Edit tour

Windows Analysis Report
OC & PL.exe

Overview

General Information

Sample name:	OC & PL.exe
Analysis ID:	1559981
MD5:	c6a534ee57dee61cb20b631d697a6a09
SHA1:	e9f122b4daf12299d0a55e6e51801b386063ed61
SHA256:	ad4cfc06bad357de4ab58c9c01bc2e7015fd1944e35a206ef8b053611119f04f
Tags:	exeuser-lowmal3
Infos:

Detection

AgentTesla

Score:	100
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

Found malware configuration

Icon mismatch, binary includes an icon from a different legit application in order to fool users

Multi AV Scanner detection for submitted file

Yara detected AgentTesla

AI detected suspicious sample

Binary is likely a compiled AutoIt script file

Contains functionality to log keystrokes (.Net Source)

Machine Learning detection for sample

Maps a DLL or memory area into another process

Queries sensitive network adapter information (via WMI, Win32_NetworkAdapter, often done to detect virtual machines)

Sample uses string decryption to hide its real strings

Switches to a custom stack to bypass stack traces

Tries to detect sandboxes and other dynamic analysis tools (process name or module or function)

Tries to harvest and steal Putty / WinSCP information (sessions, passwords, etc)

Tries to harvest and steal browser information (history, passwords, etc)

Tries to harvest and steal ftp login credentials

Tries to steal Mail credentials (via file / registry access)

Writes to foreign memory regions

Contains functionality for read data from the clipboard

Contains functionality to block mouse and keyboard input (often used to hinder debugging)

Contains functionality to check if a debugger is running (IsDebuggerPresent)

Contains functionality to check if a debugger is running (OutputDebugString,GetLastError)

Contains functionality to check if a window is minimized (may be used to check if an application is visible)

Contains functionality to communicate with device drivers

Contains functionality to dynamically determine API calls

Contains functionality to execute programs as a different user

Contains functionality to launch a process as a different user

Contains functionality to launch a program with higher privileges

Contains functionality to modify clipboard data

Contains functionality to open a port and listen for incoming connection (possibly a backdoor)

Contains functionality to query CPU information (cpuid)

Contains functionality to read the PEB

Contains functionality to read the clipboard data

Contains functionality to retrieve information about pressed keystrokes

Contains functionality to shutdown / reboot the system

Contains functionality to simulate keystroke presses

Contains functionality to simulate mouse events

Contains functionality which may be used to detect a debugger (GetProcessHeap)

Contains long sleeps (>= 3 min)

Creates a process in suspended mode (likely to inject code)

Detected TCP or UDP traffic on non-standard ports

Detected potential crypto function

Extensive use of GetProcAddress (often used to hide API calls)

Found a high number of Window / User specific system calls (may be a loop to detect user behavior)

Found evaded block containing many API calls

Found evasive API chain (date check)

Found large amount of non-executed APIs

Found potential string decryption / allocating functions

IP address seen in connection with other malware

Internet Provider seen in connection with other malware

OS version to string mapping found (often used in BOTs)

Queries sensitive BIOS Information (via WMI, Win32_Bios & Win32_BaseBoard, often done to detect virtual machines)

Queries sensitive processor information (via WMI, Win32_Processor, often done to detect virtual machines)

Queries the volume information (name, serial number etc) of a device

Sample file is different than original file name gathered from version info

Sigma detected: Suspicious Outbound SMTP Connections

Uses 32bit PE files

Uses SMTP (mail sending)

Uses code obfuscation techniques (call, push, ret)

Yara detected Credential Stealer

Classification

Process Tree

System is w10x64

OC & PL.exe (PID: 816 cmdline: "C:\Users\user\Desktop\OC & PL.exe" MD5: C6A534EE57DEE61CB20B631D697A6A09)

RegSvcs.exe (PID: 6400 cmdline: "C:\Users\user\Desktop\OC & PL.exe" MD5: 9D352BC46709F0CB5EC974633A0C3C94)

cleanup

Malware Threat Intel

Provided by

Name	Description	Attribution	Blogpost URLs	Link
Agent Tesla, AgentTesla	A .NET based information stealer readily available to actors due to leaked builders. The malware is able to log keystrokes, can access the host's clipboard and crawls the disk for credentials or other valuable information. It has the capability to send information back to its C&C via HTTP(S), SMTP, FTP, or towards a Telegram channel.	SWEED	http://blog.nsfocus.net/sweed-611/ http://l1v1ngc0d3.wordpress.com/2021/11/12/agenttesla-dropped-via-nsis-installer/ http://ropgadget.com/posts/originlogger.html http://www.secureworks.com/research/threat-profiles/gold-galleon https://0xmrmagnezi.github.io/malware%20analysis/AgentTesla/	https://malpedia.caad.fkie.fraunhofer.de/details/win.agent_tesla

Malware Configuration

Threatname: Agenttesla

{"Exfil Mode": "SMTP", "Host": "mail.agaliofu.top", "Username": "egooyibo@agaliofu.top", "Password": "QPS.6YYl.Yi=                          "}

Yara Signatures

Memory Dumps

Source	Rule	Description	Author
00000000.00000002.1281202457.0000000000670000.00000004.00001000.00020000.00000000.sdmp	JoeSecurity_AgentTesla_2	Yara detected AgentTesla	Joe Security
00000005.00000002.2505480865.0000000002B83000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
00000005.00000002.2505480865.0000000002B57000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
00000005.00000002.2502890497.0000000000402000.00000040.80000000.00040000.00000000.sdmp	JoeSecurity_AgentTesla_2	Yara detected AgentTesla	Joe Security
00000005.00000002.2505480865.0000000002B01000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
00000005.00000002.2505480865.0000000002B01000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
Process Memory Space: RegSvcs.exe PID: 6400	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
Process Memory Space: RegSvcs.exe PID: 6400	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
decrypted.memstr	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
decrypted.memstr	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
Click to see the 5 entries

Unpacked PEs

Source	Rule	Description	Author
0.2.OC & PL.exe.670000.0.unpack	JoeSecurity_AgentTesla_2	Yara detected AgentTesla	Joe Security
0.2.OC & PL.exe.670000.0.raw.unpack	JoeSecurity_AgentTesla_2	Yara detected AgentTesla	Joe Security
5.2.RegSvcs.exe.400000.0.unpack	JoeSecurity_AgentTesla_2	Yara detected AgentTesla	Joe Security

Sigma Signatures

System Summary

Sigma detected: Suspicious Outbound SMTP Connections

Source: Network Connection

Author: frack113: Data: DestinationIp: 194.36.191.196, DestinationIsIpv6: false, DestinationPort: 587, EventID: 3, Image: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe, Initiated: true, ProcessId: 6400, Protocol: tcp, SourceIp: 192.168.2.7, SourceIsIpv6: false, SourcePort: 49701

Suricata Signatures

⊘No Suricata rule has matched

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

AV Detection

Found malware configuration

Source: 5.2.RegSvcs.exe.400000.0.unpack

Malware Configuration Extractor: Agenttesla {"Exfil Mode": "SMTP", "Host": "mail.agaliofu.top", "Username": "egooyibo@agaliofu.top", "Password": "QPS.6YYl.Yi= "}

Multi AV Scanner detection for submitted file

Source: OC & PL.exe

ReversingLabs: Detection: 55%

AI detected suspicious sample

Source: Submited Sample

Integrated Neural Analysis Model: Matched 100.0% probability

Machine Learning detection for sample

Source: OC & PL.exe

Joe Sandbox ML: detected

Sample uses string decryption to hide its real strings

Source: 5.2.RegSvcs.exe.400000.0.unpack	String decryptor: /log.tmp
Source: 5.2.RegSvcs.exe.400000.0.unpack	String decryptor: <br>[
Source: 5.2.RegSvcs.exe.400000.0.unpack	String decryptor: yyyy-MM-dd HH:mm:ss
Source: 5.2.RegSvcs.exe.400000.0.unpack	String decryptor: ]<br>
Source: 5.2.RegSvcs.exe.400000.0.unpack	String decryptor: <br>
Source: 5.2.RegSvcs.exe.400000.0.unpack	String decryptor: Time:
Source: 5.2.RegSvcs.exe.400000.0.unpack	String decryptor: MM/dd/yyyy HH:mm:ss
Source: 5.2.RegSvcs.exe.400000.0.unpack	String decryptor: <br>User Name:
Source: 5.2.RegSvcs.exe.400000.0.unpack	String decryptor: <br>Computer Name:
Source: 5.2.RegSvcs.exe.400000.0.unpack	String decryptor: <br>OSFullName:
Source: 5.2.RegSvcs.exe.400000.0.unpack	String decryptor: <br>CPU:
Source: 5.2.RegSvcs.exe.400000.0.unpack	String decryptor: <br>RAM:
Source: 5.2.RegSvcs.exe.400000.0.unpack	String decryptor: <br>
Source: 5.2.RegSvcs.exe.400000.0.unpack	String decryptor: IP Address:
Source: 5.2.RegSvcs.exe.400000.0.unpack	String decryptor: <br>
Source: 5.2.RegSvcs.exe.400000.0.unpack	String decryptor: <hr>
Source: 5.2.RegSvcs.exe.400000.0.unpack	String decryptor: New
Source: 5.2.RegSvcs.exe.400000.0.unpack	String decryptor: MM/dd/yyyy HH:mm:ss
Source: 5.2.RegSvcs.exe.400000.0.unpack	String decryptor: IP Address:
Source: 5.2.RegSvcs.exe.400000.0.unpack	String decryptor: false
Source: 5.2.RegSvcs.exe.400000.0.unpack	String decryptor: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:99.0) Gecko/20100101 Firefox/99.0
Source: 5.2.RegSvcs.exe.400000.0.unpack	String decryptor: false
Source: 5.2.RegSvcs.exe.400000.0.unpack	String decryptor: false
Source: 5.2.RegSvcs.exe.400000.0.unpack	String decryptor: false
Source: 5.2.RegSvcs.exe.400000.0.unpack	String decryptor: false
Source: 5.2.RegSvcs.exe.400000.0.unpack	String decryptor: false
Source: 5.2.RegSvcs.exe.400000.0.unpack	String decryptor: false
Source: 5.2.RegSvcs.exe.400000.0.unpack	String decryptor: true
Source: 5.2.RegSvcs.exe.400000.0.unpack	String decryptor: false
Source: 5.2.RegSvcs.exe.400000.0.unpack	String decryptor: mail.agaliofu.top
Source: 5.2.RegSvcs.exe.400000.0.unpack	String decryptor: egooyibo@agaliofu.top
Source: 5.2.RegSvcs.exe.400000.0.unpack	String decryptor: QPS.6YYl.Yi=
Source: 5.2.RegSvcs.exe.400000.0.unpack	String decryptor: egooyibo@agaliofu.top
Source: 5.2.RegSvcs.exe.400000.0.unpack	String decryptor: false
Source: 5.2.RegSvcs.exe.400000.0.unpack	String decryptor: false
Source: 5.2.RegSvcs.exe.400000.0.unpack	String decryptor: appdata
Source: 5.2.RegSvcs.exe.400000.0.unpack	String decryptor: MBecZ
Source: 5.2.RegSvcs.exe.400000.0.unpack	String decryptor: MBecZ.exe
Source: 5.2.RegSvcs.exe.400000.0.unpack	String decryptor: MBecZ
Source: 5.2.RegSvcs.exe.400000.0.unpack	String decryptor: true
Source: 5.2.RegSvcs.exe.400000.0.unpack	String decryptor: Type
Source: 5.2.RegSvcs.exe.400000.0.unpack	String decryptor: \drivers\etc\hosts
Source: 5.2.RegSvcs.exe.400000.0.unpack	String decryptor: <br>
Source: 5.2.RegSvcs.exe.400000.0.unpack	String decryptor: <hr>
Source: 5.2.RegSvcs.exe.400000.0.unpack	String decryptor: <br>
Source: 5.2.RegSvcs.exe.400000.0.unpack	String decryptor: <b>[
Source: 5.2.RegSvcs.exe.400000.0.unpack	String decryptor: ]</b> (
Source: 5.2.RegSvcs.exe.400000.0.unpack	String decryptor: )<br>
Source: 5.2.RegSvcs.exe.400000.0.unpack	String decryptor: {BACK}
Source: 5.2.RegSvcs.exe.400000.0.unpack	String decryptor: {ALT+TAB}
Source: 5.2.RegSvcs.exe.400000.0.unpack	String decryptor: {ALT+F4}
Source: 5.2.RegSvcs.exe.400000.0.unpack	String decryptor: {TAB}
Source: 5.2.RegSvcs.exe.400000.0.unpack	String decryptor: {ESC}
Source: 5.2.RegSvcs.exe.400000.0.unpack	String decryptor: {Win}
Source: 5.2.RegSvcs.exe.400000.0.unpack	String decryptor: {CAPSLOCK}
Source: 5.2.RegSvcs.exe.400000.0.unpack	String decryptor: {KEYUP}
Source: 5.2.RegSvcs.exe.400000.0.unpack	String decryptor: {KEYDOWN}
Source: 5.2.RegSvcs.exe.400000.0.unpack	String decryptor: {KEYLEFT}
Source: 5.2.RegSvcs.exe.400000.0.unpack	String decryptor: {KEYRIGHT}
Source: 5.2.RegSvcs.exe.400000.0.unpack	String decryptor: {DEL}
Source: 5.2.RegSvcs.exe.400000.0.unpack	String decryptor: {END}
Source: 5.2.RegSvcs.exe.400000.0.unpack	String decryptor: {HOME}
Source: 5.2.RegSvcs.exe.400000.0.unpack	String decryptor: {Insert}
Source: 5.2.RegSvcs.exe.400000.0.unpack	String decryptor: {NumLock}
Source: 5.2.RegSvcs.exe.400000.0.unpack	String decryptor: {PageDown}
Source: 5.2.RegSvcs.exe.400000.0.unpack	String decryptor: {PageUp}
Source: 5.2.RegSvcs.exe.400000.0.unpack	String decryptor: {ENTER}
Source: 5.2.RegSvcs.exe.400000.0.unpack	String decryptor: {F1}
Source: 5.2.RegSvcs.exe.400000.0.unpack	String decryptor: {F2}
Source: 5.2.RegSvcs.exe.400000.0.unpack	String decryptor: {F3}
Source: 5.2.RegSvcs.exe.400000.0.unpack	String decryptor: {F4}
Source: 5.2.RegSvcs.exe.400000.0.unpack	String decryptor: {F5}
Source: 5.2.RegSvcs.exe.400000.0.unpack	String decryptor: {F6}
Source: 5.2.RegSvcs.exe.400000.0.unpack	String decryptor: {F7}
Source: 5.2.RegSvcs.exe.400000.0.unpack	String decryptor: {F8}
Source: 5.2.RegSvcs.exe.400000.0.unpack	String decryptor: {F9}
Source: 5.2.RegSvcs.exe.400000.0.unpack	String decryptor: {F10}
Source: 5.2.RegSvcs.exe.400000.0.unpack	String decryptor: {F11}
Source: 5.2.RegSvcs.exe.400000.0.unpack	String decryptor: {F12}
Source: 5.2.RegSvcs.exe.400000.0.unpack	String decryptor: control
Source: 5.2.RegSvcs.exe.400000.0.unpack	String decryptor: {CTRL}
Source: 5.2.RegSvcs.exe.400000.0.unpack	String decryptor: &
Source: 5.2.RegSvcs.exe.400000.0.unpack	String decryptor: <
Source: 5.2.RegSvcs.exe.400000.0.unpack	String decryptor: >
Source: 5.2.RegSvcs.exe.400000.0.unpack	String decryptor: "
Source: 5.2.RegSvcs.exe.400000.0.unpack	String decryptor: <br><hr>Copied Text: <br>
Source: 5.2.RegSvcs.exe.400000.0.unpack	String decryptor: <hr>
Source: 5.2.RegSvcs.exe.400000.0.unpack	String decryptor: logins
Source: 5.2.RegSvcs.exe.400000.0.unpack	String decryptor: IE/Edge
Source: 5.2.RegSvcs.exe.400000.0.unpack	String decryptor: 2F1A6504-0641-44CF-8BB5-3612D865F2E5
Source: 5.2.RegSvcs.exe.400000.0.unpack	String decryptor: Windows Secure Note
Source: 5.2.RegSvcs.exe.400000.0.unpack	String decryptor: 3CCD5499-87A8-4B10-A215-608888DD3B55
Source: 5.2.RegSvcs.exe.400000.0.unpack	String decryptor: Windows Web Password Credential
Source: 5.2.RegSvcs.exe.400000.0.unpack	String decryptor: 154E23D0-C644-4E6F-8CE6-5069272F999F
Source: 5.2.RegSvcs.exe.400000.0.unpack	String decryptor: Windows Credential Picker Protector
Source: 5.2.RegSvcs.exe.400000.0.unpack	String decryptor: 4BF4C442-9B8A-41A0-B380-DD4A704DDB28
Source: 5.2.RegSvcs.exe.400000.0.unpack	String decryptor: Web Credentials
Source: 5.2.RegSvcs.exe.400000.0.unpack	String decryptor: 77BC582B-F0A6-4E15-4E80-61736B6F3B29
Source: 5.2.RegSvcs.exe.400000.0.unpack	String decryptor: Windows Credentials
Source: 5.2.RegSvcs.exe.400000.0.unpack	String decryptor: E69D7838-91B5-4FC9-89D5-230D4D4CC2BC
Source: 5.2.RegSvcs.exe.400000.0.unpack	String decryptor: Windows Domain Certificate Credential
Source: 5.2.RegSvcs.exe.400000.0.unpack	String decryptor: 3E0E35BE-1B77-43E7-B873-AED901B6275B
Source: 5.2.RegSvcs.exe.400000.0.unpack	String decryptor: Windows Domain Password Credential
Source: 5.2.RegSvcs.exe.400000.0.unpack	String decryptor: 3C886FF3-2669-4AA2-A8FB-3F6759A77548
Source: 5.2.RegSvcs.exe.400000.0.unpack	String decryptor: Windows Extended Credential
Source: 5.2.RegSvcs.exe.400000.0.unpack	String decryptor: 00000000-0000-0000-0000-000000000000
Source: 5.2.RegSvcs.exe.400000.0.unpack	String decryptor: SchemaId
Source: 5.2.RegSvcs.exe.400000.0.unpack	String decryptor: pResourceElement
Source: 5.2.RegSvcs.exe.400000.0.unpack	String decryptor: pIdentityElement
Source: 5.2.RegSvcs.exe.400000.0.unpack	String decryptor: pPackageSid
Source: 5.2.RegSvcs.exe.400000.0.unpack	String decryptor: pAuthenticatorElement
Source: 5.2.RegSvcs.exe.400000.0.unpack	String decryptor: IE/Edge
Source: 5.2.RegSvcs.exe.400000.0.unpack	String decryptor: UC Browser
Source: 5.2.RegSvcs.exe.400000.0.unpack	String decryptor: UCBrowser\
Source: 5.2.RegSvcs.exe.400000.0.unpack	String decryptor: Login Data
Source: 5.2.RegSvcs.exe.400000.0.unpack	String decryptor: journal
Source: 5.2.RegSvcs.exe.400000.0.unpack	String decryptor: wow_logins
Source: 5.2.RegSvcs.exe.400000.0.unpack	String decryptor: Safari for Windows
Source: 5.2.RegSvcs.exe.400000.0.unpack	String decryptor: \Common Files\Apple\Apple Application Support\plutil.exe
Source: 5.2.RegSvcs.exe.400000.0.unpack	String decryptor: \Apple Computer\Preferences\keychain.plist
Source: 5.2.RegSvcs.exe.400000.0.unpack	String decryptor: <array>
Source: 5.2.RegSvcs.exe.400000.0.unpack	String decryptor: <dict>
Source: 5.2.RegSvcs.exe.400000.0.unpack	String decryptor: <string>
Source: 5.2.RegSvcs.exe.400000.0.unpack	String decryptor: </string>
Source: 5.2.RegSvcs.exe.400000.0.unpack	String decryptor: <string>
Source: 5.2.RegSvcs.exe.400000.0.unpack	String decryptor: </string>
Source: 5.2.RegSvcs.exe.400000.0.unpack	String decryptor: <data>
Source: 5.2.RegSvcs.exe.400000.0.unpack	String decryptor: </data>
Source: 5.2.RegSvcs.exe.400000.0.unpack	String decryptor: -convert xml1 -s -o "
Source: 5.2.RegSvcs.exe.400000.0.unpack	String decryptor: \fixed_keychain.xml"
Source: 5.2.RegSvcs.exe.400000.0.unpack	String decryptor: \Microsoft\Credentials\
Source: 5.2.RegSvcs.exe.400000.0.unpack	String decryptor: \Microsoft\Credentials\
Source: 5.2.RegSvcs.exe.400000.0.unpack	String decryptor: \Microsoft\Credentials\
Source: 5.2.RegSvcs.exe.400000.0.unpack	String decryptor: \Microsoft\Credentials\
Source: 5.2.RegSvcs.exe.400000.0.unpack	String decryptor: \Microsoft\Protect\
Source: 5.2.RegSvcs.exe.400000.0.unpack	String decryptor: credential
Source: 5.2.RegSvcs.exe.400000.0.unpack	String decryptor: QQ Browser
Source: 5.2.RegSvcs.exe.400000.0.unpack	String decryptor: Tencent\QQBrowser\User Data
Source: 5.2.RegSvcs.exe.400000.0.unpack	String decryptor: \Default\EncryptedStorage
Source: 5.2.RegSvcs.exe.400000.0.unpack	String decryptor: Profile
Source: 5.2.RegSvcs.exe.400000.0.unpack	String decryptor: \EncryptedStorage
Source: 5.2.RegSvcs.exe.400000.0.unpack	String decryptor: entries
Source: 5.2.RegSvcs.exe.400000.0.unpack	String decryptor: category
Source: 5.2.RegSvcs.exe.400000.0.unpack	String decryptor: Password
Source: 5.2.RegSvcs.exe.400000.0.unpack	String decryptor: str3
Source: 5.2.RegSvcs.exe.400000.0.unpack	String decryptor: str2
Source: 5.2.RegSvcs.exe.400000.0.unpack	String decryptor: blob0
Source: 5.2.RegSvcs.exe.400000.0.unpack	String decryptor: password_value
Source: 5.2.RegSvcs.exe.400000.0.unpack	String decryptor: IncrediMail
Source: 5.2.RegSvcs.exe.400000.0.unpack	String decryptor: PopPassword
Source: 5.2.RegSvcs.exe.400000.0.unpack	String decryptor: SmtpPassword
Source: 5.2.RegSvcs.exe.400000.0.unpack	String decryptor: Software\IncrediMail\Identities\
Source: 5.2.RegSvcs.exe.400000.0.unpack	String decryptor: \Accounts_New
Source: 5.2.RegSvcs.exe.400000.0.unpack	String decryptor: PopPassword
Source: 5.2.RegSvcs.exe.400000.0.unpack	String decryptor: SmtpPassword
Source: 5.2.RegSvcs.exe.400000.0.unpack	String decryptor: SmtpServer
Source: 5.2.RegSvcs.exe.400000.0.unpack	String decryptor: EmailAddress
Source: 5.2.RegSvcs.exe.400000.0.unpack	String decryptor: Eudora
Source: 5.2.RegSvcs.exe.400000.0.unpack	String decryptor: Software\Qualcomm\Eudora\CommandLine\
Source: 5.2.RegSvcs.exe.400000.0.unpack	String decryptor: current
Source: 5.2.RegSvcs.exe.400000.0.unpack	String decryptor: Settings
Source: 5.2.RegSvcs.exe.400000.0.unpack	String decryptor: SavePasswordText
Source: 5.2.RegSvcs.exe.400000.0.unpack	String decryptor: Settings
Source: 5.2.RegSvcs.exe.400000.0.unpack	String decryptor: ReturnAddress
Source: 5.2.RegSvcs.exe.400000.0.unpack	String decryptor: Falkon Browser
Source: 5.2.RegSvcs.exe.400000.0.unpack	String decryptor: \falkon\profiles\
Source: 5.2.RegSvcs.exe.400000.0.unpack	String decryptor: profiles.ini
Source: 5.2.RegSvcs.exe.400000.0.unpack	String decryptor: startProfile=([A-z0-9\/\.\"]+)
Source: 5.2.RegSvcs.exe.400000.0.unpack	String decryptor: profiles.ini
Source: 5.2.RegSvcs.exe.400000.0.unpack	String decryptor: \browsedata.db
Source: 5.2.RegSvcs.exe.400000.0.unpack	String decryptor: autofill
Source: 5.2.RegSvcs.exe.400000.0.unpack	String decryptor: ClawsMail
Source: 5.2.RegSvcs.exe.400000.0.unpack	String decryptor: \Claws-mail
Source: 5.2.RegSvcs.exe.400000.0.unpack	String decryptor: \clawsrc
Source: 5.2.RegSvcs.exe.400000.0.unpack	String decryptor: \clawsrc
Source: 5.2.RegSvcs.exe.400000.0.unpack	String decryptor: passkey0
Source: 5.2.RegSvcs.exe.400000.0.unpack	String decryptor: master_passphrase_salt=(.+)
Source: 5.2.RegSvcs.exe.400000.0.unpack	String decryptor: master_passphrase_pbkdf2_rounds=(.+)
Source: 5.2.RegSvcs.exe.400000.0.unpack	String decryptor: \accountrc
Source: 5.2.RegSvcs.exe.400000.0.unpack	String decryptor: smtp_server
Source: 5.2.RegSvcs.exe.400000.0.unpack	String decryptor: address
Source: 5.2.RegSvcs.exe.400000.0.unpack	String decryptor: account
Source: 5.2.RegSvcs.exe.400000.0.unpack	String decryptor: \passwordstorerc
Source: 5.2.RegSvcs.exe.400000.0.unpack	String decryptor: {(.),(.)}(.*)
Source: 5.2.RegSvcs.exe.400000.0.unpack	String decryptor: Flock Browser
Source: 5.2.RegSvcs.exe.400000.0.unpack	String decryptor: APPDATA
Source: 5.2.RegSvcs.exe.400000.0.unpack	String decryptor: \Flock\Browser\
Source: 5.2.RegSvcs.exe.400000.0.unpack	String decryptor: signons3.txt
Source: 5.2.RegSvcs.exe.400000.0.unpack	String decryptor: DynDns
Source: 5.2.RegSvcs.exe.400000.0.unpack	String decryptor: ALLUSERSPROFILE
Source: 5.2.RegSvcs.exe.400000.0.unpack	String decryptor: Dyn\Updater\config.dyndns
Source: 5.2.RegSvcs.exe.400000.0.unpack	String decryptor: username=
Source: 5.2.RegSvcs.exe.400000.0.unpack	String decryptor: password=
Source: 5.2.RegSvcs.exe.400000.0.unpack	String decryptor: https://account.dyn.com/
Source: 5.2.RegSvcs.exe.400000.0.unpack	String decryptor: t6KzXhCh
Source: 5.2.RegSvcs.exe.400000.0.unpack	String decryptor: ALLUSERSPROFILE
Source: 5.2.RegSvcs.exe.400000.0.unpack	String decryptor: Dyn\Updater\daemon.cfg
Source: 5.2.RegSvcs.exe.400000.0.unpack	String decryptor: global
Source: 5.2.RegSvcs.exe.400000.0.unpack	String decryptor: accounts
Source: 5.2.RegSvcs.exe.400000.0.unpack	String decryptor: account.
Source: 5.2.RegSvcs.exe.400000.0.unpack	String decryptor: username
Source: 5.2.RegSvcs.exe.400000.0.unpack	String decryptor: account.
Source: 5.2.RegSvcs.exe.400000.0.unpack	String decryptor: password
Source: 5.2.RegSvcs.exe.400000.0.unpack	String decryptor: Psi/Psi+
Source: 5.2.RegSvcs.exe.400000.0.unpack	String decryptor: name
Source: 5.2.RegSvcs.exe.400000.0.unpack	String decryptor: password
Source: 5.2.RegSvcs.exe.400000.0.unpack	String decryptor: Psi/Psi+
Source: 5.2.RegSvcs.exe.400000.0.unpack	String decryptor: APPDATA
Source: 5.2.RegSvcs.exe.400000.0.unpack	String decryptor: \Psi\profiles
Source: 5.2.RegSvcs.exe.400000.0.unpack	String decryptor: APPDATA
Source: 5.2.RegSvcs.exe.400000.0.unpack	String decryptor: \Psi+\profiles
Source: 5.2.RegSvcs.exe.400000.0.unpack	String decryptor: \accounts.xml
Source: 5.2.RegSvcs.exe.400000.0.unpack	String decryptor: \accounts.xml
Source: 5.2.RegSvcs.exe.400000.0.unpack	String decryptor: OpenVPN
Source: 5.2.RegSvcs.exe.400000.0.unpack	String decryptor: Software\OpenVPN-GUI\configs
Source: 5.2.RegSvcs.exe.400000.0.unpack	String decryptor: Software\OpenVPN-GUI\configs
Source: 5.2.RegSvcs.exe.400000.0.unpack	String decryptor: Software\OpenVPN-GUI\configs\
Source: 5.2.RegSvcs.exe.400000.0.unpack	String decryptor: username
Source: 5.2.RegSvcs.exe.400000.0.unpack	String decryptor: auth-data
Source: 5.2.RegSvcs.exe.400000.0.unpack	String decryptor: entropy
Source: 5.2.RegSvcs.exe.400000.0.unpack	String decryptor: USERPROFILE
Source: 5.2.RegSvcs.exe.400000.0.unpack	String decryptor: \OpenVPN\config\
Source: 5.2.RegSvcs.exe.400000.0.unpack	String decryptor: remote
Source: 5.2.RegSvcs.exe.400000.0.unpack	String decryptor: remote
Source: 5.2.RegSvcs.exe.400000.0.unpack	String decryptor: NordVPN
Source: 5.2.RegSvcs.exe.400000.0.unpack	String decryptor: NordVPN
Source: 5.2.RegSvcs.exe.400000.0.unpack	String decryptor: NordVpn.exe*
Source: 5.2.RegSvcs.exe.400000.0.unpack	String decryptor: user.config
Source: 5.2.RegSvcs.exe.400000.0.unpack	String decryptor: //setting[@name='Username']/value
Source: 5.2.RegSvcs.exe.400000.0.unpack	String decryptor: //setting[@name='Password']/value
Source: 5.2.RegSvcs.exe.400000.0.unpack	String decryptor: NordVPN
Source: 5.2.RegSvcs.exe.400000.0.unpack	String decryptor: Private Internet Access
Source: 5.2.RegSvcs.exe.400000.0.unpack	String decryptor: %ProgramW6432%
Source: 5.2.RegSvcs.exe.400000.0.unpack	String decryptor: Private Internet Access\data
Source: 5.2.RegSvcs.exe.400000.0.unpack	String decryptor: ProgramFiles(x86)
Source: 5.2.RegSvcs.exe.400000.0.unpack	String decryptor: \Private Internet Access\data
Source: 5.2.RegSvcs.exe.400000.0.unpack	String decryptor: \account.json
Source: 5.2.RegSvcs.exe.400000.0.unpack	String decryptor: ."username":"(.?)"
Source: 5.2.RegSvcs.exe.400000.0.unpack	String decryptor: ."password":"(.?)"
Source: 5.2.RegSvcs.exe.400000.0.unpack	String decryptor: Private Internet Access
Source: 5.2.RegSvcs.exe.400000.0.unpack	String decryptor: privateinternetaccess.com
Source: 5.2.RegSvcs.exe.400000.0.unpack	String decryptor: FileZilla
Source: 5.2.RegSvcs.exe.400000.0.unpack	String decryptor: APPDATA
Source: 5.2.RegSvcs.exe.400000.0.unpack	String decryptor: \FileZilla\recentservers.xml
Source: 5.2.RegSvcs.exe.400000.0.unpack	String decryptor: APPDATA
Source: 5.2.RegSvcs.exe.400000.0.unpack	String decryptor: \FileZilla\recentservers.xml
Source: 5.2.RegSvcs.exe.400000.0.unpack	String decryptor: <Server>
Source: 5.2.RegSvcs.exe.400000.0.unpack	String decryptor: <Host>
Source: 5.2.RegSvcs.exe.400000.0.unpack	String decryptor: <Host>
Source: 5.2.RegSvcs.exe.400000.0.unpack	String decryptor: </Host>
Source: 5.2.RegSvcs.exe.400000.0.unpack	String decryptor: <Port>
Source: 5.2.RegSvcs.exe.400000.0.unpack	String decryptor: </Port>
Source: 5.2.RegSvcs.exe.400000.0.unpack	String decryptor: <User>
Source: 5.2.RegSvcs.exe.400000.0.unpack	String decryptor: <User>
Source: 5.2.RegSvcs.exe.400000.0.unpack	String decryptor: </User>
Source: 5.2.RegSvcs.exe.400000.0.unpack	String decryptor: <Pass encoding="base64">
Source: 5.2.RegSvcs.exe.400000.0.unpack	String decryptor: <Pass encoding="base64">
Source: 5.2.RegSvcs.exe.400000.0.unpack	String decryptor: </Pass>
Source: 5.2.RegSvcs.exe.400000.0.unpack	String decryptor: <Pass>
Source: 5.2.RegSvcs.exe.400000.0.unpack	String decryptor: <Pass encoding="base64">
Source: 5.2.RegSvcs.exe.400000.0.unpack	String decryptor: </Pass>
Source: 5.2.RegSvcs.exe.400000.0.unpack	String decryptor: CoreFTP
Source: 5.2.RegSvcs.exe.400000.0.unpack	String decryptor: SOFTWARE\FTPWare\COREFTP\Sites
Source: 5.2.RegSvcs.exe.400000.0.unpack	String decryptor: User
Source: 5.2.RegSvcs.exe.400000.0.unpack	String decryptor: Host
Source: 5.2.RegSvcs.exe.400000.0.unpack	String decryptor: Port
Source: 5.2.RegSvcs.exe.400000.0.unpack	String decryptor: hdfzpysvpzimorhk
Source: 5.2.RegSvcs.exe.400000.0.unpack	String decryptor: WinSCP
Source: 5.2.RegSvcs.exe.400000.0.unpack	String decryptor: SOFTWARE\Martin Prikryl\WinSCP 2\Sessions
Source: 5.2.RegSvcs.exe.400000.0.unpack	String decryptor: HostName
Source: 5.2.RegSvcs.exe.400000.0.unpack	String decryptor: UserName
Source: 5.2.RegSvcs.exe.400000.0.unpack	String decryptor: Password
Source: 5.2.RegSvcs.exe.400000.0.unpack	String decryptor: PublicKeyFile
Source: 5.2.RegSvcs.exe.400000.0.unpack	String decryptor: PortNumber
Source: 5.2.RegSvcs.exe.400000.0.unpack	String decryptor: [PRIVATE KEY LOCATION: "{0}"]
Source: 5.2.RegSvcs.exe.400000.0.unpack	String decryptor: WinSCP
Source: 5.2.RegSvcs.exe.400000.0.unpack	String decryptor: ABCDEF
Source: 5.2.RegSvcs.exe.400000.0.unpack	String decryptor: Flash FXP
Source: 5.2.RegSvcs.exe.400000.0.unpack	String decryptor: port
Source: 5.2.RegSvcs.exe.400000.0.unpack	String decryptor: user
Source: 5.2.RegSvcs.exe.400000.0.unpack	String decryptor: pass
Source: 5.2.RegSvcs.exe.400000.0.unpack	String decryptor: quick.dat
Source: 5.2.RegSvcs.exe.400000.0.unpack	String decryptor: Sites.dat
Source: 5.2.RegSvcs.exe.400000.0.unpack	String decryptor: \FlashFXP\
Source: 5.2.RegSvcs.exe.400000.0.unpack	String decryptor: \FlashFXP\
Source: 5.2.RegSvcs.exe.400000.0.unpack	String decryptor: yA36zA48dEhfrvghGRg57h5UlDv3
Source: 5.2.RegSvcs.exe.400000.0.unpack	String decryptor: FTP Navigator
Source: 5.2.RegSvcs.exe.400000.0.unpack	String decryptor: SystemDrive
Source: 5.2.RegSvcs.exe.400000.0.unpack	String decryptor: \FTP Navigator\Ftplist.txt
Source: 5.2.RegSvcs.exe.400000.0.unpack	String decryptor: Server
Source: 5.2.RegSvcs.exe.400000.0.unpack	String decryptor: Password
Source: 5.2.RegSvcs.exe.400000.0.unpack	String decryptor: No Password
Source: 5.2.RegSvcs.exe.400000.0.unpack	String decryptor: User
Source: 5.2.RegSvcs.exe.400000.0.unpack	String decryptor: SmartFTP
Source: 5.2.RegSvcs.exe.400000.0.unpack	String decryptor: APPDATA
Source: 5.2.RegSvcs.exe.400000.0.unpack	String decryptor: SmartFTP\Client 2.0\Favorites\Quick Connect
Source: 5.2.RegSvcs.exe.400000.0.unpack	String decryptor: WS_FTP
Source: 5.2.RegSvcs.exe.400000.0.unpack	String decryptor: appdata
Source: 5.2.RegSvcs.exe.400000.0.unpack	String decryptor: Ipswitch\WS_FTP\Sites\ws_ftp.ini
Source: 5.2.RegSvcs.exe.400000.0.unpack	String decryptor: HOST
Source: 5.2.RegSvcs.exe.400000.0.unpack	String decryptor: PWD=
Source: 5.2.RegSvcs.exe.400000.0.unpack	String decryptor: PWD=
Source: 5.2.RegSvcs.exe.400000.0.unpack	String decryptor: FtpCommander
Source: 5.2.RegSvcs.exe.400000.0.unpack	String decryptor: SystemDrive
Source: 5.2.RegSvcs.exe.400000.0.unpack	String decryptor: \Program Files (x86)\FTP Commander Deluxe\Ftplist.txt
Source: 5.2.RegSvcs.exe.400000.0.unpack	String decryptor: SystemDrive
Source: 5.2.RegSvcs.exe.400000.0.unpack	String decryptor: \Program Files (x86)\FTP Commander\Ftplist.txt
Source: 5.2.RegSvcs.exe.400000.0.unpack	String decryptor: SystemDrive
Source: 5.2.RegSvcs.exe.400000.0.unpack	String decryptor: \cftp\Ftplist.txt
Source: 5.2.RegSvcs.exe.400000.0.unpack	String decryptor: \VirtualStore\Program Files (x86)\FTP Commander\Ftplist.txt
Source: 5.2.RegSvcs.exe.400000.0.unpack	String decryptor: \VirtualStore\Program Files (x86)\FTP Commander Deluxe\Ftplist.txt
Source: 5.2.RegSvcs.exe.400000.0.unpack	String decryptor: ;Password=
Source: 5.2.RegSvcs.exe.400000.0.unpack	String decryptor: ;User=
Source: 5.2.RegSvcs.exe.400000.0.unpack	String decryptor: ;Server=
Source: 5.2.RegSvcs.exe.400000.0.unpack	String decryptor: ;Port=
Source: 5.2.RegSvcs.exe.400000.0.unpack	String decryptor: ;Port=
Source: 5.2.RegSvcs.exe.400000.0.unpack	String decryptor: ;Password=
Source: 5.2.RegSvcs.exe.400000.0.unpack	String decryptor: ;User=
Source: 5.2.RegSvcs.exe.400000.0.unpack	String decryptor: ;Anonymous=
Source: 5.2.RegSvcs.exe.400000.0.unpack	String decryptor: FTPGetter
Source: 5.2.RegSvcs.exe.400000.0.unpack	String decryptor: \FTPGetter\servers.xml
Source: 5.2.RegSvcs.exe.400000.0.unpack	String decryptor: <server>
Source: 5.2.RegSvcs.exe.400000.0.unpack	String decryptor: <server_ip>
Source: 5.2.RegSvcs.exe.400000.0.unpack	String decryptor: <server_ip>
Source: 5.2.RegSvcs.exe.400000.0.unpack	String decryptor: </server_ip>
Source: 5.2.RegSvcs.exe.400000.0.unpack	String decryptor: <server_port>
Source: 5.2.RegSvcs.exe.400000.0.unpack	String decryptor: </server_port>
Source: 5.2.RegSvcs.exe.400000.0.unpack	String decryptor: <server_user_name>
Source: 5.2.RegSvcs.exe.400000.0.unpack	String decryptor: <server_user_name>
Source: 5.2.RegSvcs.exe.400000.0.unpack	String decryptor: </server_user_name>
Source: 5.2.RegSvcs.exe.400000.0.unpack	String decryptor: <server_user_password>
Source: 5.2.RegSvcs.exe.400000.0.unpack	String decryptor: <server_user_password>
Source: 5.2.RegSvcs.exe.400000.0.unpack	String decryptor: </server_user_password>
Source: 5.2.RegSvcs.exe.400000.0.unpack	String decryptor: FTPGetter
Source: 5.2.RegSvcs.exe.400000.0.unpack	String decryptor: The Bat!
Source: 5.2.RegSvcs.exe.400000.0.unpack	String decryptor: appdata
Source: 5.2.RegSvcs.exe.400000.0.unpack	String decryptor: \The Bat!
Source: 5.2.RegSvcs.exe.400000.0.unpack	String decryptor: \Account.CFN
Source: 5.2.RegSvcs.exe.400000.0.unpack	String decryptor: \Account.CFN
Source: 5.2.RegSvcs.exe.400000.0.unpack	String decryptor: =-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=
Source: 5.2.RegSvcs.exe.400000.0.unpack	String decryptor: +-0123456789ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz
Source: 5.2.RegSvcs.exe.400000.0.unpack	String decryptor: Becky!
Source: 5.2.RegSvcs.exe.400000.0.unpack	String decryptor: HKEY_CURRENT_USER\Software\RimArts\B2\Settings
Source: 5.2.RegSvcs.exe.400000.0.unpack	String decryptor: DataDir
Source: 5.2.RegSvcs.exe.400000.0.unpack	String decryptor: Folder.lst
Source: 5.2.RegSvcs.exe.400000.0.unpack	String decryptor: \Mailbox.ini
Source: 5.2.RegSvcs.exe.400000.0.unpack	String decryptor: Account
Source: 5.2.RegSvcs.exe.400000.0.unpack	String decryptor: PassWd
Source: 5.2.RegSvcs.exe.400000.0.unpack	String decryptor: Account
Source: 5.2.RegSvcs.exe.400000.0.unpack	String decryptor: SMTPServer
Source: 5.2.RegSvcs.exe.400000.0.unpack	String decryptor: Account
Source: 5.2.RegSvcs.exe.400000.0.unpack	String decryptor: MailAddress
Source: 5.2.RegSvcs.exe.400000.0.unpack	String decryptor: Becky!
Source: 5.2.RegSvcs.exe.400000.0.unpack	String decryptor: Outlook
Source: 5.2.RegSvcs.exe.400000.0.unpack	String decryptor: Software\Microsoft\Office\15.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676
Source: 5.2.RegSvcs.exe.400000.0.unpack	String decryptor: Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676
Source: 5.2.RegSvcs.exe.400000.0.unpack	String decryptor: Software\Microsoft\Windows Messaging Subsystem\Profiles\9375CFF0413111d3B88A00104B2A6676
Source: 5.2.RegSvcs.exe.400000.0.unpack	String decryptor: Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676
Source: 5.2.RegSvcs.exe.400000.0.unpack	String decryptor: Email
Source: 5.2.RegSvcs.exe.400000.0.unpack	String decryptor: IMAP Password
Source: 5.2.RegSvcs.exe.400000.0.unpack	String decryptor: POP3 Password
Source: 5.2.RegSvcs.exe.400000.0.unpack	String decryptor: HTTP Password
Source: 5.2.RegSvcs.exe.400000.0.unpack	String decryptor: SMTP Password
Source: 5.2.RegSvcs.exe.400000.0.unpack	String decryptor: Email
Source: 5.2.RegSvcs.exe.400000.0.unpack	String decryptor: Email
Source: 5.2.RegSvcs.exe.400000.0.unpack	String decryptor: Email
Source: 5.2.RegSvcs.exe.400000.0.unpack	String decryptor: IMAP Password
Source: 5.2.RegSvcs.exe.400000.0.unpack	String decryptor: POP3 Password
Source: 5.2.RegSvcs.exe.400000.0.unpack	String decryptor: HTTP Password
Source: 5.2.RegSvcs.exe.400000.0.unpack	String decryptor: SMTP Password
Source: 5.2.RegSvcs.exe.400000.0.unpack	String decryptor: Server
Source: 5.2.RegSvcs.exe.400000.0.unpack	String decryptor: Windows Mail App
Source: 5.2.RegSvcs.exe.400000.0.unpack	String decryptor: COMPlus_legacyCorruptedStateExceptionsPolicy
Source: 5.2.RegSvcs.exe.400000.0.unpack	String decryptor: Software\Microsoft\ActiveSync\Partners
Source: 5.2.RegSvcs.exe.400000.0.unpack	String decryptor: Email
Source: 5.2.RegSvcs.exe.400000.0.unpack	String decryptor: Server
Source: 5.2.RegSvcs.exe.400000.0.unpack	String decryptor: SchemaId
Source: 5.2.RegSvcs.exe.400000.0.unpack	String decryptor: pResourceElement
Source: 5.2.RegSvcs.exe.400000.0.unpack	String decryptor: pIdentityElement
Source: 5.2.RegSvcs.exe.400000.0.unpack	String decryptor: pPackageSid
Source: 5.2.RegSvcs.exe.400000.0.unpack	String decryptor: pAuthenticatorElement
Source: 5.2.RegSvcs.exe.400000.0.unpack	String decryptor: syncpassword
Source: 5.2.RegSvcs.exe.400000.0.unpack	String decryptor: mailoutgoing
Source: 5.2.RegSvcs.exe.400000.0.unpack	String decryptor: FoxMail
Source: 5.2.RegSvcs.exe.400000.0.unpack	String decryptor: HKEY_CURRENT_USER\Software\Aerofox\FoxmailPreview
Source: 5.2.RegSvcs.exe.400000.0.unpack	String decryptor: Executable
Source: 5.2.RegSvcs.exe.400000.0.unpack	String decryptor: HKEY_CURRENT_USER\Software\Aerofox\Foxmail\V3.1
Source: 5.2.RegSvcs.exe.400000.0.unpack	String decryptor: FoxmailPath
Source: 5.2.RegSvcs.exe.400000.0.unpack	String decryptor: \Storage\
Source: 5.2.RegSvcs.exe.400000.0.unpack	String decryptor: \Storage\
Source: 5.2.RegSvcs.exe.400000.0.unpack	String decryptor: \mail
Source: 5.2.RegSvcs.exe.400000.0.unpack	String decryptor: \mail
Source: 5.2.RegSvcs.exe.400000.0.unpack	String decryptor: \VirtualStore\Program Files\Foxmail\mail
Source: 5.2.RegSvcs.exe.400000.0.unpack	String decryptor: \VirtualStore\Program Files\Foxmail\mail
Source: 5.2.RegSvcs.exe.400000.0.unpack	String decryptor: \VirtualStore\Program Files (x86)\Foxmail\mail
Source: 5.2.RegSvcs.exe.400000.0.unpack	String decryptor: \VirtualStore\Program Files (x86)\Foxmail\mail
Source: 5.2.RegSvcs.exe.400000.0.unpack	String decryptor: \Accounts\Account.rec0
Source: 5.2.RegSvcs.exe.400000.0.unpack	String decryptor: \Accounts\Account.rec0
Source: 5.2.RegSvcs.exe.400000.0.unpack	String decryptor: \Account.stg
Source: 5.2.RegSvcs.exe.400000.0.unpack	String decryptor: \Account.stg
Source: 5.2.RegSvcs.exe.400000.0.unpack	String decryptor: POP3Host
Source: 5.2.RegSvcs.exe.400000.0.unpack	String decryptor: SMTPHost
Source: 5.2.RegSvcs.exe.400000.0.unpack	String decryptor: IncomingServer
Source: 5.2.RegSvcs.exe.400000.0.unpack	String decryptor: Account
Source: 5.2.RegSvcs.exe.400000.0.unpack	String decryptor: MailAddress
Source: 5.2.RegSvcs.exe.400000.0.unpack	String decryptor: Password
Source: 5.2.RegSvcs.exe.400000.0.unpack	String decryptor: POP3Password
Source: 5.2.RegSvcs.exe.400000.0.unpack	String decryptor: Opera Mail
Source: 5.2.RegSvcs.exe.400000.0.unpack	String decryptor: \Opera Mail\Opera Mail\wand.dat
Source: 5.2.RegSvcs.exe.400000.0.unpack	String decryptor: \Opera Mail\Opera Mail\wand.dat
Source: 5.2.RegSvcs.exe.400000.0.unpack	String decryptor: opera:
Source: 5.2.RegSvcs.exe.400000.0.unpack	String decryptor: abcdefghijklmnopqrstuvwxyz1234567890_-.~!@#$%^&*()[{]}\\|';:,<>/?+=
Source: 5.2.RegSvcs.exe.400000.0.unpack	String decryptor: PocoMail
Source: 5.2.RegSvcs.exe.400000.0.unpack	String decryptor: appdata
Source: 5.2.RegSvcs.exe.400000.0.unpack	String decryptor: \Pocomail\accounts.ini
Source: 5.2.RegSvcs.exe.400000.0.unpack	String decryptor: Email
Source: 5.2.RegSvcs.exe.400000.0.unpack	String decryptor: POPPass
Source: 5.2.RegSvcs.exe.400000.0.unpack	String decryptor: SMTPPass
Source: 5.2.RegSvcs.exe.400000.0.unpack	String decryptor: SMTP
Source: 5.2.RegSvcs.exe.400000.0.unpack	String decryptor: eM Client
Source: 5.2.RegSvcs.exe.400000.0.unpack	String decryptor: eM Client\accounts.dat
Source: 5.2.RegSvcs.exe.400000.0.unpack	String decryptor: eM Client
Source: 5.2.RegSvcs.exe.400000.0.unpack	String decryptor: Accounts
Source: 5.2.RegSvcs.exe.400000.0.unpack	String decryptor: "Username":"
Source: 5.2.RegSvcs.exe.400000.0.unpack	String decryptor: "Secret":"
Source: 5.2.RegSvcs.exe.400000.0.unpack	String decryptor: 72905C47-F4FD-4CF7-A489-4E8121A155BD
Source: 5.2.RegSvcs.exe.400000.0.unpack	String decryptor: "ProviderName":"
Source: 5.2.RegSvcs.exe.400000.0.unpack	String decryptor: o6806642kbM7c5
Source: 5.2.RegSvcs.exe.400000.0.unpack	String decryptor: Mailbird
Source: 5.2.RegSvcs.exe.400000.0.unpack	String decryptor: SenderIdentities
Source: 5.2.RegSvcs.exe.400000.0.unpack	String decryptor: Accounts
Source: 5.2.RegSvcs.exe.400000.0.unpack	String decryptor: \Mailbird\Store\Store.db
Source: 5.2.RegSvcs.exe.400000.0.unpack	String decryptor: Server_Host
Source: 5.2.RegSvcs.exe.400000.0.unpack	String decryptor: Accounts
Source: 5.2.RegSvcs.exe.400000.0.unpack	String decryptor: Email
Source: 5.2.RegSvcs.exe.400000.0.unpack	String decryptor: Username
Source: 5.2.RegSvcs.exe.400000.0.unpack	String decryptor: EncryptedPassword
Source: 5.2.RegSvcs.exe.400000.0.unpack	String decryptor: Mailbird
Source: 5.2.RegSvcs.exe.400000.0.unpack	String decryptor: RealVNC 4.x
Source: 5.2.RegSvcs.exe.400000.0.unpack	String decryptor: SOFTWARE\Wow6432Node\RealVNC\WinVNC4
Source: 5.2.RegSvcs.exe.400000.0.unpack	String decryptor: Password
Source: 5.2.RegSvcs.exe.400000.0.unpack	String decryptor: RealVNC 3.x
Source: 5.2.RegSvcs.exe.400000.0.unpack	String decryptor: SOFTWARE\RealVNC\vncserver
Source: 5.2.RegSvcs.exe.400000.0.unpack	String decryptor: Password
Source: 5.2.RegSvcs.exe.400000.0.unpack	String decryptor: RealVNC 4.x
Source: 5.2.RegSvcs.exe.400000.0.unpack	String decryptor: SOFTWARE\RealVNC\WinVNC4
Source: 5.2.RegSvcs.exe.400000.0.unpack	String decryptor: Password
Source: 5.2.RegSvcs.exe.400000.0.unpack	String decryptor: RealVNC 3.x
Source: 5.2.RegSvcs.exe.400000.0.unpack	String decryptor: Software\ORL\WinVNC3
Source: 5.2.RegSvcs.exe.400000.0.unpack	String decryptor: Password
Source: 5.2.RegSvcs.exe.400000.0.unpack	String decryptor: TightVNC
Source: 5.2.RegSvcs.exe.400000.0.unpack	String decryptor: Software\TightVNC\Server
Source: 5.2.RegSvcs.exe.400000.0.unpack	String decryptor: Password
Source: 5.2.RegSvcs.exe.400000.0.unpack	String decryptor: TightVNC
Source: 5.2.RegSvcs.exe.400000.0.unpack	String decryptor: Software\TightVNC\Server
Source: 5.2.RegSvcs.exe.400000.0.unpack	String decryptor: PasswordViewOnly
Source: 5.2.RegSvcs.exe.400000.0.unpack	String decryptor: TightVNC ControlPassword
Source: 5.2.RegSvcs.exe.400000.0.unpack	String decryptor: Software\TightVNC\Server
Source: 5.2.RegSvcs.exe.400000.0.unpack	String decryptor: ControlPassword
Source: 5.2.RegSvcs.exe.400000.0.unpack	String decryptor: TigerVNC
Source: 5.2.RegSvcs.exe.400000.0.unpack	String decryptor: Software\TigerVNC\Server
Source: 5.2.RegSvcs.exe.400000.0.unpack	String decryptor: Password
Source: 5.2.RegSvcs.exe.400000.0.unpack	String decryptor: UltraVNC
Source: 5.2.RegSvcs.exe.400000.0.unpack	String decryptor: ProgramFiles(x86)
Source: 5.2.RegSvcs.exe.400000.0.unpack	String decryptor: \uvnc bvba\UltraVNC\ultravnc.ini
Source: 5.2.RegSvcs.exe.400000.0.unpack	String decryptor: passwd
Source: 5.2.RegSvcs.exe.400000.0.unpack	String decryptor: UltraVNC
Source: 5.2.RegSvcs.exe.400000.0.unpack	String decryptor: ProgramFiles(x86)
Source: 5.2.RegSvcs.exe.400000.0.unpack	String decryptor: \uvnc bvba\UltraVNC\ultravnc.ini
Source: 5.2.RegSvcs.exe.400000.0.unpack	String decryptor: passwd2
Source: 5.2.RegSvcs.exe.400000.0.unpack	String decryptor: UltraVNC
Source: 5.2.RegSvcs.exe.400000.0.unpack	String decryptor: ProgramFiles
Source: 5.2.RegSvcs.exe.400000.0.unpack	String decryptor: \uvnc bvba\UltraVNC\ultravnc.ini
Source: 5.2.RegSvcs.exe.400000.0.unpack	String decryptor: passwd
Source: 5.2.RegSvcs.exe.400000.0.unpack	String decryptor: UltraVNC
Source: 5.2.RegSvcs.exe.400000.0.unpack	String decryptor: ProgramFiles
Source: 5.2.RegSvcs.exe.400000.0.unpack	String decryptor: \uvnc bvba\UltraVNC\ultravnc.ini
Source: 5.2.RegSvcs.exe.400000.0.unpack	String decryptor: passwd2
Source: 5.2.RegSvcs.exe.400000.0.unpack	String decryptor: UltraVNC
Source: 5.2.RegSvcs.exe.400000.0.unpack	String decryptor: ProgramFiles
Source: 5.2.RegSvcs.exe.400000.0.unpack	String decryptor: \UltraVNC\ultravnc.ini
Source: 5.2.RegSvcs.exe.400000.0.unpack	String decryptor: passwd
Source: 5.2.RegSvcs.exe.400000.0.unpack	String decryptor: UltraVNC
Source: 5.2.RegSvcs.exe.400000.0.unpack	String decryptor: ProgramFiles
Source: 5.2.RegSvcs.exe.400000.0.unpack	String decryptor: \UltraVNC\ultravnc.ini
Source: 5.2.RegSvcs.exe.400000.0.unpack	String decryptor: passwd2
Source: 5.2.RegSvcs.exe.400000.0.unpack	String decryptor: UltraVNC
Source: 5.2.RegSvcs.exe.400000.0.unpack	String decryptor: ProgramFiles(x86)
Source: 5.2.RegSvcs.exe.400000.0.unpack	String decryptor: \UltraVNC\ultravnc.ini
Source: 5.2.RegSvcs.exe.400000.0.unpack	String decryptor: passwd
Source: 5.2.RegSvcs.exe.400000.0.unpack	String decryptor: UltraVNC
Source: 5.2.RegSvcs.exe.400000.0.unpack	String decryptor: ProgramFiles(x86)
Source: 5.2.RegSvcs.exe.400000.0.unpack	String decryptor: \UltraVNC\ultravnc.ini
Source: 5.2.RegSvcs.exe.400000.0.unpack	String decryptor: passwd2
Source: 5.2.RegSvcs.exe.400000.0.unpack	String decryptor: JDownloader 2.0
Source: 5.2.RegSvcs.exe.400000.0.unpack	String decryptor: JDownloader 2.0\cfg
Source: 5.2.RegSvcs.exe.400000.0.unpack	String decryptor: org.jdownloader.settings.AccountSettings.accounts.ejs
Source: 5.2.RegSvcs.exe.400000.0.unpack	String decryptor: JDownloader 2.0\cfg
Source: 5.2.RegSvcs.exe.400000.0.unpack	String decryptor: jd.controlling.authentication.AuthenticationControllerSettings.list.ejs
Source: 5.2.RegSvcs.exe.400000.0.unpack	String decryptor: Paltalk

Source: OC & PL.exe

Static PE information: EXECUTABLE_IMAGE, LARGE_ADDRESS_AWARE, 32BIT_MACHINE

Source:	Binary string: wntdll.pdbUGP source: OC & PL.exe, 00000000.00000003.1279549859.00000000035D0000.00000004.00001000.00020000.00000000.sdmp, OC & PL.exe, 00000000.00000003.1278717254.0000000003430000.00000004.00001000.00020000.00000000.sdmp
Source:	Binary string: wntdll.pdb source: OC & PL.exe, 00000000.00000003.1279549859.00000000035D0000.00000004.00001000.00020000.00000000.sdmp, OC & PL.exe, 00000000.00000003.1278717254.0000000003430000.00000004.00001000.00020000.00000000.sdmp

Source: C:\Users\user\Desktop\OC & PL.exe	Code function: 0_2_00746CA9 GetFileAttributesW,FindFirstFileW,FindClose,	0_2_00746CA9
Source: C:\Users\user\Desktop\OC & PL.exe	Code function: 0_2_007460DD _wcscat,_wcscat,__wsplitpath,FindFirstFileW,DeleteFileW,_wcscpy,_wcscat,_wcscat,lstrcmpiW,DeleteFileW,MoveFileW,MoveFileW,CopyFileW,DeleteFileW,CopyFileW,FindNextFileW,FindClose,FindClose,	0_2_007460DD
Source: C:\Users\user\Desktop\OC & PL.exe	Code function: 0_2_007463F9 _wcscat,__wsplitpath,FindFirstFileW,_wcscpy,_wcscat,_wcscat,DeleteFileW,FindNextFileW,FindClose,	0_2_007463F9
Source: C:\Users\user\Desktop\OC & PL.exe	Code function: 0_2_0074EB60 FindFirstFileW,_wcscmp,_wcscmp,FindNextFileW,FindClose,	0_2_0074EB60
Source: C:\Users\user\Desktop\OC & PL.exe	Code function: 0_2_0074F56F FindFirstFileW,FindClose,	0_2_0074F56F
Source: C:\Users\user\Desktop\OC & PL.exe	Code function: 0_2_0074F5FA FindFirstFileW,FindClose,FileTimeToLocalFileTime,FileTimeToLocalFileTime,FileTimeToLocalFileTime,FileTimeToSystemTime,__swprintf,__swprintf,__swprintf,__swprintf,__swprintf,__swprintf,__swprintf,	0_2_0074F5FA
Source: C:\Users\user\Desktop\OC & PL.exe	Code function: 0_2_00751B2F SetCurrentDirectoryW,FindFirstFileW,FindFirstFileW,_wcscmp,_wcscmp,GetFileAttributesW,SetFileAttributesW,FindNextFileW,FindClose,FindFirstFileW,SetCurrentDirectoryW,_wcscmp,_wcscmp,SetCurrentDirectoryW,SetCurrentDirectoryW,FindNextFileW,FindClose,FindClose,	0_2_00751B2F
Source: C:\Users\user\Desktop\OC & PL.exe	Code function: 0_2_00751C8A SetCurrentDirectoryW,FindFirstFileW,FindFirstFileW,_wcscmp,_wcscmp,FindNextFileW,FindClose,FindFirstFileW,SetCurrentDirectoryW,_wcscmp,_wcscmp,SetCurrentDirectoryW,SetCurrentDirectoryW,FindNextFileW,FindClose,FindClose,	0_2_00751C8A
Source: C:\Users\user\Desktop\OC & PL.exe	Code function: 0_2_00751F94 FindFirstFileW,Sleep,_wcscmp,_wcscmp,FindNextFileW,FindClose,	0_2_00751F94

Source: global traffic

TCP traffic: 192.168.2.7:49701 -> 194.36.191.196:587

Source: Joe Sandbox View	IP Address: 194.36.191.196 194.36.191.196
Source: Joe Sandbox View	IP Address: 194.36.191.196 194.36.191.196

Source: Joe Sandbox View

ASN Name: HSAE HSAE

Source: global traffic

TCP traffic: 192.168.2.7:49701 -> 194.36.191.196:587

Source: unknown

UDP traffic detected without corresponding DNS query: 1.1.1.1

Source: C:\Users\user\Desktop\OC & PL.exe

Code function: 0_2_00754EB5 InternetReadFile,InternetQueryDataAvailable,InternetReadFile,

0_2_00754EB5

Source: global traffic

DNS traffic detected: DNS query: mail.agaliofu.top

Source: RegSvcs.exe, 00000005.00000002.2505480865.0000000002B61000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://agaliofu.top
Source: RegSvcs.exe, 00000005.00000002.2505480865.0000000002B61000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://mail.agaliofu.top
Source: RegSvcs.exe, 00000005.00000002.2506741049.00000000056BB000.00000004.00000020.00020000.00000000.sdmp, RegSvcs.exe, 00000005.00000002.2506741049.0000000005660000.00000004.00000020.00020000.00000000.sdmp, RegSvcs.exe, 00000005.00000002.2504022083.0000000000CB8000.00000004.00000020.00020000.00000000.sdmp, RegSvcs.exe, 00000005.00000002.2505480865.0000000002B61000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://r10.i.lencr.org/0
Source: RegSvcs.exe, 00000005.00000002.2506741049.00000000056BB000.00000004.00000020.00020000.00000000.sdmp, RegSvcs.exe, 00000005.00000002.2506741049.0000000005660000.00000004.00000020.00020000.00000000.sdmp, RegSvcs.exe, 00000005.00000002.2504022083.0000000000CB8000.00000004.00000020.00020000.00000000.sdmp, RegSvcs.exe, 00000005.00000002.2505480865.0000000002B61000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://r10.o.lencr.org0#
Source: RegSvcs.exe, 00000005.00000002.2506741049.00000000056BB000.00000004.00000020.00020000.00000000.sdmp, RegSvcs.exe, 00000005.00000002.2504022083.0000000000CB8000.00000004.00000020.00020000.00000000.sdmp, RegSvcs.exe, 00000005.00000002.2505480865.0000000002B61000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://x1.c.lencr.org/0
Source: RegSvcs.exe, 00000005.00000002.2506741049.0000000005660000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://x1.i.
Source: RegSvcs.exe, 00000005.00000002.2506741049.00000000056BB000.00000004.00000020.00020000.00000000.sdmp, RegSvcs.exe, 00000005.00000002.2504022083.0000000000CB8000.00000004.00000020.00020000.00000000.sdmp, RegSvcs.exe, 00000005.00000002.2505480865.0000000002B61000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://x1.i.lencr.org/0

Key, Mouse, Clipboard, Microphone and Screen Capturing

Contains functionality to log keystrokes (.Net Source)

Source: 0.2.OC & PL.exe.670000.0.raw.unpack, SoC.cs

.Net Code: _0PCB6lvQ5rw

Source: C:\Users\user\Desktop\OC & PL.exe

Code function: 0_2_00756B0C OpenClipboard,IsClipboardFormatAvailable,IsClipboardFormatAvailable,GetClipboardData,CloseClipboard,GlobalLock,CloseClipboard,GlobalUnlock,IsClipboardFormatAvailable,GetClipboardData,GlobalLock,GlobalUnlock,IsClipboardFormatAvailable,GetClipboardData,GlobalLock,DragQueryFileW,DragQueryFileW,DragQueryFileW,GlobalUnlock,CountClipboardFormats,CloseClipboard,

0_2_00756B0C

Source: C:\Users\user\Desktop\OC & PL.exe

Code function: 0_2_00756D07 OpenClipboard,EmptyClipboard,GlobalAlloc,GlobalLock,_wcscpy,GlobalUnlock,OpenClipboard,EmptyClipboard,SetClipboardData,CloseClipboard,

0_2_00756D07

Source: C:\Users\user\Desktop\OC & PL.exe

0_2_00756B0C

Source: C:\Users\user\Desktop\OC & PL.exe

Code function: 0_2_00742B37 GetKeyboardState,GetAsyncKeyState,GetKeyState,GetKeyState,GetAsyncKeyState,GetKeyState,GetAsyncKeyState,GetKeyState,GetAsyncKeyState,GetKeyState,GetAsyncKeyState,GetKeyState,

0_2_00742B37

System Summary

Binary is likely a compiled AutoIt script file

Source: C:\Users\user\Desktop\OC & PL.exe	Code function: This is a third-party compiled AutoIt script.	0_2_00703D19
Source: OC & PL.exe	String found in binary or memory: This is a third-party compiled AutoIt script.
Source: OC & PL.exe, 00000000.00000000.1255988345.00000000007AE000.00000002.00000001.01000000.00000003.sdmp	String found in binary or memory: This is a third-party compiled AutoIt script.	memstr_70d81c01-a
Source: OC & PL.exe, 00000000.00000000.1255988345.00000000007AE000.00000002.00000001.01000000.00000003.sdmp	String found in binary or memory: sSDSOFTWARE\Classes\\CLSID\\\IPC$This is a third-party compiled AutoIt script."runasError allocating memory.SeAssignPrimaryTokenPrivilegeSeIncreaseQuotaPrivilegeSeBackupPrivilegeSeRestorePrivilegewinsta0defaultwinsta0\defaultComboBoxListBox\|SHELLDLL_DefViewlargeiconsdetailssmalliconslistCLASSCLASSNNREGEXPCLASSIDNAMEXYWHINSTANCETEXT%s%u%s%dLAST[LASTACTIVE[ACTIVEHANDLE=[HANDLE:REGEXP=[REGEXPTITLE:CLASSNAME=[CLASS:ALL[ALL]HANDLEREGEXPTITLETITLEThumbnailClassAutoIt3GUIContainer	memstr_222d2d83-e
Source: OC & PL.exe	String found in binary or memory: This is a third-party compiled AutoIt script.	memstr_63f55c29-2
Source: OC & PL.exe	String found in binary or memory: CSDSOFTWARE\Classes\\CLSID\\\IPC$This is a third-party compiled AutoIt script."runasError allocating memory.SeAssignPrimaryTokenPrivilegeSeIncreaseQuotaPrivilegeSeBackupPrivilegeSeRestorePrivilegewinsta0defaultwinsta0\defaultComboBoxListBox\|SHELLDLL_DefViewlargeiconsdetailssmalliconslistCLASSCLASSNNREGEXPCLASSIDNAMEXYWHINSTANCETEXT%s%u%s%dLAST[LASTACTIVE[ACTIVEHANDLE=[HANDLE:REGEXP=[REGEXPTITLE:CLASSNAME=[CLASS:ALL[ALL]HANDLEREGEXPTITLETITLEThumbnailClassAutoIt3GUIContainer	memstr_0d674436-f

Source: C:\Users\user\Desktop\OC & PL.exe

Code function: 0_2_00746606: CreateFileW,DeviceIoControl,CloseHandle,

0_2_00746606

Source: C:\Users\user\Desktop\OC & PL.exe

Code function: 0_2_0073ACC5 _memset,DuplicateTokenEx,CloseHandle,OpenWindowStationW,GetProcessWindowStation,SetProcessWindowStation,OpenDesktopW,_wcscpy,LoadUserProfileW,CreateEnvironmentBlock,CreateProcessAsUserW,UnloadUserProfile,CloseWindowStation,CloseDesktop,SetProcessWindowStation,CloseHandle,DestroyEnvironmentBlock,

0_2_0073ACC5

Source: C:\Users\user\Desktop\OC & PL.exe

Code function: 0_2_007479D3 ExitWindowsEx,InitiateSystemShutdownExW,SetSystemPowerState,

0_2_007479D3

Source: C:\Users\user\Desktop\OC & PL.exe	Code function: 0_2_0072B043	0_2_0072B043
Source: C:\Users\user\Desktop\OC & PL.exe	Code function: 0_2_00713200	0_2_00713200
Source: C:\Users\user\Desktop\OC & PL.exe	Code function: 0_2_00713B70	0_2_00713B70
Source: C:\Users\user\Desktop\OC & PL.exe	Code function: 0_2_0073410F	0_2_0073410F
Source: C:\Users\user\Desktop\OC & PL.exe	Code function: 0_2_007202A4	0_2_007202A4
Source: C:\Users\user\Desktop\OC & PL.exe	Code function: 0_2_0070E3E3	0_2_0070E3E3
Source: C:\Users\user\Desktop\OC & PL.exe	Code function: 0_2_0073038E	0_2_0073038E
Source: C:\Users\user\Desktop\OC & PL.exe	Code function: 0_2_0073467F	0_2_0073467F
Source: C:\Users\user\Desktop\OC & PL.exe	Code function: 0_2_007206D9	0_2_007206D9
Source: C:\Users\user\Desktop\OC & PL.exe	Code function: 0_2_0076AACE	0_2_0076AACE
Source: C:\Users\user\Desktop\OC & PL.exe	Code function: 0_2_00734BEF	0_2_00734BEF
Source: C:\Users\user\Desktop\OC & PL.exe	Code function: 0_2_0072CCC1	0_2_0072CCC1
Source: C:\Users\user\Desktop\OC & PL.exe	Code function: 0_2_0070AF50	0_2_0070AF50
Source: C:\Users\user\Desktop\OC & PL.exe	Code function: 0_2_00706F07	0_2_00706F07
Source: C:\Users\user\Desktop\OC & PL.exe	Code function: 0_2_0071B11F	0_2_0071B11F
Source: C:\Users\user\Desktop\OC & PL.exe	Code function: 0_2_007631BC	0_2_007631BC
Source: C:\Users\user\Desktop\OC & PL.exe	Code function: 0_2_0072D1B9	0_2_0072D1B9
Source: C:\Users\user\Desktop\OC & PL.exe	Code function: 0_2_0073724D	0_2_0073724D
Source: C:\Users\user\Desktop\OC & PL.exe	Code function: 0_2_0072123A	0_2_0072123A
Source: C:\Users\user\Desktop\OC & PL.exe	Code function: 0_2_007093F0	0_2_007093F0
Source: C:\Users\user\Desktop\OC & PL.exe	Code function: 0_2_007413CA	0_2_007413CA
Source: C:\Users\user\Desktop\OC & PL.exe	Code function: 0_2_0071F563	0_2_0071F563
Source: C:\Users\user\Desktop\OC & PL.exe	Code function: 0_2_007096C0	0_2_007096C0
Source: C:\Users\user\Desktop\OC & PL.exe	Code function: 0_2_0074B6CC	0_2_0074B6CC
Source: C:\Users\user\Desktop\OC & PL.exe	Code function: 0_2_007077B0	0_2_007077B0
Source: C:\Users\user\Desktop\OC & PL.exe	Code function: 0_2_007379C9	0_2_007379C9
Source: C:\Users\user\Desktop\OC & PL.exe	Code function: 0_2_0071FA57	0_2_0071FA57
Source: C:\Users\user\Desktop\OC & PL.exe	Code function: 0_2_00709B60	0_2_00709B60
Source: C:\Users\user\Desktop\OC & PL.exe	Code function: 0_2_00707D19	0_2_00707D19
Source: C:\Users\user\Desktop\OC & PL.exe	Code function: 0_2_0071FE6F	0_2_0071FE6F
Source: C:\Users\user\Desktop\OC & PL.exe	Code function: 0_2_00729ED0	0_2_00729ED0
Source: C:\Users\user\Desktop\OC & PL.exe	Code function: 0_2_00707FA3	0_2_00707FA3
Source: C:\Users\user\Desktop\OC & PL.exe	Code function: 0_2_00F56510	0_2_00F56510
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 5_2_028A4250	5_2_028A4250
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 5_2_028AF975	5_2_028AF975
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 5_2_028A4E68	5_2_028A4E68
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 5_2_028AAC42	5_2_028AAC42
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 5_2_028A4598	5_2_028A4598
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 5_2_05D98160	5_2_05D98160
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 5_2_05D930A0	5_2_05D930A0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 5_2_05D96810	5_2_05D96810
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 5_2_05D95790	5_2_05D95790
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 5_2_05D9BAFB	5_2_05D9BAFB
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 5_2_05D9F130	5_2_05D9F130
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 5_2_05D90040	5_2_05D90040
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 5_2_05D95ED3	5_2_05D95ED3

Source: C:\Users\user\Desktop\OC & PL.exe	Code function: String function: 0071EC2F appears 68 times
Source: C:\Users\user\Desktop\OC & PL.exe	Code function: String function: 0072F8A0 appears 35 times
Source: C:\Users\user\Desktop\OC & PL.exe	Code function: String function: 00726AC0 appears 42 times

Source: OC & PL.exe, 00000000.00000003.1280680700.00000000036FD000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamentdll.dllj% vs OC & PL.exe
Source: OC & PL.exe, 00000000.00000003.1278067652.0000000003553000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamentdll.dllj% vs OC & PL.exe
Source: OC & PL.exe, 00000000.00000002.1281202457.0000000000670000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: OriginalFilename667ba23f-a209-46d6-8a32-7e551fe203f6.exe4 vs OC & PL.exe

Source: OC & PL.exe

Static PE information: EXECUTABLE_IMAGE, LARGE_ADDRESS_AWARE, 32BIT_MACHINE

Source: 0.2.OC & PL.exe.670000.0.raw.unpack, 3SHNS.cs	Cryptographic APIs: 'TransformFinalBlock'
Source: 0.2.OC & PL.exe.670000.0.raw.unpack, Nsobj.cs	Cryptographic APIs: 'TransformFinalBlock'
Source: 0.2.OC & PL.exe.670000.0.raw.unpack, kPjPB5Pg.cs	Cryptographic APIs: 'TransformFinalBlock'
Source: 0.2.OC & PL.exe.670000.0.raw.unpack, L0cY6BffcK.cs	Cryptographic APIs: 'CreateDecryptor', 'TransformBlock'
Source: 0.2.OC & PL.exe.670000.0.raw.unpack, U25VpnZdCi.cs	Cryptographic APIs: 'TransformFinalBlock'
Source: 0.2.OC & PL.exe.670000.0.raw.unpack, 8Po0IVbA.cs	Cryptographic APIs: 'CreateDecryptor'
Source: 0.2.OC & PL.exe.670000.0.raw.unpack, En337tp.cs	Cryptographic APIs: 'TransformFinalBlock'
Source: 0.2.OC & PL.exe.670000.0.raw.unpack, En337tp.cs	Cryptographic APIs: 'TransformFinalBlock', 'CreateDecryptor'
Source: 0.2.OC & PL.exe.670000.0.raw.unpack, F1ul27ct.cs	Cryptographic APIs: 'TransformFinalBlock'
Source: 0.2.OC & PL.exe.670000.0.raw.unpack, F1ul27ct.cs	Cryptographic APIs: 'TransformFinalBlock'
Source: 0.2.OC & PL.exe.670000.0.raw.unpack, F1ul27ct.cs	Cryptographic APIs: 'TransformFinalBlock'
Source: 0.2.OC & PL.exe.670000.0.raw.unpack, F1ul27ct.cs	Cryptographic APIs: 'TransformFinalBlock'

Source: OC & PL.exe, 00000000.00000003.1266243059.0000000000D99000.00000004.00000020.00020000.00000000.sdmp, OC & PL.exe, 00000000.00000003.1266314680.0000000000DB8000.00000004.00000020.00020000.00000000.sdmp, immortaliser.0.dr	Binary or memory string: 6.vBP6*M
Source: OC & PL.exe, 00000000.00000003.1266243059.0000000000D99000.00000004.00000020.00020000.00000000.sdmp, OC & PL.exe, 00000000.00000003.1266314680.0000000000DB8000.00000004.00000020.00020000.00000000.sdmp, immortaliser.0.dr	Binary or memory string: 6.vBP6

Source: classification engine

Classification label: mal100.troj.spyw.evad.winEXE@3/2@1/1

Source: C:\Users\user\Desktop\OC & PL.exe

Code function: 0_2_0074CE7A GetLastError,FormatMessageW,

0_2_0074CE7A

Source: C:\Users\user\Desktop\OC & PL.exe	Code function: 0_2_0073AB84 AdjustTokenPrivileges,CloseHandle,		0_2_0073AB84
Source: C:\Users\user\Desktop\OC & PL.exe	Code function: 0_2_0073B134 LookupPrivilegeValueW,AdjustTokenPrivileges,GetLastError,		0_2_0073B134

Source: C:\Users\user\Desktop\OC & PL.exe

Code function: 0_2_0074E1FD SetErrorMode,GetDiskFreeSpaceExW,SetErrorMode,

0_2_0074E1FD

Source: C:\Users\user\Desktop\OC & PL.exe

Code function: 0_2_00746532 CreateToolhelp32Snapshot,Process32FirstW,Process32NextW,__wsplitpath,_wcscat,CloseHandle,

0_2_00746532

Source: C:\Users\user\Desktop\OC & PL.exe

Code function: 0_2_0075C18C CoInitializeSecurity,_memset,_memset,CoCreateInstanceEx,CoTaskMemFree,CoSetProxyBlanket,

0_2_0075C18C

Source: C:\Users\user\Desktop\OC & PL.exe

Code function: 0_2_0070406B CreateStreamOnHGlobal,FindResourceExW,LoadResource,SizeofResource,LockResource,

0_2_0070406B

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe

Mutant created: NULL

Source: C:\Users\user\Desktop\OC & PL.exe

File created: C:\Users\user~1\AppData\Local\Temp\aut1756.tmp

Jump to behavior

Source: OC & PL.exe

Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_Processor
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe

File read: C:\Users\user\AppData\Roaming\Mozilla\Firefox\profiles.ini

Jump to behavior

Source: C:\Users\user\Desktop\OC & PL.exe

Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: OC & PL.exe

ReversingLabs: Detection: 55%

Source: unknown	Process created: C:\Users\user\Desktop\OC & PL.exe "C:\Users\user\Desktop\OC & PL.exe"
Source: C:\Users\user\Desktop\OC & PL.exe	Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe "C:\Users\user\Desktop\OC & PL.exe"
Source: C:\Users\user\Desktop\OC & PL.exe	Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe "C:\Users\user\Desktop\OC & PL.exe"	Jump to behavior

Source: C:\Users\user\Desktop\OC & PL.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\Desktop\OC & PL.exe	Section loaded: wsock32.dll	Jump to behavior
Source: C:\Users\user\Desktop\OC & PL.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Users\user\Desktop\OC & PL.exe	Section loaded: winmm.dll	Jump to behavior
Source: C:\Users\user\Desktop\OC & PL.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Users\user\Desktop\OC & PL.exe	Section loaded: wininet.dll	Jump to behavior
Source: C:\Users\user\Desktop\OC & PL.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\OC & PL.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Users\user\Desktop\OC & PL.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Users\user\Desktop\OC & PL.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\Desktop\OC & PL.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Users\user\Desktop\OC & PL.exe	Section loaded: wldp.dll	Jump to behavior

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{CF4CC405-E2C5-4DDD-B3CE-5E7582D8C9FA}\InprocServer32

Jump to behavior

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe

Key opened: HKEY_CURRENT_USER\Software\Microsoft\Office\15.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676

Jump to behavior

Source: OC & PL.exe

Static file information: File size 1225216 > 1048576

Source: OC & PL.exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_IMPORT
Source: OC & PL.exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_RESOURCE
Source: OC & PL.exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_BASERELOC
Source: OC & PL.exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_DEBUG
Source: OC & PL.exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG
Source: OC & PL.exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_IAT

Source: OC & PL.exe

Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_DEBUG

Source:	Binary string: wntdll.pdbUGP source: OC & PL.exe, 00000000.00000003.1279549859.00000000035D0000.00000004.00001000.00020000.00000000.sdmp, OC & PL.exe, 00000000.00000003.1278717254.0000000003430000.00000004.00001000.00020000.00000000.sdmp
Source:	Binary string: wntdll.pdb source: OC & PL.exe, 00000000.00000003.1279549859.00000000035D0000.00000004.00001000.00020000.00000000.sdmp, OC & PL.exe, 00000000.00000003.1278717254.0000000003430000.00000004.00001000.00020000.00000000.sdmp

Source: OC & PL.exe	Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_IMPORT is in: .rdata
Source: OC & PL.exe	Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_RESOURCE is in: .rsrc
Source: OC & PL.exe	Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_BASERELOC is in: .reloc
Source: OC & PL.exe	Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG is in: .rdata
Source: OC & PL.exe	Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_IAT is in: .rdata

Source: C:\Users\user\Desktop\OC & PL.exe

Code function: 0_2_0071E01E LoadLibraryA,GetProcAddress,

0_2_0071E01E

Source: C:\Users\user\Desktop\OC & PL.exe	Code function: 0_2_0071288B push 66007123h; retn 0077h	0_2_007128E1
Source: C:\Users\user\Desktop\OC & PL.exe	Code function: 0_2_00726B05 push ecx; ret	0_2_00726B18
Source: C:\Users\user\Desktop\OC & PL.exe	Code function: 0_2_00F5697A push ebp; iretd	0_2_00F56984
Source: C:\Users\user\Desktop\OC & PL.exe	Code function: 0_2_00F56E19 push 2DA9E07Bh; ret	0_2_00F56E21

Hooking and other Techniques for Hiding and Protection

Icon mismatch, binary includes an icon from a different legit application in order to fool users

Source: initial sample

Icon embedded in binary file: icon matches a legit application icon: download.png

Source: C:\Users\user\Desktop\OC & PL.exe	Code function: 0_2_00768111 IsWindowVisible,IsWindowEnabled,GetForegroundWindow,IsIconic,IsZoomed,		0_2_00768111
Source: C:\Users\user\Desktop\OC & PL.exe	Code function: 0_2_0071EB42 GetForegroundWindow,FindWindowW,IsIconic,ShowWindow,SetForegroundWindow,GetWindowThreadProcessId,GetWindowThreadProcessId,GetCurrentThreadId,GetWindowThreadProcessId,AttachThreadInput,AttachThreadInput,AttachThreadInput,AttachThreadInput,SetForegroundWindow,MapVirtualKeyW,MapVirtualKeyW,keybd_event,keybd_event,MapVirtualKeyW,keybd_event,MapVirtualKeyW,keybd_event,MapVirtualKeyW,keybd_event,SetForegroundWindow,AttachThreadInput,AttachThreadInput,AttachThreadInput,AttachThreadInput,		0_2_0071EB42

Source: C:\Users\user\Desktop\OC & PL.exe

Code function: 0_2_0072123A __initp_misc_winsig,GetModuleHandleW,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,

0_2_0072123A

Source: C:\Users\user\Desktop\OC & PL.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\OC & PL.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior

Malware Analysis System Evasion

Queries sensitive network adapter information (via WMI, Win32_NetworkAdapter, often done to detect virtual machines)

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe

WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_NetworkAdapterConfiguration

Switches to a custom stack to bypass stack traces

Source: C:\Users\user\Desktop\OC & PL.exe

API/Special instruction interceptor: Address: F56134

Tries to detect sandboxes and other dynamic analysis tools (process name or module or function)

Source: OC & PL.exe, 00000000.00000003.1258140373.0000000000D8B000.00000004.00000020.00020000.00000000.sdmp, OC & PL.exe, 00000000.00000002.1282487024.0000000000E27000.00000004.00000020.00020000.00000000.sdmp

Binary or memory string: PROCESSHACKER.EXE

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe

Thread delayed: delay time: 922337203685477

Jump to behavior

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Window / User API: threadDelayed 1525			Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Window / User API: threadDelayed 8305			Jump to behavior

Source: C:\Users\user\Desktop\OC & PL.exe	Evaded block: after key decision			graph_0-93997
Source: C:\Users\user\Desktop\OC & PL.exe	Evaded block: after key decision			graph_0-95084

Source: C:\Users\user\Desktop\OC & PL.exe

Evasive API call chain: GetSystemTimeAsFileTime,DecisionNodes

graph_0-94544

Source: C:\Users\user\Desktop\OC & PL.exe

API coverage: 4.6 %

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe

WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_BaseBoard

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_Processor
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor

Source: C:\Users\user\Desktop\OC & PL.exe	Code function: 0_2_00746CA9 GetFileAttributesW,FindFirstFileW,FindClose,	0_2_00746CA9
Source: C:\Users\user\Desktop\OC & PL.exe	Code function: 0_2_007460DD _wcscat,_wcscat,__wsplitpath,FindFirstFileW,DeleteFileW,_wcscpy,_wcscat,_wcscat,lstrcmpiW,DeleteFileW,MoveFileW,MoveFileW,CopyFileW,DeleteFileW,CopyFileW,FindNextFileW,FindClose,FindClose,	0_2_007460DD
Source: C:\Users\user\Desktop\OC & PL.exe	Code function: 0_2_007463F9 _wcscat,__wsplitpath,FindFirstFileW,_wcscpy,_wcscat,_wcscat,DeleteFileW,FindNextFileW,FindClose,	0_2_007463F9
Source: C:\Users\user\Desktop\OC & PL.exe	Code function: 0_2_0074EB60 FindFirstFileW,_wcscmp,_wcscmp,FindNextFileW,FindClose,	0_2_0074EB60
Source: C:\Users\user\Desktop\OC & PL.exe	Code function: 0_2_0074F56F FindFirstFileW,FindClose,	0_2_0074F56F
Source: C:\Users\user\Desktop\OC & PL.exe	Code function: 0_2_0074F5FA FindFirstFileW,FindClose,FileTimeToLocalFileTime,FileTimeToLocalFileTime,FileTimeToLocalFileTime,FileTimeToSystemTime,__swprintf,__swprintf,__swprintf,__swprintf,__swprintf,__swprintf,__swprintf,	0_2_0074F5FA
Source: C:\Users\user\Desktop\OC & PL.exe	Code function: 0_2_00751B2F SetCurrentDirectoryW,FindFirstFileW,FindFirstFileW,_wcscmp,_wcscmp,GetFileAttributesW,SetFileAttributesW,FindNextFileW,FindClose,FindFirstFileW,SetCurrentDirectoryW,_wcscmp,_wcscmp,SetCurrentDirectoryW,SetCurrentDirectoryW,FindNextFileW,FindClose,FindClose,	0_2_00751B2F
Source: C:\Users\user\Desktop\OC & PL.exe	Code function: 0_2_00751C8A SetCurrentDirectoryW,FindFirstFileW,FindFirstFileW,_wcscmp,_wcscmp,FindNextFileW,FindClose,FindFirstFileW,SetCurrentDirectoryW,_wcscmp,_wcscmp,SetCurrentDirectoryW,SetCurrentDirectoryW,FindNextFileW,FindClose,FindClose,	0_2_00751C8A
Source: C:\Users\user\Desktop\OC & PL.exe	Code function: 0_2_00751F94 FindFirstFileW,Sleep,_wcscmp,_wcscmp,FindNextFileW,FindClose,	0_2_00751F94

Source: C:\Users\user\Desktop\OC & PL.exe

Code function: 0_2_0071DDC0 GetVersionExW,GetCurrentProcess,FreeLibrary,GetNativeSystemInfo,FreeLibrary,FreeLibrary,GetSystemInfo,GetSystemInfo,

0_2_0071DDC0

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 100000	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 99891	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 99782	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 99657	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 99532	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 99407	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 99282	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 99172	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 99063	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 98938	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 98813	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 98688	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 98563	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 98453	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 98344	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 98219	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 98109	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 98000	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 97891	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 97782	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 97657	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 97532	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 97407	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 97297	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 97188	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 97063	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 96938	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 96813	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 96688	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 96578	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 96469	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 96344	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 96235	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 96110	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 95985	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 95860	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 95735	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 95610	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 95485	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 95360	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 95235	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 95110	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 94985	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 94860	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 94735	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 94610	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 94485	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 94360	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 94235	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 94110	Jump to behavior

Source: RegSvcs.exe, 00000005.00000002.2506741049.0000000005660000.00000004.00000020.00020000.00000000.sdmp

Binary or memory string: Hyper-V RAW%SystemRoot%\system32\mswsock.dll&

Source: C:\Users\user\Desktop\OC & PL.exe

API call chain: ExitProcess graph end node

graph_0-93767

Source: C:\Users\user\Desktop\OC & PL.exe

Code function: 0_2_00756AAF BlockInput,

0_2_00756AAF

Source: C:\Users\user\Desktop\OC & PL.exe

Code function: 0_2_00703D19 GetCurrentDirectoryW,IsDebuggerPresent,GetFullPathNameW,SetCurrentDirectoryW,MessageBoxA,SetCurrentDirectoryW,GetForegroundWindow,ShellExecuteW,

0_2_00703D19

Source: C:\Users\user\Desktop\OC & PL.exe

Code function: 0_2_00733920 LoadLibraryExW,GetLastError,LoadLibraryW,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,IsDebuggerPresent,OutputDebugStringW,

0_2_00733920

Source: C:\Users\user\Desktop\OC & PL.exe

Code function: 0_2_0071E01E LoadLibraryA,GetProcAddress,

0_2_0071E01E

Source: C:\Users\user\Desktop\OC & PL.exe	Code function: 0_2_00F563A0 mov eax, dword ptr fs:[00000030h]	0_2_00F563A0
Source: C:\Users\user\Desktop\OC & PL.exe	Code function: 0_2_00F56400 mov eax, dword ptr fs:[00000030h]	0_2_00F56400
Source: C:\Users\user\Desktop\OC & PL.exe	Code function: 0_2_00F54D20 mov eax, dword ptr fs:[00000030h]	0_2_00F54D20

Source: C:\Users\user\Desktop\OC & PL.exe

Code function: 0_2_0073A66C GetSecurityDescriptorDacl,_memset,GetAclInformation,GetLengthSid,GetAce,AddAce,GetLengthSid,GetProcessHeap,HeapAlloc,GetLengthSid,CopySid,AddAce,SetSecurityDescriptorDacl,SetUserObjectSecurity,

0_2_0073A66C

Source: C:\Users\user\Desktop\OC & PL.exe	Code function: 0_2_007281AC SetUnhandledExceptionFilter,UnhandledExceptionFilter,		0_2_007281AC
Source: C:\Users\user\Desktop\OC & PL.exe	Code function: 0_2_00728189 SetUnhandledExceptionFilter,		0_2_00728189

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe

Memory allocated: page read and write | page guard

Jump to behavior

HIPS / PFW / Operating System Protection Evasion

Maps a DLL or memory area into another process

Source: C:\Users\user\Desktop\OC & PL.exe

Section loaded: NULL target: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe protection: execute and read and write

Jump to behavior

Writes to foreign memory regions

Source: C:\Users\user\Desktop\OC & PL.exe

Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe base: 90F008

Jump to behavior

Source: C:\Users\user\Desktop\OC & PL.exe

Code function: 0_2_0073B106 LogonUserW,

0_2_0073B106

Source: C:\Users\user\Desktop\OC & PL.exe

Code function: 0_2_00703D19 GetCurrentDirectoryW,IsDebuggerPresent,GetFullPathNameW,SetCurrentDirectoryW,MessageBoxA,SetCurrentDirectoryW,GetForegroundWindow,ShellExecuteW,

0_2_00703D19

Source: C:\Users\user\Desktop\OC & PL.exe

Code function: 0_2_0074411C SendInput,keybd_event,

0_2_0074411C

Source: C:\Users\user\Desktop\OC & PL.exe

Code function: 0_2_007474E7 mouse_event,

0_2_007474E7

Source: C:\Users\user\Desktop\OC & PL.exe

Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe "C:\Users\user\Desktop\OC & PL.exe"

Jump to behavior

Source: C:\Users\user\Desktop\OC & PL.exe

0_2_0073A66C

Source: C:\Users\user\Desktop\OC & PL.exe

Code function: 0_2_007471FA AllocateAndInitializeSid,CheckTokenMembership,FreeSid,

0_2_007471FA

Source: OC & PL.exe	Binary or memory string: Shell_TrayWnd
Source: OC & PL.exe	Binary or memory string: Run Script:AutoIt script files (.au3, .a3x).au3;.a3xAll files (.).au3#include depth exceeded. Make sure there are no recursive includesError opening the file>>>AUTOIT SCRIPT<<<Bad directive syntax errorUnterminated stringCannot parse #includeUnterminated group of commentsONOFF0%d%dShell_TrayWndTHISREMOVEblankinfoquestionstopwarning

Source: C:\Users\user\Desktop\OC & PL.exe

Code function: 0_2_007265C4 cpuid

0_2_007265C4

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Queries volume information: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe VolumeInformation	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Windows.Forms\v4.0_4.0.0.0__b77a5c561934e089\System.Windows.Forms.dll VolumeInformation	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Security\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Security.dll VolumeInformation	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.VisualBasic\v4.0_10.0.0.0__b03f5f7f11d50a3a\Microsoft.VisualBasic.dll VolumeInformation	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Drawing\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Drawing.dll VolumeInformation	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Accessibility\v4.0_4.0.0.0__b03f5f7f11d50a3a\Accessibility.dll VolumeInformation	Jump to behavior

Source: C:\Users\user\Desktop\OC & PL.exe

Code function: 0_2_0075091D GetLocalTime,SystemTimeToFileTime,LocalFileTimeToFileTime,__wsplitpath,_wcscat,_wcscat,GetCurrentDirectoryW,SetCurrentDirectoryW,SetCurrentDirectoryW,SetCurrentDirectoryW,SetCurrentDirectoryW,_wcscpy,SetCurrentDirectoryW,

0_2_0075091D

Source: C:\Users\user\Desktop\OC & PL.exe

Code function: 0_2_0077B340 GetUserNameW,

0_2_0077B340

Source: C:\Users\user\Desktop\OC & PL.exe

Code function: 0_2_00731E8E __lock,____lc_codepage_func,__getenv_helper_nolock,_free,_strlen,__malloc_crt,_strlen,__invoke_watson,_free,GetTimeZoneInformation,WideCharToMultiByte,WideCharToMultiByte,

0_2_00731E8E

Source: C:\Users\user\Desktop\OC & PL.exe

Code function: 0_2_0071DDC0 GetVersionExW,GetCurrentProcess,FreeLibrary,GetNativeSystemInfo,FreeLibrary,FreeLibrary,GetSystemInfo,GetSystemInfo,

0_2_0071DDC0

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid

Jump to behavior

Stealing of Sensitive Information

Yara detected AgentTesla

Source: Yara match	File source: 00000005.00000002.2505480865.0000000002B83000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000005.00000002.2505480865.0000000002B57000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000005.00000002.2505480865.0000000002B01000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: RegSvcs.exe PID: 6400, type: MEMORYSTR
Source: Yara match	File source: decrypted.memstr, type: MEMORYSTR
Source: Yara match	File source: 0.2.OC & PL.exe.670000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.OC & PL.exe.670000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 5.2.RegSvcs.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000000.00000002.1281202457.0000000000670000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000005.00000002.2502890497.0000000000402000.00000040.80000000.00040000.00000000.sdmp, type: MEMORY

Tries to harvest and steal Putty / WinSCP information (sessions, passwords, etc)

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe

Key opened: HKEY_CURRENT_USER\SOFTWARE\Martin Prikryl\WinSCP 2\Sessions

Jump to behavior

Tries to harvest and steal browser information (history, passwords, etc)

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	File opened: C:\Users\user\AppData\Roaming\NETGATE Technologies\BlackHawk\profiles.ini	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Login Data	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\profiles.ini	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	File opened: C:\Users\user\AppData\Roaming\8pecxstudios\Cyberfox\profiles.ini	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Login Data	Jump to behavior

Tries to harvest and steal ftp login credentials

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe

File opened: C:\FTP Navigator\Ftplist.txt

Jump to behavior

Tries to steal Mail credentials (via file / registry access)

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	File opened: C:\Users\user\AppData\Roaming\Thunderbird\profiles.ini	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	File opened: C:\Users\user\AppData\Roaming\Thunderbird\profiles.ini	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Key opened: HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Key opened: HKEY_CURRENT_USER\Software\IncrediMail\Identities	Jump to behavior

Source: OC & PL.exe	Binary or memory string: WIN_81
Source: OC & PL.exe	Binary or memory string: WIN_XP
Source: OC & PL.exe	Binary or memory string: %.3d%S%M%H%m%Y%jX86IA64X64WIN32_NTWIN_81WIN_2012R2WIN_2012WIN_8WIN_2008R2WIN_7WIN_2008WIN_VISTAWIN_2003WIN_XPeWIN_XPInstallLanguageSYSTEM\CurrentControlSet\Control\Nls\LanguageSchemeLangIDControl Panel\Appearance3, 3, 12, 0USERPROFILEUSERDOMAINUSERDNSDOMAINGetSystemWow64DirectoryWSeDebugPrivilege:winapistdcallubytep
Source: OC & PL.exe	Binary or memory string: WIN_XPe
Source: OC & PL.exe	Binary or memory string: WIN_VISTA
Source: OC & PL.exe	Binary or memory string: WIN_7
Source: OC & PL.exe	Binary or memory string: WIN_8

Source: Yara match	File source: 00000005.00000002.2505480865.0000000002B01000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: RegSvcs.exe PID: 6400, type: MEMORYSTR
Source: Yara match	File source: decrypted.memstr, type: MEMORYSTR

Remote Access Functionality

Yara detected AgentTesla

Source: Yara match	File source: 00000005.00000002.2505480865.0000000002B83000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000005.00000002.2505480865.0000000002B57000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000005.00000002.2505480865.0000000002B01000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: RegSvcs.exe PID: 6400, type: MEMORYSTR
Source: Yara match	File source: decrypted.memstr, type: MEMORYSTR
Source: Yara match	File source: 0.2.OC & PL.exe.670000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.OC & PL.exe.670000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 5.2.RegSvcs.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000000.00000002.1281202457.0000000000670000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000005.00000002.2502890497.0000000000402000.00000040.80000000.00040000.00000000.sdmp, type: MEMORY

Source: C:\Users\user\Desktop\OC & PL.exe	Code function: 0_2_00758C4F socket,WSAGetLastError,bind,listen,WSAGetLastError,closesocket,		0_2_00758C4F
Source: C:\Users\user\Desktop\OC & PL.exe	Code function: 0_2_0075923B socket,WSAGetLastError,bind,WSAGetLastError,closesocket,		0_2_0075923B

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	Acquire Infrastructure	2 Valid Accounts	121 Windows Management Instrumentation	1 DLL Side-Loading	1 Exploitation for Privilege Escalation	11 Disable or Modify Tools	2 OS Credential Dumping	2 System Time Discovery	Remote Services	11 Archive Collected Data	1 Ingress Tool Transfer	Exfiltration Over Other Network Medium	1 System Shutdown/Reboot
Credentials	Domains	Default Accounts	3 Native API	2 Valid Accounts	1 DLL Side-Loading	11 Deobfuscate/Decode Files or Information	111 Input Capture	1 Account Discovery	Remote Desktop Protocol	2 Data from Local System	1 Encrypted Channel	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	At	Logon Script (Windows)	2 Valid Accounts	2 Obfuscated Files or Information	1 Credentials in Registry	2 File and Directory Discovery	SMB/Windows Admin Shares	1 Email Collection	1 Non-Standard Port	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	Cron	Login Hook	21 Access Token Manipulation	1 DLL Side-Loading	NTDS	138 System Information Discovery	Distributed Component Object Model	111 Input Capture	1 Non-Application Layer Protocol	Traffic Duplication	Data Destruction
Gather Victim Network Information	Server	Cloud Accounts	Launchd	Network Logon Script	212 Process Injection	1 Masquerading	LSA Secrets	341 Security Software Discovery	SSH	3 Clipboard Data	11 Application Layer Protocol	Scheduled Transfer	Data Encrypted for Impact
Domain Properties	Botnet	Replication Through Removable Media	Scheduled Task	RC Scripts	RC Scripts	2 Valid Accounts	Cached Domain Credentials	121 Virtualization/Sandbox Evasion	VNC	GUI Input Capture	Multiband Communication	Data Transfer Size Limits	Service Stop
DNS	Web Services	External Remote Services	Systemd Timers	Startup Items	Startup Items	121 Virtualization/Sandbox Evasion	DCSync	2 Process Discovery	Windows Remote Management	Web Portal Capture	Commonly Used Port	Exfiltration Over C2 Channel	Inhibit System Recovery
Network Trust Dependencies	Serverless	Drive-by Compromise	Container Orchestration Job	Scheduled Task/Job	Scheduled Task/Job	21 Access Token Manipulation	Proc Filesystem	11 Application Window Discovery	Cloud Services	Credential API Hooking	Application Layer Protocol	Exfiltration Over Alternative Protocol	Defacement
Network Topology	Malvertising	Exploit Public-Facing Application	Command and Scripting Interpreter	At	At	212 Process Injection	/etc/passwd and /etc/shadow	1 System Owner/User Discovery	Direct Cloud VM Connections	Data Staged	Web Protocols	Exfiltration Over Symmetric Encrypted Non-C2 Protocol	Internal Defacement

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Source	Detection	Scanner	Label	Link
OC & PL.exe	55%	ReversingLabs	Win32.Trojan.AutoitInject
OC & PL.exe	100%	Joe Sandbox ML

Source	Detection	Scanner	Label
http://mail.agaliofu.top	0%	Avira URL Cloud	safe
http://agaliofu.top	0%	Avira URL Cloud	safe
http://x1.i.	0%	Avira URL Cloud	safe

Domains and IPs

Contacted Domains

Name	IP	Active	Malicious	Antivirus Detection	Reputation
agaliofu.top	194.36.191.196	true	true		unknown
mail.agaliofu.top	unknown	unknown	true		unknown

URLs from Memory and Binaries

Name	Source	Malicious	Antivirus Detection	Reputation
http://r10.o.lencr.org0#	RegSvcs.exe, 00000005.00000002.2506741049.00000000056BB000.00000004.00000020.00020000.00000000.sdmp, RegSvcs.exe, 00000005.00000002.2506741049.0000000005660000.00000004.00000020.00020000.00000000.sdmp, RegSvcs.exe, 00000005.00000002.2504022083.0000000000CB8000.00000004.00000020.00020000.00000000.sdmp, RegSvcs.exe, 00000005.00000002.2505480865.0000000002B61000.00000004.00000800.00020000.00000000.sdmp	false		high
http://mail.agaliofu.top	RegSvcs.exe, 00000005.00000002.2505480865.0000000002B61000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://x1.c.lencr.org/0	RegSvcs.exe, 00000005.00000002.2506741049.00000000056BB000.00000004.00000020.00020000.00000000.sdmp, RegSvcs.exe, 00000005.00000002.2504022083.0000000000CB8000.00000004.00000020.00020000.00000000.sdmp, RegSvcs.exe, 00000005.00000002.2505480865.0000000002B61000.00000004.00000800.00020000.00000000.sdmp	false		high
http://x1.i.	RegSvcs.exe, 00000005.00000002.2506741049.0000000005660000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://x1.i.lencr.org/0	RegSvcs.exe, 00000005.00000002.2506741049.00000000056BB000.00000004.00000020.00020000.00000000.sdmp, RegSvcs.exe, 00000005.00000002.2504022083.0000000000CB8000.00000004.00000020.00020000.00000000.sdmp, RegSvcs.exe, 00000005.00000002.2505480865.0000000002B61000.00000004.00000800.00020000.00000000.sdmp	false		high
http://agaliofu.top	RegSvcs.exe, 00000005.00000002.2505480865.0000000002B61000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://r10.i.lencr.org/0	RegSvcs.exe, 00000005.00000002.2506741049.00000000056BB000.00000004.00000020.00020000.00000000.sdmp, RegSvcs.exe, 00000005.00000002.2506741049.0000000005660000.00000004.00000020.00020000.00000000.sdmp, RegSvcs.exe, 00000005.00000002.2504022083.0000000000CB8000.00000004.00000020.00020000.00000000.sdmp, RegSvcs.exe, 00000005.00000002.2505480865.0000000002B61000.00000004.00000800.00020000.00000000.sdmp	false		high

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	Flag	ASN	ASN Name	Malicious
194.36.191.196	agaliofu.top	Netherlands		60117	HSAE	true

General Information

Joe Sandbox version:	41.0.0 Charoite
Analysis ID:	1559981
Start date and time:	2024-11-21 09:07:47 +01:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 5m 38s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	13
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Sample name:	OC & PL.exe
Detection:	MAL
Classification:	mal100.troj.spyw.evad.winEXE@3/2@1/1
EGA Information:	Successful, ratio: 100%
HCA Information:	Successful, ratio: 100% Number of executed functions: 61 Number of non-executed functions: 287
Cookbook Comments:	Found application associated with file extension: .exe

Warnings

Exclude process from analysis (whitelisted): MpCmdRun.exe, dllhost.exe, WMIADAP.exe, SIHClient.exe, SgrmBroker.exe, conhost.exe, svchost.exe
Excluded domains from analysis (whitelisted): otelrules.azureedge.net, slscr.update.microsoft.com, ctldl.windowsupdate.com, time.windows.com, fe3cr.delivery.mp.microsoft.com
Not all processes where analyzed, report is missing behavior information
Report size exceeded maximum capacity and may have missing disassembly code.
Report size getting too big, too many NtOpenKeyEx calls found.
Report size getting too big, too many NtQueryValueKey calls found.
VT rate limit hit for: OC & PL.exe

Simulations

Behavior and APIs

Time	Type	Description
03:08:45	API Interceptor	63x Sleep call for process: RegSvcs.exe modified

Joe Sandbox View / Context

IPs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
194.36.191.196	http://theclearinghouseus.org	Get hash	malicious	Unknown	Browse	theclearinghouseus.org/www.theclearinghouse.org/connected-banking.html
	gqtya.ps1	Get hash	malicious	Unknown	Browse	udr-offdips.com/buy/
	http://store.avast.com/store?SiteID=avast&Action=DisplayRedirectCustomPage&Locale=en_US&v=1&t=event&tid=UA-58120669-65&cid=725399894.1568213989&ec=Emailing_Digital%20River&aip=1&cm10=1&ds=Avast&ul=en_US&cs=Digital%20River&cm=email&cd2=Paid&cd3=725399894.1568213989&cd4=Business&cd5=BMG-00-001-36-AR&cd7=13306019910&cd6=22895593139&cd8=0&cd9=4871168000&cd10=USD&cd11=44&cd12=1659005853297&ea=Click&el=http://0gjysc.wildlifewalkabout.com/am9lbC5uYXNzaWZAYXJuLmFl	Get hash	malicious	Unknown	Browse	0gjysc.wildlifewalkabout.com/am9lbC5uYXNzaWZAYXJuLmFl
	#U6025-146102220896 BSIU2505935-Remitance Advise.xlsx	Get hash	malicious	FormBook	Browse	www.firstflightmdelivery.services/inug/?LJBd06wP=my5vzthd/gf6h+YfXGHF51EmCUBukXLQvdzfbkPp7mscRjHMsb7qcEfg2/kZIm7kG7WZ0g==&-ZcxnF=8p74g4BxA
	jun.exe	Get hash	malicious	AZORult	Browse	squerad.com/cgi-sys/suspendedpage.cgi
	Player offer.exe	Get hash	malicious	AZORult	Browse	squerad.com/frank/index.php

Domains

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context

ASNs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
HSAE	MX-6240N_20241120_124324.exe	Get hash	malicious	AgentTesla	Browse	194.36.191.196
	JGWfssorui.dll	Get hash	malicious	DanaBot	Browse	185.106.123.228
	ElTZP4yjRG.dll	Get hash	malicious	DanaBot	Browse	185.106.123.228
	H6PtrbXJ9Q.dll	Get hash	malicious	DanaBot	Browse	185.106.123.228
	Mj1o4aZG6y.dll	Get hash	malicious	DanaBot	Browse	185.106.123.228
	OYGqoSlvmi.dll	Get hash	malicious	DanaBot	Browse	185.106.123.228
	5vcrbMCVE7.dll	Get hash	malicious	DanaBot	Browse	185.106.123.228
	OD195KrzCl.dll	Get hash	malicious	DanaBot	Browse	185.106.123.228
	VKxD9FFAj0.dll	Get hash	malicious	DanaBot	Browse	185.106.123.228
	c6n1aEdVje.dll	Get hash	malicious	Unknown	Browse	185.106.123.228

Process:	C:\Users\user\Desktop\OC & PL.exe
File Type:	data
Category:	dropped
Size (bytes):	163718
Entropy (8bit):	7.955384855077709
Encrypted:	false
SSDEEP:	3072:rAXTTB9Rps8EaaDrGalSaDuWX+M7Jw92sIMui02iruQ3SBOdlVvqo9LLTdlJjpf:rWvRps0aHGa4IjX9w9v7uXzNCE7Rqo9n
MD5:	B90981FBADF1CDDC10872393192AE10E
SHA1:	FBDB49C7782ABD1EAF0F8D4EC88C4821FCBF49D5
SHA-256:	51D991457F75B96F7B4FB46DBBFD3B7E849D4E0D1F297DA70B01E7FAFDC2367F
SHA-512:	7F84F9002B9BAB6364739F9B24BBE94854B3CF751303CBF76FDA611678F1097E2CC2660F895AFB977346D18182045DA5CFFACDE2F2B710F91EE9F64FBF4018E7
Malicious:	false
Reputation:	low
Preview:	EA06.....@..).j.P.Mf.]...P.Rt...kX...:.V.X.....8.x.V......i`..T.x...u.v..........!.Pb....1.N...t..5..%.....4.Ng......M...:._..-f=p.Q`.mB3...@......4J...A.Sf.jh..+.y..kx..4u..b.B..%...N.....[WZ.b.@.........EN......J...$..].aj..P.........{2..xd.;.......El.{...>...<..y6..@....n.h... .b.....k..\|jc.....\|....h........<\|.!.j."..k2jUj..........K\|...:$.i....?.:k~.x)...#.....J]<.X..+.. ....=.G.....6...H..s.mEKoF..+._..{..\..Y.oq..D.......Ii....-U.\|9.Z.3....qTy...`<.(\|.!.Wl.+-V_...\\>),..04Y.._..z.6.t.....=............'.....I..El.J.3.\n.$.N.M+SH..u[..G...s.....S...Uy.3....l....=..`.@.D..H..i..."...O.4....5..$...$....x.......O.<...p.x....n....s\.....^vu.'...]9.L.}...dv..;.!.Ds...o.F..(Q.<#.....38..A..U...u..\.UjT..*k.....o...Q..i.Y.f.m._.....{v..-\......jl.d.....;j..v...x....mk..x.!..V9..Ek...Mlr.\.E5.O'..]^.7..j68.......Y...+t.R.[...o.x.Q....;.....WyL.g'...8........&.K...s.......\|:}........@...;.Q&t.T\|....8Y.vg-........_Q..@-..&.A.Dnr..^.S...........@..-..R

C:\Users\user\AppData\Local\Temp\immortaliser

Download File

Process:	C:\Users\user\Desktop\OC & PL.exe
File Type:	data
Category:	modified
Size (bytes):	244224
Entropy (8bit):	6.972874067264847
Encrypted:	false
SSDEEP:	6144:btKkuOp0JSazEuauTmMfrUbY0IeJeMsM64D6Xoyr9C:btGOi7AunT2INq646TQ
MD5:	9C4BD7A05C2C12AF4FC523D8C345E609
SHA1:	4D5EF0EFB4B921697D55A05F75A94FFEBA25508B
SHA-256:	8AF0BDE81D66507A5D12DE5D375445EB3D95AED788D2252AD576FD1A45D7C0CA
SHA-512:	3B89A5A7A92988DF9E688F2582BC357D3D0D99A711E62F20FEACC0D7E4569C2841D209292A359785B1692A8AF3A6518317E0739C89850C125FE6567B592B9E77
Malicious:	false
Reputation:	low
Preview:	...B4ZAPJ56E..NP.HSI925X.O4CYUUXOB7ZAPN56EJZNPPHSI925XKO4CYU.XOB9E.^N.?.k.O..i.!PA.(9 S188u;.,Y55p,P.7?4n9>h..j.X7/.NT_qXOB7ZAP.p6E.[MP..-925XKO4C.UWYDC.ZA.M56MJZNPPH].:25xKO4.ZUUX.B7zAPN76ENZNPPHSI=25XKO4CYuQXO@7ZAPN54E..NP@HSY925X[O4SYUUXOB'ZAPN56EJZNP.PIj25XK.7C.PUXOB7ZAPN56EJZNPPHSI=29XKO4CYUUXOB7ZAPN56EJZNPPHSI925XKO4CYUUXOB7ZAPN56EJZNpPH[I925XKO4CYU]xOB.ZAPN56EJZNP~<61M25X_.7CYuUXO.4ZARN56EJZNPPHSI92.XK/.1'6XOBq_APN.5EJ\NPP.PI925XKO4CYUUX.B7.o"+YY&JZBPPHSI=25ZKO4.ZUUXOB7ZAPN56E.ZN.PHSI925XKO4CYUUX..4ZAPN5~EJZLPUH..;2%.KO7CYUTXOD7ZAPN56EJZNPPHSI925XKO4CYUUXOB7ZAPN56EJZNPPHSI92(.....k.%qHU].v.R.F..]..1..6s .0[....X....f%H..E.U~..Z....-.G1:X.....:J!@]e2eU/.M......,...E7./...Ih.>H..l...vs...u=A....7..67"lV1<+.e$,;<9.J.H925X........&:\|.lSA+.W2.....g[Ad...JCYU1XOBEZAP/56E.ZNP?HSIW25X5O4C'UUX.B7Z.PN5.EJZkPPH>I92.XKOJCYU.%@M..9=..EJZNPe..y._.....t..n>.I.#h...!....U..FQ.B....W.3.. .Vm{nBK\JUROWJ5.;....b[QQ]ME3YMm@~..{.v.j..D..g9.)UXOB7Z.PN.6EJ..P.HSI.2.X..4CY.X.B.Z...5

Static File Info

General

File type:	PE32 executable (GUI) Intel 80386, for MS Windows
Entropy (8bit):	6.778176200844999
TrID:	Win32 Executable (generic) a (10002005/4) 99.96% Generic Win/DOS Executable (2004/3) 0.02% DOS Executable Generic (2002/1) 0.02% Autodesk FLIC Image File (extensions: flc, fli, cel) (7/3) 0.00%
File name:	OC & PL.exe
File size:	1'225'216 bytes
MD5:	c6a534ee57dee61cb20b631d697a6a09
SHA1:	e9f122b4daf12299d0a55e6e51801b386063ed61
SHA256:	ad4cfc06bad357de4ab58c9c01bc2e7015fd1944e35a206ef8b053611119f04f
SHA512:	74fb83e33ddc07dba47045674747d40d56aeb1e511cc6d5217d86967c1c6e169fd46e0b49e0dd2ce97799b7bf01170f4567becd2b857300869403cb952726e1b
SSDEEP:	24576:+tb20pkaCqT5TBWgNQ7aujW8l3JCQz6A:rVg5tQ7aujd7p5
TLSH:	6B45AC1263FECF60C7725273BA15B711AE7F7C2506A1B85B2F98393CAD30521521E6A3
File Content Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........d..............'.a.....H.k.....H.h.....H.i......}%......}5...............~.......k.......o.......1.......j.....Rich...........

File Icon


Icon Hash:	07d8d8d4d4d85106

Static PE Info

General

Entrypoint:	0x425f74
Entrypoint Section:	.text
Digitally signed:	false
Imagebase:	0x400000
Subsystem:	windows gui
Image File Characteristics:	EXECUTABLE_IMAGE, LARGE_ADDRESS_AWARE, 32BIT_MACHINE
DLL Characteristics:	DYNAMIC_BASE, TERMINAL_SERVER_AWARE
Time Stamp:	0x673DC066 [Wed Nov 20 10:56:38 2024 UTC]
TLS Callbacks:
CLR (.Net) Version:
OS Version Major:	5
OS Version Minor:	1
File Version Major:	5
File Version Minor:	1
Subsystem Version Major:	5
Subsystem Version Minor:	1
Import Hash:	3d95adbf13bbe79dc24dccb401c12091

Entrypoint Preview

Instruction
call 00007FD6948BCADFh
jmp 00007FD6948AFAF4h
int3
int3
push edi
push esi
mov esi, dword ptr [esp+10h]
mov ecx, dword ptr [esp+14h]
mov edi, dword ptr [esp+0Ch]
mov eax, ecx
mov edx, ecx
add eax, esi
cmp edi, esi
jbe 00007FD6948AFC7Ah
cmp edi, eax
jc 00007FD6948AFFDEh
bt dword ptr [004C0158h], 01h
jnc 00007FD6948AFC79h
rep movsb
jmp 00007FD6948AFF8Ch
cmp ecx, 00000080h
jc 00007FD6948AFE44h
mov eax, edi
xor eax, esi
test eax, 0000000Fh
jne 00007FD6948AFC80h
bt dword ptr [004BA370h], 01h
jc 00007FD6948B0150h
bt dword ptr [004C0158h], 00000000h
jnc 00007FD6948AFE1Dh
test edi, 00000003h
jne 00007FD6948AFE2Eh
test esi, 00000003h
jne 00007FD6948AFE0Dh
bt edi, 02h
jnc 00007FD6948AFC7Fh
mov eax, dword ptr [esi]
sub ecx, 04h
lea esi, dword ptr [esi+04h]
mov dword ptr [edi], eax
lea edi, dword ptr [edi+04h]
bt edi, 03h
jnc 00007FD6948AFC83h
movq xmm1, qword ptr [esi]
sub ecx, 08h
lea esi, dword ptr [esi+08h]
movq qword ptr [edi], xmm1
lea edi, dword ptr [edi+08h]
test esi, 00000007h
je 00007FD6948AFCD5h
bt esi, 03h
jnc 00007FD6948AFD28h
movdqa xmm1, dqword ptr [esi+00h]

Rich Headers

Programming Language:

[ C ] VS2008 SP1 build 30729
[IMP] VS2008 SP1 build 30729
[ASM] VS2012 UPD4 build 61030
[RES] VS2012 UPD4 build 61030
[LNK] VS2012 UPD4 build 61030

Data Directories

Name	Virtual Address	Virtual Size	Is in Section
IMAGE_DIRECTORY_ENTRY_EXPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IMPORT	0xb7004	0x17c	.rdata
IMAGE_DIRECTORY_ENTRY_RESOURCE	0xc4000	0x62174	.rsrc
IMAGE_DIRECTORY_ENTRY_EXCEPTION	0x0	0x0
IMAGE_DIRECTORY_ENTRY_SECURITY	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BASERELOC	0x127000	0x6c4c	.reloc
IMAGE_DIRECTORY_ENTRY_DEBUG	0x8d8d0	0x1c	.rdata
IMAGE_DIRECTORY_ENTRY_COPYRIGHT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_GLOBALPTR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_TLS	0x0	0x0
IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG	0xb2730	0x40	.rdata
IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IAT	0x8d000	0x860	.rdata
IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_RESERVED	0x0	0x0

Sections

Name	Virtual Address	Virtual Size	Raw Size	MD5	Xored PE	ZLIB Complexity	File Type	Entropy	Characteristics
.text	0x1000	0x8b54f	0x8b600	f437a6545e938612764dbb0a314376fc	False	0.5699499019058296	data	6.680413749210956	IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
.rdata	0x8d000	0x2cc42	0x2ce00	827ffd24759e8e420890ecf164be989e	False	0.330464397632312	data	5.770192333189168	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.data	0xba000	0x9d54	0x6200	e0a519f8e3a35fae0d9c2cfd5a4bacfc	False	0.16402264030612246	data	2.002691099965349	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.rsrc	0xc4000	0x62174	0x62200	5654feef0c8ea4f5469c5450cb848a45	False	0.5883011544585988	data	6.493435156242143	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.reloc	0x127000	0xa474	0xa600	0bc98f8631ef0bde830a7f83bb06ff08	False	0.5017884036144579	data	5.245426654116355	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_READ

Resources

Name	RVA	Size	Type	Language	Country	ZLIB Complexity
RT_ICON	0xc45d8	0x128	Device independent bitmap graphic, 16 x 32 x 4, image size 192	English	Great Britain	0.7466216216216216
RT_ICON	0xc4700	0x128	Device independent bitmap graphic, 16 x 32 x 4, image size 128, 16 important colors	English	Great Britain	0.3277027027027027
RT_ICON	0xc4828	0x128	Device independent bitmap graphic, 16 x 32 x 4, image size 192	English	Great Britain	0.3885135135135135
RT_ICON	0xc4950	0xce8	PNG image data, 256 x 256, 8-bit/color RGBA, non-interlaced	English	Great Britain	0.8692493946731235
RT_ICON	0xc5638	0x10828	Device independent bitmap graphic, 128 x 256 x 32, image size 67584	English	Great Britain	0.027046610670767773
RT_ICON	0xd5e60	0x94a8	Device independent bitmap graphic, 96 x 192 x 32, image size 38016	English	Great Britain	0.021967626655455118
RT_ICON	0xdf308	0x5488	Device independent bitmap graphic, 72 x 144 x 32, image size 21600	English	Great Britain	0.03525878003696858
RT_ICON	0xe4790	0x4228	Device independent bitmap graphic, 64 x 128 x 32, image size 16896	English	Great Britain	0.03442371280113368
RT_ICON	0xe89b8	0x25a8	Device independent bitmap graphic, 48 x 96 x 32, image size 9600	English	Great Britain	0.04854771784232365
RT_ICON	0xeaf60	0x10a8	Device independent bitmap graphic, 32 x 64 x 32, image size 4224	English	Great Britain	0.0675422138836773
RT_ICON	0xec008	0x988	Device independent bitmap graphic, 24 x 48 x 32, image size 2400	English	Great Britain	0.12704918032786885
RT_ICON	0xec990	0x468	Device independent bitmap graphic, 16 x 32 x 32, image size 1088	English	Great Britain	0.17464539007092197
RT_MENU	0xecdf8	0x50	data	English	Great Britain	0.9
RT_STRING	0xece48	0x594	data	English	Great Britain	0.3333333333333333
RT_STRING	0xed3dc	0x68a	data	English	Great Britain	0.2747909199522103
RT_STRING	0xeda68	0x490	data	English	Great Britain	0.3715753424657534
RT_STRING	0xedef8	0x5fc	data	English	Great Britain	0.3087467362924282
RT_STRING	0xee4f4	0x65c	data	English	Great Britain	0.34336609336609336
RT_STRING	0xeeb50	0x466	data	English	Great Britain	0.3605683836589698
RT_STRING	0xeefb8	0x158	Matlab v4 mat-file (little endian) n, numeric, rows 0, columns 0	English	Great Britain	0.502906976744186
RT_RCDATA	0xef110	0x36b17	data			1.00033925088049
RT_GROUP_ICON	0x125c28	0x84	data	English	Great Britain	0.7348484848484849
RT_GROUP_ICON	0x125cac	0x14	data	English	Great Britain	1.25
RT_GROUP_ICON	0x125cc0	0x14	data	English	Great Britain	1.15
RT_GROUP_ICON	0x125cd4	0x14	data	English	Great Britain	1.25
RT_VERSION	0x125ce8	0xdc	data	English	Great Britain	0.6181818181818182
RT_MANIFEST	0x125dc4	0x3b0	ASCII text, with CRLF line terminators	English	Great Britain	0.5116525423728814

Imports

DLL	Import
WSOCK32.dll	__WSAFDIsSet, recv, send, setsockopt, ntohs, recvfrom, select, WSAStartup, htons, accept, listen, bind, closesocket, connect, WSACleanup, ioctlsocket, sendto, WSAGetLastError, inet_addr, gethostbyname, gethostname, socket
VERSION.dll	GetFileVersionInfoW, VerQueryValueW, GetFileVersionInfoSizeW
WINMM.dll	timeGetTime, waveOutSetVolume, mciSendStringW
COMCTL32.dll	ImageList_Destroy, ImageList_Remove, ImageList_SetDragCursorImage, ImageList_BeginDrag, ImageList_DragEnter, ImageList_DragLeave, ImageList_EndDrag, ImageList_DragMove, ImageList_Create, InitCommonControlsEx, ImageList_ReplaceIcon
MPR.dll	WNetUseConnectionW, WNetCancelConnection2W, WNetGetConnectionW, WNetAddConnection2W
WININET.dll	InternetReadFile, InternetCloseHandle, InternetOpenW, InternetSetOptionW, InternetCrackUrlW, HttpQueryInfoW, InternetQueryOptionW, HttpOpenRequestW, HttpSendRequestW, FtpOpenFileW, FtpGetFileSize, InternetOpenUrlW, InternetConnectW, InternetQueryDataAvailable
PSAPI.DLL	GetProcessMemoryInfo
IPHLPAPI.DLL	IcmpCreateFile, IcmpCloseHandle, IcmpSendEcho
USERENV.dll	UnloadUserProfile, DestroyEnvironmentBlock, CreateEnvironmentBlock, LoadUserProfileW
UxTheme.dll	IsThemeActive
KERNEL32.dll	HeapAlloc, GetProcessHeap, HeapFree, Sleep, GetCurrentThreadId, MultiByteToWideChar, MulDiv, GetVersionExW, GetSystemInfo, FreeLibrary, LoadLibraryA, GetProcAddress, SetErrorMode, GetModuleFileNameW, WideCharToMultiByte, lstrcpyW, lstrlenW, GetModuleHandleW, QueryPerformanceCounter, VirtualFreeEx, OpenProcess, VirtualAllocEx, WriteProcessMemory, ReadProcessMemory, CreateFileW, SetFilePointerEx, ReadFile, WriteFile, FlushFileBuffers, TerminateProcess, CreateToolhelp32Snapshot, Process32FirstW, Process32NextW, SetFileTime, GetFileAttributesW, FindFirstFileW, FindClose, GetLongPathNameW, GetCurrentThread, FindNextFileW, MoveFileW, CopyFileW, CreateDirectoryW, RemoveDirectoryW, SetSystemPowerState, QueryPerformanceFrequency, FindResourceW, LoadResource, LockResource, SizeofResource, EnumResourceNamesW, OutputDebugStringW, GetTempPathW, GetTempFileNameW, DeviceIoControl, GetLocalTime, CompareStringW, DeleteCriticalSection, WaitForSingleObject, LeaveCriticalSection, GetStdHandle, CreatePipe, InterlockedExchange, TerminateThread, LoadLibraryExW, FindResourceExW, VirtualFree, FormatMessageW, GetExitCodeProcess, GetPrivateProfileStringW, WritePrivateProfileStringW, GetPrivateProfileSectionW, WritePrivateProfileSectionW, GetPrivateProfileSectionNamesW, FileTimeToLocalFileTime, FileTimeToSystemTime, SystemTimeToFileTime, LocalFileTimeToFileTime, GetDriveTypeW, GetDiskFreeSpaceExW, GetDiskFreeSpaceW, GetVolumeInformationW, SetVolumeLabelW, CreateHardLinkW, SetFileAttributesW, GetShortPathNameW, CreateEventW, SetEvent, GetEnvironmentVariableW, SetEnvironmentVariableW, GlobalLock, GlobalUnlock, GlobalAlloc, GetFileSize, GlobalFree, GlobalMemoryStatusEx, Beep, GetSystemDirectoryW, GetComputerNameW, GetWindowsDirectoryW, GetCurrentProcessId, GetProcessIoCounters, CreateProcessW, SetPriorityClass, LoadLibraryW, VirtualAlloc, CloseHandle, GetLastError, GetFullPathNameW, SetCurrentDirectoryW, IsDebuggerPresent, GetCurrentDirectoryW, lstrcmpiW, RaiseException, InitializeCriticalSectionAndSpinCount, InterlockedDecrement, InterlockedIncrement, CreateThread, DuplicateHandle, EnterCriticalSection, GetCurrentProcess, ExitProcess, GetModuleHandleExW, ExitThread, GetSystemTimeAsFileTime, ResumeThread, GetCommandLineW, IsProcessorFeaturePresent, HeapSize, IsValidCodePage, GetACP, GetOEMCP, GetCPInfo, SetLastError, UnhandledExceptionFilter, SetUnhandledExceptionFilter, TlsAlloc, TlsGetValue, TlsSetValue, TlsFree, GetStartupInfoW, GetStringTypeW, SetStdHandle, GetFileType, GetConsoleCP, GetConsoleMode, RtlUnwind, ReadConsoleW, SetFilePointer, GetTimeZoneInformation, GetDateFormatW, GetTimeFormatW, LCMapStringW, GetEnvironmentStringsW, FreeEnvironmentStringsW, HeapReAlloc, WriteConsoleW, SetEndOfFile, DeleteFileW, SetEnvironmentVariableA
USER32.dll	SetWindowPos, GetCursorInfo, RegisterHotKey, ClientToScreen, GetKeyboardLayoutNameW, IsCharAlphaW, IsCharAlphaNumericW, IsCharLowerW, IsCharUpperW, GetMenuStringW, GetSubMenu, GetCaretPos, IsZoomed, MonitorFromPoint, GetMonitorInfoW, SetWindowLongW, SetLayeredWindowAttributes, FlashWindow, GetClassLongW, TranslateAcceleratorW, IsDialogMessageW, GetSysColor, InflateRect, DrawFocusRect, DrawTextW, FrameRect, DrawFrameControl, FillRect, PtInRect, DestroyAcceleratorTable, CreateAcceleratorTableW, SetCursor, GetWindowDC, GetSystemMetrics, DrawMenuBar, GetActiveWindow, CharNextW, wsprintfW, RedrawWindow, DestroyMenu, SetMenu, GetWindowTextLengthW, CreateMenu, IsDlgButtonChecked, DefDlgProcW, CallWindowProcW, ReleaseCapture, SetCapture, MonitorFromRect, LoadImageW, CreateIconFromResourceEx, mouse_event, ExitWindowsEx, SetActiveWindow, FindWindowExW, EnumThreadWindows, SetMenuDefaultItem, InsertMenuItemW, IsMenu, TrackPopupMenuEx, GetCursorPos, CopyImage, CheckMenuRadioItem, GetMenuItemID, GetMenuItemCount, SetMenuItemInfoW, GetMenuItemInfoW, SetForegroundWindow, IsIconic, FindWindowW, UnregisterHotKey, keybd_event, SendInput, GetAsyncKeyState, SetKeyboardState, GetKeyboardState, GetKeyState, VkKeyScanW, LoadStringW, DialogBoxParamW, MessageBeep, EndDialog, SendDlgItemMessageW, GetDlgItem, SetWindowTextW, CopyRect, ReleaseDC, GetDC, EndPaint, BeginPaint, GetClientRect, GetMenu, DestroyWindow, EnumWindows, GetDesktopWindow, IsWindow, IsWindowEnabled, IsWindowVisible, EnableWindow, InvalidateRect, GetWindowLongW, GetWindowThreadProcessId, AttachThreadInput, GetFocus, ScreenToClient, SendMessageTimeoutW, EnumChildWindows, CharUpperBuffW, GetClassNameW, GetParent, GetDlgCtrlID, SendMessageW, MapVirtualKeyW, PostMessageW, GetWindowRect, SetUserObjectSecurity, CloseDesktop, CloseWindowStation, OpenDesktopW, SetProcessWindowStation, GetProcessWindowStation, OpenWindowStationW, GetUserObjectSecurity, AdjustWindowRectEx, SetRect, SetClipboardData, EmptyClipboard, CountClipboardFormats, CloseClipboard, GetClipboardData, IsClipboardFormatAvailable, OpenClipboard, BlockInput, GetMessageW, LockWindowUpdate, DispatchMessageW, TranslateMessage, DeleteMenu, PeekMessageW, MessageBoxW, DefWindowProcW, MoveWindow, SetFocus, PostQuitMessage, KillTimer, CreatePopupMenu, RegisterWindowMessageW, SetTimer, ShowWindow, CreateWindowExW, RegisterClassExW, LoadIconW, LoadCursorW, GetSysColorBrush, GetForegroundWindow, MessageBoxA, DestroyIcon, SystemParametersInfoW, CharLowerBuffW, GetWindowTextW
GDI32.dll	SetPixel, DeleteObject, GetTextExtentPoint32W, ExtCreatePen, StrokeAndFillPath, StrokePath, GetDeviceCaps, CloseFigure, LineTo, AngleArc, CreateCompatibleBitmap, CreateCompatibleDC, MoveToEx, Ellipse, PolyDraw, BeginPath, SelectObject, StretchBlt, GetDIBits, DeleteDC, GetPixel, CreateDCW, GetStockObject, Rectangle, SetViewportOrgEx, GetObjectW, SetBkMode, RoundRect, SetBkColor, CreatePen, CreateSolidBrush, SetTextColor, CreateFontW, GetTextFaceW, EndPath
COMDLG32.dll	GetSaveFileNameW, GetOpenFileNameW
ADVAPI32.dll	GetAclInformation, RegEnumValueW, RegDeleteValueW, RegDeleteKeyW, RegEnumKeyExW, RegSetValueExW, RegCreateKeyExW, GetUserNameW, RegOpenKeyExW, RegCloseKey, RegQueryValueExW, RegConnectRegistryW, InitializeSecurityDescriptor, InitializeAcl, AdjustTokenPrivileges, OpenThreadToken, OpenProcessToken, LookupPrivilegeValueW, DuplicateTokenEx, CreateProcessAsUserW, CreateProcessWithLogonW, GetLengthSid, CopySid, InitiateSystemShutdownExW, LogonUserW, AllocateAndInitializeSid, CheckTokenMembership, FreeSid, GetTokenInformation, GetSecurityDescriptorDacl, SetSecurityDescriptorDacl, AddAce, GetAce
SHELL32.dll	DragQueryPoint, ShellExecuteExW, DragQueryFileW, SHEmptyRecycleBinW, SHGetPathFromIDListW, SHBrowseForFolderW, SHCreateShellItem, SHGetDesktopFolder, SHGetSpecialFolderLocation, SHGetFolderPathW, SHFileOperationW, ExtractIconExW, Shell_NotifyIconW, ShellExecuteW, DragFinish
ole32.dll	CoTaskMemAlloc, CoTaskMemFree, CLSIDFromString, ProgIDFromCLSID, CLSIDFromProgID, OleSetMenuDescriptor, MkParseDisplayName, OleSetContainedObject, CoCreateInstance, IIDFromString, StringFromGUID2, CreateStreamOnHGlobal, CoInitialize, CoUninitialize, GetRunningObjectTable, CoGetInstanceFromFile, CoGetObject, CoInitializeSecurity, CoCreateInstanceEx, CoSetProxyBlanket
OLEAUT32.dll	RegisterTypeLib, LoadTypeLibEx, VariantCopyInd, SysReAllocString, SysFreeString, SafeArrayDestroyDescriptor, SafeArrayDestroyData, SafeArrayUnaccessData, SafeArrayAccessData, SafeArrayAllocData, UnRegisterTypeLib, SafeArrayCreateVector, SysAllocString, SysStringLen, VariantTimeToSystemTime, VarR8FromDec, SafeArrayGetVartype, OleLoadPicture, QueryPathOfRegTypeLib, VariantCopy, VariantClear, CreateDispTypeInfo, CreateStdDispatch, DispCallFunc, VariantChangeType, SafeArrayAllocDescriptorEx, VariantInit

Possible Origin

Language of compilation system	Country where language is spoken	Map
English	Great Britain

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Nov 21, 2024 09:08:47.421252966 CET	49701	587	192.168.2.7	194.36.191.196
Nov 21, 2024 09:08:47.540781975 CET	587	49701	194.36.191.196	192.168.2.7
Nov 21, 2024 09:08:47.540947914 CET	49701	587	192.168.2.7	194.36.191.196
Nov 21, 2024 09:08:48.919624090 CET	587	49701	194.36.191.196	192.168.2.7
Nov 21, 2024 09:08:48.920730114 CET	49701	587	192.168.2.7	194.36.191.196
Nov 21, 2024 09:08:49.040313005 CET	587	49701	194.36.191.196	192.168.2.7
Nov 21, 2024 09:08:49.331487894 CET	587	49701	194.36.191.196	192.168.2.7
Nov 21, 2024 09:08:49.331691027 CET	49701	587	192.168.2.7	194.36.191.196
Nov 21, 2024 09:08:49.451253891 CET	587	49701	194.36.191.196	192.168.2.7
Nov 21, 2024 09:08:49.743297100 CET	587	49701	194.36.191.196	192.168.2.7
Nov 21, 2024 09:08:49.753537893 CET	49701	587	192.168.2.7	194.36.191.196
Nov 21, 2024 09:08:49.873250008 CET	587	49701	194.36.191.196	192.168.2.7
Nov 21, 2024 09:08:50.175296068 CET	587	49701	194.36.191.196	192.168.2.7
Nov 21, 2024 09:08:50.175334930 CET	587	49701	194.36.191.196	192.168.2.7
Nov 21, 2024 09:08:50.175348997 CET	587	49701	194.36.191.196	192.168.2.7
Nov 21, 2024 09:08:50.175451994 CET	49701	587	192.168.2.7	194.36.191.196
Nov 21, 2024 09:08:50.375849009 CET	587	49701	194.36.191.196	192.168.2.7
Nov 21, 2024 09:08:50.414593935 CET	49701	587	192.168.2.7	194.36.191.196
Nov 21, 2024 09:08:50.535255909 CET	587	49701	194.36.191.196	192.168.2.7
Nov 21, 2024 09:08:50.826141119 CET	587	49701	194.36.191.196	192.168.2.7
Nov 21, 2024 09:08:50.842672110 CET	49701	587	192.168.2.7	194.36.191.196
Nov 21, 2024 09:08:50.962357998 CET	587	49701	194.36.191.196	192.168.2.7
Nov 21, 2024 09:08:51.253616095 CET	587	49701	194.36.191.196	192.168.2.7
Nov 21, 2024 09:08:51.254801035 CET	49701	587	192.168.2.7	194.36.191.196
Nov 21, 2024 09:08:51.374720097 CET	587	49701	194.36.191.196	192.168.2.7
Nov 21, 2024 09:08:51.665292978 CET	587	49701	194.36.191.196	192.168.2.7
Nov 21, 2024 09:08:51.666404009 CET	49701	587	192.168.2.7	194.36.191.196
Nov 21, 2024 09:08:51.786089897 CET	587	49701	194.36.191.196	192.168.2.7
Nov 21, 2024 09:08:52.194931030 CET	587	49701	194.36.191.196	192.168.2.7
Nov 21, 2024 09:08:52.195398092 CET	49701	587	192.168.2.7	194.36.191.196
Nov 21, 2024 09:08:52.314877987 CET	587	49701	194.36.191.196	192.168.2.7
Nov 21, 2024 09:08:52.605811119 CET	587	49701	194.36.191.196	192.168.2.7
Nov 21, 2024 09:08:52.606214046 CET	49701	587	192.168.2.7	194.36.191.196
Nov 21, 2024 09:08:52.726402998 CET	587	49701	194.36.191.196	192.168.2.7
Nov 21, 2024 09:08:53.024713039 CET	587	49701	194.36.191.196	192.168.2.7
Nov 21, 2024 09:08:53.025101900 CET	49701	587	192.168.2.7	194.36.191.196
Nov 21, 2024 09:08:53.144629955 CET	587	49701	194.36.191.196	192.168.2.7
Nov 21, 2024 09:08:53.435283899 CET	587	49701	194.36.191.196	192.168.2.7
Nov 21, 2024 09:08:53.436131001 CET	49701	587	192.168.2.7	194.36.191.196
Nov 21, 2024 09:08:53.436309099 CET	49701	587	192.168.2.7	194.36.191.196
Nov 21, 2024 09:08:53.436309099 CET	49701	587	192.168.2.7	194.36.191.196
Nov 21, 2024 09:08:53.436309099 CET	49701	587	192.168.2.7	194.36.191.196
Nov 21, 2024 09:08:53.555692911 CET	587	49701	194.36.191.196	192.168.2.7
Nov 21, 2024 09:08:53.555758953 CET	587	49701	194.36.191.196	192.168.2.7
Nov 21, 2024 09:08:53.555939913 CET	587	49701	194.36.191.196	192.168.2.7
Nov 21, 2024 09:08:53.555991888 CET	587	49701	194.36.191.196	192.168.2.7
Nov 21, 2024 09:08:53.962784052 CET	587	49701	194.36.191.196	192.168.2.7
Nov 21, 2024 09:08:54.017200947 CET	49701	587	192.168.2.7	194.36.191.196
Nov 21, 2024 09:10:26.486879110 CET	49701	587	192.168.2.7	194.36.191.196
Nov 21, 2024 09:10:26.606595993 CET	587	49701	194.36.191.196	192.168.2.7
Nov 21, 2024 09:10:26.898158073 CET	587	49701	194.36.191.196	192.168.2.7
Nov 21, 2024 09:10:26.902350903 CET	49701	587	192.168.2.7	194.36.191.196

UDP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Nov 21, 2024 09:08:46.471668005 CET	57674	53	192.168.2.7	1.1.1.1
Nov 21, 2024 09:08:47.412620068 CET	53	57674	1.1.1.1	192.168.2.7

DNS Queries

Timestamp	Source IP	Dest IP	Trans ID	OP Code	Name	Type	Class	DNS over HTTPS
Nov 21, 2024 09:08:46.471668005 CET	192.168.2.7	1.1.1.1	0x25ae	Standard query (0)	mail.agaliofu.top	A (IP address)	IN (0x0001)	false

DNS Answers

Timestamp	Source IP	Dest IP	Trans ID	Reply Code	Name	CName	Address	Type	Class	DNS over HTTPS
Nov 21, 2024 09:08:47.412620068 CET	1.1.1.1	192.168.2.7	0x25ae	No error (0)	mail.agaliofu.top	agaliofu.top		CNAME (Canonical name)	IN (0x0001)	false
Nov 21, 2024 09:08:47.412620068 CET	1.1.1.1	192.168.2.7	0x25ae	No error (0)	agaliofu.top		194.36.191.196	A (IP address)	IN (0x0001)	false

SMTP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP	Commands
Nov 21, 2024 09:08:48.919624090 CET	587	49701	194.36.191.196	192.168.2.7	220-hosting1.nl.hostsailor.com ESMTP Exim 4.96.2 #2 Thu, 21 Nov 2024 09:08:48 +0100 220-We do not authorize the use of this system to transport unsolicited, 220 and/or bulk e-mail.
Nov 21, 2024 09:08:48.920730114 CET	49701	587	192.168.2.7	194.36.191.196	EHLO 445817
Nov 21, 2024 09:08:49.331487894 CET	587	49701	194.36.191.196	192.168.2.7	250-hosting1.nl.hostsailor.com Hello 445817 [8.46.123.75] 250-SIZE 52428800 250-8BITMIME 250-PIPELINING 250-PIPECONNECT 250-STARTTLS 250 HELP
Nov 21, 2024 09:08:49.331691027 CET	49701	587	192.168.2.7	194.36.191.196	STARTTLS
Nov 21, 2024 09:08:49.743297100 CET	587	49701	194.36.191.196	192.168.2.7	220 TLS go ahead

Target ID:	0
Start time:	03:08:41
Start date:	21/11/2024
Path:	C:\Users\user\Desktop\OC & PL.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\Desktop\OC & PL.exe"
Imagebase:	0x700000
File size:	1'225'216 bytes
MD5 hash:	C6A534EE57DEE61CB20B631D697A6A09
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_AgentTesla_2, Description: Yara detected AgentTesla, Source: 00000000.00000002.1281202457.0000000000670000.00000004.00001000.00020000.00000000.sdmp, Author: Joe Security
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	5
Start time:	03:08:43
Start date:	21/11/2024
Path:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\Desktop\OC & PL.exe"
Imagebase:	0x680000
File size:	45'984 bytes
MD5 hash:	9D352BC46709F0CB5EC974633A0C3C94
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_AgentTesla_1, Description: Yara detected AgentTesla, Source: 00000005.00000002.2505480865.0000000002B83000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_AgentTesla_1, Description: Yara detected AgentTesla, Source: 00000005.00000002.2505480865.0000000002B57000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_AgentTesla_2, Description: Yara detected AgentTesla, Source: 00000005.00000002.2502890497.0000000000402000.00000040.80000000.00040000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 00000005.00000002.2505480865.0000000002B01000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_AgentTesla_1, Description: Yara detected AgentTesla, Source: 00000005.00000002.2505480865.0000000002B01000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security
Reputation:	high
Has exited:	false

Show Windows behavior

Execution Graph

Execution Coverage:	4.2%
Dynamic/Decrypted Code Coverage:	1.5%
Signature Coverage:	6.4%
Total number of Nodes:	2000
Total number of Limit Nodes:	165

Executed Functions

Function 0072B043 Relevance: 21.5, APIs: 14, Instructions: 537
COMMONLIBRARYCODE

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Memory Dump Source

Source File: 00000000.00000002.1281263787.0000000000701000.00000020.00000001.01000000.00000003.sdmp, Offset: 00700000, based on PE: true

Associated: 00000000.00000002.1281243473.0000000000700000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1281360671.000000000078D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1281360671.00000000007AE000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1281496264.00000000007BA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1281529307.00000000007C4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1281529307.00000000007C7000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1281529307.00000000007D5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1281529307.00000000007D7000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_700000_OC & PL.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5e3c613bfe8a9bdca4a8e8b9edaa447cc46305026f91e34e24e2dc5481d85e05
Instruction ID: c6705261312931ad935da9fb4947a2449fc61fdb20c6ccb7835576f41c2383b8
Opcode Fuzzy Hash: 5e3c613bfe8a9bdca4a8e8b9edaa447cc46305026f91e34e24e2dc5481d85e05
Instruction Fuzzy Hash: 29324F75A02268CBDB24DF54EC85AE9B7B5FF46310F1441D9E40AA7A81D7389E80CF92

Function 00703D19 Relevance: 19.4, APIs: 8, Strings: 3, Instructions: 151
windowCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetCurrentDirectoryW.KERNEL32(00007FFF,?,00000000,00000001,?,?,00703AA3,?), ref: 00703D45
IsDebuggerPresent.KERNEL32(?,?,?,?,00703AA3,?), ref: 00703D57
GetFullPathNameW.KERNEL32(00007FFF,?,?,007C1148,007C1130,?,?,?,?,00703AA3,?), ref: 00703DC8

Part of subcall function 00706430: GetFullPathNameW.KERNEL32(?,00007FFF,?,?,?,00703DEE,007C1148,?,?,?,?,?,00703AA3,?), ref: 00706471

SetCurrentDirectoryW.KERNEL32(?,?,?,00703AA3,?), ref: 00703E48
MessageBoxA.USER32(00000000,This is a third-party compiled AutoIt script.,007B28F4,00000010), ref: 00771CCE
SetCurrentDirectoryW.KERNEL32(?,007C1148,?,?,?,?,?,00703AA3,?), ref: 00771D06
GetForegroundWindow.USER32(runas,?,?,?,00000001,?,0079DAB4,007C1148,?,?,?,?,?,00703AA3,?), ref: 00771D89
ShellExecuteW.SHELL32(00000000,?,?,?,?,00703AA3), ref: 00771D90

Part of subcall function 00703E6E: GetSysColorBrush.USER32(0000000F), ref: 00703E79
Part of subcall function 00703E6E: LoadCursorW.USER32(00000000,00007F00), ref: 00703E88
Part of subcall function 00703E6E: LoadIconW.USER32(00000063), ref: 00703E9E
Part of subcall function 00703E6E: LoadIconW.USER32(000000A4), ref: 00703EB0
Part of subcall function 00703E6E: LoadIconW.USER32(000000A2), ref: 00703EC2
Part of subcall function 00703E6E: RegisterClassExW.USER32(?), ref: 00703F30

Part of subcall function 007036B8: CreateWindowExW.USER32(00000000,AutoIt v3,AutoIt v3,00CF0000,80000000,80000000,0000012C,00000064,00000000,00000000,00000000,00000001), ref: 007036E6
Part of subcall function 007036B8: CreateWindowExW.USER32(00000000,edit,00000000,50B008C4,00000000,00000000,00000000,00000000,00000000,00000001,00000000), ref: 00703707
Part of subcall function 007036B8: ShowWindow.USER32(00000000,?,?,?,?,00703AA3,?), ref: 0070371B
Part of subcall function 007036B8: ShowWindow.USER32(00000000,?,?,?,?,00703AA3,?), ref: 00703724

Part of subcall function 00704FFC: _memset.LIBCMT ref: 00705022
Part of subcall function 00704FFC: Shell_NotifyIconW.SHELL32(00000000,?), ref: 007050CB

Strings

(){, xrefs: 00771D49
This is a third-party compiled AutoIt script., xrefs: 00771CC8
runas, xrefs: 00771D84

Memory Dump Source

Source File: 00000000.00000002.1281263787.0000000000701000.00000020.00000001.01000000.00000003.sdmp, Offset: 00700000, based on PE: true

Associated: 00000000.00000002.1281243473.0000000000700000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1281360671.000000000078D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1281360671.00000000007AE000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1281496264.00000000007BA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1281529307.00000000007C4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1281529307.00000000007C7000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1281529307.00000000007D5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1281529307.00000000007D7000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_700000_OC & PL.jbxd

Similarity

API ID: Window$IconLoad$CurrentDirectory$CreateFullNamePathShow$BrushClassColorCursorDebuggerExecuteForegroundMessageNotifyPresentRegisterShellShell__memset
String ID: (){$This is a third-party compiled AutoIt script.$runas
API String ID: 438480954-1312010355
Opcode ID: 9748a68c9baa0679180fa231c26996ccc1b23bfb377590a851ed06d33e3c95a6
Instruction ID: 047b595118898da64eda451b20f5c5abfa7850fabbce928149fb2e51346d40b4
Opcode Fuzzy Hash: 9748a68c9baa0679180fa231c26996ccc1b23bfb377590a851ed06d33e3c95a6
Instruction Fuzzy Hash: FC51E270A0424CEBCF12ABB4DC49EEE7BB9AB06740F548378F501621D3DA6C4A458B21

Function 0071DDC0 Relevance: 10.7, APIs: 7, Instructions: 175
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetVersionExW.KERNEL32(?), ref: 0071DDEC
GetCurrentProcess.KERNEL32(00000000,0079DC38,?,?), ref: 0071DEAC
GetNativeSystemInfo.KERNELBASE(?,0079DC38,?,?), ref: 0071DF01
FreeLibrary.KERNEL32(00000000,?,?), ref: 0071DF0C
FreeLibrary.KERNEL32(00000000,?,?), ref: 0071DF1F
GetSystemInfo.KERNEL32(?,0079DC38,?,?), ref: 0071DF29
GetSystemInfo.KERNEL32(?,0079DC38,?,?), ref: 0071DF35

Memory Dump Source

Source File: 00000000.00000002.1281263787.0000000000701000.00000020.00000001.01000000.00000003.sdmp, Offset: 00700000, based on PE: true

Associated: 00000000.00000002.1281243473.0000000000700000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1281360671.000000000078D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1281360671.00000000007AE000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1281496264.00000000007BA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1281529307.00000000007C4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1281529307.00000000007C7000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1281529307.00000000007D5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1281529307.00000000007D7000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_700000_OC & PL.jbxd

Similarity

API ID: InfoSystem$FreeLibrary$CurrentNativeProcessVersion
String ID:
API String ID: 3851250370-0
Opcode ID: 9c57225ccd32fe5a2255baf6cdb25f7f36e66a7a6c8c7b29ef83cf9b6d3bd852
Instruction ID: d373829ed7b3a85f467d3d02ced0bfa3ac83564c384be68681df93ff34a54ef0
Opcode Fuzzy Hash: 9c57225ccd32fe5a2255baf6cdb25f7f36e66a7a6c8c7b29ef83cf9b6d3bd852
Instruction Fuzzy Hash: C661B3B180A3C4CBCF25CF6898C41E97FB46F29300B2985D8D8499F287C628CE49CF65

Function 0070406B Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 61
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateStreamOnHGlobal.COMBASE(00000000,00000001,?,?,?,?,?,0070449E,?,?,00000000,00000001), ref: 0070407B
FindResourceExW.KERNEL32(?,0000000A,SCRIPT,00000000,?,?,0070449E,?,?,00000000,00000001), ref: 00704092
LoadResource.KERNEL32(?,00000000,?,?,0070449E,?,?,00000000,00000001,?,?,?,?,?,?,007041FB), ref: 00774F1A
SizeofResource.KERNEL32(?,00000000,?,?,0070449E,?,?,00000000,00000001,?,?,?,?,?,?,007041FB), ref: 00774F2F
LockResource.KERNEL32(0070449E,?,?,0070449E,?,?,00000000,00000001,?,?,?,?,?,?,007041FB,00000000), ref: 00774F42

Strings

SCRIPT, xrefs: 00704088

Memory Dump Source

Source File: 00000000.00000002.1281263787.0000000000701000.00000020.00000001.01000000.00000003.sdmp, Offset: 00700000, based on PE: true

Associated: 00000000.00000002.1281243473.0000000000700000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1281360671.000000000078D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1281360671.00000000007AE000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1281496264.00000000007BA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1281529307.00000000007C4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1281529307.00000000007C7000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1281529307.00000000007D5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1281529307.00000000007D7000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_700000_OC & PL.jbxd

Similarity

API ID: Resource$CreateFindGlobalLoadLockSizeofStream
String ID: SCRIPT
API String ID: 3051347437-3967369404
Opcode ID: 7e5b9ba73b1901b723ef91c1b46e0065ae263761bd5566250529a13e7cea56ba
Instruction ID: 4b5c82c01e896a6fd38b7d10e8e1df917096c09a528f6d818a2d590adab91ab9
Opcode Fuzzy Hash: 7e5b9ba73b1901b723ef91c1b46e0065ae263761bd5566250529a13e7cea56ba
Instruction Fuzzy Hash: 57112EB1240701AFE7318B65EC48F277BB9EBC5B61F2486ACF60296290DB75DC008A30

Function 00713B70 Relevance: 5.9, Strings: 4, Instructions: 903COMMON

Download Yara Rule

Strings

|, xrefs: 007140A4
|, xrefs: 007140EC
|, xrefs: 0077701F
@, xrefs: 00714176

Memory Dump Source

Source File: 00000000.00000002.1281263787.0000000000701000.00000020.00000001.01000000.00000003.sdmp, Offset: 00700000, based on PE: true

Associated: 00000000.00000002.1281243473.0000000000700000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1281360671.000000000078D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1281360671.00000000007AE000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1281496264.00000000007BA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1281529307.00000000007C4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1281529307.00000000007C7000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1281529307.00000000007D5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1281529307.00000000007D7000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_700000_OC & PL.jbxd

Similarity

API ID: Exception@8Throwstd::exception::exception
String ID: @$ |$ |$ |
API String ID: 3728558374-3078951211
Opcode ID: 52f440d0c919a445a2c58fbe4695756158a4599494f78dd716142f6067d94c25
Instruction ID: 275b2e6bc905542bbf7e8ca202b8bf1afce4501fb4f8b6470e82b2e055425376
Opcode Fuzzy Hash: 52f440d0c919a445a2c58fbe4695756158a4599494f78dd716142f6067d94c25
Instruction Fuzzy Hash: C4729E70A04208DFCF14DF98C485AEEB7B5FF48340F14C05AE909AB291D779AE85CB91

Function 00746CA9 Relevance: 4.5, APIs: 3, Instructions: 25fileCOMMON

Download Yara Rule

APIs

GetFileAttributesW.KERNELBASE(?,00772F49), ref: 00746CB9
FindFirstFileW.KERNELBASE(?,?), ref: 00746CCA
FindClose.KERNEL32(00000000), ref: 00746CDA

Memory Dump Source

Source File: 00000000.00000002.1281263787.0000000000701000.00000020.00000001.01000000.00000003.sdmp, Offset: 00700000, based on PE: true

Associated: 00000000.00000002.1281243473.0000000000700000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1281360671.000000000078D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1281360671.00000000007AE000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1281496264.00000000007BA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1281529307.00000000007C4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1281529307.00000000007C7000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1281529307.00000000007D5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1281529307.00000000007D7000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_700000_OC & PL.jbxd

Similarity

API ID: FileFind$AttributesCloseFirst
String ID:
API String ID: 48322524-0
Opcode ID: 522216111d6c89ca5cc9cb89d46faa539ed1b739460f4935ea77f3d1056d3469
Instruction ID: 45434e5f1c9ca806c58cafb2595dcbfa731293ef991334e835ed0f97fa7147a5
Opcode Fuzzy Hash: 522216111d6c89ca5cc9cb89d46faa539ed1b739460f4935ea77f3d1056d3469
Instruction Fuzzy Hash: A4E04835C145155782206738EC4D8E9776CDE06339F204715F575C11D0E778ED4456EA

Function 00713200 Relevance: 2.2, Strings: 1, Instructions: 986COMMON

Download Yara Rule

Strings

|, xrefs: 0077933E

Memory Dump Source

Source File: 00000000.00000002.1281263787.0000000000701000.00000020.00000001.01000000.00000003.sdmp, Offset: 00700000, based on PE: true

Associated: 00000000.00000002.1281243473.0000000000700000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1281360671.000000000078D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1281360671.00000000007AE000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1281496264.00000000007BA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1281529307.00000000007C4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1281529307.00000000007C7000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1281529307.00000000007D5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1281529307.00000000007D7000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_700000_OC & PL.jbxd

Similarity

API ID: BuffCharUpper
String ID: |
API String ID: 3964851224-671517993
Opcode ID: bff1ba00c50935aac5564a7bc7d42b1099bce56336c3e55cf56511baeaea0927
Instruction ID: 46a0c299ccdbbc691baaa6bf6c5975eac303b2a211e93c9cd468ea9ed3fd4f95
Opcode Fuzzy Hash: bff1ba00c50935aac5564a7bc7d42b1099bce56336c3e55cf56511baeaea0927
Instruction Fuzzy Hash: 97924970608341DFD724DF18C484BAAB7E1BF88304F14895DE99A8B2A2D779ED85CB52

Function 0070E8D0 Relevance: 49.8, APIs: 24, Strings: 4, Instructions: 816windowsleeptimeCOMMON

Download Yara Rule

APIs

PeekMessageW.USER32(?,00000000,00000000,00000000,00000001), ref: 0070E959
timeGetTime.WINMM ref: 0070EBFA
PeekMessageW.USER32(?,00000000,00000000,00000000,00000001), ref: 0070ED2E
TranslateMessage.USER32(?), ref: 0070ED3F
DispatchMessageW.USER32(?), ref: 0070ED4A
LockWindowUpdate.USER32(00000000), ref: 0070ED79
DestroyWindow.USER32 ref: 0070ED85
GetMessageW.USER32(?,00000000,00000000,00000000), ref: 0070ED9F
Sleep.KERNEL32(0000000A), ref: 00775270
TranslateMessage.USER32(?), ref: 007759F7
DispatchMessageW.USER32(?), ref: 00775A05
GetMessageW.USER32(?,00000000,00000000,00000000), ref: 00775A19

Strings

@GUI_CTRLID, xrefs: 00775314
@TRAY_ID, xrefs: 007754C9
@GUI_CTRLHANDLE, xrefs: 007753AC
@GUI_WINHANDLE, xrefs: 00775360

Memory Dump Source

Source File: 00000000.00000002.1281263787.0000000000701000.00000020.00000001.01000000.00000003.sdmp, Offset: 00700000, based on PE: true

Associated: 00000000.00000002.1281243473.0000000000700000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1281360671.000000000078D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1281360671.00000000007AE000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1281496264.00000000007BA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1281529307.00000000007C4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1281529307.00000000007C7000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1281529307.00000000007D5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1281529307.00000000007D7000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_700000_OC & PL.jbxd

Similarity

API ID: Message$DispatchPeekTranslateWindow$DestroyLockSleepTimeUpdatetime
String ID: @GUI_CTRLHANDLE$@GUI_CTRLID$@GUI_WINHANDLE$@TRAY_ID
API String ID: 2641332412-570651680
Opcode ID: 50c516b714005a2331789b6fd74d528dfb3f1d02a907eaeda899357bc44f5994
Instruction ID: 9c062b951c30193d1481389475328e602bd6f4582501ee3bb470ebf8f781f685
Opcode Fuzzy Hash: 50c516b714005a2331789b6fd74d528dfb3f1d02a907eaeda899357bc44f5994
Instruction Fuzzy Hash: 49628370604340DFDB24DF24C899FAA77E5BF45304F148A6DE98A8B2D2DBBD9844CB52

Function 00735C78 Relevance: 47.9, APIs: 26, Strings: 1, Instructions: 626fileCOMMONLIBRARYCODE

Download Yara Rule

APIs

___createFile.LIBCMT ref: 00735EC3
___createFile.LIBCMT ref: 00735F04
GetLastError.KERNEL32(?,?,?,?,?,00000000,00000109), ref: 00735F2D
__dosmaperr.LIBCMT ref: 00735F34
GetFileType.KERNELBASE(00000000,?,?,?,?,?,00000000,00000109), ref: 00735F47
GetLastError.KERNEL32(?,?,?,?,?,00000000,00000109), ref: 00735F6A
__dosmaperr.LIBCMT ref: 00735F73
CloseHandle.KERNEL32(00000000,?,?,?,?,?,00000000,00000109), ref: 00735F7C
__set_osfhnd.LIBCMT ref: 00735FAC
__lseeki64_nolock.LIBCMT ref: 00736016
__close_nolock.LIBCMT ref: 0073603C
__chsize_nolock.LIBCMT ref: 0073606C
__lseeki64_nolock.LIBCMT ref: 0073607E
__lseeki64_nolock.LIBCMT ref: 00736176
__lseeki64_nolock.LIBCMT ref: 0073618B
__close_nolock.LIBCMT ref: 007361EB

Part of subcall function 0072EA9C: CloseHandle.KERNELBASE(00000000,007AEEF4,00000000,?,00736041,007AEEF4,?,?,?,?,?,?,?,?,00000000,00000109), ref: 0072EAEC
Part of subcall function 0072EA9C: GetLastError.KERNEL32(?,00736041,007AEEF4,?,?,?,?,?,?,?,?,00000000,00000109), ref: 0072EAF6
Part of subcall function 0072EA9C: __free_osfhnd.LIBCMT ref: 0072EB03
Part of subcall function 0072EA9C: __dosmaperr.LIBCMT ref: 0072EB25

Part of subcall function 00727C0E: __getptd_noexit.LIBCMT ref: 00727C0E

__lseeki64_nolock.LIBCMT ref: 0073620D
CloseHandle.KERNEL32(00000000,?,?,?,?,?,00000000,00000109), ref: 00736342
___createFile.LIBCMT ref: 00736361
GetLastError.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,00000000,00000109), ref: 0073636E
__dosmaperr.LIBCMT ref: 00736375
__free_osfhnd.LIBCMT ref: 00736395
__invoke_watson.LIBCMT ref: 007363C3
__wsopen_helper.LIBCMT ref: 007363DD

Strings

@, xrefs: 00735F98

Memory Dump Source

Source File: 00000000.00000002.1281263787.0000000000701000.00000020.00000001.01000000.00000003.sdmp, Offset: 00700000, based on PE: true

Associated: 00000000.00000002.1281243473.0000000000700000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1281360671.000000000078D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1281360671.00000000007AE000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1281496264.00000000007BA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1281529307.00000000007C4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1281529307.00000000007C7000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1281529307.00000000007D5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1281529307.00000000007D7000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_700000_OC & PL.jbxd

Similarity

API ID: __lseeki64_nolock$ErrorFileLast__dosmaperr$CloseHandle___create$__close_nolock__free_osfhnd$Type__chsize_nolock__getptd_noexit__invoke_watson__set_osfhnd__wsopen_helper
String ID: @
API String ID: 3896587723-2766056989
Opcode ID: 1d7b4d10157284ba65666ca66f24613bffe7b129979297c35cfca4607ceae299
Instruction ID: cd1c3f198cbc255fe5a2b8a45c19cd25fe3a72faff8234fcb1386c9133a4a967
Opcode Fuzzy Hash: 1d7b4d10157284ba65666ca66f24613bffe7b129979297c35cfca4607ceae299
Instruction Fuzzy Hash: F6220671A0060AABFB299F68DC89BBD7B71FB04314F248229E5219B2D3C33D8D50C791

Function 0074FA0C Relevance: 26.5, APIs: 13, Strings: 2, Instructions: 238
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

_wcscpy.LIBCMT ref: 0074FA96
_wcschr.LIBCMT ref: 0074FAA4
_wcscpy.LIBCMT ref: 0074FABB
_wcscat.LIBCMT ref: 0074FACA
_wcscat.LIBCMT ref: 0074FAE8
_wcscpy.LIBCMT ref: 0074FB09
__wsplitpath.LIBCMT ref: 0074FBE6
_wcscpy.LIBCMT ref: 0074FC0B
_wcscpy.LIBCMT ref: 0074FC1D
_wcscpy.LIBCMT ref: 0074FC32
_wcscat.LIBCMT ref: 0074FC47
_wcscat.LIBCMT ref: 0074FC59
_wcscat.LIBCMT ref: 0074FC6E

Part of subcall function 0074BFA4: _wcscmp.LIBCMT ref: 0074C03E
Part of subcall function 0074BFA4: __wsplitpath.LIBCMT ref: 0074C083
Part of subcall function 0074BFA4: _wcscpy.LIBCMT ref: 0074C096
Part of subcall function 0074BFA4: _wcscat.LIBCMT ref: 0074C0A9
Part of subcall function 0074BFA4: __wsplitpath.LIBCMT ref: 0074C0CE
Part of subcall function 0074BFA4: _wcscat.LIBCMT ref: 0074C0E4
Part of subcall function 0074BFA4: _wcscat.LIBCMT ref: 0074C0F7

Strings

>>>AUTOIT SCRIPT<<<, xrefs: 0074FA61
t2{, xrefs: 0074FC97

Memory Dump Source

Source File: 00000000.00000002.1281263787.0000000000701000.00000020.00000001.01000000.00000003.sdmp, Offset: 00700000, based on PE: true

Associated: 00000000.00000002.1281243473.0000000000700000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1281360671.000000000078D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1281360671.00000000007AE000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1281496264.00000000007BA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1281529307.00000000007C4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1281529307.00000000007C7000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1281529307.00000000007D5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1281529307.00000000007D7000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_700000_OC & PL.jbxd

Similarity

API ID: _wcscat$_wcscpy$__wsplitpath$_wcschr_wcscmp
String ID: >>>AUTOIT SCRIPT<<<$t2{
API String ID: 2955681530-1270873693
Opcode ID: 4888288d54cf644be6b470e52dcb4d981f221e3b5a44c9988a88a47021fab0c0
Instruction ID: 1912caa3d06e117eb4a084400570a945f26e54e62a1ec1720c99dec873a057b7
Opcode Fuzzy Hash: 4888288d54cf644be6b470e52dcb4d981f221e3b5a44c9988a88a47021fab0c0
Instruction Fuzzy Hash: 4F91A571604705EFCB10EF64C895F9AB3E8FF44310F004969F98997292DB38E944CBA2

Function 0072EE0E Relevance: 26.2, APIs: 17, Instructions: 664COMMONLIBRARYCODE

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1281263787.0000000000701000.00000020.00000001.01000000.00000003.sdmp, Offset: 00700000, based on PE: true

Associated: 00000000.00000002.1281243473.0000000000700000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1281360671.000000000078D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1281360671.00000000007AE000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1281496264.00000000007BA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1281529307.00000000007C4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1281529307.00000000007C7000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1281529307.00000000007D5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1281529307.00000000007D7000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_700000_OC & PL.jbxd

Similarity

API ID: __getptd_noexit
String ID:
API String ID: 3074181302-0
Opcode ID: f40bf7bbb622f2c7bb9160449249b56baf3f2267ccd3c6b722117fcb5ac3427e
Instruction ID: 5f376b2565cf29bdbf2dec8b8272ee7d217a6c39c8c23fd4d51a80b0597f3da4
Opcode Fuzzy Hash: f40bf7bbb622f2c7bb9160449249b56baf3f2267ccd3c6b722117fcb5ac3427e
Instruction Fuzzy Hash: 10324A70E042A5DFDB21CF68E840BAD7BB1AF46310F28817AE8559F292D77C9D41C7A0

Function 00703F53 Relevance: 19.3, APIs: 7, Strings: 4, Instructions: 53
windowregistryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetSysColorBrush.USER32(0000000F), ref: 00703F86
RegisterClassExW.USER32(00000030), ref: 00703FB0
RegisterWindowMessageW.USER32(TaskbarCreated), ref: 00703FC1
InitCommonControlsEx.COMCTL32(?), ref: 00703FDE
ImageList_Create.COMCTL32(00000010,00000010,00000021,00000001,00000001), ref: 00703FEE
LoadIconW.USER32(000000A9), ref: 00704004
ImageList_ReplaceIcon.COMCTL32(000000FF,00000000), ref: 00704013

Strings

0, xrefs: 00703F68
+, xrefs: 00703F6F
TaskbarCreated, xrefs: 00703FB6
AutoIt v3 GUI, xrefs: 00703FA2

Memory Dump Source

Source File: 00000000.00000002.1281263787.0000000000701000.00000020.00000001.01000000.00000003.sdmp, Offset: 00700000, based on PE: true

Associated: 00000000.00000002.1281243473.0000000000700000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1281360671.000000000078D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1281360671.00000000007AE000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1281496264.00000000007BA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1281529307.00000000007C4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1281529307.00000000007C7000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1281529307.00000000007D5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1281529307.00000000007D7000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_700000_OC & PL.jbxd

Similarity

API ID: IconImageList_Register$BrushClassColorCommonControlsCreateInitLoadMessageReplaceWindow
String ID: +$0$AutoIt v3 GUI$TaskbarCreated
API String ID: 2914291525-1005189915
Opcode ID: ab97007ed7c1be3eb880b446a23b55f8d0e35b61eaa460c4b61d6707b8f386ae
Instruction ID: 255e48eaa038cef0a5e9ca4082c0cca3c4b2e0fe600ee365ab2f7d39e6d591c7
Opcode Fuzzy Hash: ab97007ed7c1be3eb880b446a23b55f8d0e35b61eaa460c4b61d6707b8f386ae
Instruction Fuzzy Hash: C521F7B5940308AFDB10EFA4EC89BCDBBB4FB09700F10812AF511B62A0D7B84944CF99

Function 0074BFA4 Relevance: 18.3, APIs: 12, Instructions: 316
fileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 0074BDB4: __time64.LIBCMT ref: 0074BDBE

Part of subcall function 00704517: _fseek.LIBCMT ref: 0070452F

__wsplitpath.LIBCMT ref: 0074C083

Part of subcall function 00721DFC: __wsplitpath_helper.LIBCMT ref: 00721E3C

_wcscpy.LIBCMT ref: 0074C096
_wcscat.LIBCMT ref: 0074C0A9
__wsplitpath.LIBCMT ref: 0074C0CE
_wcscat.LIBCMT ref: 0074C0E4
_wcscat.LIBCMT ref: 0074C0F7
_wcscmp.LIBCMT ref: 0074C03E

Part of subcall function 0074C56D: _wcscmp.LIBCMT ref: 0074C65D
Part of subcall function 0074C56D: _wcscmp.LIBCMT ref: 0074C670

DeleteFileW.KERNEL32(?,?,?,?,00000004,00000001,?,?,00000004,00000001,?,?,00000004,00000001,?,?), ref: 0074C2A1
DeleteFileW.KERNEL32(?,?,?,?,?,?,00000004,00000001,?,?,00000004,00000001,?,?,00000004,00000001), ref: 0074C338
CopyFileW.KERNEL32(?,?,00000000,?,?,?,00000004,00000001,?,?,00000004,00000001,?,?,00000004,00000001), ref: 0074C34E
DeleteFileW.KERNEL32(?,?,?,00000004,00000001,?,?,00000004,00000001,?,?,00000004,00000001,?,?,00000004), ref: 0074C35F
DeleteFileW.KERNELBASE(?,?,?,00000004,00000001,?,?,00000004,00000001,?,?,00000004,00000001,?,?,00000004), ref: 0074C371

Memory Dump Source

Source File: 00000000.00000002.1281263787.0000000000701000.00000020.00000001.01000000.00000003.sdmp, Offset: 00700000, based on PE: true

Associated: 00000000.00000002.1281243473.0000000000700000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1281360671.000000000078D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1281360671.00000000007AE000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1281496264.00000000007BA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1281529307.00000000007C4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1281529307.00000000007C7000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1281529307.00000000007D5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1281529307.00000000007D7000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_700000_OC & PL.jbxd

Similarity

API ID: File$Delete$_wcscat_wcscmp$__wsplitpath$Copy__time64__wsplitpath_helper_fseek_wcscpy
String ID:
API String ID: 2378138488-0
Opcode ID: ce99693b1b62c7290fe90d14feca0c3b4b73327fbda65f12e5425d858aa6f573
Instruction ID: fe73e3d0d98153a02c7897314f89de047d79c458c3e7b5eaa4fb122fa9c2a706
Opcode Fuzzy Hash: ce99693b1b62c7290fe90d14feca0c3b4b73327fbda65f12e5425d858aa6f573
Instruction Fuzzy Hash: D5C12AB1E01229EBDF21DF95CC85EDEB7B8AF48300F1041A6F609E6151DB789A848F65

Function 00703742 Relevance: 15.9, APIs: 8, Strings: 1, Instructions: 151
windowtimeregistryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

DefWindowProcW.USER32(?,?,?,?), ref: 007037B3
KillTimer.USER32(?,00000001), ref: 007037DD
SetTimer.USER32(?,00000001,000002EE,00000000), ref: 00703800
RegisterWindowMessageW.USER32(TaskbarCreated), ref: 0070380B
CreatePopupMenu.USER32 ref: 0070381F
PostQuitMessage.USER32(00000000), ref: 0070382E

Strings

TaskbarCreated, xrefs: 00703806

Memory Dump Source

Source File: 00000000.00000002.1281263787.0000000000701000.00000020.00000001.01000000.00000003.sdmp, Offset: 00700000, based on PE: true

Associated: 00000000.00000002.1281243473.0000000000700000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1281360671.000000000078D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1281360671.00000000007AE000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1281496264.00000000007BA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1281529307.00000000007C4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1281529307.00000000007C7000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1281529307.00000000007D5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1281529307.00000000007D7000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_700000_OC & PL.jbxd

Similarity

API ID: MessageTimerWindow$CreateKillMenuPopupPostProcQuitRegister
String ID: TaskbarCreated
API String ID: 129472671-2362178303
Opcode ID: 4d6576b208ed317077e7226bb238e9a7491798e5390f41bb70daabf53611413e
Instruction ID: a62e7ff621fcc6ac5395ecd43672d1532c24bf2582c1406dc1098d9caac75cf8
Opcode Fuzzy Hash: 4d6576b208ed317077e7226bb238e9a7491798e5390f41bb70daabf53611413e
Instruction Fuzzy Hash: 954116F120014AEBDB205B289C8EF7937DDFB41341F94963DF902921D2DB6C9E909766

Function 00703E6E Relevance: 15.8, APIs: 6, Strings: 3, Instructions: 66
windowregistryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetSysColorBrush.USER32(0000000F), ref: 00703E79
LoadCursorW.USER32(00000000,00007F00), ref: 00703E88
LoadIconW.USER32(00000063), ref: 00703E9E
LoadIconW.USER32(000000A4), ref: 00703EB0
LoadIconW.USER32(000000A2), ref: 00703EC2

Part of subcall function 00704024: LoadImageW.USER32(00700000,00000063,00000001,00000010,00000010,00000000), ref: 00704048

RegisterClassExW.USER32(?), ref: 00703F30

Part of subcall function 00703F53: GetSysColorBrush.USER32(0000000F), ref: 00703F86
Part of subcall function 00703F53: RegisterClassExW.USER32(00000030), ref: 00703FB0
Part of subcall function 00703F53: RegisterWindowMessageW.USER32(TaskbarCreated), ref: 00703FC1
Part of subcall function 00703F53: InitCommonControlsEx.COMCTL32(?), ref: 00703FDE
Part of subcall function 00703F53: ImageList_Create.COMCTL32(00000010,00000010,00000021,00000001,00000001), ref: 00703FEE
Part of subcall function 00703F53: LoadIconW.USER32(000000A9), ref: 00704004
Part of subcall function 00703F53: ImageList_ReplaceIcon.COMCTL32(000000FF,00000000), ref: 00704013

Strings

AutoIt v3, xrefs: 00703F1F
0, xrefs: 00703F02
#, xrefs: 00703F09

Memory Dump Source

Source File: 00000000.00000002.1281263787.0000000000701000.00000020.00000001.01000000.00000003.sdmp, Offset: 00700000, based on PE: true

Associated: 00000000.00000002.1281243473.0000000000700000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1281360671.000000000078D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1281360671.00000000007AE000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1281496264.00000000007BA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1281529307.00000000007C4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1281529307.00000000007C7000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1281529307.00000000007D5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1281529307.00000000007D7000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_700000_OC & PL.jbxd

Similarity

API ID: Load$Icon$ImageRegister$BrushClassColorList_$CommonControlsCreateCursorInitMessageReplaceWindow
String ID: #$0$AutoIt v3
API String ID: 423443420-4155596026
Opcode ID: 0f26291a477222a91fba367cf8914025756b98b4c2e77fd0a78aee106965b1fb
Instruction ID: d4f4272202d3057867caf9c52a063808424f35e554f8821be70b461e022606f4
Opcode Fuzzy Hash: 0f26291a477222a91fba367cf8914025756b98b4c2e77fd0a78aee106965b1fb
Instruction Fuzzy Hash: 4B212FB0D00308AFDB10DFA9EC45E99BBF5FB49310F54822EE614A22A1D77D4A508B99

Function 0072ACB3 Relevance: 15.2, APIs: 10, Instructions: 219
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

__lock.LIBCMT ref: 0072ACC1

Part of subcall function 00727CF4: __mtinitlocknum.LIBCMT ref: 00727D06
Part of subcall function 00727CF4: EnterCriticalSection.KERNEL32(00000000,?,00727ADD,0000000D), ref: 00727D1F

__calloc_crt.LIBCMT ref: 0072ACD2

Part of subcall function 00726986: __calloc_impl.LIBCMT ref: 00726995
Part of subcall function 00726986: Sleep.KERNEL32(00000000,000003BC,0071F507,?,0000000E), ref: 007269AC

@_EH4_CallFilterFunc@8.LIBCMT ref: 0072ACED
GetStartupInfoW.KERNEL32(?,007B6E28,00000064,00725E91,007B6C70,00000014), ref: 0072AD46
__calloc_crt.LIBCMT ref: 0072AD91
GetFileType.KERNEL32(00000001), ref: 0072ADD8
InitializeCriticalSectionAndSpinCount.KERNEL32(0000000D,00000FA0), ref: 0072AE11

Memory Dump Source

Source File: 00000000.00000002.1281263787.0000000000701000.00000020.00000001.01000000.00000003.sdmp, Offset: 00700000, based on PE: true

Associated: 00000000.00000002.1281243473.0000000000700000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1281360671.000000000078D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1281360671.00000000007AE000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1281496264.00000000007BA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1281529307.00000000007C4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1281529307.00000000007C7000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1281529307.00000000007D5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1281529307.00000000007D7000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_700000_OC & PL.jbxd

Similarity

API ID: CriticalSection__calloc_crt$CallCountEnterFileFilterFunc@8InfoInitializeSleepSpinStartupType__calloc_impl__lock__mtinitlocknum
String ID:
API String ID: 1426640281-0
Opcode ID: 1412c9470231177ec2d9e7e844d5370d08fe515e4618ec83fce8afca9da23d86
Instruction ID: d9bace7223d6a5edbd8753a0af91e12493c1170076c754fe4b3a04ab5c632590
Opcode Fuzzy Hash: 1412c9470231177ec2d9e7e844d5370d08fe515e4618ec83fce8afca9da23d86
Instruction Fuzzy Hash: E581B1B1D05365DFDB24CF68E8455A9BBF0AF05320B24826DD4A6AB3D1D73C9803CB96

Function 00F554F0 Relevance: 10.7, APIs: 7, Instructions: 239
fileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateFileW.KERNELBASE(00000000,?,80000000,00000007,00000000,00000003,00000080,00000000,?,00000000), ref: 00F555C1
VirtualFree.KERNELBASE(00000000,00000000,00008000,00000000,00000000,00000000,00000000,?,?,00000000), ref: 00F557E7

Memory Dump Source

Source File: 00000000.00000002.1282677803.0000000000F52000.00000040.00000020.00020000.00000000.sdmp, Offset: 00F52000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f52000_OC & PL.jbxd

Similarity

API ID: CreateFileFreeVirtual
String ID:
API String ID: 204039940-0
Opcode ID: 7a8af28d10d872e8c42d0e09e8738e4af41cabd85448581b7ead53f150642b41
Instruction ID: ded41d574c1661928c08b486d87c0fb1fc5901145fe12dffbca957bbf5d4aa57
Opcode Fuzzy Hash: 7a8af28d10d872e8c42d0e09e8738e4af41cabd85448581b7ead53f150642b41
Instruction Fuzzy Hash: 45A11674E00608EBDF14CFA4C8A4BAEBBB5FF48715F208559EA01BB280D7759A45DF90

Function 007049FB Relevance: 10.6, APIs: 4, Strings: 2, Instructions: 73
registryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

RegOpenKeyExW.KERNELBASE(80000001,Software\AutoIt v3\AutoIt,00000000,00000001,?), ref: 00704A1D
RegQueryValueExW.ADVAPI32(?,Include,00000000,00000000,00000000,?), ref: 007741DB
RegQueryValueExW.ADVAPI32(?,Include,00000000,00000000,?,?,00000000), ref: 0077421A
RegCloseKey.ADVAPI32(?), ref: 00774249

Strings

Include, xrefs: 007741D3, 00774212
Software\AutoIt v3\AutoIt, xrefs: 00704A13

Memory Dump Source

Source File: 00000000.00000002.1281263787.0000000000701000.00000020.00000001.01000000.00000003.sdmp, Offset: 00700000, based on PE: true

Associated: 00000000.00000002.1281243473.0000000000700000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1281360671.000000000078D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1281360671.00000000007AE000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1281496264.00000000007BA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1281529307.00000000007C4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1281529307.00000000007C7000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1281529307.00000000007D5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1281529307.00000000007D7000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_700000_OC & PL.jbxd

Similarity

API ID: QueryValue$CloseOpen
String ID: Include$Software\AutoIt v3\AutoIt
API String ID: 1586453840-614718249
Opcode ID: f1a53c7f3943e61d734c327d83484c34e950ce867d4c2c4e69828a096ebd29b2
Instruction ID: 7e6cdf33135a3118ae5dbccfae78791da24abf9d136908ea336f2773ae48f5c6
Opcode Fuzzy Hash: f1a53c7f3943e61d734c327d83484c34e950ce867d4c2c4e69828a096ebd29b2
Instruction Fuzzy Hash: CC116DB1640109FEEF14ABA4DD8ADAF7BACEF05344F104054B506E61D1EB789E01D764

Function 007036B8 Relevance: 10.5, APIs: 4, Strings: 2, Instructions: 44
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateWindowExW.USER32(00000000,AutoIt v3,AutoIt v3,00CF0000,80000000,80000000,0000012C,00000064,00000000,00000000,00000000,00000001), ref: 007036E6
CreateWindowExW.USER32(00000000,edit,00000000,50B008C4,00000000,00000000,00000000,00000000,00000000,00000001,00000000), ref: 00703707
ShowWindow.USER32(00000000,?,?,?,?,00703AA3,?), ref: 0070371B
ShowWindow.USER32(00000000,?,?,?,?,00703AA3,?), ref: 00703724

Strings

AutoIt v3, xrefs: 007036DE, 007036E3, 007036E4
edit, xrefs: 00703701

Memory Dump Source

Source File: 00000000.00000002.1281263787.0000000000701000.00000020.00000001.01000000.00000003.sdmp, Offset: 00700000, based on PE: true

Associated: 00000000.00000002.1281243473.0000000000700000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1281360671.000000000078D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1281360671.00000000007AE000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1281496264.00000000007BA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1281529307.00000000007C4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1281529307.00000000007C7000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1281529307.00000000007D5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1281529307.00000000007D7000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_700000_OC & PL.jbxd

Similarity

API ID: Window$CreateShow
String ID: AutoIt v3$edit
API String ID: 1584632944-3779509399
Opcode ID: d23b6553048bf27d570aba49645b2b99660792cfd5a14a6cfc89e732e4556d5b
Instruction ID: 74a3e331bf314522cf184976c66396fd9d293451125e5b83fcb9659791ad5611
Opcode Fuzzy Hash: d23b6553048bf27d570aba49645b2b99660792cfd5a14a6cfc89e732e4556d5b
Instruction Fuzzy Hash: C2F0DA715402D47AEB315767AC08E672F7DEBC7F20F50C02EBA04A21A1C5690CE5DAB4

Function 00F55260 Relevance: 8.9, APIs: 4, Strings: 1, Instructions: 164
fileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 00F55150: Sleep.KERNELBASE(000001F4), ref: 00F55161

CreateFileW.KERNELBASE(?,80000000,00000007,00000000,00000003,00000080,00000000), ref: 00F553D4

Strings

UXOB7ZAPN56EJZNPPHSI925XKO4CYU, xrefs: 00F5543D, 00F55440

Memory Dump Source

Source File: 00000000.00000002.1282677803.0000000000F52000.00000040.00000020.00020000.00000000.sdmp, Offset: 00F52000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f52000_OC & PL.jbxd

Similarity

API ID: CreateFileSleep
String ID: UXOB7ZAPN56EJZNPPHSI925XKO4CYU
API String ID: 2694422964-1105434697
Opcode ID: 7e94153e9ca1f090646b9c33c43df9fd15fe9ede7cd8f961924e5da9212b5b7a
Instruction ID: c2ce32a84f22016e055fc76e69abb1d1a670db4f0b1e51c6787178624108c5c6
Opcode Fuzzy Hash: 7e94153e9ca1f090646b9c33c43df9fd15fe9ede7cd8f961924e5da9212b5b7a
Instruction Fuzzy Hash: 2571B030D04688DAEF11CBF4C8157EEBB75AF19705F004199E648BB2C1D7BA0A49CBA6

Function 00704A30 Relevance: 8.9, APIs: 2, Strings: 3, Instructions: 138COMMON

Download Yara Rule

APIs

Part of subcall function 00705374: GetModuleFileNameW.KERNEL32(00000000,?,00007FFF,007C1148,?,007061FF,?,00000000,00000001,00000000), ref: 00705392

Part of subcall function 007049FB: RegOpenKeyExW.KERNELBASE(80000001,Software\AutoIt v3\AutoIt,00000000,00000001,?), ref: 00704A1D

_wcscat.LIBCMT ref: 00772D80
_wcscat.LIBCMT ref: 00772DB5

Strings

\, xrefs: 00772DA2
8!|, xrefs: 00704B1C
\Include\, xrefs: 00704B0A

Memory Dump Source

Source File: 00000000.00000002.1281263787.0000000000701000.00000020.00000001.01000000.00000003.sdmp, Offset: 00700000, based on PE: true

Associated: 00000000.00000002.1281243473.0000000000700000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1281360671.000000000078D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1281360671.00000000007AE000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1281496264.00000000007BA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1281529307.00000000007C4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1281529307.00000000007C7000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1281529307.00000000007D5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1281529307.00000000007D7000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_700000_OC & PL.jbxd

Similarity

API ID: _wcscat$FileModuleNameOpen
String ID: 8!|$\$\Include\
API String ID: 3592542968-1225405541
Opcode ID: bffce42a952b9ca6d1af4689e75ef630d8c1f7a45be26187b45525c59c2830d0
Instruction ID: fb2dd1a1363c7d52c75fac6c79b4909ad154b17a6f864ea87c02088e5a677559
Opcode Fuzzy Hash: bffce42a952b9ca6d1af4689e75ef630d8c1f7a45be26187b45525c59c2830d0
Instruction Fuzzy Hash: BD5196B1504344DFC714EF55E895C9AB3F4FF49300B44862EF644832A2EB7C9A05CB65

Function 007051AF Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 88windowCOMMON

Download Yara Rule

APIs

_memset.LIBCMT ref: 0070522F
_wcscpy.LIBCMT ref: 00705283
Shell_NotifyIconW.SHELL32(00000001,?), ref: 00705293
LoadStringW.USER32(00000065,?,0000007F,00000104), ref: 00773CB0

Strings

Line: , xrefs: 00773CD9

Memory Dump Source

Source File: 00000000.00000002.1281263787.0000000000701000.00000020.00000001.01000000.00000003.sdmp, Offset: 00700000, based on PE: true

Associated: 00000000.00000002.1281243473.0000000000700000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1281360671.000000000078D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1281360671.00000000007AE000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1281496264.00000000007BA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1281529307.00000000007C4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1281529307.00000000007C7000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1281529307.00000000007D5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1281529307.00000000007D7000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_700000_OC & PL.jbxd

Similarity

API ID: IconLoadNotifyShell_String_memset_wcscpy
String ID: Line:
API String ID: 1053898822-1585850449
Opcode ID: 03e670a360879d23b90c2dd2a603bb66a6b67c8aa113f18989c6b1da1d2362c4
Instruction ID: befabb9b28add69c0843e2034900a9ff66586f12be42bfc68a6fd00b5480ea7a
Opcode Fuzzy Hash: 03e670a360879d23b90c2dd2a603bb66a6b67c8aa113f18989c6b1da1d2362c4
Instruction Fuzzy Hash: 12319CB1108744EBD321EB60EC4AFDB77D8AF45310F50861EF589920D2EB78A6588B96

Function 00704139 Relevance: 7.3, APIs: 2, Strings: 2, Instructions: 258COMMON

Download Yara Rule

APIs

Part of subcall function 007041A9: LoadLibraryExW.KERNEL32(00000001,00000000,00000002,?,?,?,?,007039FE,?,00000001), ref: 007041DB

_free.LIBCMT ref: 007736B7
_free.LIBCMT ref: 007736FE

Part of subcall function 0070C833: __wsplitpath.LIBCMT ref: 0070C93E
Part of subcall function 0070C833: _wcscpy.LIBCMT ref: 0070C953
Part of subcall function 0070C833: _wcscat.LIBCMT ref: 0070C968
Part of subcall function 0070C833: SetCurrentDirectoryW.KERNEL32(?,?,?,?,?,?,00000001,?,?,00000000), ref: 0070C978

Strings

Bad directive syntax error, xrefs: 007736E4
>>>AUTOIT SCRIPT<<<, xrefs: 00773491

Memory Dump Source

Source File: 00000000.00000002.1281263787.0000000000701000.00000020.00000001.01000000.00000003.sdmp, Offset: 00700000, based on PE: true

Associated: 00000000.00000002.1281243473.0000000000700000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1281360671.000000000078D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1281360671.00000000007AE000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1281496264.00000000007BA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1281529307.00000000007C4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1281529307.00000000007C7000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1281529307.00000000007D5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1281529307.00000000007D7000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_700000_OC & PL.jbxd

Similarity

API ID: _free$CurrentDirectoryLibraryLoad__wsplitpath_wcscat_wcscpy
String ID: >>>AUTOIT SCRIPT<<<$Bad directive syntax error
API String ID: 805182592-1757145024
Opcode ID: fcb17c72827a42362e8a4a0ae3e741efa738b04b43744f46f4d3a1a014b8ff60
Instruction ID: f6a478601e35d97a6baf72fea3bce34d94c281df83458a11e5ceaa44dd1c8baf
Opcode Fuzzy Hash: fcb17c72827a42362e8a4a0ae3e741efa738b04b43744f46f4d3a1a014b8ff60
Instruction Fuzzy Hash: 249181B1910219EFCF04EFA4CC959EDB7B4BF18350F108529F515EB291DB38AA54DB60

Function 007040E5 Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 64COMMON

Download Yara Rule

APIs

_memset.LIBCMT ref: 00773725
GetOpenFileNameW.COMDLG32 ref: 0077376F

Part of subcall function 0070660F: GetFullPathNameW.KERNEL32(?,00007FFF,?,00000000,?,?,007053B1,?,?,007061FF,?,00000000,00000001,00000000), ref: 0070662F

Part of subcall function 007040A7: GetLongPathNameW.KERNELBASE(?,?,00007FFF), ref: 007040C6

Strings

t3{, xrefs: 00773745
X, xrefs: 0077373E

Memory Dump Source

Source File: 00000000.00000002.1281263787.0000000000701000.00000020.00000001.01000000.00000003.sdmp, Offset: 00700000, based on PE: true

Associated: 00000000.00000002.1281243473.0000000000700000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1281360671.000000000078D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1281360671.00000000007AE000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1281496264.00000000007BA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1281529307.00000000007C4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1281529307.00000000007C7000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1281529307.00000000007D5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1281529307.00000000007D7000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_700000_OC & PL.jbxd

Similarity

API ID: Name$Path$FileFullLongOpen_memset
String ID: X$t3{
API String ID: 3777226403-2169849462
Opcode ID: 6789e441e8e9f30feb98a8ece8871f55f09023d1fd8105f549af1fdef3544614
Instruction ID: 887a85c4feb56883da8c98381f0cdae51caab45f2fdcc478b6ef51bf0abd86a1
Opcode Fuzzy Hash: 6789e441e8e9f30feb98a8ece8871f55f09023d1fd8105f549af1fdef3544614
Instruction Fuzzy Hash: 3821A5B1A10198DBCF11DF94DC49BEEBBF89F49304F108069E505E7281DBBC5A898FA5

Function 007234AE Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 61COMMON

Download Yara Rule

APIs

__getstream.LIBCMT ref: 007234FE

Part of subcall function 00727C0E: __getptd_noexit.LIBCMT ref: 00727C0E

@_EH4_CallFilterFunc@8.LIBCMT ref: 00723539
__wopenfile.LIBCMT ref: 00723549

Strings

<G, xrefs: 007234CD, 007234F0, 007234FC

Memory Dump Source

Source File: 00000000.00000002.1281263787.0000000000701000.00000020.00000001.01000000.00000003.sdmp, Offset: 00700000, based on PE: true

Associated: 00000000.00000002.1281243473.0000000000700000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1281360671.000000000078D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1281360671.00000000007AE000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1281496264.00000000007BA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1281529307.00000000007C4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1281529307.00000000007C7000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1281529307.00000000007D5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1281529307.00000000007D7000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_700000_OC & PL.jbxd

Similarity

API ID: CallFilterFunc@8__getptd_noexit__getstream__wopenfile
String ID: <G
API String ID: 1820251861-2138716496
Opcode ID: 6d123bccc7c6ea3c6d29edfadb9be51c5cd6e5201dd77a22df448956529e0fb4
Instruction ID: 40050f15370ce77892b5bac0dd0c831f8a6242e39c57f07e35b5dd552396ce6f
Opcode Fuzzy Hash: 6d123bccc7c6ea3c6d29edfadb9be51c5cd6e5201dd77a22df448956529e0fb4
Instruction Fuzzy Hash: 8D110AB0A00236DBDB11BF71BC4667E36A4AF05350B148966F819D7281EB3CCA5197B1

Function 0071D298 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 58registryCOMMON

Download Yara Rule

APIs

RegOpenKeyExW.KERNELBASE(80000001,Control Panel\Mouse,00000000,00000001,00000000,00000003,00000000,80000001,80000001,?,0071D28B,SwapMouseButtons,00000004,?), ref: 0071D2BC
RegQueryValueExW.KERNELBASE(00000000,00000000,00000000,00000000,?,?,?,?,0071D28B,SwapMouseButtons,00000004,?,?,?,?,0071C865), ref: 0071D2DD
RegCloseKey.KERNELBASE(00000000,?,?,0071D28B,SwapMouseButtons,00000004,?,?,?,?,0071C865), ref: 0071D2FF

Strings

Control Panel\Mouse, xrefs: 0071D2BA

Memory Dump Source

Source File: 00000000.00000002.1281263787.0000000000701000.00000020.00000001.01000000.00000003.sdmp, Offset: 00700000, based on PE: true

Associated: 00000000.00000002.1281243473.0000000000700000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1281360671.000000000078D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1281360671.00000000007AE000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1281496264.00000000007BA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1281529307.00000000007C4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1281529307.00000000007C7000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1281529307.00000000007D5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1281529307.00000000007D7000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_700000_OC & PL.jbxd

Similarity

API ID: CloseOpenQueryValue
String ID: Control Panel\Mouse
API String ID: 3677997916-824357125
Opcode ID: 937d342fb4a0ba0c2122be416a396026a0c7dcea9727dce72d56f91666bbaac9
Instruction ID: 26b4ed845c22450192ba109fcf7a05c55567026ea1f7210305748660755bcf50
Opcode Fuzzy Hash: 937d342fb4a0ba0c2122be416a396026a0c7dcea9727dce72d56f91666bbaac9
Instruction Fuzzy Hash: 69113975611208FFDB218FA8CC84EEF7BB8EF44754F108469E815D7190E735AE819B64

Function 00F54150 Relevance: 6.7, APIs: 4, Instructions: 720processthreadCOMMON

Download Yara Rule

APIs

CreateProcessW.KERNELBASE(?,00000000), ref: 00F5497D
Wow64GetThreadContext.KERNEL32(?,00010007), ref: 00F549A1
ReadProcessMemory.KERNELBASE(?,?,?,00000004,00000000), ref: 00F549C3

Memory Dump Source

Source File: 00000000.00000002.1282677803.0000000000F52000.00000040.00000020.00020000.00000000.sdmp, Offset: 00F52000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f52000_OC & PL.jbxd

Similarity

API ID: Process$ContextCreateMemoryReadThreadWow64
String ID:
API String ID: 2438371351-0
Opcode ID: 9ff7d806dc6ef1cc8f26af8a7a5011723b62bd23310367b846ce676590f9e849
Instruction ID: d1ce953a467514449f0a1f703f38c3659643e6c3a0ce6d362aa3b0297767eb48
Opcode Fuzzy Hash: 9ff7d806dc6ef1cc8f26af8a7a5011723b62bd23310367b846ce676590f9e849
Instruction Fuzzy Hash: D4623F30A14218DBEB24CFA4C844BDEB372EF58305F1091A9D60DEB390E7799E85DB59

Function 0072365B Relevance: 6.2, APIs: 4, Instructions: 162COMMONLIBRARYCODE

Download Yara Rule

APIs

_memset.LIBCMT ref: 007236B7
_memcpy_s.LIBCMT ref: 00723729
__filbuf.LIBCMT ref: 007237AA
_memset.LIBCMT ref: 007237EE

Part of subcall function 00727C0E: __getptd_noexit.LIBCMT ref: 00727C0E

Memory Dump Source

Source File: 00000000.00000002.1281263787.0000000000701000.00000020.00000001.01000000.00000003.sdmp, Offset: 00700000, based on PE: true

Associated: 00000000.00000002.1281243473.0000000000700000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1281360671.000000000078D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1281360671.00000000007AE000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1281496264.00000000007BA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1281529307.00000000007C4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1281529307.00000000007C7000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1281529307.00000000007D5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1281529307.00000000007D7000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_700000_OC & PL.jbxd

Similarity

API ID: _memset$__filbuf__getptd_noexit_memcpy_s
String ID:
API String ID: 3877424927-0
Opcode ID: 25276d1f646da7b76298e578b8e053e7e3b96e54df01e447abe6ae266d0f960a
Instruction ID: 0a525f431b13bb44c3eeea0ce6b8d59a2a2d62f7b2f8998dfc9590c96c9627aa
Opcode Fuzzy Hash: 25276d1f646da7b76298e578b8e053e7e3b96e54df01e447abe6ae266d0f960a
Instruction Fuzzy Hash: FA51B1B0A00325EBDF248FA9A88466E7BA5EF40320F248729F835963D0D77DDF518B50

Function 00702322 Relevance: 6.2, APIs: 3, Strings: 1, Instructions: 159COMMON

Download Yara Rule

APIs

Part of subcall function 007022A4: RegisterWindowMessageW.USER32(WM_GETCONTROLNAME,?,007024F1), ref: 00702303

GetStdHandle.KERNEL32(000000F6,00000000,00000000), ref: 007025A1
CoInitialize.OLE32(00000000), ref: 00702618
CloseHandle.KERNEL32(00000000), ref: 0077503A

Strings

, xrefs: 0070237A

Memory Dump Source

Source File: 00000000.00000002.1281263787.0000000000701000.00000020.00000001.01000000.00000003.sdmp, Offset: 00700000, based on PE: true

Associated: 00000000.00000002.1281243473.0000000000700000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1281360671.000000000078D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1281360671.00000000007AE000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1281496264.00000000007BA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1281529307.00000000007C4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1281529307.00000000007C7000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1281529307.00000000007D5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1281529307.00000000007D7000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_700000_OC & PL.jbxd

Similarity

API ID: Handle$CloseInitializeMessageRegisterWindow
String ID:
API String ID: 3815369404-1891724858
Opcode ID: 471efa827b613f084e126d6beb599d4b406c54930e02dbadd3114fb66375ae64
Instruction ID: 64ab799c56956b6f77d990cf7b7d890d816709e8fa6dbacc0ae854c7642aa6da
Opcode Fuzzy Hash: 471efa827b613f084e126d6beb599d4b406c54930e02dbadd3114fb66375ae64
Instruction Fuzzy Hash: C2718CB9A01285CBC314EF5AA994D95BBA4FB9A3447D4C27ED109C76B3CB3C8421CB5C

Function 0074C396 Relevance: 6.2, APIs: 4, Instructions: 154COMMON

Download Yara Rule

APIs

Part of subcall function 00704517: _fseek.LIBCMT ref: 0070452F

Part of subcall function 0074C56D: _wcscmp.LIBCMT ref: 0074C65D
Part of subcall function 0074C56D: _wcscmp.LIBCMT ref: 0074C670

_free.LIBCMT ref: 0074C4DD
_free.LIBCMT ref: 0074C4E4
_free.LIBCMT ref: 0074C54F

Part of subcall function 00721C9D: RtlFreeHeap.NTDLL(00000000,00000000,?,00727A85), ref: 00721CB1
Part of subcall function 00721C9D: GetLastError.KERNEL32(00000000,?,00727A85), ref: 00721CC3

_free.LIBCMT ref: 0074C557

Memory Dump Source

Source File: 00000000.00000002.1281263787.0000000000701000.00000020.00000001.01000000.00000003.sdmp, Offset: 00700000, based on PE: true

Associated: 00000000.00000002.1281243473.0000000000700000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1281360671.000000000078D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1281360671.00000000007AE000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1281496264.00000000007BA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1281529307.00000000007C4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1281529307.00000000007C7000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1281529307.00000000007D5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1281529307.00000000007D7000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_700000_OC & PL.jbxd

Similarity

API ID: _free$_wcscmp$ErrorFreeHeapLast_fseek
String ID:
API String ID: 1552873950-0
Opcode ID: acbc9bddfc27afc87d88584c9959c104a0ea567534d53ec5d359cc2505f852cb
Instruction ID: 63aa154949dff4d092ff9837bb10095f487c5ecf0fc2f2c0607f4fc479a8ee56
Opcode Fuzzy Hash: acbc9bddfc27afc87d88584c9959c104a0ea567534d53ec5d359cc2505f852cb
Instruction Fuzzy Hash: 4E516EB1904218EFDB159F64DC85AADBBB9EF48304F10009EB249A3281DB756A90CF58

Function 0071EB83 Relevance: 6.1, APIs: 4, Instructions: 65timewindowCOMMON

Download Yara Rule

APIs

_memset.LIBCMT ref: 0071EBB2

Part of subcall function 007051AF: _memset.LIBCMT ref: 0070522F
Part of subcall function 007051AF: _wcscpy.LIBCMT ref: 00705283
Part of subcall function 007051AF: Shell_NotifyIconW.SHELL32(00000001,?), ref: 00705293

KillTimer.USER32(?,00000001,?,?), ref: 0071EC07
SetTimer.USER32(?,00000001,000002EE,00000000), ref: 0071EC16
Shell_NotifyIconW.SHELL32(00000001,000003A8), ref: 00773C88

Memory Dump Source

Source File: 00000000.00000002.1281263787.0000000000701000.00000020.00000001.01000000.00000003.sdmp, Offset: 00700000, based on PE: true

Associated: 00000000.00000002.1281243473.0000000000700000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1281360671.000000000078D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1281360671.00000000007AE000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1281496264.00000000007BA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1281529307.00000000007C4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1281529307.00000000007C7000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1281529307.00000000007D5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1281529307.00000000007D7000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_700000_OC & PL.jbxd

Similarity

API ID: IconNotifyShell_Timer_memset$Kill_wcscpy
String ID:
API String ID: 1378193009-0
Opcode ID: c8632c06c355dea6f9f6e7cae9b19f6d31d15e0ffd71b8680ba5a09ebe8e5e4f
Instruction ID: a12f998187be3cc15290eb00276be5caac0ff8bced3a8c5192dbbfbbdd5226d9
Opcode Fuzzy Hash: c8632c06c355dea6f9f6e7cae9b19f6d31d15e0ffd71b8680ba5a09ebe8e5e4f
Instruction Fuzzy Hash: 2C21C5705047949FEB339B288C59BE7BFEC9B01308F04449DE68E661C2C3782A84CB61

Function 0074C71A Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 15COMMON

Download Yara Rule

APIs

GetTempPathW.KERNEL32(00000104,?), ref: 0074C72F
GetTempFileNameW.KERNELBASE(?,aut,00000000,?), ref: 0074C746

Strings

aut, xrefs: 0074C740

Memory Dump Source

Source File: 00000000.00000002.1281263787.0000000000701000.00000020.00000001.01000000.00000003.sdmp, Offset: 00700000, based on PE: true

Associated: 00000000.00000002.1281243473.0000000000700000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1281360671.000000000078D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1281360671.00000000007AE000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1281496264.00000000007BA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1281529307.00000000007C4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1281529307.00000000007C7000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1281529307.00000000007D5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1281529307.00000000007D7000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_700000_OC & PL.jbxd

Similarity

API ID: Temp$FileNamePath
String ID: aut
API String ID: 3285503233-3010740371
Opcode ID: 838de6618322d32d8417d0959bc04720a73956a65639fcb3cb4b44a7c01e4a9b
Instruction ID: 535d883f8dee8fe30ee0c32217ada5cc009dc72ffce1f69e85c4aa0c9f52864e
Opcode Fuzzy Hash: 838de6618322d32d8417d0959bc04720a73956a65639fcb3cb4b44a7c01e4a9b
Instruction Fuzzy Hash: 2FD05E7154030EBBDB20AB90DC0EFCA776CA700708F0041A07650A50F1DAF8EA998B58

Function 0075F8AE Relevance: 4.9, APIs: 3, Instructions: 385COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1281263787.0000000000701000.00000020.00000001.01000000.00000003.sdmp, Offset: 00700000, based on PE: true

Associated: 00000000.00000002.1281243473.0000000000700000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1281360671.000000000078D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1281360671.00000000007AE000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1281496264.00000000007BA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1281529307.00000000007C4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1281529307.00000000007C7000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1281529307.00000000007D5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1281529307.00000000007D7000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_700000_OC & PL.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: fe400bf70fa43851c5f99b34566917e847deb5366722a366f06fe0589c14902b
Instruction ID: c64d645d004c54dd76e427b7e3ff2a1700a795d3873d7102db7982a16ef2bcf1
Opcode Fuzzy Hash: fe400bf70fa43851c5f99b34566917e847deb5366722a366f06fe0589c14902b
Instruction Fuzzy Hash: 9BF15B71604301DFC710DF28C895B9EB7E5BF88314F14892EF9959B292DB78E949CB82

Function 00704FFC Relevance: 4.6, APIs: 3, Instructions: 77windowCOMMON

Download Yara Rule

APIs

_memset.LIBCMT ref: 00705022
Shell_NotifyIconW.SHELL32(00000000,?), ref: 007050CB

Memory Dump Source

Source File: 00000000.00000002.1281263787.0000000000701000.00000020.00000001.01000000.00000003.sdmp, Offset: 00700000, based on PE: true

Associated: 00000000.00000002.1281243473.0000000000700000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1281360671.000000000078D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1281360671.00000000007AE000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1281496264.00000000007BA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1281529307.00000000007C4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1281529307.00000000007C7000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1281529307.00000000007D5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1281529307.00000000007D7000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_700000_OC & PL.jbxd

Similarity

API ID: IconNotifyShell__memset
String ID:
API String ID: 928536360-0
Opcode ID: 82542ad69c33e953aa29c46df836f901c1d6c518506be3d19cb8b1a48e7e964a
Instruction ID: 0895b02b26f33736311ed472c76c90db932d4e5fb67bef4f75cc6ac655a1fac4
Opcode Fuzzy Hash: 82542ad69c33e953aa29c46df836f901c1d6c518506be3d19cb8b1a48e7e964a
Instruction Fuzzy Hash: A1318EB1604701CFD721DF34D845A9BBBE8FF49304F004A2EE59A82281E779A944CFA6

Function 0072395C Relevance: 4.6, APIs: 3, Instructions: 59memoryCOMMONLIBRARYCODE

Download Yara Rule

APIs

__FF_MSGBANNER.LIBCMT ref: 00723973

Part of subcall function 007281C2: __NMSG_WRITE.LIBCMT ref: 007281E9
Part of subcall function 007281C2: __NMSG_WRITE.LIBCMT ref: 007281F3

__NMSG_WRITE.LIBCMT ref: 0072397A

Part of subcall function 0072821F: GetModuleFileNameW.KERNEL32(00000000,007C0312,00000104,00000000,00000001,00000000), ref: 007282B1
Part of subcall function 0072821F: ___crtMessageBoxW.LIBCMT ref: 0072835F

Part of subcall function 00721145: ___crtCorExitProcess.LIBCMT ref: 0072114B
Part of subcall function 00721145: ExitProcess.KERNEL32 ref: 00721154

Part of subcall function 00727C0E: __getptd_noexit.LIBCMT ref: 00727C0E

RtlAllocateHeap.NTDLL(00D50000,00000000,00000001,00000001,00000000,?,?,0071F507,?,0000000E), ref: 0072399F

Memory Dump Source

Source File: 00000000.00000002.1281263787.0000000000701000.00000020.00000001.01000000.00000003.sdmp, Offset: 00700000, based on PE: true

Associated: 00000000.00000002.1281243473.0000000000700000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1281360671.000000000078D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1281360671.00000000007AE000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1281496264.00000000007BA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1281529307.00000000007C4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1281529307.00000000007C7000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1281529307.00000000007D5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1281529307.00000000007D7000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_700000_OC & PL.jbxd

Similarity

API ID: ExitProcess___crt$AllocateFileHeapMessageModuleName__getptd_noexit
String ID:
API String ID: 1372826849-0
Opcode ID: 881832f54fba6698fe5bdc13f4a8709e18bc494f126a5ebe8c59351642d39965
Instruction ID: 1881569af214369b150ebc2d80c366e04da9f464c06bf81cb5d88ca180d06374
Opcode Fuzzy Hash: 881832f54fba6698fe5bdc13f4a8709e18bc494f126a5ebe8c59351642d39965
Instruction Fuzzy Hash: E901B931345635DAE6253B34FC4AB2A334CDF82768F21412AF54597182DFBCFD8086A5

Function 0074C6D9 Relevance: 4.5, APIs: 3, Instructions: 24filetimeCOMMON

Download Yara Rule

APIs

CreateFileW.KERNELBASE(?,40000000,00000001,00000000,00000003,00000080,00000000,?,?,0074C385,?,?,?,?,?,00000004), ref: 0074C6F2
SetFileTime.KERNELBASE(00000000,?,00000000,?,?,0074C385,?,?,?,?,?,00000004,00000001,?,?,00000004), ref: 0074C708
CloseHandle.KERNEL32(00000000,?,0074C385,?,?,?,?,?,00000004,00000001,?,?,00000004,00000001,?,?), ref: 0074C70F

Memory Dump Source

Source File: 00000000.00000002.1281263787.0000000000701000.00000020.00000001.01000000.00000003.sdmp, Offset: 00700000, based on PE: true

Associated: 00000000.00000002.1281243473.0000000000700000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1281360671.000000000078D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1281360671.00000000007AE000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1281496264.00000000007BA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1281529307.00000000007C4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1281529307.00000000007C7000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1281529307.00000000007D5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1281529307.00000000007D7000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_700000_OC & PL.jbxd

Similarity

API ID: File$CloseCreateHandleTime
String ID:
API String ID: 3397143404-0
Opcode ID: 2f9fd64900f541556e70028086f3e61617cd442199d652b9978ddca75ddc8bd0
Instruction ID: b61c70049b78c2d800195ea1bd93e09df1af62c0e06d6e7a9c2653912f8cfc80
Opcode Fuzzy Hash: 2f9fd64900f541556e70028086f3e61617cd442199d652b9978ddca75ddc8bd0
Instruction Fuzzy Hash: F8E08632181218B7D7322B54AC0DFCA7B18AF05770F208110FB14690E097B52D11879C

Function 0074BB64 Relevance: 4.5, APIs: 3, Instructions: 22COMMON

Download Yara Rule

APIs

_free.LIBCMT ref: 0074BB72

Part of subcall function 00721C9D: RtlFreeHeap.NTDLL(00000000,00000000,?,00727A85), ref: 00721CB1
Part of subcall function 00721C9D: GetLastError.KERNEL32(00000000,?,00727A85), ref: 00721CC3

_free.LIBCMT ref: 0074BB83
_free.LIBCMT ref: 0074BB95

Memory Dump Source

Source File: 00000000.00000002.1281263787.0000000000701000.00000020.00000001.01000000.00000003.sdmp, Offset: 00700000, based on PE: true

Associated: 00000000.00000002.1281243473.0000000000700000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1281360671.000000000078D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1281360671.00000000007AE000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1281496264.00000000007BA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1281529307.00000000007C4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1281529307.00000000007C7000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1281529307.00000000007D5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1281529307.00000000007D7000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_700000_OC & PL.jbxd

Similarity

API ID: _free$ErrorFreeHeapLast
String ID:
API String ID: 776569668-0
Opcode ID: 8d6c99314b0704041c66cbc9d98ad607d1a0ae96d99a55b8255782f8bd4ba31d
Instruction ID: 8c9f2a7aa42861edca3cadfacc8c0cc3c88b1a7154ba4f5250cdf106ba04ea71
Opcode Fuzzy Hash: 8d6c99314b0704041c66cbc9d98ad607d1a0ae96d99a55b8255782f8bd4ba31d
Instruction Fuzzy Hash: C3E012E564175186DA2465797E48EB313CC9F14351B54081DB459E7146DF2CFD80C5B4

Function 0074BBE8 Relevance: 3.6, APIs: 1, Strings: 1, Instructions: 50COMMON

Download Yara Rule

APIs

__fread_nolock.LIBCMT ref: 0074BC18

Strings

EA06, xrefs: 0074BC46

Memory Dump Source

Source File: 00000000.00000002.1281263787.0000000000701000.00000020.00000001.01000000.00000003.sdmp, Offset: 00700000, based on PE: true

Associated: 00000000.00000002.1281243473.0000000000700000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1281360671.000000000078D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1281360671.00000000007AE000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1281496264.00000000007BA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1281529307.00000000007C4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1281529307.00000000007C7000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1281529307.00000000007D5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1281529307.00000000007D7000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_700000_OC & PL.jbxd

Similarity

API ID: __fread_nolock
String ID: EA06
API String ID: 2638373210-3962188686
Opcode ID: d3896d7fa2d11bf844c34895415dc760d7bb02058bfccc6576c380c275807006
Instruction ID: 98805f4013fe5bdbb6e0b7314e504389a26b2723f724cfb52d4ba32ad21d9311
Opcode Fuzzy Hash: d3896d7fa2d11bf844c34895415dc760d7bb02058bfccc6576c380c275807006
Instruction Fuzzy Hash: 9201B572904258BEDB28C7A8C85AFEEBBF89B15305F00455AF592D6181E5B8E7088B70

Function 00760828 Relevance: 3.2, APIs: 2, Instructions: 232COMMON

Download Yara Rule

APIs

_strcat.LIBCMT ref: 007608FD

Part of subcall function 0070936C: __swprintf.LIBCMT ref: 007093AB
Part of subcall function 0070936C: __itow.LIBCMT ref: 007093DF

_wcscpy.LIBCMT ref: 0076098C

Memory Dump Source

Source File: 00000000.00000002.1281263787.0000000000701000.00000020.00000001.01000000.00000003.sdmp, Offset: 00700000, based on PE: true

Associated: 00000000.00000002.1281243473.0000000000700000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1281360671.000000000078D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1281360671.00000000007AE000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1281496264.00000000007BA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1281529307.00000000007C4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1281529307.00000000007C7000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1281529307.00000000007D5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1281529307.00000000007D7000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_700000_OC & PL.jbxd

Similarity

API ID: __itow__swprintf_strcat_wcscpy
String ID:
API String ID: 1012013722-0
Opcode ID: 1484af6397ddb6023c9fd25d49ed6a416b5e4468d085dd8ae1884a531c4bb046
Instruction ID: 01e51939a56c7d1292f2a3754135504a4f42b9e1faeea09128abaff5076e350b
Opcode Fuzzy Hash: 1484af6397ddb6023c9fd25d49ed6a416b5e4468d085dd8ae1884a531c4bb046
Instruction Fuzzy Hash: 35912634A00605DFCB18DF68C4959AAB7E5EF49350B55C06AEC5ACF3A2DB38ED41CB80

Function 00703A0F Relevance: 3.1, APIs: 2, Instructions: 59COMMON

Download Yara Rule

APIs

IsThemeActive.UXTHEME ref: 00703A73

Part of subcall function 00721405: __lock.LIBCMT ref: 0072140B

Part of subcall function 00703ADB: SystemParametersInfoW.USER32(00002000,00000000,?,00000000), ref: 00703AF3
Part of subcall function 00703ADB: SystemParametersInfoW.USER32(00002001,00000000,00000000,00000002), ref: 00703B08

Part of subcall function 00703D19: GetCurrentDirectoryW.KERNEL32(00007FFF,?,00000000,00000001,?,?,00703AA3,?), ref: 00703D45
Part of subcall function 00703D19: IsDebuggerPresent.KERNEL32(?,?,?,?,00703AA3,?), ref: 00703D57
Part of subcall function 00703D19: GetFullPathNameW.KERNEL32(00007FFF,?,?,007C1148,007C1130,?,?,?,?,00703AA3,?), ref: 00703DC8
Part of subcall function 00703D19: SetCurrentDirectoryW.KERNEL32(?,?,?,00703AA3,?), ref: 00703E48

SystemParametersInfoW.USER32(00002001,00000000,00000000,00000002), ref: 00703AB3

Memory Dump Source

Source File: 00000000.00000002.1281263787.0000000000701000.00000020.00000001.01000000.00000003.sdmp, Offset: 00700000, based on PE: true

Associated: 00000000.00000002.1281243473.0000000000700000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1281360671.000000000078D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1281360671.00000000007AE000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1281496264.00000000007BA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1281529307.00000000007C4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1281529307.00000000007C7000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1281529307.00000000007D5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1281529307.00000000007D7000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_700000_OC & PL.jbxd

Similarity

API ID: InfoParametersSystem$CurrentDirectory$ActiveDebuggerFullNamePathPresentTheme__lock
String ID:
API String ID: 924797094-0
Opcode ID: c8d88d84b51fa08acdfd9c558f01b80d82ed0e358dfb0e4765eabf7cd3ea2e28
Instruction ID: 266e825283f234e0285f71af2900b186bc7615a686fa2cd869001bf3439c8d38
Opcode Fuzzy Hash: c8d88d84b51fa08acdfd9c558f01b80d82ed0e358dfb0e4765eabf7cd3ea2e28
Instruction Fuzzy Hash: 0411C071904340DFC300EF29E80990ABBE9FF95310F00CA1EF985832A2DB788591CBD6

Function 0072E9D2 Relevance: 3.1, APIs: 2, Instructions: 52COMMONLIBRARYCODE

Download Yara Rule

APIs

___lock_fhandle.LIBCMT ref: 0072EA29
__close_nolock.LIBCMT ref: 0072EA42

Part of subcall function 00727BDA: __getptd_noexit.LIBCMT ref: 00727BDA

Part of subcall function 00727C0E: __getptd_noexit.LIBCMT ref: 00727C0E

Memory Dump Source

Source File: 00000000.00000002.1281263787.0000000000701000.00000020.00000001.01000000.00000003.sdmp, Offset: 00700000, based on PE: true

Associated: 00000000.00000002.1281243473.0000000000700000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1281360671.000000000078D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1281360671.00000000007AE000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1281496264.00000000007BA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1281529307.00000000007C4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1281529307.00000000007C7000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1281529307.00000000007D5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1281529307.00000000007D7000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_700000_OC & PL.jbxd

Similarity

API ID: __getptd_noexit$___lock_fhandle__close_nolock
String ID:
API String ID: 1046115767-0
Opcode ID: 71599ac44a9b98d07540df167ad1a3fb7776652972bd28178642780c68226fc2
Instruction ID: d7c623ab7c15bbe655fd00281432b2485baf249678601906904011f19a35c8a1
Opcode Fuzzy Hash: 71599ac44a9b98d07540df167ad1a3fb7776652972bd28178642780c68226fc2
Instruction Fuzzy Hash: 0D11A0B2805670DAD716BB68B94676C3A70AF82331F268340E4201B1E2CBBC9940C6A5

Function 0071F4EA Relevance: 3.0, APIs: 2, Instructions: 43COMMON

Download Yara Rule

APIs

Part of subcall function 0072395C: __FF_MSGBANNER.LIBCMT ref: 00723973
Part of subcall function 0072395C: __NMSG_WRITE.LIBCMT ref: 0072397A
Part of subcall function 0072395C: RtlAllocateHeap.NTDLL(00D50000,00000000,00000001,00000001,00000000,?,?,0071F507,?,0000000E), ref: 0072399F

std::exception::exception.LIBCMT ref: 0071F51E
__CxxThrowException@8.LIBCMT ref: 0071F533

Part of subcall function 00726805: RaiseException.KERNEL32(?,?,0000000E,007B6A30,?,?,?,0071F538,0000000E,007B6A30,?,00000001), ref: 00726856

Memory Dump Source

Source File: 00000000.00000002.1281263787.0000000000701000.00000020.00000001.01000000.00000003.sdmp, Offset: 00700000, based on PE: true

Associated: 00000000.00000002.1281243473.0000000000700000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1281360671.000000000078D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1281360671.00000000007AE000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1281496264.00000000007BA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1281529307.00000000007C4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1281529307.00000000007C7000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1281529307.00000000007D5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1281529307.00000000007D7000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_700000_OC & PL.jbxd

Similarity

API ID: AllocateExceptionException@8HeapRaiseThrowstd::exception::exception
String ID:
API String ID: 3902256705-0
Opcode ID: d36d679f9a840debd6ffc02b7e8781135882e23c935cd013a635ee352e1966ff
Instruction ID: c35157cbbb99eb1b5bcd2ffb176ae4a4d04dcde480ae83e952ad3131caa0ebca
Opcode Fuzzy Hash: d36d679f9a840debd6ffc02b7e8781135882e23c935cd013a635ee352e1966ff
Instruction Fuzzy Hash: 77F0AF3110422EA7DB14BF9DE8059DE77E8AF00354F708036F909A21C1DBB89A9097E6

Function 00723839 Relevance: 3.0, APIs: 2, Instructions: 42COMMONLIBRARYCODE

Download Yara Rule

APIs

_memset.LIBCMT ref: 00723868
__lock_file.LIBCMT ref: 00723889

Memory Dump Source

Source File: 00000000.00000002.1281263787.0000000000701000.00000020.00000001.01000000.00000003.sdmp, Offset: 00700000, based on PE: true

Associated: 00000000.00000002.1281243473.0000000000700000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1281360671.000000000078D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1281360671.00000000007AE000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1281496264.00000000007BA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1281529307.00000000007C4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1281529307.00000000007C7000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1281529307.00000000007D5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1281529307.00000000007D7000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_700000_OC & PL.jbxd

Similarity

API ID: __lock_file_memset
String ID:
API String ID: 26237723-0
Opcode ID: 68c8a24bba93595a38f55dc38d3c21cb5948ac254ee6c63f996dfd18fee4254a
Instruction ID: e24aadfb4d5b310000be56b7d588226a4f6c3fff984c160d2b10e0dfd64ad766
Opcode Fuzzy Hash: 68c8a24bba93595a38f55dc38d3c21cb5948ac254ee6c63f996dfd18fee4254a
Instruction Fuzzy Hash: 650188B1C00229EBCF11AFA4AC0559F7B71BF40310F154219F4145A161D73D8B51DBA1

Function 007235E4 Relevance: 3.0, APIs: 2, Instructions: 33COMMONLIBRARYCODE

Download Yara Rule

APIs

Part of subcall function 00727C0E: __getptd_noexit.LIBCMT ref: 00727C0E

__lock_file.LIBCMT ref: 00723629

Part of subcall function 00724E1C: __lock.LIBCMT ref: 00724E3F

__fclose_nolock.LIBCMT ref: 00723634

Memory Dump Source

Source File: 00000000.00000002.1281263787.0000000000701000.00000020.00000001.01000000.00000003.sdmp, Offset: 00700000, based on PE: true

Associated: 00000000.00000002.1281243473.0000000000700000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1281360671.000000000078D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1281360671.00000000007AE000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1281496264.00000000007BA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1281529307.00000000007C4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1281529307.00000000007C7000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1281529307.00000000007D5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1281529307.00000000007D7000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_700000_OC & PL.jbxd

Similarity

API ID: __fclose_nolock__getptd_noexit__lock__lock_file
String ID:
API String ID: 2800547568-0
Opcode ID: 2cfb7aeafb783ef23b4f5dd29dc3088f9ac929532af014035229d0a7b03bd3ac
Instruction ID: 53cf839632f7d8ae9c952643e53c2893da005ba0e3b4a3d4b26da52f9b9106b3
Opcode Fuzzy Hash: 2cfb7aeafb783ef23b4f5dd29dc3088f9ac929532af014035229d0a7b03bd3ac
Instruction Fuzzy Hash: 76F0B4B1901234EADB117B75A80A76E7AA46F40330F258149E464AB3C1CB7C8B019B55

Function 00F5414D Relevance: 1.9, APIs: 1, Instructions: 400processthreadCOMMON

Download Yara Rule

APIs

CreateProcessW.KERNELBASE(?,00000000), ref: 00F5497D
Wow64GetThreadContext.KERNEL32(?,00010007), ref: 00F549A1
ReadProcessMemory.KERNELBASE(?,?,?,00000004,00000000), ref: 00F549C3

Memory Dump Source

Source File: 00000000.00000002.1282677803.0000000000F52000.00000040.00000020.00020000.00000000.sdmp, Offset: 00F52000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f52000_OC & PL.jbxd

Similarity

API ID: Process$ContextCreateMemoryReadThreadWow64
String ID:
API String ID: 2438371351-0
Opcode ID: 282d440d23347d33a5333bc70feb3b77e7ffa06fe9f8fdc76eda24defaf3804a
Instruction ID: 47366c19e68eb171397b6736dc888462ffdd733ee42befb6ccb1a60efd3b757e
Opcode Fuzzy Hash: 282d440d23347d33a5333bc70feb3b77e7ffa06fe9f8fdc76eda24defaf3804a
Instruction Fuzzy Hash: 8312FD20E24658C6EB24DF60D8507DEB232EF68300F1090E9910DEB7A4E77A5F85CF5A

Function 0070E8A0 Relevance: 1.7, APIs: 1, Instructions: 192COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1281263787.0000000000701000.00000020.00000001.01000000.00000003.sdmp, Offset: 00700000, based on PE: true

Associated: 00000000.00000002.1281243473.0000000000700000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1281360671.000000000078D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1281360671.00000000007AE000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1281496264.00000000007BA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1281529307.00000000007C4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1281529307.00000000007C7000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1281529307.00000000007D5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1281529307.00000000007D7000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_700000_OC & PL.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: de1caebc56e15587141934526f95b229460c9d647bd6cf8c64d7662702648db6
Instruction ID: 5c7d3a00dd1db03a86bfef077800dc2901fab909965417702b42ffe119fc401f
Opcode Fuzzy Hash: de1caebc56e15587141934526f95b229460c9d647bd6cf8c64d7662702648db6
Instruction Fuzzy Hash: 9D71B970904384CFEF25CF24C44976977D0AB55344F08CA7EE8899B2D2D7BD9885CB82

Function 00722957 Relevance: 1.6, APIs: 1, Instructions: 135COMMON

Download Yara Rule

APIs

__flush.LIBCMT ref: 00722A0B

Part of subcall function 00727C0E: __getptd_noexit.LIBCMT ref: 00727C0E

Memory Dump Source

Source File: 00000000.00000002.1281263787.0000000000701000.00000020.00000001.01000000.00000003.sdmp, Offset: 00700000, based on PE: true

Associated: 00000000.00000002.1281243473.0000000000700000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1281360671.000000000078D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1281360671.00000000007AE000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1281496264.00000000007BA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1281529307.00000000007C4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1281529307.00000000007C7000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1281529307.00000000007D5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1281529307.00000000007D7000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_700000_OC & PL.jbxd

Similarity

API ID: __flush__getptd_noexit
String ID:
API String ID: 4101623367-0
Opcode ID: ba1b573b9a1c5d238bdcc52ef1885e10968c5b94d85714b9232a10917baff8d1
Instruction ID: 962f209e61af227c9e258f48b08c918ade4c3436395c60b1c67d21232bde275d
Opcode Fuzzy Hash: ba1b573b9a1c5d238bdcc52ef1885e10968c5b94d85714b9232a10917baff8d1
Instruction Fuzzy Hash: B841C870700726BFDF288E69E88156E77B6AF44360F24C52DE855D7542EB78EE828B40

Function 0071ED18 Relevance: 1.6, APIs: 1, Instructions: 94memoryCOMMON

Download Yara Rule

APIs

VirtualProtect.KERNELBASE ref: 0071EDC7

Memory Dump Source

Source File: 00000000.00000002.1281263787.0000000000701000.00000020.00000001.01000000.00000003.sdmp, Offset: 00700000, based on PE: true

Associated: 00000000.00000002.1281243473.0000000000700000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1281360671.000000000078D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1281360671.00000000007AE000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1281496264.00000000007BA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1281529307.00000000007C4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1281529307.00000000007C7000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1281529307.00000000007D5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1281529307.00000000007D7000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_700000_OC & PL.jbxd

Similarity

API ID: ProtectVirtual
String ID:
API String ID: 544645111-0
Opcode ID: 160be14eaa7db79452b6aeb530136e2f2731e3e0b6e758b09a27e7bca35b483d
Instruction ID: e54d43c9dc4e5d25ea9aa9ec9a49a51218540601a987700135d7010376f026cd
Opcode Fuzzy Hash: 160be14eaa7db79452b6aeb530136e2f2731e3e0b6e758b09a27e7bca35b483d
Instruction Fuzzy Hash: 4A31B574B001059BD718DF5CE4809A9FBB6FF49340B6486A9E849CB296DB35EDC1CBD0

Function 0076040F Relevance: 1.6, APIs: 1, Instructions: 93COMMON

Download Yara Rule

APIs

_free.LIBCMT ref: 00760519

Memory Dump Source

Source File: 00000000.00000002.1281263787.0000000000701000.00000020.00000001.01000000.00000003.sdmp, Offset: 00700000, based on PE: true

Associated: 00000000.00000002.1281243473.0000000000700000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1281360671.000000000078D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1281360671.00000000007AE000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1281496264.00000000007BA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1281529307.00000000007C4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1281529307.00000000007C7000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1281529307.00000000007D5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1281529307.00000000007D7000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_700000_OC & PL.jbxd

Similarity

API ID: _free
String ID:
API String ID: 269201875-0
Opcode ID: 9af4ebb1ae81048eefb6ff48ebb65af11a8df766e70855496ee050d7c8e0cebc
Instruction ID: a175d46dd18798d97e6b86652ee1376e23718e66380eaa5537b09d758d9a6184
Opcode Fuzzy Hash: 9af4ebb1ae81048eefb6ff48ebb65af11a8df766e70855496ee050d7c8e0cebc
Instruction Fuzzy Hash: 19318F75204524DFCB11AF14D094AAF7BB1FF49320F10848AEA971B386DB78A965CFD1

Function 00779A75 Relevance: 1.6, APIs: 1, Instructions: 88COMMON

Download Yara Rule

APIs

VariantClear.OLEAUT32 ref: 00779A80

Memory Dump Source

Source File: 00000000.00000002.1281263787.0000000000701000.00000020.00000001.01000000.00000003.sdmp, Offset: 00700000, based on PE: true

Associated: 00000000.00000002.1281243473.0000000000700000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1281360671.000000000078D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1281360671.00000000007AE000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1281496264.00000000007BA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1281529307.00000000007C4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1281529307.00000000007C7000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1281529307.00000000007D5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1281529307.00000000007D7000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_700000_OC & PL.jbxd

Similarity

API ID: ClearVariant
String ID:
API String ID: 1473721057-0
Opcode ID: 004ce83ac4ab8f057741476bdeb0874fd4e6410926ad9497a03dbe3aa938e570
Instruction ID: 0e7b58045e1a3dbc9db1818fb788efc322e9ff020e050f43e0bf0d070e9973d1
Opcode Fuzzy Hash: 004ce83ac4ab8f057741476bdeb0874fd4e6410926ad9497a03dbe3aa938e570
Instruction Fuzzy Hash: CA414D70504641CFDB24DF18C444B5ABBF1BF85344F1989ACE99A4B7A2C37AE885CF92

Function 0072ED06 Relevance: 1.6, APIs: 1, Instructions: 66COMMONLIBRARYCODE

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1281263787.0000000000701000.00000020.00000001.01000000.00000003.sdmp, Offset: 00700000, based on PE: true

Associated: 00000000.00000002.1281243473.0000000000700000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1281360671.000000000078D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1281360671.00000000007AE000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1281496264.00000000007BA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1281529307.00000000007C4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1281529307.00000000007C7000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1281529307.00000000007D5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1281529307.00000000007D7000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_700000_OC & PL.jbxd

Similarity

API ID: __getptd_noexit
String ID:
API String ID: 3074181302-0
Opcode ID: b5cbfbda963e4620040ca6c3f13b363897ef4e3addd114f3f0c6e176402a9f12
Instruction ID: 4433d0b26e448041a5115c2a744c11260649ce179a239cc3ad0f2f965228bdfd
Opcode Fuzzy Hash: b5cbfbda963e4620040ca6c3f13b363897ef4e3addd114f3f0c6e176402a9f12
Instruction Fuzzy Hash: 3B218EB2914670DBD7167FA8FD497583B61AF42336F2A4640E4705B1E2DBBC8C40CBA5

Function 007041A9 Relevance: 1.6, APIs: 1, Instructions: 63libraryCOMMON

Download Yara Rule

APIs

Part of subcall function 00704214: FreeLibrary.KERNEL32(00000000,?), ref: 00704247

LoadLibraryExW.KERNEL32(00000001,00000000,00000002,?,?,?,?,007039FE,?,00000001), ref: 007041DB

Part of subcall function 00704291: FreeLibrary.KERNEL32(00000000), ref: 007042C4

Memory Dump Source

Source File: 00000000.00000002.1281263787.0000000000701000.00000020.00000001.01000000.00000003.sdmp, Offset: 00700000, based on PE: true

Associated: 00000000.00000002.1281243473.0000000000700000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1281360671.000000000078D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1281360671.00000000007AE000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1281496264.00000000007BA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1281529307.00000000007C4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1281529307.00000000007C7000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1281529307.00000000007D5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1281529307.00000000007D7000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_700000_OC & PL.jbxd

Similarity

API ID: Library$Free$Load
String ID:
API String ID: 2391024519-0
Opcode ID: 816924c845febdb0483d19a8ceab5817ad9a156fabba5d126a360528756a0d85
Instruction ID: 465a89d814a24b2f61a637f449a8ca2fe0bf236e915e49b98eca97ae68b916ca
Opcode Fuzzy Hash: 816924c845febdb0483d19a8ceab5817ad9a156fabba5d126a360528756a0d85
Instruction Fuzzy Hash: 7E1194B1700206EADB14BB64DC0AF9E77E9AF40700F108529F696A61C1DB789E059B60

Function 00779B45 Relevance: 1.6, APIs: 1, Instructions: 62COMMON

Download Yara Rule

APIs

VariantClear.OLEAUT32(?), ref: 00779B51

Memory Dump Source

Source File: 00000000.00000002.1281263787.0000000000701000.00000020.00000001.01000000.00000003.sdmp, Offset: 00700000, based on PE: true

Associated: 00000000.00000002.1281243473.0000000000700000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1281360671.000000000078D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1281360671.00000000007AE000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1281496264.00000000007BA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1281529307.00000000007C4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1281529307.00000000007C7000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1281529307.00000000007D5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1281529307.00000000007D7000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_700000_OC & PL.jbxd

Similarity

API ID: ClearVariant
String ID:
API String ID: 1473721057-0
Opcode ID: 1c3488d01a118e9a5d9d8fe4b9d9cad4cab8e54b5824d0ba05da4a6a627dfa5f
Instruction ID: 0323db8f156b70a7bca32aa01f40144cf5bc9a8261b0e1be54871007acff04dd
Opcode Fuzzy Hash: 1c3488d01a118e9a5d9d8fe4b9d9cad4cab8e54b5824d0ba05da4a6a627dfa5f
Instruction Fuzzy Hash: 5C215A70508201CFDB24DF28C448A5ABBF1BF84304F148968F59A4B2A2D779E885CF92

Function 0072AF61 Relevance: 1.6, APIs: 1, Instructions: 56COMMONLIBRARYCODE

Download Yara Rule

APIs

___lock_fhandle.LIBCMT ref: 0072AFC0

Part of subcall function 00727BDA: __getptd_noexit.LIBCMT ref: 00727BDA

Part of subcall function 00727C0E: __getptd_noexit.LIBCMT ref: 00727C0E

Memory Dump Source

Source File: 00000000.00000002.1281263787.0000000000701000.00000020.00000001.01000000.00000003.sdmp, Offset: 00700000, based on PE: true

Associated: 00000000.00000002.1281243473.0000000000700000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1281360671.000000000078D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1281360671.00000000007AE000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1281496264.00000000007BA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1281529307.00000000007C4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1281529307.00000000007C7000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1281529307.00000000007D5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1281529307.00000000007D7000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_700000_OC & PL.jbxd

Similarity

API ID: __getptd_noexit$___lock_fhandle
String ID:
API String ID: 1144279405-0
Opcode ID: 8ac8270cd4331d4ed80d8c37640bb35d8b621c532dca8cccbf478cbf358c1818
Instruction ID: 744c67b5e4869696f5b8dab5bbf6f2be3ee3e45a71b20cc1070c4e3562f6a09a
Opcode Fuzzy Hash: 8ac8270cd4331d4ed80d8c37640bb35d8b621c532dca8cccbf478cbf358c1818
Instruction Fuzzy Hash: A3118FB2805670DFD7267FA4BA4A7593B60AF42332F264244E4741B1E2D7BC8D40DBA5

Function 007039DB Relevance: 1.5, APIs: 1, Instructions: 41COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1281263787.0000000000701000.00000020.00000001.01000000.00000003.sdmp, Offset: 00700000, based on PE: true

Associated: 00000000.00000002.1281243473.0000000000700000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1281360671.000000000078D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1281360671.00000000007AE000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1281496264.00000000007BA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1281529307.00000000007C4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1281529307.00000000007C7000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1281529307.00000000007D5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1281529307.00000000007D7000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_700000_OC & PL.jbxd

Similarity

API ID: LibraryLoad
String ID:
API String ID: 1029625771-0
Opcode ID: e908df7db2011151d19b897d4a4948494f90a1a3426dd436a38c65c5f4b6a17e
Instruction ID: 102e93f540c1ad9d098f156824181bf9ce447f0a251c437fc91807a7a08b24c5
Opcode Fuzzy Hash: e908df7db2011151d19b897d4a4948494f90a1a3426dd436a38c65c5f4b6a17e
Instruction Fuzzy Hash: C201367150010DEECF05EF64C8958FEBBB8AF21344F10C165B565971E5EA349B49DB60

Function 00722AAE Relevance: 1.5, APIs: 1, Instructions: 35COMMON

Download Yara Rule

APIs

__lock_file.LIBCMT ref: 00722AED

Part of subcall function 00727C0E: __getptd_noexit.LIBCMT ref: 00727C0E

Memory Dump Source

Source File: 00000000.00000002.1281263787.0000000000701000.00000020.00000001.01000000.00000003.sdmp, Offset: 00700000, based on PE: true

Associated: 00000000.00000002.1281243473.0000000000700000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1281360671.000000000078D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1281360671.00000000007AE000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1281496264.00000000007BA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1281529307.00000000007C4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1281529307.00000000007C7000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1281529307.00000000007D5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1281529307.00000000007D7000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_700000_OC & PL.jbxd

Similarity

API ID: __getptd_noexit__lock_file
String ID:
API String ID: 2597487223-0
Opcode ID: d272f85fb26d1fc1e518e801c0ffea0cae74b9fcff53be19cbdfd04f006973b5
Instruction ID: cb4570d758fc57c349779fe60c4356e78a93c96e59c02c27d51a823ae60b274e
Opcode Fuzzy Hash: d272f85fb26d1fc1e518e801c0ffea0cae74b9fcff53be19cbdfd04f006973b5
Instruction Fuzzy Hash: 2CF0C271900265FBDF21AF74AC0A7DF3AB5BF00310F158465B8149A192D77CCA53DB51

Function 00704252 Relevance: 1.5, APIs: 1, Instructions: 28COMMON

Download Yara Rule

APIs

FreeLibrary.KERNEL32(?,?,?,?,?,007039FE,?,00000001), ref: 00704286

Memory Dump Source

Source File: 00000000.00000002.1281263787.0000000000701000.00000020.00000001.01000000.00000003.sdmp, Offset: 00700000, based on PE: true

Associated: 00000000.00000002.1281243473.0000000000700000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1281360671.000000000078D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1281360671.00000000007AE000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1281496264.00000000007BA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1281529307.00000000007C4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1281529307.00000000007C7000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1281529307.00000000007D5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1281529307.00000000007D7000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_700000_OC & PL.jbxd

Similarity

API ID: FreeLibrary
String ID:
API String ID: 3664257935-0
Opcode ID: 0e88b7840c3e33859f4693d15d2aa4321261966f13a25a22a6b2c33491d5fdc5
Instruction ID: 7d6307927fc64713b41263fcde2c7310855f1000d152fe7a9e49401dbfb8c1c4
Opcode Fuzzy Hash: 0e88b7840c3e33859f4693d15d2aa4321261966f13a25a22a6b2c33491d5fdc5
Instruction Fuzzy Hash: 44F039B1605712DFCB34DF64E894816BBE4BF043253248B7EF2D682650C73A9840DF50

Function 007040A7 Relevance: 1.5, APIs: 1, Instructions: 23COMMON

Download Yara Rule

APIs

GetLongPathNameW.KERNELBASE(?,?,00007FFF), ref: 007040C6

Memory Dump Source

Source File: 00000000.00000002.1281263787.0000000000701000.00000020.00000001.01000000.00000003.sdmp, Offset: 00700000, based on PE: true

Associated: 00000000.00000002.1281243473.0000000000700000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1281360671.000000000078D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1281360671.00000000007AE000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1281496264.00000000007BA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1281529307.00000000007C4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1281529307.00000000007C7000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1281529307.00000000007D5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1281529307.00000000007D7000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_700000_OC & PL.jbxd

Similarity

API ID: LongNamePath
String ID:
API String ID: 82841172-0
Opcode ID: 191be6fc96d09e2867c9e4614a92fc90510b9811674da070fb41ddebc6d3e251
Instruction ID: b8528febb20e6963a88ab96fdbdf462e79d375ecbb280612bd552e79a8f5eaa8
Opcode Fuzzy Hash: 191be6fc96d09e2867c9e4614a92fc90510b9811674da070fb41ddebc6d3e251
Instruction Fuzzy Hash: A1E0CD766001249BC711A654DC4AFEA77ADDF8C6A0F054175F905D7244D9689D818790

Function 0074BCF4 Relevance: 1.5, APIs: 1, Instructions: 22COMMON

Download Yara Rule

APIs

__fread_nolock.LIBCMT ref: 0074BD16

Memory Dump Source

Source File: 00000000.00000002.1281263787.0000000000701000.00000020.00000001.01000000.00000003.sdmp, Offset: 00700000, based on PE: true

Associated: 00000000.00000002.1281243473.0000000000700000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1281360671.000000000078D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1281360671.00000000007AE000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1281496264.00000000007BA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1281529307.00000000007C4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1281529307.00000000007C7000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1281529307.00000000007D5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1281529307.00000000007D7000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_700000_OC & PL.jbxd

Similarity

API ID: __fread_nolock
String ID:
API String ID: 2638373210-0
Opcode ID: 3cca4198d2bc13ecada8dba30311a83a0df564d107d747b73ddd6f796e1577fd
Instruction ID: 28f5cb496824df83d0a99a5c36f7f3ae830e87a8cc64031e10afc85d7bc33218
Opcode Fuzzy Hash: 3cca4198d2bc13ecada8dba30311a83a0df564d107d747b73ddd6f796e1577fd
Instruction Fuzzy Hash: 44E092B1604B009BD7388A24D800BE373E0EB05309F00085CF29A83241EBA6BC418A59

Function 00F5514C Relevance: 1.3, APIs: 1, Instructions: 21sleepCOMMON

Download Yara Rule

APIs

Sleep.KERNELBASE(000001F4), ref: 00F55161

Memory Dump Source

Source File: 00000000.00000002.1282677803.0000000000F52000.00000040.00000020.00020000.00000000.sdmp, Offset: 00F52000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f52000_OC & PL.jbxd

Similarity

API ID: Sleep
String ID:
API String ID: 3472027048-0
Opcode ID: 647f186050b41918f79179839cbc1a488579cc5f77474145a25b6e124dddc6ea
Instruction ID: 130cc198b400aaeea513041b5422cda64d50bab34e3379e7781aca9737a8bef1
Opcode Fuzzy Hash: 647f186050b41918f79179839cbc1a488579cc5f77474145a25b6e124dddc6ea
Instruction Fuzzy Hash: 34E09A7494010DAFDB00EFA8D54969E7BB4EF04702F1005A1FE0596681DA309A549A62

Function 00F55150 Relevance: 1.3, APIs: 1, Instructions: 18sleepCOMMON

Download Yara Rule

APIs

Sleep.KERNELBASE(000001F4), ref: 00F55161

Memory Dump Source

Source File: 00000000.00000002.1282677803.0000000000F52000.00000040.00000020.00020000.00000000.sdmp, Offset: 00F52000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f52000_OC & PL.jbxd

Similarity

API ID: Sleep
String ID:
API String ID: 3472027048-0
Opcode ID: 368835ae2f5fba710e6c01549c2017e46dd928bc4d187f44ede00cceab054826
Instruction ID: 3d4235f4d00b53c57e946b79fe56bca51ec6586e08868ce3ec6a24acce56f592
Opcode Fuzzy Hash: 368835ae2f5fba710e6c01549c2017e46dd928bc4d187f44ede00cceab054826
Instruction Fuzzy Hash: 5AE0E67494010DDFDB00EFB8D54969E7FB4EF04702F100161FD01D2281D6309D509A62

Non-executed Functions

Function 0076AACE Relevance: 60.1, APIs: 33, Strings: 1, Instructions: 574windowCOMMON

Download Yara Rule

APIs

SendMessageW.USER32(?,00000400,00000000,00000000), ref: 0076B1CD

Strings

%d/%02d/%02d, xrefs: 0076AEFC

Memory Dump Source

Source File: 00000000.00000002.1281263787.0000000000701000.00000020.00000001.01000000.00000003.sdmp, Offset: 00700000, based on PE: true

Associated: 00000000.00000002.1281243473.0000000000700000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1281360671.000000000078D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1281360671.00000000007AE000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1281496264.00000000007BA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1281529307.00000000007C4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1281529307.00000000007C7000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1281529307.00000000007D5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1281529307.00000000007D7000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_700000_OC & PL.jbxd

Similarity

API ID: MessageSend
String ID: %d/%02d/%02d
API String ID: 3850602802-328681919
Opcode ID: d21cf129de33503fb905e2f810ace066a4ed74cc58e7118bb8d9bb8b1f166f40
Instruction ID: 5fb1b85082a9c5ace096b5acbf5cccfb42082a85f27bdd13794d02a60f2c3ba9
Opcode Fuzzy Hash: d21cf129de33503fb905e2f810ace066a4ed74cc58e7118bb8d9bb8b1f166f40
Instruction Fuzzy Hash: 70128071600218BBEB259F68CC49FAA7BB8FF46710F108119FD16EA2D1DB789941CF61

Function 0071EB42 Relevance: 43.9, APIs: 24, Strings: 1, Instructions: 130keyboardthreadwindowCOMMON

Download Yara Rule

APIs

GetForegroundWindow.USER32(00000000,00000000), ref: 0071EB4A
FindWindowW.USER32(Shell_TrayWnd,00000000), ref: 00773AEA
IsIconic.USER32(000000FF), ref: 00773AF3
ShowWindow.USER32(000000FF,00000009), ref: 00773B00
SetForegroundWindow.USER32(000000FF), ref: 00773B0A
GetWindowThreadProcessId.USER32(00000000,00000000), ref: 00773B20
GetCurrentThreadId.KERNEL32 ref: 00773B27
GetWindowThreadProcessId.USER32(000000FF,00000000), ref: 00773B33
AttachThreadInput.USER32(000000FF,00000000,00000001), ref: 00773B44
AttachThreadInput.USER32(000000FF,00000000,00000001), ref: 00773B4C
AttachThreadInput.USER32(00000000,?,00000001), ref: 00773B54
SetForegroundWindow.USER32(000000FF), ref: 00773B57
MapVirtualKeyW.USER32(00000012,00000000), ref: 00773B6C
keybd_event.USER32(00000012,00000000), ref: 00773B77
MapVirtualKeyW.USER32(00000012,00000000), ref: 00773B81
keybd_event.USER32(00000012,00000000), ref: 00773B86
MapVirtualKeyW.USER32(00000012,00000000), ref: 00773B8F
keybd_event.USER32(00000012,00000000), ref: 00773B94
MapVirtualKeyW.USER32(00000012,00000000), ref: 00773B9E
keybd_event.USER32(00000012,00000000), ref: 00773BA3
SetForegroundWindow.USER32(000000FF), ref: 00773BA6
AttachThreadInput.USER32(000000FF,?,00000000), ref: 00773BCD

Strings

Shell_TrayWnd, xrefs: 00773AE5

Memory Dump Source

Source File: 00000000.00000002.1281263787.0000000000701000.00000020.00000001.01000000.00000003.sdmp, Offset: 00700000, based on PE: true

Associated: 00000000.00000002.1281243473.0000000000700000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1281360671.000000000078D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1281360671.00000000007AE000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1281496264.00000000007BA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1281529307.00000000007C4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1281529307.00000000007C7000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1281529307.00000000007D5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1281529307.00000000007D7000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_700000_OC & PL.jbxd

Similarity

API ID: Window$Thread$AttachForegroundInputVirtualkeybd_event$Process$CurrentFindIconicShow
String ID: Shell_TrayWnd
API String ID: 4125248594-2988720461
Opcode ID: 8295442dcbf53eec261bdc2eddcd75193918f881b12dab7c54884f452fd3fc11
Instruction ID: 7ab77acadaf2854954b4a508894bb907f4ab104b3451c555307772dbb6f0f11b
Opcode Fuzzy Hash: 8295442dcbf53eec261bdc2eddcd75193918f881b12dab7c54884f452fd3fc11
Instruction Fuzzy Hash: F23169B1A803187BEF305B658C49F7F7F6CDB44B90F218015FA05E61D0D6B95D10AB64

Function 0073ACC5 Relevance: 37.0, APIs: 17, Strings: 4, Instructions: 223COMMON

Download Yara Rule

APIs

Part of subcall function 0073B134: LookupPrivilegeValueW.ADVAPI32(00000000,00000000,00000004), ref: 0073B180
Part of subcall function 0073B134: AdjustTokenPrivileges.ADVAPI32(?,00000000,00000000,?,00000000,?), ref: 0073B1AD
Part of subcall function 0073B134: GetLastError.KERNEL32 ref: 0073B1BA

_memset.LIBCMT ref: 0073AD08
DuplicateTokenEx.ADVAPI32(?,00000000,00000000,00000002,00000001,?,?,?,?,00000001,?,?), ref: 0073AD5A
CloseHandle.KERNEL32(?), ref: 0073AD6B
OpenWindowStationW.USER32(winsta0,00000000,00060000), ref: 0073AD82
GetProcessWindowStation.USER32 ref: 0073AD9B
SetProcessWindowStation.USER32(00000000), ref: 0073ADA5
OpenDesktopW.USER32(default,00000000,00000000,00060081), ref: 0073ADBF

Part of subcall function 0073AB84: AdjustTokenPrivileges.ADVAPI32(?,00000000,?,00000000,00000000,00000000,?,0073ACC0), ref: 0073AB99
Part of subcall function 0073AB84: CloseHandle.KERNEL32(?,?,0073ACC0), ref: 0073ABAB

Strings

H*{, xrefs: 0073AE40
default, xrefs: 0073ADBA
winsta0, xrefs: 0073AD7D
, xrefs: 0073AD17

Memory Dump Source

Source File: 00000000.00000002.1281263787.0000000000701000.00000020.00000001.01000000.00000003.sdmp, Offset: 00700000, based on PE: true

Associated: 00000000.00000002.1281243473.0000000000700000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1281360671.000000000078D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1281360671.00000000007AE000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1281496264.00000000007BA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1281529307.00000000007C4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1281529307.00000000007C7000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1281529307.00000000007D5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1281529307.00000000007D7000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_700000_OC & PL.jbxd

Similarity

API ID: StationTokenWindow$AdjustCloseHandleOpenPrivilegesProcess$DesktopDuplicateErrorLastLookupPrivilegeValue_memset
String ID: $H*{$default$winsta0
API String ID: 2063423040-2197612085
Opcode ID: a6fe45a2f1f2b3802c60ec2b8031276ea7f91b5f77cc5625270a330762dba86d
Instruction ID: 748b9c3f56f1cfbf50f271e3d806505c566a7f2366b87b7a991769342d243217
Opcode Fuzzy Hash: a6fe45a2f1f2b3802c60ec2b8031276ea7f91b5f77cc5625270a330762dba86d
Instruction Fuzzy Hash: 82819DB194120DFFEF119FA4CC4AAEEBB79EF04304F148119F964A21A2D7398E44DB61

Function 007460DD Relevance: 31.7, APIs: 17, Strings: 1, Instructions: 174filestringCOMMON

Download Yara Rule

APIs

Part of subcall function 00746EBB: GetFullPathNameW.KERNEL32(00000000,00007FFF,?,?,?,?,?,?,00745FA6,?), ref: 00746ED8

Part of subcall function 00746EBB: GetFullPathNameW.KERNEL32(?,00007FFF,?,?,?,?,?,00745FA6,?), ref: 00746EF1

Part of subcall function 0074725E: __wsplitpath.LIBCMT ref: 0074727B
Part of subcall function 0074725E: __wsplitpath.LIBCMT ref: 0074728E

Part of subcall function 007472CB: GetFileAttributesW.KERNEL32(?,00746019), ref: 007472CC

_wcscat.LIBCMT ref: 00746149
_wcscat.LIBCMT ref: 00746167
__wsplitpath.LIBCMT ref: 0074618E
FindFirstFileW.KERNEL32(?,?), ref: 007461A4
_wcscpy.LIBCMT ref: 00746209
_wcscat.LIBCMT ref: 0074621C
_wcscat.LIBCMT ref: 0074622F
lstrcmpiW.KERNEL32(?,?), ref: 0074625D
DeleteFileW.KERNEL32(?), ref: 0074626E
MoveFileW.KERNEL32(?,?), ref: 00746289
MoveFileW.KERNEL32(?,?), ref: 00746298
CopyFileW.KERNEL32(?,?,00000000), ref: 007462AD
DeleteFileW.KERNEL32(?), ref: 007462BE
FindNextFileW.KERNEL32(00000000,00000010), ref: 007462E1
FindClose.KERNEL32(00000000), ref: 007462FD
FindClose.KERNEL32(00000000), ref: 0074630B

Strings

\*.*, xrefs: 00746138, 00746147, 00746165

Memory Dump Source

Source File: 00000000.00000002.1281263787.0000000000701000.00000020.00000001.01000000.00000003.sdmp, Offset: 00700000, based on PE: true

Associated: 00000000.00000002.1281243473.0000000000700000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1281360671.000000000078D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1281360671.00000000007AE000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1281496264.00000000007BA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1281529307.00000000007C4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1281529307.00000000007C7000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1281529307.00000000007D5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1281529307.00000000007D7000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_700000_OC & PL.jbxd

Similarity

API ID: File$Find_wcscat$__wsplitpath$CloseDeleteFullMoveNamePath$AttributesCopyFirstNext_wcscpylstrcmpi
String ID: \*.*
API String ID: 1917200108-1173974218
Opcode ID: bd8d9023421a0d355acae3e3b57f2755d6b649bcf44e29f95e8350df35c7f1cf
Instruction ID: 5b0808e921e85024df97f59a9d262a9df036cf8800caf47303f88e5088e6900c
Opcode Fuzzy Hash: bd8d9023421a0d355acae3e3b57f2755d6b649bcf44e29f95e8350df35c7f1cf
Instruction Fuzzy Hash: 365111B294812CAACB21EB91DC48DEF77BCBF05300F0541E6E545E2141DF7A9B898FA5

Function 00756B0C Relevance: 30.2, APIs: 20, Instructions: 167clipboardCOMMON

Download Yara Rule

APIs

OpenClipboard.USER32(0079DC00), ref: 00756B36
IsClipboardFormatAvailable.USER32(0000000D), ref: 00756B44
GetClipboardData.USER32(0000000D), ref: 00756B4C
CloseClipboard.USER32 ref: 00756B58
GlobalLock.KERNEL32(00000000), ref: 00756B74
CloseClipboard.USER32 ref: 00756B7E
GlobalUnlock.KERNEL32(00000000), ref: 00756B93
IsClipboardFormatAvailable.USER32(00000001), ref: 00756BA0
GetClipboardData.USER32(00000001), ref: 00756BA8
GlobalLock.KERNEL32(00000000), ref: 00756BB5
GlobalUnlock.KERNEL32(00000000), ref: 00756BE9
CloseClipboard.USER32 ref: 00756CF6

Memory Dump Source

Source File: 00000000.00000002.1281263787.0000000000701000.00000020.00000001.01000000.00000003.sdmp, Offset: 00700000, based on PE: true

Associated: 00000000.00000002.1281243473.0000000000700000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1281360671.000000000078D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1281360671.00000000007AE000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1281496264.00000000007BA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1281529307.00000000007C4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1281529307.00000000007C7000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1281529307.00000000007D5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1281529307.00000000007D7000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_700000_OC & PL.jbxd

Similarity

API ID: Clipboard$Global$Close$AvailableDataFormatLockUnlock$Open
String ID:
API String ID: 3222323430-0
Opcode ID: ba0d77911069be3bbde13205cdab79acae2e7162935039dac059fc4fbf26ea77
Instruction ID: 5b99e1e7cbbd52ba5025126fe53016bc830dcc00788c8e6682c718b6bb36863e
Opcode Fuzzy Hash: ba0d77911069be3bbde13205cdab79acae2e7162935039dac059fc4fbf26ea77
Instruction Fuzzy Hash: 2C51C2B1240205EBD311AF60CC5AFAE73A8BF44B11F604129F946D71D1EFB8EC098B66

Function 0074F5FA Relevance: 28.3, APIs: 13, Strings: 3, Instructions: 278timefileCOMMON

Download Yara Rule

APIs

FindFirstFileW.KERNEL32(?,?), ref: 0074F62B
FindClose.KERNEL32(00000000), ref: 0074F67F
FileTimeToLocalFileTime.KERNEL32(?,?), ref: 0074F6A4
FileTimeToLocalFileTime.KERNEL32(?,?), ref: 0074F6BB
FileTimeToSystemTime.KERNEL32(?,?), ref: 0074F6E2
__swprintf.LIBCMT ref: 0074F72E
__swprintf.LIBCMT ref: 0074F767
__swprintf.LIBCMT ref: 0074F7BB

Part of subcall function 0072172B: __woutput_l.LIBCMT ref: 00721784

__swprintf.LIBCMT ref: 0074F809
__swprintf.LIBCMT ref: 0074F858
__swprintf.LIBCMT ref: 0074F8A7
__swprintf.LIBCMT ref: 0074F8F6

Strings

%4d%02d%02d%02d%02d%02d, xrefs: 0074F728
%02d, xrefs: 0074F7B0, 0074F7B9, 0074F807, 0074F856, 0074F8A5, 0074F8F4
%4d, xrefs: 0074F761

Memory Dump Source

Source File: 00000000.00000002.1281263787.0000000000701000.00000020.00000001.01000000.00000003.sdmp, Offset: 00700000, based on PE: true

Associated: 00000000.00000002.1281243473.0000000000700000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1281360671.000000000078D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1281360671.00000000007AE000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1281496264.00000000007BA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1281529307.00000000007C4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1281529307.00000000007C7000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1281529307.00000000007D5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1281529307.00000000007D7000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_700000_OC & PL.jbxd

Similarity

API ID: __swprintf$FileTime$FindLocal$CloseFirstSystem__woutput_l
String ID: %02d$%4d$%4d%02d%02d%02d%02d%02d
API String ID: 835046349-2428617273
Opcode ID: 56f49119005238b46e004478108ca2bee025487dfcf10da7fb5cca27288bb2b3
Instruction ID: b2a4f708d24b5f7000737d31724f63fa21fc0fa1d397b68bf99dabe07450f5c5
Opcode Fuzzy Hash: 56f49119005238b46e004478108ca2bee025487dfcf10da7fb5cca27288bb2b3
Instruction Fuzzy Hash: D3A1F1B2508344EBC311EBA4C899DAFB7ECBF94704F44491DF595C2192EB38D949C762

Function 00751B2F Relevance: 28.1, APIs: 15, Strings: 1, Instructions: 118fileCOMMON

Download Yara Rule

APIs

FindFirstFileW.KERNEL32(?,?,771A8FB0,?,00000000), ref: 00751B50
_wcscmp.LIBCMT ref: 00751B65
_wcscmp.LIBCMT ref: 00751B7C
GetFileAttributesW.KERNEL32(?), ref: 00751B8E
SetFileAttributesW.KERNEL32(?,?), ref: 00751BA8
FindNextFileW.KERNEL32(00000000,?), ref: 00751BC0
FindClose.KERNEL32(00000000), ref: 00751BCB
FindFirstFileW.KERNEL32(*.*,?), ref: 00751BE7
_wcscmp.LIBCMT ref: 00751C0E
_wcscmp.LIBCMT ref: 00751C25
SetCurrentDirectoryW.KERNEL32(?), ref: 00751C37
SetCurrentDirectoryW.KERNEL32(007B39FC), ref: 00751C55
FindNextFileW.KERNEL32(00000000,00000010), ref: 00751C5F
FindClose.KERNEL32(00000000), ref: 00751C6C
FindClose.KERNEL32(00000000), ref: 00751C7C

Strings

*.*, xrefs: 00751BE2

Memory Dump Source

Source File: 00000000.00000002.1281263787.0000000000701000.00000020.00000001.01000000.00000003.sdmp, Offset: 00700000, based on PE: true

Associated: 00000000.00000002.1281243473.0000000000700000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1281360671.000000000078D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1281360671.00000000007AE000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1281496264.00000000007BA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1281529307.00000000007C4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1281529307.00000000007C7000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1281529307.00000000007D5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1281529307.00000000007D7000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_700000_OC & PL.jbxd

Similarity

API ID: Find$File$_wcscmp$Close$AttributesCurrentDirectoryFirstNext
String ID: *.*
API String ID: 1803514871-438819550
Opcode ID: c4701d504a3a938ff8d2ea0700bbf14333deab7c7b5763d9ecf742c288f0054c
Instruction ID: 42a33da678ea28ef126a7475e11d76c28ef54a1e9fe4a762b6a17190deed05dd
Opcode Fuzzy Hash: c4701d504a3a938ff8d2ea0700bbf14333deab7c7b5763d9ecf742c288f0054c
Instruction Fuzzy Hash: 7F31EA71940219ABDF20ABB0DC4DBDE77ACAF05322F504195ED11E3090EBBDDE498B64

Function 0075091D Relevance: 22.9, APIs: 12, Strings: 1, Instructions: 185timeCOMMON

Download Yara Rule

APIs

GetLocalTime.KERNEL32(?), ref: 007509DF
SystemTimeToFileTime.KERNEL32(?,?), ref: 007509EF
LocalFileTimeToFileTime.KERNEL32(?,?), ref: 007509FB
__wsplitpath.LIBCMT ref: 00750A59
_wcscat.LIBCMT ref: 00750A71
_wcscat.LIBCMT ref: 00750A83
GetCurrentDirectoryW.KERNEL32(00007FFF,?), ref: 00750A98
SetCurrentDirectoryW.KERNEL32(?), ref: 00750AAC
SetCurrentDirectoryW.KERNEL32(?), ref: 00750ADE
SetCurrentDirectoryW.KERNEL32(?), ref: 00750AFF
_wcscpy.LIBCMT ref: 00750B0B
SetCurrentDirectoryW.KERNEL32(?,?,?,?,?), ref: 00750B4A

Strings

*.*, xrefs: 00750B05

Memory Dump Source

Source File: 00000000.00000002.1281263787.0000000000701000.00000020.00000001.01000000.00000003.sdmp, Offset: 00700000, based on PE: true

Associated: 00000000.00000002.1281243473.0000000000700000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1281360671.000000000078D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1281360671.00000000007AE000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1281496264.00000000007BA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1281529307.00000000007C4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1281529307.00000000007C7000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1281529307.00000000007D5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1281529307.00000000007D7000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_700000_OC & PL.jbxd

Similarity

API ID: CurrentDirectoryTime$File$Local_wcscat$System__wsplitpath_wcscpy
String ID: *.*
API String ID: 3566783562-438819550
Opcode ID: 4deef2113fecdf549a7289345ca2439ed1fb41cab9711a9627745f46fb61e2a5
Instruction ID: 5ab88b95d9576e97b6d05d9cc817e98a23f7588e9e11f6d65449864a5fe8bcd3
Opcode Fuzzy Hash: 4deef2113fecdf549a7289345ca2439ed1fb41cab9711a9627745f46fb61e2a5
Instruction Fuzzy Hash: D26149B2504305DFD710EF60C88999EB3E9FF89310F04891AF989C7252DB79E949CB92

Function 0073A66C Relevance: 21.2, APIs: 14, Instructions: 178memoryCOMMON

Download Yara Rule

APIs

Part of subcall function 0073ABBB: GetUserObjectSecurity.USER32(?,?,?,00000000,?), ref: 0073ABD7
Part of subcall function 0073ABBB: GetLastError.KERNEL32(?,0073A69F,?,?,?), ref: 0073ABE1
Part of subcall function 0073ABBB: GetProcessHeap.KERNEL32(00000008,?,?,0073A69F,?,?,?), ref: 0073ABF0
Part of subcall function 0073ABBB: HeapAlloc.KERNEL32(00000000,?,0073A69F,?,?,?), ref: 0073ABF7
Part of subcall function 0073ABBB: GetUserObjectSecurity.USER32(?,?,00000000,?,?), ref: 0073AC0E

Part of subcall function 0073AC56: GetProcessHeap.KERNEL32(00000008,0073A6B5,00000000,00000000,?,0073A6B5,?), ref: 0073AC62
Part of subcall function 0073AC56: HeapAlloc.KERNEL32(00000000,?,0073A6B5,?), ref: 0073AC69
Part of subcall function 0073AC56: InitializeSecurityDescriptor.ADVAPI32(00000000,00000001,?,0073A6B5,?), ref: 0073AC7A

GetSecurityDescriptorDacl.ADVAPI32(?,?,?,?), ref: 0073A6D0
_memset.LIBCMT ref: 0073A6E5
GetAclInformation.ADVAPI32(?,?,0000000C,00000002), ref: 0073A704
GetLengthSid.ADVAPI32(?), ref: 0073A715
GetAce.ADVAPI32(?,00000000,?), ref: 0073A752
AddAce.ADVAPI32(?,00000002,000000FF,?,?), ref: 0073A76E
GetLengthSid.ADVAPI32(?), ref: 0073A78B
GetProcessHeap.KERNEL32(00000008,-00000008), ref: 0073A79A
HeapAlloc.KERNEL32(00000000), ref: 0073A7A1
GetLengthSid.ADVAPI32(?,00000008,?), ref: 0073A7C2
CopySid.ADVAPI32(00000000), ref: 0073A7C9
AddAce.ADVAPI32(?,00000002,000000FF,00000000,?), ref: 0073A7FA
SetSecurityDescriptorDacl.ADVAPI32(?,00000001,?,00000000), ref: 0073A820
SetUserObjectSecurity.USER32(?,00000004,?), ref: 0073A834

Memory Dump Source

Source File: 00000000.00000002.1281263787.0000000000701000.00000020.00000001.01000000.00000003.sdmp, Offset: 00700000, based on PE: true

Associated: 00000000.00000002.1281243473.0000000000700000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1281360671.000000000078D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1281360671.00000000007AE000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1281496264.00000000007BA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1281529307.00000000007C4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1281529307.00000000007C7000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1281529307.00000000007D5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1281529307.00000000007D7000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_700000_OC & PL.jbxd

Similarity

API ID: HeapSecurity$AllocDescriptorLengthObjectProcessUser$Dacl$CopyErrorInformationInitializeLast_memset
String ID:
API String ID: 3996160137-0
Opcode ID: 5dab921860724b0074c96da4be6339d31fe6899b01f8f2dccfbf1ee205475376
Instruction ID: 699bf111a391828a720bc8aa451f1f0381c6e35c1bc4387367dfc8006b19b03d
Opcode Fuzzy Hash: 5dab921860724b0074c96da4be6339d31fe6899b01f8f2dccfbf1ee205475376
Instruction Fuzzy Hash: CB515C71900219BFEF119F90DC86EEEBBB9FF04300F148129E851AA292D7399E05CB61

Function 00706F07 Relevance: 20.9, Strings: 16, Instructions: 883COMMON

Download Yara Rule

Strings

BSR_ANYCRLF), xrefs: 00782EA0
zzz z, xrefs: 00707096, 0070709C
LIMIT_MATCH=, xrefs: 00782CF2
BSR_UNICODE), xrefs: 00782EBA
ANYCRLF), xrefs: 00782E7D
z, xrefs: 00706F77
CRLF), xrefs: 00782E43
CR), xrefs: 00782E09
NO_START_OPT), xrefs: 00782CD1
UCP), xrefs: 00782C8F
ANY), xrefs: 00782E60
UTF16), xrefs: 00782C56
LIMIT_RECURSION=, xrefs: 00782D7E
UTF), xrefs: 00782C7C
LF), xrefs: 00782E26
NO_AUTO_POSSESS), xrefs: 00782CB0

Memory Dump Source

Source File: 00000000.00000002.1281263787.0000000000701000.00000020.00000001.01000000.00000003.sdmp, Offset: 00700000, based on PE: true

Associated: 00000000.00000002.1281243473.0000000000700000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1281360671.000000000078D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1281360671.00000000007AE000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1281496264.00000000007BA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1281529307.00000000007C4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1281529307.00000000007C7000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1281529307.00000000007D5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1281529307.00000000007D7000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_700000_OC & PL.jbxd

Similarity

API ID:
String ID: z$ANY)$ANYCRLF)$BSR_ANYCRLF)$BSR_UNICODE)$CR)$CRLF)$LF)$LIMIT_MATCH=$LIMIT_RECURSION=$NO_AUTO_POSSESS)$NO_START_OPT)$UCP)$UTF)$UTF16)$zzz z
API String ID: 0-2950441857
Opcode ID: 83792ee73725e7688ecd03db3838dac56c668bb52c6f357566bf4e4241612f82
Instruction ID: 68b50765584d4c168c25e938b95f946aabf33eba3b08b458614f5f93815e266e
Opcode Fuzzy Hash: 83792ee73725e7688ecd03db3838dac56c668bb52c6f357566bf4e4241612f82
Instruction Fuzzy Hash: 96729F71E04219DBDF28DF58C8847AEB7F5BF48710F14816AE805EB281EB789E41DB94

Function 007463F9 Relevance: 17.6, APIs: 9, Strings: 1, Instructions: 89fileCOMMON

Download Yara Rule

APIs

Part of subcall function 00746EBB: GetFullPathNameW.KERNEL32(00000000,00007FFF,?,?,?,?,?,?,00745FA6,?), ref: 00746ED8

Part of subcall function 007472CB: GetFileAttributesW.KERNEL32(?,00746019), ref: 007472CC

_wcscat.LIBCMT ref: 00746441
__wsplitpath.LIBCMT ref: 0074645F
FindFirstFileW.KERNEL32(?,?), ref: 00746474
_wcscpy.LIBCMT ref: 007464A3
_wcscat.LIBCMT ref: 007464B8
_wcscat.LIBCMT ref: 007464CA
DeleteFileW.KERNEL32(?), ref: 007464DA
FindNextFileW.KERNEL32(00000000,00000010), ref: 007464EB
FindClose.KERNEL32(00000000), ref: 00746506

Strings

\*.*, xrefs: 0074643B

Memory Dump Source

Source File: 00000000.00000002.1281263787.0000000000701000.00000020.00000001.01000000.00000003.sdmp, Offset: 00700000, based on PE: true

Associated: 00000000.00000002.1281243473.0000000000700000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1281360671.000000000078D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1281360671.00000000007AE000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1281496264.00000000007BA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1281529307.00000000007C4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1281529307.00000000007C7000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1281529307.00000000007D5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1281529307.00000000007D7000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_700000_OC & PL.jbxd

Similarity

API ID: File$Find_wcscat$AttributesCloseDeleteFirstFullNameNextPath__wsplitpath_wcscpy
String ID: \*.*
API String ID: 2643075503-1173974218
Opcode ID: 23ab267e14441cbe90e6a11eaa6a4bfa27f0001d3d73c4f5947e0a9d685ce80f
Instruction ID: e629bde31b83d6dc37c49e9cab7d2678130cdfe85d2677853f1e73ee08a9b90a
Opcode Fuzzy Hash: 23ab267e14441cbe90e6a11eaa6a4bfa27f0001d3d73c4f5947e0a9d685ce80f
Instruction Fuzzy Hash: 193186B24483889EC721EBA48889DDBB7DCAF56310F44491AF5D8C3142EB39D64987B7

Function 007631BC Relevance: 16.9, APIs: 11, Instructions: 397registryCOMMON

Download Yara Rule

APIs

Part of subcall function 00763C06: CharUpperBuffW.USER32(?,?,?,?,?,?,?,00762BB5,?,?), ref: 00763C1D

RegConnectRegistryW.ADVAPI32(?,?,?), ref: 0076328E

Part of subcall function 0070936C: __swprintf.LIBCMT ref: 007093AB
Part of subcall function 0070936C: __itow.LIBCMT ref: 007093DF

RegQueryValueExW.ADVAPI32(?,?,00000000,?,00000000,?), ref: 0076332D
RegQueryValueExW.ADVAPI32(?,?,00000000,00000000,?,00000008), ref: 007633C5
RegCloseKey.ADVAPI32(000000FE,000000FE,00000000,?,00000000), ref: 00763604
RegCloseKey.ADVAPI32(00000000), ref: 00763611

Memory Dump Source

Source File: 00000000.00000002.1281263787.0000000000701000.00000020.00000001.01000000.00000003.sdmp, Offset: 00700000, based on PE: true

Associated: 00000000.00000002.1281243473.0000000000700000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1281360671.000000000078D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1281360671.00000000007AE000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1281496264.00000000007BA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1281529307.00000000007C4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1281529307.00000000007C7000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1281529307.00000000007D5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1281529307.00000000007D7000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_700000_OC & PL.jbxd

Similarity

API ID: CloseQueryValue$BuffCharConnectRegistryUpper__itow__swprintf
String ID:
API String ID: 1240663315-0
Opcode ID: 814545b723a137eb6088cb1c3fc662afc3d5919bace0317df20edb46be8355cf
Instruction ID: 04c3346112303b2626445db7ff4f38542447c419e5678168e092286f89ff31dc
Opcode Fuzzy Hash: 814545b723a137eb6088cb1c3fc662afc3d5919bace0317df20edb46be8355cf
Instruction Fuzzy Hash: AFE14C71604200EFCB15DF28C995D6ABBE9EF88314F04856DF94ADB2A2DB38ED05CB51

Function 00742B37 Relevance: 16.6, APIs: 11, Instructions: 119keyboardCOMMON

Download Yara Rule

APIs

GetKeyboardState.USER32(?), ref: 00742B5F
GetAsyncKeyState.USER32(000000A0), ref: 00742BE0
GetKeyState.USER32(000000A0), ref: 00742BFB
GetAsyncKeyState.USER32(000000A1), ref: 00742C15
GetKeyState.USER32(000000A1), ref: 00742C2A
GetAsyncKeyState.USER32(00000011), ref: 00742C42
GetKeyState.USER32(00000011), ref: 00742C54
GetAsyncKeyState.USER32(00000012), ref: 00742C6C
GetKeyState.USER32(00000012), ref: 00742C7E
GetAsyncKeyState.USER32(0000005B), ref: 00742C96
GetKeyState.USER32(0000005B), ref: 00742CA8

Memory Dump Source

Source File: 00000000.00000002.1281263787.0000000000701000.00000020.00000001.01000000.00000003.sdmp, Offset: 00700000, based on PE: true

Associated: 00000000.00000002.1281243473.0000000000700000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1281360671.000000000078D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1281360671.00000000007AE000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1281496264.00000000007BA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1281529307.00000000007C4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1281529307.00000000007C7000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1281529307.00000000007D5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1281529307.00000000007D7000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_700000_OC & PL.jbxd

Similarity

API ID: State$Async$Keyboard
String ID:
API String ID: 541375521-0
Opcode ID: 77ce4cd9034e3e2d3f52ea3939291bd5274614212bc408fdb733568de51201d2
Instruction ID: f314b74958282280251f7d5b0c3f391724f9cda9f331c7fd3a24e24c9d1345ea
Opcode Fuzzy Hash: 77ce4cd9034e3e2d3f52ea3939291bd5274614212bc408fdb733568de51201d2
Instruction Fuzzy Hash: 0641E5705047C96DFF319B6088443B9BFA0AB11354F84805AE9C6562C3EB9C9DE5C7B6

Function 00756D07 Relevance: 15.1, APIs: 10, Instructions: 83clipboardmemoryCOMMON

Download Yara Rule

APIs

OpenClipboard.USER32 ref: 00756D2E
EmptyClipboard.USER32 ref: 00756D34
GlobalAlloc.KERNEL32(00000002,?), ref: 00756D49
CloseClipboard.USER32 ref: 00756DE8

Memory Dump Source

Source File: 00000000.00000002.1281263787.0000000000701000.00000020.00000001.01000000.00000003.sdmp, Offset: 00700000, based on PE: true

Associated: 00000000.00000002.1281243473.0000000000700000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1281360671.000000000078D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1281360671.00000000007AE000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1281496264.00000000007BA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1281529307.00000000007C4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1281529307.00000000007C7000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1281529307.00000000007D5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1281529307.00000000007D7000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_700000_OC & PL.jbxd

Similarity

API ID: Clipboard$AllocCloseEmptyGlobalOpen
String ID:
API String ID: 1737998785-0
Opcode ID: a766a6bbe55b129f107aec2ea6e4e7cb45361235a7952b4b0bb9ed49f4e7323a
Instruction ID: 1dc9df556df22299662fcf174448380242489599a64f717f943e51daac0ebc58
Opcode Fuzzy Hash: a766a6bbe55b129f107aec2ea6e4e7cb45361235a7952b4b0bb9ed49f4e7323a
Instruction Fuzzy Hash: 97216B313402149FDB11AF64DC49B6D77A9FF04721F10C419F94A9B2A2DB78AC418B98

Function 0075C18C Relevance: 12.5, APIs: 6, Strings: 1, Instructions: 232COMMON

Download Yara Rule

APIs

Part of subcall function 00739ABF: CLSIDFromProgID.OLE32 ref: 00739ADC
Part of subcall function 00739ABF: ProgIDFromCLSID.OLE32(?,00000000), ref: 00739AF7
Part of subcall function 00739ABF: lstrcmpiW.KERNEL32(?,00000000), ref: 00739B05
Part of subcall function 00739ABF: CoTaskMemFree.OLE32(00000000,?,00000000), ref: 00739B15

CoInitializeSecurity.OLE32(00000000,000000FF,00000000,00000000,00000002,00000003,00000000,00000000,00000000,?,?,?), ref: 0075C235
_memset.LIBCMT ref: 0075C242
_memset.LIBCMT ref: 0075C360
CoCreateInstanceEx.OLE32(?,00000000,00000015,?,00000001,00000001), ref: 0075C38C
CoTaskMemFree.OLE32(?), ref: 0075C397

Strings

NULL Pointer assignment, xrefs: 0075C3E5

Memory Dump Source

Source File: 00000000.00000002.1281263787.0000000000701000.00000020.00000001.01000000.00000003.sdmp, Offset: 00700000, based on PE: true

Associated: 00000000.00000002.1281243473.0000000000700000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1281360671.000000000078D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1281360671.00000000007AE000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1281496264.00000000007BA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1281529307.00000000007C4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1281529307.00000000007C7000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1281529307.00000000007D5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1281529307.00000000007D7000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_700000_OC & PL.jbxd

Similarity

API ID: FreeFromProgTask_memset$CreateInitializeInstanceSecuritylstrcmpi
String ID: NULL Pointer assignment
API String ID: 1300414916-2785691316
Opcode ID: 569ae40aaef098a16aab06bbe8f1863c68468e7c572715908d6d64ed8b913a9b
Instruction ID: 2c425e5fa79198f55ef9b97d4163720d31f60561222f328b39de30f2f9354e03
Opcode Fuzzy Hash: 569ae40aaef098a16aab06bbe8f1863c68468e7c572715908d6d64ed8b913a9b
Instruction Fuzzy Hash: CF912971D00218EFDB11DF94DC95EEEBBB9AF04710F10815AF915A7281DB749A45CFA0

Function 007479D3 Relevance: 10.6, APIs: 3, Strings: 3, Instructions: 58shutdownCOMMON

Download Yara Rule

APIs

Part of subcall function 0073B134: LookupPrivilegeValueW.ADVAPI32(00000000,00000000,00000004), ref: 0073B180
Part of subcall function 0073B134: AdjustTokenPrivileges.ADVAPI32(?,00000000,00000000,?,00000000,?), ref: 0073B1AD
Part of subcall function 0073B134: GetLastError.KERNEL32 ref: 0073B1BA

ExitWindowsEx.USER32(?,00000000), ref: 00747A0F

Strings

SeShutdownPrivilege, xrefs: 007479DD
@, xrefs: 00747A02
, xrefs: 007479FD

Memory Dump Source

Source File: 00000000.00000002.1281263787.0000000000701000.00000020.00000001.01000000.00000003.sdmp, Offset: 00700000, based on PE: true

Associated: 00000000.00000002.1281243473.0000000000700000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1281360671.000000000078D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1281360671.00000000007AE000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1281496264.00000000007BA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1281529307.00000000007C4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1281529307.00000000007C7000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1281529307.00000000007D5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1281529307.00000000007D7000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_700000_OC & PL.jbxd

Similarity

API ID: AdjustErrorExitLastLookupPrivilegePrivilegesTokenValueWindows
String ID: $@$SeShutdownPrivilege
API String ID: 2234035333-194228
Opcode ID: 17c48ded4b4ffd72cb2bbc5517c95bbcf935a6b1081a866790c5232385d3e0d9
Instruction ID: 83efd6f3e811dfccd3b39dc6852f29c904e59fed370151d0447f10fdcd9cf2a4
Opcode Fuzzy Hash: 17c48ded4b4ffd72cb2bbc5517c95bbcf935a6b1081a866790c5232385d3e0d9
Instruction Fuzzy Hash: 47018471798211ABF73C666CDC5BBBF73589B00740F248424F943A20D2DB6D9E00C2A5

Function 00758C4F Relevance: 9.1, APIs: 6, Instructions: 83networkCOMMON

Download Yara Rule

APIs

socket.WSOCK32(00000002,00000001,00000006,?,00000002,00000000), ref: 00758CA8
WSAGetLastError.WSOCK32(00000000), ref: 00758CB7
bind.WSOCK32(00000000,?,00000010), ref: 00758CD3
listen.WSOCK32(00000000,00000005), ref: 00758CE2
WSAGetLastError.WSOCK32(00000000), ref: 00758CFC
closesocket.WSOCK32(00000000,00000000), ref: 00758D10

Memory Dump Source

Source File: 00000000.00000002.1281263787.0000000000701000.00000020.00000001.01000000.00000003.sdmp, Offset: 00700000, based on PE: true

Associated: 00000000.00000002.1281243473.0000000000700000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1281360671.000000000078D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1281360671.00000000007AE000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1281496264.00000000007BA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1281529307.00000000007C4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1281529307.00000000007C7000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1281529307.00000000007D5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1281529307.00000000007D7000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_700000_OC & PL.jbxd

Similarity

API ID: ErrorLast$bindclosesocketlistensocket
String ID:
API String ID: 1279440585-0
Opcode ID: 1091c4e67e5493f21f38a9a036486b97c22c58d0b2183a7af3dcdbb46bef3720
Instruction ID: d18904ae06c119692328de99d532200cf5fb1a12e898cf928d2c8ccc10128483
Opcode Fuzzy Hash: 1091c4e67e5493f21f38a9a036486b97c22c58d0b2183a7af3dcdbb46bef3720
Instruction Fuzzy Hash: B721B631600200DFC720EF68C949BAE77E9EF48711F108158F956B73D2CB78AD458B65

Function 00746532 Relevance: 9.1, APIs: 6, Instructions: 71processCOMMON

Download Yara Rule

APIs

CreateToolhelp32Snapshot.KERNEL32(00000002,00000000,?,00000000), ref: 00746554
Process32FirstW.KERNEL32(00000000,0000022C), ref: 00746564
Process32NextW.KERNEL32(00000000,0000022C), ref: 00746583
__wsplitpath.LIBCMT ref: 007465A7
_wcscat.LIBCMT ref: 007465BA
CloseHandle.KERNEL32(00000000,?,00000000), ref: 007465F9

Memory Dump Source

Source File: 00000000.00000002.1281263787.0000000000701000.00000020.00000001.01000000.00000003.sdmp, Offset: 00700000, based on PE: true

Associated: 00000000.00000002.1281243473.0000000000700000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1281360671.000000000078D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1281360671.00000000007AE000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1281496264.00000000007BA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1281529307.00000000007C4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1281529307.00000000007C7000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1281529307.00000000007D5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1281529307.00000000007D7000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_700000_OC & PL.jbxd

Similarity

API ID: Process32$CloseCreateFirstHandleNextSnapshotToolhelp32__wsplitpath_wcscat
String ID:
API String ID: 1605983538-0
Opcode ID: ef6e42316ff0d37a24a69d7215a71216cb3335de8c24ce8f85d66c464430c3bd
Instruction ID: b7be1f55acad727988232abd013db68cb48791ea573684c4cae9715e0e3d9179
Opcode Fuzzy Hash: ef6e42316ff0d37a24a69d7215a71216cb3335de8c24ce8f85d66c464430c3bd
Instruction Fuzzy Hash: 9F216271900218EBDB20ABA4DD88FEEB7BCAB49300F5044A5E505E7141EB799F95CB61

Function 00709B60 Relevance: 8.6, Strings: 6, Instructions: 1055COMMON

Download Yara Rule

Strings

VUUU, xrefs: 00709E95
VUUU, xrefs: 0078BE14
VUUU, xrefs: 00709EA7
ERCP, xrefs: 00709C32
VUUU, xrefs: 00709ED4
z, xrefs: 00709CF3

Memory Dump Source

Source File: 00000000.00000002.1281263787.0000000000701000.00000020.00000001.01000000.00000003.sdmp, Offset: 00700000, based on PE: true

Associated: 00000000.00000002.1281243473.0000000000700000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1281360671.000000000078D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1281360671.00000000007AE000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1281496264.00000000007BA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1281529307.00000000007C4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1281529307.00000000007C7000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1281529307.00000000007D5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1281529307.00000000007D7000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_700000_OC & PL.jbxd

Similarity

API ID:
String ID: ERCP$VUUU$VUUU$VUUU$VUUU$z
API String ID: 0-788689851
Opcode ID: 61744e0606e79afeb8bfff0173b68ae0243dcf1c6253f4fdac4f084dc42aedb5
Instruction ID: 7513f42404955f883cdc91a11150d1c79912092242b8412a05124eb8b5609795
Opcode Fuzzy Hash: 61744e0606e79afeb8bfff0173b68ae0243dcf1c6253f4fdac4f084dc42aedb5
Instruction Fuzzy Hash: 99928071E0021ADBDF25DF58C8807ADB7F1BB54314F1482AAE915AB2C1E7789D81CFA1

Function 007413CA Relevance: 8.1, APIs: 1, Strings: 4, Instructions: 560stringCOMMON

Download Yara Rule

APIs

lstrlenW.KERNEL32(?,?,?,00000000), ref: 007413DC

Strings

<2{, xrefs: 007416FA
|, xrefs: 0074140C
(, xrefs: 00741422
,2{, xrefs: 007416B1

Memory Dump Source

Source File: 00000000.00000002.1281263787.0000000000701000.00000020.00000001.01000000.00000003.sdmp, Offset: 00700000, based on PE: true

Associated: 00000000.00000002.1281243473.0000000000700000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1281360671.000000000078D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1281360671.00000000007AE000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1281496264.00000000007BA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1281529307.00000000007C4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1281529307.00000000007C7000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1281529307.00000000007D5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1281529307.00000000007D7000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_700000_OC & PL.jbxd

Similarity

API ID: lstrlen
String ID: ($,2{$<2{$|
API String ID: 1659193697-236823615
Opcode ID: 3edcd8322c83fe3f555d73752714e0fc604346f0353be7325648d6f3411738a9
Instruction ID: b8361b5c8105e9c23d6a2e5d580a8ad12452bd69fe35400eb1df611ee4032304
Opcode Fuzzy Hash: 3edcd8322c83fe3f555d73752714e0fc604346f0353be7325648d6f3411738a9
Instruction Fuzzy Hash: 8B322675A00605DFC728DF69C480AAAB7F0FF48320B55C46EE59ADB3A1E774E981CB44

Function 0075923B Relevance: 7.6, APIs: 5, Instructions: 146networkCOMMON

Download Yara Rule

APIs

Part of subcall function 0075A82C: inet_addr.WSOCK32(00000000,00000000,?,?,?,00000000), ref: 0075A84E

socket.WSOCK32(00000002,00000002,00000011,?,?,?,00000000), ref: 00759296
WSAGetLastError.WSOCK32(00000000,00000000), ref: 007592B9

Memory Dump Source

Source File: 00000000.00000002.1281263787.0000000000701000.00000020.00000001.01000000.00000003.sdmp, Offset: 00700000, based on PE: true

Associated: 00000000.00000002.1281243473.0000000000700000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1281360671.000000000078D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1281360671.00000000007AE000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1281496264.00000000007BA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1281529307.00000000007C4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1281529307.00000000007C7000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1281529307.00000000007D5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1281529307.00000000007D7000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_700000_OC & PL.jbxd

Similarity

API ID: ErrorLastinet_addrsocket
String ID:
API String ID: 4170576061-0
Opcode ID: 547e17f908212b5944c1552a339b7acb45bea44742b98421f39e71ab351326f2
Instruction ID: 4b10a7a8aaaf95c9cb918f8a5bac0b598878536a361b49e1987803f93fd05538
Opcode Fuzzy Hash: 547e17f908212b5944c1552a339b7acb45bea44742b98421f39e71ab351326f2
Instruction Fuzzy Hash: 2C41B470600204EFDB10AF68C84AEBE77EDEF44724F148548FA56AB2D2DB789D418B91

Function 0074EB60 Relevance: 7.6, APIs: 5, Instructions: 125fileCOMMON

Download Yara Rule

APIs

FindFirstFileW.KERNEL32(?,?), ref: 0074EB8A
_wcscmp.LIBCMT ref: 0074EBBA
_wcscmp.LIBCMT ref: 0074EBCF
FindNextFileW.KERNEL32(00000000,?), ref: 0074EBE0
FindClose.KERNEL32(00000000,00000001,00000000), ref: 0074EC0E

Memory Dump Source

Source File: 00000000.00000002.1281263787.0000000000701000.00000020.00000001.01000000.00000003.sdmp, Offset: 00700000, based on PE: true

Associated: 00000000.00000002.1281243473.0000000000700000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1281360671.000000000078D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1281360671.00000000007AE000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1281496264.00000000007BA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1281529307.00000000007C4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1281529307.00000000007C7000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1281529307.00000000007D5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1281529307.00000000007D7000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_700000_OC & PL.jbxd

Similarity

API ID: Find$File_wcscmp$CloseFirstNext
String ID:
API String ID: 2387731787-0
Opcode ID: 65282d0df617bb5f168011540faec0bc7a01bb5ee45bd74e118679b223470fc9
Instruction ID: 1fc16f95f615b5c981566731f8b8ebbf32fd6aa9b7d952164712eacf88d649c3
Opcode Fuzzy Hash: 65282d0df617bb5f168011540faec0bc7a01bb5ee45bd74e118679b223470fc9
Instruction Fuzzy Hash: 8F41CF75600701CFC718DF28C494EAAB3E4FF49324F10455DEA5A8B3A2DB39AD81CBA1

Function 00768111 Relevance: 7.6, APIs: 5, Instructions: 69windowCOMMON

Download Yara Rule

APIs

IsWindowVisible.USER32 ref: 00768160
IsWindowEnabled.USER32 ref: 0076816E
GetForegroundWindow.USER32(?,?,00000001), ref: 0076817B
IsIconic.USER32 ref: 00768189
IsZoomed.USER32 ref: 00768197

Memory Dump Source

Source File: 00000000.00000002.1281263787.0000000000701000.00000020.00000001.01000000.00000003.sdmp, Offset: 00700000, based on PE: true

Associated: 00000000.00000002.1281243473.0000000000700000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1281360671.000000000078D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1281360671.00000000007AE000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1281496264.00000000007BA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1281529307.00000000007C4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1281529307.00000000007C7000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1281529307.00000000007D5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1281529307.00000000007D7000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_700000_OC & PL.jbxd

Similarity

API ID: Window$EnabledForegroundIconicVisibleZoomed
String ID:
API String ID: 292994002-0
Opcode ID: 3a2f0355c731f532c475bbd49d25f33ca7583714cdf4b3e93a5ab6b49e2507e3
Instruction ID: 41d6a17665af63ec6b8f5b54fbab314b7bfa5074b87f1d878f4a6e32232ba02f
Opcode Fuzzy Hash: 3a2f0355c731f532c475bbd49d25f33ca7583714cdf4b3e93a5ab6b49e2507e3
Instruction Fuzzy Hash: 4911E231340118ABE7252F26DC48E6F7799EF45360B10462DFC0AD7281CF3C9C0386A6

Function 0071E01E Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 15libraryloaderCOMMON

Download Yara Rule

APIs

LoadLibraryA.KERNEL32(kernel32.dll,?,0071E014,771B0AE0,0071DEF1,0079DC38,?,?), ref: 0071E02C
GetProcAddress.KERNEL32(00000000,GetNativeSystemInfo), ref: 0071E03E

Strings

kernel32.dll, xrefs: 0071E027
GetNativeSystemInfo, xrefs: 0071E038

Memory Dump Source

Source File: 00000000.00000002.1281263787.0000000000701000.00000020.00000001.01000000.00000003.sdmp, Offset: 00700000, based on PE: true

Associated: 00000000.00000002.1281243473.0000000000700000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1281360671.000000000078D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1281360671.00000000007AE000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1281496264.00000000007BA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1281529307.00000000007C4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1281529307.00000000007C7000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1281529307.00000000007D5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1281529307.00000000007D7000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_700000_OC & PL.jbxd

Similarity

API ID: AddressLibraryLoadProc
String ID: GetNativeSystemInfo$kernel32.dll
API String ID: 2574300362-192647395
Opcode ID: 74718913a5981f2f897888e9dd178d1d596242c5cecd2b6d713609e96e93696d
Instruction ID: 56c187ec24b64fb67e3ee2e2002a735f74e68bb2c69f28416d438da8c88fbe89
Opcode Fuzzy Hash: 74718913a5981f2f897888e9dd178d1d596242c5cecd2b6d713609e96e93696d
Instruction Fuzzy Hash: F1D05E708407129EC7315B65E80C79277D5AF04700F298419E88192190D6BCD8818750

Function 0071B11F Relevance: 4.9, APIs: 3, Instructions: 377COMMON

Download Yara Rule

APIs

Part of subcall function 0071B34E: GetWindowLongW.USER32(?,000000EB), ref: 0071B35F

DefDlgProcW.USER32(?,?,?,?,?), ref: 0071B22F

Part of subcall function 0071B55D: DefDlgProcW.USER32(?,00000020,?,00000000), ref: 0071B5A5

Memory Dump Source

Source File: 00000000.00000002.1281263787.0000000000701000.00000020.00000001.01000000.00000003.sdmp, Offset: 00700000, based on PE: true

Associated: 00000000.00000002.1281243473.0000000000700000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1281360671.000000000078D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1281360671.00000000007AE000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1281496264.00000000007BA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1281529307.00000000007C4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1281529307.00000000007C7000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1281529307.00000000007D5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1281529307.00000000007D7000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_700000_OC & PL.jbxd

Similarity

API ID: Proc$LongWindow
String ID:
API String ID: 2749884682-0
Opcode ID: dd245f98e29721b995d35e7be0b1b6d71e91e1da07307cfcee11e295ff1b5796
Instruction ID: 70feeddaf65eb3cfab6104d3e8456e5c68eb0e72b9cfa0c3e8165fc8963b5de7
Opcode Fuzzy Hash: dd245f98e29721b995d35e7be0b1b6d71e91e1da07307cfcee11e295ff1b5796
Instruction Fuzzy Hash: F1A12870114109FADB386B2D9C8DEFF2A6CFB4A384B54816DF806D61D2DB3C9C959272

Function 00754EB5 Relevance: 4.7, APIs: 3, Instructions: 155networkfileCOMMON

Download Yara Rule

APIs

InternetQueryDataAvailable.WININET(?,?,00000000,00000000,00000000,?,?,?,?,?,?,?,?,007543BF,00000000), ref: 00754FA6
InternetReadFile.WININET(00000001,00000000,00000001,00000001), ref: 00754FD2

Memory Dump Source

Source File: 00000000.00000002.1281263787.0000000000701000.00000020.00000001.01000000.00000003.sdmp, Offset: 00700000, based on PE: true

Associated: 00000000.00000002.1281243473.0000000000700000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1281360671.000000000078D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1281360671.00000000007AE000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1281496264.00000000007BA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1281529307.00000000007C4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1281529307.00000000007C7000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1281529307.00000000007D5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1281529307.00000000007D7000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_700000_OC & PL.jbxd

Similarity

API ID: Internet$AvailableDataFileQueryRead
String ID:
API String ID: 599397726-0
Opcode ID: fc9e7d45611b14ad9dc2469cec4b22edb00fa165f232c5dd0c0ba8410e6596b7
Instruction ID: 356ae613f4a8f88d40b8ebcc189d999b235b62ad2a0074e77d5436c0f655fd33
Opcode Fuzzy Hash: fc9e7d45611b14ad9dc2469cec4b22edb00fa165f232c5dd0c0ba8410e6596b7
Instruction Fuzzy Hash: F841F871504205FFEB209F94DC85EFB77BCEB4031AF10402AFA05661C0E6B99E8997A0

Function 007077B0 Relevance: 4.6, APIs: 1, Strings: 1, Instructions: 1076COMMON

Download Yara Rule

APIs

_memmove.LIBCMT ref: 00707921

Strings

\Q{, xrefs: 00781028

Memory Dump Source

Source File: 00000000.00000002.1281263787.0000000000701000.00000020.00000001.01000000.00000003.sdmp, Offset: 00700000, based on PE: true

Associated: 00000000.00000002.1281243473.0000000000700000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1281360671.000000000078D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1281360671.00000000007AE000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1281496264.00000000007BA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1281529307.00000000007C4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1281529307.00000000007C7000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1281529307.00000000007D5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1281529307.00000000007D7000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_700000_OC & PL.jbxd

Similarity

API ID: _memmove
String ID: \Q{
API String ID: 4104443479-4270901863
Opcode ID: 0d2a0810047fdd7a2d0913725825c8c4db65c6c7fc14e78ea90f172dadfd4b91
Instruction ID: d218bd746c4a79714ea2929f3aad76c59144f8f9ed4e68f39bcc8fe7174bedc0
Opcode Fuzzy Hash: 0d2a0810047fdd7a2d0913725825c8c4db65c6c7fc14e78ea90f172dadfd4b91
Instruction Fuzzy Hash: D5A23C74E04219CFDB28CF58C4846ADB7F1FF48314F2582A9D859AB391D778AE81DB90

Function 0074E1FD Relevance: 4.6, APIs: 3, Instructions: 72COMMON

Download Yara Rule

APIs

SetErrorMode.KERNEL32(00000001), ref: 0074E20D
GetDiskFreeSpaceExW.KERNEL32(?,?,?,?), ref: 0074E267
SetErrorMode.KERNEL32(00000000,00000001,00000000), ref: 0074E2B4

Memory Dump Source

Source File: 00000000.00000002.1281263787.0000000000701000.00000020.00000001.01000000.00000003.sdmp, Offset: 00700000, based on PE: true

Associated: 00000000.00000002.1281243473.0000000000700000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1281360671.000000000078D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1281360671.00000000007AE000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1281496264.00000000007BA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1281529307.00000000007C4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1281529307.00000000007C7000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1281529307.00000000007D5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1281529307.00000000007D7000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_700000_OC & PL.jbxd

Similarity

API ID: ErrorMode$DiskFreeSpace
String ID:
API String ID: 1682464887-0
Opcode ID: c5d1bd918fa4be0e78c613d78a84c46e336571ea987460400a62b2b2df6054be
Instruction ID: 42c11f8ec4dca9d54596c97ed3634a152ea03904f7c4f6fa68e192f1df3a6088
Opcode Fuzzy Hash: c5d1bd918fa4be0e78c613d78a84c46e336571ea987460400a62b2b2df6054be
Instruction Fuzzy Hash: E3219035A00118EFCB00DFA5D888EEDFBF9FF48320F1480A9E905A7291DB399905CB54

Function 0073B134 Relevance: 4.6, APIs: 3, Instructions: 67COMMON

Download Yara Rule

APIs

Part of subcall function 0071F4EA: std::exception::exception.LIBCMT ref: 0071F51E
Part of subcall function 0071F4EA: __CxxThrowException@8.LIBCMT ref: 0071F533

LookupPrivilegeValueW.ADVAPI32(00000000,00000000,00000004), ref: 0073B180
AdjustTokenPrivileges.ADVAPI32(?,00000000,00000000,?,00000000,?), ref: 0073B1AD
GetLastError.KERNEL32 ref: 0073B1BA

Memory Dump Source

Source File: 00000000.00000002.1281263787.0000000000701000.00000020.00000001.01000000.00000003.sdmp, Offset: 00700000, based on PE: true

Associated: 00000000.00000002.1281243473.0000000000700000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1281360671.000000000078D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1281360671.00000000007AE000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1281496264.00000000007BA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1281529307.00000000007C4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1281529307.00000000007C7000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1281529307.00000000007D5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1281529307.00000000007D7000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_700000_OC & PL.jbxd

Similarity

API ID: AdjustErrorException@8LastLookupPrivilegePrivilegesThrowTokenValuestd::exception::exception
String ID:
API String ID: 1922334811-0
Opcode ID: 698697129425392015bdbfed4eccaa7ed5425e6ad1e27d8776fd5827ec8cefc4
Instruction ID: 8c31453bf3280b9c6b3d3efe4534e637dbf40c594ff7e749ecb2d8c67fcc9bf1
Opcode Fuzzy Hash: 698697129425392015bdbfed4eccaa7ed5425e6ad1e27d8776fd5827ec8cefc4
Instruction Fuzzy Hash: C611C1B1400204AFE7289F68DCC5D6BB7BDFB44310B20852EF45697281DB78FC418B60

Function 00746606 Relevance: 4.6, APIs: 3, Instructions: 58fileCOMMON

Download Yara Rule

APIs

CreateFileW.KERNEL32(?,00000080,00000003,00000000,00000003,00000080,00000000), ref: 00746623
DeviceIoControl.KERNEL32(00000000,002D1400,?,0000000C,?,00000028,?,00000000), ref: 00746664
CloseHandle.KERNEL32(?,?,00000080,00000003,00000000,00000003,00000080,00000000), ref: 0074666F

Memory Dump Source

Source File: 00000000.00000002.1281263787.0000000000701000.00000020.00000001.01000000.00000003.sdmp, Offset: 00700000, based on PE: true

Associated: 00000000.00000002.1281243473.0000000000700000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1281360671.000000000078D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1281360671.00000000007AE000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1281496264.00000000007BA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1281529307.00000000007C4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1281529307.00000000007C7000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1281529307.00000000007D5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1281529307.00000000007D7000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_700000_OC & PL.jbxd

Similarity

API ID: CloseControlCreateDeviceFileHandle
String ID:
API String ID: 33631002-0
Opcode ID: f78d2f810312b3140218fe819559b6423523f08bd34fdf4c07bcc976e3b6b749
Instruction ID: 575d77ee618ad9aecdcc6b1726fb00f4e395869ef53666926e25d8dcf49b9057
Opcode Fuzzy Hash: f78d2f810312b3140218fe819559b6423523f08bd34fdf4c07bcc976e3b6b749
Instruction Fuzzy Hash: 4C111E71E01228BFDB109FA9DC45BAEBBBCEB45B10F108156F900E6290D7B45E058BA6

Function 007471FA Relevance: 4.5, APIs: 3, Instructions: 42memoryCOMMON

Download Yara Rule

APIs

AllocateAndInitializeSid.ADVAPI32(?,00000002,00000020,00000220,00000000,00000000,00000000,00000000,00000000,00000000,?,?), ref: 00747223
CheckTokenMembership.ADVAPI32(00000000,?,?), ref: 0074723A
FreeSid.ADVAPI32(?), ref: 0074724A

Memory Dump Source

Source File: 00000000.00000002.1281263787.0000000000701000.00000020.00000001.01000000.00000003.sdmp, Offset: 00700000, based on PE: true

Associated: 00000000.00000002.1281243473.0000000000700000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1281360671.000000000078D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1281360671.00000000007AE000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1281496264.00000000007BA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1281529307.00000000007C4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1281529307.00000000007C7000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1281529307.00000000007D5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1281529307.00000000007D7000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_700000_OC & PL.jbxd

Similarity

API ID: AllocateCheckFreeInitializeMembershipToken
String ID:
API String ID: 3429775523-0
Opcode ID: 947165bdb9c010a86ad17a12290551bfc64961b2e77b9cf5bb17ad1b0efd5c09
Instruction ID: 80a14388252e57e3993995804704cd2481643c95bbabd7b4ce0b6bcd01d4d253
Opcode Fuzzy Hash: 947165bdb9c010a86ad17a12290551bfc64961b2e77b9cf5bb17ad1b0efd5c09
Instruction Fuzzy Hash: 4CF01D76A44309BFDF04DFE4DD89AEEBBB8FF08201F508469E602E21D1E3749A449B14

Function 0074F56F Relevance: 3.1, APIs: 2, Instructions: 52fileCOMMON

Download Yara Rule

APIs

FindFirstFileW.KERNEL32(?,?), ref: 0074F599
FindClose.KERNEL32(00000000), ref: 0074F5C9

Memory Dump Source

Source File: 00000000.00000002.1281263787.0000000000701000.00000020.00000001.01000000.00000003.sdmp, Offset: 00700000, based on PE: true

Associated: 00000000.00000002.1281243473.0000000000700000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1281360671.000000000078D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1281360671.00000000007AE000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1281496264.00000000007BA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1281529307.00000000007C4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1281529307.00000000007C7000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1281529307.00000000007D5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1281529307.00000000007D7000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_700000_OC & PL.jbxd

Similarity

API ID: Find$CloseFileFirst
String ID:
API String ID: 2295610775-0
Opcode ID: a50cd933b4410eb5465d35af2591c3ce9a95aab7737ea7b282d0148e6a6e5a2a
Instruction ID: e10f4bcae6fd19ac88a7ea6d2ceb894d67ba571760f7430c8a869eff142bdb48
Opcode Fuzzy Hash: a50cd933b4410eb5465d35af2591c3ce9a95aab7737ea7b282d0148e6a6e5a2a
Instruction Fuzzy Hash: 09118E326002049FD710EF28D849A6EF3E9FF84324F01891EF9A597291DB38AD118B95

Function 0074CE7A Relevance: 3.0, APIs: 2, Instructions: 30windowCOMMON

Download Yara Rule

APIs

GetLastError.KERNEL32(00000000,?,00000FFF,00000000,00000016,?,0075BE6A,?,?,00000000,?), ref: 0074CEA7
FormatMessageW.KERNEL32(00001000,00000000,000000FF,00000000,?,00000FFF,00000000,00000016,?,0075BE6A,?,?,00000000,?), ref: 0074CEB9

Memory Dump Source

Source File: 00000000.00000002.1281263787.0000000000701000.00000020.00000001.01000000.00000003.sdmp, Offset: 00700000, based on PE: true

Associated: 00000000.00000002.1281243473.0000000000700000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1281360671.000000000078D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1281360671.00000000007AE000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1281496264.00000000007BA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1281529307.00000000007C4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1281529307.00000000007C7000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1281529307.00000000007D5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1281529307.00000000007D7000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_700000_OC & PL.jbxd

Similarity

API ID: ErrorFormatLastMessage
String ID:
API String ID: 3479602957-0
Opcode ID: 436fa56491b7f8819e1998451bac9cda4d7990d1d60dd8d0583c97f4985defa1
Instruction ID: 90ca2e33019da7da240b281d2487737818336935a8da949a67203fb2b4946d17
Opcode Fuzzy Hash: 436fa56491b7f8819e1998451bac9cda4d7990d1d60dd8d0583c97f4985defa1
Instruction Fuzzy Hash: 10F08C31101239EBDB21EBA4DC49FFA776DBF083A1F008265F919D6181D7389A40CBA0

Function 0074411C Relevance: 3.0, APIs: 2, Instructions: 29keyboardCOMMON

Download Yara Rule

APIs

SendInput.USER32(00000001,?,0000001C,?,?,00000002), ref: 00744153
keybd_event.USER32(?,75A4C0D0,?,00000000), ref: 00744166

Memory Dump Source

Source File: 00000000.00000002.1281263787.0000000000701000.00000020.00000001.01000000.00000003.sdmp, Offset: 00700000, based on PE: true

Associated: 00000000.00000002.1281243473.0000000000700000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1281360671.000000000078D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1281360671.00000000007AE000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1281496264.00000000007BA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1281529307.00000000007C4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1281529307.00000000007C7000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1281529307.00000000007D5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1281529307.00000000007D7000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_700000_OC & PL.jbxd

Similarity

API ID: InputSendkeybd_event
String ID:
API String ID: 3536248340-0
Opcode ID: 9ec9f1ec17b5b341ce8dfb7d49908b502b57129891129ddbaecf077f0adf602b
Instruction ID: 16053e0e6bbb25cf375a77c31ad50051a18235d2f59baabdda9d6fcae8df7b5a
Opcode Fuzzy Hash: 9ec9f1ec17b5b341ce8dfb7d49908b502b57129891129ddbaecf077f0adf602b
Instruction Fuzzy Hash: 78F09A7080038DAFDB058FA4C809BBE7FB0EF00305F00801AF966A6192D779CA12DFA4

Function 0073AB84 Relevance: 3.0, APIs: 2, Instructions: 22COMMON

Download Yara Rule

APIs

AdjustTokenPrivileges.ADVAPI32(?,00000000,?,00000000,00000000,00000000,?,0073ACC0), ref: 0073AB99
CloseHandle.KERNEL32(?,?,0073ACC0), ref: 0073ABAB

Memory Dump Source

Source File: 00000000.00000002.1281263787.0000000000701000.00000020.00000001.01000000.00000003.sdmp, Offset: 00700000, based on PE: true

Associated: 00000000.00000002.1281243473.0000000000700000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1281360671.000000000078D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1281360671.00000000007AE000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1281496264.00000000007BA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1281529307.00000000007C4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1281529307.00000000007C7000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1281529307.00000000007D5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1281529307.00000000007D7000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_700000_OC & PL.jbxd

Similarity

API ID: AdjustCloseHandlePrivilegesToken
String ID:
API String ID: 81990902-0
Opcode ID: ff782b80ff9b6cadff9a8dd999d35de5f4734e9ed793d3bda12a87d6fcda4765
Instruction ID: 56b3fe1993ba47d240e8b6e19b39c9934b9701bebe994a07ad67e388052dee62
Opcode Fuzzy Hash: ff782b80ff9b6cadff9a8dd999d35de5f4734e9ed793d3bda12a87d6fcda4765
Instruction Fuzzy Hash: 2FE0E671000510EFE7252F54EC09DB7B7FAEF04320B20C429F499814B1D7665CD0EB50

Function 007281AC Relevance: 3.0, APIs: 2, Instructions: 8COMMONLIBRARYCODE

Download Yara Rule

APIs

SetUnhandledExceptionFilter.KERNEL32(00000000,0000000E,00726DB3,-0000031A,?,?,00000001), ref: 007281B1
UnhandledExceptionFilter.KERNEL32(?,?,?,00000001), ref: 007281BA

Memory Dump Source

Source File: 00000000.00000002.1281263787.0000000000701000.00000020.00000001.01000000.00000003.sdmp, Offset: 00700000, based on PE: true

Associated: 00000000.00000002.1281243473.0000000000700000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1281360671.000000000078D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1281360671.00000000007AE000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1281496264.00000000007BA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1281529307.00000000007C4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1281529307.00000000007C7000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1281529307.00000000007D5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1281529307.00000000007D7000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_700000_OC & PL.jbxd

Similarity

API ID: ExceptionFilterUnhandled
String ID:
API String ID: 3192549508-0
Opcode ID: 2fa87b9ce10b2b749a73ec9ea6850067f6719bd57e2a5f015eda2c96c2e8c46f
Instruction ID: 7944f0fdbe43748bda7848c46b77f1846134e0d65ef0fd191983d68ab89a1af6
Opcode Fuzzy Hash: 2fa87b9ce10b2b749a73ec9ea6850067f6719bd57e2a5f015eda2c96c2e8c46f
Instruction Fuzzy Hash: D3B09231084608EBDB102BA1EC09B587F68EB09652F208020F60D448A18B7658108B9A

Function 0072D1B9 Relevance: 2.1, APIs: 1, Instructions: 645COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1281263787.0000000000701000.00000020.00000001.01000000.00000003.sdmp, Offset: 00700000, based on PE: true

Associated: 00000000.00000002.1281243473.0000000000700000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1281360671.000000000078D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1281360671.00000000007AE000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1281496264.00000000007BA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1281529307.00000000007C4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1281529307.00000000007C7000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1281529307.00000000007D5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1281529307.00000000007D7000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_700000_OC & PL.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b2b9bf9e516abdcf978215ff362c19a44bd6438e313279b0bb7bc48d556d3558
Instruction ID: 41de4a69bbde2f52dc2364922ef2ff4c873a937ac95c060b6c6cda4bd7a8525f
Opcode Fuzzy Hash: b2b9bf9e516abdcf978215ff362c19a44bd6438e313279b0bb7bc48d556d3558
Instruction Fuzzy Hash: EF320422D29F514DD7239634D822335A298EFB73D4F15D727F819B5AAAEB2DC8C34104

Function 007096C0 Relevance: 2.1, APIs: 1, Instructions: 573COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1281263787.0000000000701000.00000020.00000001.01000000.00000003.sdmp, Offset: 00700000, based on PE: true

Associated: 00000000.00000002.1281243473.0000000000700000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1281360671.000000000078D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1281360671.00000000007AE000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1281496264.00000000007BA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1281529307.00000000007C4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1281529307.00000000007C7000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1281529307.00000000007D5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1281529307.00000000007D7000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_700000_OC & PL.jbxd

Similarity

API ID: __itow__swprintf
String ID:
API String ID: 674341424-0
Opcode ID: 0ca251fc1445b5c1997f050769af6ccb7e740f93614d690f9e02cbf0ebf9331e
Instruction ID: 83f3533debea151cfca78ca751addb13c5cf2ebf49213d37b4b15db2e0d618ac
Opcode Fuzzy Hash: 0ca251fc1445b5c1997f050769af6ccb7e740f93614d690f9e02cbf0ebf9331e
Instruction Fuzzy Hash: E222ADB1608301DFD724DF14C894B6FB7E4AF88350F108A1DF99A97292DB79E945CB82

Function 0073038E Relevance: 1.8, APIs: 1, Instructions: 294COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1281263787.0000000000701000.00000020.00000001.01000000.00000003.sdmp, Offset: 00700000, based on PE: true

Associated: 00000000.00000002.1281243473.0000000000700000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1281360671.000000000078D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1281360671.00000000007AE000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1281496264.00000000007BA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1281529307.00000000007C4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1281529307.00000000007C7000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1281529307.00000000007D5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1281529307.00000000007D7000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_700000_OC & PL.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: abc3e81f69b7a424eb4a5906c7f69cd276a93616600b7923f9e2f0b82af9175c
Instruction ID: c1ee98775f96aa186e8f4f67fc610e0ffd1634e98d439c36b18737531cc4646c
Opcode Fuzzy Hash: abc3e81f69b7a424eb4a5906c7f69cd276a93616600b7923f9e2f0b82af9175c
Instruction Fuzzy Hash: F0B12320D2AF504DD72396398832336B75CAFBB2D5F92D71BFC1A74D22EB2581934284

Function 0074B6CC Relevance: 1.6, APIs: 1, Instructions: 71COMMON

Download Yara Rule

APIs

__time64.LIBCMT ref: 0074B6DF

Part of subcall function 0072344A: GetSystemTimeAsFileTime.KERNEL32(00000000,?,?,?,0074BDC3,00000000,?,?,?,?,0074BF70,00000000,?), ref: 00723453
Part of subcall function 0072344A: __aulldiv.LIBCMT ref: 00723473

Memory Dump Source

Source File: 00000000.00000002.1281263787.0000000000701000.00000020.00000001.01000000.00000003.sdmp, Offset: 00700000, based on PE: true

Associated: 00000000.00000002.1281243473.0000000000700000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1281360671.000000000078D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1281360671.00000000007AE000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1281496264.00000000007BA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1281529307.00000000007C4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1281529307.00000000007C7000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1281529307.00000000007D5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1281529307.00000000007D7000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_700000_OC & PL.jbxd

Similarity

API ID: Time$FileSystem__aulldiv__time64
String ID:
API String ID: 2893107130-0
Opcode ID: 5165674b082b950978ee32e58deb33766ceea4a5e41274416e89ad34c3947fca
Instruction ID: 06c14086d71968fdeadb8a8bac980988fa149cae7aa873eeb970a43d70bf3429
Opcode Fuzzy Hash: 5165674b082b950978ee32e58deb33766ceea4a5e41274416e89ad34c3947fca
Instruction Fuzzy Hash: 04216D72634510CBC729CF38C881A92B7E5EB95310B248E6DE4E5CB280CB78AA05DB54

Function 00756AAF Relevance: 1.5, APIs: 1, Instructions: 25keyboardCOMMON

Download Yara Rule

APIs

BlockInput.USER32(00000001), ref: 00756ACA

Memory Dump Source

Source File: 00000000.00000002.1281263787.0000000000701000.00000020.00000001.01000000.00000003.sdmp, Offset: 00700000, based on PE: true

Associated: 00000000.00000002.1281243473.0000000000700000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1281360671.000000000078D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1281360671.00000000007AE000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1281496264.00000000007BA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1281529307.00000000007C4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1281529307.00000000007C7000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1281529307.00000000007D5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1281529307.00000000007D7000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_700000_OC & PL.jbxd

Similarity

API ID: BlockInput
String ID:
API String ID: 3456056419-0
Opcode ID: 07538af7a15ee77db4fc2ce9684ee967f528b267e9660fc8643da6fd526872fd
Instruction ID: 782b6f30f6aa1d545720b79dfedbf8e08f1127f7f9ce1ba0d71a8aa11e23b9fe
Opcode Fuzzy Hash: 07538af7a15ee77db4fc2ce9684ee967f528b267e9660fc8643da6fd526872fd
Instruction Fuzzy Hash: DFE01235210204AFD750EF99D404996B7EDAF64751B04C416F945D7391DAB4E8448BA0

Function 007474E7 Relevance: 1.5, APIs: 1, Instructions: 24COMMON

Download Yara Rule

APIs

mouse_event.USER32(00000004,00000000,00000000,00000000,00000000), ref: 0074750A

Memory Dump Source

Source File: 00000000.00000002.1281263787.0000000000701000.00000020.00000001.01000000.00000003.sdmp, Offset: 00700000, based on PE: true

Associated: 00000000.00000002.1281243473.0000000000700000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1281360671.000000000078D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1281360671.00000000007AE000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1281496264.00000000007BA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1281529307.00000000007C4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1281529307.00000000007C7000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1281529307.00000000007D5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1281529307.00000000007D7000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_700000_OC & PL.jbxd

Similarity

API ID: mouse_event
String ID:
API String ID: 2434400541-0
Opcode ID: b31581d68c05e2c1d01b46ea8f8a0f8cb299173bca87b31b55b9c1aaa21b8344
Instruction ID: 8b2154e5d281e0d8fc8f0bf81578164f22783520aa4e61f25428e6e88da37e60
Opcode Fuzzy Hash: b31581d68c05e2c1d01b46ea8f8a0f8cb299173bca87b31b55b9c1aaa21b8344
Instruction Fuzzy Hash: F0D06CA426C685A9E82D0728AD1BFB75A08E300792FE4858AF6029D4C0BBAC6D15E035

Function 0073B106 Relevance: 1.5, APIs: 1, Instructions: 18COMMON

Download Yara Rule

APIs

LogonUserW.ADVAPI32(?,00000001,?,?,00000000,0073AD3E), ref: 0073B124

Memory Dump Source

Source File: 00000000.00000002.1281263787.0000000000701000.00000020.00000001.01000000.00000003.sdmp, Offset: 00700000, based on PE: true

Associated: 00000000.00000002.1281243473.0000000000700000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1281360671.000000000078D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1281360671.00000000007AE000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1281496264.00000000007BA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1281529307.00000000007C4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1281529307.00000000007C7000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1281529307.00000000007D5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1281529307.00000000007D7000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_700000_OC & PL.jbxd

Similarity

API ID: LogonUser
String ID:
API String ID: 1244722697-0
Opcode ID: 2042a38d7cc50d764a61c143d7000589491787f8e86c92a9b8188cba93178f4f
Instruction ID: 165e244ebc5c68502003f751cb82236a6e4018e5160900351ebfc6ae06bc2f21
Opcode Fuzzy Hash: 2042a38d7cc50d764a61c143d7000589491787f8e86c92a9b8188cba93178f4f
Instruction Fuzzy Hash: 0DD05E321A460EAEDF024FA4EC02EAE3F6AEB04700F508110FA11C50A0C675D931AB50

Function 0077B340 Relevance: 1.5, APIs: 1, Instructions: 7COMMON

Download Yara Rule

APIs

GetUserNameW.ADVAPI32 ref: 0077B352

Memory Dump Source

Source File: 00000000.00000002.1281263787.0000000000701000.00000020.00000001.01000000.00000003.sdmp, Offset: 00700000, based on PE: true

Associated: 00000000.00000002.1281243473.0000000000700000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1281360671.000000000078D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1281360671.00000000007AE000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1281496264.00000000007BA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1281529307.00000000007C4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1281529307.00000000007C7000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1281529307.00000000007D5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1281529307.00000000007D7000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_700000_OC & PL.jbxd

Similarity

API ID: NameUser
String ID:
API String ID: 2645101109-0
Opcode ID: 01898d51f8ea88673d11d998ec07651f01b7c785d5c6c0bb4dcab6a6d46dab5f
Instruction ID: cf17c9c375192900eac26e591f3b3d2f5c290802994f38d9358d9c3a8981b32e
Opcode Fuzzy Hash: 01898d51f8ea88673d11d998ec07651f01b7c785d5c6c0bb4dcab6a6d46dab5f
Instruction Fuzzy Hash: F9C04CB1400109EFDB51DBC0C9449EEB7BCAB04301F2090919105F1150D7749B459B77

Function 00728189 Relevance: 1.5, APIs: 1, Instructions: 6COMMON

Download Yara Rule

APIs

SetUnhandledExceptionFilter.KERNEL32(?), ref: 0072818F

Memory Dump Source

Source File: 00000000.00000002.1281263787.0000000000701000.00000020.00000001.01000000.00000003.sdmp, Offset: 00700000, based on PE: true

Associated: 00000000.00000002.1281243473.0000000000700000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1281360671.000000000078D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1281360671.00000000007AE000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1281496264.00000000007BA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1281529307.00000000007C4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1281529307.00000000007C7000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1281529307.00000000007D5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1281529307.00000000007D7000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_700000_OC & PL.jbxd

Similarity

API ID: ExceptionFilterUnhandled
String ID:
API String ID: 3192549508-0
Opcode ID: d81bd9c8892fe0497049cb12cbabbbba149b54b65deb9236f1d7781f00204aec
Instruction ID: 7dab7d679c27f486046af6637a27b374ce000203e5886cb0b1509db10e6c4468
Opcode Fuzzy Hash: d81bd9c8892fe0497049cb12cbabbbba149b54b65deb9236f1d7781f00204aec
Instruction Fuzzy Hash: C2A0113008020CEB8F002B82EC088883F2CEA002A0B208020F80C008208B22A8208A8A

Function 007093F0 Relevance: .5, Instructions: 531COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1281263787.0000000000701000.00000020.00000001.01000000.00000003.sdmp, Offset: 00700000, based on PE: true

Associated: 00000000.00000002.1281243473.0000000000700000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1281360671.000000000078D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1281360671.00000000007AE000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1281496264.00000000007BA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1281529307.00000000007C4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1281529307.00000000007C7000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1281529307.00000000007D5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1281529307.00000000007D7000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_700000_OC & PL.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 30a0f4a13ce771bcc040886a93b77d7bf3ead8590f83a6b733fd3d3f47e193c0
Instruction ID: cd17fed50811db512bbb6cf2050637958f7532b705bc4cb489cc8a78a7443132
Opcode Fuzzy Hash: 30a0f4a13ce771bcc040886a93b77d7bf3ead8590f83a6b733fd3d3f47e193c0
Instruction Fuzzy Hash: B7129370A00209DFDF04DFA5D995AEEB7F5FF48300F108629E516E7292EB3AA911CB54

Function 0070E3E3 Relevance: .5, Instructions: 521COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1281263787.0000000000701000.00000020.00000001.01000000.00000003.sdmp, Offset: 00700000, based on PE: true

Associated: 00000000.00000002.1281243473.0000000000700000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1281360671.000000000078D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1281360671.00000000007AE000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1281496264.00000000007BA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1281529307.00000000007C4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1281529307.00000000007C7000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1281529307.00000000007D5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1281529307.00000000007D7000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_700000_OC & PL.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9fa6d7ef7521946e05359e5da65fa9f0e68c4ba452c0f876f468f3e5d7f58dde
Instruction ID: 3313029eb79cef3fdf61d51a996e11172c2f6693d6f3f5ed10930170068bdb52
Opcode Fuzzy Hash: 9fa6d7ef7521946e05359e5da65fa9f0e68c4ba452c0f876f468f3e5d7f58dde
Instruction Fuzzy Hash: 29129E70A04205CFDB24DF58D484ABAB7F1FF14304F14CA6AE95A9B391E739AD81CB91

Function 0070AF50 Relevance: .5, Instructions: 514COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1281263787.0000000000701000.00000020.00000001.01000000.00000003.sdmp, Offset: 00700000, based on PE: true

Associated: 00000000.00000002.1281243473.0000000000700000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1281360671.000000000078D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1281360671.00000000007AE000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1281496264.00000000007BA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1281529307.00000000007C4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1281529307.00000000007C7000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1281529307.00000000007D5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1281529307.00000000007D7000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_700000_OC & PL.jbxd

Similarity

API ID: Exception@8Throwstd::exception::exception
String ID:
API String ID: 3728558374-0
Opcode ID: c437914307644eb976d619a4df53c6e69b3d654d4164e36b9b4f94400db76fcd
Instruction ID: 38474be4e1b409ecf6014c0db197d131092f3430fe2784bdc84acf061cc8a701
Opcode Fuzzy Hash: c437914307644eb976d619a4df53c6e69b3d654d4164e36b9b4f94400db76fcd
Instruction Fuzzy Hash: AF02D5B0A00209DBCF04DF68D895AAE77F5FF44340F10C169E80ADB296EB39DA55CB91

Function 007202A4 Relevance: .3, Instructions: 345COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1281263787.0000000000701000.00000020.00000001.01000000.00000003.sdmp, Offset: 00700000, based on PE: true

Associated: 00000000.00000002.1281243473.0000000000700000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1281360671.000000000078D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1281360671.00000000007AE000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1281496264.00000000007BA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1281529307.00000000007C4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1281529307.00000000007C7000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1281529307.00000000007D5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1281529307.00000000007D7000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_700000_OC & PL.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6bcf19402166b509fafb4c50a64371ef2a93877f8d810bfc08732e8a9195a1a8
Instruction ID: ca5a2de14afecc4e1bb3c7c6be51853e3fa8c6720105c9bc70981089af6f3a7b
Opcode Fuzzy Hash: 6bcf19402166b509fafb4c50a64371ef2a93877f8d810bfc08732e8a9195a1a8
Instruction Fuzzy Hash: E4C1C6322051A30ADF2D463E943447EFAA15EA27B171A076DD8B3CB4D6FF28C568D670

Function 007206D9 Relevance: .3, Instructions: 341COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1281263787.0000000000701000.00000020.00000001.01000000.00000003.sdmp, Offset: 00700000, based on PE: true

Associated: 00000000.00000002.1281243473.0000000000700000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1281360671.000000000078D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1281360671.00000000007AE000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1281496264.00000000007BA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1281529307.00000000007C4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1281529307.00000000007C7000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1281529307.00000000007D5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1281529307.00000000007D7000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_700000_OC & PL.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2d76c3bdd49f8e00aad6e71f29a941d673537f809e9b181fbd8d4251c6dfdf40
Instruction ID: ce510e09aac145d57f4b15a85ee213772d0b666bee90fc48a45bfd819decf230
Opcode Fuzzy Hash: 2d76c3bdd49f8e00aad6e71f29a941d673537f809e9b181fbd8d4251c6dfdf40
Instruction Fuzzy Hash: 3EC1F0322051A30ADF2D463ED43447EBAA15EA2BB170A036DD4B3CB5D6FF28D568D670

Function 0071FA57 Relevance: .3, Instructions: 323COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1281263787.0000000000701000.00000020.00000001.01000000.00000003.sdmp, Offset: 00700000, based on PE: true

Associated: 00000000.00000002.1281243473.0000000000700000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1281360671.000000000078D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1281360671.00000000007AE000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1281496264.00000000007BA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1281529307.00000000007C4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1281529307.00000000007C7000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1281529307.00000000007D5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1281529307.00000000007D7000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_700000_OC & PL.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b18fb967447e529c76739499a87999de3f08bdf72590393fa5476362680146d7
Instruction ID: 2b7a0923d3639c4f24ccc9826c6619d61521fd32692a29e48fcc5e468334c8f9
Opcode Fuzzy Hash: b18fb967447e529c76739499a87999de3f08bdf72590393fa5476362680146d7
Instruction Fuzzy Hash: EBC1923220909309DF2D463DC4744BEBAA15EA2BB571A077DD4B3CB5D5FF28C5A8D620

Function 00F56510 Relevance: .1, Instructions: 92COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1282677803.0000000000F52000.00000040.00000020.00020000.00000000.sdmp, Offset: 00F52000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f52000_OC & PL.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 424b499c86482d5e2cad33d2eb2b77d7085f14ac4781241b47b3debc7e1ef18c
Instruction ID: 61f3c40188d9c3045f7d6ee8ef0f614225db886daeda57a35a14a1b6199f5ff9
Opcode Fuzzy Hash: 424b499c86482d5e2cad33d2eb2b77d7085f14ac4781241b47b3debc7e1ef18c
Instruction Fuzzy Hash: 1C41B371D1051CEBCF48CFADC991AEEBBF2AF88201F948299D516AB345D730AB41DB50

Function 00F563A0 Relevance: .0, Instructions: 35COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1282677803.0000000000F52000.00000040.00000020.00020000.00000000.sdmp, Offset: 00F52000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f52000_OC & PL.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6091d3ab8c142cd01bdaf95ad615aaddba634de501579065cef803e1d5150a63
Instruction ID: a512496d5dd8e7a17c0d0f29dda1369319cae7d2e4bac623a1c82d69f13c7aa0
Opcode Fuzzy Hash: 6091d3ab8c142cd01bdaf95ad615aaddba634de501579065cef803e1d5150a63
Instruction Fuzzy Hash: 31018078A00209EFCB48DF98C5909AEF7B5FB88310F608599ED19A7301D730AE41EB80

Function 00F56400 Relevance: .0, Instructions: 35COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1282677803.0000000000F52000.00000040.00000020.00020000.00000000.sdmp, Offset: 00F52000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f52000_OC & PL.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2824983519b781728331ca74e43d8f1b114060d413125894b627f2317d3cf6f3
Instruction ID: d3611042a12d71f4041347ea1f848c12b0f26de4e6a2c93820f81ca21316c802
Opcode Fuzzy Hash: 2824983519b781728331ca74e43d8f1b114060d413125894b627f2317d3cf6f3
Instruction Fuzzy Hash: 58018078A00109EFCB44DF98C5909AEF7B5FB88310F608599ED19A7301E730AE41DB80

Function 00F54D20 Relevance: .0, Instructions: 6COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1282677803.0000000000F52000.00000040.00000020.00020000.00000000.sdmp, Offset: 00F52000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f52000_OC & PL.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e1f80ac41b4fc2d45690e214ca5193b9bf4f67450f61a2a701b7f1fb86cd8f4e
Instruction ID: 2052e7d0eb43af8a57a5c2d707c06396f1b84aee57587abda472ed480d51124b
Opcode Fuzzy Hash: e1f80ac41b4fc2d45690e214ca5193b9bf4f67450f61a2a701b7f1fb86cd8f4e
Instruction Fuzzy Hash: 1AB012310527488BC2118B89E008B1073ECA308E04F1000B0D40C07B01827874008D48

Function 0075A2A9 Relevance: 77.5, APIs: 40, Strings: 4, Instructions: 490filecommemoryCOMMON

Download Yara Rule

APIs

DeleteObject.GDI32(00000000), ref: 0075A2FE
DeleteObject.GDI32(00000000), ref: 0075A310
DestroyWindow.USER32 ref: 0075A31E
GetDesktopWindow.USER32 ref: 0075A338
GetWindowRect.USER32(00000000), ref: 0075A33F
SetRect.USER32(?,00000000,00000000,000001F4,00000190), ref: 0075A480
AdjustWindowRectEx.USER32(?,88C00000,00000000,00000002), ref: 0075A490
CreateWindowExW.USER32(00000002,AutoIt v3,?,88C00000,000000FF,000000FF,?,?,00000000,00000000,00000000), ref: 0075A4D8
GetClientRect.USER32(00000000,?), ref: 0075A4E4
CreateWindowExW.USER32(00000000,static,00000000,5000000E,00000000,00000000,?,?,00000000,00000000,00000000), ref: 0075A51E
CreateFileW.KERNEL32(?,80000000,00000000,00000000,00000003,00000000,00000000,?,88C00000,000000FF,000000FF,?,?,00000000,00000000,00000000), ref: 0075A540
GetFileSize.KERNEL32(00000000,00000000,?,88C00000,000000FF,000000FF,?,?,00000000,00000000,00000000), ref: 0075A553
GlobalAlloc.KERNEL32(00000002,00000000,?,88C00000,000000FF,000000FF,?,?,00000000,00000000,00000000), ref: 0075A55E
GlobalLock.KERNEL32(00000000), ref: 0075A567
ReadFile.KERNEL32(00000000,00000000,00000000,00000190,00000000,?,88C00000,000000FF,000000FF,?,?,00000000,00000000,00000000), ref: 0075A576
GlobalUnlock.KERNEL32(00000000), ref: 0075A57F
CloseHandle.KERNEL32(00000000,?,88C00000,000000FF,000000FF,?,?,00000000,00000000,00000000), ref: 0075A586
GlobalFree.KERNEL32(00000000), ref: 0075A591
CreateStreamOnHGlobal.OLE32(00000000,00000001,88C00000,?,88C00000,000000FF,000000FF,?,?,00000000,00000000,00000000), ref: 0075A5A3
OleLoadPicture.OLEAUT32(88C00000,00000000,00000000,0078D9BC,00000000), ref: 0075A5B9
GlobalFree.KERNEL32(00000000), ref: 0075A5C9
CopyImage.USER32(000001F4,00000000,00000000,00000000,00002000), ref: 0075A5EF
SendMessageW.USER32(?,00000172,00000000,000001F4), ref: 0075A60E
SetWindowPos.USER32(?,00000000,00000000,00000000,?,?,00000020,?,88C00000,000000FF,000000FF,?,?,00000000,00000000,00000000), ref: 0075A630
ShowWindow.USER32(00000004,?,88C00000,000000FF,000000FF,?,?,00000000,00000000,00000000), ref: 0075A81D

Strings

, xrefs: 0075A7A3
AutoIt v3, xrefs: 0075A4D0
DISPLAY, xrefs: 0075A680
static, xrefs: 0075A518, 0075A66F

Memory Dump Source

Source File: 00000000.00000002.1281263787.0000000000701000.00000020.00000001.01000000.00000003.sdmp, Offset: 00700000, based on PE: true

Associated: 00000000.00000002.1281243473.0000000000700000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1281360671.000000000078D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1281360671.00000000007AE000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1281496264.00000000007BA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1281529307.00000000007C4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1281529307.00000000007C7000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1281529307.00000000007D5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1281529307.00000000007D7000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_700000_OC & PL.jbxd

Similarity

API ID: Window$Global$CreateRect$File$DeleteFreeObject$AdjustAllocClientCloseCopyDesktopDestroyHandleImageLoadLockMessagePictureReadSendShowSizeStreamUnlock
String ID: $AutoIt v3$DISPLAY$static
API String ID: 2211948467-2373415609
Opcode ID: 8c65004f144ffd5f581665fa58bc144352ab56c0345ee644cd09997797608cec
Instruction ID: 9a9cf5fea5b1ef34158c07b8d6ad6b0da690d32dde797968a976e53871db52e6
Opcode Fuzzy Hash: 8c65004f144ffd5f581665fa58bc144352ab56c0345ee644cd09997797608cec
Instruction Fuzzy Hash: 89025D71900218EFDB14DFA4CD89EAE7BB9FF49311F108268F9059B2A1D778AD41CB64

Function 0076D285 Relevance: 49.8, APIs: 33, Instructions: 260COMMON

Download Yara Rule

APIs

SetTextColor.GDI32(?,00000000), ref: 0076D2DB
GetSysColorBrush.USER32(0000000F), ref: 0076D30C
GetSysColor.USER32(0000000F), ref: 0076D318
SetBkColor.GDI32(?,000000FF), ref: 0076D332
SelectObject.GDI32(?,00000000), ref: 0076D341
InflateRect.USER32(?,000000FF,000000FF), ref: 0076D36C
GetSysColor.USER32(00000010), ref: 0076D374
CreateSolidBrush.GDI32(00000000), ref: 0076D37B
FrameRect.USER32(?,?,00000000), ref: 0076D38A
DeleteObject.GDI32(00000000), ref: 0076D391
InflateRect.USER32(?,000000FE,000000FE), ref: 0076D3DC
FillRect.USER32(?,?,00000000), ref: 0076D40E
GetWindowLongW.USER32(?,000000F0), ref: 0076D439

Part of subcall function 0076D575: GetSysColor.USER32(00000012), ref: 0076D5AE
Part of subcall function 0076D575: SetTextColor.GDI32(?,?), ref: 0076D5B2
Part of subcall function 0076D575: GetSysColorBrush.USER32(0000000F), ref: 0076D5C8
Part of subcall function 0076D575: GetSysColor.USER32(0000000F), ref: 0076D5D3
Part of subcall function 0076D575: GetSysColor.USER32(00000011), ref: 0076D5F0
Part of subcall function 0076D575: CreatePen.GDI32(00000000,00000001,00743C00), ref: 0076D5FE
Part of subcall function 0076D575: SelectObject.GDI32(?,00000000), ref: 0076D60F
Part of subcall function 0076D575: SetBkColor.GDI32(?,00000000), ref: 0076D618
Part of subcall function 0076D575: SelectObject.GDI32(?,?), ref: 0076D625
Part of subcall function 0076D575: InflateRect.USER32(?,000000FF,000000FF), ref: 0076D644
Part of subcall function 0076D575: RoundRect.GDI32(?,?,?,?,?,00000005,00000005), ref: 0076D65B
Part of subcall function 0076D575: GetWindowLongW.USER32(00000000,000000F0), ref: 0076D670
Part of subcall function 0076D575: SendMessageW.USER32(00000000,0000000E,00000000,00000000), ref: 0076D698

Memory Dump Source

Source File: 00000000.00000002.1281263787.0000000000701000.00000020.00000001.01000000.00000003.sdmp, Offset: 00700000, based on PE: true

Associated: 00000000.00000002.1281243473.0000000000700000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1281360671.000000000078D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1281360671.00000000007AE000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1281496264.00000000007BA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1281529307.00000000007C4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1281529307.00000000007C7000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1281529307.00000000007D5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1281529307.00000000007D7000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_700000_OC & PL.jbxd

Similarity

API ID: Color$Rect$Object$BrushInflateSelect$CreateLongTextWindow$DeleteFillFrameMessageRoundSendSolid
String ID:
API String ID: 3521893082-0
Opcode ID: 9a39f52d02047a841361d24dc676bfc8d4aed4ac8cd4924c6acdd5ca326d464f
Instruction ID: af03f501884c945fec6033793aced3ab1d16e4d7782780a7a7c61a71e75e327d
Opcode Fuzzy Hash: 9a39f52d02047a841361d24dc676bfc8d4aed4ac8cd4924c6acdd5ca326d464f
Instruction Fuzzy Hash: A791AE71908305EFCB209F64DC48E6B7BA9FF89320F208A19F962961E0D779DD44CB56

Function 0071B8FD Relevance: 49.5, APIs: 27, Strings: 1, Instructions: 491windowCOMMON

Download Yara Rule

APIs

DestroyWindow.USER32 ref: 0071B98B
DeleteObject.GDI32(00000000), ref: 0071B9CD
DeleteObject.GDI32(00000000), ref: 0071B9D8
DestroyIcon.USER32(00000000), ref: 0071B9E3
DestroyWindow.USER32(00000000), ref: 0071B9EE
SendMessageW.USER32(?,00001308,?,00000000), ref: 0077D2AA
ImageList_Remove.COMCTL32(?,000000FF,?), ref: 0077D2E3
MoveWindow.USER32(00000000,?,?,?,?,00000000), ref: 0077D711

Part of subcall function 0071B9FF: InvalidateRect.USER32(?,00000000,00000001,?,?,?,0071B759,?,00000000,?,?,?,?,0071B72B,00000000,?), ref: 0071BA58

SendMessageW.USER32 ref: 0077D758
SendMessageW.USER32(?,00001008,000000FF,00000000), ref: 0077D76F
ImageList_Destroy.COMCTL32(00000000), ref: 0077D785
ImageList_Destroy.COMCTL32(00000000), ref: 0077D790

Strings

0, xrefs: 0077D5A5

Memory Dump Source

Source File: 00000000.00000002.1281263787.0000000000701000.00000020.00000001.01000000.00000003.sdmp, Offset: 00700000, based on PE: true

Associated: 00000000.00000002.1281243473.0000000000700000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1281360671.000000000078D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1281360671.00000000007AE000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1281496264.00000000007BA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1281529307.00000000007C4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1281529307.00000000007C7000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1281529307.00000000007D5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1281529307.00000000007D7000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_700000_OC & PL.jbxd

Similarity

API ID: Destroy$ImageList_MessageSendWindow$DeleteObject$IconInvalidateMoveRectRemove
String ID: 0
API String ID: 464785882-4108050209
Opcode ID: 3555c4b8ebfe19627a1816027b628dc3764a18c270e63a99f5715fa6576926a0
Instruction ID: 004cd127932c122a7517c4acb7a90c839d935ce3eb59ddbe1b15c2c5b852184b
Opcode Fuzzy Hash: 3555c4b8ebfe19627a1816027b628dc3764a18c270e63a99f5715fa6576926a0
Instruction Fuzzy Hash: 5E127D70204241DFDB25CF28C888BA9BBF5FF45354F148569E989CB692C739EC92CB91

Function 0074DBC4 Relevance: 45.7, APIs: 3, Strings: 23, Instructions: 187COMMON

Download Yara Rule

APIs

SetErrorMode.KERNEL32(00000001), ref: 0074DBD6
GetDriveTypeW.KERNEL32(?,0079DC54,?,\\.\,0079DC00), ref: 0074DCC3
SetErrorMode.KERNEL32(00000000,0079DC54,?,\\.\,0079DC00), ref: 0074DE29

Strings

Unknown, xrefs: 0074DCE3, 0074DD8C
USB, xrefs: 0074DDBD
1394, xrefs: 0074DDA8
SCSI, xrefs: 0074DD93
\\.\, xrefs: 0074DC2B
Fibre, xrefs: 0074DDB6
SATA, xrefs: 0074DDD9
Fixed, xrefs: 0074DD0B
RAID, xrefs: 0074DDC4
RAMDisk, xrefs: 0074DCED
SAS, xrefs: 0074DDD2
Network, xrefs: 0074DD01
PhysicalDrive, xrefs: 0074DC67
CDROM, xrefs: 0074DCF7
SSA, xrefs: 0074DDAF
iSCSI, xrefs: 0074DDCB
Removable, xrefs: 0074DD15
ATAPI, xrefs: 0074DD9A
ATA, xrefs: 0074DDA1
MMC, xrefs: 0074DDE7
FileBackedVirtual, xrefs: 0074DDF5
SSD, xrefs: 0074DD50
Virtual, xrefs: 0074DDEE

Memory Dump Source

Source File: 00000000.00000002.1281263787.0000000000701000.00000020.00000001.01000000.00000003.sdmp, Offset: 00700000, based on PE: true

Associated: 00000000.00000002.1281243473.0000000000700000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1281360671.000000000078D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1281360671.00000000007AE000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1281496264.00000000007BA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1281529307.00000000007C4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1281529307.00000000007C7000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1281529307.00000000007D5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1281529307.00000000007D7000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_700000_OC & PL.jbxd

Similarity

API ID: ErrorMode$DriveType
String ID: 1394$ATA$ATAPI$CDROM$Fibre$FileBackedVirtual$Fixed$MMC$Network$PhysicalDrive$RAID$RAMDisk$Removable$SAS$SATA$SCSI$SSA$SSD$USB$Unknown$Virtual$\\.\$iSCSI
API String ID: 2907320926-4222207086
Opcode ID: e74f0d42adbc7a4bbd6f068f256296b40a50ee71a387eaa39ed1ad5088eafc45
Instruction ID: ad4a65ca8ce3d5416d13e2a50c5e6b569cac7b771b34a585ca1e0dd650526148
Opcode Fuzzy Hash: e74f0d42adbc7a4bbd6f068f256296b40a50ee71a387eaa39ed1ad5088eafc45
Instruction Fuzzy Hash: EE5191B0748302EBC620DF10C8959AAB7A1FB94704B20491EF4879B2D9DB7CDD85DF52

Function 0070CC24 Relevance: 44.0, APIs: 12, Strings: 13, Instructions: 267COMMON

Download Yara Rule

APIs

__wcsnicmp.LIBCMT ref: 0070CC68
__wcsnicmp.LIBCMT ref: 0070CC80
__wcsnicmp.LIBCMT ref: 0070CC98
__wcsnicmp.LIBCMT ref: 0070CCB0
__wcsnicmp.LIBCMT ref: 0070CCC8
__wcsnicmp.LIBCMT ref: 0070CCE0
__wcsnicmp.LIBCMT ref: 0070CCF8
__wcsnicmp.LIBCMT ref: 0070CD0C
__wcsnicmp.LIBCMT ref: 0070CD4D
__wcsnicmp.LIBCMT ref: 0070CD61
__wcsnicmp.LIBCMT ref: 0070CD75
__wcsnicmp.LIBCMT ref: 0070CD89

Strings

#cs, xrefs: 0070CD06, 0070CD5B
Bad directive syntax error, xrefs: 00772ECB
#include, xrefs: 0070CCDA
#comments-start, xrefs: 0070CCF2, 0070CD47
#include-once, xrefs: 0070CCC2
#ce, xrefs: 0070CD83
#comments-end, xrefs: 0070CD6F
Unterminated group of comments, xrefs: 00772FB4
#requireadmin, xrefs: 0070CC92
#pragma compile, xrefs: 0070CC62
#notrayicon, xrefs: 0070CC7A
#OnAutoItStartRegister, xrefs: 0070CCAA
Cannot parse #include, xrefs: 00772FA1

Memory Dump Source

Source File: 00000000.00000002.1281263787.0000000000701000.00000020.00000001.01000000.00000003.sdmp, Offset: 00700000, based on PE: true

Associated: 00000000.00000002.1281243473.0000000000700000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1281360671.000000000078D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1281360671.00000000007AE000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1281496264.00000000007BA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1281529307.00000000007C4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1281529307.00000000007C7000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1281529307.00000000007D5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1281529307.00000000007D7000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_700000_OC & PL.jbxd

Similarity

API ID: __wcsnicmp
String ID: #OnAutoItStartRegister$#ce$#comments-end$#comments-start$#cs$#include$#include-once$#notrayicon$#pragma compile$#requireadmin$Bad directive syntax error$Cannot parse #include$Unterminated group of comments
API String ID: 1038674560-86951937
Opcode ID: b6d4b00c15913a6fc1d77a325ba0236b2925e457692bdcacdd8c8d5e055718e3
Instruction ID: 1a8290a0a50e4668d7884ecc54bd7dea08885b9b335bf1bb5191532d0e3f3d91
Opcode Fuzzy Hash: b6d4b00c15913a6fc1d77a325ba0236b2925e457692bdcacdd8c8d5e055718e3
Instruction Fuzzy Hash: 7381FBB0740215FBDF25AB64DC96FAF37A9AF25340F044229F9096A1C3EB6CD951C2A1

Function 0076C6E9 Relevance: 42.4, APIs: 23, Strings: 1, Instructions: 447windowCOMMON

Download Yara Rule

APIs

SetWindowPos.USER32(?,00000000,00000000,00000000,00000000,00000000,00000013,?,?,?), ref: 0076C788
SendMessageW.USER32(?,0000113F,00000000,00000008), ref: 0076C83E
SendMessageW.USER32(?,00001102,00000002,?), ref: 0076C859
SendMessageW.USER32(?,000000F1,?,00000000), ref: 0076CB15

Strings

0, xrefs: 0076C89C

Memory Dump Source

Source File: 00000000.00000002.1281263787.0000000000701000.00000020.00000001.01000000.00000003.sdmp, Offset: 00700000, based on PE: true

Associated: 00000000.00000002.1281243473.0000000000700000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1281360671.000000000078D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1281360671.00000000007AE000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1281496264.00000000007BA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1281529307.00000000007C4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1281529307.00000000007C7000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1281529307.00000000007D5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1281529307.00000000007D7000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_700000_OC & PL.jbxd

Similarity

API ID: MessageSend$Window
String ID: 0
API String ID: 2326795674-4108050209
Opcode ID: d86d7919cabbe7bf365d65f163aefcdd20e3b982a252247bc96d04077a368808
Instruction ID: 74a9a1b92006c11cc9b43f9eb9a0f2c0a2cf8712bec7df955b22f4a028f59edd
Opcode Fuzzy Hash: d86d7919cabbe7bf365d65f163aefcdd20e3b982a252247bc96d04077a368808
Instruction Fuzzy Hash: 8AF1B271204305AFD7228F24C849BBABBE4FF49354F18462DF9DA962A1C778DC44DB92

Function 0076638D Relevance: 42.4, APIs: 1, Strings: 23, Instructions: 352COMMON

Download Yara Rule

APIs

CharUpperBuffW.USER32(?,?,0079DC00), ref: 00766449

Strings

GETLINECOUNT, xrefs: 007666E4
ADDSTRING, xrefs: 00766536
GETCURRENTSELECTION, xrefs: 00766603
GETCURRENTCOL, xrefs: 00766724
ISENABLED, xrefs: 0076648C
UNCHECK, xrefs: 007666A1
SELECTSTRING, xrefs: 00766626
FINDSTRING, xrefs: 00766596
TABLEFT, xrefs: 007664A7
GETCURRENTLINE, xrefs: 00766704
SHOWDROPDOWN, xrefs: 00766500
CHECK, xrefs: 0076668B
TABRIGHT, xrefs: 007664BD
SENDCOMMANDID, xrefs: 007667CA
SETCURRENTSELECTION, xrefs: 007665D6
GETLINE, xrefs: 0076678B
EDITPASTE, xrefs: 0076675B
ISCHECKED, xrefs: 00766659
ISVISIBLE, xrefs: 00766455
DELSTRING, xrefs: 00766569
GETSELECTED, xrefs: 007666C1
CURRENTTAB, xrefs: 007664DD
HIDEDROPDOWN, xrefs: 00766520

Memory Dump Source

Source File: 00000000.00000002.1281263787.0000000000701000.00000020.00000001.01000000.00000003.sdmp, Offset: 00700000, based on PE: true

Associated: 00000000.00000002.1281243473.0000000000700000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1281360671.000000000078D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1281360671.00000000007AE000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1281496264.00000000007BA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1281529307.00000000007C4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1281529307.00000000007C7000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1281529307.00000000007D5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1281529307.00000000007D7000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_700000_OC & PL.jbxd

Similarity

API ID: BuffCharUpper
String ID: ADDSTRING$CHECK$CURRENTTAB$DELSTRING$EDITPASTE$FINDSTRING$GETCURRENTCOL$GETCURRENTLINE$GETCURRENTSELECTION$GETLINE$GETLINECOUNT$GETSELECTED$HIDEDROPDOWN$ISCHECKED$ISENABLED$ISVISIBLE$SELECTSTRING$SENDCOMMANDID$SETCURRENTSELECTION$SHOWDROPDOWN$TABLEFT$TABRIGHT$UNCHECK
API String ID: 3964851224-45149045
Opcode ID: 6b75803ff415e244c95a864a78a8cc442b9e8e762254f101a5ef3166e99f5934
Instruction ID: b60b41cf1eb7f81cc19b55b20cd1d9d5d769692f9d9bf852b0c4750de2194421
Opcode Fuzzy Hash: 6b75803ff415e244c95a864a78a8cc442b9e8e762254f101a5ef3166e99f5934
Instruction Fuzzy Hash: AFC15D30204246CBCB04EF14C955AAE77E5AF94344F544869FD865B2E3DB3CED8ACB92

Function 0076D575 Relevance: 39.2, APIs: 26, Instructions: 186windowCOMMON

Download Yara Rule

APIs

GetSysColor.USER32(00000012), ref: 0076D5AE
SetTextColor.GDI32(?,?), ref: 0076D5B2
GetSysColorBrush.USER32(0000000F), ref: 0076D5C8
GetSysColor.USER32(0000000F), ref: 0076D5D3
CreateSolidBrush.GDI32(?), ref: 0076D5D8
GetSysColor.USER32(00000011), ref: 0076D5F0
CreatePen.GDI32(00000000,00000001,00743C00), ref: 0076D5FE
SelectObject.GDI32(?,00000000), ref: 0076D60F
SetBkColor.GDI32(?,00000000), ref: 0076D618
SelectObject.GDI32(?,?), ref: 0076D625
InflateRect.USER32(?,000000FF,000000FF), ref: 0076D644
RoundRect.GDI32(?,?,?,?,?,00000005,00000005), ref: 0076D65B
GetWindowLongW.USER32(00000000,000000F0), ref: 0076D670
SendMessageW.USER32(00000000,0000000E,00000000,00000000), ref: 0076D698
GetWindowTextW.USER32(00000000,00000000,00000001), ref: 0076D6BF
InflateRect.USER32(?,000000FD,000000FD), ref: 0076D6DD
DrawFocusRect.USER32(?,?), ref: 0076D6E8
GetSysColor.USER32(00000011), ref: 0076D6F6
SetTextColor.GDI32(?,00000000), ref: 0076D6FE
DrawTextW.USER32(?,00000000,000000FF,?,?), ref: 0076D712
SelectObject.GDI32(?,0076D2A5), ref: 0076D729
DeleteObject.GDI32(?), ref: 0076D734
SelectObject.GDI32(?,?), ref: 0076D73A
DeleteObject.GDI32(?), ref: 0076D73F
SetTextColor.GDI32(?,?), ref: 0076D745
SetBkColor.GDI32(?,?), ref: 0076D74F

Memory Dump Source

Source File: 00000000.00000002.1281263787.0000000000701000.00000020.00000001.01000000.00000003.sdmp, Offset: 00700000, based on PE: true

Associated: 00000000.00000002.1281243473.0000000000700000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1281360671.000000000078D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1281360671.00000000007AE000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1281496264.00000000007BA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1281529307.00000000007C4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1281529307.00000000007C7000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1281529307.00000000007D5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1281529307.00000000007D7000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_700000_OC & PL.jbxd

Similarity

API ID: Color$Object$Text$RectSelect$BrushCreateDeleteDrawInflateWindow$FocusLongMessageRoundSendSolid
String ID:
API String ID: 1996641542-0
Opcode ID: e904b7b268e217ebf6539c89f50443a5926970cc28a9a49220058b46fe9abcab
Instruction ID: 90285523bc2b96256aaa42b8bf42846657b3aa609bf9dda20c863d12b3c378da
Opcode Fuzzy Hash: e904b7b268e217ebf6539c89f50443a5926970cc28a9a49220058b46fe9abcab
Instruction Fuzzy Hash: F1513C71D40208AFDF209FA8DC48EAE7B79EF08320F218515F916AB2E1D7799E409F54

Function 0076B6C4 Relevance: 38.9, APIs: 21, Strings: 1, Instructions: 400windowCOMMON

Download Yara Rule

APIs

SendMessageW.USER32(?,00000158,000000FF,0000014E), ref: 0076B7B0
SendMessageW.USER32(?,0000014E,00000000,00000000), ref: 0076B7C1
CharNextW.USER32(0000014E), ref: 0076B7F0
SendMessageW.USER32(?,0000014B,00000000,00000000), ref: 0076B831
SendMessageW.USER32(?,00000158,000000FF,00000158), ref: 0076B847
SendMessageW.USER32(?,0000014E,00000000,00000000), ref: 0076B858
SendMessageW.USER32(?,000000C2,00000001,0000014E), ref: 0076B875
SetWindowTextW.USER32(?,0000014E), ref: 0076B8C7
SendMessageW.USER32(?,000000B1,000F4240,000F423F), ref: 0076B8DD
SendMessageW.USER32(?,00001002,00000000,?), ref: 0076B90E
_memset.LIBCMT ref: 0076B933
SendMessageW.USER32(00000000,00001060,00000001,00000004), ref: 0076B97C
_memset.LIBCMT ref: 0076B9DB
SendMessageW.USER32 ref: 0076BA05
SendMessageW.USER32(?,00001074,?,00000001), ref: 0076BA5D
SendMessageW.USER32(?,0000133D,?,?), ref: 0076BB0A
InvalidateRect.USER32(?,00000000,00000001), ref: 0076BB2C
GetMenuItemInfoW.USER32(?), ref: 0076BB76
SetMenuItemInfoW.USER32(?,?,00000000,00000030), ref: 0076BBA3
DrawMenuBar.USER32(?), ref: 0076BBB2
SetWindowTextW.USER32(?,0000014E), ref: 0076BBDA

Strings

0, xrefs: 0076BB4F

Memory Dump Source

Source File: 00000000.00000002.1281263787.0000000000701000.00000020.00000001.01000000.00000003.sdmp, Offset: 00700000, based on PE: true

Associated: 00000000.00000002.1281243473.0000000000700000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1281360671.000000000078D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1281360671.00000000007AE000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1281496264.00000000007BA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1281529307.00000000007C4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1281529307.00000000007C7000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1281529307.00000000007D5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1281529307.00000000007D7000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_700000_OC & PL.jbxd

Similarity

API ID: MessageSend$Menu$InfoItemTextWindow_memset$CharDrawInvalidateNextRect
String ID: 0
API String ID: 1073566785-4108050209
Opcode ID: 17594aac5b070983b805b1c05750d820c2866419b8e82ec56475cb11bdd598b7
Instruction ID: 08e06ed7e485a220b4ab2711c2af96d6c19a8e6651de471e55310c2d40f65565
Opcode Fuzzy Hash: 17594aac5b070983b805b1c05750d820c2866419b8e82ec56475cb11bdd598b7
Instruction Fuzzy Hash: 19E16FB1900218EBDB209F65CC84EEE7B78EF06754F14815AFD1AEA191D7789A81CF60

Function 00702EC0 Relevance: 37.1, APIs: 8, Strings: 13, Instructions: 346COMMON

Download Yara Rule

APIs

GetForegroundWindow.USER32 ref: 00702F7A
IsWindow.USER32(?), ref: 007722FD

Strings

P+{, xrefs: 007721E0
H+{, xrefs: 00772184
TITLE, xrefs: 00772292
T+{, xrefs: 0077220E
HANDLE, xrefs: 007720E2
CLASS, xrefs: 00772128
L+{, xrefs: 007721B2
REGEXPCLASS, xrefs: 00772149
ALL, xrefs: 00772264
REGEXPTITLE, xrefs: 007720F8
LAST, xrefs: 007720B6
INSTANCE, xrefs: 0077223C
ACTIVE, xrefs: 007720CC

Memory Dump Source

Source File: 00000000.00000002.1281263787.0000000000701000.00000020.00000001.01000000.00000003.sdmp, Offset: 00700000, based on PE: true

Associated: 00000000.00000002.1281243473.0000000000700000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1281360671.000000000078D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1281360671.00000000007AE000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1281496264.00000000007BA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1281529307.00000000007C4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1281529307.00000000007C7000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1281529307.00000000007D5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1281529307.00000000007D7000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_700000_OC & PL.jbxd

Similarity

API ID: Window$Foreground
String ID: ACTIVE$ALL$CLASS$H+{$HANDLE$INSTANCE$L+{$LAST$P+{$REGEXPCLASS$REGEXPTITLE$T+{$TITLE
API String ID: 62970417-2990896003
Opcode ID: 295d5eace6fae1be6bf52561e20a1797b44d848dc7f08d3d65e4948d9c9abcec
Instruction ID: f82bd0afc83ab4f494364654bd0b4d8e4460b642ce260b39e37bb4d85613096b
Opcode Fuzzy Hash: 295d5eace6fae1be6bf52561e20a1797b44d848dc7f08d3d65e4948d9c9abcec
Instruction Fuzzy Hash: 7BD1B631108247DBCF14EF10C845AAABBB4BF54384F108A29F469575E3DB38E99BCB91

Function 0076764F Relevance: 37.0, APIs: 18, Strings: 3, Instructions: 290windowCOMMON

Download Yara Rule

APIs

GetCursorPos.USER32(?), ref: 0076778A
GetDesktopWindow.USER32 ref: 0076779F
GetWindowRect.USER32(00000000), ref: 007677A6
GetWindowLongW.USER32(?,000000F0), ref: 00767808
DestroyWindow.USER32(?), ref: 00767834
CreateWindowExW.USER32(00000008,tooltips_class32,00000000,00000003,80000000,80000000,80000000,80000000,00000000,00000000,00000000,00000000), ref: 0076785D
SendMessageW.USER32(00000000,00000432,00000000,00000030), ref: 0076787B
SendMessageW.USER32(?,00000439,00000000,00000030), ref: 007678A1
SendMessageW.USER32(?,00000421,?,?), ref: 007678B6
SendMessageW.USER32(?,0000041D,00000000,00000000), ref: 007678C9
IsWindowVisible.USER32(?), ref: 007678E9
SendMessageW.USER32(?,00000412,00000000,D8F0D8F0), ref: 00767904
SendMessageW.USER32(?,00000411,00000001,00000030), ref: 00767918
GetWindowRect.USER32(?,?), ref: 00767930
MonitorFromPoint.USER32(?,?,00000002), ref: 00767956
GetMonitorInfoW.USER32 ref: 00767970
CopyRect.USER32(?,?), ref: 00767987
SendMessageW.USER32(?,00000412,00000000), ref: 007679F2

Strings

tooltips_class32, xrefs: 00767856
(, xrefs: 00767965
0, xrefs: 00767735

Memory Dump Source

Source File: 00000000.00000002.1281263787.0000000000701000.00000020.00000001.01000000.00000003.sdmp, Offset: 00700000, based on PE: true

Associated: 00000000.00000002.1281243473.0000000000700000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1281360671.000000000078D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1281360671.00000000007AE000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1281496264.00000000007BA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1281529307.00000000007C4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1281529307.00000000007C7000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1281529307.00000000007D5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1281529307.00000000007D7000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_700000_OC & PL.jbxd

Similarity

API ID: MessageSendWindow$Rect$Monitor$CopyCreateCursorDesktopDestroyFromInfoLongPointVisible
String ID: ($0$tooltips_class32
API String ID: 698492251-4156429822
Opcode ID: b24a538e0f77d4650184379281e9c06cee416b508d245f43b1197575932135bf
Instruction ID: 630b6a2f51cf8def61949efe1ec249029a44a58e4f128bd31a3b47dbf49ae038
Opcode Fuzzy Hash: b24a538e0f77d4650184379281e9c06cee416b508d245f43b1197575932135bf
Instruction Fuzzy Hash: 35B17C71608301EFD714DF64C888B5ABBE5BF88354F008A1DF99A9B291D778EC04CB96

Function 00746CE9 Relevance: 36.9, APIs: 16, Strings: 5, Instructions: 178COMMON

Download Yara Rule

APIs

GetFileVersionInfoSizeW.VERSION(?,?), ref: 00746CFB
GetFileVersionInfoW.VERSION(?,00000000,00000000,00000000,?,?), ref: 00746D21
_wcscpy.LIBCMT ref: 00746D4F
_wcscmp.LIBCMT ref: 00746D5A
_wcscat.LIBCMT ref: 00746D70
_wcsstr.LIBCMT ref: 00746D7B
VerQueryValueW.VERSION(?,\VarFileInfo\Translation,?,?,?,?,?,?,00000000,?,?), ref: 00746D97
_wcscat.LIBCMT ref: 00746DE0
_wcscat.LIBCMT ref: 00746DE7
_wcsncpy.LIBCMT ref: 00746E12

Strings

DefaultLangCodepage, xrefs: 00746DFA
\VarFileInfo\Translation, xrefs: 00746D8F
StringFileInfo\, xrefs: 00746D6A
%u.%u.%u.%u, xrefs: 00746E75
04090000, xrefs: 00746DCD

Memory Dump Source

Source File: 00000000.00000002.1281263787.0000000000701000.00000020.00000001.01000000.00000003.sdmp, Offset: 00700000, based on PE: true

Associated: 00000000.00000002.1281243473.0000000000700000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1281360671.000000000078D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1281360671.00000000007AE000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1281496264.00000000007BA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1281529307.00000000007C4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1281529307.00000000007C7000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1281529307.00000000007D5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1281529307.00000000007D7000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_700000_OC & PL.jbxd

Similarity

API ID: _wcscat$FileInfoVersion$QuerySizeValue_wcscmp_wcscpy_wcsncpy_wcsstr
String ID: %u.%u.%u.%u$04090000$DefaultLangCodepage$StringFileInfo\$\VarFileInfo\Translation
API String ID: 699586101-1459072770
Opcode ID: 94e63e8bdd80624b7972020891f3c72d79662754a4a13a3da21250fa1a1b71d3
Instruction ID: d44f16789a3817f5d3a600c4f4a085f6f18b1791bb490f678d7a99af1d13436b
Opcode Fuzzy Hash: 94e63e8bdd80624b7972020891f3c72d79662754a4a13a3da21250fa1a1b71d3
Instruction Fuzzy Hash: F141C4B1A04210FBEB10AB64DC4BEFF77BCEF46710F144165F901A6182EB7C9A4196B6

Function 0071A856 Relevance: 33.5, APIs: 18, Strings: 1, Instructions: 285windowtimeCOMMON

Download Yara Rule

APIs

SystemParametersInfoW.USER32(00000030,00000000,000000FF,00000000), ref: 0071A939
GetSystemMetrics.USER32(00000007), ref: 0071A941
SystemParametersInfoW.USER32(00000030,00000000,000000FF,00000000), ref: 0071A96C
GetSystemMetrics.USER32(00000008), ref: 0071A974
GetSystemMetrics.USER32(00000004), ref: 0071A999
SetRect.USER32(000000FF,00000000,00000000,000000FF,000000FF), ref: 0071A9B6
AdjustWindowRectEx.USER32(000000FF,00000000,00000000,00000000), ref: 0071A9C6
CreateWindowExW.USER32(00000000,AutoIt v3 GUI,?,00000000,?,000000FF,000000FF,000000FF,?,00000000,00000000), ref: 0071A9F9
SetWindowLongW.USER32(00000000,000000EB,00000000), ref: 0071AA0D
GetClientRect.USER32(00000000,000000FF), ref: 0071AA2B
GetStockObject.GDI32(00000011), ref: 0071AA47
SendMessageW.USER32(00000000,00000030,00000000), ref: 0071AA52

Part of subcall function 0071B63C: GetCursorPos.USER32(000000FF), ref: 0071B64F
Part of subcall function 0071B63C: ScreenToClient.USER32(00000000,000000FF), ref: 0071B66C
Part of subcall function 0071B63C: GetAsyncKeyState.USER32(00000001), ref: 0071B691
Part of subcall function 0071B63C: GetAsyncKeyState.USER32(00000002), ref: 0071B69F

SetTimer.USER32(00000000,00000000,00000028,0071AB87), ref: 0071AA79

Strings

AutoIt v3 GUI, xrefs: 0071A9F1

Memory Dump Source

Source File: 00000000.00000002.1281263787.0000000000701000.00000020.00000001.01000000.00000003.sdmp, Offset: 00700000, based on PE: true

Associated: 00000000.00000002.1281243473.0000000000700000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1281360671.000000000078D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1281360671.00000000007AE000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1281496264.00000000007BA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1281529307.00000000007C4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1281529307.00000000007C7000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1281529307.00000000007D5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1281529307.00000000007D7000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_700000_OC & PL.jbxd

Similarity

API ID: System$MetricsRectWindow$AsyncClientInfoParametersState$AdjustCreateCursorLongMessageObjectScreenSendStockTimer
String ID: AutoIt v3 GUI
API String ID: 1458621304-248962490
Opcode ID: 62502f33fbe92c6313b4e9682feee6fce75b8f7496c479750d7ce4e79c0060d7
Instruction ID: 5d3466b28122df7917c061f0b4bdc48b756d1dc0af18320a7931a098e0e63b8d
Opcode Fuzzy Hash: 62502f33fbe92c6313b4e9682feee6fce75b8f7496c479750d7ce4e79c0060d7
Instruction Fuzzy Hash: 7BB13C7164120AEFDB24DFA8DC45BE97BB4FF08314F118229FA15A62D0DB78AC90CB55

Function 00763639 Relevance: 26.7, APIs: 9, Strings: 6, Instructions: 477registryCOMMON

Download Yara Rule

APIs

RegConnectRegistryW.ADVAPI32(?,?,?), ref: 00763735
RegCreateKeyExW.ADVAPI32(?,?,00000000,0079DC00,00000000,?,00000000,?,?), ref: 007637A3
RegCloseKey.ADVAPI32(00000000,00000001,00000000,00000000,00000000), ref: 007637EB
RegSetValueExW.ADVAPI32(00000001,?,00000000,00000002,?), ref: 00763874
RegCloseKey.ADVAPI32(?), ref: 00763B94
RegCloseKey.ADVAPI32(00000000), ref: 00763BA1

Strings

REG_BINARY, xrefs: 00763B2F
REG_QWORD, xrefs: 00763AE2
REG_MULTI_SZ, xrefs: 0076395C
REG_SZ, xrefs: 007638B2
REG_EXPAND_SZ, xrefs: 00763811
REG_DWORD, xrefs: 00763A65

Memory Dump Source

Source File: 00000000.00000002.1281263787.0000000000701000.00000020.00000001.01000000.00000003.sdmp, Offset: 00700000, based on PE: true

Associated: 00000000.00000002.1281243473.0000000000700000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1281360671.000000000078D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1281360671.00000000007AE000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1281496264.00000000007BA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1281529307.00000000007C4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1281529307.00000000007C7000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1281529307.00000000007D5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1281529307.00000000007D7000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_700000_OC & PL.jbxd

Similarity

API ID: Close$ConnectCreateRegistryValue
String ID: REG_BINARY$REG_DWORD$REG_EXPAND_SZ$REG_MULTI_SZ$REG_QWORD$REG_SZ
API String ID: 536824911-966354055
Opcode ID: bdf6721c1b5081914890296468ecbc4779e47840fc35631ea39da3ce9acfade8
Instruction ID: dc3202fe253de9178aa15fe4dffb8d273b654ffff8931babaaeedee010cb1cc3
Opcode Fuzzy Hash: bdf6721c1b5081914890296468ecbc4779e47840fc35631ea39da3ce9acfade8
Instruction Fuzzy Hash: 7A026A75200601DFCB14EF14C899A2AB7E5FF88720F05855DF98A9B3A2DB38ED41CB95

Function 00766BC9 Relevance: 26.5, APIs: 2, Strings: 13, Instructions: 281windowCOMMON

Download Yara Rule

APIs

CharUpperBuffW.USER32(?,?), ref: 00766C56
SendMessageW.USER32(?,00001032,00000000,00000000), ref: 00766D16

Strings

SELECT, xrefs: 00766DA8
DESELECT, xrefs: 00766DFC
GETSELECTEDCOUNT, xrefs: 00766CF9
VIEWCHANGE, xrefs: 00766ECD
SELECTINVERT, xrefs: 00766DDE
GETSUBITEMCOUNT, xrefs: 00766CA1
SELECTCLEAR, xrefs: 00766D8D
SELECTALL, xrefs: 00766D75
GETITEMCOUNT, xrefs: 00766C84
FINDITEM, xrefs: 00766E81
GETSELECTED, xrefs: 00766E3C
ISSELECTED, xrefs: 00766D21
GETTEXT, xrefs: 00766CBF

Memory Dump Source

Source File: 00000000.00000002.1281263787.0000000000701000.00000020.00000001.01000000.00000003.sdmp, Offset: 00700000, based on PE: true

Associated: 00000000.00000002.1281243473.0000000000700000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1281360671.000000000078D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1281360671.00000000007AE000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1281496264.00000000007BA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1281529307.00000000007C4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1281529307.00000000007C7000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1281529307.00000000007D5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1281529307.00000000007D7000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_700000_OC & PL.jbxd

Similarity

API ID: BuffCharMessageSendUpper
String ID: DESELECT$FINDITEM$GETITEMCOUNT$GETSELECTED$GETSELECTEDCOUNT$GETSUBITEMCOUNT$GETTEXT$ISSELECTED$SELECT$SELECTALL$SELECTCLEAR$SELECTINVERT$VIEWCHANGE
API String ID: 3974292440-719923060
Opcode ID: 54d00c300f9ef739a47f1ddd57033138ff65ad965752f21075228e230eee5698
Instruction ID: 4b483c341931d89914dc2018d92c87b383bea0692cd7187bacbc850fae0b2a58
Opcode Fuzzy Hash: 54d00c300f9ef739a47f1ddd57033138ff65ad965752f21075228e230eee5698
Instruction Fuzzy Hash: 4EA17D70204342DBCB14EF24C855AAAB3A6BF84310F50496DBD969B3D2DB39EC46CB91

Function 0073CF50 Relevance: 26.5, APIs: 14, Strings: 1, Instructions: 273windowtimeCOMMON

Download Yara Rule

APIs

GetClassNameW.USER32(?,?,00000100), ref: 0073CF91
__swprintf.LIBCMT ref: 0073D032
_wcscmp.LIBCMT ref: 0073D045
SendMessageTimeoutW.USER32(?,?,00000101,00000000,00000002,00001388,?), ref: 0073D09A
_wcscmp.LIBCMT ref: 0073D0D6
GetClassNameW.USER32(?,?,00000400), ref: 0073D10D
GetDlgCtrlID.USER32(?), ref: 0073D15F
GetWindowRect.USER32(?,?), ref: 0073D195
GetParent.USER32(?), ref: 0073D1B3
ScreenToClient.USER32(00000000), ref: 0073D1BA
GetClassNameW.USER32(?,?,00000100), ref: 0073D234
_wcscmp.LIBCMT ref: 0073D248
GetWindowTextW.USER32(?,?,00000400), ref: 0073D26E
_wcscmp.LIBCMT ref: 0073D282

Strings

%s%u, xrefs: 0073D02C

Memory Dump Source

Source File: 00000000.00000002.1281263787.0000000000701000.00000020.00000001.01000000.00000003.sdmp, Offset: 00700000, based on PE: true

Associated: 00000000.00000002.1281243473.0000000000700000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1281360671.000000000078D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1281360671.00000000007AE000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1281496264.00000000007BA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1281529307.00000000007C4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1281529307.00000000007C7000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1281529307.00000000007D5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1281529307.00000000007D7000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_700000_OC & PL.jbxd

Similarity

API ID: _wcscmp$ClassName$Window$ClientCtrlMessageParentRectScreenSendTextTimeout__swprintf
String ID: %s%u
API String ID: 3119225716-679674701
Opcode ID: e7954146875fc501cb22df3855c39b77ee95f4296aae30f6ceb743bf17129696
Instruction ID: 084d7402cd0211cdc4ef4de54a940d4599253688ab670ab67b80bd881f8c6e02
Opcode Fuzzy Hash: e7954146875fc501cb22df3855c39b77ee95f4296aae30f6ceb743bf17129696
Instruction Fuzzy Hash: 24A1E171604306AFE725DF64D884FAAB7A8FF44350F008619F999D3182EB38EE05CB91

Function 0073D8A7 Relevance: 26.5, APIs: 13, Strings: 2, Instructions: 249COMMON

Download Yara Rule

APIs

GetClassNameW.USER32(00000008,?,00000400), ref: 0073D8EB
_wcscmp.LIBCMT ref: 0073D8FC
GetWindowTextW.USER32(00000001,?,00000400), ref: 0073D924
CharUpperBuffW.USER32(?,00000000), ref: 0073D941
_wcscmp.LIBCMT ref: 0073D95F
_wcsstr.LIBCMT ref: 0073D970
GetClassNameW.USER32(00000018,?,00000400), ref: 0073D9A8
_wcscmp.LIBCMT ref: 0073D9B8
GetWindowTextW.USER32(00000002,?,00000400), ref: 0073D9DF
GetClassNameW.USER32(00000018,?,00000400), ref: 0073DA28
_wcscmp.LIBCMT ref: 0073DA38
GetClassNameW.USER32(00000010,?,00000400), ref: 0073DA60
GetWindowRect.USER32(00000004,?), ref: 0073DAC9

Strings

@, xrefs: 0073D8C6
ThumbnailClass, xrefs: 0073D9B3, 0073DA33

Memory Dump Source

Source File: 00000000.00000002.1281263787.0000000000701000.00000020.00000001.01000000.00000003.sdmp, Offset: 00700000, based on PE: true

Associated: 00000000.00000002.1281243473.0000000000700000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1281360671.000000000078D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1281360671.00000000007AE000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1281496264.00000000007BA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1281529307.00000000007C4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1281529307.00000000007C7000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1281529307.00000000007D5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1281529307.00000000007D7000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_700000_OC & PL.jbxd

Similarity

API ID: ClassName_wcscmp$Window$Text$BuffCharRectUpper_wcsstr
String ID: @$ThumbnailClass
API String ID: 1788623398-1539354611
Opcode ID: be2fa6f76d96e4eda087d9a8826e67b9061df7218eed8f2cf3f18fa50b011b12
Instruction ID: aba4ae1f62927b4ca4798996590680b0d522b24a96dda7abcd9f9a3f7ab2aec7
Opcode Fuzzy Hash: be2fa6f76d96e4eda087d9a8826e67b9061df7218eed8f2cf3f18fa50b011b12
Instruction Fuzzy Hash: FD81C0710083459BEB21CF50E985FAA7BE8FF44314F04846AFD899A097DB38ED45CBA1

Function 0073D6F4 Relevance: 26.4, APIs: 3, Strings: 12, Instructions: 104COMMON

Download Yara Rule

APIs

__wcsnicmp.LIBCMT ref: 0073D753

Strings

[CLASS:, xrefs: 0073D7A3
REGEXP=, xrefs: 0073D768
[ALL, xrefs: 0073D7F9
[HANDLE:, xrefs: 0073D75F
HANDLE=, xrefs: 0073D74C
ALL, xrefs: 0073D7E7
LAST, xrefs: 0073D718
[ACTIVE, xrefs: 0073D740
ACTIVE, xrefs: 0073D72E
[LAST, xrefs: 0073D800
[REGEXPTITLE:, xrefs: 0073D77B
CLASSNAME=, xrefs: 0073D790

Memory Dump Source

Source File: 00000000.00000002.1281263787.0000000000701000.00000020.00000001.01000000.00000003.sdmp, Offset: 00700000, based on PE: true

Associated: 00000000.00000002.1281243473.0000000000700000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1281360671.000000000078D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1281360671.00000000007AE000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1281496264.00000000007BA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1281529307.00000000007C4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1281529307.00000000007C7000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1281529307.00000000007D5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1281529307.00000000007D7000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_700000_OC & PL.jbxd

Similarity

API ID: __wcsnicmp
String ID: ACTIVE$ALL$CLASSNAME=$HANDLE=$LAST$REGEXP=$[ACTIVE$[ALL$[CLASS:$[HANDLE:$[LAST$[REGEXPTITLE:
API String ID: 1038674560-1810252412
Opcode ID: 34927d6983c25e23373ce7e280ae8f88891c2bb62f9ecb05eacaca3b7f1ce5be
Instruction ID: cea750a6ba1dd0676f281cf9aa7168b6b97b8dd263784fa2bbede18df5ef6ad9
Opcode Fuzzy Hash: 34927d6983c25e23373ce7e280ae8f88891c2bb62f9ecb05eacaca3b7f1ce5be
Instruction Fuzzy Hash: 75316FB1645205E6EB24FB50ED57FEEB3A5AF20710F200629F441710D3FF6DAE158662

Function 0073EA9D Relevance: 25.7, APIs: 17, Instructions: 168windowtimeCOMMON

Download Yara Rule

APIs

LoadIconW.USER32(00000063), ref: 0073EAB0
SendMessageW.USER32(?,00000080,00000000,00000000), ref: 0073EAC2
SetWindowTextW.USER32(?,?), ref: 0073EAD9
GetDlgItem.USER32(?,000003EA), ref: 0073EAEE
SetWindowTextW.USER32(00000000,?), ref: 0073EAF4
GetDlgItem.USER32(?,000003E9), ref: 0073EB04
SetWindowTextW.USER32(00000000,?), ref: 0073EB0A
SendDlgItemMessageW.USER32(?,000003E9,000000CC,?,00000000), ref: 0073EB2B
SendDlgItemMessageW.USER32(?,000003E9,000000C5,00000000,00000000), ref: 0073EB45
GetWindowRect.USER32(?,?), ref: 0073EB4E
SetWindowTextW.USER32(?,?), ref: 0073EBB9
GetDesktopWindow.USER32 ref: 0073EBBF
GetWindowRect.USER32(00000000), ref: 0073EBC6
MoveWindow.USER32(?,?,?,?,00000000,00000000), ref: 0073EC12
GetClientRect.USER32(?,?), ref: 0073EC1F
PostMessageW.USER32(?,00000005,00000000,00000000), ref: 0073EC44
SetTimer.USER32(?,0000040A,00000000,00000000), ref: 0073EC6F

Memory Dump Source

Source File: 00000000.00000002.1281263787.0000000000701000.00000020.00000001.01000000.00000003.sdmp, Offset: 00700000, based on PE: true

Associated: 00000000.00000002.1281243473.0000000000700000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1281360671.000000000078D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1281360671.00000000007AE000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1281496264.00000000007BA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1281529307.00000000007C4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1281529307.00000000007C7000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1281529307.00000000007D5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1281529307.00000000007D7000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_700000_OC & PL.jbxd

Similarity

API ID: Window$ItemMessageText$RectSend$ClientDesktopIconLoadMovePostTimer
String ID:
API String ID: 3869813825-0
Opcode ID: 4c52b06bdf381c2e3b97fdcbc501392e9e0553e9fb239d04121bc78e08ea5ed3
Instruction ID: 3bbf24e97fce5f75c233ea18d81fe8ee0d75b0fcce5d4b44ddccf289a8489903
Opcode Fuzzy Hash: 4c52b06bdf381c2e3b97fdcbc501392e9e0553e9fb239d04121bc78e08ea5ed3
Instruction Fuzzy Hash: 14512C71900709EFEB219FA8CD89E6EBBB5FF04704F108928E586A25E1D778AD44CB14

Function 007579B0 Relevance: 25.6, APIs: 17, Instructions: 109COMMON

Download Yara Rule

APIs

LoadCursorW.USER32(00000000,00007F8A), ref: 007579C6
LoadCursorW.USER32(00000000,00007F00), ref: 007579D1
LoadCursorW.USER32(00000000,00007F03), ref: 007579DC
LoadCursorW.USER32(00000000,00007F8B), ref: 007579E7
LoadCursorW.USER32(00000000,00007F01), ref: 007579F2
LoadCursorW.USER32(00000000,00007F81), ref: 007579FD
LoadCursorW.USER32(00000000,00007F88), ref: 00757A08
LoadCursorW.USER32(00000000,00007F80), ref: 00757A13
LoadCursorW.USER32(00000000,00007F86), ref: 00757A1E
LoadCursorW.USER32(00000000,00007F83), ref: 00757A29
LoadCursorW.USER32(00000000,00007F85), ref: 00757A34
LoadCursorW.USER32(00000000,00007F82), ref: 00757A3F
LoadCursorW.USER32(00000000,00007F84), ref: 00757A4A
LoadCursorW.USER32(00000000,00007F04), ref: 00757A55
LoadCursorW.USER32(00000000,00007F02), ref: 00757A60
LoadCursorW.USER32(00000000,00007F89), ref: 00757A6B
GetCursorInfo.USER32(?), ref: 00757A7B

Memory Dump Source

Source File: 00000000.00000002.1281263787.0000000000701000.00000020.00000001.01000000.00000003.sdmp, Offset: 00700000, based on PE: true

Associated: 00000000.00000002.1281243473.0000000000700000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1281360671.000000000078D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1281360671.00000000007AE000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1281496264.00000000007BA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1281529307.00000000007C4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1281529307.00000000007C7000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1281529307.00000000007D5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1281529307.00000000007D7000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_700000_OC & PL.jbxd

Similarity

API ID: Cursor$Load$Info
String ID:
API String ID: 2577412497-0
Opcode ID: 552d8d1a93f193f146c2cd738597c486709dedeb8cc78ba2328cea695caeb3ac
Instruction ID: 509cf88d54989b2d918c30f9d791ffc3cbbb91ff9857371b6050b356ad07b776
Opcode Fuzzy Hash: 552d8d1a93f193f146c2cd738597c486709dedeb8cc78ba2328cea695caeb3ac
Instruction Fuzzy Hash: 103129B0D48319AADB109FBA9C8999FBFE8FF04750F504526E50DE7280DA7CA504CFA1

Function 0070C833 Relevance: 25.0, APIs: 7, Strings: 7, Instructions: 479COMMON

Download Yara Rule

APIs

Part of subcall function 0071E968: GetCurrentDirectoryW.KERNEL32(00007FFF,?,?,?,0070C8B7,?,00002000,?,?,00000000,?,0070419E,?,?,?,0079DC00), ref: 0071E984

Part of subcall function 0070660F: GetFullPathNameW.KERNEL32(?,00007FFF,?,00000000,?,?,007053B1,?,?,007061FF,?,00000000,00000001,00000000), ref: 0070662F

__wsplitpath.LIBCMT ref: 0070C93E

Part of subcall function 00721DFC: __wsplitpath_helper.LIBCMT ref: 00721E3C

_wcscpy.LIBCMT ref: 0070C953
_wcscat.LIBCMT ref: 0070C968
SetCurrentDirectoryW.KERNEL32(?,?,?,?,?,?,00000001,?,?,00000000), ref: 0070C978
SetCurrentDirectoryW.KERNEL32(?), ref: 0070CABE

Part of subcall function 0070B337: _wcscpy.LIBCMT ref: 0070B36F

Strings

Error opening the file, xrefs: 007730B4, 0077313D
Bad directive syntax error, xrefs: 00773429
AU3!, xrefs: 0070C90C
#include depth exceeded. Make sure there are no recursive includes, xrefs: 00773098
EA06, xrefs: 007730C9
>>>AUTOIT SCRIPT<<<, xrefs: 0077311B
Unterminated string, xrefs: 00773470

Memory Dump Source

Source File: 00000000.00000002.1281263787.0000000000701000.00000020.00000001.01000000.00000003.sdmp, Offset: 00700000, based on PE: true

Associated: 00000000.00000002.1281243473.0000000000700000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1281360671.000000000078D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1281360671.00000000007AE000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1281496264.00000000007BA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1281529307.00000000007C4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1281529307.00000000007C7000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1281529307.00000000007D5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1281529307.00000000007D7000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_700000_OC & PL.jbxd

Similarity

API ID: CurrentDirectory$_wcscpy$FullNamePath__wsplitpath__wsplitpath_helper_wcscat
String ID: #include depth exceeded. Make sure there are no recursive includes$>>>AUTOIT SCRIPT<<<$AU3!$Bad directive syntax error$EA06$Error opening the file$Unterminated string
API String ID: 2258743419-1018226102
Opcode ID: edcf002d0d21ef9cc2f5eced6091d96fd3c03a8c2bf9ddadac91ed4a84093e8d
Instruction ID: 5e9ad0728b52d23033a2a17066815f00029be427bd4799e11c5a6051b2951968
Opcode Fuzzy Hash: edcf002d0d21ef9cc2f5eced6091d96fd3c03a8c2bf9ddadac91ed4a84093e8d
Instruction Fuzzy Hash: 3F12B2B1508341DFC725EF24C885AAFBBE5BF98340F404A1DF58993292DB38DA49DB52

Function 0076CE58 Relevance: 24.7, APIs: 12, Strings: 2, Instructions: 205windowCOMMON

Download Yara Rule

APIs

_memset.LIBCMT ref: 0076CEFB
DestroyWindow.USER32(?,?), ref: 0076CF73
CreateWindowExW.USER32(00000008,tooltips_class32,00000000,?,80000000,80000000,80000000,80000000,?,00000000,00000000,?), ref: 0076CFF4
SendMessageW.USER32(00000000,00000433,00000000,00000030), ref: 0076D016
SendMessageW.USER32(00000000,00000432,00000000,00000030), ref: 0076D025
DestroyWindow.USER32(?), ref: 0076D042
CreateWindowExW.USER32(00000008,tooltips_class32,00000000,?,80000000,80000000,80000000,80000000,?,00000000,00700000,00000000), ref: 0076D075
SendMessageW.USER32(00000000,00000432,00000000,00000030), ref: 0076D094
GetDesktopWindow.USER32 ref: 0076D0A9
GetWindowRect.USER32(00000000), ref: 0076D0B0
SendMessageW.USER32(00000000,00000418,00000000,?), ref: 0076D0C2
SendMessageW.USER32(00000000,00000421,?,00000000), ref: 0076D0DA

Part of subcall function 0071B526: GetWindowLongW.USER32(?,000000EB), ref: 0071B537

Strings

tooltips_class32, xrefs: 0076CFED, 0076D06E
0, xrefs: 0076CF1B

Memory Dump Source

Source File: 00000000.00000002.1281263787.0000000000701000.00000020.00000001.01000000.00000003.sdmp, Offset: 00700000, based on PE: true

Associated: 00000000.00000002.1281243473.0000000000700000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1281360671.000000000078D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1281360671.00000000007AE000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1281496264.00000000007BA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1281529307.00000000007C4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1281529307.00000000007C7000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1281529307.00000000007D5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1281529307.00000000007D7000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_700000_OC & PL.jbxd

Similarity

API ID: Window$MessageSend$CreateDestroy$DesktopLongRect_memset
String ID: 0$tooltips_class32
API String ID: 3877571568-3619404913
Opcode ID: 7b008182d318df9bf1e01d3c309b00c279795e52e3d9cf5351ad0e886d3d5c29
Instruction ID: 9d9bcdc79d652da14eab956e9ba308c8c49454f013f0ff6108ad06ae0c98bb3f
Opcode Fuzzy Hash: 7b008182d318df9bf1e01d3c309b00c279795e52e3d9cf5351ad0e886d3d5c29
Instruction Fuzzy Hash: 0671DFB0650309AFD720CF28CC84FA677E5EB89704F54851DF986972A1DB78EC42CB66

Function 0076F351 Relevance: 24.7, APIs: 11, Strings: 3, Instructions: 178windowfileCOMMON

Download Yara Rule

APIs

Part of subcall function 0071B34E: GetWindowLongW.USER32(?,000000EB), ref: 0071B35F

DragQueryPoint.SHELL32(?,?), ref: 0076F37A

Part of subcall function 0076D7DE: ClientToScreen.USER32(?,?), ref: 0076D807
Part of subcall function 0076D7DE: GetWindowRect.USER32(?,?), ref: 0076D87D
Part of subcall function 0076D7DE: PtInRect.USER32(?,?,0076ED5A), ref: 0076D88D

SendMessageW.USER32(?,000000B0,?,?), ref: 0076F3E3
DragQueryFileW.SHELL32(?,000000FF,00000000,00000000), ref: 0076F3EE
DragQueryFileW.SHELL32(?,00000000,?,00000104), ref: 0076F411
_wcscat.LIBCMT ref: 0076F441
SendMessageW.USER32(?,000000C2,00000001,?), ref: 0076F458
SendMessageW.USER32(?,000000B0,?,?), ref: 0076F471
SendMessageW.USER32(?,000000B1,?,?), ref: 0076F488
SendMessageW.USER32(?,000000B1,?,?), ref: 0076F4AA
DragFinish.SHELL32(?), ref: 0076F4B1
DefDlgProcW.USER32(?,00000233,?,00000000,?,?,?), ref: 0076F59C

Strings

@GUI_DRAGFILE, xrefs: 0076F54B
@GUI_DROPID, xrefs: 0076F4D1
@GUI_DRAGID, xrefs: 0076F510

Memory Dump Source

Source File: 00000000.00000002.1281263787.0000000000701000.00000020.00000001.01000000.00000003.sdmp, Offset: 00700000, based on PE: true

Associated: 00000000.00000002.1281243473.0000000000700000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1281360671.000000000078D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1281360671.00000000007AE000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1281496264.00000000007BA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1281529307.00000000007C4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1281529307.00000000007C7000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1281529307.00000000007D5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1281529307.00000000007D7000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_700000_OC & PL.jbxd

Similarity

API ID: MessageSend$Drag$Query$FileRectWindow$ClientFinishLongPointProcScreen_wcscat
String ID: @GUI_DRAGFILE$@GUI_DRAGID$@GUI_DROPID
API String ID: 169749273-3440237614
Opcode ID: 372ab515bae8429951865f4bca1451ad9d625655070454b98ba9d6cefc07dc65
Instruction ID: 008865a5ff9fe7e22b3c6cc7eab34419c3db52fca11e443495a14dddb1dac1d9
Opcode Fuzzy Hash: 372ab515bae8429951865f4bca1451ad9d625655070454b98ba9d6cefc07dc65
Instruction Fuzzy Hash: 0A615C71108304EFC311EF64DC49E9BBBE8EF89750F104A1EF995921A2DB399A19CB52

Function 0074AAF8 Relevance: 23.1, APIs: 11, Strings: 2, Instructions: 374timeCOMMON

Download Yara Rule

APIs

VariantInit.OLEAUT32(00000000), ref: 0074AB3D
VariantCopy.OLEAUT32(?,?), ref: 0074AB46
VariantClear.OLEAUT32(?), ref: 0074AB52
VariantTimeToSystemTime.OLEAUT32(?,?,?), ref: 0074AC40
__swprintf.LIBCMT ref: 0074AC70
VarR8FromDec.OLEAUT32(?,?), ref: 0074AC9C
VariantInit.OLEAUT32(?), ref: 0074AD4D
SysFreeString.OLEAUT32(00000016), ref: 0074ADDF
VariantClear.OLEAUT32(?), ref: 0074AE35
VariantClear.OLEAUT32(?), ref: 0074AE44
VariantInit.OLEAUT32(00000000), ref: 0074AE80

Strings

Default, xrefs: 0074ACFD
%4d%02d%02d%02d%02d%02d, xrefs: 0074AC6A

Memory Dump Source

Source File: 00000000.00000002.1281263787.0000000000701000.00000020.00000001.01000000.00000003.sdmp, Offset: 00700000, based on PE: true

Associated: 00000000.00000002.1281243473.0000000000700000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1281360671.000000000078D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1281360671.00000000007AE000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1281496264.00000000007BA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1281529307.00000000007C4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1281529307.00000000007C7000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1281529307.00000000007D5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1281529307.00000000007D7000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_700000_OC & PL.jbxd

Similarity

API ID: Variant$ClearInit$Time$CopyFreeFromStringSystem__swprintf
String ID: %4d%02d%02d%02d%02d%02d$Default
API String ID: 3730832054-3931177956
Opcode ID: 3646bef9d272b2d1041406a113acc70b083c7f59333d41d9bec3e199e13b1912
Instruction ID: 7ff36ef9a1f2a99b19f0da5b9a4969b80c616b24a1c4f031edc847a83ee94f7b
Opcode Fuzzy Hash: 3646bef9d272b2d1041406a113acc70b083c7f59333d41d9bec3e199e13b1912
Instruction Fuzzy Hash: 91D1EFB1A80215FBDB209F65C889BAEB7B5FF04700F248155E8059B181DB7CEC41DBA3

Function 0076716A Relevance: 23.0, APIs: 2, Strings: 11, Instructions: 244windowCOMMON

Download Yara Rule

APIs

CharUpperBuffW.USER32(?,?), ref: 007671FC
SendMessageW.USER32(?,00001105,00000000,00000000), ref: 00767247

Strings

SELECT, xrefs: 007673E0
GETITEMCOUNT, xrefs: 00767311
COLLAPSE, xrefs: 0076728D
EXISTS, xrefs: 007672B0
UNCHECK, xrefs: 0076740B
ISCHECKED, xrefs: 007673B2
GETTOTALCOUNT, xrefs: 0076722A
GETSELECTED, xrefs: 0076733F
EXPAND, xrefs: 007672E1
GETTEXT, xrefs: 00767382
CHECK, xrefs: 00767267

Memory Dump Source

Source File: 00000000.00000002.1281263787.0000000000701000.00000020.00000001.01000000.00000003.sdmp, Offset: 00700000, based on PE: true

Associated: 00000000.00000002.1281243473.0000000000700000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1281360671.000000000078D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1281360671.00000000007AE000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1281496264.00000000007BA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1281529307.00000000007C4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1281529307.00000000007C7000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1281529307.00000000007D5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1281529307.00000000007D7000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_700000_OC & PL.jbxd

Similarity

API ID: BuffCharMessageSendUpper
String ID: CHECK$COLLAPSE$EXISTS$EXPAND$GETITEMCOUNT$GETSELECTED$GETTEXT$GETTOTALCOUNT$ISCHECKED$SELECT$UNCHECK
API String ID: 3974292440-4258414348
Opcode ID: fd2909e3fa6d6538eceffdfb73ab4082a4b568da02d6a8b4951175c47b9b9426
Instruction ID: 22751e3dcd2545ef2fccc1dc835874a20e3c40abcca9254e75cd9880c3a9b2c1
Opcode Fuzzy Hash: fd2909e3fa6d6538eceffdfb73ab4082a4b568da02d6a8b4951175c47b9b9426
Instruction Fuzzy Hash: 2B916E70204241CBCB09EF14C855AAEB7A1BF54354F008969FD966B3E3DB38ED4ACB91

Function 0073CB82 Relevance: 23.0, APIs: 2, Strings: 11, Instructions: 239COMMON

Download Yara Rule

APIs

EnumChildWindows.USER32(?,0073CF50), ref: 0073CE90

Strings

TEXT, xrefs: 0073CDC7
P+{, xrefs: 0073CD43
NAME, xrefs: 0073CCC2
CLASS, xrefs: 0073CC10
REGEXPCLASS, xrefs: 0073CC56
CLASSNN, xrefs: 0073CC33
T+{, xrefs: 0073CD72
H+{, xrefs: 0073CCE8
INSTANCE, xrefs: 0073CD9E
L+{, xrefs: 0073CD14
4+{, xrefs: 0073CC96

Memory Dump Source

Source File: 00000000.00000002.1281263787.0000000000701000.00000020.00000001.01000000.00000003.sdmp, Offset: 00700000, based on PE: true

Associated: 00000000.00000002.1281243473.0000000000700000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1281360671.000000000078D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1281360671.00000000007AE000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1281496264.00000000007BA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1281529307.00000000007C4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1281529307.00000000007C7000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1281529307.00000000007D5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1281529307.00000000007D7000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_700000_OC & PL.jbxd

Similarity

API ID: ChildEnumWindows
String ID: 4+{$CLASS$CLASSNN$H+{$INSTANCE$L+{$NAME$P+{$REGEXPCLASS$T+{$TEXT
API String ID: 3555792229-2973363509
Opcode ID: 10ffec023745ee1ad38aa42f5fe4f4921a96f6b8e3474f31430e70c99b5fa810
Instruction ID: 6048c72f8507b66a06c1d5a0552af858a10f5709e7ee4a3f2a51149b9ed4b77c
Opcode Fuzzy Hash: 10ffec023745ee1ad38aa42f5fe4f4921a96f6b8e3474f31430e70c99b5fa810
Instruction Fuzzy Hash: FB91C871600206DBEB19EF60C485BEEFB75BF04300F548525E859B7192DF38699AC7E0

Function 0076E4F5 Relevance: 22.9, APIs: 10, Strings: 3, Instructions: 199windowlibraryCOMMON

Download Yara Rule

APIs

LoadImageW.USER32(00000000,?,00000001,?,?,00002010), ref: 0076E5AB
LoadLibraryExW.KERNEL32(?,00000000,00000032,00000000,?,?,?,?,?,0076BEAF), ref: 0076E607
LoadImageW.USER32(?,?,00000001,?,?,00000000), ref: 0076E647
LoadImageW.USER32(?,?,00000001,?,?,00000000), ref: 0076E68C
LoadImageW.USER32(?,?,00000001,?,?,00000000), ref: 0076E6C3
FreeLibrary.KERNEL32(?,00000004,?,?,?,?,0076BEAF), ref: 0076E6CF
ExtractIconExW.SHELL32(?,00000000,00000000,00000000,00000001), ref: 0076E6DF
DestroyIcon.USER32(?,?,?,?,?,0076BEAF), ref: 0076E6EE
SendMessageW.USER32(?,00000170,00000000,00000000), ref: 0076E70B
SendMessageW.USER32(?,00000064,00000172,00000001), ref: 0076E717

Part of subcall function 00720FA7: __wcsicmp_l.LIBCMT ref: 00721030

Strings

.icl, xrefs: 0076E521
.dll, xrefs: 0076E564
.exe, xrefs: 0076E541

Memory Dump Source

Source File: 00000000.00000002.1281263787.0000000000701000.00000020.00000001.01000000.00000003.sdmp, Offset: 00700000, based on PE: true

Associated: 00000000.00000002.1281243473.0000000000700000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1281360671.000000000078D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1281360671.00000000007AE000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1281496264.00000000007BA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1281529307.00000000007C4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1281529307.00000000007C7000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1281529307.00000000007D5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1281529307.00000000007D7000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_700000_OC & PL.jbxd

Similarity

API ID: Load$Image$IconLibraryMessageSend$DestroyExtractFree__wcsicmp_l
String ID: .dll$.exe$.icl
API String ID: 1212759294-1154884017
Opcode ID: bb2900ff43619f9827f5eeaa76dffe1d4edee9b16327479da5aa4509eb0e8ed2
Instruction ID: 9d9c914fa9b739f6ff2b03bb4c4b403c82cfc52b2b67c8ed67578d60ed34c76c
Opcode Fuzzy Hash: bb2900ff43619f9827f5eeaa76dffe1d4edee9b16327479da5aa4509eb0e8ed2
Instruction Fuzzy Hash: 65619FB1540215FAEB24DF64DC46FEE77A8BB18724F208205F916D61D2EB789D90CBB0

Function 0074D219 Relevance: 22.9, APIs: 5, Strings: 8, Instructions: 138COMMON

Download Yara Rule

APIs

Part of subcall function 0070936C: __swprintf.LIBCMT ref: 007093AB
Part of subcall function 0070936C: __itow.LIBCMT ref: 007093DF

CharLowerBuffW.USER32(?,?), ref: 0074D292
GetDriveTypeW.KERNEL32 ref: 0074D2DF
mciSendStringW.WINMM(?,00000000,00000000,00000000), ref: 0074D327
mciSendStringW.WINMM(?,00000000,00000000,00000000), ref: 0074D35E
mciSendStringW.WINMM(?,00000000,00000000,00000000), ref: 0074D38C

Strings

closed, xrefs: 0074D2A6, 0074D2AF
close, xrefs: 0074D298
open , xrefs: 0074D2EE
open, xrefs: 0074D2B9
wait, xrefs: 0074D349
set cd door , xrefs: 0074D32D
close cd wait, xrefs: 0074D377
type cdaudio alias cd wait, xrefs: 0074D30A

Memory Dump Source

Source File: 00000000.00000002.1281263787.0000000000701000.00000020.00000001.01000000.00000003.sdmp, Offset: 00700000, based on PE: true

Associated: 00000000.00000002.1281243473.0000000000700000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1281360671.000000000078D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1281360671.00000000007AE000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1281496264.00000000007BA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1281529307.00000000007C4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1281529307.00000000007C7000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1281529307.00000000007D5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1281529307.00000000007D7000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_700000_OC & PL.jbxd

Similarity

API ID: SendString$BuffCharDriveLowerType__itow__swprintf
String ID: type cdaudio alias cd wait$ wait$close$close cd wait$closed$open$open $set cd door
API String ID: 1148790751-4113822522
Opcode ID: 164ae28daa08b52b753ce15833665600c1b523a69f9781a61d7f7fce38f180b3
Instruction ID: b06cc362a0dacdea713e19958cee36eff0403489f50caf35688e6aa622000120
Opcode Fuzzy Hash: 164ae28daa08b52b753ce15833665600c1b523a69f9781a61d7f7fce38f180b3
Instruction Fuzzy Hash: F0515CB1104305DFC700EF14C8959AAB3E8FF88714F10896DF89567291DB39EE46CB92

Function 007426BC Relevance: 22.9, APIs: 8, Strings: 5, Instructions: 137windowCOMMON

Download Yara Rule

APIs

GetModuleHandleW.KERNEL32(00000000,?,00000FFF,00000016,00000000,?,?,00773973,00000016,0000138C,00000016,?,00000016,0079DDB4,00000000,?), ref: 007426F1
LoadStringW.USER32(00000000,?,00773973,00000016), ref: 007426FA
GetModuleHandleW.KERNEL32(00000000,00000016,?,00000FFF,?,?,00773973,00000016,0000138C,00000016,?,00000016,0079DDB4,00000000,?,00000016), ref: 0074271C
LoadStringW.USER32(00000000,?,00773973,00000016), ref: 0074271F
__swprintf.LIBCMT ref: 0074276F
__swprintf.LIBCMT ref: 00742780
_wprintf.LIBCMT ref: 00742829
MessageBoxW.USER32(00000000,?,?,00011010), ref: 00742840

Strings

%s (%d) : ==> %s: %s %s, xrefs: 00742824
^ ERROR, xrefs: 007427D5
Line %d (File "%s"):, xrefs: 00742769
Line %d:, xrefs: 0074277A
Error: , xrefs: 007427F7

Memory Dump Source

Source File: 00000000.00000002.1281263787.0000000000701000.00000020.00000001.01000000.00000003.sdmp, Offset: 00700000, based on PE: true

Associated: 00000000.00000002.1281243473.0000000000700000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1281360671.000000000078D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1281360671.00000000007AE000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1281496264.00000000007BA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1281529307.00000000007C4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1281529307.00000000007C7000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1281529307.00000000007D5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1281529307.00000000007D7000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_700000_OC & PL.jbxd

Similarity

API ID: HandleLoadModuleString__swprintf$Message_wprintf
String ID: Error: $%s (%d) : ==> %s: %s %s$Line %d (File "%s"):$Line %d:$^ ERROR
API String ID: 618562835-2268648507
Opcode ID: bd82b1bab94de296b2cc5d0090818dd39b0b3f239adced82cf4d8e107e286db1
Instruction ID: 0a57f62963218e3de7c3a50918ce7f05b654e26d5ba72613362f46d8dd8df5ec
Opcode Fuzzy Hash: bd82b1bab94de296b2cc5d0090818dd39b0b3f239adced82cf4d8e107e286db1
Instruction Fuzzy Hash: B6411EB2900219EACB15FBE0DD9AEEFB7B8AF14340F500165B501760D2EB686F59CB61

Function 0074D0B8 Relevance: 22.9, APIs: 10, Strings: 3, Instructions: 101fileCOMMON

Download Yara Rule

APIs

GetFullPathNameW.KERNEL32(?,00007FFF,?,?), ref: 0074D0D8
__swprintf.LIBCMT ref: 0074D0FA
CreateDirectoryW.KERNEL32(?,00000000), ref: 0074D137
CreateFileW.KERNEL32(?,40000000,00000000,00000000,00000003,02200000,00000000), ref: 0074D15C
_memset.LIBCMT ref: 0074D17B
_wcsncpy.LIBCMT ref: 0074D1B7
DeviceIoControl.KERNEL32(00000000,000900A4,?,?,00000000,00000000,?,00000000), ref: 0074D1EC
CloseHandle.KERNEL32(00000000), ref: 0074D1F7
RemoveDirectoryW.KERNEL32(?), ref: 0074D200
CloseHandle.KERNEL32(00000000), ref: 0074D20A

Strings

\??\%s, xrefs: 0074D0F4
\, xrefs: 0074D110
:, xrefs: 0074D11B

Memory Dump Source

Source File: 00000000.00000002.1281263787.0000000000701000.00000020.00000001.01000000.00000003.sdmp, Offset: 00700000, based on PE: true

Associated: 00000000.00000002.1281243473.0000000000700000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1281360671.000000000078D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1281360671.00000000007AE000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1281496264.00000000007BA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1281529307.00000000007C4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1281529307.00000000007C7000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1281529307.00000000007D5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1281529307.00000000007D7000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_700000_OC & PL.jbxd

Similarity

API ID: CloseCreateDirectoryHandle$ControlDeviceFileFullNamePathRemove__swprintf_memset_wcsncpy
String ID: :$\$\??\%s
API String ID: 2733774712-3457252023
Opcode ID: 98832c57b7c79101a22bc21295360a88c14cddb6246b741db6b96d27b4280e79
Instruction ID: b7135688edd94185a62b330ab2c7e679fe4804448a94700f73996b4fc786fee0
Opcode Fuzzy Hash: 98832c57b7c79101a22bc21295360a88c14cddb6246b741db6b96d27b4280e79
Instruction Fuzzy Hash: 473181B2540119ABDB31DFA0DC49FEB77BCEF89740F1080B6F949D21A1E7789A458B24

Function 0076E731 Relevance: 22.6, APIs: 15, Instructions: 129filecommemoryCOMMON

Download Yara Rule

APIs

CreateFileW.KERNEL32(00000000,80000000,00000000,00000000,00000003,00000000,00000000,00000000,?,?,?,?,?,0076BEF4,?,?), ref: 0076E754
GetFileSize.KERNEL32(00000000,00000000,?,?,?,?,0076BEF4,?,?,00000000,?), ref: 0076E76B
GlobalAlloc.KERNEL32(00000002,00000000,?,?,?,?,0076BEF4,?,?,00000000,?), ref: 0076E776
CloseHandle.KERNEL32(00000000,?,?,?,?,0076BEF4,?,?,00000000,?), ref: 0076E783
GlobalLock.KERNEL32(00000000), ref: 0076E78C
ReadFile.KERNEL32(00000000,00000000,00000000,00000000,00000000,?,?,?,?,0076BEF4,?,?,00000000,?), ref: 0076E79B
GlobalUnlock.KERNEL32(00000000), ref: 0076E7A4
CloseHandle.KERNEL32(00000000,?,?,?,?,0076BEF4,?,?,00000000,?), ref: 0076E7AB
CreateStreamOnHGlobal.OLE32(00000000,00000001,?,?,?,?,?,0076BEF4,?,?,00000000,?), ref: 0076E7BC
OleLoadPicture.OLEAUT32(?,00000000,00000000,0078D9BC,?), ref: 0076E7D5
GlobalFree.KERNEL32(00000000), ref: 0076E7E5
GetObjectW.GDI32(00000000,00000018,?), ref: 0076E809
CopyImage.USER32(00000000,00000000,?,?,00002000), ref: 0076E834
DeleteObject.GDI32(00000000), ref: 0076E85C
SendMessageW.USER32(?,00000172,00000000,00000000), ref: 0076E872

Memory Dump Source

Source File: 00000000.00000002.1281263787.0000000000701000.00000020.00000001.01000000.00000003.sdmp, Offset: 00700000, based on PE: true

Associated: 00000000.00000002.1281243473.0000000000700000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1281360671.000000000078D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1281360671.00000000007AE000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1281496264.00000000007BA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1281529307.00000000007C4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1281529307.00000000007C7000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1281529307.00000000007D5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1281529307.00000000007D7000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_700000_OC & PL.jbxd

Similarity

API ID: Global$File$CloseCreateHandleObject$AllocCopyDeleteFreeImageLoadLockMessagePictureReadSendSizeStreamUnlock
String ID:
API String ID: 3840717409-0
Opcode ID: f7db7f2bba874e7a51d0bfbb66e008f99ae7fd306241b544ddb90129690195fa
Instruction ID: bf946e1e8d935aabcbda9ad236431793395f80ac7fbba3850f52eb011f32c551
Opcode Fuzzy Hash: f7db7f2bba874e7a51d0bfbb66e008f99ae7fd306241b544ddb90129690195fa
Instruction Fuzzy Hash: 2C414C75640209EFDB219F65DC4CEAA7BB8FF89721F208058F906E72A0D7389D40DB60

Function 007505F8 Relevance: 21.2, APIs: 11, Strings: 1, Instructions: 230COMMON

Download Yara Rule

APIs

__wsplitpath.LIBCMT ref: 0075076F
_wcscat.LIBCMT ref: 00750787
_wcscat.LIBCMT ref: 00750799
GetCurrentDirectoryW.KERNEL32(00007FFF,?), ref: 007507AE
SetCurrentDirectoryW.KERNEL32(?), ref: 007507C2
GetFileAttributesW.KERNEL32(?), ref: 007507DA
SetFileAttributesW.KERNEL32(?,00000000), ref: 007507F4
SetCurrentDirectoryW.KERNEL32(?), ref: 00750806

Strings

*.*, xrefs: 00750845

Memory Dump Source

Source File: 00000000.00000002.1281263787.0000000000701000.00000020.00000001.01000000.00000003.sdmp, Offset: 00700000, based on PE: true

Associated: 00000000.00000002.1281243473.0000000000700000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1281360671.000000000078D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1281360671.00000000007AE000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1281496264.00000000007BA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1281529307.00000000007C4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1281529307.00000000007C7000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1281529307.00000000007D5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1281529307.00000000007D7000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_700000_OC & PL.jbxd

Similarity

API ID: CurrentDirectory$AttributesFile_wcscat$__wsplitpath
String ID: *.*
API String ID: 34673085-438819550
Opcode ID: db30eda1b1c59a2d58f5722e77de41992efffff4068281e5105ed914cf277938
Instruction ID: ae311ca3d7be9fd7656ca35bf0477eec91f4dc9230d4529b70c491c0a666e060
Opcode Fuzzy Hash: db30eda1b1c59a2d58f5722e77de41992efffff4068281e5105ed914cf277938
Instruction Fuzzy Hash: DE818E71504301DFCB24DF24C8459AAB3E8FB88305F14882EFC89C7251EBB8E9598BD2

Function 0076EEEB Relevance: 21.2, APIs: 11, Strings: 1, Instructions: 229windowCOMMON

Download Yara Rule

APIs

Part of subcall function 0071B34E: GetWindowLongW.USER32(?,000000EB), ref: 0071B35F

PostMessageW.USER32(?,00000111,00000000,00000000), ref: 0076EF3B
GetFocus.USER32 ref: 0076EF4B
GetDlgCtrlID.USER32(00000000), ref: 0076EF56
_memset.LIBCMT ref: 0076F081
GetMenuItemInfoW.USER32 ref: 0076F0AC
GetMenuItemCount.USER32(00000000), ref: 0076F0CC
GetMenuItemID.USER32(?,00000000), ref: 0076F0DF
GetMenuItemInfoW.USER32(00000000,-00000001,00000001,?), ref: 0076F113
GetMenuItemInfoW.USER32(00000000,?,00000001,?), ref: 0076F15B
CheckMenuRadioItem.USER32(?,00000000,?,00000000,00000400), ref: 0076F193
DefDlgProcW.USER32(?,00000111,?,?,?,?,?,?,?), ref: 0076F1C8

Strings

0, xrefs: 0076F079

Memory Dump Source

Source File: 00000000.00000002.1281263787.0000000000701000.00000020.00000001.01000000.00000003.sdmp, Offset: 00700000, based on PE: true

Associated: 00000000.00000002.1281243473.0000000000700000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1281360671.000000000078D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1281360671.00000000007AE000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1281496264.00000000007BA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1281529307.00000000007C4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1281529307.00000000007C7000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1281529307.00000000007D5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1281529307.00000000007D7000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_700000_OC & PL.jbxd

Similarity

API ID: ItemMenu$Info$CheckCountCtrlFocusLongMessagePostProcRadioWindow_memset
String ID: 0
API String ID: 1296962147-4108050209
Opcode ID: f1f670702159019ce440e3aed7dccb6f02c7381e909cfce57954887d6207fcaa
Instruction ID: 629b7bee6fb68fba033e9940c084436f16fe0eee9048231445feddcd9f17524e
Opcode Fuzzy Hash: f1f670702159019ce440e3aed7dccb6f02c7381e909cfce57954887d6207fcaa
Instruction Fuzzy Hash: B5817971204305EFD724CF14D888AAABBE9FB89354F10492EFD9697291D738D901CBA2

Function 0073A867 Relevance: 21.2, APIs: 14, Instructions: 178memoryCOMMON

Download Yara Rule

APIs

Part of subcall function 0073ABBB: GetUserObjectSecurity.USER32(?,?,?,00000000,?), ref: 0073ABD7
Part of subcall function 0073ABBB: GetLastError.KERNEL32(?,0073A69F,?,?,?), ref: 0073ABE1
Part of subcall function 0073ABBB: GetProcessHeap.KERNEL32(00000008,?,?,0073A69F,?,?,?), ref: 0073ABF0
Part of subcall function 0073ABBB: HeapAlloc.KERNEL32(00000000,?,0073A69F,?,?,?), ref: 0073ABF7
Part of subcall function 0073ABBB: GetUserObjectSecurity.USER32(?,?,00000000,?,?), ref: 0073AC0E

Part of subcall function 0073AC56: GetProcessHeap.KERNEL32(00000008,0073A6B5,00000000,00000000,?,0073A6B5,?), ref: 0073AC62
Part of subcall function 0073AC56: HeapAlloc.KERNEL32(00000000,?,0073A6B5,?), ref: 0073AC69
Part of subcall function 0073AC56: InitializeSecurityDescriptor.ADVAPI32(00000000,00000001,?,0073A6B5,?), ref: 0073AC7A

GetSecurityDescriptorDacl.ADVAPI32(?,?,?,?), ref: 0073A8CB
_memset.LIBCMT ref: 0073A8E0
GetAclInformation.ADVAPI32(?,?,0000000C,00000002), ref: 0073A8FF
GetLengthSid.ADVAPI32(?), ref: 0073A910
GetAce.ADVAPI32(?,00000000,?), ref: 0073A94D
AddAce.ADVAPI32(?,00000002,000000FF,?,?), ref: 0073A969
GetLengthSid.ADVAPI32(?), ref: 0073A986
GetProcessHeap.KERNEL32(00000008,-00000008), ref: 0073A995
HeapAlloc.KERNEL32(00000000), ref: 0073A99C
GetLengthSid.ADVAPI32(?,00000008,?), ref: 0073A9BD
CopySid.ADVAPI32(00000000), ref: 0073A9C4
AddAce.ADVAPI32(?,00000002,000000FF,00000000,?), ref: 0073A9F5
SetSecurityDescriptorDacl.ADVAPI32(?,00000001,?,00000000), ref: 0073AA1B
SetUserObjectSecurity.USER32(?,00000004,?), ref: 0073AA2F

Memory Dump Source

Source File: 00000000.00000002.1281263787.0000000000701000.00000020.00000001.01000000.00000003.sdmp, Offset: 00700000, based on PE: true

Associated: 00000000.00000002.1281243473.0000000000700000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1281360671.000000000078D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1281360671.00000000007AE000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1281496264.00000000007BA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1281529307.00000000007C4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1281529307.00000000007C7000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1281529307.00000000007D5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1281529307.00000000007D7000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_700000_OC & PL.jbxd

Similarity

API ID: HeapSecurity$AllocDescriptorLengthObjectProcessUser$Dacl$CopyErrorInformationInitializeLast_memset
String ID:
API String ID: 3996160137-0
Opcode ID: bb7b0ac45003fe7cde93594ecc93348e633197e1de7eb722c441bab2240d389c
Instruction ID: 67e41e5d23268a90099bb2ae90513952bf7b8696f5f9aa7977b5d12428090150
Opcode Fuzzy Hash: bb7b0ac45003fe7cde93594ecc93348e633197e1de7eb722c441bab2240d389c
Instruction Fuzzy Hash: A0511CB1900209BFEF10DF94DD46EEEBBB9FF04310F148119E955A6291DB399E05CB61

Function 0074CC5C Relevance: 21.2, APIs: 7, Strings: 5, Instructions: 155COMMON

Download Yara Rule

APIs

LoadStringW.USER32(00000066,?,00000FFF), ref: 0074CCA3
LoadStringW.USER32(?,?,00000FFF,?), ref: 0074CCC5
__swprintf.LIBCMT ref: 0074CD1E
__swprintf.LIBCMT ref: 0074CD37
_wprintf.LIBCMT ref: 0074CDED
_wprintf.LIBCMT ref: 0074CE0B

Strings

"%s" (%d) : ==> %s:, xrefs: 0074CE06
^ ERROR, xrefs: 0074CD8F
"%s" (%d) : ==> %s:%s%s, xrefs: 0074CDE8
Line %d (File "%s"):, xrefs: 0074CD18, 0074CD31
Error: , xrefs: 0074CDB5

Memory Dump Source

Source File: 00000000.00000002.1281263787.0000000000701000.00000020.00000001.01000000.00000003.sdmp, Offset: 00700000, based on PE: true

Associated: 00000000.00000002.1281243473.0000000000700000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1281360671.000000000078D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1281360671.00000000007AE000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1281496264.00000000007BA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1281529307.00000000007C4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1281529307.00000000007C7000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1281529307.00000000007D5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1281529307.00000000007D7000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_700000_OC & PL.jbxd

Similarity

API ID: LoadString__swprintf_wprintf
String ID: Error: $"%s" (%d) : ==> %s:$"%s" (%d) : ==> %s:%s%s$Line %d (File "%s"):$^ ERROR
API String ID: 2889450990-2391861430
Opcode ID: 74532411b89a8f43637378e82380532ade1b030d1329425951d789e961bc82d2
Instruction ID: 4e613251c348b8cddf0c061bb54d99677569d878fac2dc03bd1791e752ae72ef
Opcode Fuzzy Hash: 74532411b89a8f43637378e82380532ade1b030d1329425951d789e961bc82d2
Instruction Fuzzy Hash: 6C519F71900119FACB15EBE0DD4AEEEB7B8AF08300F504265F505721A2EB396F99DF61

Function 0074CA48 Relevance: 21.2, APIs: 7, Strings: 5, Instructions: 151COMMON

Download Yara Rule

APIs

LoadStringW.USER32(00000066,?,00000FFF,00000016), ref: 0074CA8F
LoadStringW.USER32(00000072,?,00000FFF,?), ref: 0074CAB0
__swprintf.LIBCMT ref: 0074CB09
__swprintf.LIBCMT ref: 0074CB22
_wprintf.LIBCMT ref: 0074CBCD
_wprintf.LIBCMT ref: 0074CBEB

Strings

"%s" (%d) : ==> %s:, xrefs: 0074CBE6
^ ERROR , xrefs: 0074CB64
"%s" (%d) : ==> %s:%s%s, xrefs: 0074CBC8
Line %d (File "%s"):, xrefs: 0074CB03, 0074CB1C
Error: , xrefs: 0074CB95

Memory Dump Source

Source File: 00000000.00000002.1281263787.0000000000701000.00000020.00000001.01000000.00000003.sdmp, Offset: 00700000, based on PE: true

Associated: 00000000.00000002.1281243473.0000000000700000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1281360671.000000000078D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1281360671.00000000007AE000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1281496264.00000000007BA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1281529307.00000000007C4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1281529307.00000000007C7000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1281529307.00000000007D5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1281529307.00000000007D7000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_700000_OC & PL.jbxd

Similarity

API ID: LoadString__swprintf_wprintf
String ID: Error: $"%s" (%d) : ==> %s:$"%s" (%d) : ==> %s:%s%s$Line %d (File "%s"):$^ ERROR
API String ID: 2889450990-3420473620
Opcode ID: d7634316906a5a0ade0625a0635345cbdedab267833a327970bccb9c337fba1c
Instruction ID: fadffb7fafc2aec871b45a706832af8e2a08afbce88e1733bf620af9c3acd58e
Opcode Fuzzy Hash: d7634316906a5a0ade0625a0635345cbdedab267833a327970bccb9c337fba1c
Instruction Fuzzy Hash: F351AFB1900219EACB15EBE0DD4AEEEB7B8AF04340F504265F50572092EB3C6F99DF61

Function 00763C06 Relevance: 21.1, APIs: 1, Strings: 11, Instructions: 109COMMON

Download Yara Rule

APIs

CharUpperBuffW.USER32(?,?,?,?,?,?,?,00762BB5,?,?), ref: 00763C1D

Strings

HKLM, xrefs: 00763C81
HKEY_CURRENT_CONFIG, xrefs: 00763CC0
HKEY_LOCAL_MACHINE, xrefs: 00763C6C
HKCU, xrefs: 00763CF3
HKEY_CURRENT_USER, xrefs: 00763CE2
$E{, xrefs: 00763C36
HKU, xrefs: 00763D15
HKCC, xrefs: 00763CD1
HKCR, xrefs: 00763CAB
HKEY_CLASSES_ROOT, xrefs: 00763C96
HKEY_USERS, xrefs: 00763D04

Memory Dump Source

Source File: 00000000.00000002.1281263787.0000000000701000.00000020.00000001.01000000.00000003.sdmp, Offset: 00700000, based on PE: true

Associated: 00000000.00000002.1281243473.0000000000700000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1281360671.000000000078D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1281360671.00000000007AE000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1281496264.00000000007BA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1281529307.00000000007C4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1281529307.00000000007C7000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1281529307.00000000007D5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1281529307.00000000007D7000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_700000_OC & PL.jbxd

Similarity

API ID: BuffCharUpper
String ID: $E{$HKCC$HKCR$HKCU$HKEY_CLASSES_ROOT$HKEY_CURRENT_CONFIG$HKEY_CURRENT_USER$HKEY_LOCAL_MACHINE$HKEY_USERS$HKLM$HKU
API String ID: 3964851224-3416176561
Opcode ID: f98ecdfbd2834cda97431399cbeeddefa2f40600ec0c92020e0f2f2fd6c6c333
Instruction ID: f3e0bf1d2774aca80b57769bd972481fc5bb08e7858b1bcbf901683aa38a94a0
Opcode Fuzzy Hash: f98ecdfbd2834cda97431399cbeeddefa2f40600ec0c92020e0f2f2fd6c6c333
Instruction Fuzzy Hash: 57413D3021024BCBDF10EF14DC55AEA3365AF62340F504865FC566B2D2EB7CAE9ACB60

Function 007455BD Relevance: 19.7, APIs: 13, Instructions: 213windowCOMMON

Download Yara Rule

APIs

_memset.LIBCMT ref: 007455D7
GetMenuItemInfoW.USER32(00000000,00000007,00000000,00000030), ref: 00745664
GetMenuItemCount.USER32(007C1708), ref: 007456ED
DeleteMenu.USER32(007C1708,00000005,00000000,000000F5,?,?), ref: 0074577D
DeleteMenu.USER32(007C1708,00000004,00000000), ref: 00745785
DeleteMenu.USER32(007C1708,00000006,00000000), ref: 0074578D
DeleteMenu.USER32(007C1708,00000003,00000000), ref: 00745795
GetMenuItemCount.USER32(007C1708), ref: 0074579D
SetMenuItemInfoW.USER32(007C1708,00000004,00000000,00000030), ref: 007457D3
GetCursorPos.USER32(?), ref: 007457DD
SetForegroundWindow.USER32(00000000), ref: 007457E6
TrackPopupMenuEx.USER32(007C1708,00000000,?,00000000,00000000,00000000), ref: 007457F9
PostMessageW.USER32(00000000,00000000,00000000,00000000), ref: 00745805

Memory Dump Source

Source File: 00000000.00000002.1281263787.0000000000701000.00000020.00000001.01000000.00000003.sdmp, Offset: 00700000, based on PE: true

Associated: 00000000.00000002.1281243473.0000000000700000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1281360671.000000000078D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1281360671.00000000007AE000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1281496264.00000000007BA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1281529307.00000000007C4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1281529307.00000000007C7000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1281529307.00000000007D5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1281529307.00000000007D7000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_700000_OC & PL.jbxd

Similarity

API ID: Menu$DeleteItem$CountInfo$CursorForegroundMessagePopupPostTrackWindow_memset
String ID:
API String ID: 3993528054-0
Opcode ID: 364fea6282020b7bdb479b26c34bf8638dc578f9f94338df7243833301462aee
Instruction ID: eaabdf5428d8355928a9f3d30a9099e2577cc2892beb4417ccd4fbc678cfeffd
Opcode Fuzzy Hash: 364fea6282020b7bdb479b26c34bf8638dc578f9f94338df7243833301462aee
Instruction Fuzzy Hash: 53713330640A19FFEB219F14CC49FAABF65FF01768F244216F6186A1D2C7786C10DBA5

Function 0073A14D Relevance: 19.4, APIs: 8, Strings: 3, Instructions: 127registryshareCOMMON

Download Yara Rule

APIs

_memset.LIBCMT ref: 0073A1DC
WNetAddConnection2W.MPR(?,?,?,00000000), ref: 0073A211
RegConnectRegistryW.ADVAPI32(?,80000002,?), ref: 0073A22D
RegOpenKeyExW.ADVAPI32(?,?,00000000,00020019,?,?,SOFTWARE\Classes\), ref: 0073A249
RegQueryValueExW.ADVAPI32(?,00000000,00000000,00000000,?,?,?,SOFTWARE\Classes\), ref: 0073A273
CLSIDFromString.OLE32(?,?,?,SOFTWARE\Classes\), ref: 0073A29B
RegCloseKey.ADVAPI32(?,?,SOFTWARE\Classes\), ref: 0073A2A6
RegCloseKey.ADVAPI32(?,?,SOFTWARE\Classes\), ref: 0073A2AB

Strings

SOFTWARE\Classes\, xrefs: 0073A17D
\IPC$, xrefs: 0073A1F3
\CLSID, xrefs: 0073A193

Memory Dump Source

Source File: 00000000.00000002.1281263787.0000000000701000.00000020.00000001.01000000.00000003.sdmp, Offset: 00700000, based on PE: true

Associated: 00000000.00000002.1281243473.0000000000700000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1281360671.000000000078D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1281360671.00000000007AE000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1281496264.00000000007BA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1281529307.00000000007C4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1281529307.00000000007C7000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1281529307.00000000007D5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1281529307.00000000007D7000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_700000_OC & PL.jbxd

Similarity

API ID: Close$ConnectConnection2FromOpenQueryRegistryStringValue_memset
String ID: SOFTWARE\Classes\$\CLSID$\IPC$
API String ID: 1687751970-22481851
Opcode ID: 63e1326b39a7a71cc40ae74c40144b83692a6a8ec6b8ec7784c103304ecbee0f
Instruction ID: f37c296ef135904d35922c4049b4b270e5882d9bac3c828980e57eaba26f9d85
Opcode Fuzzy Hash: 63e1326b39a7a71cc40ae74c40144b83692a6a8ec6b8ec7784c103304ecbee0f
Instruction Fuzzy Hash: 8541C876C1022DEADF25EBA4DC95DEEB7B8BF04750F004129F901A31A1EB789E05CB91

Function 007467E9 Relevance: 19.4, APIs: 10, Strings: 1, Instructions: 107windowCOMMON

Download Yara Rule

APIs

__swprintf.LIBCMT ref: 007467FD
__swprintf.LIBCMT ref: 0074680A

Part of subcall function 0072172B: __woutput_l.LIBCMT ref: 00721784

FindResourceW.KERNEL32(?,?,0000000E), ref: 00746834
LoadResource.KERNEL32(?,00000000), ref: 00746840
LockResource.KERNEL32(00000000), ref: 0074684D
FindResourceW.KERNEL32(?,?,00000003), ref: 0074686D
LoadResource.KERNEL32(?,00000000), ref: 0074687F
SizeofResource.KERNEL32(?,00000000), ref: 0074688E
LockResource.KERNEL32(?), ref: 0074689A
CreateIconFromResourceEx.USER32(?,?,00000001,00030000,00000000,00000000,00000000), ref: 007468F9

Strings

5{, xrefs: 007467F6

Memory Dump Source

Source File: 00000000.00000002.1281263787.0000000000701000.00000020.00000001.01000000.00000003.sdmp, Offset: 00700000, based on PE: true

Associated: 00000000.00000002.1281243473.0000000000700000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1281360671.000000000078D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1281360671.00000000007AE000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1281496264.00000000007BA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1281529307.00000000007C4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1281529307.00000000007C7000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1281529307.00000000007D5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1281529307.00000000007D7000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_700000_OC & PL.jbxd

Similarity

API ID: Resource$FindLoadLock__swprintf$CreateFromIconSizeof__woutput_l
String ID: 5{
API String ID: 1433390588-2178416286
Opcode ID: 31739b55f633fb858dc7a18fab5c5363b0dbf9b5f33a8fbf41172095d18e8edb
Instruction ID: 22732e5332ccae4fe95aa71dce841e63845ea4c5d3b9bf5398ac91b596bce5a2
Opcode Fuzzy Hash: 31739b55f633fb858dc7a18fab5c5363b0dbf9b5f33a8fbf41172095d18e8edb
Instruction Fuzzy Hash: 92318E7190021AABDB10AF60ED59EBABBADFF09340B108425F902E2151E73CDD61DBA5

Function 007425B5 Relevance: 19.3, APIs: 6, Strings: 5, Instructions: 74windowCOMMON

Download Yara Rule

APIs

GetModuleHandleW.KERNEL32(00000000,?,?,00000FFF,00000000,?,007736F4,00000010,?,Bad directive syntax error,0079DC00,00000000,?,?,?,>>>AUTOIT SCRIPT<<<), ref: 007425D6
LoadStringW.USER32(00000000,?,007736F4,00000010), ref: 007425DD
_wprintf.LIBCMT ref: 00742610
__swprintf.LIBCMT ref: 00742632
MessageBoxW.USER32(00000000,00000001,00000001,00011010), ref: 007426A1

Strings

%s (%d) : ==> %s.: %s %s, xrefs: 0074260B
Error: , xrefs: 0074266F
., xrefs: 00742687
Line %d (File "%s"):, xrefs: 00742647
Line %d:, xrefs: 0074262C

Memory Dump Source

Source File: 00000000.00000002.1281263787.0000000000701000.00000020.00000001.01000000.00000003.sdmp, Offset: 00700000, based on PE: true

Associated: 00000000.00000002.1281243473.0000000000700000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1281360671.000000000078D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1281360671.00000000007AE000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1281496264.00000000007BA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1281529307.00000000007C4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1281529307.00000000007C7000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1281529307.00000000007D5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1281529307.00000000007D7000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_700000_OC & PL.jbxd

Similarity

API ID: HandleLoadMessageModuleString__swprintf_wprintf
String ID: Error: $%s (%d) : ==> %s.: %s %s$.$Line %d (File "%s"):$Line %d:
API String ID: 1080873982-4153970271
Opcode ID: f9eea36639db83d7b7c3c7ff280d7b62361c884fc07023b64c46590d36b5b682
Instruction ID: 3ab9a19e89580974d64c2eb0571316b71e8339ace8e8562c84b5602cfc5643fe
Opcode Fuzzy Hash: f9eea36639db83d7b7c3c7ff280d7b62361c884fc07023b64c46590d36b5b682
Instruction Fuzzy Hash: C9218B7180021EEFCF12AB90CC0AFEE7B78BF18304F404555F505621A2EB79AA69DB61

Function 00747AD9 Relevance: 19.3, APIs: 5, Strings: 6, Instructions: 73COMMON

Download Yara Rule

APIs

mciSendStringW.WINMM(status PlayMe mode,?,00000100,00000000), ref: 00747B42
mciSendStringW.WINMM(close PlayMe,00000000,00000000,00000000), ref: 00747B58
mciSendStringW.WINMM(?,00000000,00000000,00000000), ref: 00747B69
mciSendStringW.WINMM(play PlayMe wait,00000000,00000000,00000000), ref: 00747B7B
mciSendStringW.WINMM(play PlayMe,00000000,00000000,00000000), ref: 00747B8C

Strings

close PlayMe, xrefs: 00747B53, 00747B80
status PlayMe mode, xrefs: 00747B3D
open , xrefs: 00747AF1
play PlayMe wait, xrefs: 00747B76
alias PlayMe, xrefs: 00747B1B
play PlayMe, xrefs: 00747B87

Memory Dump Source

Source File: 00000000.00000002.1281263787.0000000000701000.00000020.00000001.01000000.00000003.sdmp, Offset: 00700000, based on PE: true

Associated: 00000000.00000002.1281243473.0000000000700000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1281360671.000000000078D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1281360671.00000000007AE000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1281496264.00000000007BA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1281529307.00000000007C4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1281529307.00000000007C7000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1281529307.00000000007D5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1281529307.00000000007D7000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_700000_OC & PL.jbxd

Similarity

API ID: SendString
String ID: alias PlayMe$close PlayMe$open $play PlayMe$play PlayMe wait$status PlayMe mode
API String ID: 890592661-1007645807
Opcode ID: a79d802b876bb4ec25bca64b8c23fc088e01e20d88b7fd85f552ca3f8ded43ab
Instruction ID: cee36698aef74c1f4a2409085c0bb44a2ec30022e309e3d081061c78905f04e5
Opcode Fuzzy Hash: a79d802b876bb4ec25bca64b8c23fc088e01e20d88b7fd85f552ca3f8ded43ab
Instruction Fuzzy Hash: 241198F1650259F9D724B771CC8AEFF7ABCEB91B10F000659B411A20D1EF681E85C5B0

Function 0074778F Relevance: 19.3, APIs: 10, Strings: 1, Instructions: 72sleepwindowtimeCOMMON

Download Yara Rule

APIs

timeGetTime.WINMM ref: 00747794

Part of subcall function 0071DC38: timeGetTime.WINMM(?,75A4B400,007758AB), ref: 0071DC3C

Sleep.KERNEL32(0000000A), ref: 007477C0
EnumThreadWindows.USER32(?,Function_00047744,00000000), ref: 007477E4
FindWindowExW.USER32(?,00000000,BUTTON,00000000), ref: 00747806
SetActiveWindow.USER32 ref: 00747825
SendMessageW.USER32(00000000,000000F5,00000000,00000000), ref: 00747833
SendMessageW.USER32(00000010,00000000,00000000), ref: 00747852
Sleep.KERNEL32(000000FA), ref: 0074785D
IsWindow.USER32 ref: 00747869
EndDialog.USER32(00000000), ref: 0074787A

Strings

BUTTON, xrefs: 007477F8

Memory Dump Source

Source File: 00000000.00000002.1281263787.0000000000701000.00000020.00000001.01000000.00000003.sdmp, Offset: 00700000, based on PE: true

Associated: 00000000.00000002.1281243473.0000000000700000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1281360671.000000000078D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1281360671.00000000007AE000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1281496264.00000000007BA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1281529307.00000000007C4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1281529307.00000000007C7000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1281529307.00000000007D5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1281529307.00000000007D7000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_700000_OC & PL.jbxd

Similarity

API ID: Window$MessageSendSleepTimetime$ActiveDialogEnumFindThreadWindows
String ID: BUTTON
API String ID: 1194449130-3405671355
Opcode ID: 517a929ddd72ea645c76d62e7ac73e49a236126f169b775ae5c56677bc648ac6
Instruction ID: 4f1d21352cc8ace7417785cc7b3d4a3aa472ae3dd74ee349f968488f0237b426
Opcode Fuzzy Hash: 517a929ddd72ea645c76d62e7ac73e49a236126f169b775ae5c56677bc648ac6
Instruction Fuzzy Hash: 60218CB0284249AFE7295B20EC8DF663F29FB48348F11C429F506861A2DB7D9D14DB69

Function 007502EE Relevance: 18.3, APIs: 12, Instructions: 282comCOMMON

Download Yara Rule

APIs

Part of subcall function 0070936C: __swprintf.LIBCMT ref: 007093AB
Part of subcall function 0070936C: __itow.LIBCMT ref: 007093DF

CoInitialize.OLE32(00000000), ref: 0075034B
SHGetSpecialFolderLocation.SHELL32(00000000,00000000,?), ref: 007503DE
SHGetDesktopFolder.SHELL32(?), ref: 007503F2
CoCreateInstance.OLE32(0078DA8C,00000000,00000001,007B3CF8,?), ref: 0075043E
SHCreateShellItem.SHELL32(00000000,00000000,?,00000003), ref: 007504AD
CoTaskMemFree.OLE32(?,?), ref: 00750505
_memset.LIBCMT ref: 00750542
SHBrowseForFolderW.SHELL32(?), ref: 0075057E
SHGetPathFromIDListW.SHELL32(00000000,?), ref: 007505A1
CoTaskMemFree.OLE32(00000000), ref: 007505A8
CoTaskMemFree.OLE32(00000000,00000001,00000000), ref: 007505DF
CoUninitialize.OLE32(00000001,00000000), ref: 007505E1

Memory Dump Source

Source File: 00000000.00000002.1281263787.0000000000701000.00000020.00000001.01000000.00000003.sdmp, Offset: 00700000, based on PE: true

Associated: 00000000.00000002.1281243473.0000000000700000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1281360671.000000000078D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1281360671.00000000007AE000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1281496264.00000000007BA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1281529307.00000000007C4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1281529307.00000000007C7000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1281529307.00000000007D5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1281529307.00000000007D7000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_700000_OC & PL.jbxd

Similarity

API ID: FolderFreeTask$Create$BrowseDesktopFromInitializeInstanceItemListLocationPathShellSpecialUninitialize__itow__swprintf_memset
String ID:
API String ID: 1246142700-0
Opcode ID: 838ed79dc7adb64f971c2b592e22413aa9c941c4286834bf6e57a41ccc1cf5a2
Instruction ID: 7031d4a9b1c2e491d55a5167e1bdc153ddbfccf0261aea8a0328f139c8664754
Opcode Fuzzy Hash: 838ed79dc7adb64f971c2b592e22413aa9c941c4286834bf6e57a41ccc1cf5a2
Instruction Fuzzy Hash: 9FB1F975A00208EFDB14DFA4C888DAEBBB9FF48305B1485A9F905EB251D774ED45CB90

Function 00742E5B Relevance: 18.2, APIs: 12, Instructions: 185keyboardCOMMON

Download Yara Rule

APIs

GetKeyboardState.USER32(?), ref: 00742ED6
SetKeyboardState.USER32(?), ref: 00742F41
GetAsyncKeyState.USER32(000000A0), ref: 00742F61
GetKeyState.USER32(000000A0), ref: 00742F78
GetAsyncKeyState.USER32(000000A1), ref: 00742FA7
GetKeyState.USER32(000000A1), ref: 00742FB8
GetAsyncKeyState.USER32(00000011), ref: 00742FE4
GetKeyState.USER32(00000011), ref: 00742FF2
GetAsyncKeyState.USER32(00000012), ref: 0074301B
GetKeyState.USER32(00000012), ref: 00743029
GetAsyncKeyState.USER32(0000005B), ref: 00743052
GetKeyState.USER32(0000005B), ref: 00743060

Memory Dump Source

Source File: 00000000.00000002.1281263787.0000000000701000.00000020.00000001.01000000.00000003.sdmp, Offset: 00700000, based on PE: true

Associated: 00000000.00000002.1281243473.0000000000700000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1281360671.000000000078D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1281360671.00000000007AE000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1281496264.00000000007BA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1281529307.00000000007C4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1281529307.00000000007C7000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1281529307.00000000007D5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1281529307.00000000007D7000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_700000_OC & PL.jbxd

Similarity

API ID: State$Async$Keyboard
String ID:
API String ID: 541375521-0
Opcode ID: ba510e1b76d60e216e4f2b9d43fcc0120df5889fef6c1d255df25833e74d7f6b
Instruction ID: 636674a75ef6f5b55562cdf89479ca317f1ac94aa0971bc2a1e1a33f85b8853c
Opcode Fuzzy Hash: ba510e1b76d60e216e4f2b9d43fcc0120df5889fef6c1d255df25833e74d7f6b
Instruction Fuzzy Hash: 62512960A0479869FB35DBA088147EABFF45F11340F88859EE5C2561C3DB5C9B8CC761

Function 0073ED02 Relevance: 18.2, APIs: 12, Instructions: 174COMMON

Download Yara Rule

APIs

GetDlgItem.USER32(?,00000001), ref: 0073ED1E
GetWindowRect.USER32(00000000,?), ref: 0073ED30
MoveWindow.USER32(00000001,0000000A,?,00000001,?,00000000), ref: 0073ED8E
GetDlgItem.USER32(?,00000002), ref: 0073ED99
GetWindowRect.USER32(00000000,?), ref: 0073EDAB
MoveWindow.USER32(00000001,?,00000000,00000001,?,00000000), ref: 0073EE01
GetDlgItem.USER32(?,000003E9), ref: 0073EE0F
GetWindowRect.USER32(00000000,?), ref: 0073EE20
MoveWindow.USER32(00000000,0000000A,00000000,?,?,00000000), ref: 0073EE63
GetDlgItem.USER32(?,000003EA), ref: 0073EE71
MoveWindow.USER32(00000000,0000000A,0000000A,?,-00000005,00000000), ref: 0073EE8E
InvalidateRect.USER32(?,00000000,00000001), ref: 0073EE9B

Memory Dump Source

Source File: 00000000.00000002.1281263787.0000000000701000.00000020.00000001.01000000.00000003.sdmp, Offset: 00700000, based on PE: true

Associated: 00000000.00000002.1281243473.0000000000700000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1281360671.000000000078D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1281360671.00000000007AE000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1281496264.00000000007BA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1281529307.00000000007C4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1281529307.00000000007C7000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1281529307.00000000007D5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1281529307.00000000007D7000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_700000_OC & PL.jbxd

Similarity

API ID: Window$ItemMoveRect$Invalidate
String ID:
API String ID: 3096461208-0
Opcode ID: 5ca54d1bf34e7bf3a9f51fdc3884c489ff6c7e1a4ebdf3d5acb72d986bffd27c
Instruction ID: ca0b107b3cceadc6e3896eb84bbcabcc264f79c7bfa97c049c5764cfffbbfe52
Opcode Fuzzy Hash: 5ca54d1bf34e7bf3a9f51fdc3884c489ff6c7e1a4ebdf3d5acb72d986bffd27c
Instruction Fuzzy Hash: 7A513371B40209AFDB18CF69CD85EAEBBB6FB88710F148129F519D72D1D7749D008B14

Function 0071B73E Relevance: 18.2, APIs: 12, Instructions: 170timeCOMMON

Download Yara Rule

APIs

Part of subcall function 0071B9FF: InvalidateRect.USER32(?,00000000,00000001,?,?,?,0071B759,?,00000000,?,?,?,?,0071B72B,00000000,?), ref: 0071BA58

DestroyWindow.USER32(?,?,?,?,?,?,?,?,?,?,00000000,?,?,?,?,0071B72B), ref: 0071B7F6
KillTimer.USER32(00000000,?,00000000,?,?,?,?,0071B72B,00000000,?,?,0071B2EF,?,?), ref: 0071B88D
DestroyAcceleratorTable.USER32(00000000), ref: 0077D8A6
ImageList_Destroy.COMCTL32(00000000,?,00000000,?,?,?,?,0071B72B,00000000,?,?,0071B2EF,?,?), ref: 0077D8D7
ImageList_Destroy.COMCTL32(00000000,?,00000000,?,?,?,?,0071B72B,00000000,?,?,0071B2EF,?,?), ref: 0077D8EE
ImageList_Destroy.COMCTL32(00000000,?,00000000,?,?,?,?,0071B72B,00000000,?,?,0071B2EF,?,?), ref: 0077D90A
DeleteObject.GDI32(00000000), ref: 0077D91C

Memory Dump Source

Source File: 00000000.00000002.1281263787.0000000000701000.00000020.00000001.01000000.00000003.sdmp, Offset: 00700000, based on PE: true

Associated: 00000000.00000002.1281243473.0000000000700000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1281360671.000000000078D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1281360671.00000000007AE000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1281496264.00000000007BA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1281529307.00000000007C4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1281529307.00000000007C7000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1281529307.00000000007D5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1281529307.00000000007D7000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_700000_OC & PL.jbxd

Similarity

API ID: Destroy$ImageList_$AcceleratorDeleteInvalidateKillObjectRectTableTimerWindow
String ID:
API String ID: 641708696-0
Opcode ID: b093660592051d4689b9ee20e568a5f0cab745d8c61f9b14d46b42d37f57f048
Instruction ID: 4eea7040726ee18809f81ae447593fc75405bc2534fe4ce5beb125d2bb6d63e4
Opcode Fuzzy Hash: b093660592051d4689b9ee20e568a5f0cab745d8c61f9b14d46b42d37f57f048
Instruction Fuzzy Hash: F7615530500601DFDB359F18D988BA5B7B5FF95726F24852EE04696AA0CB3CACD0DF88

Function 0071B40A Relevance: 18.1, APIs: 12, Instructions: 131COMMON

Download Yara Rule

APIs

Part of subcall function 0071B526: GetWindowLongW.USER32(?,000000EB), ref: 0071B537

GetSysColor.USER32(0000000F), ref: 0071B438

Memory Dump Source

Source File: 00000000.00000002.1281263787.0000000000701000.00000020.00000001.01000000.00000003.sdmp, Offset: 00700000, based on PE: true

Associated: 00000000.00000002.1281243473.0000000000700000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1281360671.000000000078D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1281360671.00000000007AE000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1281496264.00000000007BA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1281529307.00000000007C4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1281529307.00000000007C7000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1281529307.00000000007D5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1281529307.00000000007D7000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_700000_OC & PL.jbxd

Similarity

API ID: ColorLongWindow
String ID:
API String ID: 259745315-0
Opcode ID: 77ce9c337ff05bacb5307a26368781c35dbb839d736d2c7cb4fc0fc53611bab6
Instruction ID: 77a080ec510db491aa700f830ea78b40587d6ef74772b36aa7a0f87873d2c380
Opcode Fuzzy Hash: 77ce9c337ff05bacb5307a26368781c35dbb839d736d2c7cb4fc0fc53611bab6
Instruction Fuzzy Hash: E541CE30040184ABDF316F6CD889BF93B66AF46730F29C265FD658A1E2D7788C81DB21

Function 0074690B Relevance: 18.1, APIs: 12, Instructions: 113COMMON

Download Yara Rule

APIs

_wcschr.LIBCMT ref: 00746923
_wcscpy.LIBCMT ref: 00746934
__wsplitpath.LIBCMT ref: 00746958
__wsplitpath.LIBCMT ref: 00746979
_wcscpy.LIBCMT ref: 0074699B
_wcscpy.LIBCMT ref: 007469B9
_wcscpy.LIBCMT ref: 007469C7
_wcscat.LIBCMT ref: 007469D6
_wcscat.LIBCMT ref: 00746A2B
_wcscat.LIBCMT ref: 00746A61
_wcscat.LIBCMT ref: 00746A73

Memory Dump Source

Source File: 00000000.00000002.1281263787.0000000000701000.00000020.00000001.01000000.00000003.sdmp, Offset: 00700000, based on PE: true

Associated: 00000000.00000002.1281243473.0000000000700000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1281360671.000000000078D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1281360671.00000000007AE000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1281496264.00000000007BA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1281529307.00000000007C4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1281529307.00000000007C7000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1281529307.00000000007D5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1281529307.00000000007D7000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_700000_OC & PL.jbxd

Similarity

API ID: _wcscat_wcscpy$__wsplitpath$_wcschr
String ID:
API String ID: 136442275-0
Opcode ID: a12473c9ba46c03736e851181e399176a16de42d6262651f8ce5ec4bfd69dff5
Instruction ID: 86e65ea3a6a2a3e15be72c2665bef06770e80850d37ebbbdf7ed75b31d938b71
Opcode Fuzzy Hash: a12473c9ba46c03736e851181e399176a16de42d6262651f8ce5ec4bfd69dff5
Instruction Fuzzy Hash: B24121B694512CAFCF61DB90DC49DCA73BCEB44300F0041A6F659A2051EB74ABE58FA1

Function 0074D76A Relevance: 17.7, APIs: 3, Strings: 7, Instructions: 180COMMON

Download Yara Rule

APIs

CharLowerBuffW.USER32(0079DC00,0079DC00,0079DC00), ref: 0074D7CE
GetDriveTypeW.KERNEL32(?,007B3A70,00000061), ref: 0074D898
_wcscpy.LIBCMT ref: 0074D8C2

Strings

removable, xrefs: 0074D800
network, xrefs: 0074D82C
unknown, xrefs: 0074D859
ramdisk, xrefs: 0074D842
cdrom, xrefs: 0074D7EA
all, xrefs: 0074D7D4
fixed, xrefs: 0074D816

Memory Dump Source

Source File: 00000000.00000002.1281263787.0000000000701000.00000020.00000001.01000000.00000003.sdmp, Offset: 00700000, based on PE: true

Associated: 00000000.00000002.1281243473.0000000000700000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1281360671.000000000078D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1281360671.00000000007AE000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1281496264.00000000007BA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1281529307.00000000007C4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1281529307.00000000007C7000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1281529307.00000000007D5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1281529307.00000000007D7000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_700000_OC & PL.jbxd

Similarity

API ID: BuffCharDriveLowerType_wcscpy
String ID: all$cdrom$fixed$network$ramdisk$removable$unknown
API String ID: 2820617543-1000479233
Opcode ID: 0196e8ac2da79ffc7c9f755857125f00c2fa5e41f8f04541ff357494a2467cbb
Instruction ID: 36982984ca463cbc09fc755d6969388801d3caa5df847498a9e10d60f47e3de2
Opcode Fuzzy Hash: 0196e8ac2da79ffc7c9f755857125f00c2fa5e41f8f04541ff357494a2467cbb
Instruction Fuzzy Hash: F0519271104301EFC710EF14D895AAEB7A9EF84314F20892DF9DA572D2DB39ED45CA52

Function 0070936C Relevance: 17.6, APIs: 6, Strings: 4, Instructions: 145COMMON

Download Yara Rule

APIs

__swprintf.LIBCMT ref: 007093AB
__itow.LIBCMT ref: 007093DF

Part of subcall function 00721557: _xtow@16.LIBCMT ref: 00721578

Strings

0x%p, xrefs: 00774CAD
%.15g, xrefs: 007093A5
False, xrefs: 00774C93
True, xrefs: 00774C8C

Memory Dump Source

Source File: 00000000.00000002.1281263787.0000000000701000.00000020.00000001.01000000.00000003.sdmp, Offset: 00700000, based on PE: true

Associated: 00000000.00000002.1281243473.0000000000700000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1281360671.000000000078D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1281360671.00000000007AE000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1281496264.00000000007BA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1281529307.00000000007C4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1281529307.00000000007C7000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1281529307.00000000007D5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1281529307.00000000007D7000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_700000_OC & PL.jbxd

Similarity

API ID: __itow__swprintf_xtow@16
String ID: %.15g$0x%p$False$True
API String ID: 1502193981-2263619337
Opcode ID: d80312cb259cf50d22ed4e94d53a18233726d20b813d96e038b7054356289b3a
Instruction ID: e53d6fb902069092c0d2fbf7e1e05de9d3ec4ebfda842e8fc0b5d6b8a8349268
Opcode Fuzzy Hash: d80312cb259cf50d22ed4e94d53a18233726d20b813d96e038b7054356289b3a
Instruction Fuzzy Hash: 2341E671504204EFDB25DB78D945FAAB3E8EF44340F2085AAE64DD71D2EB399941CB60

Function 0076A1B6 Relevance: 17.6, APIs: 9, Strings: 1, Instructions: 101windowCOMMON

Download Yara Rule

APIs

MoveWindow.USER32(?,?,?,000000FF,000000FF,00000000,?,?,000000FF,000000FF,?,?,static,00000000,00000000,?), ref: 0076A259
CreateCompatibleDC.GDI32(00000000), ref: 0076A260
SendMessageW.USER32(?,00000173,00000000,00000000), ref: 0076A273
SelectObject.GDI32(00000000,00000000), ref: 0076A27B
GetPixel.GDI32(00000000,00000000,00000000), ref: 0076A286
DeleteDC.GDI32(00000000), ref: 0076A28F
GetWindowLongW.USER32(?,000000EC), ref: 0076A299
SetLayeredWindowAttributes.USER32(?,00000000,00000000,00000001), ref: 0076A2AD
DestroyWindow.USER32(?,?,?,000000FF,000000FF,?,?,static,00000000,00000000,?,?,00000000,00000000,?,?), ref: 0076A2B9

Strings

static, xrefs: 0076A1F1

Memory Dump Source

Source File: 00000000.00000002.1281263787.0000000000701000.00000020.00000001.01000000.00000003.sdmp, Offset: 00700000, based on PE: true

Associated: 00000000.00000002.1281243473.0000000000700000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1281360671.000000000078D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1281360671.00000000007AE000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1281496264.00000000007BA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1281529307.00000000007C4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1281529307.00000000007C7000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1281529307.00000000007D5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1281529307.00000000007D7000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_700000_OC & PL.jbxd

Similarity

API ID: Window$AttributesCompatibleCreateDeleteDestroyLayeredLongMessageMoveObjectPixelSelectSend
String ID: static
API String ID: 2559357485-2160076837
Opcode ID: 1c5db7487dd4a64f00a709f8bf7ee98ac304af3e2137ddb72c2a3364eb858d19
Instruction ID: 2bb1cb61b0ed9af41e8d9f3da2056bd528400bdbaefc68cead0bd36aabb99abb
Opcode Fuzzy Hash: 1c5db7487dd4a64f00a709f8bf7ee98ac304af3e2137ddb72c2a3364eb858d19
Instruction Fuzzy Hash: D2315831140218BFDB215FA4DC49FEA3B69FF49360F214214FA1AA60E0D73A9C11DBA9

Function 00746F02 Relevance: 17.6, APIs: 9, Strings: 1, Instructions: 72networkCOMMON

Download Yara Rule

APIs

WSAStartup.WSOCK32(00000101,?), ref: 00746F1D
gethostname.WSOCK32(?,00000100), ref: 00746F37
gethostbyname.WSOCK32(?), ref: 00746F44
_wcscpy.LIBCMT ref: 00746F6C
inet_ntoa.WSOCK32(?), ref: 00746F8A
_strcat.LIBCMT ref: 00746F98
_wcscpy.LIBCMT ref: 00746FAF
WSACleanup.WSOCK32 ref: 00746FBD
_wcscpy.LIBCMT ref: 00746FCB

Strings

0.0.0.0, xrefs: 00746F66

Memory Dump Source

Source File: 00000000.00000002.1281263787.0000000000701000.00000020.00000001.01000000.00000003.sdmp, Offset: 00700000, based on PE: true

Associated: 00000000.00000002.1281243473.0000000000700000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1281360671.000000000078D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1281360671.00000000007AE000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1281496264.00000000007BA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1281529307.00000000007C4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1281529307.00000000007C7000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1281529307.00000000007D5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1281529307.00000000007D7000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_700000_OC & PL.jbxd

Similarity

API ID: _wcscpy$CleanupStartup_strcatgethostbynamegethostnameinet_ntoa
String ID: 0.0.0.0
API String ID: 2620052-3771769585
Opcode ID: e477142e22410336037c0ad0fa4c52be9d83f402fae391666bb2046b6728df29
Instruction ID: cff4f5639a9fde7210db851ef819b0c73f6bd6f55028d54025e26a7b83298a7b
Opcode Fuzzy Hash: e477142e22410336037c0ad0fa4c52be9d83f402fae391666bb2046b6728df29
Instruction Fuzzy Hash: 6B110671504114AFDB24AB70EC4EEDA77BCEF41720F1140A5F145A6092EF7CEE898BA5

Function 0072500E Relevance: 16.8, APIs: 11, Instructions: 257COMMON

Download Yara Rule

APIs

_memset.LIBCMT ref: 00725047

Part of subcall function 00727C0E: __getptd_noexit.LIBCMT ref: 00727C0E

__gmtime64_s.LIBCMT ref: 007250E0
__gmtime64_s.LIBCMT ref: 00725116
__gmtime64_s.LIBCMT ref: 00725133
__allrem.LIBCMT ref: 00725189
__ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z.LIBCMT ref: 007251A5
__allrem.LIBCMT ref: 007251BC
__ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z.LIBCMT ref: 007251DA
__allrem.LIBCMT ref: 007251F1
__ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z.LIBCMT ref: 0072520F
__invoke_watson.LIBCMT ref: 00725280

Memory Dump Source

Source File: 00000000.00000002.1281263787.0000000000701000.00000020.00000001.01000000.00000003.sdmp, Offset: 00700000, based on PE: true

Associated: 00000000.00000002.1281243473.0000000000700000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1281360671.000000000078D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1281360671.00000000007AE000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1281496264.00000000007BA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1281529307.00000000007C4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1281529307.00000000007C7000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1281529307.00000000007D5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1281529307.00000000007D7000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_700000_OC & PL.jbxd

Similarity

API ID: Unothrow_t@std@@@__allrem__ehfuncinfo$??2@__gmtime64_s$__getptd_noexit__invoke_watson_memset
String ID:
API String ID: 384356119-0
Opcode ID: d5e017027a87c5018ad803d53256558374d4b82fb585307daa6d96de3ac92c4c
Instruction ID: cd703fbe553049fe4bdfd2e5257f44a26c745a6eb0f726fa54521fc7d5e014b3
Opcode Fuzzy Hash: d5e017027a87c5018ad803d53256558374d4b82fb585307daa6d96de3ac92c4c
Instruction Fuzzy Hash: D471D7B2A01B26EBE7249E79DC45B6A73E8BF04764F144229F510D72C2E778DD408BD0

Function 00744DDD Relevance: 16.7, APIs: 11, Instructions: 189windowsleepCOMMON

Download Yara Rule

APIs

_memset.LIBCMT ref: 00744DF8
GetMenuItemInfoW.USER32(007C1708,000000FF,00000000,00000030), ref: 00744E59
SetMenuItemInfoW.USER32(007C1708,00000004,00000000,00000030), ref: 00744E8F
Sleep.KERNEL32(000001F4), ref: 00744EA1
GetMenuItemCount.USER32(?), ref: 00744EE5
GetMenuItemID.USER32(?,00000000), ref: 00744F01
GetMenuItemID.USER32(?,-00000001), ref: 00744F2B
GetMenuItemID.USER32(?,?), ref: 00744F70
CheckMenuRadioItem.USER32(?,00000000,?,00000000,00000400), ref: 00744FB6
GetMenuItemInfoW.USER32(?,000000FF,00000000,00000030), ref: 00744FCA
SetMenuItemInfoW.USER32(?,000000FF,00000000,00000030), ref: 00744FEB

Memory Dump Source

Source File: 00000000.00000002.1281263787.0000000000701000.00000020.00000001.01000000.00000003.sdmp, Offset: 00700000, based on PE: true

Associated: 00000000.00000002.1281243473.0000000000700000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1281360671.000000000078D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1281360671.00000000007AE000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1281496264.00000000007BA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1281529307.00000000007C4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1281529307.00000000007C7000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1281529307.00000000007D5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1281529307.00000000007D7000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_700000_OC & PL.jbxd

Similarity

API ID: ItemMenu$Info$CheckCountRadioSleep_memset
String ID:
API String ID: 4176008265-0
Opcode ID: fe9358b9ed2cf5f9a6771fbcfd6605d7dead6007e691b1f80e4de5ee7ca3ba2b
Instruction ID: 040fc426c1c54bf352c928aecc074940047ba6b5bc0c5d8db6ef5e477ce344b7
Opcode Fuzzy Hash: fe9358b9ed2cf5f9a6771fbcfd6605d7dead6007e691b1f80e4de5ee7ca3ba2b
Instruction Fuzzy Hash: B8619E71900259EFDB21CFA4D888FAE7BB8FB01308F18415AF441A7291D739AD49EB21

Function 00769C16 Relevance: 16.7, APIs: 11, Instructions: 183windowCOMMON

Download Yara Rule

APIs

SendMessageW.USER32(?,0000101F,00000000,00000000), ref: 00769C98
SendMessageW.USER32(00000000,?,0000101F,00000000), ref: 00769C9B
GetWindowLongW.USER32(?,000000F0), ref: 00769CBF
_memset.LIBCMT ref: 00769CD0
SendMessageW.USER32(?,00001004,00000000,00000000), ref: 00769CE2
SendMessageW.USER32(?,0000104D,00000000,00000007), ref: 00769D5A

Memory Dump Source

Source File: 00000000.00000002.1281263787.0000000000701000.00000020.00000001.01000000.00000003.sdmp, Offset: 00700000, based on PE: true

Associated: 00000000.00000002.1281243473.0000000000700000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1281360671.000000000078D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1281360671.00000000007AE000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1281496264.00000000007BA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1281529307.00000000007C4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1281529307.00000000007C7000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1281529307.00000000007D5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1281529307.00000000007D7000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_700000_OC & PL.jbxd

Similarity

API ID: MessageSend$LongWindow_memset
String ID:
API String ID: 830647256-0
Opcode ID: 23a2f2755069402f60fc36cf0c6c1082173eef7874ce404900809d463c31975a
Instruction ID: d2dbf0501af2ed3d23f589b93356e3f8a007b5490e2829559f705191f2579a5a
Opcode Fuzzy Hash: 23a2f2755069402f60fc36cf0c6c1082173eef7874ce404900809d463c31975a
Instruction Fuzzy Hash: FF616C75A00208AFDB21DFA4CC81EEEB7B8EB09714F1441A9FA15A7292D778AD41DB50

Function 007394E1 Relevance: 16.6, APIs: 11, Instructions: 109memoryCOMMON

Download Yara Rule

APIs

SafeArrayAllocDescriptorEx.OLEAUT32(0000000C,00000000,?), ref: 007394FE
SafeArrayAllocData.OLEAUT32(?), ref: 00739549
VariantInit.OLEAUT32(?), ref: 0073955B
SafeArrayAccessData.OLEAUT32(?,?), ref: 0073957B
VariantCopy.OLEAUT32(?,?), ref: 007395BE
SafeArrayUnaccessData.OLEAUT32(?), ref: 007395D2
VariantClear.OLEAUT32(?), ref: 007395E7
SafeArrayDestroyData.OLEAUT32(?), ref: 007395F4
SafeArrayDestroyDescriptor.OLEAUT32(?), ref: 007395FD
VariantClear.OLEAUT32(?), ref: 0073960F
SafeArrayDestroyDescriptor.OLEAUT32(?), ref: 0073961A

Memory Dump Source

Source File: 00000000.00000002.1281263787.0000000000701000.00000020.00000001.01000000.00000003.sdmp, Offset: 00700000, based on PE: true

Associated: 00000000.00000002.1281243473.0000000000700000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1281360671.000000000078D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1281360671.00000000007AE000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1281496264.00000000007BA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1281529307.00000000007C4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1281529307.00000000007C7000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1281529307.00000000007D5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1281529307.00000000007D7000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_700000_OC & PL.jbxd

Similarity

API ID: ArraySafe$DataVariant$DescriptorDestroy$AllocClear$AccessCopyInitUnaccess
String ID:
API String ID: 2706829360-0
Opcode ID: f24f214b9095eefabb7e8ec928e8e12c973c08c9cbb31df600738043f400fb18
Instruction ID: 7028c16d207797babe2b7ef4c9ecdb4c8ce224c440a77bcd2f456797a4cd3b4b
Opcode Fuzzy Hash: f24f214b9095eefabb7e8ec928e8e12c973c08c9cbb31df600738043f400fb18
Instruction Fuzzy Hash: EB417131900219EFDB11EFA4DC489DEBB79FF08354F108065E945A3292DB78EA85CBA5

Function 0075BB08 Relevance: 16.0, APIs: 5, Strings: 4, Instructions: 264COMMON

Download Yara Rule

APIs

_memset.LIBCMT ref: 0075BB5C
VariantInit.OLEAUT32(?), ref: 0075BC2D
VariantInit.OLEAUT32(?), ref: 0075BD2E
VariantClear.OLEAUT32(?), ref: 0075BD38
VariantClear.OLEAUT32(?), ref: 0075BD99

Strings

Null Object assignment in FOR..IN loop, xrefs: 0075BBBD, 0075BCEB, 0075BDA7
h?{, xrefs: 0075BB2D
|?{, xrefs: 0075BB34
Incorrect Object type in FOR..IN loop, xrefs: 0075BD11

Memory Dump Source

Source File: 00000000.00000002.1281263787.0000000000701000.00000020.00000001.01000000.00000003.sdmp, Offset: 00700000, based on PE: true

Associated: 00000000.00000002.1281243473.0000000000700000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1281360671.000000000078D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1281360671.00000000007AE000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1281496264.00000000007BA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1281529307.00000000007C4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1281529307.00000000007C7000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1281529307.00000000007D5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1281529307.00000000007D7000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_700000_OC & PL.jbxd

Similarity

API ID: Variant$ClearInit$_memset
String ID: Incorrect Object type in FOR..IN loop$Null Object assignment in FOR..IN loop$h?{$|?{
API String ID: 2862541840-144167290
Opcode ID: dbd7d35111d8931ad505e34b7521014a457601c46b28bf49e5e49081fee089f3
Instruction ID: 2709af67ac282660bdd5baa8b1f61669be590d47efabfa01984737a4a0e13421
Opcode Fuzzy Hash: dbd7d35111d8931ad505e34b7521014a457601c46b28bf49e5e49081fee089f3
Instruction Fuzzy Hash: 03918F71A00219ABDF24DF95C848FFEB7B8EF45711F108159F915AB280DBB89949CFA0

Function 0075ADAE Relevance: 15.9, APIs: 6, Strings: 3, Instructions: 197comCOMMON

Download Yara Rule

APIs

Part of subcall function 0070936C: __swprintf.LIBCMT ref: 007093AB
Part of subcall function 0070936C: __itow.LIBCMT ref: 007093DF

CoInitialize.OLE32 ref: 0075ADF6
CoUninitialize.OLE32 ref: 0075AE01
CoCreateInstance.OLE32(?,00000000,00000017,0078D8FC,?), ref: 0075AE61
IIDFromString.OLE32(?,?), ref: 0075AED4
VariantInit.OLEAUT32(?), ref: 0075AF6E
VariantClear.OLEAUT32(?), ref: 0075AFCF

Strings

Failed to create object, xrefs: 0075AE6C, 0075AF22
Invalid parameter, xrefs: 0075AEED
NULL Pointer assignment, xrefs: 0075AEA6

Memory Dump Source

Source File: 00000000.00000002.1281263787.0000000000701000.00000020.00000001.01000000.00000003.sdmp, Offset: 00700000, based on PE: true

Associated: 00000000.00000002.1281243473.0000000000700000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1281360671.000000000078D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1281360671.00000000007AE000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1281496264.00000000007BA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1281529307.00000000007C4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1281529307.00000000007C7000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1281529307.00000000007D5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1281529307.00000000007D7000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_700000_OC & PL.jbxd

Similarity

API ID: Variant$ClearCreateFromInitInitializeInstanceStringUninitialize__itow__swprintf
String ID: Failed to create object$Invalid parameter$NULL Pointer assignment
API String ID: 834269672-1287834457
Opcode ID: 02e7488cebf88f2c3f932fb1081c68d8e9189a1276e75a24d03caeae67524cb2
Instruction ID: 338746b593cec3a6330d4c99eedee37702908ad28b26fa4312aa479ea4400061
Opcode Fuzzy Hash: 02e7488cebf88f2c3f932fb1081c68d8e9189a1276e75a24d03caeae67524cb2
Instruction Fuzzy Hash: E6619070608311EFD711DF54C84ABAAB7E8AF44715F104629F9859B2D1C7B8ED48CB93

Function 00758107 Relevance: 15.9, APIs: 8, Strings: 1, Instructions: 163networkfileCOMMON

Download Yara Rule

APIs

WSAStartup.WSOCK32(00000101,?), ref: 00758168
inet_addr.WSOCK32(?,?,?), ref: 007581AD
gethostbyname.WSOCK32(?), ref: 007581B9
IcmpCreateFile.IPHLPAPI ref: 007581C7
IcmpSendEcho.IPHLPAPI(?,?,?,00000005,00000000,?,00000029,00000FA0), ref: 00758237
IcmpSendEcho.IPHLPAPI(00000000,00000000,?,00000005,00000000,?,00000029,00000FA0), ref: 0075824D
IcmpCloseHandle.IPHLPAPI(00000000), ref: 007582C2
WSACleanup.WSOCK32 ref: 007582C8

Strings

Ping, xrefs: 007581EB

Memory Dump Source

Source File: 00000000.00000002.1281263787.0000000000701000.00000020.00000001.01000000.00000003.sdmp, Offset: 00700000, based on PE: true

Associated: 00000000.00000002.1281243473.0000000000700000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1281360671.000000000078D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1281360671.00000000007AE000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1281496264.00000000007BA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1281529307.00000000007C4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1281529307.00000000007C7000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1281529307.00000000007D5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1281529307.00000000007D7000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_700000_OC & PL.jbxd

Similarity

API ID: Icmp$EchoSend$CleanupCloseCreateFileHandleStartupgethostbynameinet_addr
String ID: Ping
API String ID: 1028309954-2246546115
Opcode ID: cd1dee94064fb451ecfc5e9a4cb4d659442f610b83c830b9167dcace6169de8b
Instruction ID: 746d4e74dbc31ebca2b065813f74421505c8a8f5411214028b66849ce4478f05
Opcode Fuzzy Hash: cd1dee94064fb451ecfc5e9a4cb4d659442f610b83c830b9167dcace6169de8b
Instruction Fuzzy Hash: B4519F316007009FD760AF24CC49BAABBE4BF48311F148919FA95EB2E1DB78EC45CB42

Function 0074E389 Relevance: 15.8, APIs: 4, Strings: 5, Instructions: 97COMMON

Download Yara Rule

APIs

SetErrorMode.KERNEL32(00000001), ref: 0074E396
GetDiskFreeSpaceW.KERNEL32(?,?,?,?,?,00000002,00000001), ref: 0074E40C
GetLastError.KERNEL32 ref: 0074E416
SetErrorMode.KERNEL32(00000000,READY), ref: 0074E483

Strings

UNKNOWN, xrefs: 0074E43B
READONLY, xrefs: 0074E44E
INVALID, xrefs: 0074E455
NOTREADY, xrefs: 0074E442
READY, xrefs: 0074E45C

Memory Dump Source

Source File: 00000000.00000002.1281263787.0000000000701000.00000020.00000001.01000000.00000003.sdmp, Offset: 00700000, based on PE: true

Associated: 00000000.00000002.1281243473.0000000000700000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1281360671.000000000078D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1281360671.00000000007AE000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1281496264.00000000007BA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1281529307.00000000007C4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1281529307.00000000007C7000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1281529307.00000000007D5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1281529307.00000000007D7000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_700000_OC & PL.jbxd

Similarity

API ID: Error$Mode$DiskFreeLastSpace
String ID: INVALID$NOTREADY$READONLY$READY$UNKNOWN
API String ID: 4194297153-14809454
Opcode ID: c593b6679fb4ba3ec24e3732ab77e2188038c88a8b4da95d832f694732e84244
Instruction ID: 508bf1384b59e092c2d7e9fbe9bada02a67026588f7b9336e7eb93138a491658
Opcode Fuzzy Hash: c593b6679fb4ba3ec24e3732ab77e2188038c88a8b4da95d832f694732e84244
Instruction Fuzzy Hash: E4318175A40249EFDB11EBA8C889AADBBB4FF04310F148125F505EB2D1DB789A41CB51

Function 0073B907 Relevance: 15.8, APIs: 7, Strings: 2, Instructions: 81windowCOMMON

Download Yara Rule

APIs

SendMessageW.USER32(?,0000018C,000000FF,00000002), ref: 0073B98C
GetDlgCtrlID.USER32 ref: 0073B997
GetParent.USER32 ref: 0073B9B3
SendMessageW.USER32(00000000,?,00000111,?), ref: 0073B9B6
GetDlgCtrlID.USER32(?), ref: 0073B9BF
GetParent.USER32(?), ref: 0073B9DB
SendMessageW.USER32(00000000,?,?,00000111), ref: 0073B9DE

Strings

ListBox, xrefs: 0073B949
ComboBox, xrefs: 0073B911

Memory Dump Source

Source File: 00000000.00000002.1281263787.0000000000701000.00000020.00000001.01000000.00000003.sdmp, Offset: 00700000, based on PE: true

Associated: 00000000.00000002.1281243473.0000000000700000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1281360671.000000000078D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1281360671.00000000007AE000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1281496264.00000000007BA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1281529307.00000000007C4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1281529307.00000000007C7000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1281529307.00000000007D5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1281529307.00000000007D7000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_700000_OC & PL.jbxd

Similarity

API ID: MessageSend$CtrlParent
String ID: ComboBox$ListBox
API String ID: 1383977212-1403004172
Opcode ID: 0771424eec3876971405f572a024ef33f79c5f9f144b48ea7a616410ae77c7e7
Instruction ID: 1cf988ea30f0ca8aa572d89124dc47dea79b32b7ee84efe7bb98271fabdb6f62
Opcode Fuzzy Hash: 0771424eec3876971405f572a024ef33f79c5f9f144b48ea7a616410ae77c7e7
Instruction Fuzzy Hash: BE21C1B4A40108EFDB05ABA0DC86EFEBBB4EB49300F104219FA51932E2DB7C58159B24

Function 0073B9F0 Relevance: 15.8, APIs: 7, Strings: 2, Instructions: 80windowCOMMON

Download Yara Rule

APIs

SendMessageW.USER32(?,00000186,00000002,00000000), ref: 0073BA73
GetDlgCtrlID.USER32 ref: 0073BA7E
GetParent.USER32 ref: 0073BA9A
SendMessageW.USER32(00000000,?,00000111,?), ref: 0073BA9D
GetDlgCtrlID.USER32(?), ref: 0073BAA6
GetParent.USER32(?), ref: 0073BAC2
SendMessageW.USER32(00000000,?,?,00000111), ref: 0073BAC5

Strings

ListBox, xrefs: 0073BA32
ComboBox, xrefs: 0073B9FA

Memory Dump Source

Source File: 00000000.00000002.1281263787.0000000000701000.00000020.00000001.01000000.00000003.sdmp, Offset: 00700000, based on PE: true

Associated: 00000000.00000002.1281243473.0000000000700000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1281360671.000000000078D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1281360671.00000000007AE000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1281496264.00000000007BA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1281529307.00000000007C4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1281529307.00000000007C7000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1281529307.00000000007D5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1281529307.00000000007D7000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_700000_OC & PL.jbxd

Similarity

API ID: MessageSend$CtrlParent
String ID: ComboBox$ListBox
API String ID: 1383977212-1403004172
Opcode ID: 2bd784a5f1e329f4e5e631a28837498414aee9cf399310aa1c31dbd05c3875b0
Instruction ID: 8824702f67859d08d45f4980bb774cc6afaf9343241c58d99efd961acca2db7a
Opcode Fuzzy Hash: 2bd784a5f1e329f4e5e631a28837498414aee9cf399310aa1c31dbd05c3875b0
Instruction Fuzzy Hash: 6621C5B4A40108FFDB11ABA4DC85EFEB7B5EF45300F108215F951932D2EB7D59199B24

Function 0073BAD7 Relevance: 15.8, APIs: 4, Strings: 5, Instructions: 71windowCOMMON

Download Yara Rule

APIs

GetParent.USER32 ref: 0073BAE3
GetClassNameW.USER32(00000000,?,00000100), ref: 0073BAF8
_wcscmp.LIBCMT ref: 0073BB0A
SendMessageW.USER32(00000000,00000111,0000702B,00000000), ref: 0073BB85

Strings

SHELLDLL_DefView, xrefs: 0073BB04
smallicons, xrefs: 0073BB4D
details, xrefs: 0073BB33
largeicons, xrefs: 0073BB19
list, xrefs: 0073BB67

Memory Dump Source

Source File: 00000000.00000002.1281263787.0000000000701000.00000020.00000001.01000000.00000003.sdmp, Offset: 00700000, based on PE: true

Associated: 00000000.00000002.1281243473.0000000000700000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1281360671.000000000078D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1281360671.00000000007AE000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1281496264.00000000007BA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1281529307.00000000007C4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1281529307.00000000007C7000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1281529307.00000000007D5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1281529307.00000000007D7000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_700000_OC & PL.jbxd

Similarity

API ID: ClassMessageNameParentSend_wcscmp
String ID: SHELLDLL_DefView$details$largeicons$list$smallicons
API String ID: 1704125052-3381328864
Opcode ID: ffd8c4f7a1dd2765e66385db4128d6ae77d4594bb38cdc01b76589ff7db1535e
Instruction ID: d80cabf69d28909373dccfe9c632e0f699ad9656c17a4ca7d309484d4839dff8
Opcode Fuzzy Hash: ffd8c4f7a1dd2765e66385db4128d6ae77d4594bb38cdc01b76589ff7db1535e
Instruction Fuzzy Hash: CB1106F6688317FAFA206634EC1BEA6B79C9F11360F204022FA14E40D7FFAD68214564

Function 0075B2A9 Relevance: 15.3, APIs: 10, Instructions: 324fileCOMMON

Download Yara Rule

APIs

VariantInit.OLEAUT32(?), ref: 0075B2D5
CoInitialize.OLE32(00000000), ref: 0075B302
CoUninitialize.OLE32 ref: 0075B30C
GetRunningObjectTable.OLE32(00000000,?), ref: 0075B40C
SetErrorMode.KERNEL32(00000001,00000029), ref: 0075B539
CoGetInstanceFromFile.OLE32(00000000,?,00000000,00000015,00000002), ref: 0075B56D
CoGetObject.OLE32(?,00000000,0078D91C,?), ref: 0075B590
SetErrorMode.KERNEL32(00000000), ref: 0075B5A3
SetErrorMode.KERNEL32(00000000,00000000,00000000,00000000,00000000), ref: 0075B623
VariantClear.OLEAUT32(0078D91C), ref: 0075B633

Memory Dump Source

Source File: 00000000.00000002.1281263787.0000000000701000.00000020.00000001.01000000.00000003.sdmp, Offset: 00700000, based on PE: true

Associated: 00000000.00000002.1281243473.0000000000700000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1281360671.000000000078D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1281360671.00000000007AE000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1281496264.00000000007BA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1281529307.00000000007C4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1281529307.00000000007C7000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1281529307.00000000007D5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1281529307.00000000007D7000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_700000_OC & PL.jbxd

Similarity

API ID: ErrorMode$ObjectVariant$ClearFileFromInitInitializeInstanceRunningTableUninitialize
String ID:
API String ID: 2395222682-0
Opcode ID: 5189a24b1aac59074c6aa62e32ee97fdfd6d0ee0607eb128ee91c3f24f6d5264
Instruction ID: 7b04f0ac90d5a1cc8e87b7f0b8258bdfc50a785a6ea4e4203d4c87f8b8f8b236
Opcode Fuzzy Hash: 5189a24b1aac59074c6aa62e32ee97fdfd6d0ee0607eb128ee91c3f24f6d5264
Instruction Fuzzy Hash: C0C113B1608305EFC714DF68C88496AB7E9FF88305F10491DF98A9B251DBB9ED09CB52

Function 00744025 Relevance: 15.1, APIs: 10, Instructions: 88threadCOMMON

Download Yara Rule

APIs

GetCurrentThreadId.KERNEL32 ref: 00744047
GetForegroundWindow.USER32(00000000,?,?,?,?,?,007430A5,?,00000001), ref: 0074405B
GetWindowThreadProcessId.USER32(00000000), ref: 00744062
AttachThreadInput.USER32(00000000,00000000,00000001,?,?,?,?,?,007430A5,?,00000001), ref: 00744071
GetWindowThreadProcessId.USER32(?,00000000), ref: 00744083
AttachThreadInput.USER32(?,00000000,00000001,?,?,?,?,?,007430A5,?,00000001), ref: 0074409C
AttachThreadInput.USER32(00000000,00000000,00000001,?,?,?,?,?,007430A5,?,00000001), ref: 007440AE
AttachThreadInput.USER32(00000000,00000000,?,?,?,?,?,007430A5,?,00000001), ref: 007440F3
AttachThreadInput.USER32(?,?,00000000,?,?,?,?,?,007430A5,?,00000001), ref: 00744108
AttachThreadInput.USER32(00000000,?,00000000,?,?,?,?,?,007430A5,?,00000001), ref: 00744113

Memory Dump Source

Source File: 00000000.00000002.1281263787.0000000000701000.00000020.00000001.01000000.00000003.sdmp, Offset: 00700000, based on PE: true

Associated: 00000000.00000002.1281243473.0000000000700000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1281360671.000000000078D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1281360671.00000000007AE000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1281496264.00000000007BA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1281529307.00000000007C4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1281529307.00000000007C7000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1281529307.00000000007D5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1281529307.00000000007D7000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_700000_OC & PL.jbxd

Similarity

API ID: Thread$AttachInput$Window$Process$CurrentForeground
String ID:
API String ID: 2156557900-0
Opcode ID: de22e315ca6afd8f3b027b252a9c9beaa9a1c270e845ba5b7aad8ae1ca3bde90
Instruction ID: 15ed10e051123354c5d77c0a91b1c6a198365eb247713aa1be53bf8593910adb
Opcode Fuzzy Hash: de22e315ca6afd8f3b027b252a9c9beaa9a1c270e845ba5b7aad8ae1ca3bde90
Instruction Fuzzy Hash: D6314F71640208ABDB30EB54DC89FAD77B9AB58351F21C119F905E62E0DBBCDD809B68

Function 00703093 Relevance: 14.2, APIs: 7, Strings: 1, Instructions: 210COMMON

Download Yara Rule

APIs

mciSendStringW.WINMM(close all,00000000,00000000,00000000), ref: 007030DC
CoUninitialize.OLE32(?,00000000), ref: 00703181
UnregisterHotKey.USER32(?), ref: 007032A9
DestroyWindow.USER32(?), ref: 00775079
FreeLibrary.KERNEL32(?), ref: 007750F8
VirtualFree.KERNEL32(?,00000000,00008000), ref: 00775125

Strings

close all, xrefs: 007030D7

Memory Dump Source

Source File: 00000000.00000002.1281263787.0000000000701000.00000020.00000001.01000000.00000003.sdmp, Offset: 00700000, based on PE: true

Associated: 00000000.00000002.1281243473.0000000000700000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1281360671.000000000078D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1281360671.00000000007AE000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1281496264.00000000007BA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1281529307.00000000007C4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1281529307.00000000007C7000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1281529307.00000000007D5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1281529307.00000000007D7000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_700000_OC & PL.jbxd

Similarity

API ID: Free$DestroyLibrarySendStringUninitializeUnregisterVirtualWindow
String ID: close all
API String ID: 469580280-3243417748
Opcode ID: 6c077d4ec7aa205f1ee93a95e01c588d777ea3751332b903a77faca97015909c
Instruction ID: 781f83b0978b8c5bc33e5a128f88b02fb048126f5712103534281eeb44426477
Opcode Fuzzy Hash: 6c077d4ec7aa205f1ee93a95e01c588d777ea3751332b903a77faca97015909c
Instruction Fuzzy Hash: 94913D74600206CFC715EF24C899E68F3E8FF14304F5482A9E50A672A2DF38AE66CF54

Function 0071CB8D Relevance: 14.2, APIs: 7, Strings: 1, Instructions: 185windowCOMMON

Download Yara Rule

APIs

SetWindowLongW.USER32(?,000000EB), ref: 0071CC15

Part of subcall function 0071CCCD: GetClientRect.USER32(?,?), ref: 0071CCF6
Part of subcall function 0071CCCD: GetWindowRect.USER32(?,?), ref: 0071CD37
Part of subcall function 0071CCCD: ScreenToClient.USER32(?,?), ref: 0071CD5F

GetDC.USER32 ref: 0077D137
SendMessageW.USER32(?,00000031,00000000,00000000), ref: 0077D14A
SelectObject.GDI32(00000000,00000000), ref: 0077D158
SelectObject.GDI32(00000000,00000000), ref: 0077D16D
ReleaseDC.USER32(?,00000000), ref: 0077D175
MoveWindow.USER32(?,?,?,?,?,?,?,00000031,00000000,00000000), ref: 0077D200

Strings

U, xrefs: 0077D0D5

Memory Dump Source

Source File: 00000000.00000002.1281263787.0000000000701000.00000020.00000001.01000000.00000003.sdmp, Offset: 00700000, based on PE: true

Associated: 00000000.00000002.1281243473.0000000000700000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1281360671.000000000078D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1281360671.00000000007AE000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1281496264.00000000007BA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1281529307.00000000007C4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1281529307.00000000007C7000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1281529307.00000000007D5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1281529307.00000000007D7000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_700000_OC & PL.jbxd

Similarity

API ID: Window$ClientObjectRectSelect$LongMessageMoveReleaseScreenSend
String ID: U
API String ID: 4009187628-3372436214
Opcode ID: c2cc942bb7b99d999248fef43a75f330c866ad21433b3c25ae9b7617ba2a336d
Instruction ID: 6052a0cb6e1e5c3f4d0d0901fb6090b2f8ae917c4d0db213297a55cb495f63e2
Opcode Fuzzy Hash: c2cc942bb7b99d999248fef43a75f330c866ad21433b3c25ae9b7617ba2a336d
Instruction Fuzzy Hash: 0771D430500209DFCF319F68CC85AEA7BB5FF49394F248269ED59962A6D7398C81DF60

Function 0076ECD4 Relevance: 14.1, APIs: 6, Strings: 2, Instructions: 149windowCOMMON

Download Yara Rule

APIs

Part of subcall function 0071B34E: GetWindowLongW.USER32(?,000000EB), ref: 0071B35F

Part of subcall function 0071B63C: GetCursorPos.USER32(000000FF), ref: 0071B64F
Part of subcall function 0071B63C: ScreenToClient.USER32(00000000,000000FF), ref: 0071B66C
Part of subcall function 0071B63C: GetAsyncKeyState.USER32(00000001), ref: 0071B691
Part of subcall function 0071B63C: GetAsyncKeyState.USER32(00000002), ref: 0071B69F

ImageList_DragLeave.COMCTL32(00000000,00000000,00000001,?,?,?), ref: 0076ED3C
ImageList_EndDrag.COMCTL32 ref: 0076ED42
ReleaseCapture.USER32 ref: 0076ED48
SetWindowTextW.USER32(?,00000000), ref: 0076EDF0
SendMessageW.USER32(?,000000B1,00000000,000000FF), ref: 0076EE03
DefDlgProcW.USER32(?,00000202,?,?,00000000,00000001,?,?,?), ref: 0076EEDC

Strings

@GUI_DRAGFILE, xrefs: 0076EE77
@GUI_DROPID, xrefs: 0076EE33

Memory Dump Source

Source File: 00000000.00000002.1281263787.0000000000701000.00000020.00000001.01000000.00000003.sdmp, Offset: 00700000, based on PE: true

Associated: 00000000.00000002.1281243473.0000000000700000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1281360671.000000000078D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1281360671.00000000007AE000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1281496264.00000000007BA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1281529307.00000000007C4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1281529307.00000000007C7000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1281529307.00000000007D5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1281529307.00000000007D7000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_700000_OC & PL.jbxd

Similarity

API ID: AsyncDragImageList_StateWindow$CaptureClientCursorLeaveLongMessageProcReleaseScreenSendText
String ID: @GUI_DRAGFILE$@GUI_DROPID
API String ID: 1924731296-2107944366
Opcode ID: 3454cfdc1d20b021fa39b8ab9c508a412268962de74b5c1d47ef28e5b90de789
Instruction ID: bf8341c983664f30d0e3a12c8741c409e4d08ab8ede63ed5e58c2002fad92c76
Opcode Fuzzy Hash: 3454cfdc1d20b021fa39b8ab9c508a412268962de74b5c1d47ef28e5b90de789
Instruction Fuzzy Hash: B751CD74204300EFD710EF10CC5AFAA37E4EB88704F408A2DF956972E2DB799954CB62

Function 007545C4 Relevance: 14.1, APIs: 7, Strings: 1, Instructions: 133networkCOMMON

Download Yara Rule

APIs

InternetConnectW.WININET(?,?,?,?,?,?,00000000,00000000), ref: 007545FF
HttpOpenRequestW.WININET(00000000,00000000,?,00000000,00000000,00000000,?,00000000), ref: 0075462B
InternetQueryOptionW.WININET(00000000,0000001F,00000000,?), ref: 0075466D
InternetSetOptionW.WININET(00000000,0000001F,00000100,00000004), ref: 00754682
HttpSendRequestW.WININET(00000000,00000000,00000000,00000000,00000000), ref: 0075468F
HttpQueryInfoW.WININET(00000000,00000005,?,?,00000000), ref: 007546BF
InternetCloseHandle.WININET(00000000), ref: 00754706

Part of subcall function 00755052: GetLastError.KERNEL32(?,?,007543CC,00000000,00000000,00000001), ref: 00755067

Strings

, xrefs: 007546B8

Memory Dump Source

Source File: 00000000.00000002.1281263787.0000000000701000.00000020.00000001.01000000.00000003.sdmp, Offset: 00700000, based on PE: true

Associated: 00000000.00000002.1281243473.0000000000700000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1281360671.000000000078D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1281360671.00000000007AE000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1281496264.00000000007BA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1281529307.00000000007C4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1281529307.00000000007C7000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1281529307.00000000007D5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1281529307.00000000007D7000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_700000_OC & PL.jbxd

Similarity

API ID: Internet$Http$OptionQueryRequest$CloseConnectErrorHandleInfoLastOpenSend
String ID:
API String ID: 1241431887-3916222277
Opcode ID: 7f546cb77348a9c0f8bfe8cac7aed87039fd25bd128fa2a7441e02508b311213
Instruction ID: 366658ae8f23a009f80e9088769535b8ae432d337d3f526444f00250bcffc0b7
Opcode Fuzzy Hash: 7f546cb77348a9c0f8bfe8cac7aed87039fd25bd128fa2a7441e02508b311213
Instruction Fuzzy Hash: BA416DB1541205BFEB119F60CC89FEA77ACEF09319F108116FE059A185E7B89D898BA4

Function 0075B644 Relevance: 13.9, APIs: 9, Instructions: 432COMMON

Download Yara Rule

APIs

GetModuleFileNameW.KERNEL32(?,?,00000104,?,0079DC00), ref: 0075B715
FreeLibrary.KERNEL32(00000000,00000001,00000000,?,0079DC00), ref: 0075B749
QueryPathOfRegTypeLib.OLEAUT32(?,?,?,?,?), ref: 0075B8C1
SysFreeString.OLEAUT32(?), ref: 0075B8EB

Memory Dump Source

Source File: 00000000.00000002.1281263787.0000000000701000.00000020.00000001.01000000.00000003.sdmp, Offset: 00700000, based on PE: true

Associated: 00000000.00000002.1281243473.0000000000700000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1281360671.000000000078D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1281360671.00000000007AE000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1281496264.00000000007BA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1281529307.00000000007C4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1281529307.00000000007C7000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1281529307.00000000007D5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1281529307.00000000007D7000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_700000_OC & PL.jbxd

Similarity

API ID: Free$FileLibraryModuleNamePathQueryStringType
String ID:
API String ID: 560350794-0
Opcode ID: 0f626796ecf18644bb3449b50a257353ee564c7048dbd8052923703d88f81f56
Instruction ID: c01c85dd2d913a9cb85949f7b016800f8e2387b4da20072361c51a982cde0a03
Opcode Fuzzy Hash: 0f626796ecf18644bb3449b50a257353ee564c7048dbd8052923703d88f81f56
Instruction Fuzzy Hash: 07F10671A00209EFDB14DF94C888EEEB7B9FF48315F108559F905AB250DB75AE49CB90

Function 007624D4 Relevance: 13.9, APIs: 9, Instructions: 376processCOMMON

Download Yara Rule

APIs

_memset.LIBCMT ref: 007624F5
GetSystemDirectoryW.KERNEL32(00000000,00000000), ref: 00762688
GetSystemDirectoryW.KERNEL32(00000000,00000000), ref: 007626AC
GetCurrentDirectoryW.KERNEL32(00000000,00000000), ref: 007626EC
GetCurrentDirectoryW.KERNEL32(00000000,00000000), ref: 0076270E
CreateProcessW.KERNEL32(00000000,?,00000000,00000000,?,?,00000000,?,?,?), ref: 0076286F
GetLastError.KERNEL32(00000000,00000001,00000000), ref: 007628A1
CloseHandle.KERNEL32(?), ref: 007628D0
CloseHandle.KERNEL32(?), ref: 00762947

Memory Dump Source

Source File: 00000000.00000002.1281263787.0000000000701000.00000020.00000001.01000000.00000003.sdmp, Offset: 00700000, based on PE: true

Associated: 00000000.00000002.1281243473.0000000000700000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1281360671.000000000078D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1281360671.00000000007AE000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1281496264.00000000007BA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1281529307.00000000007C4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1281529307.00000000007C7000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1281529307.00000000007D5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1281529307.00000000007D7000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_700000_OC & PL.jbxd

Similarity

API ID: Directory$CloseCurrentHandleSystem$CreateErrorLastProcess_memset
String ID:
API String ID: 4090791747-0
Opcode ID: 425a85f223c50ff7aaecbfc974ea398d128ce247ef1304dd3d1d02ef883a235b
Instruction ID: 3ddb450b3d3f1c0a9f03f2af56b716a84a5b300ccfb2a25947653e123f60b4b8
Opcode Fuzzy Hash: 425a85f223c50ff7aaecbfc974ea398d128ce247ef1304dd3d1d02ef883a235b
Instruction Fuzzy Hash: 24D1CE31604701DFCB25EF24C895A6ABBE5BF84310F14855DF98A9B2E2DB39EC41CB52

Function 0076B33A Relevance: 13.7, APIs: 9, Instructions: 167COMMON

Download Yara Rule

APIs

InvalidateRect.USER32(?,00000000,00000001,?,00000001), ref: 0076B3F4

Memory Dump Source

Source File: 00000000.00000002.1281263787.0000000000701000.00000020.00000001.01000000.00000003.sdmp, Offset: 00700000, based on PE: true

Associated: 00000000.00000002.1281243473.0000000000700000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1281360671.000000000078D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1281360671.00000000007AE000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1281496264.00000000007BA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1281529307.00000000007C4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1281529307.00000000007C7000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1281529307.00000000007D5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1281529307.00000000007D7000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_700000_OC & PL.jbxd

Similarity

API ID: InvalidateRect
String ID:
API String ID: 634782764-0
Opcode ID: abdb3e0c3d625ceb70441312bf77af9651dcc766113c384f2c57aef333cfab19
Instruction ID: c98c52b3f61c7e7faef66b862d67cff0bed603323e5f5e6bbee5103ad4ff066b
Opcode Fuzzy Hash: abdb3e0c3d625ceb70441312bf77af9651dcc766113c384f2c57aef333cfab19
Instruction Fuzzy Hash: C8518031640204FAEF309B29CC89BA93F64EB06354F644115FE16E62E2DB79E9D08B51

Function 0071A699 Relevance: 13.7, APIs: 9, Instructions: 163windowCOMMON

Download Yara Rule

APIs

LoadImageW.USER32(00000000,?,00000001,00000010,00000010,00000010), ref: 0077DB1B
ExtractIconExW.SHELL32(?,00000000,00000000,00000000,00000001), ref: 0077DB3C
LoadImageW.USER32(00000000,?,00000001,00000000,00000000,00000050), ref: 0077DB51
ExtractIconExW.SHELL32(?,00000000,?,00000000,00000001), ref: 0077DB6E
SendMessageW.USER32(00000000,00000080,00000000,00000000), ref: 0077DB95
DestroyIcon.USER32(00000000,?,?,?,?,?,?,0071A67C,00000000,00000000,00000000,000000FF,00000000,000000FF,000000FF), ref: 0077DBA0
SendMessageW.USER32(00000000,00000080,00000001,00000000), ref: 0077DBBD
DestroyIcon.USER32(00000000,?,?,?,?,?,?,0071A67C,00000000,00000000,00000000,000000FF,00000000,000000FF,000000FF), ref: 0077DBC8

Memory Dump Source

Source File: 00000000.00000002.1281263787.0000000000701000.00000020.00000001.01000000.00000003.sdmp, Offset: 00700000, based on PE: true

Associated: 00000000.00000002.1281243473.0000000000700000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1281360671.000000000078D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1281360671.00000000007AE000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1281496264.00000000007BA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1281529307.00000000007C4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1281529307.00000000007C7000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1281529307.00000000007D5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1281529307.00000000007D7000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_700000_OC & PL.jbxd

Similarity

API ID: Icon$DestroyExtractImageLoadMessageSend
String ID:
API String ID: 1268354404-0
Opcode ID: d6cdc022233307da90ce3a6aa123e7b048582344e92ab1401c8a77d1b95f3c50
Instruction ID: d38fca9c9bea1f2390cef0198ff36eb7c6b9dfcc2305191197f69d32d4be85b0
Opcode Fuzzy Hash: d6cdc022233307da90ce3a6aa123e7b048582344e92ab1401c8a77d1b95f3c50
Instruction Fuzzy Hash: CD517A70600208EFDB20DF68CC85FAA37B5EF48750F108529F94AA62E1D7B8AD90CB50

Function 00747555 Relevance: 13.6, APIs: 9, Instructions: 142filestringCOMMON

Download Yara Rule

APIs

Part of subcall function 00746EBB: GetFullPathNameW.KERNEL32(00000000,00007FFF,?,?,?,?,?,?,00745FA6,?), ref: 00746ED8

Part of subcall function 00746EBB: GetFullPathNameW.KERNEL32(?,00007FFF,?,?,?,?,?,00745FA6,?), ref: 00746EF1

Part of subcall function 007472CB: GetFileAttributesW.KERNEL32(?,00746019), ref: 007472CC

lstrcmpiW.KERNEL32(?,?), ref: 007475CA
_wcscmp.LIBCMT ref: 007475E2
MoveFileW.KERNEL32(?,?), ref: 007475FB

Memory Dump Source

Source File: 00000000.00000002.1281263787.0000000000701000.00000020.00000001.01000000.00000003.sdmp, Offset: 00700000, based on PE: true

Associated: 00000000.00000002.1281243473.0000000000700000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1281360671.000000000078D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1281360671.00000000007AE000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1281496264.00000000007BA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1281529307.00000000007C4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1281529307.00000000007C7000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1281529307.00000000007D5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1281529307.00000000007D7000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_700000_OC & PL.jbxd

Similarity

API ID: FileFullNamePath$AttributesMove_wcscmplstrcmpi
String ID:
API String ID: 793581249-0
Opcode ID: 9e0c6cca253ef7112ae8febcc95aa3ac92d26a569511878a371fb1cb82bb4b0e
Instruction ID: 4f317a297694d6494ba6844f0f2cc6ab6551cf47216d0a4b16ea70ba83c05116
Opcode Fuzzy Hash: 9e0c6cca253ef7112ae8febcc95aa3ac92d26a569511878a371fb1cb82bb4b0e
Instruction Fuzzy Hash: EA5131B2A492299FDF64EB94E845DDE73BCAF08310B5040AAF605E3141EB7897C5CB74

Function 0071EA69 Relevance: 13.6, APIs: 9, Instructions: 135COMMON

Download Yara Rule

APIs

ShowWindow.USER32(00000000,000000FF,00000000,00000000,00000000,?,0077DAD1,00000004,00000000,00000000), ref: 0071EAEB
ShowWindow.USER32(00000000,00000000,00000000,00000000,00000000,?,0077DAD1,00000004,00000000,00000000), ref: 0071EB32
ShowWindow.USER32(00000000,00000006,00000000,00000000,00000000,?,0077DAD1,00000004,00000000,00000000), ref: 0077DC86
ShowWindow.USER32(00000000,000000FF,00000000,00000000,00000000,?,0077DAD1,00000004,00000000,00000000), ref: 0077DCF2

Memory Dump Source

Source File: 00000000.00000002.1281263787.0000000000701000.00000020.00000001.01000000.00000003.sdmp, Offset: 00700000, based on PE: true

Associated: 00000000.00000002.1281243473.0000000000700000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1281360671.000000000078D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1281360671.00000000007AE000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1281496264.00000000007BA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1281529307.00000000007C4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1281529307.00000000007C7000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1281529307.00000000007D5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1281529307.00000000007D7000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_700000_OC & PL.jbxd

Similarity

API ID: ShowWindow
String ID:
API String ID: 1268545403-0
Opcode ID: daf7a85028efe5cfed2ec75808e544975e57ed3d649395d494dc63a88cf725b9
Instruction ID: 87c074bde7eb43af926a73a111a4e537d664cf9e342e2399b0135ab0c9e80c09
Opcode Fuzzy Hash: daf7a85028efe5cfed2ec75808e544975e57ed3d649395d494dc63a88cf725b9
Instruction Fuzzy Hash: E141D6B020D280DEDB39472C8D8DEBA7BA6AF41354F19841DE84B429E1D67C6CC0D321

Function 0073B263 Relevance: 13.5, APIs: 9, Instructions: 49memorythreadCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32(00000008,0000000C,00000000,00000000,?,0073AEF1,00000B00,?,?), ref: 0073B26C
HeapAlloc.KERNEL32(00000000,?,0073AEF1,00000B00,?,?), ref: 0073B273
GetCurrentProcess.KERNEL32(00000000,00000000,00000000,00000002,?,0073AEF1,00000B00,?,?), ref: 0073B288
GetCurrentProcess.KERNEL32(?,00000000,?,0073AEF1,00000B00,?,?), ref: 0073B290
DuplicateHandle.KERNEL32(00000000,?,0073AEF1,00000B00,?,?), ref: 0073B293
GetCurrentProcess.KERNEL32(00000008,00000000,00000000,00000002,?,0073AEF1,00000B00,?,?), ref: 0073B2A3
GetCurrentProcess.KERNEL32(0073AEF1,00000000,?,0073AEF1,00000B00,?,?), ref: 0073B2AB
DuplicateHandle.KERNEL32(00000000,?,0073AEF1,00000B00,?,?), ref: 0073B2AE
CreateThread.KERNEL32(00000000,00000000,0073B2D4,00000000,00000000,00000000), ref: 0073B2C8

Memory Dump Source

Source File: 00000000.00000002.1281263787.0000000000701000.00000020.00000001.01000000.00000003.sdmp, Offset: 00700000, based on PE: true

Associated: 00000000.00000002.1281243473.0000000000700000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1281360671.000000000078D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1281360671.00000000007AE000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1281496264.00000000007BA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1281529307.00000000007C4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1281529307.00000000007C7000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1281529307.00000000007D5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1281529307.00000000007D7000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_700000_OC & PL.jbxd

Similarity

API ID: Process$Current$DuplicateHandleHeap$AllocCreateThread
String ID:
API String ID: 1957940570-0
Opcode ID: 3a3886bf5e53e06f3c1577b7310245b64b7885fd850426e25a50e843eb77b858
Instruction ID: 46f9aba60914d87e2a3eb56dfe5d5441367f9cc7b45d72b731a02fa416efe995
Opcode Fuzzy Hash: 3a3886bf5e53e06f3c1577b7310245b64b7885fd850426e25a50e843eb77b858
Instruction Fuzzy Hash: 7B01BFB5680308BFE720ABA5EC4DF5B7BACEB88711F118411FA05DB1D1C6B49C00CB65

Function 0075C43F Relevance: 12.7, APIs: 5, Strings: 2, Instructions: 401COMMON

Download Yara Rule

Strings

NULL Pointer assignment, xrefs: 0075C876, 0075C887
Not an Object type, xrefs: 0075C49E

Memory Dump Source

Source File: 00000000.00000002.1281263787.0000000000701000.00000020.00000001.01000000.00000003.sdmp, Offset: 00700000, based on PE: true

Associated: 00000000.00000002.1281243473.0000000000700000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1281360671.000000000078D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1281360671.00000000007AE000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1281496264.00000000007BA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1281529307.00000000007C4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1281529307.00000000007C7000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1281529307.00000000007D5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1281529307.00000000007D7000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_700000_OC & PL.jbxd

Similarity

API ID:
String ID: NULL Pointer assignment$Not an Object type
API String ID: 0-572801152
Opcode ID: 2fc627ead54b3c6480d6bcd21b712f538c37703cac03b20d27ef5a3968ca17bf
Instruction ID: 88e61f82d24e4627c98e34b74003ab86c82b68b7a357557b1d47499e37dcfc56
Opcode Fuzzy Hash: 2fc627ead54b3c6480d6bcd21b712f538c37703cac03b20d27ef5a3968ca17bf
Instruction Fuzzy Hash: FFE1D171A00319AFDF11DFA4C884BEE77B5EB48315F148429ED05AB281E7B8AD49CB90

Function 007516DA Relevance: 12.6, APIs: 5, Strings: 2, Instructions: 309COMMON

Download Yara Rule

APIs

Part of subcall function 0070936C: __swprintf.LIBCMT ref: 007093AB
Part of subcall function 0070936C: __itow.LIBCMT ref: 007093DF

Part of subcall function 0071C6F4: _wcscpy.LIBCMT ref: 0071C717

_wcstok.LIBCMT ref: 0075184E
_wcscpy.LIBCMT ref: 007518DD
_memset.LIBCMT ref: 00751910

Strings

X, xrefs: 00751948
p2{l2{, xrefs: 00751920

Memory Dump Source

Source File: 00000000.00000002.1281263787.0000000000701000.00000020.00000001.01000000.00000003.sdmp, Offset: 00700000, based on PE: true

Associated: 00000000.00000002.1281243473.0000000000700000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1281360671.000000000078D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1281360671.00000000007AE000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1281496264.00000000007BA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1281529307.00000000007C4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1281529307.00000000007C7000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1281529307.00000000007D5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1281529307.00000000007D7000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_700000_OC & PL.jbxd

Similarity

API ID: _wcscpy$__itow__swprintf_memset_wcstok
String ID: X$p2{l2{
API String ID: 774024439-3749979566
Opcode ID: 8408f64f074b88b9501810ca1b8d6a8919f1ed3be3a696b69755803f85321ae0
Instruction ID: d10337190c240dde9a4d7d527f4dd1bf850ab8d53f0b5cfc9d5296d938edb974
Opcode Fuzzy Hash: 8408f64f074b88b9501810ca1b8d6a8919f1ed3be3a696b69755803f85321ae0
Instruction Fuzzy Hash: EDC19271504340DFC724EF64C899B9AB7E4BF85351F408A2DF889972A2DB78ED45CB82

Function 00769A75 Relevance: 12.4, APIs: 6, Strings: 1, Instructions: 142windowCOMMON

Download Yara Rule

APIs

SendMessageW.USER32(00000000,00001036,00000010,00000010), ref: 00769B19
SendMessageW.USER32(?,00001036,00000000,?), ref: 00769B2D
SetWindowPos.USER32(?,00000000,00000000,00000000,00000000,00000000,00000013), ref: 00769B47
_wcscat.LIBCMT ref: 00769BA2
SendMessageW.USER32(?,00001057,00000000,?), ref: 00769BB9
SendMessageW.USER32(?,00001061,?,0000000F), ref: 00769BE7

Strings

SysListView32, xrefs: 00769AEB

Memory Dump Source

Source File: 00000000.00000002.1281263787.0000000000701000.00000020.00000001.01000000.00000003.sdmp, Offset: 00700000, based on PE: true

Associated: 00000000.00000002.1281243473.0000000000700000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1281360671.000000000078D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1281360671.00000000007AE000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1281496264.00000000007BA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1281529307.00000000007C4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1281529307.00000000007C7000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1281529307.00000000007D5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1281529307.00000000007D7000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_700000_OC & PL.jbxd

Similarity

API ID: MessageSend$Window_wcscat
String ID: SysListView32
API String ID: 307300125-78025650
Opcode ID: b3b3a9245135d7bd828cd0ea59f7a0781fa103d4bdf6d4f33467706d467d7de3
Instruction ID: b63924de1636d8e45987bd469620560e6095e1ef5632480a8c9102154ff494b1
Opcode Fuzzy Hash: b3b3a9245135d7bd828cd0ea59f7a0781fa103d4bdf6d4f33467706d467d7de3
Instruction Fuzzy Hash: F3418371940308EFDB219FA4DC85FEA77A8EB08350F10452AFA4AA7291D6799D84CB64

Function 0076172F Relevance: 12.4, APIs: 6, Strings: 1, Instructions: 135COMMON

Download Yara Rule

APIs

Part of subcall function 00746532: CreateToolhelp32Snapshot.KERNEL32(00000002,00000000,?,00000000), ref: 00746554
Part of subcall function 00746532: Process32FirstW.KERNEL32(00000000,0000022C), ref: 00746564
Part of subcall function 00746532: CloseHandle.KERNEL32(00000000,?,00000000), ref: 007465F9

OpenProcess.KERNEL32(00000001,00000000,?), ref: 0076179A
GetLastError.KERNEL32 ref: 007617AD
OpenProcess.KERNEL32(00000001,00000000,?), ref: 007617D9
TerminateProcess.KERNEL32(00000000,00000000), ref: 00761855
GetLastError.KERNEL32(00000000), ref: 00761860
CloseHandle.KERNEL32(00000000), ref: 00761895

Strings

SeDebugPrivilege, xrefs: 007617B8

Memory Dump Source

Source File: 00000000.00000002.1281263787.0000000000701000.00000020.00000001.01000000.00000003.sdmp, Offset: 00700000, based on PE: true

Associated: 00000000.00000002.1281243473.0000000000700000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1281360671.000000000078D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1281360671.00000000007AE000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1281496264.00000000007BA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1281529307.00000000007C4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1281529307.00000000007C7000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1281529307.00000000007D5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1281529307.00000000007D7000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_700000_OC & PL.jbxd

Similarity

API ID: Process$CloseErrorHandleLastOpen$CreateFirstProcess32SnapshotTerminateToolhelp32
String ID: SeDebugPrivilege
API String ID: 2533919879-2896544425
Opcode ID: b50fda8fa444873f16138c17db7780b183414ee48a7e80ffff49ddcc5c637824
Instruction ID: 5596df28626455dd03a5827479e9f7ba7562b5116aaae9312511f152bf3b51f0
Opcode Fuzzy Hash: b50fda8fa444873f16138c17db7780b183414ee48a7e80ffff49ddcc5c637824
Instruction Fuzzy Hash: CB41BF71640201EFDB15EF58C8A9FADB7A5AF54310F098058FA069F2C2DB7CA9448B95

Function 00745819 Relevance: 12.3, APIs: 2, Strings: 5, Instructions: 81windowCOMMON

Download Yara Rule

APIs

LoadIconW.USER32(00000000,00007F03), ref: 007458B8

Strings

question, xrefs: 00745871
info, xrefs: 00745859
blank, xrefs: 0074583A
warning, xrefs: 007458A1
stop, xrefs: 00745889

Memory Dump Source

Source File: 00000000.00000002.1281263787.0000000000701000.00000020.00000001.01000000.00000003.sdmp, Offset: 00700000, based on PE: true

Associated: 00000000.00000002.1281243473.0000000000700000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1281360671.000000000078D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1281360671.00000000007AE000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1281496264.00000000007BA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1281529307.00000000007C4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1281529307.00000000007C7000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1281529307.00000000007D5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1281529307.00000000007D7000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_700000_OC & PL.jbxd

Similarity

API ID: IconLoad
String ID: blank$info$question$stop$warning
API String ID: 2457776203-404129466
Opcode ID: 495a156954a4d03a06eeee792a49fda77af423d037b2dfe920c8ca5e5d2358b3
Instruction ID: 72a97d8d188ea3a1fe28272e418530ecc362a2bd5d44b4a1ec248f0ff94663e5
Opcode Fuzzy Hash: 495a156954a4d03a06eeee792a49fda77af423d037b2dfe920c8ca5e5d2358b3
Instruction Fuzzy Hash: E8110A71649756FBE7115B54AC92EAA339C9F15324B20003AF510E62C3EBBCAE4043A8

Function 0074A729 Relevance: 12.3, APIs: 8, Instructions: 317COMMON

Download Yara Rule

APIs

SafeArrayGetVartype.OLEAUT32(?,00000000), ref: 0074A806

Memory Dump Source

Source File: 00000000.00000002.1281263787.0000000000701000.00000020.00000001.01000000.00000003.sdmp, Offset: 00700000, based on PE: true

Associated: 00000000.00000002.1281243473.0000000000700000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1281360671.000000000078D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1281360671.00000000007AE000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1281496264.00000000007BA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1281529307.00000000007C4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1281529307.00000000007C7000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1281529307.00000000007D5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1281529307.00000000007D7000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_700000_OC & PL.jbxd

Similarity

API ID: ArraySafeVartype
String ID:
API String ID: 1725837607-0
Opcode ID: 079187259720331def4582bb855e0a546a7f205ac36deef1532c498a44ec2be1
Instruction ID: 6c76470a5773830ce46c232c49c4c50250e93b74b18640f9f1e7b32b9b9ac8a2
Opcode Fuzzy Hash: 079187259720331def4582bb855e0a546a7f205ac36deef1532c498a44ec2be1
Instruction Fuzzy Hash: F3C18D75A4421AEFDB10DF98C485BBEB7F4FF08315F24806AE605E7281D738A981CB95

Function 00746B49 Relevance: 12.3, APIs: 6, Strings: 1, Instructions: 46windowCOMMON

Download Yara Rule

APIs

GetModuleHandleW.KERNEL32(00000000,?,?,00000100,00000000), ref: 00746B63
LoadStringW.USER32(00000000), ref: 00746B6A
GetModuleHandleW.KERNEL32(00000000,00001389,?,00000100), ref: 00746B80
LoadStringW.USER32(00000000), ref: 00746B87
_wprintf.LIBCMT ref: 00746BAD
MessageBoxW.USER32(00000000,?,?,00011010), ref: 00746BCB

Strings

%s (%d) : ==> %s: %s %s, xrefs: 00746BA8

Memory Dump Source

Source File: 00000000.00000002.1281263787.0000000000701000.00000020.00000001.01000000.00000003.sdmp, Offset: 00700000, based on PE: true

Associated: 00000000.00000002.1281243473.0000000000700000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1281360671.000000000078D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1281360671.00000000007AE000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1281496264.00000000007BA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1281529307.00000000007C4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1281529307.00000000007C7000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1281529307.00000000007D5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1281529307.00000000007D7000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_700000_OC & PL.jbxd

Similarity

API ID: HandleLoadModuleString$Message_wprintf
String ID: %s (%d) : ==> %s: %s %s
API String ID: 3648134473-3128320259
Opcode ID: 61428e90af0a503009e62e9dbdf8aa243f53eeef7900e259fab10d55bd05c391
Instruction ID: 3159a4c1cf4b3fca2cae32fb8d51e39d610db26dd607ee400a57adacb7d35671
Opcode Fuzzy Hash: 61428e90af0a503009e62e9dbdf8aa243f53eeef7900e259fab10d55bd05c391
Instruction Fuzzy Hash: 330136F6940218BFEB21A794DD8DEF7776CDB08304F5084A1B745D2081EA789E848F75

Function 00762B19 Relevance: 12.3, APIs: 8, Instructions: 251registryCOMMON

Download Yara Rule

APIs

Part of subcall function 00763C06: CharUpperBuffW.USER32(?,?,?,?,?,?,?,00762BB5,?,?), ref: 00763C1D

RegConnectRegistryW.ADVAPI32(?,?,?), ref: 00762BF6

Memory Dump Source

Source File: 00000000.00000002.1281263787.0000000000701000.00000020.00000001.01000000.00000003.sdmp, Offset: 00700000, based on PE: true

Associated: 00000000.00000002.1281243473.0000000000700000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1281360671.000000000078D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1281360671.00000000007AE000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1281496264.00000000007BA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1281529307.00000000007C4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1281529307.00000000007C7000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1281529307.00000000007D5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1281529307.00000000007D7000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_700000_OC & PL.jbxd

Similarity

API ID: BuffCharConnectRegistryUpper
String ID:
API String ID: 2595220575-0
Opcode ID: 0fe2ad0487f8b1b4102319cd11c23ec4de2665fcf52d89b4073dc93a30277ddf
Instruction ID: 0c2827ee8fd519eb7691be81c2f66da2c6c3d2d9a240acb8f17595390dd41097
Opcode Fuzzy Hash: 0fe2ad0487f8b1b4102319cd11c23ec4de2665fcf52d89b4073dc93a30277ddf
Instruction Fuzzy Hash: C8917871204201DFCB15EF54C899B6EB7E5AF88310F14891DF9969B2A2DB38ED46CB42

Function 007595BF Relevance: 12.2, APIs: 8, Instructions: 247networkCOMMON

Download Yara Rule

APIs

select.WSOCK32 ref: 00759691
WSAGetLastError.WSOCK32(00000000), ref: 0075969E
__WSAFDIsSet.WSOCK32(00000000,?,00000000), ref: 007596C8
#17.WSOCK32(00000000,?,?,00000000,?,00000010), ref: 007596E9
WSAGetLastError.WSOCK32(00000000), ref: 007596F8
htons.WSOCK32(?,?,?,00000000,?), ref: 007597AA
inet_ntoa.WSOCK32(?,?,?,?,?,?,?,?,?,?,?,?,0079DC00), ref: 00759765

Part of subcall function 0073D2FF: _strlen.LIBCMT ref: 0073D309

_strlen.LIBCMT ref: 00759800

Memory Dump Source

Source File: 00000000.00000002.1281263787.0000000000701000.00000020.00000001.01000000.00000003.sdmp, Offset: 00700000, based on PE: true

Associated: 00000000.00000002.1281243473.0000000000700000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1281360671.000000000078D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1281360671.00000000007AE000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1281496264.00000000007BA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1281529307.00000000007C4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1281529307.00000000007C7000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1281529307.00000000007D5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1281529307.00000000007D7000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_700000_OC & PL.jbxd

Similarity

API ID: ErrorLast_strlen$htonsinet_ntoaselect
String ID:
API String ID: 3480843537-0
Opcode ID: 5f282c230d9ba3c47b09910c73162947a8cbe7682f3178b270b2309d5540c15e
Instruction ID: bc69482e908df3e9b8e64f2a414ec8367c9b719d5e5e2e2c267e758bc1cef389
Opcode Fuzzy Hash: 5f282c230d9ba3c47b09910c73162947a8cbe7682f3178b270b2309d5540c15e
Instruction Fuzzy Hash: 6B81A071504200EBD724EF64CC89EABB7E8EB85714F104A1DFA559B1D1EB78ED08CB92

Function 0072A979 Relevance: 12.1, APIs: 8, Instructions: 118COMMONLIBRARYCODE

Download Yara Rule

APIs

__mtinitlocknum.LIBCMT ref: 0072A991

Part of subcall function 00727D7C: __FF_MSGBANNER.LIBCMT ref: 00727D91
Part of subcall function 00727D7C: __NMSG_WRITE.LIBCMT ref: 00727D98
Part of subcall function 00727D7C: __malloc_crt.LIBCMT ref: 00727DB8

__lock.LIBCMT ref: 0072A9A4
__lock.LIBCMT ref: 0072A9F0
InitializeCriticalSectionAndSpinCount.KERNEL32(8000000C,00000FA0,007B6DE0,00000018,00735E7B,?,00000000,00000109), ref: 0072AA0C
EnterCriticalSection.KERNEL32(8000000C,007B6DE0,00000018,00735E7B,?,00000000,00000109), ref: 0072AA29
LeaveCriticalSection.KERNEL32(8000000C), ref: 0072AA39

Memory Dump Source

Source File: 00000000.00000002.1281263787.0000000000701000.00000020.00000001.01000000.00000003.sdmp, Offset: 00700000, based on PE: true

Associated: 00000000.00000002.1281243473.0000000000700000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1281360671.000000000078D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1281360671.00000000007AE000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1281496264.00000000007BA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1281529307.00000000007C4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1281529307.00000000007C7000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1281529307.00000000007D5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1281529307.00000000007D7000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_700000_OC & PL.jbxd

Similarity

API ID: CriticalSection$__lock$CountEnterInitializeLeaveSpin__malloc_crt__mtinitlocknum
String ID:
API String ID: 1422805418-0
Opcode ID: d6f19cdbcd0d58c41284e9c5a9de90ed492137a11b865f1996238834d59bb376
Instruction ID: edd0ca1558c73b8e432877e9ec9376315b5b8e5609a166c0f7b5f3b23b6d02d8
Opcode Fuzzy Hash: d6f19cdbcd0d58c41284e9c5a9de90ed492137a11b865f1996238834d59bb376
Instruction Fuzzy Hash: 09412A71A00226EBEB149F68EA45B5CB7B0BF01335F20C21DE425AB2D1DB7C9940CBD6

Function 00768ECC Relevance: 12.1, APIs: 8, Instructions: 95windowCOMMON

Download Yara Rule

APIs

DeleteObject.GDI32(00000000), ref: 00768EE4
GetDC.USER32(00000000), ref: 00768EEC
GetDeviceCaps.GDI32(00000000,0000005A), ref: 00768EF7
ReleaseDC.USER32(00000000,00000000), ref: 00768F03
CreateFontW.GDI32(?,00000000,00000000,00000000,00000000,?,?,?,00000001,00000004,00000000,?,00000000,?), ref: 00768F3F
SendMessageW.USER32(?,00000030,00000000,00000001), ref: 00768F50
MoveWindow.USER32(?,?,?,?,?,00000000,?,?,0076BD19,?,?,000000FF,00000000,?,000000FF,?), ref: 00768F8A
SendMessageW.USER32(?,00000142,00000000,00000000), ref: 00768FAA

Memory Dump Source

Source File: 00000000.00000002.1281263787.0000000000701000.00000020.00000001.01000000.00000003.sdmp, Offset: 00700000, based on PE: true

Associated: 00000000.00000002.1281243473.0000000000700000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1281360671.000000000078D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1281360671.00000000007AE000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1281496264.00000000007BA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1281529307.00000000007C4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1281529307.00000000007C7000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1281529307.00000000007D5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1281529307.00000000007D7000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_700000_OC & PL.jbxd

Similarity

API ID: MessageSend$CapsCreateDeleteDeviceFontMoveObjectReleaseWindow
String ID:
API String ID: 3864802216-0
Opcode ID: b748b6edbed3dde46a6ee5e75567d4299bc90233babd874cfb1554873a7c63ab
Instruction ID: 83ff6e56512d6e97feb9d7b41e0ef57668ce68a370eb65f2ff8da7fd980d3c99
Opcode Fuzzy Hash: b748b6edbed3dde46a6ee5e75567d4299bc90233babd874cfb1554873a7c63ab
Instruction Fuzzy Hash: EA316D72240214BFEB208F50CC49FEA3BAAEF49765F044165FE09DA191D6B99C41CB74

Function 00770133 Relevance: 10.7, APIs: 7, Instructions: 245windowCOMMON

Download Yara Rule

APIs

Part of subcall function 0071B34E: GetWindowLongW.USER32(?,000000EB), ref: 0071B35F

GetSystemMetrics.USER32(0000000F), ref: 0077016D
MoveWindow.USER32(00000003,?,00000000,00000001,00000000,00000000,?,?,?), ref: 0077038D
SendMessageW.USER32(00000003,00000142,00000000,0000FFFF), ref: 007703AB
InvalidateRect.USER32(?,00000000,00000001,?), ref: 007703D6
SendMessageW.USER32(00000003,00000469,?,00000000), ref: 007703FF
ShowWindow.USER32(00000003,00000000), ref: 00770421
DefDlgProcW.USER32(?,00000005,?,?), ref: 00770440

Memory Dump Source

Source File: 00000000.00000002.1281263787.0000000000701000.00000020.00000001.01000000.00000003.sdmp, Offset: 00700000, based on PE: true

Associated: 00000000.00000002.1281243473.0000000000700000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1281360671.000000000078D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1281360671.00000000007AE000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1281496264.00000000007BA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1281529307.00000000007C4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1281529307.00000000007C7000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1281529307.00000000007D5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1281529307.00000000007D7000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_700000_OC & PL.jbxd

Similarity

API ID: Window$MessageSend$InvalidateLongMetricsMoveProcRectShowSystem
String ID:
API String ID: 3356174886-0
Opcode ID: bb3fd5f0fafb0cd269355f0a18ecd73f3f4b9cca62ae6e9008f25587fa762b96
Instruction ID: 5f1c0eec1e2434fe5593faebbb4df6009b682ad3594f74d0fe3cfd5fe3238719
Opcode Fuzzy Hash: bb3fd5f0fafb0cd269355f0a18ecd73f3f4b9cca62ae6e9008f25587fa762b96
Instruction Fuzzy Hash: C3A19F35600616EFDF18CF68C9897BDBBB1BF05780F14C129E858AB291D778AD60CB90

Function 0071AE78 Relevance: 10.7, APIs: 7, Instructions: 218COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1281263787.0000000000701000.00000020.00000001.01000000.00000003.sdmp, Offset: 00700000, based on PE: true

Associated: 00000000.00000002.1281243473.0000000000700000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1281360671.000000000078D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1281360671.00000000007AE000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1281496264.00000000007BA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1281529307.00000000007C4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1281529307.00000000007C7000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1281529307.00000000007D5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1281529307.00000000007D7000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_700000_OC & PL.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3054e511253bdc05a0a7d6b4607e6c1fab2bfc2ff991167d28ef6db0d9dbd1bd
Instruction ID: b792a648125a3721624b107385a42f3c442580c0a162697b876e6b96f933c9ca
Opcode Fuzzy Hash: 3054e511253bdc05a0a7d6b4607e6c1fab2bfc2ff991167d28ef6db0d9dbd1bd
Instruction Fuzzy Hash: 52716C70901509FFCB14CF98CC89AEEBB79FF89310F248159F915AA291C738DA42CB65

Function 00762230 Relevance: 10.7, APIs: 5, Strings: 1, Instructions: 191COMMON

Download Yara Rule

APIs

_memset.LIBCMT ref: 0076225A
_memset.LIBCMT ref: 00762323
ShellExecuteExW.SHELL32(?), ref: 00762368

Part of subcall function 0070936C: __swprintf.LIBCMT ref: 007093AB
Part of subcall function 0070936C: __itow.LIBCMT ref: 007093DF

Part of subcall function 0071C6F4: _wcscpy.LIBCMT ref: 0071C717

CloseHandle.KERNEL32(00000000), ref: 0076242F
FreeLibrary.KERNEL32(00000000), ref: 0076243E

Strings

@, xrefs: 00762334

Memory Dump Source

Source File: 00000000.00000002.1281263787.0000000000701000.00000020.00000001.01000000.00000003.sdmp, Offset: 00700000, based on PE: true

Associated: 00000000.00000002.1281243473.0000000000700000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1281360671.000000000078D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1281360671.00000000007AE000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1281496264.00000000007BA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1281529307.00000000007C4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1281529307.00000000007C7000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1281529307.00000000007D5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1281529307.00000000007D7000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_700000_OC & PL.jbxd

Similarity

API ID: _memset$CloseExecuteFreeHandleLibraryShell__itow__swprintf_wcscpy
String ID: @
API String ID: 4082843840-2766056989
Opcode ID: 6b93368b6da334eec26e672c98a1e06232a328f7b5e4b3ef7e21bb96609347ce
Instruction ID: 1f7e05b978211bb8e2ef9214aefd0e2355c040b4b7f930cad8df69d3efd6aadf
Opcode Fuzzy Hash: 6b93368b6da334eec26e672c98a1e06232a328f7b5e4b3ef7e21bb96609347ce
Instruction Fuzzy Hash: 38718D70A00619DFCF05EFA8C88599EBBF5FF48310F108159E846AB392DB38AD41CB94

Function 00743BC3 Relevance: 10.7, APIs: 7, Instructions: 164windowCOMMON

Download Yara Rule

APIs

GetParent.USER32(00000000), ref: 00743C02
GetKeyboardState.USER32(?), ref: 00743C17
SetKeyboardState.USER32(?), ref: 00743C78
PostMessageW.USER32(00000000,00000100,00000010,?), ref: 00743CA4
PostMessageW.USER32(00000000,00000100,00000011,?), ref: 00743CC1
PostMessageW.USER32(00000000,00000100,00000012,?), ref: 00743D05
PostMessageW.USER32(00000000,00000100,0000005B,?), ref: 00743D26

Memory Dump Source

Source File: 00000000.00000002.1281263787.0000000000701000.00000020.00000001.01000000.00000003.sdmp, Offset: 00700000, based on PE: true

Associated: 00000000.00000002.1281243473.0000000000700000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1281360671.000000000078D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1281360671.00000000007AE000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1281496264.00000000007BA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1281529307.00000000007C4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1281529307.00000000007C7000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1281529307.00000000007D5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1281529307.00000000007D7000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_700000_OC & PL.jbxd

Similarity

API ID: MessagePost$KeyboardState$Parent
String ID:
API String ID: 87235514-0
Opcode ID: 4c27210f6123ca574cb9290d9baef337756be9ce6d69db32a96da85a3c4c75a9
Instruction ID: 810772e2045eaf1506d0452b65d9cd42b445496cc8c8d75321aa9db63d231327
Opcode Fuzzy Hash: 4c27210f6123ca574cb9290d9baef337756be9ce6d69db32a96da85a3c4c75a9
Instruction Fuzzy Hash: 795109A0A447D53DFB3687348C55B76BFA99F06304F088489E0DD5A4C2D39CEE94EB60

Function 00768FC8 Relevance: 10.6, APIs: 7, Instructions: 99windowCOMMON

Download Yara Rule

APIs

SendMessageW.USER32(00000000,000000F0,00000000,00000000), ref: 00768FE7
GetWindowLongW.USER32(00D6D890,000000F0), ref: 0076901A
GetWindowLongW.USER32(00D6D890,000000F0), ref: 0076904F
SendMessageW.USER32(00000000,000000F1,00000000,00000000), ref: 00769081
SendMessageW.USER32(00000000,000000F1,00000001,00000000), ref: 007690AB
GetWindowLongW.USER32(00000000,000000F0), ref: 007690BC
SetWindowLongW.USER32(00000000,000000F0,00000000), ref: 007690D6

Memory Dump Source

Source File: 00000000.00000002.1281263787.0000000000701000.00000020.00000001.01000000.00000003.sdmp, Offset: 00700000, based on PE: true

Associated: 00000000.00000002.1281243473.0000000000700000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1281360671.000000000078D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1281360671.00000000007AE000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1281496264.00000000007BA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1281529307.00000000007C4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1281529307.00000000007C7000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1281529307.00000000007D5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1281529307.00000000007D7000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_700000_OC & PL.jbxd

Similarity

API ID: LongWindow$MessageSend
String ID:
API String ID: 2178440468-0
Opcode ID: 5e3f3354713df6b59886d57cc5e93cdd82aaf8fc847093f28dfbb5a0aed2d75f
Instruction ID: 7ca966e32357ef7db4d7ee472b950199398d3ff50120d33350ab1ceb1a1a00af
Opcode Fuzzy Hash: 5e3f3354713df6b59886d57cc5e93cdd82aaf8fc847093f28dfbb5a0aed2d75f
Instruction Fuzzy Hash: ED313B34740116DFDB20CF58DC84F6437A9FB4A754F1482A9FA1A9B2B2CB79AC40DB45

Function 007408AF Relevance: 10.6, APIs: 7, Instructions: 94memoryCOMMON

Download Yara Rule

APIs

MultiByteToWideChar.KERNEL32(00000000,00000000,?,000000FF,00000000,00000000), ref: 007408F2
MultiByteToWideChar.KERNEL32(00000000,00000000,?,000000FF,00000000,00000000), ref: 00740918
SysAllocString.OLEAUT32(00000000), ref: 0074091B
SysAllocString.OLEAUT32(?), ref: 00740939
SysFreeString.OLEAUT32(?), ref: 00740942
StringFromGUID2.OLE32(?,?,00000028), ref: 00740967
SysAllocString.OLEAUT32(?), ref: 00740975

Memory Dump Source

Source File: 00000000.00000002.1281263787.0000000000701000.00000020.00000001.01000000.00000003.sdmp, Offset: 00700000, based on PE: true

Associated: 00000000.00000002.1281243473.0000000000700000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1281360671.000000000078D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1281360671.00000000007AE000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1281496264.00000000007BA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1281529307.00000000007C4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1281529307.00000000007C7000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1281529307.00000000007D5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1281529307.00000000007D7000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_700000_OC & PL.jbxd

Similarity

API ID: String$Alloc$ByteCharMultiWide$FreeFrom
String ID:
API String ID: 3761583154-0
Opcode ID: 8869bc2edc8a3a66e263de394a5e2d569362f6dbf70cb8aaf84894c2c4767572
Instruction ID: 5a1942b2f273177442d9dd89a49cd636f93f88ab0786fba67a61062811f5c6dc
Opcode Fuzzy Hash: 8869bc2edc8a3a66e263de394a5e2d569362f6dbf70cb8aaf84894c2c4767572
Instruction Fuzzy Hash: EB219776601219AFDB109F78DC88DAB73ACEF09360B148125FE19DB191D778EC4587A4

Function 00742472 Relevance: 10.6, APIs: 3, Strings: 3, Instructions: 90COMMON

Download Yara Rule

APIs

__wcsnicmp.LIBCMT ref: 00742485
__wcsnicmp.LIBCMT ref: 007424A6
__wcsnicmp.LIBCMT ref: 007424C0

Strings

#requireadmin, xrefs: 007424A0
#notrayicon, xrefs: 0074247D
#OnAutoItStartRegister, xrefs: 007424BA

Memory Dump Source

Source File: 00000000.00000002.1281263787.0000000000701000.00000020.00000001.01000000.00000003.sdmp, Offset: 00700000, based on PE: true

Associated: 00000000.00000002.1281243473.0000000000700000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1281360671.000000000078D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1281360671.00000000007AE000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1281496264.00000000007BA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1281529307.00000000007C4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1281529307.00000000007C7000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1281529307.00000000007D5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1281529307.00000000007D7000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_700000_OC & PL.jbxd

Similarity

API ID: __wcsnicmp
String ID: #OnAutoItStartRegister$#notrayicon$#requireadmin
API String ID: 1038674560-2734436370
Opcode ID: c64ca62ee5517fa42966979ceb8a5039dbaa9e0f0cc87f41f364fc50a2ab8c5d
Instruction ID: fc6abd0ff0f1b91a7a4dfd4665ebb48e361a6c2ec00e9c645a2f0102fc37161b
Opcode Fuzzy Hash: c64ca62ee5517fa42966979ceb8a5039dbaa9e0f0cc87f41f364fc50a2ab8c5d
Instruction Fuzzy Hash: 54214C71244151B7C731A638AC16FB7B3A8EF65310FA04026F445D7083E76D9DA3C3A5

Function 00740986 Relevance: 10.6, APIs: 7, Instructions: 89memoryCOMMON

Download Yara Rule

APIs

MultiByteToWideChar.KERNEL32(00000000,00000000,?,000000FF,00000000,00000000), ref: 007409CB
MultiByteToWideChar.KERNEL32(00000000,00000000,?,000000FF,00000000,00000000), ref: 007409F1
SysAllocString.OLEAUT32(00000000), ref: 007409F4
SysAllocString.OLEAUT32 ref: 00740A15
SysFreeString.OLEAUT32 ref: 00740A1E
StringFromGUID2.OLE32(?,?,00000028), ref: 00740A38
SysAllocString.OLEAUT32(?), ref: 00740A46

Memory Dump Source

Source File: 00000000.00000002.1281263787.0000000000701000.00000020.00000001.01000000.00000003.sdmp, Offset: 00700000, based on PE: true

Associated: 00000000.00000002.1281243473.0000000000700000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1281360671.000000000078D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1281360671.00000000007AE000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1281496264.00000000007BA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1281529307.00000000007C4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1281529307.00000000007C7000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1281529307.00000000007D5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1281529307.00000000007D7000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_700000_OC & PL.jbxd

Similarity

API ID: String$Alloc$ByteCharMultiWide$FreeFrom
String ID:
API String ID: 3761583154-0
Opcode ID: 0cc203cf5051ca93e7ad1c0e212e0b560be39e2e9a2fd1f44cbeff224f38064a
Instruction ID: 546a330a0e765aa13da504ac1a00c2dedfa1b864ed69a35f140514a6e66e1dba
Opcode Fuzzy Hash: 0cc203cf5051ca93e7ad1c0e212e0b560be39e2e9a2fd1f44cbeff224f38064a
Instruction Fuzzy Hash: FA217475700204AFDB10AFB8DC88DAA77ECEF08360714C125FA09CB2A1E778EC418B64

Function 0076A2C8 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 75windowCOMMON

Download Yara Rule

APIs

Part of subcall function 0071D17C: CreateWindowExW.USER32(?,?,?,?,?,?,?,?,?,?,00000000,00000096), ref: 0071D1BA
Part of subcall function 0071D17C: GetStockObject.GDI32(00000011), ref: 0071D1CE
Part of subcall function 0071D17C: SendMessageW.USER32(00000000,00000030,00000000), ref: 0071D1D8

SendMessageW.USER32(00000000,00002001,00000000,FF000000), ref: 0076A32D
SendMessageW.USER32(?,00000409,00000000,FF000000), ref: 0076A33A
SendMessageW.USER32(?,00000402,00000000,00000000), ref: 0076A345
SendMessageW.USER32(?,00000401,00000000,00640000), ref: 0076A354
SendMessageW.USER32(?,00000404,00000001,00000000), ref: 0076A360

Strings

Msctls_Progress32, xrefs: 0076A2FE

Memory Dump Source

Source File: 00000000.00000002.1281263787.0000000000701000.00000020.00000001.01000000.00000003.sdmp, Offset: 00700000, based on PE: true

Associated: 00000000.00000002.1281243473.0000000000700000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1281360671.000000000078D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1281360671.00000000007AE000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1281496264.00000000007BA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1281529307.00000000007C4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1281529307.00000000007C7000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1281529307.00000000007D5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1281529307.00000000007D7000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_700000_OC & PL.jbxd

Similarity

API ID: MessageSend$CreateObjectStockWindow
String ID: Msctls_Progress32
API String ID: 1025951953-3636473452
Opcode ID: 04935041b5a24364aea993a9dd026cb43b8bcac49c6c0c748e59c9faa17e562a
Instruction ID: 743c006f48133d061b1880dfcb4803ef10c91340515491963b43492808960d4f
Opcode Fuzzy Hash: 04935041b5a24364aea993a9dd026cb43b8bcac49c6c0c748e59c9faa17e562a
Instruction Fuzzy Hash: E411D0B114021DBEEF114F61CC85EEB7F6DFF09398F014114FA09A20A0C6769C21DBA4

Function 0071CCCD Relevance: 9.3, APIs: 6, Instructions: 253COMMON

Download Yara Rule

APIs

GetClientRect.USER32(?,?), ref: 0071CCF6
GetWindowRect.USER32(?,?), ref: 0071CD37
ScreenToClient.USER32(?,?), ref: 0071CD5F
GetClientRect.USER32(?,?), ref: 0071CE8C
GetWindowRect.USER32(?,?), ref: 0071CEA5

Memory Dump Source

Source File: 00000000.00000002.1281263787.0000000000701000.00000020.00000001.01000000.00000003.sdmp, Offset: 00700000, based on PE: true

Associated: 00000000.00000002.1281243473.0000000000700000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1281360671.000000000078D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1281360671.00000000007AE000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1281496264.00000000007BA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1281529307.00000000007C4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1281529307.00000000007C7000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1281529307.00000000007D5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1281529307.00000000007D7000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_700000_OC & PL.jbxd

Similarity

API ID: Rect$Client$Window$Screen
String ID:
API String ID: 1296646539-0
Opcode ID: 89576e1ef7aacb6a3d34176208ec87c67514ac2606e92f17d24843196dd8f8a4
Instruction ID: 3fa460d052bb1af6d31dc77045dbd8f96862d27c06a6432915613f838dd33b81
Opcode Fuzzy Hash: 89576e1ef7aacb6a3d34176208ec87c67514ac2606e92f17d24843196dd8f8a4
Instruction Fuzzy Hash: DEB15A79A40249DBDF10CFA8C5807EDBBB1FF08350F149569EC59EB290DB38A994CB64

Function 00761BDF Relevance: 9.2, APIs: 6, Instructions: 163processCOMMON

Download Yara Rule

APIs

CreateToolhelp32Snapshot.KERNEL32 ref: 00761C18
Process32FirstW.KERNEL32(00000000,?), ref: 00761C26
__wsplitpath.LIBCMT ref: 00761C54

Part of subcall function 00721DFC: __wsplitpath_helper.LIBCMT ref: 00721E3C

_wcscat.LIBCMT ref: 00761C69
Process32NextW.KERNEL32(00000000,?), ref: 00761CDF
CloseHandle.KERNEL32(00000000,?,?,00000002,00000000), ref: 00761CF1

Memory Dump Source

Source File: 00000000.00000002.1281263787.0000000000701000.00000020.00000001.01000000.00000003.sdmp, Offset: 00700000, based on PE: true

Associated: 00000000.00000002.1281243473.0000000000700000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1281360671.000000000078D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1281360671.00000000007AE000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1281496264.00000000007BA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1281529307.00000000007C4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1281529307.00000000007C7000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1281529307.00000000007D5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1281529307.00000000007D7000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_700000_OC & PL.jbxd

Similarity

API ID: Process32$CloseCreateFirstHandleNextSnapshotToolhelp32__wsplitpath__wsplitpath_helper_wcscat
String ID:
API String ID: 1380811348-0
Opcode ID: ed180db04c5ce94411f37094ea0a23342877ed6e81b2816efb79188311eb1eaa
Instruction ID: 5812519dadf932d5ae80e70b22c6ad0ed034101769b5f84fba3e898e5edaf380
Opcode Fuzzy Hash: ed180db04c5ce94411f37094ea0a23342877ed6e81b2816efb79188311eb1eaa
Instruction Fuzzy Hash: B55171B1504304DFD720EF24C849EABB7E8EF88754F044A1EF98697291DB789904CBA2

Function 00762FD6 Relevance: 9.2, APIs: 6, Instructions: 160registryCOMMON

Download Yara Rule

APIs

Part of subcall function 00763C06: CharUpperBuffW.USER32(?,?,?,?,?,?,?,00762BB5,?,?), ref: 00763C1D

RegConnectRegistryW.ADVAPI32(?,?,?), ref: 007630AF
RegOpenKeyExW.ADVAPI32(?,?,00000000,?,?), ref: 007630EF
RegCloseKey.ADVAPI32(?,00000001,00000000), ref: 00763112
RegEnumValueW.ADVAPI32(?,-00000001,?,?,00000000,?,00000000,00000000), ref: 0076313B
RegCloseKey.ADVAPI32(?,?,00000000), ref: 0076317E
RegCloseKey.ADVAPI32(00000000), ref: 0076318B

Memory Dump Source

Source File: 00000000.00000002.1281263787.0000000000701000.00000020.00000001.01000000.00000003.sdmp, Offset: 00700000, based on PE: true

Associated: 00000000.00000002.1281243473.0000000000700000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1281360671.000000000078D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1281360671.00000000007AE000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1281496264.00000000007BA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1281529307.00000000007C4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1281529307.00000000007C7000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1281529307.00000000007D5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1281529307.00000000007D7000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_700000_OC & PL.jbxd

Similarity

API ID: Close$BuffCharConnectEnumOpenRegistryUpperValue
String ID:
API String ID: 3451389628-0
Opcode ID: 5991a19800e3e2bf2ccf0d666827d0ec76ad7e6ecb4858243f49db5702a2c3d6
Instruction ID: 3c35bb60dac96d0bf82278157e261c2610a4e35711f009004050c6378b890650
Opcode Fuzzy Hash: 5991a19800e3e2bf2ccf0d666827d0ec76ad7e6ecb4858243f49db5702a2c3d6
Instruction Fuzzy Hash: 7E514971104304EFC715EF64C899E6AB7E9FF89300F044A1DF956872A1DB39EA09CB52

Function 007684DE Relevance: 9.2, APIs: 6, Instructions: 152windowCOMMON

Download Yara Rule

APIs

GetMenu.USER32(?), ref: 00768540
GetMenuItemCount.USER32(00000000), ref: 00768577
GetMenuStringW.USER32(00000000,00000000,?,00007FFF,00000400), ref: 0076859F
GetMenuItemID.USER32(?,?), ref: 0076860E
GetSubMenu.USER32(?,?), ref: 0076861C
PostMessageW.USER32(?,00000111,?,00000000), ref: 0076866D

Memory Dump Source

Source File: 00000000.00000002.1281263787.0000000000701000.00000020.00000001.01000000.00000003.sdmp, Offset: 00700000, based on PE: true

Associated: 00000000.00000002.1281243473.0000000000700000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1281360671.000000000078D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1281360671.00000000007AE000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1281496264.00000000007BA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1281529307.00000000007C4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1281529307.00000000007C7000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1281529307.00000000007D5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1281529307.00000000007D7000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_700000_OC & PL.jbxd

Similarity

API ID: Menu$Item$CountMessagePostString
String ID:
API String ID: 650687236-0
Opcode ID: f7f27018e49c732551023b12b0bf785914424d40a8aca6a7482a6102770cf91e
Instruction ID: adc330ab06451bd715f845c484bce173cf4f4207ace2591c17f59880b44d74b6
Opcode Fuzzy Hash: f7f27018e49c732551023b12b0bf785914424d40a8aca6a7482a6102770cf91e
Instruction Fuzzy Hash: CD51B171A00214EFCF51EF54C845AAEB7F4EF48310F148559ED06B7392DB78AE418B96

Function 00744AC2 Relevance: 9.1, APIs: 6, Instructions: 136windowCOMMON

Download Yara Rule

APIs

_memset.LIBCMT ref: 00744B10
GetMenuItemInfoW.USER32(?,000000FF,00000000,00000030), ref: 00744B5B
IsMenu.USER32(00000000), ref: 00744B7B
CreatePopupMenu.USER32 ref: 00744BAF
GetMenuItemCount.USER32(000000FF), ref: 00744C0D
InsertMenuItemW.USER32(00000000,?,00000001,00000030), ref: 00744C3E

Memory Dump Source

Source File: 00000000.00000002.1281263787.0000000000701000.00000020.00000001.01000000.00000003.sdmp, Offset: 00700000, based on PE: true

Associated: 00000000.00000002.1281243473.0000000000700000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1281360671.000000000078D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1281360671.00000000007AE000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1281496264.00000000007BA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1281529307.00000000007C4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1281529307.00000000007C7000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1281529307.00000000007D5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1281529307.00000000007D7000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_700000_OC & PL.jbxd

Similarity

API ID: Menu$Item$CountCreateInfoInsertPopup_memset
String ID:
API String ID: 3311875123-0
Opcode ID: c77d2d921896902eeff84a604badbfe3a60a574d360519622d0169de801a9434
Instruction ID: 1c2de3f56abb1ba66c51a37b14222594fb30820b061be85e989e8ae1cf136a09
Opcode Fuzzy Hash: c77d2d921896902eeff84a604badbfe3a60a574d360519622d0169de801a9434
Instruction Fuzzy Hash: 3551CFB0601219EFDF20CF68D8C8BADBBF4EF44318F288159E4259B291D7789944DB61

Function 00758DE2 Relevance: 9.1, APIs: 6, Instructions: 136networkCOMMON

Download Yara Rule

APIs

select.WSOCK32(00000000,00000001,00000000,00000000,?,000003E8,0079DC00), ref: 00758E7C
WSAGetLastError.WSOCK32(00000000), ref: 00758E89
__WSAFDIsSet.WSOCK32(00000000,00000001,00000000), ref: 00758EAD
#16.WSOCK32(?,?,00000000,00000000), ref: 00758EC5
_strlen.LIBCMT ref: 00758EF7
WSAGetLastError.WSOCK32(00000000), ref: 00758F6A

Memory Dump Source

Source File: 00000000.00000002.1281263787.0000000000701000.00000020.00000001.01000000.00000003.sdmp, Offset: 00700000, based on PE: true

Associated: 00000000.00000002.1281243473.0000000000700000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1281360671.000000000078D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1281360671.00000000007AE000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1281496264.00000000007BA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1281529307.00000000007C4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1281529307.00000000007C7000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1281529307.00000000007D5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1281529307.00000000007D7000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_700000_OC & PL.jbxd

Similarity

API ID: ErrorLast$_strlenselect
String ID:
API String ID: 2217125717-0
Opcode ID: f5748b732136217ef14a400718322b4bb7192ee82097bc913b9cf5dbef2de5d4
Instruction ID: 27ad49070090ef0c63c4f3797358fbed4d0a392242255e4441622152eefd298c
Opcode Fuzzy Hash: f5748b732136217ef14a400718322b4bb7192ee82097bc913b9cf5dbef2de5d4
Instruction Fuzzy Hash: C341D571500204EFCB54EBA4CD8AEEEB7B9AF58311F104259F516A72D1DF78AE04CB61

Function 0071ABF5 Relevance: 9.1, APIs: 6, Instructions: 113COMMON

Download Yara Rule

APIs

Part of subcall function 0071B34E: GetWindowLongW.USER32(?,000000EB), ref: 0071B35F

BeginPaint.USER32(?,?,?), ref: 0071AC2A
GetWindowRect.USER32(?,?), ref: 0071AC8E
ScreenToClient.USER32(?,?), ref: 0071ACAB
SetViewportOrgEx.GDI32(00000000,?,?,00000000), ref: 0071ACBC
EndPaint.USER32(?,?,?,?,?), ref: 0071AD06
Rectangle.GDI32(00000000,00000000,00000000,?,?), ref: 0077E673

Memory Dump Source

Source File: 00000000.00000002.1281263787.0000000000701000.00000020.00000001.01000000.00000003.sdmp, Offset: 00700000, based on PE: true

Associated: 00000000.00000002.1281243473.0000000000700000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1281360671.000000000078D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1281360671.00000000007AE000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1281496264.00000000007BA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1281529307.00000000007C4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1281529307.00000000007C7000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1281529307.00000000007D5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1281529307.00000000007D7000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_700000_OC & PL.jbxd

Similarity

API ID: PaintWindow$BeginClientLongRectRectangleScreenViewport
String ID:
API String ID: 2592858361-0
Opcode ID: 05fee8a50a30ae96b305497c0d11592ccece7f7644e376fe68a3957c52f1996c
Instruction ID: a5f40a4e1a788845628ec38774ca184decd16a542cdcdbde4f60e644a2cef88d
Opcode Fuzzy Hash: 05fee8a50a30ae96b305497c0d11592ccece7f7644e376fe68a3957c52f1996c
Instruction Fuzzy Hash: FF41E370101201AFC710DF28DC88FB67BA8EF5A360F144269F9A4972E2D7399C84DB62

Function 0076E397 Relevance: 9.1, APIs: 6, Instructions: 108windowCOMMON

Download Yara Rule

APIs

ShowWindow.USER32(007C1628,00000000,007C1628,00000000,00000000,007C1628,?,0077DC5D,00000000,?,00000000,00000000,00000000,?,0077DAD1,00000004), ref: 0076E40B
EnableWindow.USER32(00000000,00000000), ref: 0076E42F
ShowWindow.USER32(007C1628,00000000), ref: 0076E48F
ShowWindow.USER32(00000000,00000004), ref: 0076E4A1
EnableWindow.USER32(00000000,00000001), ref: 0076E4C5
SendMessageW.USER32(?,0000130C,00000000,00000000), ref: 0076E4E8

Memory Dump Source

Source File: 00000000.00000002.1281263787.0000000000701000.00000020.00000001.01000000.00000003.sdmp, Offset: 00700000, based on PE: true

Associated: 00000000.00000002.1281243473.0000000000700000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1281360671.000000000078D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1281360671.00000000007AE000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1281496264.00000000007BA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1281529307.00000000007C4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1281529307.00000000007C7000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1281529307.00000000007D5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1281529307.00000000007D7000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_700000_OC & PL.jbxd

Similarity

API ID: Window$Show$Enable$MessageSend
String ID:
API String ID: 642888154-0
Opcode ID: e9287edd5705f66b8ce21140979cdbaae81e3d99e15074a103735f629924379c
Instruction ID: 93935e43a5020f786eb02ab4b00d71f9ef825a9173f9d2f46f8c773e64259460
Opcode Fuzzy Hash: e9287edd5705f66b8ce21140979cdbaae81e3d99e15074a103735f629924379c
Instruction Fuzzy Hash: B3414038601180EFDB25CF24C499B947FE1BF05704F1881A9FE5A8F2A2CB79AC45CB61

Function 007498BA Relevance: 9.1, APIs: 6, Instructions: 100fileCOMMON

Download Yara Rule

APIs

InterlockedExchange.KERNEL32(?,000001F5), ref: 007498D1

Part of subcall function 0071F4EA: std::exception::exception.LIBCMT ref: 0071F51E
Part of subcall function 0071F4EA: __CxxThrowException@8.LIBCMT ref: 0071F533

ReadFile.KERNEL32(0000FFFF,00000000,0000FFFF,?,00000000), ref: 00749908
EnterCriticalSection.KERNEL32(?), ref: 00749924
LeaveCriticalSection.KERNEL32(?), ref: 0074999E
ReadFile.KERNEL32(0000FFFF,00000000,0000FFFF,00000000,00000000), ref: 007499B3
InterlockedExchange.KERNEL32(?,000001F6), ref: 007499D2

Memory Dump Source

Source File: 00000000.00000002.1281263787.0000000000701000.00000020.00000001.01000000.00000003.sdmp, Offset: 00700000, based on PE: true

Associated: 00000000.00000002.1281243473.0000000000700000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1281360671.000000000078D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1281360671.00000000007AE000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1281496264.00000000007BA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1281529307.00000000007C4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1281529307.00000000007C7000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1281529307.00000000007D5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1281529307.00000000007D7000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_700000_OC & PL.jbxd

Similarity

API ID: CriticalExchangeFileInterlockedReadSection$EnterException@8LeaveThrowstd::exception::exception
String ID:
API String ID: 2537439066-0
Opcode ID: 9faaa0be2ef853ed08a5d4be896589a1d3fcea99060a14dd881f0e3b49a1fd4e
Instruction ID: 6a6b92a21513448d6d9501eaa14f0996d3316b47bf772cf9eca039615a39940e
Opcode Fuzzy Hash: 9faaa0be2ef853ed08a5d4be896589a1d3fcea99060a14dd881f0e3b49a1fd4e
Instruction Fuzzy Hash: 98316331900105EBDB10EF98DC89EAFB778FF84310B248069F904AB296D778DE54DB64

Function 00759B45 Relevance: 9.1, APIs: 6, Instructions: 99COMMON

Download Yara Rule

APIs

GetForegroundWindow.USER32(?,?,?,?,?,?,007577F4,?,?,00000000,00000001), ref: 00759B53

Part of subcall function 00756544: GetWindowRect.USER32(?,?), ref: 00756557

GetDesktopWindow.USER32 ref: 00759B7D
GetWindowRect.USER32(00000000), ref: 00759B84
mouse_event.USER32(00008001,?,?,00000001,00000001), ref: 00759BB6

Part of subcall function 00747A58: Sleep.KERNEL32(?,00000000,?,?,?,?,?,?,?,?,?), ref: 00747AD0

GetCursorPos.USER32(?), ref: 00759BE2
mouse_event.USER32(00008001,?,?,00000000,00000000), ref: 00759C44

Memory Dump Source

Source File: 00000000.00000002.1281263787.0000000000701000.00000020.00000001.01000000.00000003.sdmp, Offset: 00700000, based on PE: true

Associated: 00000000.00000002.1281243473.0000000000700000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1281360671.000000000078D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1281360671.00000000007AE000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1281496264.00000000007BA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1281529307.00000000007C4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1281529307.00000000007C7000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1281529307.00000000007D5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1281529307.00000000007D7000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_700000_OC & PL.jbxd

Similarity

API ID: Window$Rectmouse_event$CursorDesktopForegroundSleep
String ID:
API String ID: 4137160315-0
Opcode ID: 83a5c26e4d9c4cf8fe73dc2eb51745870b791d1b1cffa40caa454f46779ebe2a
Instruction ID: f422ea6721d66b4e716c774c2a225cec993ae931b59cb26d0dcc98b638ef65bc
Opcode Fuzzy Hash: 83a5c26e4d9c4cf8fe73dc2eb51745870b791d1b1cffa40caa454f46779ebe2a
Instruction Fuzzy Hash: 8B31C1B2644309ABD720DF18D849F9BB7E9FF88314F00491AFA85D7181D775E918CB92

Function 0073AF64 Relevance: 9.1, APIs: 6, Instructions: 73processCOMMON

Download Yara Rule

APIs

GetCurrentProcess.KERNEL32(0000000A,00000004), ref: 0073AFAE
OpenProcessToken.ADVAPI32(00000000), ref: 0073AFB5
CreateEnvironmentBlock.USERENV(?,00000004,00000001), ref: 0073AFC4
CloseHandle.KERNEL32(00000004), ref: 0073AFCF
CreateProcessWithLogonW.ADVAPI32(?,?,?,00000000,00000000,?,?,00000000,?,?,?), ref: 0073AFFE
DestroyEnvironmentBlock.USERENV(00000000), ref: 0073B012

Memory Dump Source

Source File: 00000000.00000002.1281263787.0000000000701000.00000020.00000001.01000000.00000003.sdmp, Offset: 00700000, based on PE: true

Associated: 00000000.00000002.1281243473.0000000000700000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1281360671.000000000078D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1281360671.00000000007AE000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1281496264.00000000007BA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1281529307.00000000007C4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1281529307.00000000007C7000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1281529307.00000000007D5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1281529307.00000000007D7000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_700000_OC & PL.jbxd

Similarity

API ID: Process$BlockCreateEnvironment$CloseCurrentDestroyHandleLogonOpenTokenWith
String ID:
API String ID: 1413079979-0
Opcode ID: 5d09eef54ce7fe8cdc030aa6a970a149f24a633520a8693339f6bfde678acbf7
Instruction ID: 6acf9ebf266c8fc9120787e093efe24914aba1dd885255ca7ebc2449749f67e8
Opcode Fuzzy Hash: 5d09eef54ce7fe8cdc030aa6a970a149f24a633520a8693339f6bfde678acbf7
Instruction Fuzzy Hash: F3215072140209FFEF119F94DD09FAE7BA9EF44304F148015FA41A21A2C37ADD11DB61

Function 0076EBF6 Relevance: 9.0, APIs: 6, Instructions: 49COMMON

Download Yara Rule

APIs

Part of subcall function 0071AF83: ExtCreatePen.GDI32(?,?,00000000,00000000,00000000,?,?,00000000), ref: 0071AFE3
Part of subcall function 0071AF83: SelectObject.GDI32(?,00000000), ref: 0071AFF2
Part of subcall function 0071AF83: BeginPath.GDI32(?), ref: 0071B009
Part of subcall function 0071AF83: SelectObject.GDI32(?,00000000), ref: 0071B033

MoveToEx.GDI32(00000000,-00000002,?,00000000), ref: 0076EC20
LineTo.GDI32(00000000,00000003,?), ref: 0076EC34
MoveToEx.GDI32(00000000,00000000,?,00000000), ref: 0076EC42
LineTo.GDI32(00000000,00000000,?), ref: 0076EC52
EndPath.GDI32(00000000), ref: 0076EC62
StrokePath.GDI32(00000000), ref: 0076EC72

Memory Dump Source

Source File: 00000000.00000002.1281263787.0000000000701000.00000020.00000001.01000000.00000003.sdmp, Offset: 00700000, based on PE: true

Associated: 00000000.00000002.1281243473.0000000000700000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1281360671.000000000078D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1281360671.00000000007AE000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1281496264.00000000007BA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1281529307.00000000007C4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1281529307.00000000007C7000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1281529307.00000000007D5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1281529307.00000000007D7000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_700000_OC & PL.jbxd

Similarity

API ID: Path$LineMoveObjectSelect$BeginCreateStroke
String ID:
API String ID: 43455801-0
Opcode ID: 2869aa806571e84d54be30c6280e2f5102a088431c8b70800190b228e7393d4d
Instruction ID: f6e1345d8750b6fcf9c23117b90d1f3d26c616e0e38d4edd53c447f4b8001cfa
Opcode Fuzzy Hash: 2869aa806571e84d54be30c6280e2f5102a088431c8b70800190b228e7393d4d
Instruction Fuzzy Hash: 0C11357204014CBFEF129F90DC88EEA7F6DEF08360F148122BE099A1A0D7759D55DBA0

Function 0073E19B Relevance: 9.0, APIs: 6, Instructions: 48COMMON

Download Yara Rule

APIs

GetDC.USER32(00000000), ref: 0073E1C0
GetDeviceCaps.GDI32(00000000,00000058), ref: 0073E1D1
GetDeviceCaps.GDI32(00000000,0000005A), ref: 0073E1D8
ReleaseDC.USER32(00000000,00000000), ref: 0073E1E0
MulDiv.KERNEL32(000009EC,?,00000000), ref: 0073E1F7
MulDiv.KERNEL32(000009EC,?,?), ref: 0073E209

Part of subcall function 00739AA3: RaiseException.KERNEL32(-C0000018,00000001,00000000,00000000,00739A05,00000000,00000000,?,00739DDB), ref: 0073A53A

Memory Dump Source

Source File: 00000000.00000002.1281263787.0000000000701000.00000020.00000001.01000000.00000003.sdmp, Offset: 00700000, based on PE: true

Associated: 00000000.00000002.1281243473.0000000000700000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1281360671.000000000078D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1281360671.00000000007AE000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1281496264.00000000007BA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1281529307.00000000007C4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1281529307.00000000007C7000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1281529307.00000000007D5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1281529307.00000000007D7000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_700000_OC & PL.jbxd

Similarity

API ID: CapsDevice$ExceptionRaiseRelease
String ID:
API String ID: 603618608-0
Opcode ID: feb2cf678be35b6c15b130c4833452259b093b8540f20f5b82829b72dc8b05aa
Instruction ID: d37ba654151134faa5fb237753e7f6875535cd9887a1252875feff63a93c0aee
Opcode Fuzzy Hash: feb2cf678be35b6c15b130c4833452259b093b8540f20f5b82829b72dc8b05aa
Instruction Fuzzy Hash: D30184B5A40219BFEB109BA58C49F5EBFB8EB48351F108066EE04A73D1D6749C00CBA0

Function 00727B47 Relevance: 9.0, APIs: 6, Instructions: 45threadCOMMON

Download Yara Rule

APIs

__init_pointers.LIBCMT ref: 00727B47

Part of subcall function 0072123A: __initp_misc_winsig.LIBCMT ref: 0072125E
Part of subcall function 0072123A: GetModuleHandleW.KERNEL32(kernel32.dll), ref: 00727F51
Part of subcall function 0072123A: GetProcAddress.KERNEL32(00000000,FlsAlloc), ref: 00727F65
Part of subcall function 0072123A: GetProcAddress.KERNEL32(00000000,FlsFree), ref: 00727F78
Part of subcall function 0072123A: GetProcAddress.KERNEL32(00000000,FlsGetValue), ref: 00727F8B
Part of subcall function 0072123A: GetProcAddress.KERNEL32(00000000,FlsSetValue), ref: 00727F9E
Part of subcall function 0072123A: GetProcAddress.KERNEL32(00000000,InitializeCriticalSectionEx), ref: 00727FB1
Part of subcall function 0072123A: GetProcAddress.KERNEL32(00000000,CreateSemaphoreExW), ref: 00727FC4
Part of subcall function 0072123A: GetProcAddress.KERNEL32(00000000,SetThreadStackGuarantee), ref: 00727FD7
Part of subcall function 0072123A: GetProcAddress.KERNEL32(00000000,CreateThreadpoolTimer), ref: 00727FEA
Part of subcall function 0072123A: GetProcAddress.KERNEL32(00000000,SetThreadpoolTimer), ref: 00727FFD
Part of subcall function 0072123A: GetProcAddress.KERNEL32(00000000,WaitForThreadpoolTimerCallbacks), ref: 00728010
Part of subcall function 0072123A: GetProcAddress.KERNEL32(00000000,CloseThreadpoolTimer), ref: 00728023
Part of subcall function 0072123A: GetProcAddress.KERNEL32(00000000,CreateThreadpoolWait), ref: 00728036
Part of subcall function 0072123A: GetProcAddress.KERNEL32(00000000,SetThreadpoolWait), ref: 00728049
Part of subcall function 0072123A: GetProcAddress.KERNEL32(00000000,CloseThreadpoolWait), ref: 0072805C
Part of subcall function 0072123A: GetProcAddress.KERNEL32(00000000,FlushProcessWriteBuffers), ref: 0072806F

__mtinitlocks.LIBCMT ref: 00727B4C

Part of subcall function 00727E23: InitializeCriticalSectionAndSpinCount.KERNEL32(007BAC68,00000FA0,?,?,00727B51,00725E77,007B6C70,00000014), ref: 00727E41

__mtterm.LIBCMT ref: 00727B55

Part of subcall function 00727BBD: DeleteCriticalSection.KERNEL32(00000000,00000000,?,?,00727B5A,00725E77,007B6C70,00000014), ref: 00727D3F
Part of subcall function 00727BBD: _free.LIBCMT ref: 00727D46
Part of subcall function 00727BBD: DeleteCriticalSection.KERNEL32(007BAC68,?,?,00727B5A,00725E77,007B6C70,00000014), ref: 00727D68

__calloc_crt.LIBCMT ref: 00727B7A
GetCurrentThreadId.KERNEL32 ref: 00727BA3

Memory Dump Source

Source File: 00000000.00000002.1281263787.0000000000701000.00000020.00000001.01000000.00000003.sdmp, Offset: 00700000, based on PE: true

Associated: 00000000.00000002.1281243473.0000000000700000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1281360671.000000000078D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1281360671.00000000007AE000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1281496264.00000000007BA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1281529307.00000000007C4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1281529307.00000000007C7000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1281529307.00000000007D5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1281529307.00000000007D7000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_700000_OC & PL.jbxd

Similarity

API ID: AddressProc$CriticalSection$Delete$CountCurrentHandleInitializeModuleSpinThread__calloc_crt__init_pointers__initp_misc_winsig__mtinitlocks__mtterm_free
String ID:
API String ID: 2942034483-0
Opcode ID: 8df49e80a2ae927a2d925bd83044ec29f8db5980dda7b807f9f0b0c72a06827b
Instruction ID: c2a18b943c42c96afd4fd8a73265771fd53d196389bf8697ac5c867c00a726c3
Opcode Fuzzy Hash: 8df49e80a2ae927a2d925bd83044ec29f8db5980dda7b807f9f0b0c72a06827b
Instruction Fuzzy Hash: C2F090B250D332AAE62D77757E4EA4A27D49F01730F614699F8A0C50D2FF2D8C41C178

Function 007027EC Relevance: 9.0, APIs: 6, Instructions: 44keyboardCOMMON

Download Yara Rule

APIs

MapVirtualKeyW.USER32(0000005B,00000000), ref: 0070281D
MapVirtualKeyW.USER32(00000010,00000000), ref: 00702825
MapVirtualKeyW.USER32(000000A0,00000000), ref: 00702830
MapVirtualKeyW.USER32(000000A1,00000000), ref: 0070283B
MapVirtualKeyW.USER32(00000011,00000000), ref: 00702843
MapVirtualKeyW.USER32(00000012,00000000), ref: 0070284B

Memory Dump Source

Source File: 00000000.00000002.1281263787.0000000000701000.00000020.00000001.01000000.00000003.sdmp, Offset: 00700000, based on PE: true

Associated: 00000000.00000002.1281243473.0000000000700000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1281360671.000000000078D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1281360671.00000000007AE000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1281496264.00000000007BA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1281529307.00000000007C4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1281529307.00000000007C7000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1281529307.00000000007D5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1281529307.00000000007D7000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_700000_OC & PL.jbxd

Similarity

API ID: Virtual
String ID:
API String ID: 4278518827-0
Opcode ID: fa43896438a976fdc418ca8e0eae6a2c79bb78f057763214c93200f9706b6680
Instruction ID: afdaf94e439bc6c1de455f57c82e3cb309b73e4baf53752c838c8fff058e58e7
Opcode Fuzzy Hash: fa43896438a976fdc418ca8e0eae6a2c79bb78f057763214c93200f9706b6680
Instruction Fuzzy Hash: AE016CB0941B5D7DE3008F6A8C85B52FFA8FF15354F00411B915C47941C7F5A864CBE5

Function 00749AD5 Relevance: 9.0, APIs: 6, Instructions: 44COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1281263787.0000000000701000.00000020.00000001.01000000.00000003.sdmp, Offset: 00700000, based on PE: true

Associated: 00000000.00000002.1281243473.0000000000700000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1281360671.000000000078D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1281360671.00000000007AE000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1281496264.00000000007BA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1281529307.00000000007C4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1281529307.00000000007C7000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1281529307.00000000007D5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1281529307.00000000007D7000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_700000_OC & PL.jbxd

Similarity

API ID: CriticalExchangeInterlockedSection$EnterLeaveObjectSingleTerminateThreadWait
String ID:
API String ID: 1423608774-0
Opcode ID: 362ff7abe948391b3cc2937975b586e68356d6d273ea42da2ce5e82a5adf4a12
Instruction ID: 0c057a97a182e4cf186308937a1518652fe81808e9fc576c1c93510c03593dc5
Opcode Fuzzy Hash: 362ff7abe948391b3cc2937975b586e68356d6d273ea42da2ce5e82a5adf4a12
Instruction Fuzzy Hash: 8C016D32282211EBDB252B54EC48DEB776ABF88711B148529F603925A0DB7CDC00DB54

Function 00747BF7 Relevance: 9.0, APIs: 6, Instructions: 42windowtimethreadCOMMON

Download Yara Rule

APIs

PostMessageW.USER32(?,00000010,00000000,00000000), ref: 00747C07
SendMessageTimeoutW.USER32(?,00000010,00000000,00000000,00000002,000001F4,?), ref: 00747C1D
GetWindowThreadProcessId.USER32(?,?), ref: 00747C2C
OpenProcess.KERNEL32(001F0FFF,00000000,?,?,?,?,00000010,00000000,00000000,00000002,000001F4,?,?,00000010,00000000,00000000), ref: 00747C3B
TerminateProcess.KERNEL32(00000000,00000000,?,?,?,00000010,00000000,00000000,00000002,000001F4,?,?,00000010,00000000,00000000), ref: 00747C45
CloseHandle.KERNEL32(00000000,?,?,?,00000010,00000000,00000000,00000002,000001F4,?,?,00000010,00000000,00000000), ref: 00747C4C

Memory Dump Source

Source File: 00000000.00000002.1281263787.0000000000701000.00000020.00000001.01000000.00000003.sdmp, Offset: 00700000, based on PE: true

Associated: 00000000.00000002.1281243473.0000000000700000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1281360671.000000000078D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1281360671.00000000007AE000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1281496264.00000000007BA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1281529307.00000000007C4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1281529307.00000000007C7000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1281529307.00000000007D5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1281529307.00000000007D7000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_700000_OC & PL.jbxd

Similarity

API ID: Process$Message$CloseHandleOpenPostSendTerminateThreadTimeoutWindow
String ID:
API String ID: 839392675-0
Opcode ID: 3525009aeb3872fa7010a9117150d92970af5b053fe385f9defceef244630d7c
Instruction ID: 4645549d071f0d54db4494eb606e21f310cd239e6a1d2525f788481bdcb1cf99
Opcode Fuzzy Hash: 3525009aeb3872fa7010a9117150d92970af5b053fe385f9defceef244630d7c
Instruction Fuzzy Hash: 44F01772681158BBE6315B529C0EEEF7B7CEFC6B61F104018FA01D1091E7A85E41C7B9

Function 00749A20 Relevance: 9.0, APIs: 6, Instructions: 33synchronizationthreadCOMMONLIBRARYCODE

Download Yara Rule

APIs

InterlockedExchange.KERNEL32(?,?), ref: 00749A33
EnterCriticalSection.KERNEL32(?,?,?,?,00775DEE,?,?,?,?,?,0070ED63), ref: 00749A44
TerminateThread.KERNEL32(?,000001F6,?,?,?,00775DEE,?,?,?,?,?,0070ED63), ref: 00749A51
WaitForSingleObject.KERNEL32(?,000003E8,?,?,?,00775DEE,?,?,?,?,?,0070ED63), ref: 00749A5E

Part of subcall function 007493D1: CloseHandle.KERNEL32(?,?,00749A6B,?,?,?,00775DEE,?,?,?,?,?,0070ED63), ref: 007493DB

InterlockedExchange.KERNEL32(?,000001F6), ref: 00749A71
LeaveCriticalSection.KERNEL32(?,?,?,?,00775DEE,?,?,?,?,?,0070ED63), ref: 00749A78

Memory Dump Source

Source File: 00000000.00000002.1281263787.0000000000701000.00000020.00000001.01000000.00000003.sdmp, Offset: 00700000, based on PE: true

Associated: 00000000.00000002.1281243473.0000000000700000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1281360671.000000000078D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1281360671.00000000007AE000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1281496264.00000000007BA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1281529307.00000000007C4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1281529307.00000000007C7000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1281529307.00000000007D5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1281529307.00000000007D7000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_700000_OC & PL.jbxd

Similarity

API ID: CriticalExchangeInterlockedSection$CloseEnterHandleLeaveObjectSingleTerminateThreadWait
String ID:
API String ID: 3495660284-0
Opcode ID: fce873789effe96ec8619147972219e3b9933e6cb8d8c0381ff7741ce47a888c
Instruction ID: dc006053120ef35a8ef98b2f5e870f09769696bf5390fbaf1686868196cf15b2
Opcode Fuzzy Hash: fce873789effe96ec8619147972219e3b9933e6cb8d8c0381ff7741ce47a888c
Instruction Fuzzy Hash: E4F05E32181211EBD7612BA4EC8DDAB773AFF85311B248425F603910E0DB7DDC01DB54

Function 0075AFE0 Relevance: 9.0, APIs: 3, Strings: 2, Instructions: 229COMMON

Download Yara Rule

APIs

VariantInit.OLEAUT32(?), ref: 0075B006
CharUpperBuffW.USER32(?,?), ref: 0075B115
VariantClear.OLEAUT32(?), ref: 0075B298

Part of subcall function 00749DC5: VariantInit.OLEAUT32(00000000), ref: 00749E05
Part of subcall function 00749DC5: VariantCopy.OLEAUT32(?,?), ref: 00749E0E
Part of subcall function 00749DC5: VariantClear.OLEAUT32(?), ref: 00749E1A

Strings

AUTOIT.ERROR, xrefs: 0075B11B
Incorrect Parameter format, xrefs: 0075B03E, 0075B20B

Memory Dump Source

Source File: 00000000.00000002.1281263787.0000000000701000.00000020.00000001.01000000.00000003.sdmp, Offset: 00700000, based on PE: true

Associated: 00000000.00000002.1281243473.0000000000700000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1281360671.000000000078D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1281360671.00000000007AE000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1281496264.00000000007BA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1281529307.00000000007C4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1281529307.00000000007C7000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1281529307.00000000007D5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1281529307.00000000007D7000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_700000_OC & PL.jbxd

Similarity

API ID: Variant$ClearInit$BuffCharCopyUpper
String ID: AUTOIT.ERROR$Incorrect Parameter format
API String ID: 4237274167-1221869570
Opcode ID: 18c50c5e4f999444b028f1735d7c312d1601fd2796dd9f9de32eb8c0db4fb381
Instruction ID: 30aedfb49125fd47aaa0789337bd9fb5bf71aa559a45657a0e3a8bedff8c1b53
Opcode Fuzzy Hash: 18c50c5e4f999444b028f1735d7c312d1601fd2796dd9f9de32eb8c0db4fb381
Instruction Fuzzy Hash: B8915C70608301DFCB10DF24C4859AAB7E4BF89704F14896DF89A9B392DB79ED49CB52

Function 00745347 Relevance: 8.9, APIs: 4, Strings: 1, Instructions: 180windowCOMMON

Download Yara Rule

APIs

Part of subcall function 0071C6F4: _wcscpy.LIBCMT ref: 0071C717

_memset.LIBCMT ref: 00745438
GetMenuItemInfoW.USER32(?), ref: 00745467
SetMenuItemInfoW.USER32(?,?,00000000,?), ref: 00745513
SetMenuDefaultItem.USER32(?,000000FF,00000000), ref: 0074553D

Strings

0, xrefs: 00745430

Memory Dump Source

Source File: 00000000.00000002.1281263787.0000000000701000.00000020.00000001.01000000.00000003.sdmp, Offset: 00700000, based on PE: true

Associated: 00000000.00000002.1281243473.0000000000700000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1281360671.000000000078D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1281360671.00000000007AE000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1281496264.00000000007BA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1281529307.00000000007C4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1281529307.00000000007C7000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1281529307.00000000007D5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1281529307.00000000007D7000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_700000_OC & PL.jbxd

Similarity

API ID: ItemMenu$Info$Default_memset_wcscpy
String ID: 0
API String ID: 4152858687-4108050209
Opcode ID: 2a8a1675a7231a6a99361877f26325521588309e5912d1779d989455a95cc3dc
Instruction ID: da6d3dc951f4768ad68aceb0ba5e7213a335ea9c6757b721c98209831f31a952
Opcode Fuzzy Hash: 2a8a1675a7231a6a99361877f26325521588309e5912d1779d989455a95cc3dc
Instruction Fuzzy Hash: 23511F722047019BD7149F28C844BBBB7EAAF86324F14062EF895D31D3DBACCD548B92

Function 00740213 Relevance: 8.9, APIs: 4, Strings: 1, Instructions: 120comlibraryloaderCOMMON

Download Yara Rule

APIs

CoCreateInstance.OLE32(?,00000000,00000005,?,?,?,?,?,?,?,?,?,?,?), ref: 0074027B
SetErrorMode.KERNEL32(00000001,?,?,?,?,?,?,?,?,?), ref: 007402B1
GetProcAddress.KERNEL32(?,DllGetClassObject), ref: 007402C2
SetErrorMode.KERNEL32(00000000,?,?,?,?,?,?,?,?,?), ref: 00740344

Strings

DllGetClassObject, xrefs: 007402B7

Memory Dump Source

Source File: 00000000.00000002.1281263787.0000000000701000.00000020.00000001.01000000.00000003.sdmp, Offset: 00700000, based on PE: true

Associated: 00000000.00000002.1281243473.0000000000700000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1281360671.000000000078D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1281360671.00000000007AE000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1281496264.00000000007BA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1281529307.00000000007C4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1281529307.00000000007C7000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1281529307.00000000007D5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1281529307.00000000007D7000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_700000_OC & PL.jbxd

Similarity

API ID: ErrorMode$AddressCreateInstanceProc
String ID: DllGetClassObject
API String ID: 753597075-1075368562
Opcode ID: 7b7e0f372778d10bdd82f5953649c88def1893c9e0cb0627d431089ab8dcea31
Instruction ID: 499ad748c832eb5ac54ab240cd35f4534006d7f4085ba7fbd2e664f369fa917d
Opcode Fuzzy Hash: 7b7e0f372778d10bdd82f5953649c88def1893c9e0cb0627d431089ab8dcea31
Instruction Fuzzy Hash: 62415BB1600204EFDB15DF54C884BAA7FB9EF44310B1580ADEA099F246D7B9DD44CBE0

Function 00745007 Relevance: 8.9, APIs: 4, Strings: 1, Instructions: 114windowCOMMON

Download Yara Rule

APIs

_memset.LIBCMT ref: 00745075
GetMenuItemInfoW.USER32 ref: 00745091
DeleteMenu.USER32(00000004,00000007,00000000), ref: 007450D7
DeleteMenu.USER32(?,00000000,00000000,?,00000000,00000000,007C1708,00000000), ref: 00745120

Strings

0, xrefs: 0074506D

Memory Dump Source

Source File: 00000000.00000002.1281263787.0000000000701000.00000020.00000001.01000000.00000003.sdmp, Offset: 00700000, based on PE: true

Associated: 00000000.00000002.1281243473.0000000000700000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1281360671.000000000078D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1281360671.00000000007AE000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1281496264.00000000007BA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1281529307.00000000007C4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1281529307.00000000007C7000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1281529307.00000000007D5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1281529307.00000000007D7000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_700000_OC & PL.jbxd

Similarity

API ID: Menu$Delete$InfoItem_memset
String ID: 0
API String ID: 1173514356-4108050209
Opcode ID: 6d46ad43e0a93ecaa0c219db1507cd04d38b7c53daa8fe8aad6fb6052e23b214
Instruction ID: 7eb6c5d683a59d3d70acb1ce453cfec1877f3f91018e522aec7ee7d22bd93ea8
Opcode Fuzzy Hash: 6d46ad43e0a93ecaa0c219db1507cd04d38b7c53daa8fe8aad6fb6052e23b214
Instruction Fuzzy Hash: 6141F330204745EFD720DF24DC84B2AB7E4AF89724F144A1EF865972D2D738E900CB62

Function 00760567 Relevance: 8.8, APIs: 1, Strings: 4, Instructions: 100COMMON

Download Yara Rule

APIs

CharLowerBuffW.USER32(?,?,?,?), ref: 00760587

Strings

none, xrefs: 00760662
cdecl, xrefs: 007605DE
stdcall, xrefs: 00760609
winapi, xrefs: 007605F8

Memory Dump Source

Source File: 00000000.00000002.1281263787.0000000000701000.00000020.00000001.01000000.00000003.sdmp, Offset: 00700000, based on PE: true

Associated: 00000000.00000002.1281243473.0000000000700000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1281360671.000000000078D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1281360671.00000000007AE000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1281496264.00000000007BA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1281529307.00000000007C4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1281529307.00000000007C7000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1281529307.00000000007D5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1281529307.00000000007D7000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_700000_OC & PL.jbxd

Similarity

API ID: BuffCharLower
String ID: cdecl$none$stdcall$winapi
API String ID: 2358735015-567219261
Opcode ID: 95cd24406531d95e46a92988ca6876e6f0beebc193b59a93f550ed7d7ac3c51d
Instruction ID: d5d99c5138fac59287f3ededa1b9e334ad56e03de71a7a1b786867d2edef974b
Opcode Fuzzy Hash: 95cd24406531d95e46a92988ca6876e6f0beebc193b59a93f550ed7d7ac3c51d
Instruction Fuzzy Hash: 24319E70600216EFCF00EF68CC559EFB3B4FF54314B108629E826A76D2DB79A956CB90

Function 0073B80A Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 93windowCOMMON

Download Yara Rule

APIs

SendMessageW.USER32(?,00000188,00000000,00000000), ref: 0073B88E
SendMessageW.USER32(?,0000018A,00000000,00000000), ref: 0073B8A1
SendMessageW.USER32(?,00000189,?,00000000), ref: 0073B8D1

Strings

ListBox, xrefs: 0073B84D
ComboBox, xrefs: 0073B815

Memory Dump Source

Source File: 00000000.00000002.1281263787.0000000000701000.00000020.00000001.01000000.00000003.sdmp, Offset: 00700000, based on PE: true

Associated: 00000000.00000002.1281243473.0000000000700000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1281360671.000000000078D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1281360671.00000000007AE000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1281496264.00000000007BA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1281529307.00000000007C4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1281529307.00000000007C7000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1281529307.00000000007D5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1281529307.00000000007D7000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_700000_OC & PL.jbxd

Similarity

API ID: MessageSend
String ID: ComboBox$ListBox
API String ID: 3850602802-1403004172
Opcode ID: 8cbb4998ccc807157b40dcc6027e83f74c03017cea4bf1b3ff8d903fc27a0dde
Instruction ID: 4ef38a4cad60779794083f883b7e89159ac1b400a3a9d7bb8a6d6c0baef27d9e
Opcode Fuzzy Hash: 8cbb4998ccc807157b40dcc6027e83f74c03017cea4bf1b3ff8d903fc27a0dde
Instruction Fuzzy Hash: 3F21B1B1A00108EFEB14ABA4D89ADFE77B8DF15350F108229F521A61E2DB7C5D069760

Function 007543E2 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 85networkCOMMON

Download Yara Rule

APIs

InternetOpenUrlW.WININET(?,?,00000000,00000000,?,00000000), ref: 00754401
HttpSendRequestW.WININET(00000000,00000000,00000000,00000000,00000000), ref: 00754427
HttpQueryInfoW.WININET(00000000,00000005,?,?,?), ref: 00754457
InternetCloseHandle.WININET(00000000), ref: 0075449E

Part of subcall function 00755052: GetLastError.KERNEL32(?,?,007543CC,00000000,00000000,00000001), ref: 00755067

Strings

, xrefs: 00754450

Memory Dump Source

Source File: 00000000.00000002.1281263787.0000000000701000.00000020.00000001.01000000.00000003.sdmp, Offset: 00700000, based on PE: true

Associated: 00000000.00000002.1281243473.0000000000700000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1281360671.000000000078D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1281360671.00000000007AE000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1281496264.00000000007BA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1281529307.00000000007C4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1281529307.00000000007C7000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1281529307.00000000007D5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1281529307.00000000007D7000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_700000_OC & PL.jbxd

Similarity

API ID: HttpInternet$CloseErrorHandleInfoLastOpenQueryRequestSend
String ID:
API String ID: 1951874230-3916222277
Opcode ID: d4622f0b18666d24e570f33b5aee7b1263551bca0ed5a0a891ea90aea60f5672
Instruction ID: afbfaf6ce0a7f66420c0993b33385f179e0b050da44a0cd3c702e5e475efe339
Opcode Fuzzy Hash: d4622f0b18666d24e570f33b5aee7b1263551bca0ed5a0a891ea90aea60f5672
Instruction Fuzzy Hash: 512192B2540208BFE7219F64CC85FFF77FCEB48759F10811AF90992140EAA88D499771

Function 007690E2 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 80windowlibraryCOMMON

Download Yara Rule

APIs

Part of subcall function 0071D17C: CreateWindowExW.USER32(?,?,?,?,?,?,?,?,?,?,00000000,00000096), ref: 0071D1BA
Part of subcall function 0071D17C: GetStockObject.GDI32(00000011), ref: 0071D1CE
Part of subcall function 0071D17C: SendMessageW.USER32(00000000,00000030,00000000), ref: 0071D1D8

SendMessageW.USER32(00000000,00000467,00000000,?), ref: 0076915C
LoadLibraryW.KERNEL32(?), ref: 00769163
SendMessageW.USER32(?,00000467,00000000,00000000), ref: 00769178
DestroyWindow.USER32(?), ref: 00769180

Strings

SysAnimate32, xrefs: 00769137

Memory Dump Source

Source File: 00000000.00000002.1281263787.0000000000701000.00000020.00000001.01000000.00000003.sdmp, Offset: 00700000, based on PE: true

Associated: 00000000.00000002.1281243473.0000000000700000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1281360671.000000000078D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1281360671.00000000007AE000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1281496264.00000000007BA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1281529307.00000000007C4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1281529307.00000000007C7000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1281529307.00000000007D5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1281529307.00000000007D7000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_700000_OC & PL.jbxd

Similarity

API ID: MessageSend$Window$CreateDestroyLibraryLoadObjectStock
String ID: SysAnimate32
API String ID: 4146253029-1011021900
Opcode ID: 841d799bcd48a77ccffed6084a9026fda4f547e7efe6ba4e00364bdeb68d42af
Instruction ID: 12748808b1e7eb621d6c913e1c619be981bb58e56fa7e1dbc8ba2176ac69042c
Opcode Fuzzy Hash: 841d799bcd48a77ccffed6084a9026fda4f547e7efe6ba4e00364bdeb68d42af
Instruction Fuzzy Hash: 37218E7120020ABBEF244E649C88EBA77ADEF9A364F204618FE56921D0D739DC41A761

Function 00749568 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 78filepipeCOMMON

Download Yara Rule

APIs

GetStdHandle.KERNEL32(0000000C), ref: 00749588
CreatePipe.KERNEL32(?,?,0000000C,00000000), ref: 007495B9
GetStdHandle.KERNEL32(0000000C), ref: 007495CB
CreateFileW.KERNEL32(nul,40000000,00000002,0000000C,00000003,00000080,00000000), ref: 00749605

Strings

nul, xrefs: 00749600

Memory Dump Source

Source File: 00000000.00000002.1281263787.0000000000701000.00000020.00000001.01000000.00000003.sdmp, Offset: 00700000, based on PE: true

Associated: 00000000.00000002.1281243473.0000000000700000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1281360671.000000000078D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1281360671.00000000007AE000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1281496264.00000000007BA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1281529307.00000000007C4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1281529307.00000000007C7000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1281529307.00000000007D5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1281529307.00000000007D7000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_700000_OC & PL.jbxd

Similarity

API ID: CreateHandle$FilePipe
String ID: nul
API String ID: 4209266947-2873401336
Opcode ID: 24def29b0ec71d2a1b9646618105d949b8bf170556e03632e98df8f40695efdd
Instruction ID: c784e025f91c4d5bb9bffdca3865bb0abddfeb4239f9a833cc9b27f6056f3131
Opcode Fuzzy Hash: 24def29b0ec71d2a1b9646618105d949b8bf170556e03632e98df8f40695efdd
Instruction Fuzzy Hash: C4216070600205ABEB219F29DC45A9BBBF8BF45720F304A19FAA1D72D0D778DD50CB20

Function 00749634 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 78filepipeCOMMON

Download Yara Rule

APIs

GetStdHandle.KERNEL32(000000F6), ref: 00749653
CreatePipe.KERNEL32(?,?,0000000C,00000000), ref: 00749683
GetStdHandle.KERNEL32(000000F6), ref: 00749694
CreateFileW.KERNEL32(nul,80000000,00000001,0000000C,00000003,00000080,00000000), ref: 007496CE

Strings

nul, xrefs: 007496C9

Memory Dump Source

Source File: 00000000.00000002.1281263787.0000000000701000.00000020.00000001.01000000.00000003.sdmp, Offset: 00700000, based on PE: true

Associated: 00000000.00000002.1281243473.0000000000700000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1281360671.000000000078D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1281360671.00000000007AE000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1281496264.00000000007BA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1281529307.00000000007C4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1281529307.00000000007C7000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1281529307.00000000007D5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1281529307.00000000007D7000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_700000_OC & PL.jbxd

Similarity

API ID: CreateHandle$FilePipe
String ID: nul
API String ID: 4209266947-2873401336
Opcode ID: a15c17b05f7e1d213623d3cb1dbacf53a85479629e345dfa2f376365a67adbf3
Instruction ID: a6eb5f69b4ea0628e8894a0780cbbd9580acd2ca45d575d96dce5060e1ba41ee
Opcode Fuzzy Hash: a15c17b05f7e1d213623d3cb1dbacf53a85479629e345dfa2f376365a67adbf3
Instruction Fuzzy Hash: 5E21AF716002059BDB209F698C48E9B77F8BF95730F214A18FAA1E32D0E7789C41CB26

Function 0074DAF6 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 72COMMON

Download Yara Rule

APIs

SetErrorMode.KERNEL32(00000001), ref: 0074DB0A
GetVolumeInformationW.KERNEL32(?,?,00007FFF,?,00000000,00000000,00000000,00000000), ref: 0074DB5E
__swprintf.LIBCMT ref: 0074DB77
SetErrorMode.KERNEL32(00000000,00000001,00000000,0079DC00), ref: 0074DBB5

Strings

%lu, xrefs: 0074DB71

Memory Dump Source

Source File: 00000000.00000002.1281263787.0000000000701000.00000020.00000001.01000000.00000003.sdmp, Offset: 00700000, based on PE: true

Associated: 00000000.00000002.1281243473.0000000000700000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1281360671.000000000078D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1281360671.00000000007AE000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1281496264.00000000007BA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1281529307.00000000007C4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1281529307.00000000007C7000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1281529307.00000000007D5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1281529307.00000000007D7000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_700000_OC & PL.jbxd

Similarity

API ID: ErrorMode$InformationVolume__swprintf
String ID: %lu
API String ID: 3164766367-685833217
Opcode ID: 2142404b05315f8a973e1ee4fb907e75bc28907028227056bbf78334faf9363e
Instruction ID: fcf47625caa12715b2d4d0c8b869dde7dda4e9c3067f5e258aeb1b0d556bfd72
Opcode Fuzzy Hash: 2142404b05315f8a973e1ee4fb907e75bc28907028227056bbf78334faf9363e
Instruction Fuzzy Hash: 5621B375A00108EFCB11EFA4D989DAEBBF8EF89700B104069F505D7291DB78EE01CB60

Function 0073C9E0 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 67windowCOMMON

Download Yara Rule

APIs

Part of subcall function 0073C82D: SendMessageTimeoutW.USER32(?,00000000,00000000,00000000,00000002,00001388,00000001), ref: 0073C84A
Part of subcall function 0073C82D: GetWindowThreadProcessId.USER32(?,00000000), ref: 0073C85D
Part of subcall function 0073C82D: GetCurrentThreadId.KERNEL32 ref: 0073C864
Part of subcall function 0073C82D: AttachThreadInput.USER32(00000000), ref: 0073C86B

GetFocus.USER32 ref: 0073CA05

Part of subcall function 0073C876: GetParent.USER32(?), ref: 0073C884

GetClassNameW.USER32(?,?,00000100), ref: 0073CA4E
EnumChildWindows.USER32(?,0073CAC4), ref: 0073CA76
__swprintf.LIBCMT ref: 0073CA90

Strings

%s%d, xrefs: 0073CA8A

Memory Dump Source

Source File: 00000000.00000002.1281263787.0000000000701000.00000020.00000001.01000000.00000003.sdmp, Offset: 00700000, based on PE: true

Associated: 00000000.00000002.1281243473.0000000000700000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1281360671.000000000078D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1281360671.00000000007AE000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1281496264.00000000007BA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1281529307.00000000007C4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1281529307.00000000007C7000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1281529307.00000000007D5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1281529307.00000000007D7000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_700000_OC & PL.jbxd

Similarity

API ID: Thread$AttachChildClassCurrentEnumFocusInputMessageNameParentProcessSendTimeoutWindowWindows__swprintf
String ID: %s%d
API String ID: 3187004680-1110647743
Opcode ID: b3ce3b151604633e2245c17fdf9d6df80dda58a7c94b082e139d4c041f86f3c9
Instruction ID: 888030a8c9979ef96e55fc26410b6d014771fdd307b399bd048dd31a537f5561
Opcode Fuzzy Hash: b3ce3b151604633e2245c17fdf9d6df80dda58a7c94b082e139d4c041f86f3c9
Instruction Fuzzy Hash: 231145B1600209ABDF12BF609C89FE93778AF44714F008065F909BA183DB789A45DB70

Function 00727A94 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 41COMMONLIBRARYCODE

Download Yara Rule

APIs

__lock.LIBCMT ref: 00727AD8

Part of subcall function 00727CF4: __mtinitlocknum.LIBCMT ref: 00727D06
Part of subcall function 00727CF4: EnterCriticalSection.KERNEL32(00000000,?,00727ADD,0000000D), ref: 00727D1F

InterlockedIncrement.KERNEL32(?), ref: 00727AE5
__lock.LIBCMT ref: 00727AF9
___addlocaleref.LIBCMT ref: 00727B17

Strings

`x, xrefs: 00727AA3

Memory Dump Source

Source File: 00000000.00000002.1281263787.0000000000701000.00000020.00000001.01000000.00000003.sdmp, Offset: 00700000, based on PE: true

Associated: 00000000.00000002.1281243473.0000000000700000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1281360671.000000000078D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1281360671.00000000007AE000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1281496264.00000000007BA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1281529307.00000000007C4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1281529307.00000000007C7000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1281529307.00000000007D5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1281529307.00000000007D7000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_700000_OC & PL.jbxd

Similarity

API ID: __lock$CriticalEnterIncrementInterlockedSection___addlocaleref__mtinitlocknum
String ID: `x
API String ID: 1687444384-280707560
Opcode ID: 7fadb825e4667c6e8ea4937c38662508d0d16305dfdbee48de7241e5629e0ff4
Instruction ID: 90296dec7dfb02d004d0d7e21b456c234e703fef32eec379e9bc8cfb9143c59d
Opcode Fuzzy Hash: 7fadb825e4667c6e8ea4937c38662508d0d16305dfdbee48de7241e5629e0ff4
Instruction Fuzzy Hash: 870184B1544B00EFD720EF75E90974AB7F0FF40325F20890EE495976A0CB78A684CB55

Function 0076E32E Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 40processCOMMON

Download Yara Rule

APIs

_memset.LIBCMT ref: 0076E33D
_memset.LIBCMT ref: 0076E34C
CreateProcessW.KERNEL32(00000000,?,00000000,00000000,00000000,00000020,00000000,00000000,007C3D00,007C3D44), ref: 0076E37B
CloseHandle.KERNEL32 ref: 0076E38D

Strings

D=|, xrefs: 0076E346

Memory Dump Source

Source File: 00000000.00000002.1281263787.0000000000701000.00000020.00000001.01000000.00000003.sdmp, Offset: 00700000, based on PE: true

Associated: 00000000.00000002.1281243473.0000000000700000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1281360671.000000000078D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1281360671.00000000007AE000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1281496264.00000000007BA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1281529307.00000000007C4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1281529307.00000000007C7000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1281529307.00000000007D5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1281529307.00000000007D7000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_700000_OC & PL.jbxd

Similarity

API ID: _memset$CloseCreateHandleProcess
String ID: D=|
API String ID: 3277943733-3146353063
Opcode ID: f4aaf42b36222c7c02c15a5634dffe309da9999739850fedec33ec96492de1fe
Instruction ID: 9756662b617a14e3153dd883741179bfc172bdd7eb64241caf31e1fac0dac6c8
Opcode Fuzzy Hash: f4aaf42b36222c7c02c15a5634dffe309da9999739850fedec33ec96492de1fe
Instruction Fuzzy Hash: AEF0DAB1741314BAE2106B65AC49FB77F6CDB04755F00C429BE0ADA1A2D67D9E1086B8

Function 00761945 Relevance: 7.7, APIs: 5, Instructions: 232COMMON

Download Yara Rule

APIs

OpenProcess.KERNEL32(00000410,00000000,00000000), ref: 007619F3
GetProcessIoCounters.KERNEL32(00000000,?), ref: 00761A26
GetProcessMemoryInfo.PSAPI(00000000,?,00000028), ref: 00761B49
CloseHandle.KERNEL32(?), ref: 00761BBF

Memory Dump Source

Source File: 00000000.00000002.1281263787.0000000000701000.00000020.00000001.01000000.00000003.sdmp, Offset: 00700000, based on PE: true

Associated: 00000000.00000002.1281243473.0000000000700000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1281360671.000000000078D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1281360671.00000000007AE000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1281496264.00000000007BA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1281529307.00000000007C4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1281529307.00000000007C7000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1281529307.00000000007D5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1281529307.00000000007D7000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_700000_OC & PL.jbxd

Similarity

API ID: Process$CloseCountersHandleInfoMemoryOpen
String ID:
API String ID: 2364364464-0
Opcode ID: 05c757d0341e702790eca2c7d1b6de4eee24465348a79dd8c5150d55b24dfdb3
Instruction ID: c7ed61544f57f4afd186db7492e7062b2d41374f4f5c0167f8837176fdbdefb8
Opcode Fuzzy Hash: 05c757d0341e702790eca2c7d1b6de4eee24465348a79dd8c5150d55b24dfdb3
Instruction Fuzzy Hash: 718144B0640214EBDF21DF64C89ABADBBE5AF04710F18C459F905AF3C2D7B9AD418B90

Function 0076E062 Relevance: 7.7, APIs: 5, Instructions: 187windowCOMMON

Download Yara Rule

APIs

SendMessageW.USER32(?,0000041C,00000000,00000000), ref: 0076E1D5
SendMessageW.USER32(?,000000B0,?,?), ref: 0076E20D
IsDlgButtonChecked.USER32(?,00000001), ref: 0076E248
GetWindowLongW.USER32(?,000000EC), ref: 0076E269
SendMessageW.USER32(?,000000A1,00000002,00000000), ref: 0076E281

Memory Dump Source

Source File: 00000000.00000002.1281263787.0000000000701000.00000020.00000001.01000000.00000003.sdmp, Offset: 00700000, based on PE: true

Associated: 00000000.00000002.1281243473.0000000000700000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1281360671.000000000078D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1281360671.00000000007AE000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1281496264.00000000007BA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1281529307.00000000007C4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1281529307.00000000007C7000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1281529307.00000000007D5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1281529307.00000000007D7000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_700000_OC & PL.jbxd

Similarity

API ID: MessageSend$ButtonCheckedLongWindow
String ID:
API String ID: 3188977179-0
Opcode ID: b13644116ffa2cbe13e4876b38fff150e795b42215469dc1d4ae66a6131abc7b
Instruction ID: 188d002ac66f1e2d792d20d0d60c2b7cfcb93b78daae42f19beebd52e893bb5a
Opcode Fuzzy Hash: b13644116ffa2cbe13e4876b38fff150e795b42215469dc1d4ae66a6131abc7b
Instruction Fuzzy Hash: 2861B438600208EFDB25CF58C894FAA77BAEF4A300F1480A9FD5697391C778AD51DB21

Function 00760688 Relevance: 7.6, APIs: 5, Instructions: 149libraryloaderCOMMON

Download Yara Rule

APIs

Part of subcall function 0070936C: __swprintf.LIBCMT ref: 007093AB
Part of subcall function 0070936C: __itow.LIBCMT ref: 007093DF

LoadLibraryW.KERNEL32(?,00000004,?,?), ref: 007606EE
GetProcAddress.KERNEL32(00000000,?), ref: 0076077D
GetProcAddress.KERNEL32(00000000,00000000), ref: 0076079B
GetProcAddress.KERNEL32(00000000,?), ref: 007607E1
FreeLibrary.KERNEL32(00000000,00000004), ref: 007607FB

Part of subcall function 0071E65E: WideCharToMultiByte.KERNEL32(00000000,00000000,00000000,?,00000000,00000000,00000000,00000000,00000000,00000000,?,0074A574,?,?,00000000,00000008), ref: 0071E675
Part of subcall function 0071E65E: WideCharToMultiByte.KERNEL32(00000000,00000000,00000000,?,00000000,00000000,00000000,00000000,?,?,0074A574,?,?,00000000,00000008), ref: 0071E699

Memory Dump Source

Source File: 00000000.00000002.1281263787.0000000000701000.00000020.00000001.01000000.00000003.sdmp, Offset: 00700000, based on PE: true

Associated: 00000000.00000002.1281243473.0000000000700000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1281360671.000000000078D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1281360671.00000000007AE000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1281496264.00000000007BA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1281529307.00000000007C4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1281529307.00000000007C7000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1281529307.00000000007D5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1281529307.00000000007D7000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_700000_OC & PL.jbxd

Similarity

API ID: AddressProc$ByteCharLibraryMultiWide$FreeLoad__itow__swprintf
String ID:
API String ID: 327935632-0
Opcode ID: f7cd9d36677b35f574fbbe3970c9896b27e0cab433851cd5ecc1992699486df3
Instruction ID: 38f1f646c778e44ba0593ad123e2b2a5842792611daae7a57beee5e35f708435
Opcode Fuzzy Hash: f7cd9d36677b35f574fbbe3970c9896b27e0cab433851cd5ecc1992699486df3
Instruction Fuzzy Hash: AF514B75A00209DFCB14EFA8C889DAEB7F5BF58310B158155E916AB392DB38ED45CF80

Function 00762E29 Relevance: 7.6, APIs: 5, Instructions: 144registryCOMMON

Download Yara Rule

APIs

Part of subcall function 00763C06: CharUpperBuffW.USER32(?,?,?,?,?,?,?,00762BB5,?,?), ref: 00763C1D

RegConnectRegistryW.ADVAPI32(?,?,?), ref: 00762EEF
RegOpenKeyExW.ADVAPI32(?,?,00000000,?,?), ref: 00762F2E
RegEnumKeyExW.ADVAPI32(?,-00000001,?,?,00000000,00000000,00000000,?), ref: 00762F75
RegCloseKey.ADVAPI32(?,?), ref: 00762FA1
RegCloseKey.ADVAPI32(00000000), ref: 00762FAE

Memory Dump Source

Source File: 00000000.00000002.1281263787.0000000000701000.00000020.00000001.01000000.00000003.sdmp, Offset: 00700000, based on PE: true

Associated: 00000000.00000002.1281243473.0000000000700000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1281360671.000000000078D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1281360671.00000000007AE000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1281496264.00000000007BA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1281529307.00000000007C4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1281529307.00000000007C7000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1281529307.00000000007D5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1281529307.00000000007D7000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_700000_OC & PL.jbxd

Similarity

API ID: Close$BuffCharConnectEnumOpenRegistryUpper
String ID:
API String ID: 3740051246-0
Opcode ID: 7e5526bff571f59632287a3ac765212fc26003c9e0017cc73fac3e8c95eacfda
Instruction ID: defb05a8b129e805817f13c2a56e99bf8d1b56fda355ad60555bb5c1fe7e2389
Opcode Fuzzy Hash: 7e5526bff571f59632287a3ac765212fc26003c9e0017cc73fac3e8c95eacfda
Instruction Fuzzy Hash: A3517B71208204EFC715EF54C895EAAB7F8BF88304F10891DF99687292DB38E905CB52

Function 0076CCF7 Relevance: 7.6, APIs: 5, Instructions: 129COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1281263787.0000000000701000.00000020.00000001.01000000.00000003.sdmp, Offset: 00700000, based on PE: true

Associated: 00000000.00000002.1281243473.0000000000700000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1281360671.000000000078D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1281360671.00000000007AE000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1281496264.00000000007BA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1281529307.00000000007C4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1281529307.00000000007C7000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1281529307.00000000007D5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1281529307.00000000007D7000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_700000_OC & PL.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 21d0093086511d25d149a4c8836309b31a37ef21c468d93f3341473e69f541f0
Instruction ID: a513369635404eef9900c0f7b0ceb0da4916fd621b87e74b3c674e2b1e37c07b
Opcode Fuzzy Hash: 21d0093086511d25d149a4c8836309b31a37ef21c468d93f3341473e69f541f0
Instruction Fuzzy Hash: 9041A379A00204ABD722DF68CC48FB9BB78EB09350F184265FD9AA72D1C739AD11DB54

Function 00751206 Relevance: 7.6, APIs: 5, Instructions: 127COMMON

Download Yara Rule

APIs

GetPrivateProfileSectionW.KERNEL32(00000003,?,00007FFF,?), ref: 007512B4
GetPrivateProfileSectionW.KERNEL32(?,00000001,00000003,?), ref: 007512DD
WritePrivateProfileSectionW.KERNEL32(?,?,?), ref: 0075131C

Part of subcall function 0070936C: __swprintf.LIBCMT ref: 007093AB
Part of subcall function 0070936C: __itow.LIBCMT ref: 007093DF

WritePrivateProfileStringW.KERNEL32(00000003,00000000,00000000,?), ref: 00751341
WritePrivateProfileStringW.KERNEL32(00000000,00000000,00000000,?), ref: 00751349

Memory Dump Source

Source File: 00000000.00000002.1281263787.0000000000701000.00000020.00000001.01000000.00000003.sdmp, Offset: 00700000, based on PE: true

Associated: 00000000.00000002.1281243473.0000000000700000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1281360671.000000000078D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1281360671.00000000007AE000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1281496264.00000000007BA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1281529307.00000000007C4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1281529307.00000000007C7000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1281529307.00000000007D5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1281529307.00000000007D7000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_700000_OC & PL.jbxd

Similarity

API ID: PrivateProfile$SectionWrite$String$__itow__swprintf
String ID:
API String ID: 1389676194-0
Opcode ID: fece8f8632dd15328e5b53fcf9e77c7a593bb686231490999ee6167d78b6d208
Instruction ID: 5d6d4effb1fb6d95ec9a2ebf481a1444dfb9869aabf1e122fbed7b13d3b9772e
Opcode Fuzzy Hash: fece8f8632dd15328e5b53fcf9e77c7a593bb686231490999ee6167d78b6d208
Instruction Fuzzy Hash: E2410835A00105DFCB01EF64C995AAEBBF5FF08311B148099E94AAB3A2DB39ED41DF50

Function 0071B63C Relevance: 7.6, APIs: 5, Instructions: 110keyboardCOMMON

Download Yara Rule

APIs

GetCursorPos.USER32(000000FF), ref: 0071B64F
ScreenToClient.USER32(00000000,000000FF), ref: 0071B66C
GetAsyncKeyState.USER32(00000001), ref: 0071B691
GetAsyncKeyState.USER32(00000002), ref: 0071B69F

Memory Dump Source

Source File: 00000000.00000002.1281263787.0000000000701000.00000020.00000001.01000000.00000003.sdmp, Offset: 00700000, based on PE: true

Associated: 00000000.00000002.1281243473.0000000000700000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1281360671.000000000078D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1281360671.00000000007AE000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1281496264.00000000007BA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1281529307.00000000007C4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1281529307.00000000007C7000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1281529307.00000000007D5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1281529307.00000000007D7000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_700000_OC & PL.jbxd

Similarity

API ID: AsyncState$ClientCursorScreen
String ID:
API String ID: 4210589936-0
Opcode ID: c5100fd6609f485f304b8df67ffc4023ffcc0fc91840f3f4103faf2fe8bc9fac
Instruction ID: 7f7d9e5d79f2072c4fa1496d39461933598d7bad3877350a1c0d47225b483fee
Opcode Fuzzy Hash: c5100fd6609f485f304b8df67ffc4023ffcc0fc91840f3f4103faf2fe8bc9fac
Instruction Fuzzy Hash: 72416031604119FBCF259F68C848AEDBB74BF15364F20831AF829962D0C739AD94DF91

Function 0073B358 Relevance: 7.6, APIs: 5, Instructions: 88sleepwindowCOMMON

Download Yara Rule

APIs

GetWindowRect.USER32(?,?), ref: 0073B369
PostMessageW.USER32(?,00000201,00000001), ref: 0073B413
Sleep.KERNEL32(00000000,?,00000201,00000001,?,?,?), ref: 0073B41B
PostMessageW.USER32(?,00000202,00000000), ref: 0073B429
Sleep.KERNEL32(00000000,?,00000202,00000000,?,?,00000201,00000001,?,?,?), ref: 0073B431

Memory Dump Source

Source File: 00000000.00000002.1281263787.0000000000701000.00000020.00000001.01000000.00000003.sdmp, Offset: 00700000, based on PE: true

Associated: 00000000.00000002.1281243473.0000000000700000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1281360671.000000000078D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1281360671.00000000007AE000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1281496264.00000000007BA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1281529307.00000000007C4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1281529307.00000000007C7000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1281529307.00000000007D5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1281529307.00000000007D7000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_700000_OC & PL.jbxd

Similarity

API ID: MessagePostSleep$RectWindow
String ID:
API String ID: 3382505437-0
Opcode ID: 6498e4e56613ec4fec9c61bcecd3fd7239c574a15fa0bfa1a940ce0674e22c1a
Instruction ID: e53efeda6b19b9ad00344ec0be1cf0eea17bc7b058b489cc248dc6c69d13b2c8
Opcode Fuzzy Hash: 6498e4e56613ec4fec9c61bcecd3fd7239c574a15fa0bfa1a940ce0674e22c1a
Instruction Fuzzy Hash: 6C31A07190022DEBEF14CF68D94DA9E7BB5EB44315F108229F921A61D2C3B89D54CB91

Function 0073DBBF Relevance: 7.6, APIs: 5, Instructions: 87windowCOMMON

Download Yara Rule

APIs

IsWindowVisible.USER32(?), ref: 0073DBD7
SendMessageW.USER32(?,0000000E,00000000,00000000), ref: 0073DBF4
SendMessageW.USER32(?,0000000D,00000001,00000000), ref: 0073DC2C
CharUpperBuffW.USER32(00000000,00000000,?,?,?,?), ref: 0073DC52
_wcsstr.LIBCMT ref: 0073DC5C

Memory Dump Source

Source File: 00000000.00000002.1281263787.0000000000701000.00000020.00000001.01000000.00000003.sdmp, Offset: 00700000, based on PE: true

Associated: 00000000.00000002.1281243473.0000000000700000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1281360671.000000000078D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1281360671.00000000007AE000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1281496264.00000000007BA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1281529307.00000000007C4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1281529307.00000000007C7000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1281529307.00000000007D5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1281529307.00000000007D7000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_700000_OC & PL.jbxd

Similarity

API ID: MessageSend$BuffCharUpperVisibleWindow_wcsstr
String ID:
API String ID: 3902887630-0
Opcode ID: a0c3771b86c6e2b4e15df2479877642c7e12880b6575e8c4ed81e548bd75f9e6
Instruction ID: 0eb4f9ce142685b7023a0ba0b8bb69923455b613f80d3e7032defb438be4eec8
Opcode Fuzzy Hash: a0c3771b86c6e2b4e15df2479877642c7e12880b6575e8c4ed81e548bd75f9e6
Instruction Fuzzy Hash: 0E210771214104BFFB355B39AC49E7B7BA9DF45750F108029F809CA192EBA9CC41D3B0

Function 0073BC77 Relevance: 7.6, APIs: 5, Instructions: 82windowCOMMON

Download Yara Rule

APIs

SendMessageW.USER32(?,00001004,00000000,00000000), ref: 0073BC90
SendMessageW.USER32(?,0000102C,00000000,00000002), ref: 0073BCC2
__itow.LIBCMT ref: 0073BCDA
SendMessageW.USER32(?,0000102C,00000000,00000002), ref: 0073BD00
__itow.LIBCMT ref: 0073BD11

Memory Dump Source

Source File: 00000000.00000002.1281263787.0000000000701000.00000020.00000001.01000000.00000003.sdmp, Offset: 00700000, based on PE: true

Associated: 00000000.00000002.1281243473.0000000000700000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1281360671.000000000078D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1281360671.00000000007AE000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1281496264.00000000007BA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1281529307.00000000007C4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1281529307.00000000007C7000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1281529307.00000000007D5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1281529307.00000000007D7000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_700000_OC & PL.jbxd

Similarity

API ID: MessageSend$__itow
String ID:
API String ID: 3379773720-0
Opcode ID: e4e9e6fd1d4a3e89a9983e6cfd08e7b613f31a13da1134b24f5454220186adca
Instruction ID: 890dc5b6a06051a07a34b8019dc63dfc70a8d0d665b2b3667972f30c5ecd23f2
Opcode Fuzzy Hash: e4e9e6fd1d4a3e89a9983e6cfd08e7b613f31a13da1134b24f5454220186adca
Instruction Fuzzy Hash: 1C21C375700218FAEB20AA659C4AFDF7BA8AF59750F105064FA05EB1C3EB788D0587B1

Function 00746318 Relevance: 7.6, APIs: 5, Instructions: 80COMMON

Download Yara Rule

APIs

Part of subcall function 007050E6: _wcsncpy.LIBCMT ref: 007050FA

GetFileAttributesW.KERNEL32(?,?,?,?,007460C3), ref: 00746369
GetLastError.KERNEL32(?,?,?,007460C3), ref: 00746374
CreateDirectoryW.KERNEL32(?,00000000,?,?,?,007460C3), ref: 00746388
_wcsrchr.LIBCMT ref: 007463AA

Part of subcall function 00746318: CreateDirectoryW.KERNEL32(?,00000000,?,?,?,007460C3), ref: 007463E0

Memory Dump Source

Source File: 00000000.00000002.1281263787.0000000000701000.00000020.00000001.01000000.00000003.sdmp, Offset: 00700000, based on PE: true

Associated: 00000000.00000002.1281243473.0000000000700000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1281360671.000000000078D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1281360671.00000000007AE000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1281496264.00000000007BA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1281529307.00000000007C4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1281529307.00000000007C7000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1281529307.00000000007D5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1281529307.00000000007D7000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_700000_OC & PL.jbxd

Similarity

API ID: CreateDirectory$AttributesErrorFileLast_wcsncpy_wcsrchr
String ID:
API String ID: 3633006590-0
Opcode ID: b4bbb23579a60e7fcb5c6f7553324412fb9aa2b84d34fed5bffdb1acc2fa90f5
Instruction ID: 840f835b7b80305756cd63908d98a6ad32b16f23ca288b376ee0a516414e6408
Opcode Fuzzy Hash: b4bbb23579a60e7fcb5c6f7553324412fb9aa2b84d34fed5bffdb1acc2fa90f5
Instruction Fuzzy Hash: 0E21C3315442559ADF25AE78AC4AFEA23ACAF1B360F204465F045D30D1EB6CDD848A66

Function 00758B95 Relevance: 7.6, APIs: 5, Instructions: 71networkCOMMON

Download Yara Rule

APIs

Part of subcall function 0075A82C: inet_addr.WSOCK32(00000000,00000000,?,?,?,00000000), ref: 0075A84E

socket.WSOCK32(00000002,00000001,00000006,?,?,00000000), ref: 00758BD3
WSAGetLastError.WSOCK32(00000000), ref: 00758BE2
connect.WSOCK32(00000000,?,00000010), ref: 00758BFE

Memory Dump Source

Source File: 00000000.00000002.1281263787.0000000000701000.00000020.00000001.01000000.00000003.sdmp, Offset: 00700000, based on PE: true

Associated: 00000000.00000002.1281243473.0000000000700000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1281360671.000000000078D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1281360671.00000000007AE000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1281496264.00000000007BA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1281529307.00000000007C4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1281529307.00000000007C7000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1281529307.00000000007D5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1281529307.00000000007D7000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_700000_OC & PL.jbