a276e1216775c1dae2e18e0122e06f2f2b60ae6375bd9efa224
Instruction Fuzzy Hash: 4B218675204214AFDB10DFA9DC88DAA77ECEF483707008526FD19EB266D670EC498764

Function 00E7A2C8 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 75windowCOMMON

Download Yara Rule

APIs

Part of subcall function 00E2D17C: CreateWindowExW.USER32(?,?,?,?,?,?,?,?,?,?,00000000,00000096), ref: 00E2D1BA
Part of subcall function 00E2D17C: GetStockObject.GDI32(00000011), ref: 00E2D1CE
Part of subcall function 00E2D17C: SendMessageW.USER32(00000000,00000030,00000000), ref: 00E2D1D8

SendMessageW.USER32(00000000,00002001,00000000,FF000000), ref: 00E7A32D
SendMessageW.USER32(?,00000409,00000000,FF000000), ref: 00E7A33A
SendMessageW.USER32(?,00000402,00000000,00000000), ref: 00E7A345
SendMessageW.USER32(?,00000401,00000000,00640000), ref: 00E7A354
SendMessageW.USER32(?,00000404,00000001,00000000), ref: 00E7A360

Strings

Msctls_Progress32, xrefs: 00E7A2FE

Memory Dump Source

Source File: 00000000.00000002.1262750966.0000000000E11000.00000020.00000001.01000000.00000003.sdmp, Offset: 00E10000, based on PE: true

Associated: 00000000.00000002.1262729095.0000000000E10000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1262808979.0000000000E9D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1262808979.0000000000EBE000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1262857687.0000000000ECA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1262878803.0000000000ED4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1262878803.0000000000F07000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_e10000_18112024_Dokman_1 Kas_m 2024- Avans_T24-2112184_dekont.jbxd

Similarity

API ID: MessageSend$CreateObjectStockWindow
String ID: Msctls_Progress32
API String ID: 1025951953-3636473452
Opcode ID: c236af5f39d2cee26491a515674dcebc0efeb34d5a4eed75dacf4424779e044d
Instruction ID: 901e9c6140d51af3bd7610831be56e7831e427d48e13d07ecdf8a860be6ddccb
Opcode Fuzzy Hash: c236af5f39d2cee26491a515674dcebc0efeb34d5a4eed75dacf4424779e044d
Instruction Fuzzy Hash: 211190B1150219BEEF155FA1CC85EEB7F6DFF08798F059115BA08A60A0C7729C21DBA4

Function 00E2CCCD Relevance: 9.3, APIs: 6, Instructions: 253COMMON

Download Yara Rule

APIs

GetClientRect.USER32(?,?), ref: 00E2CCF6
GetWindowRect.USER32(?,?), ref: 00E2CD37
ScreenToClient.USER32(?,?), ref: 00E2CD5F
GetClientRect.USER32(?,?), ref: 00E2CE8C
GetWindowRect.USER32(?,?), ref: 00E2CEA5

Memory Dump Source

Source File: 00000000.00000002.1262750966.0000000000E11000.00000020.00000001.01000000.00000003.sdmp, Offset: 00E10000, based on PE: true

Associated: 00000000.00000002.1262729095.0000000000E10000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1262808979.0000000000E9D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1262808979.0000000000EBE000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1262857687.0000000000ECA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1262878803.0000000000ED4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1262878803.0000000000F07000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_e10000_18112024_Dokman_1 Kas_m 2024- Avans_T24-2112184_dekont.jbxd

Similarity

API ID: Rect$Client$Window$Screen
String ID:
API String ID: 1296646539-0
Opcode ID: 2c6457fe99df5ade9730d1b753a0a5d6ea88923ae565b6b6bb5b5b418cc293cf
Instruction ID: 76fd99974257e5d298fb9d64cdd4fa23c7eaba41e3b66bc3828ebfcca8d7f4c8
Opcode Fuzzy Hash: 2c6457fe99df5ade9730d1b753a0a5d6ea88923ae565b6b6bb5b5b418cc293cf
Instruction Fuzzy Hash: 4BB16C79900259DBDF10CFA8C8807EDBBB1FF08314F25A52AEC59EB250DB70A950DB65

Function 00E71BDF Relevance: 9.2, APIs: 6, Instructions: 163processCOMMON

Download Yara Rule

APIs

CreateToolhelp32Snapshot.KERNEL32 ref: 00E71C18
Process32FirstW.KERNEL32(00000000,?), ref: 00E71C26
__wsplitpath.LIBCMT ref: 00E71C54

Part of subcall function 00E31DFC: __wsplitpath_helper.LIBCMT ref: 00E31E3C

_wcscat.LIBCMT ref: 00E71C69
Process32NextW.KERNEL32(00000000,?), ref: 00E71CDF
CloseHandle.KERNEL32(00000000,?,?,00000002,00000000), ref: 00E71CF1

Memory Dump Source

Source File: 00000000.00000002.1262750966.0000000000E11000.00000020.00000001.01000000.00000003.sdmp, Offset: 00E10000, based on PE: true

Associated: 00000000.00000002.1262729095.0000000000E10000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1262808979.0000000000E9D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1262808979.0000000000EBE000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1262857687.0000000000ECA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1262878803.0000000000ED4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1262878803.0000000000F07000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_e10000_18112024_Dokman_1 Kas_m 2024- Avans_T24-2112184_dekont.jbxd

Similarity

API ID: Process32$CloseCreateFirstHandleNextSnapshotToolhelp32__wsplitpath__wsplitpath_helper_wcscat
String ID:
API String ID: 1380811348-0
Opcode ID: 134f85d3b6d3e6c257ef494776a994e7247aa5392422dcfec9bd18e006a5af98
Instruction ID: d415966a41ceeb1bf8da52f56b4d946da93ca5f0959ab769fcaebc6dce37f883
Opcode Fuzzy Hash: 134f85d3b6d3e6c257ef494776a994e7247aa5392422dcfec9bd18e006a5af98
Instruction Fuzzy Hash: 55517D711083109FD720DF64DC85EABB7ECEF88754F00595EF589A7251EB309A05CB92

Function 00E72FD6 Relevance: 9.2, APIs: 6, Instructions: 160registryCOMMON

Download Yara Rule

APIs

Part of subcall function 00E73C06: CharUpperBuffW.USER32(?,?,?,?,?,?,?,00E72BB5,?,?), ref: 00E73C1D

RegConnectRegistryW.ADVAPI32(?,?,?), ref: 00E730AF
RegOpenKeyExW.ADVAPI32(?,?,00000000,?,?), ref: 00E730EF
RegCloseKey.ADVAPI32(?,00000001,00000000), ref: 00E73112
RegEnumValueW.ADVAPI32(?,-00000001,?,?,00000000,?,00000000,00000000), ref: 00E7313B
RegCloseKey.ADVAPI32(?,?,00000000), ref: 00E7317E
RegCloseKey.ADVAPI32(00000000), ref: 00E7318B

Memory Dump Source

Source File: 00000000.00000002.1262750966.0000000000E11000.00000020.00000001.01000000.00000003.sdmp, Offset: 00E10000, based on PE: true

Associated: 00000000.00000002.1262729095.0000000000E10000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1262808979.0000000000E9D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1262808979.0000000000EBE000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1262857687.0000000000ECA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1262878803.0000000000ED4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1262878803.0000000000F07000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_e10000_18112024_Dokman_1 Kas_m 2024- Avans_T24-2112184_dekont.jbxd

Similarity

API ID: Close$BuffCharConnectEnumOpenRegistryUpperValue
String ID:
API String ID: 3451389628-0
Opcode ID: b07e5328ae0c5a91bbdab89f64abed316671c3d04e0f67974f97bc652d93ab0a
Instruction ID: c621b915a7403fcc99a412587ba410389e23cad5a6eeb4159ce7554d373a91f7
Opcode Fuzzy Hash: b07e5328ae0c5a91bbdab89f64abed316671c3d04e0f67974f97bc652d93ab0a
Instruction Fuzzy Hash: EB515A31208300AFC710EF64CC95EAAB7E9FF88314F04991EF555A72A1DB31EA49DB52

Function 00E784DE Relevance: 9.2, APIs: 6, Instructions: 152windowCOMMON

Download Yara Rule

APIs

GetMenu.USER32(?), ref: 00E78540
GetMenuItemCount.USER32(00000000), ref: 00E78577
GetMenuStringW.USER32(00000000,00000000,?,00007FFF,00000400), ref: 00E7859F
GetMenuItemID.USER32(?,?), ref: 00E7860E
GetSubMenu.USER32(?,?), ref: 00E7861C
PostMessageW.USER32(?,00000111,?,00000000), ref: 00E7866D

Memory Dump Source

Source File: 00000000.00000002.1262750966.0000000000E11000.00000020.00000001.01000000.00000003.sdmp, Offset: 00E10000, based on PE: true

Associated: 00000000.00000002.1262729095.0000000000E10000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1262808979.0000000000E9D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1262808979.0000000000EBE000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1262857687.0000000000ECA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1262878803.0000000000ED4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1262878803.0000000000F07000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_e10000_18112024_Dokman_1 Kas_m 2024- Avans_T24-2112184_dekont.jbxd

Similarity

API ID: Menu$Item$CountMessagePostString
String ID:
API String ID: 650687236-0
Opcode ID: 1f58c49978caf897405809cb14b90772e15365e81e8da14fbb2bb55864ef8079
Instruction ID: b390c1c705cb2dd5d38ceb343458fa43ae35ad53b4d8415773a02c85a6d38e69
Opcode Fuzzy Hash: 1f58c49978caf897405809cb14b90772e15365e81e8da14fbb2bb55864ef8079
Instruction Fuzzy Hash: 0C517D71A00225AFCB11EFA4C945AEEB7F4EF58314F10945AE919B7351DB70AE418B90

Function 00E54AC2 Relevance: 9.1, APIs: 6, Instructions: 136windowCOMMON

Download Yara Rule

APIs

_memset.LIBCMT ref: 00E54B10
GetMenuItemInfoW.USER32(?,000000FF,00000000,00000030), ref: 00E54B5B
IsMenu.USER32(00000000), ref: 00E54B7B
CreatePopupMenu.USER32 ref: 00E54BAF
GetMenuItemCount.USER32(000000FF), ref: 00E54C0D
InsertMenuItemW.USER32(00000000,?,00000001,00000030), ref: 00E54C3E

Memory Dump Source

Source File: 00000000.00000002.1262750966.0000000000E11000.00000020.00000001.01000000.00000003.sdmp, Offset: 00E10000, based on PE: true

Associated: 00000000.00000002.1262729095.0000000000E10000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1262808979.0000000000E9D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1262808979.0000000000EBE000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1262857687.0000000000ECA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1262878803.0000000000ED4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1262878803.0000000000F07000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_e10000_18112024_Dokman_1 Kas_m 2024- Avans_T24-2112184_dekont.jbxd

Similarity

API ID: Menu$Item$CountCreateInfoInsertPopup_memset
String ID:
API String ID: 3311875123-0
Opcode ID: 8991febd4a43309ccb53ac9069daf50266912139ad7fcc3ce9183ad3bb6335ea
Instruction ID: 3936ca016793b5445c4230b2b5b6013037ab8923774f0ac019fc60c3ecef4cb0
Opcode Fuzzy Hash: 8991febd4a43309ccb53ac9069daf50266912139ad7fcc3ce9183ad3bb6335ea
Instruction Fuzzy Hash: 7F51A1B0601209EFDF24CF68D888BADBBF4AF8531EF145959E815BB2D1D3709988CB51

Function 00E68DE2 Relevance: 9.1, APIs: 6, Instructions: 136networkCOMMON

Download Yara Rule

APIs

select.WSOCK32(00000000,00000001,00000000,00000000,?), ref: 00E68E7C
WSAGetLastError.WSOCK32(00000000), ref: 00E68E89
__WSAFDIsSet.WSOCK32(00000000,00000001), ref: 00E68EAD
#16.WSOCK32(?,?,00000000,00000000), ref: 00E68EC5
_strlen.LIBCMT ref: 00E68EF7
WSAGetLastError.WSOCK32(00000000), ref: 00E68F6A

Memory Dump Source

Source File: 00000000.00000002.1262750966.0000000000E11000.00000020.00000001.01000000.00000003.sdmp, Offset: 00E10000, based on PE: true

Associated: 00000000.00000002.1262729095.0000000000E10000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1262808979.0000000000E9D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1262808979.0000000000EBE000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1262857687.0000000000ECA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1262878803.0000000000ED4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1262878803.0000000000F07000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_e10000_18112024_Dokman_1 Kas_m 2024- Avans_T24-2112184_dekont.jbxd

Similarity

API ID: ErrorLast$_strlenselect
String ID:
API String ID: 2217125717-0
Opcode ID: 1bcfebb86ac068e891f4b10586dc66f30d250ec716dccef4b74cbdeb429e846b
Instruction ID: 619dcf9f5cd3c2719cd503aec538e4f18574d56c37ecd7a50abe4175003f79a6
Opcode Fuzzy Hash: 1bcfebb86ac068e891f4b10586dc66f30d250ec716dccef4b74cbdeb429e846b
Instruction Fuzzy Hash: 2441E271604208AFCB14EBA4DD85EEEB7F9AF18354F10665AF416B7291DF30AE44CB60

Function 00E2ABF5 Relevance: 9.1, APIs: 6, Instructions: 113COMMON

Download Yara Rule

APIs

Part of subcall function 00E2B34E: GetWindowLongW.USER32(?,000000EB), ref: 00E2B35F

BeginPaint.USER32(?,?,?), ref: 00E2AC2A
GetWindowRect.USER32(?,?), ref: 00E2AC8E
ScreenToClient.USER32(?,?), ref: 00E2ACAB
SetViewportOrgEx.GDI32(00000000,?,?,00000000), ref: 00E2ACBC
EndPaint.USER32(?,?,?,?,?), ref: 00E2AD06
Rectangle.GDI32(00000000,00000000,00000000,?,?), ref: 00E8E673

Memory Dump Source

Source File: 00000000.00000002.1262750966.0000000000E11000.00000020.00000001.01000000.00000003.sdmp, Offset: 00E10000, based on PE: true

Associated: 00000000.00000002.1262729095.0000000000E10000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1262808979.0000000000E9D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1262808979.0000000000EBE000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1262857687.0000000000ECA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1262878803.0000000000ED4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1262878803.0000000000F07000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_e10000_18112024_Dokman_1 Kas_m 2024- Avans_T24-2112184_dekont.jbxd

Similarity

API ID: PaintWindow$BeginClientLongRectRectangleScreenViewport
String ID:
API String ID: 2592858361-0
Opcode ID: 8f2f5ac9570c62e75a1cfb4eb1d08b4cc9cf8a6b9ed954d73e8fec10e7b7bd41
Instruction ID: 1e9466eae2efe35c7ed4165c0cc9304177bf4c4ff6acf5aee661b62d3e10077f
Opcode Fuzzy Hash: 8f2f5ac9570c62e75a1cfb4eb1d08b4cc9cf8a6b9ed954d73e8fec10e7b7bd41
Instruction Fuzzy Hash: BA41F871105310AFC710DF15EC85FBB7BF8EB55324F08126AF9A8A72A1D7309849DB62

Function 00E7E397 Relevance: 9.1, APIs: 6, Instructions: 108windowCOMMON

Download Yara Rule

APIs

ShowWindow.USER32(00ED1628,00000000,00ED1628,00000000,00000000,00ED1628,?,00E8DC5D,00000000,?,00000000,00000000,00000000,?,00E8DAD1,00000004), ref: 00E7E40B
EnableWindow.USER32(00000000,00000000), ref: 00E7E42F
ShowWindow.USER32(00ED1628,00000000), ref: 00E7E48F
ShowWindow.USER32(00000000,00000004), ref: 00E7E4A1
EnableWindow.USER32(00000000,00000001), ref: 00E7E4C5
SendMessageW.USER32(?,0000130C,00000000,00000000), ref: 00E7E4E8

Memory Dump Source

Source File: 00000000.00000002.1262750966.0000000000E11000.00000020.00000001.01000000.00000003.sdmp, Offset: 00E10000, based on PE: true

Associated: 00000000.00000002.1262729095.0000000000E10000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1262808979.0000000000E9D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1262808979.0000000000EBE000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1262857687.0000000000ECA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1262878803.0000000000ED4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1262878803.0000000000F07000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_e10000_18112024_Dokman_1 Kas_m 2024- Avans_T24-2112184_dekont.jbxd

Similarity

API ID: Window$Show$Enable$MessageSend
String ID:
API String ID: 642888154-0
Opcode ID: 3213d728b536bf662291a12cf4183816fbd8a2f75f1ab5a974838e8827e5c57a
Instruction ID: 0a05a5160af613b19face5fea9bbf3dce2969562a775014e0d46ca0fa30f0826
Opcode Fuzzy Hash: 3213d728b536bf662291a12cf4183816fbd8a2f75f1ab5a974838e8827e5c57a
Instruction Fuzzy Hash: 46416230605150EFDB21CF24C899B947BE1BF09308F1891EAEA6DAF3A2D731A845CB51

Function 00E598BA Relevance: 9.1, APIs: 6, Instructions: 100fileCOMMON

Download Yara Rule

APIs

InterlockedExchange.KERNEL32(?,000001F5), ref: 00E598D1

Part of subcall function 00E2F4EA: std::exception::exception.LIBCMT ref: 00E2F51E
Part of subcall function 00E2F4EA: __CxxThrowException@8.LIBCMT ref: 00E2F533

ReadFile.KERNEL32(0000FFFF,00000000,0000FFFF,?,00000000), ref: 00E59908
EnterCriticalSection.KERNEL32(?), ref: 00E59924
LeaveCriticalSection.KERNEL32(?), ref: 00E5999E
ReadFile.KERNEL32(0000FFFF,00000000,0000FFFF,00000000,00000000), ref: 00E599B3
InterlockedExchange.KERNEL32(?,000001F6), ref: 00E599D2

Memory Dump Source

Source File: 00000000.00000002.1262750966.0000000000E11000.00000020.00000001.01000000.00000003.sdmp, Offset: 00E10000, based on PE: true

Associated: 00000000.00000002.1262729095.0000000000E10000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1262808979.0000000000E9D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1262808979.0000000000EBE000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1262857687.0000000000ECA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1262878803.0000000000ED4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1262878803.0000000000F07000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_e10000_18112024_Dokman_1 Kas_m 2024- Avans_T24-2112184_dekont.jbxd

Similarity

API ID: CriticalExchangeFileInterlockedReadSection$EnterException@8LeaveThrowstd::exception::exception
String ID:
API String ID: 2537439066-0
Opcode ID: b7993243dd13d7699d3038926bde95735870432ae53b47b32b0368e8d8f6bea2
Instruction ID: a97baf7688cd4c212be183f670bc3021037dedbab2aec3eb04b163608cdbbfcb
Opcode Fuzzy Hash: b7993243dd13d7699d3038926bde95735870432ae53b47b32b0368e8d8f6bea2
Instruction Fuzzy Hash: F6316D31900115EFDB00EFA5DC85EAEB7B8FF84311B1480BAE904BA256D770DA14DBA0

Function 00E69B45 Relevance: 9.1, APIs: 6, Instructions: 99COMMON

Download Yara Rule

APIs

GetForegroundWindow.USER32(?,?,?,?,?,?,00E677F4,?,?,00000000,00000001), ref: 00E69B53

Part of subcall function 00E66544: GetWindowRect.USER32(?,?), ref: 00E66557

GetDesktopWindow.USER32 ref: 00E69B7D
GetWindowRect.USER32(00000000), ref: 00E69B84
mouse_event.USER32(00008001,?,?,00000001,00000001), ref: 00E69BB6

Part of subcall function 00E57A58: Sleep.KERNEL32(?,00000000,?,?,?,?,?,?,?,?,?), ref: 00E57AD0

GetCursorPos.USER32(?), ref: 00E69BE2
mouse_event.USER32(00008001,?,?,00000000,00000000), ref: 00E69C44

Memory Dump Source

Source File: 00000000.00000002.1262750966.0000000000E11000.00000020.00000001.01000000.00000003.sdmp, Offset: 00E10000, based on PE: true

Associated: 00000000.00000002.1262729095.0000000000E10000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1262808979.0000000000E9D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1262808979.0000000000EBE000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1262857687.0000000000ECA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1262878803.0000000000ED4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1262878803.0000000000F07000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_e10000_18112024_Dokman_1 Kas_m 2024- Avans_T24-2112184_dekont.jbxd

Similarity

API ID: Window$Rectmouse_event$CursorDesktopForegroundSleep
String ID:
API String ID: 4137160315-0
Opcode ID: abf0125dfd1fbd4b8d31ddaa72614374f29e8a861137f63679b585c1515e1e70
Instruction ID: 54832a0182baf0485c69c10cc10e305b600ebae454f0133dc0d68e99a5de6f22
Opcode Fuzzy Hash: abf0125dfd1fbd4b8d31ddaa72614374f29e8a861137f63679b585c1515e1e70
Instruction Fuzzy Hash: FB31CE72148315AFC710DF54EC49A9AB7EDFF88354F00091AF585E7182DA31EA18CB92

Function 00E4AF64 Relevance: 9.1, APIs: 6, Instructions: 73processCOMMON

Download Yara Rule

APIs

GetCurrentProcess.KERNEL32(0000000A,00000004), ref: 00E4AFAE
OpenProcessToken.ADVAPI32(00000000), ref: 00E4AFB5
CreateEnvironmentBlock.USERENV(?,00000004,00000001), ref: 00E4AFC4
CloseHandle.KERNEL32(00000004), ref: 00E4AFCF
CreateProcessWithLogonW.ADVAPI32(?,?,?,00000000,00000000,?,?,00000000,?,?,?), ref: 00E4AFFE
DestroyEnvironmentBlock.USERENV(00000000), ref: 00E4B012

Memory Dump Source

Source File: 00000000.00000002.1262750966.0000000000E11000.00000020.00000001.01000000.00000003.sdmp, Offset: 00E10000, based on PE: true

Associated: 00000000.00000002.1262729095.0000000000E10000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1262808979.0000000000E9D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1262808979.0000000000EBE000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1262857687.0000000000ECA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1262878803.0000000000ED4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1262878803.0000000000F07000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_e10000_18112024_Dokman_1 Kas_m 2024- Avans_T24-2112184_dekont.jbxd

Similarity

API ID: Process$BlockCreateEnvironment$CloseCurrentDestroyHandleLogonOpenTokenWith
String ID:
API String ID: 1413079979-0
Opcode ID: c978b405b7156f4c147f4ac44d44ea2db5032e0c83c6385405efc74e43e395b6
Instruction ID: 670e29b2daa887216d65fa7664612026ae3cc1d37495ab7a4429580b0ca16365
Opcode Fuzzy Hash: c978b405b7156f4c147f4ac44d44ea2db5032e0c83c6385405efc74e43e395b6
Instruction Fuzzy Hash: 97217F72144209AFCB128F95ED09BEE7BA9EB44318F084026FA01B2161C376DD28DB61

Function 00E7EBF6 Relevance: 9.0, APIs: 6, Instructions: 49COMMON

Download Yara Rule

APIs

Part of subcall function 00E2AF83: ExtCreatePen.GDI32(?,?,00000000,00000000,00000000,?,?,00000000), ref: 00E2AFE3
Part of subcall function 00E2AF83: SelectObject.GDI32(?,00000000), ref: 00E2AFF2
Part of subcall function 00E2AF83: BeginPath.GDI32(?), ref: 00E2B009
Part of subcall function 00E2AF83: SelectObject.GDI32(?,00000000), ref: 00E2B033

MoveToEx.GDI32(00000000,-00000002,?,00000000), ref: 00E7EC20
LineTo.GDI32(00000000,00000003,?), ref: 00E7EC34
MoveToEx.GDI32(00000000,00000000,?,00000000), ref: 00E7EC42
LineTo.GDI32(00000000,00000000,?), ref: 00E7EC52
EndPath.GDI32(00000000), ref: 00E7EC62
StrokePath.GDI32(00000000), ref: 00E7EC72

Memory Dump Source

Source File: 00000000.00000002.1262750966.0000000000E11000.00000020.00000001.01000000.00000003.sdmp, Offset: 00E10000, based on PE: true

Associated: 00000000.00000002.1262729095.0000000000E10000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1262808979.0000000000E9D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1262808979.0000000000EBE000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1262857687.0000000000ECA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1262878803.0000000000ED4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1262878803.0000000000F07000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_e10000_18112024_Dokman_1 Kas_m 2024- Avans_T24-2112184_dekont.jbxd

Similarity

API ID: Path$LineMoveObjectSelect$BeginCreateStroke
String ID:
API String ID: 43455801-0
Opcode ID: 3fe6007ecea800a54fb4f7b23b268c0723e75bc6749fdf337b077ca2086a5399
Instruction ID: 73b62a969fa59d04a2e4f7ac60f51b3bceaaf9aa85f8493a22f89225d8f0ac6d
Opcode Fuzzy Hash: 3fe6007ecea800a54fb4f7b23b268c0723e75bc6749fdf337b077ca2086a5399
Instruction Fuzzy Hash: A4115B7200415CBFEF029F91DD88EEA7F6DEB08354F048063BE18AA160C7719D59DBA0

Function 00E4E19B Relevance: 9.0, APIs: 6, Instructions: 48COMMON

Download Yara Rule

APIs

GetDC.USER32(00000000), ref: 00E4E1C0
GetDeviceCaps.GDI32(00000000,00000058), ref: 00E4E1D1
GetDeviceCaps.GDI32(00000000,0000005A), ref: 00E4E1D8
ReleaseDC.USER32(00000000,00000000), ref: 00E4E1E0
MulDiv.KERNEL32(000009EC,?,00000000), ref: 00E4E1F7
MulDiv.KERNEL32(000009EC,?,?), ref: 00E4E209

Part of subcall function 00E49AA3: RaiseException.KERNEL32(-C0000018,00000001,00000000,00000000,00E49A05,00000000,00000000,?,00E49DDB), ref: 00E4A53A

Memory Dump Source

Source File: 00000000.00000002.1262750966.0000000000E11000.00000020.00000001.01000000.00000003.sdmp, Offset: 00E10000, based on PE: true

Associated: 00000000.00000002.1262729095.0000000000E10000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1262808979.0000000000E9D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1262808979.0000000000EBE000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1262857687.0000000000ECA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1262878803.0000000000ED4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1262878803.0000000000F07000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_e10000_18112024_Dokman_1 Kas_m 2024- Avans_T24-2112184_dekont.jbxd

Similarity

API ID: CapsDevice$ExceptionRaiseRelease
String ID:
API String ID: 603618608-0
Opcode ID: 0353097aae2bd15fd7b669770725b99e09f707d38d930e3f8fe5e070fa89023c
Instruction ID: 9653ff73038bd537eab86d33d16e3c0e95136b8295d9ed6853f2066f27c3f901
Opcode Fuzzy Hash: 0353097aae2bd15fd7b669770725b99e09f707d38d930e3f8fe5e070fa89023c
Instruction Fuzzy Hash: 7A018FB5A40318BFEB109BA69C45B5EBFB9EB48351F004067EA04BB391D6709C00CBA0

Function 00E37B47 Relevance: 9.0, APIs: 6, Instructions: 45threadCOMMON

Download Yara Rule

APIs

__init_pointers.LIBCMT ref: 00E37B47

Part of subcall function 00E3123A: __initp_misc_winsig.LIBCMT ref: 00E3125E
Part of subcall function 00E3123A: GetModuleHandleW.KERNEL32(kernel32.dll), ref: 00E37F51
Part of subcall function 00E3123A: GetProcAddress.KERNEL32(00000000,FlsAlloc), ref: 00E37F65
Part of subcall function 00E3123A: GetProcAddress.KERNEL32(00000000,FlsFree), ref: 00E37F78
Part of subcall function 00E3123A: GetProcAddress.KERNEL32(00000000,FlsGetValue), ref: 00E37F8B
Part of subcall function 00E3123A: GetProcAddress.KERNEL32(00000000,FlsSetValue), ref: 00E37F9E
Part of subcall function 00E3123A: GetProcAddress.KERNEL32(00000000,InitializeCriticalSectionEx), ref: 00E37FB1
Part of subcall function 00E3123A: GetProcAddress.KERNEL32(00000000,CreateSemaphoreExW), ref: 00E37FC4
Part of subcall function 00E3123A: GetProcAddress.KERNEL32(00000000,SetThreadStackGuarantee), ref: 00E37FD7
Part of subcall function 00E3123A: GetProcAddress.KERNEL32(00000000,CreateThreadpoolTimer), ref: 00E37FEA
Part of subcall function 00E3123A: GetProcAddress.KERNEL32(00000000,SetThreadpoolTimer), ref: 00E37FFD
Part of subcall function 00E3123A: GetProcAddress.KERNEL32(00000000,WaitForThreadpoolTimerCallbacks), ref: 00E38010
Part of subcall function 00E3123A: GetProcAddress.KERNEL32(00000000,CloseThreadpoolTimer), ref: 00E38023
Part of subcall function 00E3123A: GetProcAddress.KERNEL32(00000000,CreateThreadpoolWait), ref: 00E38036
Part of subcall function 00E3123A: GetProcAddress.KERNEL32(00000000,SetThreadpoolWait), ref: 00E38049
Part of subcall function 00E3123A: GetProcAddress.KERNEL32(00000000,CloseThreadpoolWait), ref: 00E3805C
Part of subcall function 00E3123A: GetProcAddress.KERNEL32(00000000,FlushProcessWriteBuffers), ref: 00E3806F

__mtinitlocks.LIBCMT ref: 00E37B4C

Part of subcall function 00E37E23: InitializeCriticalSectionAndSpinCount.KERNEL32(00ECAC68,00000FA0,?,?,00E37B51,00E35E77,00EC6C70,00000014), ref: 00E37E41

__mtterm.LIBCMT ref: 00E37B55

Part of subcall function 00E37BBD: DeleteCriticalSection.KERNEL32(00000000,00000000,?,?,00E37B5A,00E35E77,00EC6C70,00000014), ref: 00E37D3F
Part of subcall function 00E37BBD: _free.LIBCMT ref: 00E37D46
Part of subcall function 00E37BBD: DeleteCriticalSection.KERNEL32(00ECAC68,?,?,00E37B5A,00E35E77,00EC6C70,00000014), ref: 00E37D68

__calloc_crt.LIBCMT ref: 00E37B7A
GetCurrentThreadId.KERNEL32 ref: 00E37BA3

Memory Dump Source

Source File: 00000000.00000002.1262750966.0000000000E11000.00000020.00000001.01000000.00000003.sdmp, Offset: 00E10000, based on PE: true

Associated: 00000000.00000002.1262729095.0000000000E10000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1262808979.0000000000E9D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1262808979.0000000000EBE000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1262857687.0000000000ECA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1262878803.0000000000ED4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1262878803.0000000000F07000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_e10000_18112024_Dokman_1 Kas_m 2024- Avans_T24-2112184_dekont.jbxd

Similarity

API ID: AddressProc$CriticalSection$Delete$CountCurrentHandleInitializeModuleSpinThread__calloc_crt__init_pointers__initp_misc_winsig__mtinitlocks__mtterm_free
String ID:
API String ID: 2942034483-0
Opcode ID: 915be59709e8971ad457d3c3f7ff6113da36a1cdfd3c19db9ac9002db4b142cf
Instruction ID: b74484aaafb4c983ebce8db5574059babc1b711d6e651c3e1f0e0626e3b1ba71
Opcode Fuzzy Hash: 915be59709e8971ad457d3c3f7ff6113da36a1cdfd3c19db9ac9002db4b142cf
Instruction Fuzzy Hash: A9F062B211D3161AE63876757C0EA4A7EE59B01778F2426A9F8E0F50D1EB218841C164

Function 00E127EC Relevance: 9.0, APIs: 6, Instructions: 44keyboardCOMMON

Download Yara Rule

APIs

MapVirtualKeyW.USER32(0000005B,00000000), ref: 00E1281D
MapVirtualKeyW.USER32(00000010,00000000), ref: 00E12825
MapVirtualKeyW.USER32(000000A0,00000000), ref: 00E12830
MapVirtualKeyW.USER32(000000A1,00000000), ref: 00E1283B
MapVirtualKeyW.USER32(00000011,00000000), ref: 00E12843
MapVirtualKeyW.USER32(00000012,00000000), ref: 00E1284B

Memory Dump Source

Source File: 00000000.00000002.1262750966.0000000000E11000.00000020.00000001.01000000.00000003.sdmp, Offset: 00E10000, based on PE: true

Associated: 00000000.00000002.1262729095.0000000000E10000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1262808979.0000000000E9D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1262808979.0000000000EBE000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1262857687.0000000000ECA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1262878803.0000000000ED4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1262878803.0000000000F07000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_e10000_18112024_Dokman_1 Kas_m 2024- Avans_T24-2112184_dekont.jbxd

Similarity

API ID: Virtual
String ID:
API String ID: 4278518827-0
Opcode ID: 96a1c0d184097b2cf15869592b9d0d36e66baec712fa3b78849db894bc0f9a59
Instruction ID: f698dd50740976f919581047c47d5509eddd887b106f45545b8223d20105a950
Opcode Fuzzy Hash: 96a1c0d184097b2cf15869592b9d0d36e66baec712fa3b78849db894bc0f9a59
Instruction Fuzzy Hash: 640167B1902B5ABDE3008F6A8C85B56FFA8FF19354F00411BA15C47A42C7F5A868CBE5

Function 00E59AD5 Relevance: 9.0, APIs: 6, Instructions: 44COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1262750966.0000000000E11000.00000020.00000001.01000000.00000003.sdmp, Offset: 00E10000, based on PE: true

Associated: 00000000.00000002.1262729095.0000000000E10000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1262808979.0000000000E9D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1262808979.0000000000EBE000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1262857687.0000000000ECA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1262878803.0000000000ED4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1262878803.0000000000F07000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_e10000_18112024_Dokman_1 Kas_m 2024- Avans_T24-2112184_dekont.jbxd

Similarity

API ID: CriticalExchangeInterlockedSection$EnterLeaveObjectSingleTerminateThreadWait
String ID:
API String ID: 1423608774-0
Opcode ID: cd1c7830b29137b942d62b2870d93742b88113effba5bd9e711926b722b4bc91
Instruction ID: 800e1c6112ec8898e82afd00073bde445745686ef649a390ae9669a687308cd5
Opcode Fuzzy Hash: cd1c7830b29137b942d62b2870d93742b88113effba5bd9e711926b722b4bc91
Instruction Fuzzy Hash: 1001A932105221EFDB155B65ED48DEF7769FF88703744182BF903B21A2DB749809DB60

Function 00E57BF7 Relevance: 9.0, APIs: 6, Instructions: 42windowtimethreadCOMMON

Download Yara Rule

APIs

PostMessageW.USER32(?,00000010,00000000,00000000), ref: 00E57C07
SendMessageTimeoutW.USER32(?,00000010,00000000,00000000,00000002,000001F4,?), ref: 00E57C1D
GetWindowThreadProcessId.USER32(?,?), ref: 00E57C2C
OpenProcess.KERNEL32(001F0FFF,00000000,?,?,?,?,00000010,00000000,00000000,00000002,000001F4,?,?,00000010,00000000,00000000), ref: 00E57C3B
TerminateProcess.KERNEL32(00000000,00000000,?,?,?,00000010,00000000,00000000,00000002,000001F4,?,?,00000010,00000000,00000000), ref: 00E57C45
CloseHandle.KERNEL32(00000000,?,?,?,00000010,00000000,00000000,00000002,000001F4,?,?,00000010,00000000,00000000), ref: 00E57C4C

Memory Dump Source

Source File: 00000000.00000002.1262750966.0000000000E11000.00000020.00000001.01000000.00000003.sdmp, Offset: 00E10000, based on PE: true

Associated: 00000000.00000002.1262729095.0000000000E10000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1262808979.0000000000E9D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1262808979.0000000000EBE000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1262857687.0000000000ECA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1262878803.0000000000ED4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1262878803.0000000000F07000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_e10000_18112024_Dokman_1 Kas_m 2024- Avans_T24-2112184_dekont.jbxd

Similarity

API ID: Process$Message$CloseHandleOpenPostSendTerminateThreadTimeoutWindow
String ID:
API String ID: 839392675-0
Opcode ID: fbcc77be30eef49ee0e2fbfb6a74ba8d4e1ead700a0f4a6e966bae289d67733e
Instruction ID: bb2762d72db59f02e8debb74379c36c7c0a074790b8304ad7d50c531713189b7
Opcode Fuzzy Hash: fbcc77be30eef49ee0e2fbfb6a74ba8d4e1ead700a0f4a6e966bae289d67733e
Instruction Fuzzy Hash: 49F03A72246168BFE7215B639C0EEEF7B7CEFCAB15F00001BFA02A1051D7A05A49C6B5

Function 00E59A20 Relevance: 9.0, APIs: 6, Instructions: 33synchronizationthreadCOMMONLIBRARYCODE

Download Yara Rule

APIs

InterlockedExchange.KERNEL32(?,?), ref: 00E59A33
EnterCriticalSection.KERNEL32(?,?,?,?,00E85DEE,?,?,?,?,?,00E1ED63), ref: 00E59A44
TerminateThread.KERNEL32(?,000001F6,?,?,?,00E85DEE,?,?,?,?,?,00E1ED63), ref: 00E59A51
WaitForSingleObject.KERNEL32(?,000003E8,?,?,?,00E85DEE,?,?,?,?,?,00E1ED63), ref: 00E59A5E

Part of subcall function 00E593D1: CloseHandle.KERNEL32(?,?,00E59A6B,?,?,?,00E85DEE,?,?,?,?,?,00E1ED63), ref: 00E593DB

InterlockedExchange.KERNEL32(?,000001F6), ref: 00E59A71
LeaveCriticalSection.KERNEL32(?,?,?,?,00E85DEE,?,?,?,?,?,00E1ED63), ref: 00E59A78

Memory Dump Source

Source File: 00000000.00000002.1262750966.0000000000E11000.00000020.00000001.01000000.00000003.sdmp, Offset: 00E10000, based on PE: true

Associated: 00000000.00000002.1262729095.0000000000E10000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1262808979.0000000000E9D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1262808979.0000000000EBE000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1262857687.0000000000ECA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1262878803.0000000000ED4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1262878803.0000000000F07000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_e10000_18112024_Dokman_1 Kas_m 2024- Avans_T24-2112184_dekont.jbxd

Similarity

API ID: CriticalExchangeInterlockedSection$CloseEnterHandleLeaveObjectSingleTerminateThreadWait
String ID:
API String ID: 3495660284-0
Opcode ID: 72f27c77a5ed16dd22a6c5e66a89c864299e88178382215473885881aa0b9945
Instruction ID: 07cfaa2ab6d01629d6aecf8bb46f448155e2f26068d01d91452eb99e01f9bf79
Opcode Fuzzy Hash: 72f27c77a5ed16dd22a6c5e66a89c864299e88178382215473885881aa0b9945
Instruction Fuzzy Hash: 33F05E32149221EFD7121BA5ED89DEE7769FF85302B141427F503B10B6EB759809DB60

Function 00E11CDE Relevance: 9.0, APIs: 4, Strings: 1, Instructions: 250COMMON

Download Yara Rule

APIs

Part of subcall function 00E2F4EA: std::exception::exception.LIBCMT ref: 00E2F51E
Part of subcall function 00E2F4EA: __CxxThrowException@8.LIBCMT ref: 00E2F533

__swprintf.LIBCMT ref: 00E11EA6

Strings

\\[\\nrt]|%%|%[-+ 0#]?([0-9]*|\*)?(\.[0-9]*|\.\*)?[hlL]?[diouxXeEfgGs], xrefs: 00E11D49

Memory Dump Source

Source File: 00000000.00000002.1262750966.0000000000E11000.00000020.00000001.01000000.00000003.sdmp, Offset: 00E10000, based on PE: true

Associated: 00000000.00000002.1262729095.0000000000E10000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1262808979.0000000000E9D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1262808979.0000000000EBE000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1262857687.0000000000ECA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1262878803.0000000000ED4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1262878803.0000000000F07000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_e10000_18112024_Dokman_1 Kas_m 2024- Avans_T24-2112184_dekont.jbxd

Similarity

API ID: Exception@8Throw__swprintfstd::exception::exception
String ID: \\[\\nrt]|%%|%[-+ 0#]?([0-9]*|\*)?(\.[0-9]*|\.\*)?[hlL]?[diouxXeEfgGs]
API String ID: 2125237772-557222456
Opcode ID: 40a2bccabce77adad1693dfea634a9d965644dc5fc1c56f9518d2f3071c2a845
Instruction ID: a9f8ee481fec22780162c97eb46dfb6724bc47accc32d46804afa3c6e67e2191
Opcode Fuzzy Hash: 40a2bccabce77adad1693dfea634a9d965644dc5fc1c56f9518d2f3071c2a845
Instruction Fuzzy Hash: 43919E715082019FCB24EF24C895CAEB7E4BF85700F10695DF999B72A1DB70ED85CBA2

Function 00E6AFE0 Relevance: 9.0, APIs: 3, Strings: 2, Instructions: 229COMMON

Download Yara Rule

APIs

VariantInit.OLEAUT32(?), ref: 00E6B006
CharUpperBuffW.USER32(?,?), ref: 00E6B115
VariantClear.OLEAUT32(?), ref: 00E6B298

Part of subcall function 00E59DC5: VariantInit.OLEAUT32(00000000), ref: 00E59E05
Part of subcall function 00E59DC5: VariantCopy.OLEAUT32(?,?), ref: 00E59E0E
Part of subcall function 00E59DC5: VariantClear.OLEAUT32(?), ref: 00E59E1A

Strings

Incorrect Parameter format, xrefs: 00E6B03E, 00E6B20B
AUTOIT.ERROR, xrefs: 00E6B11B

Memory Dump Source

Source File: 00000000.00000002.1262750966.0000000000E11000.00000020.00000001.01000000.00000003.sdmp, Offset: 00E10000, based on PE: true

Associated: 00000000.00000002.1262729095.0000000000E10000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1262808979.0000000000E9D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1262808979.0000000000EBE000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1262857687.0000000000ECA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1262878803.0000000000ED4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1262878803.0000000000F07000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_e10000_18112024_Dokman_1 Kas_m 2024- Avans_T24-2112184_dekont.jbxd

Similarity

API ID: Variant$ClearInit$BuffCharCopyUpper
String ID: AUTOIT.ERROR$Incorrect Parameter format
API String ID: 4237274167-1221869570
Opcode ID: badab943a4cae3c722f83d99f3e74e69f338219cbfd5133434963b168c0634fd
Instruction ID: 70e58f403760cc62e1927985d35e513e240c077ed3cef4507f76a61f8de608d2
Opcode Fuzzy Hash: badab943a4cae3c722f83d99f3e74e69f338219cbfd5133434963b168c0634fd
Instruction Fuzzy Hash: 42919A30648301DFCB10DF24D49099ABBF4AF89744F14582EF89AEB362DB31E985CB52

Function 00E55347 Relevance: 8.9, APIs: 4, Strings: 1, Instructions: 180windowCOMMON

Download Yara Rule

APIs

Part of subcall function 00E2C6F4: _wcscpy.LIBCMT ref: 00E2C717

_memset.LIBCMT ref: 00E55438
GetMenuItemInfoW.USER32(?), ref: 00E55467
SetMenuItemInfoW.USER32(?,?,00000000,?), ref: 00E55513
SetMenuDefaultItem.USER32(?,000000FF,00000000), ref: 00E5553D

Strings

0, xrefs: 00E55430

Memory Dump Source

Source File: 00000000.00000002.1262750966.0000000000E11000.00000020.00000001.01000000.00000003.sdmp, Offset: 00E10000, based on PE: true

Associated: 00000000.00000002.1262729095.0000000000E10000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1262808979.0000000000E9D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1262808979.0000000000EBE000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1262857687.0000000000ECA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1262878803.0000000000ED4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1262878803.0000000000F07000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_e10000_18112024_Dokman_1 Kas_m 2024- Avans_T24-2112184_dekont.jbxd

Similarity

API ID: ItemMenu$Info$Default_memset_wcscpy
String ID: 0
API String ID: 4152858687-4108050209
Opcode ID: d47eb114a5ef24ba754c943e9e1d917be595747e600e49a3aa16a1b9f99d332b
Instruction ID: bfe5475bb2abda81a9b9df638731dadbf012842ade2d616e1025ecc31c98bf94
Opcode Fuzzy Hash: d47eb114a5ef24ba754c943e9e1d917be595747e600e49a3aa16a1b9f99d332b
Instruction Fuzzy Hash: 6B51F6732047019BD7149B28C8616BBB7E4EF8535AF142D2AFCA6F31E1E760CD488B52

Function 00E50213 Relevance: 8.9, APIs: 4, Strings: 1, Instructions: 120comlibraryloaderCOMMON

Download Yara Rule

APIs

CoCreateInstance.OLE32(?,00000000,00000005,?,?,?,?,?,?,?,?,?,?,?), ref: 00E5027B
SetErrorMode.KERNEL32(00000001,?,?,?,?,?,?,?,?,?), ref: 00E502B1
GetProcAddress.KERNEL32(?,DllGetClassObject), ref: 00E502C2
SetErrorMode.KERNEL32(00000000,?,?,?,?,?,?,?,?,?), ref: 00E50344

Strings

DllGetClassObject, xrefs: 00E502B7

Memory Dump Source

Source File: 00000000.00000002.1262750966.0000000000E11000.00000020.00000001.01000000.00000003.sdmp, Offset: 00E10000, based on PE: true

Associated: 00000000.00000002.1262729095.0000000000E10000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1262808979.0000000000E9D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1262808979.0000000000EBE000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1262857687.0000000000ECA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1262878803.0000000000ED4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1262878803.0000000000F07000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_e10000_18112024_Dokman_1 Kas_m 2024- Avans_T24-2112184_dekont.jbxd

Similarity

API ID: ErrorMode$AddressCreateInstanceProc
String ID: DllGetClassObject
API String ID: 753597075-1075368562
Opcode ID: 922319172be65c5255b0200e5b7139798efdd9d0838c73e3a8e2c00ab9b0cd4a
Instruction ID: ac55b23354a03b75c8d09e85ef174507ca500f02d0936bb4d286afc6db32c76d
Opcode Fuzzy Hash: 922319172be65c5255b0200e5b7139798efdd9d0838c73e3a8e2c00ab9b0cd4a
Instruction Fuzzy Hash: 54416AB1600204EFDB15CF54C885B9A7BB9EF84316F1494AEFD09AF216D7B1D948CBA0

Function 00E55007 Relevance: 8.9, APIs: 4, Strings: 1, Instructions: 114windowCOMMON

Download Yara Rule

APIs

_memset.LIBCMT ref: 00E55075
GetMenuItemInfoW.USER32 ref: 00E55091
DeleteMenu.USER32(00000004,00000007,00000000), ref: 00E550D7
DeleteMenu.USER32(?,00000000,00000000,?,00000000,00000000,00ED1708,00000000), ref: 00E55120

Strings

0, xrefs: 00E5506D

Memory Dump Source

Source File: 00000000.00000002.1262750966.0000000000E11000.00000020.00000001.01000000.00000003.sdmp, Offset: 00E10000, based on PE: true

Associated: 00000000.00000002.1262729095.0000000000E10000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1262808979.0000000000E9D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1262808979.0000000000EBE000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1262857687.0000000000ECA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1262878803.0000000000ED4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1262878803.0000000000F07000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_e10000_18112024_Dokman_1 Kas_m 2024- Avans_T24-2112184_dekont.jbxd

Similarity

API ID: Menu$Delete$InfoItem_memset
String ID: 0
API String ID: 1173514356-4108050209
Opcode ID: 7e50fa2ce43c7ad005940cf316b12d61c714ae7525be9d3b4230e1ca6796d503
Instruction ID: e183dedbe4800bc8349b901bfecccb285c1e52ff6b2165976e4981fd3b6924a2
Opcode Fuzzy Hash: 7e50fa2ce43c7ad005940cf316b12d61c714ae7525be9d3b4230e1ca6796d503
Instruction Fuzzy Hash: C141E572205B019FD710DF24DC94B6ABBE4AF85319F045A5EFC55A72D1D730E848CB62

Function 00E70567 Relevance: 8.8, APIs: 1, Strings: 4, Instructions: 100COMMON

Download Yara Rule

APIs

CharLowerBuffW.USER32(?,?,?,?), ref: 00E70587

Strings

none, xrefs: 00E70662
cdecl, xrefs: 00E705DE
winapi, xrefs: 00E705F8
stdcall, xrefs: 00E70609

Memory Dump Source

Source File: 00000000.00000002.1262750966.0000000000E11000.00000020.00000001.01000000.00000003.sdmp, Offset: 00E10000, based on PE: true

Associated: 00000000.00000002.1262729095.0000000000E10000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1262808979.0000000000E9D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1262808979.0000000000EBE000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1262857687.0000000000ECA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1262878803.0000000000ED4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1262878803.0000000000F07000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_e10000_18112024_Dokman_1 Kas_m 2024- Avans_T24-2112184_dekont.jbxd

Similarity

API ID: BuffCharLower
String ID: cdecl$none$stdcall$winapi
API String ID: 2358735015-567219261
Opcode ID: 03eae095b9255aab9481523809cf6c3524b8834a78c5a67db8124c1d61e6cef5
Instruction ID: fa65362633bf0a2d42356844224a2af97458a688a4362ac7eb4c13ac29a45b7f
Opcode Fuzzy Hash: 03eae095b9255aab9481523809cf6c3524b8834a78c5a67db8124c1d61e6cef5
Instruction Fuzzy Hash: 9531A170600216AFCF00EF94CD519EEB3B4FF94314B10AA69E826B76D1DB71A956CB80

Function 00E4B80A Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 93windowCOMMON

Download Yara Rule

APIs

SendMessageW.USER32(?,00000188,00000000,00000000), ref: 00E4B88E
SendMessageW.USER32(?,0000018A,00000000,00000000), ref: 00E4B8A1
SendMessageW.USER32(?,00000189,?,00000000), ref: 00E4B8D1

Strings

ComboBox, xrefs: 00E4B815
ListBox, xrefs: 00E4B84D

Memory Dump Source

Source File: 00000000.00000002.1262750966.0000000000E11000.00000020.00000001.01000000.00000003.sdmp, Offset: 00E10000, based on PE: true

Associated: 00000000.00000002.1262729095.0000000000E10000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1262808979.0000000000E9D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1262808979.0000000000EBE000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1262857687.0000000000ECA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1262878803.0000000000ED4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1262878803.0000000000F07000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_e10000_18112024_Dokman_1 Kas_m 2024- Avans_T24-2112184_dekont.jbxd

Similarity

API ID: MessageSend
String ID: ComboBox$ListBox
API String ID: 3850602802-1403004172
Opcode ID: 292e460abbeac945efe09d0b5cbf79335f5e09ec53535a42835a52e4d70972d2
Instruction ID: 6ef13a4bbda856be964ea22191242d45d937cbfc3d0546f32cae09b2f54cbece
Opcode Fuzzy Hash: 292e460abbeac945efe09d0b5cbf79335f5e09ec53535a42835a52e4d70972d2
Instruction Fuzzy Hash: CF21F371940208BFDB08AB64EC86DFE77BCDF49354B10612AF026B71E1DB748D0A9760

Function 00E643E2 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 85networkCOMMON

Download Yara Rule

APIs

InternetOpenUrlW.WININET(?,?,00000000,00000000,?,00000000), ref: 00E64401
HttpSendRequestW.WININET(00000000,00000000,00000000,00000000,00000000), ref: 00E64427
HttpQueryInfoW.WININET(00000000,00000005,?,?,?), ref: 00E64457
InternetCloseHandle.WININET(00000000), ref: 00E6449E

Part of subcall function 00E65052: GetLastError.KERNEL32(?,?,00E643CC,00000000,00000000,00000001), ref: 00E65067

Strings

, xrefs: 00E64450

Memory Dump Source

Source File: 00000000.00000002.1262750966.0000000000E11000.00000020.00000001.01000000.00000003.sdmp, Offset: 00E10000, based on PE: true

Associated: 00000000.00000002.1262729095.0000000000E10000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1262808979.0000000000E9D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1262808979.0000000000EBE000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1262857687.0000000000ECA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1262878803.0000000000ED4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1262878803.0000000000F07000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_e10000_18112024_Dokman_1 Kas_m 2024- Avans_T24-2112184_dekont.jbxd

Similarity

API ID: HttpInternet$CloseErrorHandleInfoLastOpenQueryRequestSend
String ID:
API String ID: 1951874230-3916222277
Opcode ID: 154f970f958f0044cb9c80947bc4331bb56a5ee67c194b082c8f23f8f21c3ef0
Instruction ID: 1beeddb5d5d1f28f510ec93b99c824df8e7f37a538436433dd8c710389cdd4f3
Opcode Fuzzy Hash: 154f970f958f0044cb9c80947bc4331bb56a5ee67c194b082c8f23f8f21c3ef0
Instruction Fuzzy Hash: 962180F2644208BEE7119F94EC86EBB76ECEB48798F10901BF115B6180DE648D059771

Function 00E790E2 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 80windowlibraryCOMMON

Download Yara Rule

APIs

Part of subcall function 00E2D17C: CreateWindowExW.USER32(?,?,?,?,?,?,?,?,?,?,00000000,00000096), ref: 00E2D1BA
Part of subcall function 00E2D17C: GetStockObject.GDI32(00000011), ref: 00E2D1CE
Part of subcall function 00E2D17C: SendMessageW.USER32(00000000,00000030,00000000), ref: 00E2D1D8

SendMessageW.USER32(00000000,00000467,00000000,?), ref: 00E7915C
LoadLibraryW.KERNEL32(?), ref: 00E79163
SendMessageW.USER32(?,00000467,00000000,00000000), ref: 00E79178
DestroyWindow.USER32(?), ref: 00E79180

Strings

SysAnimate32, xrefs: 00E79137

Memory Dump Source

Source File: 00000000.00000002.1262750966.0000000000E11000.00000020.00000001.01000000.00000003.sdmp, Offset: 00E10000, based on PE: true

Associated: 00000000.00000002.1262729095.0000000000E10000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1262808979.0000000000E9D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1262808979.0000000000EBE000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1262857687.0000000000ECA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1262878803.0000000000ED4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1262878803.0000000000F07000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_e10000_18112024_Dokman_1 Kas_m 2024- Avans_T24-2112184_dekont.jbxd

Similarity

API ID: MessageSend$Window$CreateDestroyLibraryLoadObjectStock
String ID: SysAnimate32
API String ID: 4146253029-1011021900
Opcode ID: a28cd596134db2e8fe0ac714edd89897917b30e66e67eb5fd9ab1e7a6f498fc8
Instruction ID: 3c9e075d0fbc9fffed6abefab01bf76072eb9d9ca016f747ca78ade4cffdb02a
Opcode Fuzzy Hash: a28cd596134db2e8fe0ac714edd89897917b30e66e67eb5fd9ab1e7a6f498fc8
Instruction Fuzzy Hash: 3021BE71200206BFEF104E64DC85EBB37A9EF99378F51A259F918B2192C331CC61A760

Function 00E59568 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 78filepipeCOMMON

Download Yara Rule

APIs

GetStdHandle.KERNEL32(0000000C), ref: 00E59588
CreatePipe.KERNEL32(?,?,0000000C,00000000), ref: 00E595B9
GetStdHandle.KERNEL32(0000000C), ref: 00E595CB
CreateFileW.KERNEL32(nul,40000000,00000002,0000000C,00000003,00000080,00000000), ref: 00E59605

Strings

nul, xrefs: 00E59600

Memory Dump Source

Source File: 00000000.00000002.1262750966.0000000000E11000.00000020.00000001.01000000.00000003.sdmp, Offset: 00E10000, based on PE: true

Associated: 00000000.00000002.1262729095.0000000000E10000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1262808979.0000000000E9D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1262808979.0000000000EBE000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1262857687.0000000000ECA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1262878803.0000000000ED4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1262878803.0000000000F07000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_e10000_18112024_Dokman_1 Kas_m 2024- Avans_T24-2112184_dekont.jbxd

Similarity

API ID: CreateHandle$FilePipe
String ID: nul
API String ID: 4209266947-2873401336
Opcode ID: e08ca9456519497d34b01ed38ca5773155c102ea48ea62f86b76aa8a706fec8b
Instruction ID: a8dbe2b094f18229b09677a500209d022423e58a7a5c592213bcfe629b688627
Opcode Fuzzy Hash: e08ca9456519497d34b01ed38ca5773155c102ea48ea62f86b76aa8a706fec8b
Instruction Fuzzy Hash: 62215A70600205EBDB219F25DC45ADE7BA8AF44725F205A1AFDA1F72E1E770D958CB20

Function 00E59634 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 78filepipeCOMMON

Download Yara Rule

APIs

GetStdHandle.KERNEL32(000000F6), ref: 00E59653
CreatePipe.KERNEL32(?,?,0000000C,00000000), ref: 00E59683
GetStdHandle.KERNEL32(000000F6), ref: 00E59694
CreateFileW.KERNEL32(nul,80000000,00000001,0000000C,00000003,00000080,00000000), ref: 00E596CE

Strings

nul, xrefs: 00E596C9

Memory Dump Source

Source File: 00000000.00000002.1262750966.0000000000E11000.00000020.00000001.01000000.00000003.sdmp, Offset: 00E10000, based on PE: true

Associated: 00000000.00000002.1262729095.0000000000E10000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1262808979.0000000000E9D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1262808979.0000000000EBE000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1262857687.0000000000ECA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1262878803.0000000000ED4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1262878803.0000000000F07000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_e10000_18112024_Dokman_1 Kas_m 2024- Avans_T24-2112184_dekont.jbxd

Similarity

API ID: CreateHandle$FilePipe
String ID: nul
API String ID: 4209266947-2873401336
Opcode ID: be53b5b6d9be53c61ec251d9a4895090d20e271805a4f532669f3498802bdd61
Instruction ID: 9e2d5d9514012a5db794e0696797b48043a585a1abea0427bcffa13bbdacce2c
Opcode Fuzzy Hash: be53b5b6d9be53c61ec251d9a4895090d20e271805a4f532669f3498802bdd61
Instruction Fuzzy Hash: B2217A71600215DBDB209F69CC44EDA77E8AF44725F201E19ECA1F72D1E6B0984DCB10

Function 00E5DAF6 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 72COMMON

Download Yara Rule

APIs

SetErrorMode.KERNEL32(00000001), ref: 00E5DB0A
GetVolumeInformationW.KERNEL32(?,?,00007FFF,?,00000000,00000000,00000000,00000000), ref: 00E5DB5E
__swprintf.LIBCMT ref: 00E5DB77
SetErrorMode.KERNEL32(00000000,00000001,00000000,00EADC00), ref: 00E5DBB5

Strings

%lu, xrefs: 00E5DB71

Memory Dump Source

Source File: 00000000.00000002.1262750966.0000000000E11000.00000020.00000001.01000000.00000003.sdmp, Offset: 00E10000, based on PE: true

Associated: 00000000.00000002.1262729095.0000000000E10000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1262808979.0000000000E9D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1262808979.0000000000EBE000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1262857687.0000000000ECA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1262878803.0000000000ED4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1262878803.0000000000F07000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_e10000_18112024_Dokman_1 Kas_m 2024- Avans_T24-2112184_dekont.jbxd

Similarity

API ID: ErrorMode$InformationVolume__swprintf
String ID: %lu
API String ID: 3164766367-685833217
Opcode ID: 6e024ecabbc0396a8ec627345326e317d242335d435dc799192277a4b2ef5312
Instruction ID: 9b522272980deebf52136c9ae581886ef4656b53865b59d885d6ba3a9a7245e0
Opcode Fuzzy Hash: 6e024ecabbc0396a8ec627345326e317d242335d435dc799192277a4b2ef5312
Instruction Fuzzy Hash: 11217135A00208AFCB10EB65DD85EEEBBF8EF49704B10506AF905F7251DB71EA45CB61

Function 00E4C9E0 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 67windowCOMMON

Download Yara Rule

APIs

Part of subcall function 00E4C82D: SendMessageTimeoutW.USER32(?,00000000,00000000,00000000,00000002,00001388,00000001), ref: 00E4C84A
Part of subcall function 00E4C82D: GetWindowThreadProcessId.USER32(?,00000000), ref: 00E4C85D
Part of subcall function 00E4C82D: GetCurrentThreadId.KERNEL32 ref: 00E4C864
Part of subcall function 00E4C82D: AttachThreadInput.USER32(00000000), ref: 00E4C86B

GetFocus.USER32 ref: 00E4CA05

Part of subcall function 00E4C876: GetParent.USER32(?), ref: 00E4C884

GetClassNameW.USER32(?,?,00000100), ref: 00E4CA4E
EnumChildWindows.USER32(?,00E4CAC4), ref: 00E4CA76
__swprintf.LIBCMT ref: 00E4CA90

Strings

%s%d, xrefs: 00E4CA8A

Memory Dump Source

Source File: 00000000.00000002.1262750966.0000000000E11000.00000020.00000001.01000000.00000003.sdmp, Offset: 00E10000, based on PE: true

Associated: 00000000.00000002.1262729095.0000000000E10000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1262808979.0000000000E9D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1262808979.0000000000EBE000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1262857687.0000000000ECA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1262878803.0000000000ED4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1262878803.0000000000F07000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_e10000_18112024_Dokman_1 Kas_m 2024- Avans_T24-2112184_dekont.jbxd

Similarity

API ID: Thread$AttachChildClassCurrentEnumFocusInputMessageNameParentProcessSendTimeoutWindowWindows__swprintf
String ID: %s%d
API String ID: 3187004680-1110647743
Opcode ID: 4a6f3f95ef193804d07433c60078020bc9113ed0ac761dd77513211da843223b
Instruction ID: eeda97dde937ff52a20dc93c7fc4679f8c1358598fb6f4b3725e21e42ca00daf
Opcode Fuzzy Hash: 4a6f3f95ef193804d07433c60078020bc9113ed0ac761dd77513211da843223b
Instruction Fuzzy Hash: C61184715002097BCB51BF609C85FE937B8AF49714F106066FE19BB182DB709545DB70

Function 00E37A94 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 41COMMONLIBRARYCODE

Download Yara Rule

APIs

__lock.LIBCMT ref: 00E37AD8

Part of subcall function 00E37CF4: __mtinitlocknum.LIBCMT ref: 00E37D06
Part of subcall function 00E37CF4: EnterCriticalSection.KERNEL32(00000000,?,00E37ADD,0000000D), ref: 00E37D1F

InterlockedIncrement.KERNEL32(?), ref: 00E37AE5
__lock.LIBCMT ref: 00E37AF9
___addlocaleref.LIBCMT ref: 00E37B17

Strings

`, xrefs: 00E37AA3

Memory Dump Source

Source File: 00000000.00000002.1262750966.0000000000E11000.00000020.00000001.01000000.00000003.sdmp, Offset: 00E10000, based on PE: true

Associated: 00000000.00000002.1262729095.0000000000E10000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1262808979.0000000000E9D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1262808979.0000000000EBE000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1262857687.0000000000ECA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1262878803.0000000000ED4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1262878803.0000000000F07000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_e10000_18112024_Dokman_1 Kas_m 2024- Avans_T24-2112184_dekont.jbxd

Similarity

API ID: __lock$CriticalEnterIncrementInterlockedSection___addlocaleref__mtinitlocknum
String ID: `
API String ID: 1687444384-4168407445
Opcode ID: feb93009a39084e2981d15efd1ba0403ad589539b7ee197944c10c829107cfa6
Instruction ID: 468e910a2b0c8217f005f9acbac1437208a44d8b252ca46154dfa5151e725c71
Opcode Fuzzy Hash: feb93009a39084e2981d15efd1ba0403ad589539b7ee197944c10c829107cfa6
Instruction Fuzzy Hash: 5F015BB1404B00AED731DF75C90A74AFBF0AF44725F20A90EA4DAA72A0CB70A684CB41

Function 00E7E32E Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 40processCOMMON

Download Yara Rule

APIs

_memset.LIBCMT ref: 00E7E33D
_memset.LIBCMT ref: 00E7E34C
CreateProcessW.KERNEL32(00000000,?,00000000,00000000,00000000,00000020,00000000,00000000,00ED3D00,00ED3D44), ref: 00E7E37B
CloseHandle.KERNEL32 ref: 00E7E38D

Strings

D=, xrefs: 00E7E346

Memory Dump Source

Source File: 00000000.00000002.1262750966.0000000000E11000.00000020.00000001.01000000.00000003.sdmp, Offset: 00E10000, based on PE: true

Associated: 00000000.00000002.1262729095.0000000000E10000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1262808979.0000000000E9D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1262808979.0000000000EBE000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1262857687.0000000000ECA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1262878803.0000000000ED4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1262878803.0000000000F07000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_e10000_18112024_Dokman_1 Kas_m 2024- Avans_T24-2112184_dekont.jbxd

Similarity

API ID: _memset$CloseCreateHandleProcess
String ID: D=
API String ID: 3277943733-488882995
Opcode ID: 6c143413fb7334b4a853ec8ddaac679f159c85eb851c55eca451d2bbc480a8f3
Instruction ID: d4ab274bfd457cc66551865ed13f84c29305a13f4ec9a355fe5e2073ea192c7e
Opcode Fuzzy Hash: 6c143413fb7334b4a853ec8ddaac679f159c85eb851c55eca451d2bbc480a8f3
Instruction Fuzzy Hash: A2F03AF1541314BEE2105B76BC4AF777FADDB04754F005422BE08F62A2D3759E048AAA

Function 00E71945 Relevance: 7.7, APIs: 5, Instructions: 232COMMON

Download Yara Rule

APIs

OpenProcess.KERNEL32(00000410,00000000,00000000), ref: 00E719F3
GetProcessIoCounters.KERNEL32(00000000,?), ref: 00E71A26
GetProcessMemoryInfo.PSAPI(00000000,?,00000028), ref: 00E71B49
CloseHandle.KERNEL32(?), ref: 00E71BBF

Memory Dump Source

Source File: 00000000.00000002.1262750966.0000000000E11000.00000020.00000001.01000000.00000003.sdmp, Offset: 00E10000, based on PE: true

Associated: 00000000.00000002.1262729095.0000000000E10000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1262808979.0000000000E9D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1262808979.0000000000EBE000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1262857687.0000000000ECA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1262878803.0000000000ED4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1262878803.0000000000F07000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_e10000_18112024_Dokman_1 Kas_m 2024- Avans_T24-2112184_dekont.jbxd

Similarity

API ID: Process$CloseCountersHandleInfoMemoryOpen
String ID:
API String ID: 2364364464-0
Opcode ID: a8ddfcd24385ff1acb315c4ddbd5d4b013814b6d6ec86faf22bb12e53bfaab06
Instruction ID: f1ce2d9d4279eee13338251c85e52f027098a5024e951d8e984c5ad6cfb7fe0d
Opcode Fuzzy Hash: a8ddfcd24385ff1acb315c4ddbd5d4b013814b6d6ec86faf22bb12e53bfaab06
Instruction Fuzzy Hash: F5816E70600314EBDF209F64C896BADBBE5BF48720F14D499F909BF382D7B4A9418B90

Function 00E7E062 Relevance: 7.7, APIs: 5, Instructions: 187windowCOMMON

Download Yara Rule

APIs

SendMessageW.USER32(?,0000041C,00000000,00000000), ref: 00E7E1D5
SendMessageW.USER32(?,000000B0,?,?), ref: 00E7E20D
IsDlgButtonChecked.USER32(?,00000001), ref: 00E7E248
GetWindowLongW.USER32(?,000000EC), ref: 00E7E269
SendMessageW.USER32(?,000000A1,00000002,00000000), ref: 00E7E281

Memory Dump Source

Source File: 00000000.00000002.1262750966.0000000000E11000.00000020.00000001.01000000.00000003.sdmp, Offset: 00E10000, based on PE: true

Associated: 00000000.00000002.1262729095.0000000000E10000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1262808979.0000000000E9D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1262808979.0000000000EBE000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1262857687.0000000000ECA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1262878803.0000000000ED4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1262878803.0000000000F07000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_e10000_18112024_Dokman_1 Kas_m 2024- Avans_T24-2112184_dekont.jbxd

Similarity

API ID: MessageSend$ButtonCheckedLongWindow
String ID:
API String ID: 3188977179-0
Opcode ID: 79be1cb5b34bb40e80fd3fd198cf046e2e8a6f478ea3bf6f05593e871338fb0a
Instruction ID: bea59904e1f07ae888b82223ef1b0a71a8c2899e5866affea664ccfd5178e043
Opcode Fuzzy Hash: 79be1cb5b34bb40e80fd3fd198cf046e2e8a6f478ea3bf6f05593e871338fb0a
Instruction Fuzzy Hash: E6618E34A05204AFDB24DF58C896FAA77BAEB8D304F5490DAF95DB73A1C770A940CB11

Function 00E51C9A Relevance: 7.7, APIs: 5, Instructions: 158COMMON

Download Yara Rule

APIs

VariantInit.OLEAUT32(?), ref: 00E51CB4
VariantClear.OLEAUT32(00000013), ref: 00E51D26
VariantClear.OLEAUT32(00000000), ref: 00E51D81
VariantClear.OLEAUT32(?), ref: 00E51DF8
VariantChangeType.OLEAUT32(?,?,00000000,00000013), ref: 00E51E26

Memory Dump Source

Source File: 00000000.00000002.1262750966.0000000000E11000.00000020.00000001.01000000.00000003.sdmp, Offset: 00E10000, based on PE: true

Associated: 00000000.00000002.1262729095.0000000000E10000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1262808979.0000000000E9D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1262808979.0000000000EBE000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1262857687.0000000000ECA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1262878803.0000000000ED4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1262878803.0000000000F07000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_e10000_18112024_Dokman_1 Kas_m 2024- Avans_T24-2112184_dekont.jbxd

Similarity

API ID: Variant$Clear$ChangeInitType
String ID:
API String ID: 4136290138-0
Opcode ID: 846487a7c16a56b6f8739cbeea80b7041bba6459a4813879b5d03a5aec123389
Instruction ID: c8b3b9a23de5ac5cd23009ed7fdd7c7d6205134be16dd337ec682510c2831e4b
Opcode Fuzzy Hash: 846487a7c16a56b6f8739cbeea80b7041bba6459a4813879b5d03a5aec123389
Instruction Fuzzy Hash: 09514AB5A00219AFDB14CF58C880AAAB7F9FF4C315B15855AED59EB300D730E955CFA0

Function 00E70688 Relevance: 7.6, APIs: 5, Instructions: 149libraryloaderCOMMON

Download Yara Rule

APIs

Part of subcall function 00E1936C: __swprintf.LIBCMT ref: 00E193AB
Part of subcall function 00E1936C: __itow.LIBCMT ref: 00E193DF

LoadLibraryW.KERNEL32(?,00000004,?,?), ref: 00E706EE
GetProcAddress.KERNEL32(00000000,?), ref: 00E7077D
GetProcAddress.KERNEL32(00000000,00000000), ref: 00E7079B
GetProcAddress.KERNEL32(00000000,?), ref: 00E707E1
FreeLibrary.KERNEL32(00000000,00000004), ref: 00E707FB

Part of subcall function 00E2E65E: WideCharToMultiByte.KERNEL32(00000000,00000000,00000000,?,00000000,00000000,00000000,00000000,00000000,00000000,?,00E5A574,?,?,00000000,00000008), ref: 00E2E675
Part of subcall function 00E2E65E: WideCharToMultiByte.KERNEL32(00000000,00000000,00000000,?,00000000,00000000,00000000,00000000,?,?,00E5A574,?,?,00000000,00000008), ref: 00E2E699

Memory Dump Source

Source File: 00000000.00000002.1262750966.0000000000E11000.00000020.00000001.01000000.00000003.sdmp, Offset: 00E10000, based on PE: true

Associated: 00000000.00000002.1262729095.0000000000E10000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1262808979.0000000000E9D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1262808979.0000000000EBE000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1262857687.0000000000ECA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1262878803.0000000000ED4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1262878803.0000000000F07000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_e10000_18112024_Dokman_1 Kas_m 2024- Avans_T24-2112184_dekont.jbxd

Similarity

API ID: AddressProc$ByteCharLibraryMultiWide$FreeLoad__itow__swprintf
String ID:
API String ID: 327935632-0
Opcode ID: 2b918818e31c5d04175142704ef61af74099a8b9ae099bd9823899473c9eb858
Instruction ID: a514b69528c8d8a460473597a46d3ce26d2f017a4cc6bdc232803a504d93379c
Opcode Fuzzy Hash: 2b918818e31c5d04175142704ef61af74099a8b9ae099bd9823899473c9eb858
Instruction Fuzzy Hash: E7513775A04215DFCB04EFA8C8919EDB7F5AF48314B14D05AE919BB362DB30ED86CB81

Function 00E72E29 Relevance: 7.6, APIs: 5, Instructions: 144registryCOMMON

Download Yara Rule

APIs

Part of subcall function 00E73C06: CharUpperBuffW.USER32(?,?,?,?,?,?,?,00E72BB5,?,?), ref: 00E73C1D

RegConnectRegistryW.ADVAPI32(?,?,?), ref: 00E72EEF
RegOpenKeyExW.ADVAPI32(?,?,00000000,?,?), ref: 00E72F2E
RegEnumKeyExW.ADVAPI32(?,-00000001,?,?,00000000,00000000,00000000,?), ref: 00E72F75
RegCloseKey.ADVAPI32(?,?), ref: 00E72FA1
RegCloseKey.ADVAPI32(00000000), ref: 00E72FAE

Memory Dump Source

Source File: 00000000.00000002.1262750966.0000000000E11000.00000020.00000001.01000000.00000003.sdmp, Offset: 00E10000, based on PE: true

Associated: 00000000.00000002.1262729095.0000000000E10000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1262808979.0000000000E9D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1262808979.0000000000EBE000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1262857687.0000000000ECA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1262878803.0000000000ED4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1262878803.0000000000F07000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_e10000_18112024_Dokman_1 Kas_m 2024- Avans_T24-2112184_dekont.jbxd

Similarity

API ID: Close$BuffCharConnectEnumOpenRegistryUpper
String ID:
API String ID: 3740051246-0
Opcode ID: f601d95e3ccb955e205a242cb77ba6422d2254cef6806ac4bcfb5e71e60100a9
Instruction ID: 8f276384f87275120156973186fce7121e258bee6167c1d95a7e4e478959c265
Opcode Fuzzy Hash: f601d95e3ccb955e205a242cb77ba6422d2254cef6806ac4bcfb5e71e60100a9
Instruction Fuzzy Hash: 51514971208304AFD704EB64CC91EAAB7F9FF88304F14981EF699A7291DB30E945CB52

Function 00E7CCF7 Relevance: 7.6, APIs: 5, Instructions: 129COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1262750966.0000000000E11000.00000020.00000001.01000000.00000003.sdmp, Offset: 00E10000, based on PE: true

Associated: 00000000.00000002.1262729095.0000000000E10000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1262808979.0000000000E9D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1262808979.0000000000EBE000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1262857687.0000000000ECA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1262878803.0000000000ED4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1262878803.0000000000F07000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_e10000_18112024_Dokman_1 Kas_m 2024- Avans_T24-2112184_dekont.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ac7d2c7ba39ae9177105ce168c4ae2800da890a6fd7c5da00a8ccae76f4bd7f9
Instruction ID: ba529a273097cbf5c30e9f02d7342826153e2e7eea1738e2044c8b32868d61f1
Opcode Fuzzy Hash: ac7d2c7ba39ae9177105ce168c4ae2800da890a6fd7c5da00a8ccae76f4bd7f9
Instruction Fuzzy Hash: CE41D439904214AFC720DF68CC44FE9BB6DEB09314F24A16AFA6DB72D1C730AD41DA50

Function 00E61206 Relevance: 7.6, APIs: 5, Instructions: 127COMMON

Download Yara Rule

APIs

GetPrivateProfileSectionW.KERNEL32(00000003,?,00007FFF,?), ref: 00E612B4
GetPrivateProfileSectionW.KERNEL32(?,00000001,00000003,?), ref: 00E612DD
WritePrivateProfileSectionW.KERNEL32(?,?,?), ref: 00E6131C

Part of subcall function 00E1936C: __swprintf.LIBCMT ref: 00E193AB
Part of subcall function 00E1936C: __itow.LIBCMT ref: 00E193DF

WritePrivateProfileStringW.KERNEL32(00000003,00000000,00000000,?), ref: 00E61341
WritePrivateProfileStringW.KERNEL32(00000000,00000000,00000000,?), ref: 00E61349

Memory Dump Source

Source File: 00000000.00000002.1262750966.0000000000E11000.00000020.00000001.01000000.00000003.sdmp, Offset: 00E10000, based on PE: true

Associated: 00000000.00000002.1262729095.0000000000E10000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1262808979.0000000000E9D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1262808979.0000000000EBE000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1262857687.0000000000ECA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1262878803.0000000000ED4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1262878803.0000000000F07000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_e10000_18112024_Dokman_1 Kas_m 2024- Avans_T24-2112184_dekont.jbxd

Similarity

API ID: PrivateProfile$SectionWrite$String$__itow__swprintf
String ID:
API String ID: 1389676194-0
Opcode ID: 80ba45d21fa304b675660889f778bd79c53a8aa6acb74af34306f00bf6181ed0
Instruction ID: 3ca5a3f79bf29ffff2c417415fde5d0aa09010d58a6535efebc899e45c82af8e
Opcode Fuzzy Hash: 80ba45d21fa304b675660889f778bd79c53a8aa6acb74af34306f00bf6181ed0
Instruction Fuzzy Hash: 5D410A35A00115DFCB01EF64C991AAEBBF5FF48314B149099E91ABB3A2CB31EE51DB50

Function 00E2B63C Relevance: 7.6, APIs: 5, Instructions: 110keyboardCOMMON

Download Yara Rule

APIs

GetCursorPos.USER32(000000FF), ref: 00E2B64F
ScreenToClient.USER32(00000000,000000FF), ref: 00E2B66C
GetAsyncKeyState.USER32(00000001), ref: 00E2B691
GetAsyncKeyState.USER32(00000002), ref: 00E2B69F

Memory Dump Source

Source File: 00000000.00000002.1262750966.0000000000E11000.00000020.00000001.01000000.00000003.sdmp, Offset: 00E10000, based on PE: true

Associated: 00000000.00000002.1262729095.0000000000E10000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1262808979.0000000000E9D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1262808979.0000000000EBE000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1262857687.0000000000ECA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1262878803.0000000000ED4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1262878803.0000000000F07000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_e10000_18112024_Dokman_1 Kas_m 2024- Avans_T24-2112184_dekont.jbxd

Similarity

API ID: AsyncState$ClientCursorScreen
String ID:
API String ID: 4210589936-0
Opcode ID: 5c4a947f4f01196e638e425b01e931d0b09859390222f6b171b05707bee736c1
Instruction ID: 27bc447efd54656697897c2153aec9abaf9a61827afb04048ccadcc71b4e180c
Opcode Fuzzy Hash: 5c4a947f4f01196e638e425b01e931d0b09859390222f6b171b05707bee736c1
Instruction Fuzzy Hash: 98412E35608119BFDF159F64CC44AE9BBB4EB05324F10521AE82DB62D0CB30A994EFA1

Function 00E4B358 Relevance: 7.6, APIs: 5, Instructions: 88sleepwindowCOMMON

Download Yara Rule

APIs

GetWindowRect.USER32(?,?), ref: 00E4B369
PostMessageW.USER32(?,00000201,00000001), ref: 00E4B413
Sleep.KERNEL32(00000000,?,00000201,00000001,?,?,?), ref: 00E4B41B
PostMessageW.USER32(?,00000202,00000000), ref: 00E4B429
Sleep.KERNEL32(00000000,?,00000202,00000000,?,?,00000201,00000001,?,?,?), ref: 00E4B431

Memory Dump Source

Source File: 00000000.00000002.1262750966.0000000000E11000.00000020.00000001.01000000.00000003.sdmp, Offset: 00E10000, based on PE: true

Associated: 00000000.00000002.1262729095.0000000000E10000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1262808979.0000000000E9D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1262808979.0000000000EBE000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1262857687.0000000000ECA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1262878803.0000000000ED4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1262878803.0000000000F07000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_e10000_18112024_Dokman_1 Kas_m 2024- Avans_T24-2112184_dekont.jbxd

Similarity

API ID: MessagePostSleep$RectWindow
String ID:
API String ID: 3382505437-0
Opcode ID: 114f7e44d2a9bfc90fbfb727ecfcf751201fa136523c376133fec85028806b8f
Instruction ID: f11f2296b12ac20dac110636460fa3a4e1e018879125da2da9f1274f686495a4
Opcode Fuzzy Hash: 114f7e44d2a9bfc90fbfb727ecfcf751201fa136523c376133fec85028806b8f
Instruction Fuzzy Hash: 00319C71904229EFDF04CF69ED4DA9E7BB5EB04329F10422AF921AA1D1C3B0D954CB90

Function 00E4DBBF Relevance: 7.6, APIs: 5, Instructions: 87windowCOMMON

Download Yara Rule

APIs

IsWindowVisible.USER32(?), ref: 00E4DBD7
SendMessageW.USER32(?,0000000E,00000000,00000000), ref: 00E4DBF4
SendMessageW.USER32(?,0000000D,00000001,00000000), ref: 00E4DC2C
CharUpperBuffW.USER32(00000000,00000000,?,?,?,?), ref: 00E4DC52
_wcsstr.LIBCMT ref: 00E4DC5C

Memory Dump Source

Source File: 00000000.00000002.1262750966.0000000000E11000.00000020.00000001.01000000.00000003.sdmp, Offset: 00E10000, based on PE: true

Associated: 00000000.00000002.1262729095.0000000000E10000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1262808979.0000000000E9D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1262808979.0000000000EBE000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1262857687.0000000000ECA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1262878803.0000000000ED4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1262878803.0000000000F07000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_e10000_18112024_Dokman_1 Kas_m 2024- Avans_T24-2112184_dekont.jbxd

Similarity

API ID: MessageSend$BuffCharUpperVisibleWindow_wcsstr
String ID:
API String ID: 3902887630-0
Opcode ID: 8c327c81fee473a1f35e91f47e16706f8fd6bd5855f87eee9390a68cacdedf00
Instruction ID: b9dee1dbbedd628085bd0f824bbe7ad096b5de0a31d1e956aa791b2a98ccc61c
Opcode Fuzzy Hash: 8c327c81fee473a1f35e91f47e16706f8fd6bd5855f87eee9390a68cacdedf00
Instruction Fuzzy Hash: 29212971208214BFEB155F39AD89E7BBBACDF45764F10503AF809FA191EAA1CC01D2A0

Function 00E4BC77 Relevance: 7.6, APIs: 5, Instructions: 82windowCOMMON

Download Yara Rule

APIs

SendMessageW.USER32(?,00001004,00000000,00000000), ref: 00E4BC90
SendMessageW.USER32(?,0000102C,00000000,00000002), ref: 00E4BCC2
__itow.LIBCMT ref: 00E4BCDA
SendMessageW.USER32(?,0000102C,00000000,00000002), ref: 00E4BD00
__itow.LIBCMT ref: 00E4BD11

Memory Dump Source

Source File: 00000000.00000002.1262750966.0000000000E11000.00000020.00000001.01000000.00000003.sdmp, Offset: 00E10000, based on PE: true

Associated: 00000000.00000002.1262729095.0000000000E10000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1262808979.0000000000E9D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1262808979.0000000000EBE000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1262857687.0000000000ECA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1262878803.0000000000ED4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1262878803.0000000000F07000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_e10000_18112024_Dokman_1 Kas_m 2024- Avans_T24-2112184_dekont.jbxd

Similarity

API ID: MessageSend$__itow
String ID:
API String ID: 3379773720-0
Opcode ID: 5b6e14bb039a16f7a41c3ad073d8603e93bd9ee6af9998d7dc2c17c1bfff9475
Instruction ID: 551ec415d4a343ed2266e993d2c2c34609b364535fa030f7f31d41b30ed989fd
Opcode Fuzzy Hash: 5b6e14bb039a16f7a41c3ad073d8603e93bd9ee6af9998d7dc2c17c1bfff9475
Instruction Fuzzy Hash: 53219635B00718BADB11AF759D86FDE7AA8AF49710F103065F906FB182DB70C94587A1

Function 00E56318 Relevance: 7.6, APIs: 5, Instructions: 80COMMON

Download Yara Rule

APIs

Part of subcall function 00E150E6: _wcsncpy.LIBCMT ref: 00E150FA

GetFileAttributesW.KERNEL32(?,?,?,?,00E560C3), ref: 00E56369
GetLastError.KERNEL32(?,?,?,00E560C3), ref: 00E56374
CreateDirectoryW.KERNEL32(?,00000000,?,?,?,00E560C3), ref: 00E56388
_wcsrchr.LIBCMT ref: 00E563AA

Part of subcall function 00E56318: CreateDirectoryW.KERNEL32(?,00000000,?,?,?,00E560C3), ref: 00E563E0

Memory Dump Source

Source File: 00000000.00000002.1262750966.0000000000E11000.00000020.00000001.01000000.00000003.sdmp, Offset: 00E10000, based on PE: true

Associated: 00000000.00000002.1262729095.0000000000E10000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1262808979.0000000000E9D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1262808979.0000000000EBE000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1262857687.0000000000ECA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1262878803.0000000000ED4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1262878803.0000000000F07000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_e10000_18112024_Dokman_1 Kas_m 2024- Avans_T24-2112184_dekont.jbxd

Similarity

API ID: CreateDirectory$AttributesErrorFileLast_wcsncpy_wcsrchr
String ID:
API String ID: 3633006590-0
Opcode ID: 991a5fabd5d86ec3df1565dfc07677bb175ea0bba8a6e5e27eb016657c2a9389
Instruction ID: ee73c1758100cf3a54d4661dac823c01baa9ccad0d462008021d32a316938a77
Opcode Fuzzy Hash: 991a5fabd5d86ec3df1565dfc07677bb175ea0bba8a6e5e27eb016657c2a9389
Instruction Fuzzy Hash: DA21EB315042159BDB25AB74EC46FEA33ECEF55366F902866F845F30D0EB60DD8C8A54

Function 00E68B95 Relevance: 7.6, APIs: 5, Instructions: 71networkCOMMON

Download Yara Rule

APIs

Part of subcall function 00E6A82C: inet_addr.WSOCK32(00000000), ref: 00E6A84E

socket.WSOCK32(00000002,00000001,00000006), ref: 00E68BD3
WSAGetLastError.WSOCK32(00000000), ref: 00E68BE2
connect.WSOCK32(00000000,?,00000010), ref: 00E68BFE

Memory Dump Source

Source File: 00000000.00000002.1262750966.0000000000E11000.00000020.00000001.01000000.00000003.sdmp, Offset: 00E10000, based on PE: true

Associated: 00000000.00000002.1262729095.0000000000E10000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1262808979.0000000000E9D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1262808979.0000000000EBE000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1262857687.0000000000ECA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1262878803.0000000000ED4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1262878803.0000000000F07000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_e10000_18112024_Dokman_1 Kas_m 2024- Avans_T24-2112184_dekont.jbxd

Similarity

API ID: ErrorLastconnectinet_addrsocket
String ID:
API String ID: 3701255441-0
Opcode ID: cd205e4039593bb119b75ffd7283829323e4b5a6d18c202619ebc4a18f23fdeb
Instruction ID: bb829510491dd6227b727f7a8716a1c06c44ffd71c201a318b2ed20b7fd3db50
Opcode Fuzzy Hash: cd205e4039593bb119b75ffd7283829323e4b5a6d18c202619ebc4a18f23fdeb
Instruction Fuzzy Hash: 9221F0313002249FCB10EF68DD85B7EB3E9AF58364F04550AF916BB292CB70AC058B61

Function 00E68420 Relevance: 7.6, APIs: 5, Instructions: 69COMMON

Download Yara Rule

APIs

IsWindow.USER32(00000000), ref: 00E68441
GetForegroundWindow.USER32 ref: 00E68458
GetDC.USER32(00000000), ref: 00E68494
GetPixel.GDI32(00000000,?,00000003), ref: 00E684A0
ReleaseDC.USER32(00000000,00000003), ref: 00E684DB

Memory Dump Source

Source File: 00000000.00000002.1262750966.0000000000E11000.00000020.00000001.01000000.00000003.sdmp, Offset: 00E10000, based on PE: true

Associated: 00000000.00000002.1262729095.0000000000E10000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1262808979.0000000000E9D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1262808979.0000000000EBE000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1262857687.0000000000ECA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1262878803.0000000000ED4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1262878803.0000000000F07000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_e10000_18112024_Dokman_1 Kas_m 2024- Avans_T24-2112184_dekont.jbxd

Similarity

API ID: Window$ForegroundPixelRelease
String ID:
API String ID: 4156661090-0
Opcode ID: aa54037aa1a2fc40968da4420989dd400c1c0c874bc4b0a6a5de43ea2b85013e
Instruction ID: ad560d538069193dec80ea0d4328cae20a209fd1ccb83ab1298b3ebda8d16e30
Opcode Fuzzy Hash: aa54037aa1a2fc40968da4420989dd400c1c0c874bc4b0a6a5de43ea2b85013e
Instruction Fuzzy Hash: 1821C375A00214AFD700DFA5DD85AAEBBF5EF48341F04887AE85AA7252DF70AC44CB60

Function 00E2AF83 Relevance: 7.6, APIs: 5, Instructions: 67COMMON

Download Yara Rule

APIs

ExtCreatePen.GDI32(?,?,00000000,00000000,00000000,?,?,00000000), ref: 00E2AFE3
SelectObject.GDI32(?,00000000), ref: 00E2AFF2
BeginPath.GDI32(?), ref: 00E2B009
SelectObject.GDI32(?,00000000), ref: 00E2B033

Memory Dump Source

Source File: 00000000.00000002.1262750966.0000000000E11000.00000020.00000001.01000000.00000003.sdmp, Offset: 00E10000, based on PE: true

Associated: 00000000.00000002.1262729095.0000000000E10000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1262808979.0000000000E9D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1262808979.0000000000EBE000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1262857687.0000000000ECA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1262878803.0000000000ED4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1262878803.0000000000F07000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_e10000_18112024_Dokman_1 Kas_m 2024- Avans_T24-2112184_dekont.jbxd

Similarity

API ID: ObjectSelect$BeginCreatePath
String ID:
API String ID: 3225163088-0
Opcode ID: eb07722437c95d0a078102fc8afefb60bb6e090bc043edb941f9590fb7ba2ca9
Instruction ID: 1738569056f46a00889b3cba2903ce6fc49ae520203048f417aba5f367be6044
Opcode Fuzzy Hash: eb07722437c95d0a078102fc8afefb60bb6e090bc043edb941f9590fb7ba2ca9
Instruction Fuzzy Hash: 0C21A1B1906319FFDB119F96FC44BAE7B68F710359F18526BE435B21A0C3708849CB50

Function 00E3217F Relevance: 7.6, APIs: 5, Instructions: 61threadCOMMON

Download Yara Rule

APIs

__calloc_crt.LIBCMT ref: 00E321A9
CreateThread.KERNEL32(?,?,00E322DF,00000000,?,?), ref: 00E321ED
GetLastError.KERNEL32 ref: 00E321F7
_free.LIBCMT ref: 00E32200
__dosmaperr.LIBCMT ref: 00E3220B

Part of subcall function 00E37C0E: __getptd_noexit.LIBCMT ref: 00E37C0E

Memory Dump Source

Source File: 00000000.00000002.1262750966.0000000000E11000.00000020.00000001.01000000.00000003.sdmp, Offset: 00E10000, based on PE: true

Associated: 00000000.00000002.1262729095.0000000000E10000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1262808979.0000000000E9D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1262808979.0000000000EBE000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1262857687.0000000000ECA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1262878803.0000000000ED4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1262878803.0000000000F07000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_e10000_18112024_Dokman_1 Kas_m 2024- Avans_T24-2112184_dekont.jbxd

Similarity

API ID: CreateErrorLastThread__calloc_crt__dosmaperr__getptd_noexit_free
String ID:
API String ID: 2664167353-0
Opcode ID: ed26643279343e76c8b6dd786ae8d3940984a80adfcb180e84a739b9e6f08d0c
Instruction ID: ceb119e247b71d43ac596a6bfa3fb5e06afa21531c94de4c655ef703fa2187ff
Opcode Fuzzy Hash: ed26643279343e76c8b6dd786ae8d3940984a80adfcb180e84a739b9e6f08d0c
Instruction Fuzzy Hash: 3A114832108306AFDB20AF65DC49DAB7FE8EF00774F10102EFA94B6051DB31D801C6A0

Function 00E4ABBB Relevance: 7.5, APIs: 5, Instructions: 48memoryCOMMON

Download Yara Rule

APIs

GetUserObjectSecurity.USER32(?,?,?,00000000,?), ref: 00E4ABD7
GetLastError.KERNEL32(?,00E4A69F,?,?,?), ref: 00E4ABE1
GetProcessHeap.KERNEL32(00000008,?,?,00E4A69F,?,?,?), ref: 00E4ABF0
HeapAlloc.KERNEL32(00000000,?,00E4A69F,?,?,?), ref: 00E4ABF7
GetUserObjectSecurity.USER32(?,?,00000000,?,?), ref: 00E4AC0E

Memory Dump Source

Source File: 00000000.00000002.1262750966.0000000000E11000.00000020.00000001.01000000.00000003.sdmp, Offset: 00E10000, based on PE: true

Associated: 00000000.00000002.1262729095.0000000000E10000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1262808979.0000000000E9D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1262808979.0000000000EBE000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1262857687.0000000000ECA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1262878803.0000000000ED4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1262878803.0000000000F07000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_e10000_18112024_Dokman_1 Kas_m 2024- Avans_T24-2112184_dekont.jbxd

Similarity

API ID: HeapObjectSecurityUser$AllocErrorLastProcess
String ID:
API String ID: 842720411-0
Opcode ID: 6f56663a4c68c357bcfa307880845c25712ab75161857227b19e0b0321f7aabf
Instruction ID: d0c7cea10dc5daf7b8e483cc3dcb45cb39e806e32bc4438ff9c193df2f46614f
Opcode Fuzzy Hash: 6f56663a4c68c357bcfa307880845c25712ab75161857227b19e0b0321f7aabf
Instruction Fuzzy Hash: 9A016971245214BFDB104FAAEC88DAB7BACEF8A369714042AF805E3260DA719C44CF61

Function 00E49ABF Relevance: 7.5, APIs: 5, Instructions: 47stringCOMMON

Download Yara Rule

APIs

CLSIDFromProgID.OLE32 ref: 00E49ADC
ProgIDFromCLSID.OLE32(?,00000000), ref: 00E49AF7
lstrcmpiW.KERNEL32(?,00000000), ref: 00E49B05
CoTaskMemFree.OLE32(00000000,?,00000000), ref: 00E49B15
CLSIDFromString.OLE32(?,?), ref: 00E49B21

Memory Dump Source

Source File: 00000000.00000002.1262750966.0000000000E11000.00000020.00000001.01000000.00000003.sdmp, Offset: 00E10000, based on PE: true

Associated: 00000000.00000002.1262729095.0000000000E10000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1262808979.0000000000E9D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1262808979.0000000000EBE000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1262857687.0000000000ECA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1262878803.0000000000ED4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1262878803.0000000000F07000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_e10000_18112024_Dokman_1 Kas_m 2024- Avans_T24-2112184_dekont.jbxd

Similarity

API ID: From$Prog$FreeStringTasklstrcmpi
String ID:
API String ID: 3897988419-0
Opcode ID: 3fb044349cb230132b80634c7950315bf8008112d3bb6d41a662d305a9e1933a
Instruction ID: 29c41d2946663014d272cd1cb2ebd60bfde946d6f4d306ab16936bbe54634951
Opcode Fuzzy Hash: 3fb044349cb230132b80634c7950315bf8008112d3bb6d41a662d305a9e1933a
Instruction Fuzzy Hash: E8018F76600214BFDB144F55FD48B9A7AEDEB44392F144026F905F2212D770DD049BA0

Function 00E57A58 Relevance: 7.5, APIs: 5, Instructions: 47sleepCOMMON

Download Yara Rule

APIs

QueryPerformanceCounter.KERNEL32(?,00000000,?,?,?,?,?,?,?,?,?), ref: 00E57A74
QueryPerformanceFrequency.KERNEL32(?,?,?,?,?,?,?,?,?,?), ref: 00E57A82
Sleep.KERNEL32(00000000,?,?,?,?,?,?,?,?,?), ref: 00E57A8A
QueryPerformanceCounter.KERNEL32(?,?,?,?,?,?,?,?,?,?), ref: 00E57A94
Sleep.KERNEL32(?,00000000,?,?,?,?,?,?,?,?,?), ref: 00E57AD0

Memory Dump Source

Source File: 00000000.00000002.1262750966.0000000000E11000.00000020.00000001.01000000.00000003.sdmp, Offset: 00E10000, based on PE: true

Associated: 00000000.00000002.1262729095.0000000000E10000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1262808979.0000000000E9D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1262808979.0000000000EBE000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1262857687.0000000000ECA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1262878803.0000000000ED4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1262878803.0000000000F07000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_e10000_18112024_Dokman_1 Kas_m 2024- Avans_T24-2112184_dekont.jbxd

Similarity

API ID: PerformanceQuery$CounterSleep$Frequency
String ID:
API String ID: 2833360925-0
Opcode ID: 911e7d2b73b1e30047fb5e1757a9f3cb411c302990f6b7e09e756e7ffbb98644
Instruction ID: 85d5020c726ae0156218a69bbd410f61efff43f8b048efaef8da7f724b6f6737
Opcode Fuzzy Hash: 911e7d2b73b1e30047fb5e1757a9f3cb411c302990f6b7e09e756e7ffbb98644
Instruction Fuzzy Hash: 4D014472C09629EFCF00EFE6EC489DDBB78FF08712F001456E941B2151DB3096688761

Function 00E4AAC3 Relevance: 7.5, APIs: 5, Instructions: 45memoryCOMMON

Download Yara Rule

APIs

GetTokenInformation.ADVAPI32(?,00000003(TokenIntegrityLevel),?,00000000,?), ref: 00E4AADA
GetLastError.KERNEL32(?,TokenIntegrityLevel,?,00000000,?), ref: 00E4AAE4
GetProcessHeap.KERNEL32(00000008,?,?,TokenIntegrityLevel,?,00000000,?), ref: 00E4AAF3
HeapAlloc.KERNEL32(00000000,?,TokenIntegrityLevel,?,00000000,?), ref: 00E4AAFA
GetTokenInformation.ADVAPI32(?,00000003(TokenIntegrityLevel),00000000,?,?,?,TokenIntegrityLevel,?,00000000,?), ref: 00E4AB10

Memory Dump Source

Source File: 00000000.00000002.1262750966.0000000000E11000.00000020.00000001.01000000.00000003.sdmp, Offset: 00E10000, based on PE: true

Associated: 00000000.00000002.1262729095.0000000000E10000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1262808979.0000000000E9D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1262808979.0000000000EBE000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1262857687.0000000000ECA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1262878803.0000000000ED4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1262878803.0000000000F07000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_e10000_18112024_Dokman_1 Kas_m 2024- Avans_T24-2112184_dekont.jbxd

Similarity

API ID: HeapInformationToken$AllocErrorLastProcess
String ID:
API String ID: 44706859-0
Opcode ID: cd310e6690f3b87bf91352acce37b3c73688afb7996539af00e26c4d61727b5c
Instruction ID: ceb064685592f6a504d332603d8f6b9a36c8dccdcfc1994e748ec25a59c87f34
Opcode Fuzzy Hash: cd310e6690f3b87bf91352acce37b3c73688afb7996539af00e26c4d61727b5c
Instruction Fuzzy Hash: 33F04F71245218AFEB110FA6EC88E673B6DFF457A9F04002BF941E7190CA60A8158A61

Function 00E4AA62 Relevance: 7.5, APIs: 5, Instructions: 45memoryCOMMON

Download Yara Rule

APIs

GetTokenInformation.ADVAPI32(?,00000002,?,00000000,?), ref: 00E4AA79
GetLastError.KERNEL32(?,00000002,?,00000000,?), ref: 00E4AA83
GetProcessHeap.KERNEL32(00000008,?,?,00000002,?,00000000,?), ref: 00E4AA92
HeapAlloc.KERNEL32(00000000,?,00000002,?,00000000,?), ref: 00E4AA99
GetTokenInformation.ADVAPI32(?,00000002,00000000,?,?,?,00000002,?,00000000,?), ref: 00E4AAAF

Memory Dump Source

Source File: 00000000.00000002.1262750966.0000000000E11000.00000020.00000001.01000000.00000003.sdmp, Offset: 00E10000, based on PE: true

Associated: 00000000.00000002.1262729095.0000000000E10000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1262808979.0000000000E9D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1262808979.0000000000EBE000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1262857687.0000000000ECA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1262878803.0000000000ED4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1262878803.0000000000F07000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_e10000_18112024_Dokman_1 Kas_m 2024- Avans_T24-2112184_dekont.jbxd

Similarity

API ID: HeapInformationToken$AllocErrorLastProcess
String ID:
API String ID: 44706859-0
Opcode ID: c141393f9844ce40034bcdcfa430441de01e050935a36cce3a6dfe436752cde1
Instruction ID: c4f62fe8c4b315cec98b75dc18c2c3def4aae16a97fbaf949c6fbf98edd93e66
Opcode Fuzzy Hash: c141393f9844ce40034bcdcfa430441de01e050935a36cce3a6dfe436752cde1
Instruction Fuzzy Hash: B9F0AF31245214AFEB105FA6AC88E673BACFF497A8F04002BFA01E7190DA609C05DB61

Function 00E4EC80 Relevance: 7.5, APIs: 5, Instructions: 40windowtimeCOMMON

Download Yara Rule

APIs

GetDlgItem.USER32(?,000003E9), ref: 00E4EC94
GetWindowTextW.USER32(00000000,?,00000100), ref: 00E4ECAB
MessageBeep.USER32(00000000), ref: 00E4ECC3
KillTimer.USER32(?,0000040A), ref: 00E4ECDF
EndDialog.USER32(?,00000001), ref: 00E4ECF9

Memory Dump Source

Source File: 00000000.00000002.1262750966.0000000000E11000.00000020.00000001.01000000.00000003.sdmp, Offset: 00E10000, based on PE: true

Associated: 00000000.00000002.1262729095.0000000000E10000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1262808979.0000000000E9D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1262808979.0000000000EBE000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1262857687.0000000000ECA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1262878803.0000000000ED4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1262878803.0000000000F07000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_e10000_18112024_Dokman_1 Kas_m 2024- Avans_T24-2112184_dekont.jbxd

Similarity

API ID: BeepDialogItemKillMessageTextTimerWindow
String ID:
API String ID: 3741023627-0
Opcode ID: 9fddb2e81d632cf507b4db8e8463827c573671bb9758e162701af56d7176d80a
Instruction ID: 72226e78a51602a1cc4f82109c3fe90b0ea7796a6f90da2dc5e3c8afc1828fa6
Opcode Fuzzy Hash: 9fddb2e81d632cf507b4db8e8463827c573671bb9758e162701af56d7176d80a
Instruction Fuzzy Hash: EB016D30504754ABEB245B55EE8EB96B7B8FB00709F04155AA582B15E1DBF0AA888B40

Function 00E2B0AB Relevance: 7.5, APIs: 5, Instructions: 29COMMON

Download Yara Rule

APIs

EndPath.GDI32(?), ref: 00E2B0BA
StrokeAndFillPath.GDI32(?,?,00E8E680,00000000,?,?,?), ref: 00E2B0D6
SelectObject.GDI32(?,00000000), ref: 00E2B0E9
DeleteObject.GDI32 ref: 00E2B0FC
StrokePath.GDI32(?), ref: 00E2B117

Memory Dump Source

Source File: 00000000.00000002.1262750966.0000000000E11000.00000020.00000001.01000000.00000003.sdmp, Offset: 00E10000, based on PE: true

Associated: 00000000.00000002.1262729095.0000000000E10000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1262808979.0000000000E9D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1262808979.0000000000EBE000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1262857687.0000000000ECA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1262878803.0000000000ED4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1262878803.0000000000F07000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_e10000_18112024_Dokman_1 Kas_m 2024- Avans_T24-2112184_dekont.jbxd

Similarity

API ID: Path$ObjectStroke$DeleteFillSelect
String ID:
API String ID: 2625713937-0
Opcode ID: 3175b4fe2da0c58da5ee47386c602ef00652f66e6dafa55975f69a1c9905ec52
Instruction ID: f3bd45051a7dd560a978974760e6a4b8b02706e585de79ddeef00eaed220d173
Opcode Fuzzy Hash: 3175b4fe2da0c58da5ee47386c602ef00652f66e6dafa55975f69a1c9905ec52
Instruction Fuzzy Hash: 6FF0F63001A218EFCB229F66FC097983B65E700366F089357E425650F1C7308969CF10

Function 00E5F23D Relevance: 7.3, APIs: 3, Strings: 1, Instructions: 277comCOMMON

Download Yara Rule

APIs

CoInitialize.OLE32(00000000), ref: 00E5F2DA
CoCreateInstance.OLE32(00E9DA7C,00000000,00000001,00E9D8EC,?), ref: 00E5F2F2
CoUninitialize.OLE32 ref: 00E5F555

Strings

.lnk, xrefs: 00E5F28B, 00E5F290, 00E5F29E

Memory Dump Source

Source File: 00000000.00000002.1262750966.0000000000E11000.00000020.00000001.01000000.00000003.sdmp, Offset: 00E10000, based on PE: true

Associated: 00000000.00000002.1262729095.0000000000E10000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1262808979.0000000000E9D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1262808979.0000000000EBE000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1262857687.0000000000ECA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1262878803.0000000000ED4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1262878803.0000000000F07000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_e10000_18112024_Dokman_1 Kas_m 2024- Avans_T24-2112184_dekont.jbxd

Similarity

API ID: CreateInitializeInstanceUninitialize
String ID: .lnk
API String ID: 948891078-24824748
Opcode ID: 721caac6de746e743de47c5f8c2bcbe650bd5066463753c7f8090ffe63c88034
Instruction ID: f8b063a8709a60fabb6a6ec50c342a88ad03fa32cac04c6103488b4885d62af7
Opcode Fuzzy Hash: 721caac6de746e743de47c5f8c2bcbe650bd5066463753c7f8090ffe63c88034
Instruction Fuzzy Hash: 00A11A71108301AFD700EF64DC92EABB7E8EF98714F00591DF555A7192EB70EA49CB62

Function 00E5E7DD Relevance: 7.3, APIs: 3, Strings: 1, Instructions: 261comCOMMON

Download Yara Rule

APIs

Part of subcall function 00E1660F: GetFullPathNameW.KERNEL32(?,00007FFF,?,00000000,?,?,00E153B1,?,?,00E161FF,?,00000000,00000001,00000000), ref: 00E1662F

CoInitialize.OLE32(00000000), ref: 00E5E85D
CoCreateInstance.OLE32(00E9DA7C,00000000,00000001,00E9D8EC,?), ref: 00E5E876
CoUninitialize.OLE32 ref: 00E5E893

Part of subcall function 00E1936C: __swprintf.LIBCMT ref: 00E193AB
Part of subcall function 00E1936C: __itow.LIBCMT ref: 00E193DF

Strings

.lnk, xrefs: 00E5E83B, 00E5E84D

Memory Dump Source

Source File: 00000000.00000002.1262750966.0000000000E11000.00000020.00000001.01000000.00000003.sdmp, Offset: 00E10000, based on PE: true

Associated: 00000000.00000002.1262729095.0000000000E10000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1262808979.0000000000E9D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1262808979.0000000000EBE000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1262857687.0000000000ECA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1262878803.0000000000ED4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1262878803.0000000000F07000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_e10000_18112024_Dokman_1 Kas_m 2024- Avans_T24-2112184_dekont.jbxd

Similarity

API ID: CreateFullInitializeInstanceNamePathUninitialize__itow__swprintf
String ID: .lnk
API String ID: 2126378814-24824748
Opcode ID: 69f6d6e27b6b49a113f8d67e2a2d5c31e09724aa0f3b61fdabeda9a42627814f
Instruction ID: a1fef8654507b0ac9e2696f5a920aacd5e9c9d3da5c57571a46b712dd7365493
Opcode Fuzzy Hash: 69f6d6e27b6b49a113f8d67e2a2d5c31e09724aa0f3b61fdabeda9a42627814f
Instruction Fuzzy Hash: 0AA157356043119FCB18DF24C884D6EB7E5BF88315F148989F9A5AB3A2CB31ED49CB91

Function 00E3325D Relevance: 7.2, APIs: 3, Strings: 1, Instructions: 180COMMON

Download Yara Rule

APIs

__startOneArgErrorHandling.LIBCMT ref: 00E332ED

Part of subcall function 00E3E0D0: __87except.LIBCMT ref: 00E3E10B

Strings

pow, xrefs: 00E332C5, 00E332E2

Memory Dump Source

Source File: 00000000.00000002.1262750966.0000000000E11000.00000020.00000001.01000000.00000003.sdmp, Offset: 00E10000, based on PE: true

Associated: 00000000.00000002.1262729095.0000000000E10000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1262808979.0000000000E9D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1262808979.0000000000EBE000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1262857687.0000000000ECA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1262878803.0000000000ED4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1262878803.0000000000F07000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_e10000_18112024_Dokman_1 Kas_m 2024- Avans_T24-2112184_dekont.jbxd

Similarity

API ID: ErrorHandling__87except__start
String ID: pow
API String ID: 2905807303-2276729525
Opcode ID: 8b96712b63af3c8cba114ce0089147e7d24a4276dc46442da98302ed9fa34c82
Instruction ID: db8625025bdfc1d5c277127a2f1f3839cd6013f1153933193a9a24d8225211bc
Opcode Fuzzy Hash: 8b96712b63af3c8cba114ce0089147e7d24a4276dc46442da98302ed9fa34c82
Instruction Fuzzy Hash: FD515C31A092019ACB157728C90DBBB6FE4DB81714F24AD68F4E5B23F9DF358D88D642

Function 00E54606 Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 122COMMON

Download Yara Rule

APIs

CharUpperBuffW.USER32(0000000C,00000016,00000016,00000000,00000000,?,00000000,00EADC50,?,0000000F,0000000C,00000016,00EADC50,?), ref: 00E54645

Part of subcall function 00E1936C: __swprintf.LIBCMT ref: 00E193AB
Part of subcall function 00E1936C: __itow.LIBCMT ref: 00E193DF

CharUpperBuffW.USER32(?,?,00000000,?), ref: 00E546C5

Strings

THIS, xrefs: 00E54703
REMOVE, xrefs: 00E54676

Memory Dump Source

Source File: 00000000.00000002.1262750966.0000000000E11000.00000020.00000001.01000000.00000003.sdmp, Offset: 00E10000, based on PE: true

Associated: 00000000.00000002.1262729095.0000000000E10000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1262808979.0000000000E9D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1262808979.0000000000EBE000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1262857687.0000000000ECA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1262878803.0000000000ED4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1262878803.0000000000F07000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_e10000_18112024_Dokman_1 Kas_m 2024- Avans_T24-2112184_dekont.jbxd

Similarity

API ID: BuffCharUpper$__itow__swprintf
String ID: REMOVE$THIS
API String ID: 3797816924-776492005
Opcode ID: 8fbd5bbe7d29ed850a44f45a33bf910f4fcce274a4aa12d8cbbfafcddba93e34
Instruction ID: cfdf1f574f3edd6ae802566b91af032cde64c0acd2c407f3c846181b37762261
Opcode Fuzzy Hash: 8fbd5bbe7d29ed850a44f45a33bf910f4fcce274a4aa12d8cbbfafcddba93e34
Instruction Fuzzy Hash: 264152B4A001199FCF04DF64C841AEDB7F5FF49309F14A85AE916BB292DB349D89CB50

Function 00E4C189 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 121windowCOMMON

Download Yara Rule

APIs

Part of subcall function 00E5430B: WriteProcessMemory.KERNEL32(?,?,?,00000000,00000000,00000000,?,00E4BC08,?,?,00000034,00000800,?,00000034), ref: 00E54335

SendMessageW.USER32(?,00001104,00000000,00000000), ref: 00E4C1D3

Part of subcall function 00E542D6: ReadProcessMemory.KERNEL32(?,?,?,00000000,00000000,00000000,?,00E4BC37,?,?,00000800,?,00001073,00000000,?,?), ref: 00E54300

Part of subcall function 00E5422F: GetWindowThreadProcessId.USER32(?,?), ref: 00E5425A
Part of subcall function 00E5422F: OpenProcess.KERNEL32(00000438,00000000,?,?,?,00E4BBCC,00000034,?,?,00001004,00000000,00000000), ref: 00E5426A
Part of subcall function 00E5422F: VirtualAllocEx.KERNEL32(00000000,00000000,?,00001000,00000004,?,?,00E4BBCC,00000034,?,?,00001004,00000000,00000000), ref: 00E54280

SendMessageW.USER32(?,00001111,00000000,00000000), ref: 00E4C240
SendMessageW.USER32(?,00001111,00000000,00000000), ref: 00E4C28D

Strings

@, xrefs: 00E4C2A5

Memory Dump Source

Source File: 00000000.00000002.1262750966.0000000000E11000.00000020.00000001.01000000.00000003.sdmp, Offset: 00E10000, based on PE: true

Associated: 00000000.00000002.1262729095.0000000000E10000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1262808979.0000000000E9D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1262808979.0000000000EBE000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1262857687.0000000000ECA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1262878803.0000000000ED4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1262878803.0000000000F07000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_e10000_18112024_Dokman_1 Kas_m 2024- Avans_T24-2112184_dekont.jbxd

Similarity

API ID: Process$MessageSend$Memory$AllocOpenReadThreadVirtualWindowWrite
String ID: @
API String ID: 4150878124-2766056989
Opcode ID: 5c8232ae2554e8c959780b77f9ef2ef96b01ed6583735d8f1596d467241beed7
Instruction ID: b2811e1351d17c3c906297a0cd319fc56800f125282aceb7a9f3256e1d7faf5d
Opcode Fuzzy Hash: 5c8232ae2554e8c959780b77f9ef2ef96b01ed6583735d8f1596d467241beed7
Instruction Fuzzy Hash: EA417D76900218BFCB11DFA4CD81AEEB7B8FF09304F104495FA45B7191DAB06E89CB60

Function 00E7A63F Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 110COMMON

Download Yara Rule

APIs

SetWindowPos.USER32(00000000,00000000,00000000,00000000,00000000,00000000,00000013,?,?,SysTreeView32,00EADC00,00000000,?,?,?,?), ref: 00E7A6D8
GetWindowLongW.USER32 ref: 00E7A6F5
SetWindowLongW.USER32(?,000000F0,00000000), ref: 00E7A705

Strings

SysTreeView32, xrefs: 00E7A6AA

Memory Dump Source

Source File: 00000000.00000002.1262750966.0000000000E11000.00000020.00000001.01000000.00000003.sdmp, Offset: 00E10000, based on PE: true

Associated: 00000000.00000002.1262729095.0000000000E10000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1262808979.0000000000E9D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1262808979.0000000000EBE000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1262857687.0000000000ECA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1262878803.0000000000ED4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1262878803.0000000000F07000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_e10000_18112024_Dokman_1 Kas_m 2024- Avans_T24-2112184_dekont.jbxd

Similarity

API ID: Window$Long
String ID: SysTreeView32
API String ID: 847901565-1698111956
Opcode ID: 2945872545aa0ffd612665ef039db421ee8ccdf2e0b2058e8b296886724b7e99
Instruction ID: 39fd7e580e44980054192404e96bf02bf0a8da521192f57b5fa3a3c987597fd0
Opcode Fuzzy Hash: 2945872545aa0ffd612665ef039db421ee8ccdf2e0b2058e8b296886724b7e99
Instruction Fuzzy Hash: D731B231104205AFDB158F74DC41BDA77A9EB89328F289726F879B32E0C730E8519B51

Function 00E65180 Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 96networkCOMMON

Download Yara Rule

APIs

_memset.LIBCMT ref: 00E65190
InternetCrackUrlW.WININET(?,00000000,00000000,?), ref: 00E651C6

Strings

D, xrefs: 00E6522E
|, xrefs: 00E651B5

Memory Dump Source

Source File: 00000000.00000002.1262750966.0000000000E11000.00000020.00000001.01000000.00000003.sdmp, Offset: 00E10000, based on PE: true

Associated: 00000000.00000002.1262729095.0000000000E10000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1262808979.0000000000E9D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1262808979.0000000000EBE000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1262857687.0000000000ECA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1262878803.0000000000ED4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1262878803.0000000000F07000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_e10000_18112024_Dokman_1 Kas_m 2024- Avans_T24-2112184_dekont.jbxd

Similarity

API ID: CrackInternet_memset
String ID: |$D
API String ID: 1413715105-465884809
Opcode ID: 12bfb0ed1aceb25403897dbc40da5b24feb3c3467436968dcba294795ee8a92d
Instruction ID: fda078538a924d4de59336d6e7598c3ec1f096ddff079906413a29d9c4c3ac87
Opcode Fuzzy Hash: 12bfb0ed1aceb25403897dbc40da5b24feb3c3467436968dcba294795ee8a92d
Instruction Fuzzy Hash: AA311971D40119ABCF01AFE4DC85EEEBFB9FF14754F101019E815B6166DB31AA46CBA0

Function 00E7A0D6 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 89windowCOMMON

Download Yara Rule

APIs

SendMessageW.USER32(00000000,00001009,00000000,?), ref: 00E7A15E
SetWindowPos.USER32(?,00000000,?,?,?,?,00000004), ref: 00E7A172
SendMessageW.USER32(?,00001002,00000000,?), ref: 00E7A196

Strings

SysMonthCal32, xrefs: 00E7A129

Memory Dump Source

Source File: 00000000.00000002.1262750966.0000000000E11000.00000020.00000001.01000000.00000003.sdmp, Offset: 00E10000, based on PE: true

Associated: 00000000.00000002.1262729095.0000000000E10000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1262808979.0000000000E9D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1262808979.0000000000EBE000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1262857687.0000000000ECA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1262878803.0000000000ED4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1262878803.0000000000F07000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_e10000_18112024_Dokman_1 Kas_m 2024- Avans_T24-2112184_dekont.jbxd

Similarity

API ID: MessageSend$Window
String ID: SysMonthCal32
API String ID: 2326795674-1439706946
Opcode ID: 846938cc2fcdcd195682cae97f438d5fb20327b86200440847f4f61a16cbdc9d
Instruction ID: 589d85261baf04bdd3e9f7be8afd90d1364ad693f6d7ea99cb83531680b71ffc
Opcode Fuzzy Hash: 846938cc2fcdcd195682cae97f438d5fb20327b86200440847f4f61a16cbdc9d
Instruction Fuzzy Hash: 9621BF72510218ABEF118F94CC42FEE3BB9EF88724F145224FA59BB1D0D6B5AC55CB90

Function 00E7A88A Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 88windowCOMMON

Download Yara Rule

APIs

SendMessageW.USER32(00000000,00000469,?,00000000), ref: 00E7A941
SendMessageW.USER32(00000000,00000465,00000000,80017FFF), ref: 00E7A94F
DestroyWindow.USER32(00000000,00000000,?,?,?,00000000,msctls_updown32,00000000,00000000,00000000,00000000,00000000,00000000,?,?,00000000), ref: 00E7A956

Strings

msctls_updown32, xrefs: 00E7A8BB

Memory Dump Source

Source File: 00000000.00000002.1262750966.0000000000E11000.00000020.00000001.01000000.00000003.sdmp, Offset: 00E10000, based on PE: true

Associated: 00000000.00000002.1262729095.0000000000E10000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1262808979.0000000000E9D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1262808979.0000000000EBE000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1262857687.0000000000ECA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1262878803.0000000000ED4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1262878803.0000000000F07000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_e10000_18112024_Dokman_1 Kas_m 2024- Avans_T24-2112184_dekont.jbxd

Similarity

API ID: MessageSend$DestroyWindow
String ID: msctls_updown32
API String ID: 4014797782-2298589950
Opcode ID: 2e55c2adfcdfa7c86470ceaafbaab577ef2267ac5e38644b0853959d63bab8d9
Instruction ID: e70399ea22c0dd3833d2b86c36fd709d60bb6a8d765439c5fac1e1489edc56dd
Opcode Fuzzy Hash: 2e55c2adfcdfa7c86470ceaafbaab577ef2267ac5e38644b0853959d63bab8d9
Instruction Fuzzy Hash: 082195B5600209BFEB10DF14DC91DAB37ADEB9A368B055059F618A7391CB30EC11DB61

Function 00E799A5 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 84windowCOMMON

Download Yara Rule

APIs

SendMessageW.USER32(00000000,00000180,00000000,?), ref: 00E79A30
SendMessageW.USER32(?,00000186,00000000,00000000), ref: 00E79A40
MoveWindow.USER32(?,?,?,?,?,00000000,?,?,Listbox,00000000,00000000,?,?,?,?,?), ref: 00E79A65

Strings

Listbox, xrefs: 00E799FD

Memory Dump Source

Source File: 00000000.00000002.1262750966.0000000000E11000.00000020.00000001.01000000.00000003.sdmp, Offset: 00E10000, based on PE: true

Associated: 00000000.00000002.1262729095.0000000000E10000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1262808979.0000000000E9D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1262808979.0000000000EBE000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1262857687.0000000000ECA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1262878803.0000000000ED4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1262878803.0000000000F07000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_e10000_18112024_Dokman_1 Kas_m 2024- Avans_T24-2112184_dekont.jbxd

Similarity

API ID: MessageSend$MoveWindow
String ID: Listbox
API String ID: 3315199576-2633736733
Opcode ID: eacb4c2d42716afd945c9d00e006155674e7bfdb6f607b062f712f9295c36dfc
Instruction ID: 61cf4a64150302a29e308f833a7e401367877c5df4e026aa522c360a513cc5f2
Opcode Fuzzy Hash: eacb4c2d42716afd945c9d00e006155674e7bfdb6f607b062f712f9295c36dfc
Instruction Fuzzy Hash: AC21D732611118BFEF128F54DC85FBB3BAEEF89764F01D129F958671A1C6719C1187A0

Function 00E7A409 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 66windowCOMMON

Download Yara Rule

APIs

SendMessageW.USER32(00000000,00000405,00000000,00000000), ref: 00E7A46D
SendMessageW.USER32(?,00000406,00000000,00640000), ref: 00E7A482
SendMessageW.USER32(?,00000414,0000000A,00000000), ref: 00E7A48F

Strings

msctls_trackbar32, xrefs: 00E7A444

Memory Dump Source

Source File: 00000000.00000002.1262750966.0000000000E11000.00000020.00000001.01000000.00000003.sdmp, Offset: 00E10000, based on PE: true

Associated: 00000000.00000002.1262729095.0000000000E10000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1262808979.0000000000E9D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1262808979.0000000000EBE000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1262857687.0000000000ECA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1262878803.0000000000ED4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1262878803.0000000000F07000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_e10000_18112024_Dokman_1 Kas_m 2024- Avans_T24-2112184_dekont.jbxd

Similarity

API ID: MessageSend
String ID: msctls_trackbar32
API String ID: 3850602802-1010561917
Opcode ID: e99510a5e9e2a19a9c40977313e9f4e884e1e0cca77513d8719a04795e1e5a62
Instruction ID: 87e04fb5c3606f94dcbd983ae8db40b4642b0e3d140a7f28f0d4eb0c10fd2851
Opcode Fuzzy Hash: e99510a5e9e2a19a9c40977313e9f4e884e1e0cca77513d8719a04795e1e5a62
Instruction Fuzzy Hash: B111E771200218BEEF209F65CC49FAB37A9EFC8768F055128FA59B6091D2B2E811D720

Function 00E32287 Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 24libraryloaderCOMMONLIBRARYCODE

Download Yara Rule

APIs

LoadLibraryExW.KERNEL32(combase.dll,00000000,00000800,RoInitialize,00E32350,?), ref: 00E322A1
GetProcAddress.KERNEL32(00000000), ref: 00E322A8

Strings

RoInitialize, xrefs: 00E32290
combase.dll, xrefs: 00E3229C

Memory Dump Source

Source File: 00000000.00000002.1262750966.0000000000E11000.00000020.00000001.01000000.00000003.sdmp, Offset: 00E10000, based on PE: true

Associated: 00000000.00000002.1262729095.0000000000E10000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1262808979.0000000000E9D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1262808979.0000000000EBE000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1262857687.0000000000ECA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1262878803.0000000000ED4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1262878803.0000000000F07000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_e10000_18112024_Dokman_1 Kas_m 2024- Avans_T24-2112184_dekont.jbxd

Similarity

API ID: AddressLibraryLoadProc
String ID: RoInitialize$combase.dll
API String ID: 2574300362-340411864
Opcode ID: 08fc92c1d2a509f246eefc44c20da6ee5d2ba8130afc444cdfb0cc65a10d68ac
Instruction ID: 4d970086d9875b722427f93b5c6001aa5af4587816c84127bf3ff3f4b97c0119
Opcode Fuzzy Hash: 08fc92c1d2a509f246eefc44c20da6ee5d2ba8130afc444cdfb0cc65a10d68ac
Instruction Fuzzy Hash: 79E0E57069A310AEDA105B62AD4EB153A69E70070AF045026B242F60B0CBB54049CB18

Function 00E3235C Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 19libraryloaderCOMMONLIBRARYCODE

Download Yara Rule

APIs

LoadLibraryExW.KERNEL32(combase.dll,00000000,00000800,RoUninitialize,00E32276), ref: 00E32376
GetProcAddress.KERNEL32(00000000), ref: 00E3237D

Strings

RoUninitialize, xrefs: 00E32365
combase.dll, xrefs: 00E32371

Memory Dump Source

Source File: 00000000.00000002.1262750966.0000000000E11000.00000020.00000001.01000000.00000003.sdmp, Offset: 00E10000, based on PE: true

Associated: 00000000.00000002.1262729095.0000000000E10000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1262808979.0000000000E9D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1262808979.0000000000EBE000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1262857687.0000000000ECA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1262878803.0000000000ED4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1262878803.0000000000F07000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_e10000_18112024_Dokman_1 Kas_m 2024- Avans_T24-2112184_dekont.jbxd

Similarity

API ID: AddressLibraryLoadProc
String ID: RoUninitialize$combase.dll
API String ID: 2574300362-2819208100
Opcode ID: c5ed076859be2318604ae1057d192a33d43d843d29427309543bf17f75be0820
Instruction ID: bcc3036a06109e4794881dc0f3bc0eeff7c3d4b76189d229abc9a0960c657ae9
Opcode Fuzzy Hash: c5ed076859be2318604ae1057d192a33d43d843d29427309543bf17f75be0820
Instruction Fuzzy Hash: BAE0B67054B315AFDB205F63FD0EB143B65F700716F181426F249F20B0CBB99458CA14

Function 00E8AC59 Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 17timeCOMMON

Download Yara Rule

APIs

GetLocalTime.KERNEL32(?), ref: 00E8AC60
__swprintf.LIBCMT ref: 00E8AC94

Strings

%.3d, xrefs: 00E8AC6E
WIN_XPe, xrefs: 00E8ACD3

Memory Dump Source

Source File: 00000000.00000002.1262750966.0000000000E11000.00000020.00000001.01000000.00000003.sdmp, Offset: 00E10000, based on PE: true

Associated: 00000000.00000002.1262729095.0000000000E10000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1262808979.0000000000E9D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1262808979.0000000000EBE000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1262857687.0000000000ECA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1262878803.0000000000ED4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1262878803.0000000000F07000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_e10000_18112024_Dokman_1 Kas_m 2024- Avans_T24-2112184_dekont.jbxd

Similarity

API ID: LocalTime__swprintf
String ID: %.3d$WIN_XPe
API String ID: 2070861257-2409531811
Opcode ID: 0fe1688770d29d6c0ddffeafb4719995141eab2b18f995a442e4d5655dfedd89
Instruction ID: 35c5a54955a4d6e1dcf5756e0342f64bce08464ca7f4f53938b0bff3558c6ac3
Opcode Fuzzy Hash: 0fe1688770d29d6c0ddffeafb4719995141eab2b18f995a442e4d5655dfedd89
Instruction Fuzzy Hash: 67E012B1808628DBDB11A750DE09DF9B3BCA704741F1820E3B90EB1110D6359B85AB13

Function 00E142F6 Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 15libraryloaderCOMMON

Download Yara Rule

APIs

LoadLibraryA.KERNEL32(kernel32.dll,00000000,00E142EC,?,00E142AA,?), ref: 00E14304
GetProcAddress.KERNEL32(00000000,Wow64RevertWow64FsRedirection), ref: 00E14316

Strings

Wow64RevertWow64FsRedirection, xrefs: 00E14310
kernel32.dll, xrefs: 00E142FF

Memory Dump Source

Source File: 00000000.00000002.1262750966.0000000000E11000.00000020.00000001.01000000.00000003.sdmp, Offset: 00E10000, based on PE: true

Associated: 00000000.00000002.1262729095.0000000000E10000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1262808979.0000000000E9D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1262808979.0000000000EBE000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1262857687.0000000000ECA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1262878803.0000000000ED4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1262878803.0000000000F07000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_e10000_18112024_Dokman_1 Kas_m 2024- Avans_T24-2112184_dekont.jbxd

Similarity

API ID: AddressLibraryLoadProc
String ID: Wow64RevertWow64FsRedirection$kernel32.dll
API String ID: 2574300362-1355242751
Opcode ID: 1fc06c467689c969297b7c504f2d7fbc0eed4bec90eb0f288673850db5925eae
Instruction ID: 5398aac4b4ada03c1cd83f81046f689bae0269e84b2ec064500d8382f28f0223
Opcode Fuzzy Hash: 1fc06c467689c969297b7c504f2d7fbc0eed4bec90eb0f288673850db5925eae
Instruction Fuzzy Hash: DCD0A7F1404722DFC7204F32EC0CB8177D4AB14705B00941FE551F22A4D7B0C8C48610

Function 00E72205 Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 15libraryloaderCOMMON

Download Yara Rule

APIs

LoadLibraryA.KERNEL32(kernel32.dll,?,00E721FB,?,00E723EF), ref: 00E72213
GetProcAddress.KERNEL32(00000000,GetProcessId), ref: 00E72225

Strings

GetProcessId, xrefs: 00E7221F
kernel32.dll, xrefs: 00E7220E

Memory Dump Source

Source File: 00000000.00000002.1262750966.0000000000E11000.00000020.00000001.01000000.00000003.sdmp, Offset: 00E10000, based on PE: true

Associated: 00000000.00000002.1262729095.0000000000E10000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1262808979.0000000000E9D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1262808979.0000000000EBE000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1262857687.0000000000ECA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1262878803.0000000000ED4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1262878803.0000000000F07000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_e10000_18112024_Dokman_1 Kas_m 2024- Avans_T24-2112184_dekont.jbxd

Similarity

API ID: AddressLibraryLoadProc
String ID: GetProcessId$kernel32.dll
API String ID: 2574300362-399901964
Opcode ID: d6cdc49109f7975ca0790c3968665c902a8cf6355601bbabf2c60a07607043e3
Instruction ID: 6c4b028da2407b4fe7f4f4856994fbbac87d0e2634004de61f7b065c3674228b
Opcode Fuzzy Hash: d6cdc49109f7975ca0790c3968665c902a8cf6355601bbabf2c60a07607043e3
Instruction Fuzzy Hash: E3D0A7B5404762AFC7214F32FD08B4177D5EB04304B01A41FE946F2160D7B1D8848650

Function 00E1434B Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 15libraryloaderCOMMON

Download Yara Rule

APIs

LoadLibraryA.KERNEL32(kernel32.dll,00E141BB,00E14341,?,00E1422F,?,00E141BB,?,?,?,?,00E139FE,?,00000001), ref: 00E14359
GetProcAddress.KERNEL32(00000000,Wow64DisableWow64FsRedirection), ref: 00E1436B

Strings

Wow64DisableWow64FsRedirection, xrefs: 00E14365
kernel32.dll, xrefs: 00E14354

Memory Dump Source

Source File: 00000000.00000002.1262750966.0000000000E11000.00000020.00000001.01000000.00000003.sdmp, Offset: 00E10000, based on PE: true

Associated: 00000000.00000002.1262729095.0000000000E10000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1262808979.0000000000E9D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1262808979.0000000000EBE000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1262857687.0000000000ECA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1262878803.0000000000ED4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1262878803.0000000000F07000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_e10000_18112024_Dokman_1 Kas_m 2024- Avans_T24-2112184_dekont.jbxd

Similarity

API ID: AddressLibraryLoadProc
String ID: Wow64DisableWow64FsRedirection$kernel32.dll
API String ID: 2574300362-3689287502
Opcode ID: dba687cbaa40137134254e1bd721f0f5150056894faae8197d438f3731c625bb
Instruction ID: ad7a5ce4b9a266fa2123755fe7071f327f1f897259a1b871953c6ab7d4a82b8d
Opcode Fuzzy Hash: dba687cbaa40137134254e1bd721f0f5150056894faae8197d438f3731c625bb
Instruction Fuzzy Hash: 8FD0A7B14047229FC7204F32EC08B8177D4AB1071AB00942FE891F2290D7B0D8C48610

Function 00E50564 Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 15libraryloaderCOMMON

Download Yara Rule

APIs

LoadLibraryA.KERNEL32(oleaut32.dll,00000000,00E5052F,?,00E506D7), ref: 00E50572
GetProcAddress.KERNEL32(00000000,UnRegisterTypeLibForUser), ref: 00E50584

Strings

UnRegisterTypeLibForUser, xrefs: 00E5057E
oleaut32.dll, xrefs: 00E5056D

Memory Dump Source

Source File: 00000000.00000002.1262750966.0000000000E11000.00000020.00000001.01000000.00000003.sdmp, Offset: 00E10000, based on PE: true

Associated: 00000000.00000002.1262729095.0000000000E10000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1262808979.0000000000E9D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1262808979.0000000000EBE000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1262857687.0000000000ECA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1262878803.0000000000ED4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1262878803.0000000000F07000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_e10000_18112024_Dokman_1 Kas_m 2024- Avans_T24-2112184_dekont.jbxd

Similarity

API ID: AddressLibraryLoadProc
String ID: UnRegisterTypeLibForUser$oleaut32.dll
API String ID: 2574300362-1587604923
Opcode ID: 2e4c516d625dae3eacad54faad65c3081c13229cb52c83c38bba33501fc9c88b
Instruction ID: eac30f7b4bde3fe2ba22d4ecbf0a126fcd5361f412c3276ba62d20c0b58276b9
Opcode Fuzzy Hash: 2e4c516d625dae3eacad54faad65c3081c13229cb52c83c38bba33501fc9c88b
Instruction Fuzzy Hash: 01D05E315047229EC7209F22BC08B4277E4AF04705B20981FED41B2150EA70C4888A20

Function 00E50539 Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 15libraryloaderCOMMON

Download Yara Rule

APIs

LoadLibraryA.KERNEL32(oleaut32.dll,?,00E5051D,?,00E505FE), ref: 00E50547
GetProcAddress.KERNEL32(00000000,RegisterTypeLibForUser), ref: 00E50559

Strings

oleaut32.dll, xrefs: 00E50542
RegisterTypeLibForUser, xrefs: 00E50553

Memory Dump Source

Source File: 00000000.00000002.1262750966.0000000000E11000.00000020.00000001.01000000.00000003.sdmp, Offset: 00E10000, based on PE: true

Associated: 00000000.00000002.1262729095.0000000000E10000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1262808979.0000000000E9D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1262808979.0000000000EBE000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1262857687.0000000000ECA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1262878803.0000000000ED4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1262878803.0000000000F07000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_e10000_18112024_Dokman_1 Kas_m 2024- Avans_T24-2112184_dekont.jbxd

Similarity

API ID: AddressLibraryLoadProc
String ID: RegisterTypeLibForUser$oleaut32.dll
API String ID: 2574300362-1071820185
Opcode ID: fa82adf89645cdf90d9ea72acfd6256d15e504591036efe77924353fe5f596ec
Instruction ID: d6cd6d3e0c1941dbd8212302f059bfbe31c5a6cdeeb3ae71f141d70e21dff365
Opcode Fuzzy Hash: fa82adf89645cdf90d9ea72acfd6256d15e504591036efe77924353fe5f596ec
Instruction Fuzzy Hash: 76D0A7315047269FC7309F22EC08B4176E4AB00306B50D81FF846F2150EA70C8888A10

Function 00E6ECC8 Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 15libraryloaderCOMMON

Download Yara Rule

APIs

LoadLibraryA.KERNEL32(kernel32.dll,?,00E6ECBE,?,00E6EBBB), ref: 00E6ECD6
GetProcAddress.KERNEL32(00000000,GetSystemWow64DirectoryW), ref: 00E6ECE8

Strings

GetSystemWow64DirectoryW, xrefs: 00E6ECE2
kernel32.dll, xrefs: 00E6ECD1

Memory Dump Source

Source File: 00000000.00000002.1262750966.0000000000E11000.00000020.00000001.01000000.00000003.sdmp, Offset: 00E10000, based on PE: true

Associated: 00000000.00000002.1262729095.0000000000E10000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1262808979.0000000000E9D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1262808979.0000000000EBE000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1262857687.0000000000ECA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1262878803.0000000000ED4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1262878803.0000000000F07000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_e10000_18112024_Dokman_1 Kas_m 2024- Avans_T24-2112184_dekont.jbxd

Similarity

API ID: AddressLibraryLoadProc
String ID: GetSystemWow64DirectoryW$kernel32.dll
API String ID: 2574300362-1816364905
Opcode ID: 60cd9135f20310ce57e29611013d028829e534e35642cee9e937af7724798f92
Instruction ID: f01ab3e4c339e69886a93a9b8171da184e1958f8e81517231b03b3626c0dcf6c
Opcode Fuzzy Hash: 60cd9135f20310ce57e29611013d028829e534e35642cee9e937af7724798f92
Instruction Fuzzy Hash: CBD0A7B54447339FCB245F66FD48B42B7E8AF00344B10A41FF855F2290DBB0C8888610

Function 00E6BADD Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 15libraryloaderCOMMON

Download Yara Rule

APIs

LoadLibraryA.KERNEL32(kernel32.dll,00000000,00E6BAD3,00000001,00E6B6EE,?,00EADC00), ref: 00E6BAEB
GetProcAddress.KERNEL32(00000000,GetModuleHandleExW), ref: 00E6BAFD

Strings

kernel32.dll, xrefs: 00E6BAE6
GetModuleHandleExW, xrefs: 00E6BAF7

Memory Dump Source

Source File: 00000000.00000002.1262750966.0000000000E11000.00000020.00000001.01000000.00000003.sdmp, Offset: 00E10000, based on PE: true

Associated: 00000000.00000002.1262729095.0000000000E10000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1262808979.0000000000E9D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1262808979.0000000000EBE000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1262857687.0000000000ECA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1262878803.0000000000ED4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1262878803.0000000000F07000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_e10000_18112024_Dokman_1 Kas_m 2024- Avans_T24-2112184_dekont.jbxd

Similarity

API ID: AddressLibraryLoadProc
String ID: GetModuleHandleExW$kernel32.dll
API String ID: 2574300362-199464113
Opcode ID: f6ba9235a39834db3e86a72e4f86d65f0808baeb7166859bfa8b7cf13f7225ff
Instruction ID: a892c7f4f662d64575d7a5aa9115be7c3bc6542d748aa489f444fe10c2e371db
Opcode Fuzzy Hash: f6ba9235a39834db3e86a72e4f86d65f0808baeb7166859bfa8b7cf13f7225ff
Instruction Fuzzy Hash: 08D05E71C447229EC7305F22BC48B5176E4AB00344B00541FA843F2150D7B0C8C4C610

Function 00E73BDB Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 15libraryloaderCOMMON

Download Yara Rule

APIs

LoadLibraryA.KERNEL32(advapi32.dll,?,00E73BD1,?,00E73E06), ref: 00E73BE9
GetProcAddress.KERNEL32(00000000,RegDeleteKeyExW), ref: 00E73BFB

Strings

RegDeleteKeyExW, xrefs: 00E73BF5
advapi32.dll, xrefs: 00E73BE4

Memory Dump Source

Source File: 00000000.00000002.1262750966.0000000000E11000.00000020.00000001.01000000.00000003.sdmp, Offset: 00E10000, based on PE: true

Associated: 00000000.00000002.1262729095.0000000000E10000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1262808979.0000000000E9D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1262808979.0000000000EBE000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1262857687.0000000000ECA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1262878803.0000000000ED4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1262878803.0000000000F07000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_e10000_18112024_Dokman_1 Kas_m 2024- Avans_T24-2112184_dekont.jbxd

Similarity

API ID: AddressLibraryLoadProc
String ID: RegDeleteKeyExW$advapi32.dll
API String ID: 2574300362-4033151799
Opcode ID: fbc1d408250a2d03dd445634695f47c916ed276a655dc640c74c7ac9b2771f8c
Instruction ID: 7cc86a9b2a9ab60905b43e91c74a6c0a81c8216efe8b6b146ff4a361325a9073
Opcode Fuzzy Hash: fbc1d408250a2d03dd445634695f47c916ed276a655dc640c74c7ac9b2771f8c
Instruction Fuzzy Hash: 31D05EB14047229EC7205B72BD08A42BAE4AB01718B10942FE449B2190D6B0C4848A20

Function 00E49B30 Relevance: 6.3, APIs: 4, Instructions: 306COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1262750966.0000000000E11000.00000020.00000001.01000000.00000003.sdmp, Offset: 00E10000, based on PE: true

Associated: 00000000.00000002.1262729095.0000000000E10000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1262808979.0000000000E9D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1262808979.0000000000EBE000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1262857687.0000000000ECA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1262878803.0000000000ED4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1262878803.0000000000F07000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_e10000_18112024_Dokman_1 Kas_m 2024- Avans_T24-2112184_dekont.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9f497478fa2cc87d0a54da41d92048f01ce38f54660c0137c1a7f94933833e77
Instruction ID: 0b0c82db28435fed0dc99d469b108e9b2bb5447095f9f9899eecf4b23905b7c9
Opcode Fuzzy Hash: 9f497478fa2cc87d0a54da41d92048f01ce38f54660c0137c1a7f94933833e77
Instruction Fuzzy Hash: B8C12975A0021AEFCB14DFA4D884AAFB7B5FF88704F105599E905BB252D730EE41DBA0

Function 00E6AA84 Relevance: 6.3, APIs: 4, Instructions: 268COMMON

Download Yara Rule

APIs

CoInitialize.OLE32(00000000), ref: 00E6AAB4
CoUninitialize.OLE32 ref: 00E6AABF

Part of subcall function 00E50213: CoCreateInstance.OLE32(?,00000000,00000005,?,?,?,?,?,?,?,?,?,?,?), ref: 00E5027B

VariantInit.OLEAUT32(?), ref: 00E6AACA
VariantClear.OLEAUT32(?), ref: 00E6AD9D

Memory Dump Source

Source File: 00000000.00000002.1262750966.0000000000E11000.00000020.00000001.01000000.00000003.sdmp, Offset: 00E10000, based on PE: true

Associated: 00000000.00000002.1262729095.0000000000E10000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1262808979.0000000000E9D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1262808979.0000000000EBE000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1262857687.0000000000ECA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1262878803.0000000000ED4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1262878803.0000000000F07000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_e10000_18112024_Dokman_1 Kas_m 2024- Avans_T24-2112184_dekont.jbxd

Similarity

API ID: Variant$ClearCreateInitInitializeInstanceUninitialize
String ID:
API String ID: 780911581-0
Opcode ID: 436e214b795e85e486d7bcdd11e4f3b930212c9e2bf77744fc206d08dd4a2f53
Instruction ID: 1dfe3e56f47b93a3f8b4b9afee7123332d8ae4ccb80f0d5d785f9b504cf24d7d
Opcode Fuzzy Hash: 436e214b795e85e486d7bcdd11e4f3b930212c9e2bf77744fc206d08dd4a2f53
Instruction Fuzzy Hash: C3A16935A447019FCB10EF14D891B5AB7E4BF88354F185459FAA6BB3A2CB30ED44CB82

Function 00E491CC Relevance: 6.2, APIs: 4, Instructions: 201memoryCOMMON

Download Yara Rule

APIs

VariantInit.OLEAUT32(?), ref: 00E491DD
SysAllocString.OLEAUT32(?), ref: 00E49286
VariantCopy.OLEAUT32 ref: 00E492B5
VariantClear.OLEAUT32(?), ref: 00E492DC

Memory Dump Source

Source File: 00000000.00000002.1262750966.0000000000E11000.00000020.00000001.01000000.00000003.sdmp, Offset: 00E10000, based on PE: true

Associated: 00000000.00000002.1262729095.0000000000E10000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1262808979.0000000000E9D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1262808979.0000000000EBE000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1262857687.0000000000ECA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1262878803.0000000000ED4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1262878803.0000000000F07000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_e10000_18112024_Dokman_1 Kas_m 2024- Avans_T24-2112184_dekont.jbxd

Similarity

API ID: Variant$AllocClearCopyInitString
String ID:
API String ID: 2808897238-0
Opcode ID: 53d8d9aa16b0356f8a3d7960e4b9a711d97c112b4f5623d11d5661dd5733ed6b
Instruction ID: faa6ad20b356dc336ba58a42d9193a8340eb4516a8d8ffa0c72fdda537811242
Opcode Fuzzy Hash: 53d8d9aa16b0356f8a3d7960e4b9a711d97c112b4f5623d11d5661dd5733ed6b
Instruction Fuzzy Hash: 1F5175306043069BDB24AF65E895A6FB3E5EF4A314F20A81FE556FB2D3DB7098848705

Function 00E5C396 Relevance: 6.2, APIs: 4, Instructions: 154COMMON

Download Yara Rule

APIs

Part of subcall function 00E14517: _fseek.LIBCMT ref: 00E1452F

Part of subcall function 00E5C56D: _wcscmp.LIBCMT ref: 00E5C65D
Part of subcall function 00E5C56D: _wcscmp.LIBCMT ref: 00E5C670

_free.LIBCMT ref: 00E5C4DD
_free.LIBCMT ref: 00E5C4E4
_free.LIBCMT ref: 00E5C54F

Part of subcall function 00E31C9D: RtlFreeHeap.NTDLL(00000000,00000000,?,00E37A85), ref: 00E31CB1
Part of subcall function 00E31C9D: GetLastError.KERNEL32(00000000,?,00E37A85), ref: 00E31CC3

_free.LIBCMT ref: 00E5C557

Memory Dump Source

Source File: 00000000.00000002.1262750966.0000000000E11000.00000020.00000001.01000000.00000003.sdmp, Offset: 00E10000, based on PE: true

Associated: 00000000.00000002.1262729095.0000000000E10000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1262808979.0000000000E9D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1262808979.0000000000EBE000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1262857687.0000000000ECA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1262878803.0000000000ED4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1262878803.0000000000F07000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_e10000_18112024_Dokman_1 Kas_m 2024- Avans_T24-2112184_dekont.jbxd

Similarity

API ID: _free$_wcscmp$ErrorFreeHeapLast_fseek
String ID:
API String ID: 1552873950-0
Opcode ID: 0291d278fd3c0ee10044b808818b9d6c21fdc9175ee32bef741d63fe6815c47f
Instruction ID: f2eff06274f53021b55ceebd269fde1a82d06e427d71922baaf05811a66d1d4a
Opcode Fuzzy Hash: 0291d278fd3c0ee10044b808818b9d6c21fdc9175ee32bef741d63fe6815c47f
Instruction Fuzzy Hash: F5514CB1904218AFDB149F68DC81BEDBBB9EF48304F1014AEB659B3281DB715A84CF58

Function 00E7C4D7 Relevance: 6.1, APIs: 4, Instructions: 137COMMON

Download Yara Rule

APIs

GetWindowRect.USER32(010F6848,?), ref: 00E7C544
ScreenToClient.USER32(?,00000002), ref: 00E7C574
MoveWindow.USER32(00000002,?,?,?,000000FF,00000001,?,00000002,?,?,?,00000002,?,?), ref: 00E7C5DA

Memory Dump Source

Source File: 00000000.00000002.1262750966.0000000000E11000.00000020.00000001.01000000.00000003.sdmp, Offset: 00E10000, based on PE: true

Associated: 00000000.00000002.1262729095.0000000000E10000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1262808979.0000000000E9D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1262808979.0000000000EBE000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1262857687.0000000000ECA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1262878803.0000000000ED4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1262878803.0000000000F07000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_e10000_18112024_Dokman_1 Kas_m 2024- Avans_T24-2112184_dekont.jbxd

Similarity

API ID: Window$ClientMoveRectScreen
String ID:
API String ID: 3880355969-0
Opcode ID: 2c249b8d903ca87670c09c7de25755b76701590120dffaf3289b4c7b4be7f183
Instruction ID: 030d42aabfcc803e338a8a43bdf18b2154f33df3684da3b6d2af5ed596e8b173
Opcode Fuzzy Hash: 2c249b8d903ca87670c09c7de25755b76701590120dffaf3289b4c7b4be7f183
Instruction Fuzzy Hash: 8B515175900205EFCF10DF68D8809AE77B9EF55724F20D25AF969A7291D730ED41CB90

Function 00E4C410 Relevance: 6.1, APIs: 4, Instructions: 130windowCOMMON

Download Yara Rule

APIs

SendMessageW.USER32(?,0000110A,00000004,00000000), ref: 00E4C462
__itow.LIBCMT ref: 00E4C49C

Part of subcall function 00E4C6E8: SendMessageW.USER32(?,0000113E,00000000,00000000), ref: 00E4C753

SendMessageW.USER32(?,0000110A,00000001,?), ref: 00E4C505
__itow.LIBCMT ref: 00E4C55A

Memory Dump Source

Source File: 00000000.00000002.1262750966.0000000000E11000.00000020.00000001.01000000.00000003.sdmp, Offset: 00E10000, based on PE: true

Associated: 00000000.00000002.1262729095.0000000000E10000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1262808979.0000000000E9D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1262808979.0000000000EBE000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1262857687.0000000000ECA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1262878803.0000000000ED4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1262878803.0000000000F07000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_e10000_18112024_Dokman_1 Kas_m 2024- Avans_T24-2112184_dekont.jbxd

Similarity

API ID: MessageSend$__itow
String ID:
API String ID: 3379773720-0
Opcode ID: a302f36363862c4954372c49ed4776b85618dd0eeb5fede9b7e73eace59ccd0e
Instruction ID: cd5fbe092005e2c87f09c83b8d74a95cc6e3c478b29dcface37ee26a608e89a2
Opcode Fuzzy Hash: a302f36363862c4954372c49ed4776b85618dd0eeb5fede9b7e73eace59ccd0e
Instruction Fuzzy Hash: 3841B171A01608ABDF21DF54D851BEE7BF9AF48714F102059FA06B3281DB74AA85CBA1

Function 00E5390C Relevance: 6.1, APIs: 4, Instructions: 112keyboardwindowCOMMON

Download Yara Rule

APIs

GetKeyboardState.USER32(?,00000000,?,00000001), ref: 00E53966
SetKeyboardState.USER32(00000080,?,00000001), ref: 00E53982
PostMessageW.USER32(00000000,00000102,?,00000001), ref: 00E539EF
SendInput.USER32(00000001,?,0000001C,00000000,?,00000001), ref: 00E53A4D

Memory Dump Source

Source File: 00000000.00000002.1262750966.0000000000E11000.00000020.00000001.01000000.00000003.sdmp, Offset: 00E10000, based on PE: true

Associated: 00000000.00000002.1262729095.0000000000E10000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1262808979.0000000000E9D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1262808979.0000000000EBE000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1262857687.0000000000ECA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1262878803.0000000000ED4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1262878803.0000000000F07000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_e10000_18112024_Dokman_1 Kas_m 2024- Avans_T24-2112184_dekont.jbxd

Similarity

API ID: KeyboardState$InputMessagePostSend
String ID:
API String ID: 432972143-0
Opcode ID: 2c855728d503e17818deb6b828d110713210e7f30f6de52b0057605194f01931
Instruction ID: 9baa3bb1d6aed2727d610a0800ddc3514ac7e91f51066c602f2e8a44e80c138f
Opcode Fuzzy Hash: 2c855728d503e17818deb6b828d110713210e7f30f6de52b0057605194f01931
Instruction Fuzzy Hash: 19411BB0A04218AEEF218B7588057FDBBB59B85356F04291BEDC1B61C1C7B48E8DD761

Function 00E5E698 Relevance: 6.1, APIs: 4, Instructions: 110fileCOMMON

Download Yara Rule

APIs

CreateHardLinkW.KERNEL32(00000002,?,00000000), ref: 00E5E742
GetLastError.KERNEL32(?,00000000), ref: 00E5E768
DeleteFileW.KERNEL32(00000002,?,00000000), ref: 00E5E78D
CreateHardLinkW.KERNEL32(00000002,?,00000000,?,00000000), ref: 00E5E7B9

Memory Dump Source

Source File: 00000000.00000002.1262750966.0000000000E11000.00000020.00000001.01000000.00000003.sdmp, Offset: 00E10000, based on PE: true

Associated: 00000000.00000002.1262729095.0000000000E10000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1262808979.0000000000E9D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1262808979.0000000000EBE000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1262857687.0000000000ECA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1262878803.0000000000ED4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1262878803.0000000000F07000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_e10000_18112024_Dokman_1 Kas_m 2024- Avans_T24-2112184_dekont.jbxd

Similarity

API ID: CreateHardLink$DeleteErrorFileLast
String ID:
API String ID: 3321077145-0
Opcode ID: a43840724e1803744b43c6f96d19616a2c0660d8d3cc72490d3bf3a4287984e9
Instruction ID: dddea31f7ad605425bc30a6ddcb22edc26dc94270a88de394a70886900d75a71
Opcode Fuzzy Hash: a43840724e1803744b43c6f96d19616a2c0660d8d3cc72490d3bf3a4287984e9
Instruction Fuzzy Hash: C0414539A00610DFCB15EF15C545A8DBBE5BF89720B089489ED16AB3A2CB30FE44CB81

Function 00E7B544 Relevance: 6.1, APIs: 4, Instructions: 108COMMON

Download Yara Rule

APIs

InvalidateRect.USER32(?,00000000,00000001,?,?,?), ref: 00E7B5D1

Memory Dump Source

Source File: 00000000.00000002.1262750966.0000000000E11000.00000020.00000001.01000000.00000003.sdmp, Offset: 00E10000, based on PE: true

Associated: 00000000.00000002.1262729095.0000000000E10000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1262808979.0000000000E9D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1262808979.0000000000EBE000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1262857687.0000000000ECA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1262878803.0000000000ED4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1262878803.0000000000F07000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_e10000_18112024_Dokman_1 Kas_m 2024- Avans_T24-2112184_dekont.jbxd

Similarity

API ID: InvalidateRect
String ID:
API String ID: 634782764-0
Opcode ID: f6944413ba10fbc9e2939146640ac6e43ae8c32118308d1793fb501b07806925
Instruction ID: d384e4d8116f04dffd897492086bd1adea5a05eb9afbfb74dec775e3f78d6ed5
Opcode Fuzzy Hash: f6944413ba10fbc9e2939146640ac6e43ae8c32118308d1793fb501b07806925
Instruction Fuzzy Hash: 1031AF74601208BFEB249F59CC89FE97766EB05718F54E102F75AF62E1C730A9409B51

Function 00E7D7DE Relevance: 6.1, APIs: 4, Instructions: 105windowCOMMON

Download Yara Rule

APIs

ClientToScreen.USER32(?,?), ref: 00E7D807
GetWindowRect.USER32(?,?), ref: 00E7D87D
PtInRect.USER32(?,?,00E7ED5A), ref: 00E7D88D
MessageBeep.USER32(00000000), ref: 00E7D8FE

Memory Dump Source

Source File: 00000000.00000002.1262750966.0000000000E11000.00000020.00000001.01000000.00000003.sdmp, Offset: 00E10000, based on PE: true

Associated: 00000000.00000002.1262729095.0000000000E10000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1262808979.0000000000E9D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1262808979.0000000000EBE000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1262857687.0000000000ECA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1262878803.0000000000ED4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1262878803.0000000000F07000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_e10000_18112024_Dokman_1 Kas_m 2024- Avans_T24-2112184_dekont.jbxd

Similarity

API ID: Rect$BeepClientMessageScreenWindow
String ID:
API String ID: 1352109105-0
Opcode ID: 7fadde63cac52a80d701a0b8181df01a7deffbcbc5d6bb887b26865d304ae704
Instruction ID: a06f379490b06f1a93eaf70584e6b1bbb7e054aee2e81ddfcaa6079e99edeb6c
Opcode Fuzzy Hash: 7fadde63cac52a80d701a0b8181df01a7deffbcbc5d6bb887b26865d304ae704
Instruction Fuzzy Hash: 97418070A08219EFDB15DF59EC84BA977F5FF44314F18D1AAE518AB250D330E945CB42

Function 00E53A61 Relevance: 6.1, APIs: 4, Instructions: 104keyboardwindowCOMMON

Download Yara Rule

APIs

GetKeyboardState.USER32(?,75A4C0D0,?,00008000), ref: 00E53AB8
SetKeyboardState.USER32(00000080,?,00008000), ref: 00E53AD4
PostMessageW.USER32(00000000,00000101,00000000,?), ref: 00E53B34
SendInput.USER32(00000001,?,0000001C,75A4C0D0,?,00008000), ref: 00E53B92

Memory Dump Source

Source File: 00000000.00000002.1262750966.0000000000E11000.00000020.00000001.01000000.00000003.sdmp, Offset: 00E10000, based on PE: true

Associated: 00000000.00000002.1262729095.0000000000E10000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1262808979.0000000000E9D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1262808979.0000000000EBE000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1262857687.0000000000ECA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1262878803.0000000000ED4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1262878803.0000000000F07000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_e10000_18112024_Dokman_1 Kas_m 2024- Avans_T24-2112184_dekont.jbxd

Similarity

API ID: KeyboardState$InputMessagePostSend
String ID:
API String ID: 432972143-0
Opcode ID: e4924ef2a568bbaef2199096372ea9677dfd430df888fe7e27e948af249c0f42
Instruction ID: 6f4f6c13bfdaaf2674df62c41290343d7d990082376928fde90eabac79714c0e
Opcode Fuzzy Hash: e4924ef2a568bbaef2199096372ea9677dfd430df888fe7e27e948af249c0f42
Instruction Fuzzy Hash: 6D312630900258AEEF718B7488197FDBBB59B45356F042A1AEC81B31D1C7748F4DC761

Function 00E44004 Relevance: 6.1, APIs: 4, Instructions: 96COMMONLIBRARYCODE

Download Yara Rule

APIs

_LocaleUpdate::_LocaleUpdate.LIBCMT ref: 00E44038
__isleadbyte_l.LIBCMT ref: 00E44066
MultiByteToWideChar.KERNEL32(00000080,00000009,00000002,00000001,?,00000000,?,00000000,?,?,?), ref: 00E44094
MultiByteToWideChar.KERNEL32(00000080,00000009,00000002,00000001,?,00000000,?,00000000,?,?,?), ref: 00E440CA

Memory Dump Source

Source File: 00000000.00000002.1262750966.0000000000E11000.00000020.00000001.01000000.00000003.sdmp, Offset: 00E10000, based on PE: true

Associated: 00000000.00000002.1262729095.0000000000E10000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1262808979.0000000000E9D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1262808979.0000000000EBE000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1262857687.0000000000ECA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1262878803.0000000000ED4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1262878803.0000000000F07000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_e10000_18112024_Dokman_1 Kas_m 2024- Avans_T24-2112184_dekont.jbxd

Similarity

API ID: ByteCharLocaleMultiWide$UpdateUpdate::___isleadbyte_l
String ID:
API String ID: 3058430110-0
Opcode ID: dc681da2daccbea2a5c0485df1d35c8fa50804bccb09860bd37b9aa7765d1ccb
Instruction ID: 025ab33bf577979cc4aa8853c3ed04ac90258c4d0b5faf2fb06b8487d2e1316b
Opcode Fuzzy Hash: dc681da2daccbea2a5c0485df1d35c8fa50804bccb09860bd37b9aa7765d1ccb
Instruction Fuzzy Hash: 6031D0B1700206AFDB21DF75D845BAA7BE5FF40314F255029E661AB0E0E731DCA0DB92

Function 00E77CA5 Relevance: 6.1, APIs: 4, Instructions: 93COMMON

Download Yara Rule

APIs

GetForegroundWindow.USER32 ref: 00E77CB9

Part of subcall function 00E55F55: GetWindowThreadProcessId.USER32(?,00000000), ref: 00E55F6F
Part of subcall function 00E55F55: GetCurrentThreadId.KERNEL32 ref: 00E55F76
Part of subcall function 00E55F55: AttachThreadInput.USER32(00000000,?,00E5781F), ref: 00E55F7D

GetCaretPos.USER32(?), ref: 00E77CCA
ClientToScreen.USER32(00000000,?), ref: 00E77D03
GetForegroundWindow.USER32 ref: 00E77D09

Memory Dump Source

Source File: 00000000.00000002.1262750966.0000000000E11000.00000020.00000001.01000000.00000003.sdmp, Offset: 00E10000, based on PE: true

Associated: 00000000.00000002.1262729095.0000000000E10000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1262808979.0000000000E9D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1262808979.0000000000EBE000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1262857687.0000000000ECA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1262878803.0000000000ED4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1262878803.0000000000F07000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_e10000_18112024_Dokman_1 Kas_m 2024- Avans_T24-2112184_dekont.jbxd

Similarity

API ID: ThreadWindow$Foreground$AttachCaretClientCurrentInputProcessScreen
String ID:
API String ID: 2759813231-0
Opcode ID: aef91f0b625fc748d83c38e7a916ee22b65288055a72ababbc3cf44a779feca5
Instruction ID: dc976a09f8fce1d054edb55b546a202f58724b1bc8827f94368ed2f32ff8670b
Opcode Fuzzy Hash: aef91f0b625fc748d83c38e7a916ee22b65288055a72ababbc3cf44a779feca5
Instruction Fuzzy Hash: 8A311E72900118AFDB11EFA5DC859EFFBF9EF98314B10946AE915F3211DA319E058BA0

Function 00E7F1D7 Relevance: 6.1, APIs: 4, Instructions: 80windowCOMMON

Download Yara Rule

APIs

Part of subcall function 00E2B34E: GetWindowLongW.USER32(?,000000EB), ref: 00E2B35F

GetCursorPos.USER32(?), ref: 00E7F211
TrackPopupMenuEx.USER32(?,00000000,?,?,?,00000000,?,00E8E4C0,?,?,?,?,?), ref: 00E7F226
GetCursorPos.USER32(?), ref: 00E7F270
DefDlgProcW.USER32(?,0000007B,?,?,?,?,?,?,?,?,?,?,00E8E4C0,?,?,?), ref: 00E7F2A6

Memory Dump Source

Source File: 00000000.00000002.1262750966.0000000000E11000.00000020.00000001.01000000.00000003.sdmp, Offset: 00E10000, based on PE: true

Associated: 00000000.00000002.1262729095.0000000000E10000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1262808979.0000000000E9D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1262808979.0000000000EBE000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1262857687.0000000000ECA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1262878803.0000000000ED4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1262878803.0000000000F07000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_e10000_18112024_Dokman_1 Kas_m 2024- Avans_T24-2112184_dekont.jbxd

Similarity

API ID: Cursor$LongMenuPopupProcTrackWindow
String ID:
API String ID: 2864067406-0
Opcode ID: f3a10c9eae3cf8c7d5e666b0c44133c59d955c8236f1b566a86be01da842e6bd
Instruction ID: 4279999048d1c999adaf15de106d75a7a4b15f05ba96d3b1c172de6398642892
Opcode Fuzzy Hash: f3a10c9eae3cf8c7d5e666b0c44133c59d955c8236f1b566a86be01da842e6bd
Instruction Fuzzy Hash: EB218D39600028FFCB15CF95D858EEA7BB5EB09314F05846AF9096B2B2D3309D51DB50

Function 00E6431C Relevance: 6.1, APIs: 4, Instructions: 78networkCOMMON

Download Yara Rule

APIs

InternetConnectW.WININET(?,?,?,?,?,?,00000000,00000000), ref: 00E64358

Part of subcall function 00E643E2: InternetOpenUrlW.WININET(?,?,00000000,00000000,?,00000000), ref: 00E64401
Part of subcall function 00E643E2: InternetCloseHandle.WININET(00000000), ref: 00E6449E

Memory Dump Source

Source File: 00000000.00000002.1262750966.0000000000E11000.00000020.00000001.01000000.00000003.sdmp, Offset: 00E10000, based on PE: true

Associated: 00000000.00000002.1262729095.0000000000E10000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1262808979.0000000000E9D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1262808979.0000000000EBE000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1262857687.0000000000ECA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1262878803.0000000000ED4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1262878803.0000000000F07000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_e10000_18112024_Dokman_1 Kas_m 2024- Avans_T24-2112184_dekont.jbxd

Similarity

API ID: Internet$CloseConnectHandleOpen
String ID:
API String ID: 1463438336-0
Opcode ID: 1307f584420e9a7e53cb9796704d234ff95ab6994a3d3f208e700aaf6f6e9931
Instruction ID: 63b6267207faf66d5f767105f4a6d3eb27a51669d1670b6940f0124ebe6c401c
Opcode Fuzzy Hash: 1307f584420e9a7e53cb9796704d234ff95ab6994a3d3f208e700aaf6f6e9931
Instruction Fuzzy Hash: 6B21A1B2284605BFEB119F60EC00FBBBBE9FF44754F10601BFA15A6690DB71D8259B90

Function 00E68A7F Relevance: 6.1, APIs: 4, Instructions: 69networkCOMMON

Download Yara Rule

APIs

select.WSOCK32(00000000,00000001,00000000,00000000,?), ref: 00E68AE0
__WSAFDIsSet.WSOCK32(00000000,00000001), ref: 00E68AF2
accept.WSOCK32(00000000,00000000,00000000), ref: 00E68AFF
WSAGetLastError.WSOCK32(00000000), ref: 00E68B16

Memory Dump Source

Source File: 00000000.00000002.1262750966.0000000000E11000.00000020.00000001.01000000.00000003.sdmp, Offset: 00E10000, based on PE: true

Associated: 00000000.00000002.1262729095.0000000000E10000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1262808979.0000000000E9D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1262808979.0000000000EBE000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1262857687.0000000000ECA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1262878803.0000000000ED4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1262878803.0000000000F07000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_e10000_18112024_Dokman_1 Kas_m 2024- Avans_T24-2112184_dekont.jbxd

Similarity

API ID: ErrorLastacceptselect
String ID:
API String ID: 385091864-0
Opcode ID: 0968016e037bbcd1e32c8d8a9ad5ab43bc4f3478ecbdb8af05e8712748d71105
Instruction ID: fc5627dddf2d5124fc20aab64967a48eb360c3b7c45dcea6dcee713cef5c9dfa
Opcode Fuzzy Hash: 0968016e037bbcd1e32c8d8a9ad5ab43bc4f3478ecbdb8af05e8712748d71105
Instruction Fuzzy Hash: 0D219372A00124AFC7219F69DD85A9EBBECEF49350F00416BF849E7290DB749A85CF90

Function 00E78A37 Relevance: 6.1, APIs: 4, Instructions: 69COMMON

Download Yara Rule

APIs

GetWindowLongW.USER32(?,000000EC), ref: 00E78AA6
SetWindowLongW.USER32(?,000000EC,00000000), ref: 00E78AC0
SetWindowLongW.USER32(?,000000EC,00000000), ref: 00E78ACE
SetLayeredWindowAttributes.USER32(?,00000000,?,00000002), ref: 00E78ADC

Memory Dump Source

Source File: 00000000.00000002.1262750966.0000000000E11000.00000020.00000001.01000000.00000003.sdmp, Offset: 00E10000, based on PE: true

Associated: 00000000.00000002.1262729095.0000000000E10000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1262808979.0000000000E9D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1262808979.0000000000EBE000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1262857687.0000000000ECA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1262878803.0000000000ED4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1262878803.0000000000F07000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_e10000_18112024_Dokman_1 Kas_m 2024- Avans_T24-2112184_dekont.jbxd

Similarity

API ID: Window$Long$AttributesLayered
String ID:
API String ID: 2169480361-0
Opcode ID: af4dbe109f5a2fcb714069ee97f4f7d6e99c5943ef8216f1ccb185a983e3d5ba
Instruction ID: 10125b89b5eeaaa51f93ffb5297c28e425c6d8c687fbadaf49321f7664ee9a16
Opcode Fuzzy Hash: af4dbe109f5a2fcb714069ee97f4f7d6e99c5943ef8216f1ccb185a983e3d5ba
Instruction Fuzzy Hash: E511D331345121AFDB54AB18CD09FBA77D9EF95321F14911AF92AE72E1CB70AC50C790

Function 00E50AA6 Relevance: 6.1, APIs: 3, Strings: 1, Instructions: 68stringCOMMON

Download Yara Rule

APIs

Part of subcall function 00E51E68: lstrlenW.KERNEL32(?,00000002,?,?,000000EF,?,00E50ABB,?,?,?,00E5187A,00000000,000000EF,00000119,?,?), ref: 00E51E77
Part of subcall function 00E51E68: lstrcpyW.KERNEL32(00000000,?,?,00E50ABB,?,?,?,00E5187A,00000000,000000EF,00000119,?,?,00000000), ref: 00E51E9D
Part of subcall function 00E51E68: lstrcmpiW.KERNEL32(00000000,?,00E50ABB,?,?,?,00E5187A,00000000,000000EF,00000119,?,?), ref: 00E51ECE

lstrlenW.KERNEL32(?,00000002,?,?,?,?,00E5187A,00000000,000000EF,00000119,?,?,00000000), ref: 00E50AD4
lstrcpyW.KERNEL32(00000000,?,?,00E5187A,00000000,000000EF,00000119,?,?,00000000), ref: 00E50AFA
lstrcmpiW.KERNEL32(00000002,cdecl,?,00E5187A,00000000,000000EF,00000119,?,?,00000000), ref: 00E50B2E

Strings

cdecl, xrefs: 00E50B25

Memory Dump Source

Source File: 00000000.00000002.1262750966.0000000000E11000.00000020.00000001.01000000.00000003.sdmp, Offset: 00E10000, based on PE: true

Associated: 00000000.00000002.1262729095.0000000000E10000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1262808979.0000000000E9D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1262808979.0000000000EBE000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1262857687.0000000000ECA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1262878803.0000000000ED4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1262878803.0000000000F07000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_e10000_18112024_Dokman_1 Kas_m 2024- Avans_T24-2112184_dekont.jbxd

Similarity

API ID: lstrcmpilstrcpylstrlen
String ID: cdecl
API String ID: 4031866154-3896280584
Opcode ID: f299fdbfd8f3f11d4249e9ee7f5f8ffa62cf5db45bbd0f461b2b819a92f802b9
Instruction ID: b46d6da4a9ca71941a329129721be8cb79f6df15c07fec691e0c75207895219f
Opcode Fuzzy Hash: f299fdbfd8f3f11d4249e9ee7f5f8ffa62cf5db45bbd0f461b2b819a92f802b9
Instruction Fuzzy Hash: 9311BE36200305AFDB25AF24DC85EBA77A8FF45355B80546AFC06DB2A0EB719844C7A0

Function 00E42F96 Relevance: 6.1, APIs: 4, Instructions: 67COMMONLIBRARYCODE

Download Yara Rule

APIs

_free.LIBCMT ref: 00E42FB5

Part of subcall function 00E3395C: __FF_MSGBANNER.LIBCMT ref: 00E33973
Part of subcall function 00E3395C: __NMSG_WRITE.LIBCMT ref: 00E3397A
Part of subcall function 00E3395C: RtlAllocateHeap.NTDLL(010D0000,00000000,00000001,00000001,00000000,?,?,00E2F507,?,0000000E), ref: 00E3399F

Memory Dump Source

Source File: 00000000.00000002.1262750966.0000000000E11000.00000020.00000001.01000000.00000003.sdmp, Offset: 00E10000, based on PE: true

Associated: 00000000.00000002.1262729095.0000000000E10000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1262808979.0000000000E9D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1262808979.0000000000EBE000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1262857687.0000000000ECA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1262878803.0000000000ED4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1262878803.0000000000F07000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_e10000_18112024_Dokman_1 Kas_m 2024- Avans_T24-2112184_dekont.jbxd

Similarity

API ID: AllocateHeap_free
String ID:
API String ID: 614378929-0
Opcode ID: dc62d991c55eb4a49c9a9fdb2fd70c6028b42a98fca71de7e43e1f32461f0d07
Instruction ID: 8037323013071b5cbffcd07c7a3839e7263d7d300c7a3d08c634335800b18b70
Opcode Fuzzy Hash: dc62d991c55eb4a49c9a9fdb2fd70c6028b42a98fca71de7e43e1f32461f0d07
Instruction Fuzzy Hash: 43110632509212AFDB313F74BC0866A7FE4AF44364F607A2AF949BA151DB30CD44C790

Function 00E5058F Relevance: 6.1, APIs: 4, Instructions: 64registryCOMMON

Download Yara Rule

APIs

GetModuleFileNameW.KERNEL32(?,?,00000104,00000000,00000000), ref: 00E505AC
LoadTypeLibEx.OLEAUT32(?,00000002,?), ref: 00E505C7
RegisterTypeLib.OLEAUT32(?,?,00000000), ref: 00E505DD
FreeLibrary.KERNEL32(?), ref: 00E50632

Memory Dump Source

Source File: 00000000.00000002.1262750966.0000000000E11000.00000020.00000001.01000000.00000003.sdmp, Offset: 00E10000, based on PE: true

Associated: 00000000.00000002.1262729095.0000000000E10000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1262808979.0000000000E9D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1262808979.0000000000EBE000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1262857687.0000000000ECA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1262878803.0000000000ED4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1262878803.0000000000F07000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_e10000_18112024_Dokman_1 Kas_m 2024- Avans_T24-2112184_dekont.jbxd

Similarity

API ID: Type$FileFreeLibraryLoadModuleNameRegister
String ID:
API String ID: 3137044355-0
Opcode ID: ca528fffa4a868295f52161dc6cf595100b3c3d9f7cb27575d6fafb5674eb83b
Instruction ID: ebabc4271ab7fd87e2b6d62e8db829f3c93ef05f72e3fa9747463dd994777138
Opcode Fuzzy Hash: ca528fffa4a868295f52161dc6cf595100b3c3d9f7cb27575d6fafb5674eb83b
Instruction Fuzzy Hash: 6B218171900219EFDB20DF95DC88ADABBB8EF40705F0098AAF956B2450D7B0EA5DDF50

Function 00E56713 Relevance: 6.1, APIs: 4, Instructions: 64fileCOMMON

Download Yara Rule

APIs

CreateFileW.KERNEL32(?,C0000000,00000003,00000000,00000003,00000080,00000000), ref: 00E56733
_memset.LIBCMT ref: 00E56754
DeviceIoControl.KERNEL32(00000000,0004D02C,?,00000200,?,00000200,?,00000000), ref: 00E567A6
CloseHandle.KERNEL32(00000000), ref: 00E567AF

Memory Dump Source

Source File: 00000000.00000002.1262750966.0000000000E11000.00000020.00000001.01000000.00000003.sdmp, Offset: 00E10000, based on PE: true

Associated: 00000000.00000002.1262729095.0000000000E10000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1262808979.0000000000E9D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1262808979.0000000000EBE000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1262857687.0000000000ECA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1262878803.0000000000ED4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1262878803.0000000000F07000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_e10000_18112024_Dokman_1 Kas_m 2024- Avans_T24-2112184_dekont.jbxd

Similarity

API ID: CloseControlCreateDeviceFileHandle_memset
String ID:
API String ID: 1157408455-0
Opcode ID: 54294d52553e8ccb9f829cdbd5db53190b9c6bee89b196c70d3d17a09be1d414
Instruction ID: 084d1cc07c30c0b5c6f2ad0babe7270546e4dd3091f02f8f3cfa94808cf5a894
Opcode Fuzzy Hash: 54294d52553e8ccb9f829cdbd5db53190b9c6bee89b196c70d3d17a09be1d414
Instruction Fuzzy Hash: B711A7769012287AE72097A5AC4DFABBABCEF44764F10459BF904F7190D2744E848B64

Function 00E4B1CC Relevance: 6.1, APIs: 4, Instructions: 63memoryCOMMON

Download Yara Rule

APIs

Part of subcall function 00E4AA62: GetTokenInformation.ADVAPI32(?,00000002,?,00000000,?), ref: 00E4AA79
Part of subcall function 00E4AA62: GetLastError.KERNEL32(?,00000002,?,00000000,?), ref: 00E4AA83
Part of subcall function 00E4AA62: GetProcessHeap.KERNEL32(00000008,?,?,00000002,?,00000000,?), ref: 00E4AA92
Part of subcall function 00E4AA62: HeapAlloc.KERNEL32(00000000,?,00000002,?,00000000,?), ref: 00E4AA99
Part of subcall function 00E4AA62: GetTokenInformation.ADVAPI32(?,00000002,00000000,?,?,?,00000002,?,00000000,?), ref: 00E4AAAF

GetLengthSid.ADVAPI32(?,00000000,00E4ADE4,?,?), ref: 00E4B21B
GetProcessHeap.KERNEL32(00000008,00000000), ref: 00E4B227
HeapAlloc.KERNEL32(00000000), ref: 00E4B22E
CopySid.ADVAPI32(?,00000000,?), ref: 00E4B247

Memory Dump Source

Source File: 00000000.00000002.1262750966.0000000000E11000.00000020.00000001.01000000.00000003.sdmp, Offset: 00E10000, based on PE: true

Associated: 00000000.00000002.1262729095.0000000000E10000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1262808979.0000000000E9D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1262808979.0000000000EBE000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1262857687.0000000000ECA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1262878803.0000000000ED4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1262878803.0000000000F07000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_e10000_18112024_Dokman_1 Kas_m 2024- Avans_T24-2112184_dekont.jbxd

Similarity

API ID: Heap$AllocInformationProcessToken$CopyErrorLastLength
String ID:
API String ID: 4217664535-0
Opcode ID: 277e214567bc941b244d3f725fd33ca9a5d95732defcf15cd76de075824f26f9
Instruction ID: 1dfc7a11e0edc45cf822ff7c7a7b2b50be4a9e7ff4168cf2e29104b8af70a28e
Opcode Fuzzy Hash: 277e214567bc941b244d3f725fd33ca9a5d95732defcf15cd76de075824f26f9
Instruction Fuzzy Hash: 07119471A00205EFDB049F55EC45AAFB7A9EF85318F14902EE542F7221D771EE44DB14

Function 00E4B478 Relevance: 6.1, APIs: 4, Instructions: 58windowCOMMON

Download Yara Rule

APIs

SendMessageW.USER32(?,000000B0,?,?), ref: 00E4B498
SendMessageW.USER32(?,000000C9,?,00000000), ref: 00E4B4AA
SendMessageW.USER32(?,000000C9,?,00000000), ref: 00E4B4C0
SendMessageW.USER32(?,000000C9,?,00000000), ref: 00E4B4DB

Memory Dump Source

Source File: 00000000.00000002.1262750966.0000000000E11000.00000020.00000001.01000000.00000003.sdmp, Offset: 00E10000, based on PE: true

Associated: 00000000.00000002.1262729095.0000000000E10000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1262808979.0000000000E9D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1262808979.0000000000EBE000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1262857687.0000000000ECA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1262878803.0000000000ED4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1262878803.0000000000F07000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_e10000_18112024_Dokman_1 Kas_m 2024- Avans_T24-2112184_dekont.jbxd

Similarity

API ID: MessageSend
String ID:
API String ID: 3850602802-0
Opcode ID: 081df60d79b6e758a6b32c04ab1fb3bf75295a974b364cc7695132ca00678af2
Instruction ID: 5af00ce7f6e231114aa58e4f0e6b65e5d037b1fea34680d30f1a06b24b8816f5
Opcode Fuzzy Hash: 081df60d79b6e758a6b32c04ab1fb3bf75295a974b364cc7695132ca00678af2
Instruction Fuzzy Hash: 6111577A900218FFEB11DFA9CD81E9DBBB8FB08710F204091EA14B7291D771AE11DB94

Function 00E2B55D Relevance: 6.1, APIs: 4, Instructions: 56COMMON

Download Yara Rule

APIs

Part of subcall function 00E2B34E: GetWindowLongW.USER32(?,000000EB), ref: 00E2B35F

DefDlgProcW.USER32(?,00000020,?,00000000), ref: 00E2B5A5
GetClientRect.USER32(?,?), ref: 00E8E69A
GetCursorPos.USER32(?), ref: 00E8E6A4
ScreenToClient.USER32(?,?), ref: 00E8E6AF

Memory Dump Source

Source File: 00000000.00000002.1262750966.0000000000E11000.00000020.00000001.01000000.00000003.sdmp, Offset: 00E10000, based on PE: true

Associated: 00000000.00000002.1262729095.0000000000E10000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1262808979.0000000000E9D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1262808979.0000000000EBE000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1262857687.0000000000ECA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1262878803.0000000000ED4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1262878803.0000000000F07000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_e10000_18112024_Dokman_1 Kas_m 2024- Avans_T24-2112184_dekont.jbxd

Similarity

API ID: Client$CursorLongProcRectScreenWindow
String ID:
API String ID: 4127811313-0
Opcode ID: f9e445c8e13579b75543c474f7cc5c1200c8444486c17438fab23f44b772f2b1
Instruction ID: ad95eb0c9ad475c6eb30b918bb37972a180a5067e6e8751db066ea381f95fa37
Opcode Fuzzy Hash: f9e445c8e13579b75543c474f7cc5c1200c8444486c17438fab23f44b772f2b1
Instruction Fuzzy Hash: 7A113631900029BFCB10EF94EC858EE77B9FB08304F001452E915FB241D730AA85CBA1

Function 00E5732B Relevance: 6.1, APIs: 4, Instructions: 55synchronizationthreadwindowCOMMON

Download Yara Rule

APIs

GetCurrentThreadId.KERNEL32 ref: 00E57352
MessageBoxW.USER32(?,?,?,?), ref: 00E57385
WaitForSingleObject.KERNEL32(00000000,000000FF,?,?,?,?), ref: 00E5739B
CloseHandle.KERNEL32(00000000,?,?,?,?), ref: 00E573A2

Memory Dump Source

Source File: 00000000.00000002.1262750966.0000000000E11000.00000020.00000001.01000000.00000003.sdmp, Offset: 00E10000, based on PE: true

Associated: 00000000.00000002.1262729095.0000000000E10000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1262808979.0000000000E9D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1262808979.0000000000EBE000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1262857687.0000000000ECA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1262878803.0000000000ED4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1262878803.0000000000F07000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_e10000_18112024_Dokman_1 Kas_m 2024- Avans_T24-2112184_dekont.jbxd

Similarity

API ID: CloseCurrentHandleMessageObjectSingleThreadWait
String ID:
API String ID: 2880819207-0
Opcode ID: 172aacc5fc61fe0434f9dba310cfac20d75b937514ff69e2ea8591f8fe7cd154
Instruction ID: 7d50f2d1b7dd0726cba708811ce13f81ef36908b7cd43fedd6bc93e726772a21
Opcode Fuzzy Hash: 172aacc5fc61fe0434f9dba310cfac20d75b937514ff69e2ea8591f8fe7cd154
Instruction Fuzzy Hash: 3F112576A08214AFC7018B6AEC05A9E7FADDB45321F000217FC64F3261D270891887A1

Function 00E2D17C Relevance: 6.1, APIs: 4, Instructions: 53windowCOMMON

Download Yara Rule

APIs

CreateWindowExW.USER32(?,?,?,?,?,?,?,?,?,?,00000000,00000096), ref: 00E2D1BA
GetStockObject.GDI32(00000011), ref: 00E2D1CE
SendMessageW.USER32(00000000,00000030,00000000), ref: 00E2D1D8

Memory Dump Source

Source File: 00000000.00000002.1262750966.0000000000E11000.00000020.00000001.01000000.00000003.sdmp, Offset: 00E10000, based on PE: true

Associated: 00000000.00000002.1262729095.0000000000E10000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1262808979.0000000000E9D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1262808979.0000000000EBE000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1262857687.0000000000ECA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1262878803.0000000000ED4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1262878803.0000000000F07000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_e10000_18112024_Dokman_1 Kas_m 2024- Avans_T24-2112184_dekont.jbxd

Similarity

API ID: CreateMessageObjectSendStockWindow
String ID:
API String ID: 3970641297-0
Opcode ID: fc73614dfe65bfbea2904f9a6fff2c8aa880a9290b9f623f59904a4b2499696f
Instruction ID: 65ba5546cbc2f85b949d4dde3038d4ee1f4dc547f23a1242a78c2f5cc926ed17
Opcode Fuzzy Hash: fc73614dfe65bfbea2904f9a6fff2c8aa880a9290b9f623f59904a4b2499696f
Instruction Fuzzy Hash: BA118BB210A629BFEB024F91EC54EEABB6DFF08368F045102FA1562150C7319C609BA0

Function 00E44DF2 Relevance: 6.0, APIs: 4, Instructions: 48COMMONLIBRARYCODE

Download Yara Rule

APIs

__cftof_l.LIBCMT ref: 00E44E16

Part of subcall function 00E454F5: __fltout2.LIBCMT ref: 00E4551E

__cftog_l.LIBCMT ref: 00E44E3C
__cftoe_l.LIBCMT ref: 00E44E6E

Memory Dump Source

Source File: 00000000.00000002.1262750966.0000000000E11000.00000020.00000001.01000000.00000003.sdmp, Offset: 00E10000, based on PE: true

Associated: 00000000.00000002.1262729095.0000000000E10000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1262808979.0000000000E9D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1262808979.0000000000EBE000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1262857687.0000000000ECA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1262878803.0000000000ED4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1262878803.0000000000F07000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_e10000_18112024_Dokman_1 Kas_m 2024- Avans_T24-2112184_dekont.jbxd

Similarity

API ID: __cftoe_l__cftof_l__cftog_l__fltout2
String ID:
API String ID: 3016257755-0
Opcode ID: 3c6a35542a271610c24967ae1addb0a5128256cd46e27c9700edfec13bdc5c5a
Instruction ID: c3f9fcaf521c6768a4f4e47913836d78f919ddc6a2fee0c2fb7672ded132daba
Opcode Fuzzy Hash: 3c6a35542a271610c24967ae1addb0a5128256cd46e27c9700edfec13bdc5c5a
Instruction Fuzzy Hash: 4E0149B210014EBBCF125E84EC019EE3F63BB18354B589455FE2969075D736CAB2AB81

Function 00E37452 Relevance: 6.0, APIs: 4, Instructions: 47COMMONLIBRARYCODE

Download Yara Rule

APIs

Part of subcall function 00E37A0D: __getptd_noexit.LIBCMT ref: 00E37A0E

__lock.LIBCMT ref: 00E3748F
InterlockedDecrement.KERNEL32(?), ref: 00E374AC
_free.LIBCMT ref: 00E374BF
InterlockedIncrement.KERNEL32(010E2FA8), ref: 00E374D7

Memory Dump Source

Source File: 00000000.00000002.1262750966.0000000000E11000.00000020.00000001.01000000.00000003.sdmp, Offset: 00E10000, based on PE: true

Associated: 00000000.00000002.1262729095.0000000000E10000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1262808979.0000000000E9D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1262808979.0000000000EBE000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1262857687.0000000000ECA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1262878803.0000000000ED4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1262878803.0000000000F07000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_e10000_18112024_Dokman_1 Kas_m 2024- Avans_T24-2112184_dekont.jbxd

Similarity

API ID: Interlocked$DecrementIncrement__getptd_noexit__lock_free
String ID:
API String ID: 2704283638-0
Opcode ID: 0d781b3136dc61b35666b3263305697fd31f68e66068a9dc4d4aecd30e7d8218
Instruction ID: 419853c7f2ab9346bfed84f5f58654dbfae6ce262f8ad190b662bc0fdd9c8b0d
Opcode Fuzzy Hash: 0d781b3136dc61b35666b3263305697fd31f68e66068a9dc4d4aecd30e7d8218
Instruction Fuzzy Hash: 1F01C472909625ABC731AF35990DB5DBFA0BF04B18F18605AF8A473680C7356901CFC2

Function 00E7EA6A Relevance: 6.0, APIs: 4, Instructions: 31COMMON

Download Yara Rule

APIs

Part of subcall function 00E2AF83: ExtCreatePen.GDI32(?,?,00000000,00000000,00000000,?,?,00000000), ref: 00E2AFE3
Part of subcall function 00E2AF83: SelectObject.GDI32(?,00000000), ref: 00E2AFF2
Part of subcall function 00E2AF83: BeginPath.GDI32(?), ref: 00E2B009
Part of subcall function 00E2AF83: SelectObject.GDI32(?,00000000), ref: 00E2B033

MoveToEx.GDI32(00000000,00000000,?,00000000), ref: 00E7EA8E
LineTo.GDI32(00000000,?,?), ref: 00E7EA9B
EndPath.GDI32(00000000), ref: 00E7EAAB
StrokePath.GDI32(00000000), ref: 00E7EAB9

Memory Dump Source

Source File: 00000000.00000002.1262750966.0000000000E11000.00000020.00000001.01000000.00000003.sdmp, Offset: 00E10000, based on PE: true

Associated: 00000000.00000002.1262729095.0000000000E10000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1262808979.0000000000E9D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1262808979.0000000000EBE000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1262857687.0000000000ECA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1262878803.0000000000ED4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1262878803.0000000000F07000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_e10000_18112024_Dokman_1 Kas_m 2024- Avans_T24-2112184_dekont.jbxd

Similarity

API ID: Path$ObjectSelect$BeginCreateLineMoveStroke
String ID:
API String ID: 1539411459-0
Opcode ID: 79e6064d23c339b763515a4188f8fd603b11dbcb8cffe2ade34bf785698fef2e
Instruction ID: ca642b55d65be1bb3f5a7bef19f101ea2b2785bd558094c4ff50e1de2acfb288
Opcode Fuzzy Hash: 79e6064d23c339b763515a4188f8fd603b11dbcb8cffe2ade34bf785698fef2e
Instruction Fuzzy Hash: 4CF0E23200A268BFDB129F95AC0EFCE3F1AAF0A310F088143FA11711E183749559CBA5

Function 00E4C82D Relevance: 6.0, APIs: 4, Instructions: 30threadwindowtimeCOMMON

Download Yara Rule

APIs

SendMessageTimeoutW.USER32(?,00000000,00000000,00000000,00000002,00001388,00000001), ref: 00E4C84A
GetWindowThreadProcessId.USER32(?,00000000), ref: 00E4C85D
GetCurrentThreadId.KERNEL32 ref: 00E4C864
AttachThreadInput.USER32(00000000), ref: 00E4C86B

Memory Dump Source

Source File: 00000000.00000002.1262750966.0000000000E11000.00000020.00000001.01000000.00000003.sdmp, Offset: 00E10000, based on PE: true

Associated: 00000000.00000002.1262729095.0000000000E10000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1262808979.0000000000E9D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1262808979.0000000000EBE000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1262857687.0000000000ECA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1262878803.0000000000ED4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1262878803.0000000000F07000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_e10000_18112024_Dokman_1 Kas_m 2024- Avans_T24-2112184_dekont.jbxd

Similarity

API ID: Thread$AttachCurrentInputMessageProcessSendTimeoutWindow
String ID:
API String ID: 2710830443-0
Opcode ID: 366fabe0c4ffe1057c57ff64f3ada01746133d6f8bc4023d719d5f3e12d179fc
Instruction ID: 95fe47f02c4f5cc28ee90e7b5b3b6cdaf8da85bffacc797358599da0a3865354
Opcode Fuzzy Hash: 366fabe0c4ffe1057c57ff64f3ada01746133d6f8bc4023d719d5f3e12d179fc
Instruction Fuzzy Hash: CBE06D71146238BADB211BA3EC0DEDB7F1CEF0A7A1F008023B60DA6461C6B1D584CBE0

Function 00E4B0CD Relevance: 6.0, APIs: 4, Instructions: 23threadCOMMON

Download Yara Rule

APIs

GetCurrentThread.KERNEL32 ref: 00E4B0D6
OpenThreadToken.ADVAPI32(00000000,?,?,?,00E4AC9D), ref: 00E4B0DD
GetCurrentProcess.KERNEL32(00000028,?,?,?,?,00E4AC9D), ref: 00E4B0EA
OpenProcessToken.ADVAPI32(00000000,?,?,?,00E4AC9D), ref: 00E4B0F1

Memory Dump Source

Source File: 00000000.00000002.1262750966.0000000000E11000.00000020.00000001.01000000.00000003.sdmp, Offset: 00E10000, based on PE: true

Associated: 00000000.00000002.1262729095.0000000000E10000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1262808979.0000000000E9D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1262808979.0000000000EBE000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1262857687.0000000000ECA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1262878803.0000000000ED4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1262878803.0000000000F07000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_e10000_18112024_Dokman_1 Kas_m 2024- Avans_T24-2112184_dekont.jbxd

Similarity

API ID: CurrentOpenProcessThreadToken
String ID:
API String ID: 3974789173-0
Opcode ID: 280d7d3c796a4de5bcbf2b22c6ba68ac11a15f9ea36dbab80df3f58c786b1275
Instruction ID: 1af4c3b33aaaa988098f25ef45fe992414b6d93c48719f4a405ae6b4993d7e8e
Opcode Fuzzy Hash: 280d7d3c796a4de5bcbf2b22c6ba68ac11a15f9ea36dbab80df3f58c786b1275
Instruction Fuzzy Hash: BDE08632605221DFD7205FB36D0CB473BA9EF55796F01881AF641F6040EB748445C760

Function 00E2B47D Relevance: 6.0, APIs: 4, Instructions: 22COMMON

Download Yara Rule

APIs

GetSysColor.USER32(00000008), ref: 00E2B496
SetTextColor.GDI32(?,000000FF), ref: 00E2B4A0
SetBkMode.GDI32(?,00000001), ref: 00E2B4B5
GetStockObject.GDI32(00000005), ref: 00E2B4BD
GetWindowDC.USER32(?,00000000), ref: 00E8DE2B
GetPixel.GDI32(00000000,00000000,00000000), ref: 00E8DE38
GetPixel.GDI32(00000000,?,00000000), ref: 00E8DE51
GetPixel.GDI32(00000000,00000000,?), ref: 00E8DE6A
GetPixel.GDI32(00000000,?,?), ref: 00E8DE8A
ReleaseDC.USER32(?,00000000), ref: 00E8DE95

Memory Dump Source

Source File: 00000000.00000002.1262750966.0000000000E11000.00000020.00000001.01000000.00000003.sdmp, Offset: 00E10000, based on PE: true

Associated: 00000000.00000002.1262729095.0000000000E10000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1262808979.0000000000E9D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1262808979.0000000000EBE000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1262857687.0000000000ECA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1262878803.0000000000ED4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1262878803.0000000000F07000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_e10000_18112024_Dokman_1 Kas_m 2024- Avans_T24-2112184_dekont.jbxd

Similarity

API ID: Pixel$Color$ModeObjectReleaseStockTextWindow
String ID:
API String ID: 1946975507-0
Opcode ID: c210916baa35e787bfc5661a8086e48f4c8f3d7b6dfe41494ce925b283ebaea0
Instruction ID: a26d1b8eae64c14d9565e015a42959d14c01dcf1bfc614871553e14c89ec51db
Opcode Fuzzy Hash: c210916baa35e787bfc5661a8086e48f4c8f3d7b6dfe41494ce925b283ebaea0
Instruction Fuzzy Hash: 83E06D32108250AEDB212B66EC49BD83B11AB11339F00C327F7BDA80E1C3714984CB11

Function 00E4B2D4 Relevance: 6.0, APIs: 4, Instructions: 20synchronizationCOMMON

Download Yara Rule

APIs

WaitForSingleObject.KERNEL32(?,000000FF), ref: 00E4B2DF
UnloadUserProfile.USERENV(?,?), ref: 00E4B2EB
CloseHandle.KERNEL32(?), ref: 00E4B2F4
CloseHandle.KERNEL32(?), ref: 00E4B2FC

Part of subcall function 00E4AB24: GetProcessHeap.KERNEL32(00000000,?,00E4A848), ref: 00E4AB2B
Part of subcall function 00E4AB24: HeapFree.KERNEL32(00000000), ref: 00E4AB32

Memory Dump Source

Source File: 00000000.00000002.1262750966.0000000000E11000.00000020.00000001.01000000.00000003.sdmp, Offset: 00E10000, based on PE: true

Associated: 00000000.00000002.1262729095.0000000000E10000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1262808979.0000000000E9D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1262808979.0000000000EBE000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1262857687.0000000000ECA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1262878803.0000000000ED4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1262878803.0000000000F07000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_e10000_18112024_Dokman_1 Kas_m 2024- Avans_T24-2112184_dekont.jbxd

Similarity

API ID: CloseHandleHeap$FreeObjectProcessProfileSingleUnloadUserWait
String ID:
API String ID: 146765662-0
Opcode ID: c8d8d3f960c16d592073b3d86678c1b22c9187a039bcc244fdc5d9041ea0f1a5
Instruction ID: 80fde587c4611013b715a26f85e7376bf907052797705b3f69b3f20f0ca9cf64
Opcode Fuzzy Hash: c8d8d3f960c16d592073b3d86678c1b22c9187a039bcc244fdc5d9041ea0f1a5
Instruction Fuzzy Hash: 9DE0E676108015FFCB016FA6EC08859FFB6FF883213108223F61591571CB329475EB51

Function 00E8B29A Relevance: 6.0, APIs: 4, Instructions: 20COMMON

Download Yara Rule

APIs

GetDesktopWindow.USER32 ref: 00E8B29A
GetDC.USER32(00000000), ref: 00E8B2A4
GetDeviceCaps.GDI32(00000000,0000000C), ref: 00E8B2C3
ReleaseDC.USER32 ref: 00E8B2E2

Memory Dump Source

Source File: 00000000.00000002.1262750966.0000000000E11000.00000020.00000001.01000000.00000003.sdmp, Offset: 00E10000, based on PE: true

Associated: 00000000.00000002.1262729095.0000000000E10000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1262808979.0000000000E9D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1262808979.0000000000EBE000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1262857687.0000000000ECA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1262878803.0000000000ED4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1262878803.0000000000F07000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_e10000_18112024_Dokman_1 Kas_m 2024- Avans_T24-2112184_dekont.jbxd

Similarity

API ID: CapsDesktopDeviceReleaseWindow
String ID:
API String ID: 2889604237-0
Opcode ID: ece385e9a906620ced27581ec3dde7e4c21e3c7f0db1a9017e5226fbcdfb3af8
Instruction ID: bde56a068af8705dbe7467ac12d1ae69a054e8d2d344b28868ba4f7bee41db9c
Opcode Fuzzy Hash: ece385e9a906620ced27581ec3dde7e4c21e3c7f0db1a9017e5226fbcdfb3af8
Instruction Fuzzy Hash: BAE01AB1108224EFDB005F71DC4866D7BA5EB4C360F11980BF95AA7211CA7498448B40

Function 00E8B2AE Relevance: 6.0, APIs: 4, Instructions: 19COMMON

Download Yara Rule

APIs

GetDesktopWindow.USER32 ref: 00E8B2AE
GetDC.USER32(00000000), ref: 00E8B2B8
GetDeviceCaps.GDI32(00000000,0000000C), ref: 00E8B2C3
ReleaseDC.USER32 ref: 00E8B2E2

Memory Dump Source

Source File: 00000000.00000002.1262750966.0000000000E11000.00000020.00000001.01000000.00000003.sdmp, Offset: 00E10000, based on PE: true

Associated: 00000000.00000002.1262729095.0000000000E10000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1262808979.0000000000E9D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1262808979.0000000000EBE000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1262857687.0000000000ECA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1262878803.0000000000ED4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1262878803.0000000000F07000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_e10000_18112024_Dokman_1 Kas_m 2024- Avans_T24-2112184_dekont.jbxd

Similarity

API ID: CapsDesktopDeviceReleaseWindow
String ID:
API String ID: 2889604237-0
Opcode ID: 791bc4d525abb51c48079c503aa4e48ad5b2d4b5cb52f1f99aa44dd02553c014
Instruction ID: 084cf7f79cb0da9a0b990f59104d02a51067df338869e0bfcae1e66635aa445d
Opcode Fuzzy Hash: 791bc4d525abb51c48079c503aa4e48ad5b2d4b5cb52f1f99aa44dd02553c014
Instruction Fuzzy Hash: BDE04FB1508324EFDB005F71DC4866D7BA5FB4C350F11840BFA5AA7211CB7498448B00

Function 00E4DCDF Relevance: 5.5, APIs: 1, Strings: 2, Instructions: 240comCOMMON

Download Yara Rule

APIs

OleSetContainedObject.OLE32(?,00000001), ref: 00E4DEAA

Strings

AutoIt3GUI, xrefs: 00E4DE22
Container, xrefs: 00E4DE29

Memory Dump Source

Source File: 00000000.00000002.1262750966.0000000000E11000.00000020.00000001.01000000.00000003.sdmp, Offset: 00E10000, based on PE: true

Associated: 00000000.00000002.1262729095.0000000000E10000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1262808979.0000000000E9D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1262808979.0000000000EBE000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1262857687.0000000000ECA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1262878803.0000000000ED4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1262878803.0000000000F07000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_e10000_18112024_Dokman_1 Kas_m 2024- Avans_T24-2112184_dekont.jbxd

Similarity

API ID: ContainedObject
String ID: AutoIt3GUI$Container
API String ID: 3565006973-3941886329
Opcode ID: e61011feb5e1dde0a5c16d32a90600ba3eaa4ac4f118ba4eae2786329a292436
Instruction ID: 8ddc4838949e334572f60eb704604355abe25564ee95042a9bbd7405164d7ce4
Opcode Fuzzy Hash: e61011feb5e1dde0a5c16d32a90600ba3eaa4ac4f118ba4eae2786329a292436
Instruction Fuzzy Hash: 50915670604601AFDB24CF64D884F6AB7F9BF48714F10956EF94AEB291DBB0E841CB60

Function 00E5290D Relevance: 5.4, APIs: 1, Strings: 2, Instructions: 147COMMON

Download Yara Rule

APIs

_wcscpy.LIBCMT ref: 00E52A72

Strings

I/, xrefs: 00E5297F, 00E529E0, 00E529EA, 00E52A23, 00E52A4F, 00E52A71
I/, xrefs: 00E529FC, 00E52A64, 00E52A12

Memory Dump Source

Source File: 00000000.00000002.1262750966.0000000000E11000.00000020.00000001.01000000.00000003.sdmp, Offset: 00E10000, based on PE: true

Associated: 00000000.00000002.1262729095.0000000000E10000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1262808979.0000000000E9D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1262808979.0000000000EBE000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1262857687.0000000000ECA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1262878803.0000000000ED4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1262878803.0000000000F07000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_e10000_18112024_Dokman_1 Kas_m 2024- Avans_T24-2112184_dekont.jbxd

Similarity

API ID: _wcscpy
String ID: I/$I/
API String ID: 3048848545-2526233121
Opcode ID: 88dfdb524e9d45900ed7a20722aa58de949687d2b7979f4fca71de7ff0cb1198
Instruction ID: 5872b72144c7647de71cbaa7ca4c13af3cf4843fb58f0db31f192985f1b847b3
Opcode Fuzzy Hash: 88dfdb524e9d45900ed7a20722aa58de949687d2b7979f4fca71de7ff0cb1198
Instruction Fuzzy Hash: 43410B31900116AACF25DF98C4819FCB7B0EF5A316F54784EEE81B7292E7305E8AC790

Function 00E2BCC9 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 143sleepCOMMON

Download Yara Rule

APIs

Sleep.KERNEL32(00000000), ref: 00E2BCDA
GlobalMemoryStatusEx.KERNEL32 ref: 00E2BCF3

Strings

@, xrefs: 00E2BCE8

Memory Dump Source

Source File: 00000000.00000002.1262750966.0000000000E11000.00000020.00000001.01000000.00000003.sdmp, Offset: 00E10000, based on PE: true

Associated: 00000000.00000002.1262729095.0000000000E10000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1262808979.0000000000E9D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1262808979.0000000000EBE000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1262857687.0000000000ECA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1262878803.0000000000ED4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1262878803.0000000000F07000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_e10000_18112024_Dokman_1 Kas_m 2024- Avans_T24-2112184_dekont.jbxd

Similarity

API ID: GlobalMemorySleepStatus
String ID: @
API String ID: 2783356886-2766056989
Opcode ID: e934ce2970ec4558f4d6454fa39cad7057d55f94680df390b8c601cdde1a8b4f
Instruction ID: 844efcd5571922b6c2fa9ed33f46df298478a98ccd26a43fcaf2786bd800db29
Opcode Fuzzy Hash: e934ce2970ec4558f4d6454fa39cad7057d55f94680df390b8c601cdde1a8b4f
Instruction Fuzzy Hash: 44514671408744ABE320AF14EC86BAFBBE8FBD4354F41485EF2C8511A6DB7185AD8762

Function 00E5C56D Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 137COMMON

Download Yara Rule

APIs

Part of subcall function 00E144ED: __fread_nolock.LIBCMT ref: 00E1450B

_wcscmp.LIBCMT ref: 00E5C65D
_wcscmp.LIBCMT ref: 00E5C670

Strings

FILE, xrefs: 00E5C5A5

Memory Dump Source

Source File: 00000000.00000002.1262750966.0000000000E11000.00000020.00000001.01000000.00000003.sdmp, Offset: 00E10000, based on PE: true

Associated: 00000000.00000002.1262729095.0000000000E10000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1262808979.0000000000E9D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1262808979.0000000000EBE000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1262857687.0000000000ECA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1262878803.0000000000ED4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1262878803.0000000000F07000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_e10000_18112024_Dokman_1 Kas_m 2024- Avans_T24-2112184_dekont.jbxd

Similarity

API ID: _wcscmp$__fread_nolock
String ID: FILE
API String ID: 4029003684-3121273764
Opcode ID: 0cfc6d955f7239940ea090e56ff13095d5a2efbe7c5baeb172a8e705a968da3f
Instruction ID: 3cbd4d4096232b5049aa19ec1db20400628113e9c1a07a3713f2aa8664e4c999
Opcode Fuzzy Hash: 0cfc6d955f7239940ea090e56ff13095d5a2efbe7c5baeb172a8e705a968da3f
Instruction Fuzzy Hash: 4941E672A0020ABEDF209BA4DC41FEF77F9AF49704F002469FA11F7181D6759A05CB60

Function 00E7A76A Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 96windowCOMMON

Download Yara Rule

APIs

SendMessageW.USER32(?,00001132,00000000,?), ref: 00E7A85A
SendMessageW.USER32(?,00001105,00000000,00000000), ref: 00E7A86F

Strings

', xrefs: 00E7A7C3

Memory Dump Source

Source File: 00000000.00000002.1262750966.0000000000E11000.00000020.00000001.01000000.00000003.sdmp, Offset: 00E10000, based on PE: true

Associated: 00000000.00000002.1262729095.0000000000E10000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1262808979.0000000000E9D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1262808979.0000000000EBE000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1262857687.0000000000ECA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1262878803.0000000000ED4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1262878803.0000000000F07000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_e10000_18112024_Dokman_1 Kas_m 2024- Avans_T24-2112184_dekont.jbxd

Similarity

API ID: MessageSend
String ID: '
API String ID: 3850602802-1997036262
Opcode ID: 6e105339c76d68acd21152753d9c0323e84617452d45f66f20fccdd08dae1c0b
Instruction ID: 1014c16b15655249785f4e2427d5cb7154f980386268116e03e8acc264ef936c
Opcode Fuzzy Hash: 6e105339c76d68acd21152753d9c0323e84617452d45f66f20fccdd08dae1c0b
Instruction Fuzzy Hash: 32410775A013099FDB18CF68D885BDE7BB9FB48304F14506AE909AB381D770A946CFA1

Function 00E7975A Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 95COMMON

Download Yara Rule

APIs

DestroyWindow.USER32(?,?,?,?), ref: 00E7980E
MoveWindow.USER32(?,?,?,?,?,00000001,?,?,?), ref: 00E7984A

Strings

static, xrefs: 00E797AA

Memory Dump Source

Source File: 00000000.00000002.1262750966.0000000000E11000.00000020.00000001.01000000.00000003.sdmp, Offset: 00E10000, based on PE: true

Associated: 00000000.00000002.1262729095.0000000000E10000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1262808979.0000000000E9D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1262808979.0000000000EBE000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1262857687.0000000000ECA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1262878803.0000000000ED4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1262878803.0000000000F07000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_e10000_18112024_Dokman_1 Kas_m 2024- Avans_T24-2112184_dekont.jbxd

Similarity

API ID: Window$DestroyMove
String ID: static
API String ID: 2139405536-2160076837
Opcode ID: eadfea3fe7b554fe1966dde57dc9963489cbcf4e3ee950d3d78fcaa5766ccfc9
Instruction ID: 76065ea7e79156865ab780065a5ecc988a25ca4ae43f1bd1c10021b00f1fb7e3
Opcode Fuzzy Hash: eadfea3fe7b554fe1966dde57dc9963489cbcf4e3ee950d3d78fcaa5766ccfc9
Instruction Fuzzy Hash: 3831BC31100604AEEB149F34DC80BFB73A9FF99324F00A61AF9A9E7191DB30AC81C760

Function 00E55157 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 87windowCOMMON

Download Yara Rule

APIs

_memset.LIBCMT ref: 00E551C6
GetMenuItemInfoW.USER32(?,?,00000000,00000030), ref: 00E55201

Strings

0, xrefs: 00E551BF

Memory Dump Source

Source File: 00000000.00000002.1262750966.0000000000E11000.00000020.00000001.01000000.00000003.sdmp, Offset: 00E10000, based on PE: true

Associated: 00000000.00000002.1262729095.0000000000E10000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1262808979.0000000000E9D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1262808979.0000000000EBE000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1262857687.0000000000ECA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1262878803.0000000000ED4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1262878803.0000000000F07000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_e10000_18112024_Dokman_1 Kas_m 2024- Avans_T24-2112184_dekont.jbxd

Similarity

API ID: InfoItemMenu_memset
String ID: 0
API String ID: 2223754486-4108050209
Opcode ID: 929f044306f718cd323f702159c4571dedbe0c6b52a597fa10f5b9ae8ab04da2
Instruction ID: b8caedf325864f868862c6fe9e9f356b07357e9f203d0a25d8b4605ef16289ae
Opcode Fuzzy Hash: 929f044306f718cd323f702159c4571dedbe0c6b52a597fa10f5b9ae8ab04da2
Instruction Fuzzy Hash: 9A31F53B600704EBEB24CF99D855BAEBBF4EF45355F14182AED85BA1B0E7709948CB10

Function 00E6658B Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 83COMMON

Download Yara Rule

APIs

__snwprintf.LIBCMT ref: 00E66608

Strings

, $, xrefs: 00E66648
AUTOITCALLVARIABLE%d, xrefs: 00E665FA

Memory Dump Source

Source File: 00000000.00000002.1262750966.0000000000E11000.00000020.00000001.01000000.00000003.sdmp, Offset: 00E10000, based on PE: true

Associated: 00000000.00000002.1262729095.0000000000E10000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1262808979.0000000000E9D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1262808979.0000000000EBE000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1262857687.0000000000ECA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1262878803.0000000000ED4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1262878803.0000000000F07000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_e10000_18112024_Dokman_1 Kas_m 2024- Avans_T24-2112184_dekont.jbxd

Similarity

API ID: __snwprintf
String ID: , $$AUTOITCALLVARIABLE%d
API String ID: 2391506597-2584243854
Opcode ID: c9fd8d8c7702552b92e55b7e9e7c40701f58b16c845a2bc2d71766771f2500d4
Instruction ID: db634a2d376aca2fed893a03be6b874f4c49e11ebafb8531ebf1417c788ba3de
Opcode Fuzzy Hash: c9fd8d8c7702552b92e55b7e9e7c40701f58b16c845a2bc2d71766771f2500d4
Instruction Fuzzy Hash: 94218D71A40218ABCF15EFA4E882EEE77F4AF45740F106499F405BB191DB70EA85CBA1

Function 00E793CF Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 72windowCOMMON

Download Yara Rule

APIs

SendMessageW.USER32(00000000,00000143,00000000,?), ref: 00E7945C
SendMessageW.USER32(?,0000014E,00000000,00000000), ref: 00E79467

Strings

Combobox, xrefs: 00E79429

Memory Dump Source

Source File: 00000000.00000002.1262750966.0000000000E11000.00000020.00000001.01000000.00000003.sdmp, Offset: 00E10000, based on PE: true

Associated: 00000000.00000002.1262729095.0000000000E10000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1262808979.0000000000E9D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1262808979.0000000000EBE000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1262857687.0000000000ECA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1262878803.0000000000ED4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1262878803.0000000000F07000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_e10000_18112024_Dokman_1 Kas_m 2024- Avans_T24-2112184_dekont.jbxd

Similarity

API ID: MessageSend
String ID: Combobox
API String ID: 3850602802-2096851135
Opcode ID: 36bead06b5a999f582d1881677df6f32fd9f9a876b42ffd1bd9b83cc48b93b0a
Instruction ID: f75dc786dc78b08726c6a70a4e879e05c7c461586bc000f7f1370e1330eb5558
Opcode Fuzzy Hash: 36bead06b5a999f582d1881677df6f32fd9f9a876b42ffd1bd9b83cc48b93b0a
Instruction Fuzzy Hash: 651163B12102097FEF119E54DCC1EAB376AEF583A8F109125F929A72A1E6719C528760

Function 00E7DA42 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 71COMMON

Download Yara Rule

APIs

Part of subcall function 00E2B34E: GetWindowLongW.USER32(?,000000EB), ref: 00E2B35F

GetActiveWindow.USER32 ref: 00E7DA7B
EnumChildWindows.USER32(?,00E7D75F,00000000), ref: 00E7DAF5

Strings

T1, xrefs: 00E7DAFB

Memory Dump Source

Source File: 00000000.00000002.1262750966.0000000000E11000.00000020.00000001.01000000.00000003.sdmp, Offset: 00E10000, based on PE: true

Associated: 00000000.00000002.1262729095.0000000000E10000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1262808979.0000000000E9D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1262808979.0000000000EBE000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1262857687.0000000000ECA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1262878803.0000000000ED4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1262878803.0000000000F07000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_e10000_18112024_Dokman_1 Kas_m 2024- Avans_T24-2112184_dekont.jbxd

Similarity

API ID: Window$ActiveChildEnumLongWindows
String ID: T1
API String ID: 3814560230-924183305
Opcode ID: f7be8261870349b504cd864e7767b78ebbe67bb439d9626288e0d8d134b99742
Instruction ID: 09b80180c4e81efaa1ca4ae285320ba3e2d76779fb5eb29b6512cd044004e331
Opcode Fuzzy Hash: f7be8261870349b504cd864e7767b78ebbe67bb439d9626288e0d8d134b99742
Instruction Fuzzy Hash: D5213935209201EFC714DF29E851AA677F5FF89320F25565AE87AA73E0DB30A804CB60

Function 00E798FE Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 67COMMON

Download Yara Rule

APIs

Part of subcall function 00E2D17C: CreateWindowExW.USER32(?,?,?,?,?,?,?,?,?,?,00000000,00000096), ref: 00E2D1BA
Part of subcall function 00E2D17C: GetStockObject.GDI32(00000011), ref: 00E2D1CE
Part of subcall function 00E2D17C: SendMessageW.USER32(00000000,00000030,00000000), ref: 00E2D1D8

GetWindowRect.USER32(00000000,?), ref: 00E79968
GetSysColor.USER32(00000012), ref: 00E79982

Strings

static, xrefs: 00E79945

Memory Dump Source

Source File: 00000000.00000002.1262750966.0000000000E11000.00000020.00000001.01000000.00000003.sdmp, Offset: 00E10000, based on PE: true

Associated: 00000000.00000002.1262729095.0000000000E10000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1262808979.0000000000E9D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1262808979.0000000000EBE000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1262857687.0000000000ECA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1262878803.0000000000ED4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1262878803.0000000000F07000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_e10000_18112024_Dokman_1 Kas_m 2024- Avans_T24-2112184_dekont.jbxd

Similarity

API ID: Window$ColorCreateMessageObjectRectSendStock
String ID: static
API String ID: 1983116058-2160076837
Opcode ID: 43c0a2153d20fa8618e0eb51b4787faae65a8ac810ba7a0d2ea6390c53acf72f
Instruction ID: d5e3b2303c45b5d71cef0e69d7d595a266ef889efa0e6118be59360fb13ffc35
Opcode Fuzzy Hash: 43c0a2153d20fa8618e0eb51b4787faae65a8ac810ba7a0d2ea6390c53acf72f
Instruction Fuzzy Hash: B1115972514209AFEB04DFB8CC45EEA7BB8FF48314F015619FA59E2251D734E810DB50

Function 00E79617 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 64windowCOMMON

Download Yara Rule

APIs

GetWindowTextLengthW.USER32(00000000), ref: 00E79699
SendMessageW.USER32(?,000000B1,00000000,00000000), ref: 00E796A8

Strings

edit, xrefs: 00E7967D

Memory Dump Source

Source File: 00000000.00000002.1262750966.0000000000E11000.00000020.00000001.01000000.00000003.sdmp, Offset: 00E10000, based on PE: true

Associated: 00000000.00000002.1262729095.0000000000E10000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1262808979.0000000000E9D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1262808979.0000000000EBE000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1262857687.0000000000ECA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1262878803.0000000000ED4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1262878803.0000000000F07000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_e10000_18112024_Dokman_1 Kas_m 2024- Avans_T24-2112184_dekont.jbxd

Similarity

API ID: LengthMessageSendTextWindow
String ID: edit
API String ID: 2978978980-2167791130
Opcode ID: 11722ed17df3ea3ae4fa2a26f3a16e8828389087f09fed832e327c876f234b6c
Instruction ID: 7f2c0371f445a901bb506048e3a207938c4034d10fd74fb6fe4cb1d6f0b1411a
Opcode Fuzzy Hash: 11722ed17df3ea3ae4fa2a26f3a16e8828389087f09fed832e327c876f234b6c
Instruction Fuzzy Hash: 6A116A71100208AEEB105FA4DC44AEB3B6AEF05378F10A315F969A71E1C731EC5197A0

Function 00E55262 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 62windowCOMMON

Download Yara Rule

APIs

_memset.LIBCMT ref: 00E552D5
GetMenuItemInfoW.USER32(00000030,?,00000000,00000030), ref: 00E552F4

Strings

0, xrefs: 00E552CE

Memory Dump Source

Source File: 00000000.00000002.1262750966.0000000000E11000.00000020.00000001.01000000.00000003.sdmp, Offset: 00E10000, based on PE: true

Associated: 00000000.00000002.1262729095.0000000000E10000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1262808979.0000000000E9D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1262808979.0000000000EBE000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1262857687.0000000000ECA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1262878803.0000000000ED4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1262878803.0000000000F07000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_e10000_18112024_Dokman_1 Kas_m 2024- Avans_T24-2112184_dekont.jbxd

Similarity

API ID: InfoItemMenu_memset
String ID: 0
API String ID: 2223754486-4108050209
Opcode ID: d3a9e5255f4822ed76efed7f1ce2e3aa28c0d5d990022863d0e3c8f83dc900c2
Instruction ID: 244b649199d480a29c24086836f787cb134d5545beeae4af1e5f7f2d3f101dba
Opcode Fuzzy Hash: d3a9e5255f4822ed76efed7f1ce2e3aa28c0d5d990022863d0e3c8f83dc900c2
Instruction Fuzzy Hash: 6211D077A01714ABDB20DB99E914B9977B8AB05759F041426ED05B72B4D3B0AD0CC790

Function 00E64D9F Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 61networkCOMMON

Download Yara Rule

APIs

InternetOpenW.WININET(?,00000000,00000000,00000000,00000000), ref: 00E64DF5
InternetSetOptionW.WININET(00000000,00000032,?,00000008), ref: 00E64E1E

Strings

<local>, xrefs: 00E64DE6

Memory Dump Source

Source File: 00000000.00000002.1262750966.0000000000E11000.00000020.00000001.01000000.00000003.sdmp, Offset: 00E10000, based on PE: true

Associated: 00000000.00000002.1262729095.0000000000E10000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1262808979.0000000000E9D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1262808979.0000000000EBE000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1262857687.0000000000ECA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1262878803.0000000000ED4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1262878803.0000000000F07000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_e10000_18112024_Dokman_1 Kas_m 2024- Avans_T24-2112184_dekont.jbxd

Similarity

API ID: Internet$OpenOption
String ID: <local>
API String ID: 942729171-4266983199
Opcode ID: 10679db9295fc60e53fc365bce22c9c6ce0967120f23dd1e2319c9acde03287c
Instruction ID: 9b0ccb73473fd0665c43483bf39af00c7024066b7d0b37eb37602f1d72fd987c
Opcode Fuzzy Hash: 10679db9295fc60e53fc365bce22c9c6ce0967120f23dd1e2319c9acde03287c
Instruction Fuzzy Hash: 8D119EF1941221BADB258B619C88EEBFBA8FB06799F10A22BF515A6180D2705944C6E0

Function 00E3A70C Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 59COMMONLIBRARYCODE

Download Yara Rule

APIs

IsProcessorFeaturePresent.KERNEL32(00000017), ref: 00E437A7
___raise_securityfailure.LIBCMT ref: 00E4388E

Strings

(, xrefs: 00E43889

Memory Dump Source

Source File: 00000000.00000002.1262750966.0000000000E11000.00000020.00000001.01000000.00000003.sdmp, Offset: 00E10000, based on PE: true

Associated: 00000000.00000002.1262729095.0000000000E10000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1262808979.0000000000E9D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1262808979.0000000000EBE000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1262857687.0000000000ECA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1262878803.0000000000ED4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1262878803.0000000000F07000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_e10000_18112024_Dokman_1 Kas_m 2024- Avans_T24-2112184_dekont.jbxd

Similarity

API ID: FeaturePresentProcessor___raise_securityfailure
String ID: (
API String ID: 3761405300-2982846942
Opcode ID: c0ad1a235c1ec5637344697e517e6683bd3abca631e3b988f4009fed7c28640c
Instruction ID: 00fdea3f9aabc1c0c984a6206f4964102eab82fb5790d6500559b32d5df0f301
Opcode Fuzzy Hash: c0ad1a235c1ec5637344697e517e6683bd3abca631e3b988f4009fed7c28640c
Instruction Fuzzy Hash: BB21E4B5502204DFDB00DF66FA857453BF5FB48318F18582BE905AA3A1E3B1A989CF46

Function 00E6A82C Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 52networkCOMMON

Download Yara Rule

APIs

inet_addr.WSOCK32(00000000), ref: 00E6A84E
htons.WSOCK32(00000000), ref: 00E6A88B

Strings

255.255.255.255, xrefs: 00E6A866

Memory Dump Source

Source File: 00000000.00000002.1262750966.0000000000E11000.00000020.00000001.01000000.00000003.sdmp, Offset: 00E10000, based on PE: true

Associated: 00000000.00000002.1262729095.0000000000E10000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1262808979.0000000000E9D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1262808979.0000000000EBE000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1262857687.0000000000ECA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1262878803.0000000000ED4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1262878803.0000000000F07000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_e10000_18112024_Dokman_1 Kas_m 2024- Avans_T24-2112184_dekont.jbxd

Similarity

API ID: htonsinet_addr
String ID: 255.255.255.255
API String ID: 3832099526-2422070025
Opcode ID: 02736fa97fc8e39b600cbdf1e588783bba7081684564160683e0116f362ed557
Instruction ID: ad22d87df82b05512d030ffefca6cccc468109f1e7f5408974bc4f1a09cb490e
Opcode Fuzzy Hash: 02736fa97fc8e39b600cbdf1e588783bba7081684564160683e0116f362ed557
Instruction Fuzzy Hash: C5012634640304ABCB249F68E88AFEDB7A4EF44354F24A427F516B72D1C731E805CB52

Function 00E4B781 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 51windowCOMMON

Download Yara Rule

APIs

SendMessageW.USER32(?,000001A2,000000FF,?), ref: 00E4B7EF

Strings

ComboBox, xrefs: 00E4B78B
ListBox, xrefs: 00E4B7B9

Memory Dump Source

Source File: 00000000.00000002.1262750966.0000000000E11000.00000020.00000001.01000000.00000003.sdmp, Offset: 00E10000, based on PE: true

Associated: 00000000.00000002.1262729095.0000000000E10000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1262808979.0000000000E9D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1262808979.0000000000EBE000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1262857687.0000000000ECA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1262878803.0000000000ED4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1262878803.0000000000F07000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_e10000_18112024_Dokman_1 Kas_m 2024- Avans_T24-2112184_dekont.jbxd

Similarity

API ID: MessageSend
String ID: ComboBox$ListBox
API String ID: 3850602802-1403004172
Opcode ID: 60214152a9d56af63ce1f23facc9fdf936a606ada5af4cc5f26c4477b5fee859
Instruction ID: 2cef47bc0244542b8cb0e2b472c7f1e939d310d32890da2bfc9af2f62ff3fe5c
Opcode Fuzzy Hash: 60214152a9d56af63ce1f23facc9fdf936a606ada5af4cc5f26c4477b5fee859
Instruction Fuzzy Hash: BE01D471644214ABCB08EBA4DC52EFE33B9BF45354B14261DF472B72D2EF7499098790

Function 00E4B67D Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 49windowCOMMON

Download Yara Rule

APIs

SendMessageW.USER32(?,00000180,00000000,?), ref: 00E4B6EB

Strings

ComboBox, xrefs: 00E4B687
ListBox, xrefs: 00E4B6B5

Memory Dump Source

Source File: 00000000.00000002.1262750966.0000000000E11000.00000020.00000001.01000000.00000003.sdmp, Offset: 00E10000, based on PE: true

Associated: 00000000.00000002.1262729095.0000000000E10000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1262808979.0000000000E9D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1262808979.0000000000EBE000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1262857687.0000000000ECA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1262878803.0000000000ED4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1262878803.0000000000F07000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_e10000_18112024_Dokman_1 Kas_m 2024- Avans_T24-2112184_dekont.jbxd

Similarity

API ID: MessageSend
String ID: ComboBox$ListBox
API String ID: 3850602802-1403004172
Opcode ID: f0109394f13e72acb0997df073bda9a1d9e06e0f49c60f3ca0f394b4d17d0e7b
Instruction ID: b1c163ac754961a90534072fe6adc5fbcb70271416ada139f819d4186da407c9
Opcode Fuzzy Hash: f0109394f13e72acb0997df073bda9a1d9e06e0f49c60f3ca0f394b4d17d0e7b
Instruction Fuzzy Hash: D7018B71681108ABCB04EBA4DA52FFE73F89B05344B20202DB502B3282EB549E198BA5

Function 00E4B700 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 48windowCOMMON

Download Yara Rule

APIs

SendMessageW.USER32(?,00000182,?,00000000), ref: 00E4B76C

Strings

ComboBox, xrefs: 00E4B70A
ListBox, xrefs: 00E4B738

Memory Dump Source

Source File: 00000000.00000002.1262750966.0000000000E11000.00000020.00000001.01000000.00000003.sdmp, Offset: 00E10000, based on PE: true

Associated: 00000000.00000002.1262729095.0000000000E10000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1262808979.0000000000E9D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1262808979.0000000000EBE000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1262857687.0000000000ECA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1262878803.0000000000ED4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1262878803.0000000000F07000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_e10000_18112024_Dokman_1 Kas_m 2024- Avans_T24-2112184_dekont.jbxd

Similarity

API ID: MessageSend
String ID: ComboBox$ListBox
API String ID: 3850602802-1403004172
Opcode ID: 8e82d90503318e0f1f04bda6136f1106a374977a651b3bc8ad236e0c2fbd5699
Instruction ID: 5c97ca2b17090e6d7691a8d9385e0541a7583e7d5771d7d76d0feb95d25691f3
Opcode Fuzzy Hash: 8e82d90503318e0f1f04bda6136f1106a374977a651b3bc8ad236e0c2fbd5699
Instruction Fuzzy Hash: BD01D671680104BBCB04E7A4DE02FFE73EC9B05344F20211EB402F3192DB649E1987B5

Function 00E34D7C Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 45COMMON

Download Yara Rule

APIs

__calloc_crt.LIBCMT ref: 00E34D9E
__calloc_crt.LIBCMT ref: 00E34DB7

Strings

", xrefs: 00E34DCE

Memory Dump Source

Source File: 00000000.00000002.1262750966.0000000000E11000.00000020.00000001.01000000.00000003.sdmp, Offset: 00E10000, based on PE: true

Associated: 00000000.00000002.1262729095.0000000000E10000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1262808979.0000000000E9D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1262808979.0000000000EBE000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1262857687.0000000000ECA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1262878803.0000000000ED4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1262878803.0000000000F07000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_e10000_18112024_Dokman_1 Kas_m 2024- Avans_T24-2112184_dekont.jbxd

Similarity

API ID: __calloc_crt
String ID: "
API String ID: 3494438863-357034475
Opcode ID: 90f6761110ddc3b899fa855ba1d2a26970ce839cc468f7e96c6e9e50d3cf2e65
Instruction ID: c3faca731cb0dd44d819d1c2c7e1c3a0fb0ef7701ed6780b347c6aa6e2c9882b
Opcode Fuzzy Hash: 90f6761110ddc3b899fa855ba1d2a26970ce839cc468f7e96c6e9e50d3cf2e65
Instruction Fuzzy Hash: D8F0FCB120A6015EE7149F2ABC45BA66FE4F754764F54512FF300FA1E4E731D881C794

Function 00E14024 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 38COMMON

Download Yara Rule

APIs

LoadImageW.USER32(00E10000,00000063,00000001,00000010,00000010,00000000), ref: 00E14048
EnumResourceNamesW.KERNEL32(00000000,0000000E,00E567E9,00000063,00000000,75A50280,?,?,00E13EE1,?,?,000000FF), ref: 00E841B3

Strings

>, xrefs: 00E14028

Memory Dump Source

Source File: 00000000.00000002.1262750966.0000000000E11000.00000020.00000001.01000000.00000003.sdmp, Offset: 00E10000, based on PE: true

Associated: 00000000.00000002.1262729095.0000000000E10000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1262808979.0000000000E9D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1262808979.0000000000EBE000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1262857687.0000000000ECA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1262878803.0000000000ED4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1262878803.0000000000F07000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_e10000_18112024_Dokman_1 Kas_m 2024- Avans_T24-2112184_dekont.jbxd

Similarity

API ID: EnumImageLoadNamesResource
String ID: >
API String ID: 1578290342-260571596
Opcode ID: 3d91ca615b2475c3edb65a3181ff3a5d09629c2183af4b369d2165fef13606ff
Instruction ID: 0b06dd68195ed287ea9d5d3291d4bb27678a71101faa3b7ced2ea92ad51f2370
Opcode Fuzzy Hash: 3d91ca615b2475c3edb65a3181ff3a5d09629c2183af4b369d2165fef13606ff
Instruction Fuzzy Hash: 78F01D71742365BBE7205B1BBC4AFD33BA9E749BB5F10054BF614BA1E0D2E094888B90

Function 00E57744 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 28COMMON

Download Yara Rule

APIs

GetClassNameW.USER32(?,?,00000100), ref: 00E57762
_wcscmp.LIBCMT ref: 00E57774

Strings

#32770, xrefs: 00E5776E

Memory Dump Source

Source File: 00000000.00000002.1262750966.0000000000E11000.00000020.00000001.01000000.00000003.sdmp, Offset: 00E10000, based on PE: true

Associated: 00000000.00000002.1262729095.0000000000E10000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1262808979.0000000000E9D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1262808979.0000000000EBE000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1262857687.0000000000ECA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1262878803.0000000000ED4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1262878803.0000000000F07000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_e10000_18112024_Dokman_1 Kas_m 2024- Avans_T24-2112184_dekont.jbxd

Similarity

API ID: ClassName_wcscmp
String ID: #32770
API String ID: 2292705959-463685578
Opcode ID: a7cd7e5f3917bae15814904b4ce45457ab3cf83a916a5b49428fc4e740bd79af
Instruction ID: 3b332734ee0a3c7696f7b48b1b1c79f2701e534243be90f9f2c5e750202b3320
Opcode Fuzzy Hash: a7cd7e5f3917bae15814904b4ce45457ab3cf83a916a5b49428fc4e740bd79af
Instruction Fuzzy Hash: 96E092776043242BD710EBA6AC09E87FBACEB95764F00005BB915F3041D670A60587E0

Function 00E4A631 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 22windowCOMMON

Download Yara Rule

APIs

MessageBoxW.USER32(00000000,Error allocating memory.,AutoIt,00000010), ref: 00E4A63F

Part of subcall function 00E313F1: _doexit.LIBCMT ref: 00E313FB

Strings

Error allocating memory., xrefs: 00E4A638
AutoIt, xrefs: 00E4A633

Memory Dump Source

Source File: 00000000.00000002.1262750966.0000000000E11000.00000020.00000001.01000000.00000003.sdmp, Offset: 00E10000, based on PE: true

Associated: 00000000.00000002.1262729095.0000000000E10000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1262808979.0000000000E9D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1262808979.0000000000EBE000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1262857687.0000000000ECA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1262878803.0000000000ED4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1262878803.0000000000F07000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_e10000_18112024_Dokman_1 Kas_m 2024- Avans_T24-2112184_dekont.jbxd

Similarity

API ID: Message_doexit
String ID: AutoIt$Error allocating memory.
API String ID: 1993061046-4017498283
Opcode ID: dc1760f874551186be074835b273ad920fc1aa28ab24238a00d4ed95d599244f
Instruction ID: cac64672322fd74143e8fffbe14ae7c4a60c29c311e553d45f07b2a5a9d25af2
Opcode Fuzzy Hash: dc1760f874551186be074835b273ad920fc1aa28ab24238a00d4ed95d599244f
Instruction Fuzzy Hash: B8D05B323C432837D21436997D1BFC575CC8F59B65F05506BFB08B65C249E2D99041E9

Function 00E8AE86 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 21COMMON

Download Yara Rule

APIs

GetSystemDirectoryW.KERNEL32(?), ref: 00E8ACC0
FreeLibrary.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,?,00000104), ref: 00E8AEBD

Strings

WIN_XPe, xrefs: 00E8ACD3

Memory Dump Source

Source File: 00000000.00000002.1262750966.0000000000E11000.00000020.00000001.01000000.00000003.sdmp, Offset: 00E10000, based on PE: true

Associated: 00000000.00000002.1262729095.0000000000E10000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1262808979.0000000000E9D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1262808979.0000000000EBE000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1262857687.0000000000ECA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1262878803.0000000000ED4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1262878803.0000000000F07000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_e10000_18112024_Dokman_1 Kas_m 2024- Avans_T24-2112184_dekont.jbxd

Similarity

API ID: DirectoryFreeLibrarySystem
String ID: WIN_XPe
API String ID: 510247158-3257408948
Opcode ID: 68322c409c37b7a4e9f5f9b69816aff19b937365d54e63e80196bd1bc21cec68
Instruction ID: 294ed3cace50d03c6f71d78366678755e83bf40db17f3ddb4c0f4c138d4eba08
Opcode Fuzzy Hash: 68322c409c37b7a4e9f5f9b69816aff19b937365d54e63e80196bd1bc21cec68
Instruction Fuzzy Hash: F3E0E571C04559DFDB11EBA5ED449ECF7B8AB58301F189097E11AB2260DB705A84DF31

Function 00E786CC Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 15windowCOMMON

Download Yara Rule

APIs

FindWindowW.USER32(Shell_TrayWnd,00000000), ref: 00E786E2
PostMessageW.USER32(00000000), ref: 00E786E9

Part of subcall function 00E57A58: Sleep.KERNEL32(?,00000000,?,?,?,?,?,?,?,?,?), ref: 00E57AD0

Strings

Shell_TrayWnd, xrefs: 00E786DB

Memory Dump Source

Source File: 00000000.00000002.1262750966.0000000000E11000.00000020.00000001.01000000.00000003.sdmp, Offset: 00E10000, based on PE: true

Associated: 00000000.00000002.1262729095.0000000000E10000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1262808979.0000000000E9D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1262808979.0000000000EBE000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1262857687.0000000000ECA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1262878803.0000000000ED4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1262878803.0000000000F07000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_e10000_18112024_Dokman_1 Kas_m 2024- Avans_T24-2112184_dekont.jbxd

Similarity

API ID: FindMessagePostSleepWindow
String ID: Shell_TrayWnd
API String ID: 529655941-2988720461
Opcode ID: 00b934d07dff1da3b856e800717b84d1e0c609bc4023f13cf4698ea44c553e20
Instruction ID: 8af231e62a2b85f888d8807b16e4ab49db27c7056fa61d75cdd25c9b8dc0e1ae
Opcode Fuzzy Hash: 00b934d07dff1da3b856e800717b84d1e0c609bc4023f13cf4698ea44c553e20
Instruction Fuzzy Hash: 57D0A931388324ABE2246330AC0BFC62A089B04B21F00080BB646BA0C1C8A0A9048714

Function 00E78698 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 15windowCOMMON

Download Yara Rule

APIs

FindWindowW.USER32(Shell_TrayWnd,00000000), ref: 00E786A2
PostMessageW.USER32(00000000,00000111,00000197,00000000), ref: 00E786B5

Part of subcall function 00E57A58: Sleep.KERNEL32(?,00000000,?,?,?,?,?,?,?,?,?), ref: 00E57AD0

Strings

Shell_TrayWnd, xrefs: 00E7869B

Memory Dump Source

Source File: 00000000.00000002.1262750966.0000000000E11000.00000020.00000001.01000000.00000003.sdmp, Offset: 00E10000, based on PE: true

Associated: 00000000.00000002.1262729095.0000000000E10000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1262808979.0000000000E9D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1262808979.0000000000EBE000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1262857687.0000000000ECA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1262878803.0000000000ED4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1262878803.0000000000F07000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_e10000_18112024_Dokman_1 Kas_m 2024- Avans_T24-2112184_dekont.jbxd

Similarity

API ID: FindMessagePostSleepWindow
String ID: Shell_TrayWnd
API String ID: 529655941-2988720461
Opcode ID: e5151084298a3ce3a654da4e36a63a3b743c75015f64a251f131635319ba1e83
Instruction ID: 5735316f2717bb5c65381c1b533d979fb56aa76b38181f717fe7e8f6a8bd8846
Opcode Fuzzy Hash: e5151084298a3ce3a654da4e36a63a3b743c75015f64a251f131635319ba1e83
Instruction Fuzzy Hash: 3CD02231388324BBE3247330AC0BFC63A089B00B21F00080BB74ABA0C1C8E0E904C710

Description:	Adversaries may obtain and abuse credentials of existing accounts as a means of gaining Initial Access, Persistence, Privilege Escalation, or Defense Evasion. Compromised credentials may be used to bypass access controls placed on various resources on systems within the network and may even be used for persistent access to remote systems and externally available services, such as VPNs, Outlook Web Access, network devices, and remote desktop.Compromised credentials may also grant an adversary increased privilege to specific systems or access to restricted areas of the network. Adversaries may choose not to use malware or tools in conjunction with the legitimate access those credentials provide to make it harder to detect their presence.
Tactics:	Defense Evasion, Initial Access, Persistence, Privilege Escalation
Data Sources:	Logon Session: Logon Session Creation, Logon Session: Logon Session Metadata, User Account: User Account Authentication
Platforms:	Azure AD, Containers, Google Workspace, IaaS, Linux, macOS, Network, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse Windows Management Instrumentation (WMI) to execute malicious commands and payloads. WMI is an administration feature that provides a uniform environment to access Windows system components. The WMI service enables both local and remote access, though the latter is facilitated by Remote Services such as Distributed Component Object Model (DCOM) and Windows Remote Management (WinRM).Remote WMI over DCOM operates using port 135, whereas WMI over WinRM operates over port 5985 when using HTTP and 5986 for HTTPS.
Tactics:	Execution
Data Sources:	Command: Command Execution, Network Traffic: Network Connection Creation, Process: Process Creation, WMI: WMI Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may interact with the native OS application programming interface (API) to execute behaviors. Native APIs provide a controlled means of calling low-level OS services within the kernel, such as those involving hardware/devices, memory, and processes.These native APIs are leveraged by the OS during system boot (when other system components are not yet initialized) as well as carrying out tasks and requests during routine operations.
Tactics:	Execution
Data Sources:	Module: Module Load, Process: OS API Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may execute their own malicious payloads by side-loading DLLs. Similar to DLL Search Order Hijacking , side-loading involves hijacking which DLL a program loads. But rather than just planting the DLL within the search order of a program then waiting for the victim application to be invoked, adversaries may directly side-load their payloads by planting then invoking a legitimate application that executes their payload(s).
Tactics:	Defense Evasion, Persistence, Privilege Escalation
Data Sources:	File: File Creation, File: File Modification, Module: Module Load, Process: Process Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may exploit software vulnerabilities in an attempt to elevate privileges. Exploitation of a software vulnerability occurs when an adversary takes advantage of a programming error in a program, service, or within the operating system software or kernel itself to execute adversary-controlled code. Security constructs such as permission levels will often hinder access to information and use of certain techniques, so adversaries will likely need to perform privilege escalation to include use of software exploitation to circumvent those restrictions.
Tactics:	Privilege Escalation
Data Sources:	Driver: Driver Load, Process: Process Creation
Platforms:	Containers, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may modify access tokens to operate under a different user or system security context to perform actions and bypass access controls. Windows uses access tokens to determine the ownership of a running process. A user can manipulate access tokens to make a running process appear as though it is the child of a different process or belongs to someone other than the user that started the process. When this occurs, the process also takes on the security context associated with the new token.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	Active Directory: Active Directory Object Modification, Command: Command Execution, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, User Account: User Account Metadata
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	File: File Metadata, File: File Modification, Module: Module Load, Process: OS API Execution, Process: Process Access, Process: Process Metadata, Process: Process Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may modify and/or disable security tools to avoid possible detection of their malware/tools and activities. This may take many forms, such as killing security software processes or services, modifying / deleting Registry keys or configuration files so that tools do not operate properly, or other methods to interfere with security tools scanning or reporting information. Adversaries may also disable updates to prevent the latest security patches from reaching tools on victim systems.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, Driver: Driver Load, Process: Process Creation, Process: Process Termination, Sensor Health: Host Status, Service: Service Metadata, Windows Registry: Windows Registry Key Deletion, Windows Registry: Windows Registry Key Modification
Platforms:	Containers, IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use Obfuscated Files or Information to hide artifacts of an intrusion from analysis. They may require separate mechanisms to decode or deobfuscate that information depending on how they intend to use it. Methods for doing that include built-in functionality of malware or by using utilities present on the system.
Tactics:	Defense Evasion
Data Sources:	File: File Modification, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit. This is common behavior that can be used across different platforms and the network to evade defenses.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Creation, File: File Metadata, Module: Module Load, Process: OS API Execution, Process: Process Creation, Script: Script Execution, WMI: WMI Creation, Windows Registry: Windows Registry Key Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ various means to detect and avoid virtualization and analysis environments. This may include changing behaviors based on the results of checks for the presence of artifacts indicative of a virtual machine environment (VME) or sandbox. If the adversary detects a VME, they may alter their malware to disengage from the victim or conceal the core functions of the implant. They may also search for VME artifacts before dropping secondary or additional payloads. Adversaries may use the information learned from [Virtualization/Sandbox Evasion](https://attack.mitre.org/techniques/T1497) during automated discovery to shape follow-on behaviors.
Tactics:	Defense Evasion, Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to dump credentials to obtain account login and credential material, normally in the form of a hash or a clear text password, from the operating system and software. Credentials can then be used to perform Lateral Movement and access restricted information.
Tactics:	Credential Access
Data Sources:	Active Directory: Active Directory Object Access, Command: Command Execution, File: File Access, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow, Process: OS API Execution, Process: Process Access, Process: Process Creation, Windows Registry: Windows Registry Key Access
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use methods of capturing user input to obtain credentials or collect information. During normal system usage, users often provide credentials to various different locations, such as login pages/portals or system dialog boxes. Input capture mechanisms may be transparent to the user (e.g. Credential API Hooking ) or rely on deceiving the user into providing input into what they believe to be a genuine service (e.g. Web Portal Capture ).
Tactics:	Collection, Credential Access
Data Sources:	Driver: Driver Load, File: File Modification, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, Windows Registry: Windows Registry Key Modification
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may search the Registry on compromised systems for insecurely stored credentials. The Windows Registry stores configuration information that can be used by the system or other programs. Adversaries may query the Registry looking for credentials and passwords that have been stored for use by other programs or services. Sometimes these credentials are used for automatic logons.
Tactics:	Credential Access
Data Sources:	Command: Command Execution, Process: Process Creation, Windows Registry: Windows Registry Key Access
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	An adversary may gather the system time and/or time zone from a local or remote system. The system time is set and stored by the Windows Time Service within a domain to maintain time synchronization between systems and services in an enterprise network.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of valid accounts, usernames, or email addresses on a system or within a compromised environment. This information can help adversaries determine which accounts exist, which can aid in follow-on behavior such as brute-forcing, spear-phishing attacks, or account takeovers (e.g., Valid Accounts ).
Tactics:	Discovery
Data Sources:	Command: Command Execution, File: File Access, Process: Process Creation
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may enumerate files and directories or may search in specific locations of a host or network share for certain information within a file system. Adversaries may use the information from File and Directory Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get information about running processes on a system. Information obtained could be used to gain an understanding of common software/applications running on systems within the network. Adversaries may use the information from Process Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to identify the primary user, currently logged in user, set of users that commonly uses a system, or whether a user is actively using the system. They may do this, for example, by retrieving account usernames or by using OS Credential Dumping . The information may be collected in a number of different ways using other Discovery techniques, because user and username details are prevalent throughout a system and include running process ownership, file/directory ownership, session information, and system logs. Adversaries may use the information from [System Owner/User Discovery](https://attack.mitre.org/techniques/T1033) during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Active Directory: Active Directory Object Access, Command: Command Execution, File: File Access, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow, Process: OS API Execution, Process: Process Access, Process: Process Creation, Windows Registry: Windows Registry Key Access
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report 18112024_Dokman_1 Kas_m 2024- Avans_T24-2112184_dekont.exe

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Threat Intel

Malware Configuration

Threatname: Agenttesla

Yara Signatures

Memory Dumps

Unpacked PEs

Sigma Signatures

System Summary

Suricata Signatures

Joe Sandbox Signatures

AV Detection

Compliance

Spreading

Networking

Key, Mouse, Clipboard, Microphone and Screen Capturing

System Summary

Data Obfuscation

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

Anti Debugging

HIPS / PFW / Operating System Protection Evasion

Language, Device and Operating System Detection

Stealing of Sensitive Information

Remote Access Functionality

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

General Information

Warnings

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

C:\Users\user\AppData\Local\Temp\aut745C.tmp

C:\Users\user\AppData\Local\Temp\overfertilize

Static File Info

General

File Icon

Static PE Info

General

Entrypoint Preview

Rich Headers

Data Directories

Sections

Resources

Imports

Possible Origin

Network Behavior

Network Port Distribution

Windows Analysis Report
18112024_Dokman_1 Kas_m 2024- Avans_T24-2112184_dekont.exe

Function 00E3B043 Relevance: 21.5, APIs: 14, Instructions: 537
COMMONLIBRARYCODE

Function 00E13D19 Relevance: 19.4, APIs: 8, Strings: 3, Instructions: 151
windowCOMMON

Function 00E2DDC0 Relevance: 10.7, APIs: 7, Instructions: 175
COMMON

Function 00E1406B Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 61
COMMON

Function 00E5FA0C Relevance: 26.5, APIs: 13, Strings: 2, Instructions: 238
COMMON

Function 00E13F53 Relevance: 19.3, APIs: 7, Strings: 4, Instructions: 53
windowregistryCOMMON

Function 00E5BFA4 Relevance: 18.3, APIs: 12, Instructions: 316
fileCOMMON

Function 00E13742 Relevance: 15.9, APIs: 8, Strings: 1, Instructions: 151
windowtimeregistryCOMMON

Function 00E13E6E Relevance: 15.8, APIs: 6, Strings: 3, Instructions: 66
windowregistryCOMMON

Function 00E3ACB3 Relevance: 15.2, APIs: 10, Instructions: 219
COMMON

Function 011163F8 Relevance: 10.7, APIs: 7, Instructions: 239
fileCOMMON

Function 00E149FB Relevance: 10.6, APIs: 4, Strings: 2, Instructions: 73
registryCOMMON

Function 00E136B8 Relevance: 10.5, APIs: 4, Strings: 2, Instructions: 44
COMMON

Function 01116178 Relevance: 8.9, APIs: 4, Strings: 1, Instructions: 163
fileCOMMON

Description:	An adversary may compress and/or encrypt data that is collected prior to exfiltration. Compressing the data can help to obfuscate the collected data and minimize the amount of data sent over the network. Encryption can be used to hide information that is being exfiltrated from detection or make exfiltration less conspicuous upon inspection by a defender.
Tactics:	Collection
Data Sources:	Command: Command Execution, File: File Creation, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may search local system sources, such as file systems and configuration files or local databases, to find files of interest and sensitive data prior to Exfiltration.
Tactics:	Collection
Data Sources:	Command: Command Execution, File: File Access, Process: OS API Execution, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may target user email to collect sensitive information. Emails may contain sensitive data, including trade secrets or personal information, that can prove valuable to adversaries. Adversaries can collect or forward email from mail servers or clients.
Tactics:	Collection
Data Sources:	Application Log: Application Log Content, Command: Command Execution, File: File Access, Logon Session: Logon Session Creation, Network Traffic: Network Connection Creation
Platforms:	Google Workspace, Linux, macOS, Office 365, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may collect data stored in the clipboard from users copying information within or between applications.
Tactics:	Collection
Data Sources:	Command: Command Execution, Process: OS API Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may transfer tools or other files from an external system into a compromised environment. Tools or files may be copied from an external adversary-controlled system to the victim network through the command and control channel or through alternate protocols such as ftp . Once present, adversaries may also transfer/spread tools between victim devices within a compromised environment (i.e. Lateral Tool Transfer ).
Tactics:	Command and Control
Data Sources:	Command: Command Execution, File: File Creation, Network Traffic: Network Connection Creation, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ a known encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Despite the use of a secure algorithm, these implementations may be vulnerable to reverse engineering if secret keys are encoded and/or generated within malware samples/configuration files.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using a protocol and port pairing that are typically not associated. For example, HTTPS over port 8088or port 587as opposed to the traditional port 443. Adversaries may make changes to the standard port used by a protocol to bypass filtering or muddle analysis/parsing of network data.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use an OSI non-application layer protocol for communication between host and C2 server or among infected hosts within a network. The list of possible protocols is extensive.Specific examples include use of network layer protocols, such as the Internet Control Message Protocol (ICMP), transport layer protocols, such as the User Datagram Protocol (UDP), session layer protocols, such as Socket Secure (SOCKS), as well as redirected/tunneled protocols, such as Serial over LAN (SOL).
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using OSI application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may shutdown/reboot systems to interrupt access to, or aid in the destruction of, those systems. Operating systems may contain commands to initiate a shutdown/reboot of a machine or network device. In some cases, these commands may also be used to initiate a shutdown/reboot of a remote computer or network device via Network Device CLI (e.g. `reload` ).
Tactics:	Impact
Data Sources:	Command: Command Execution, Process: Process Creation, Sensor Health: Host Status
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre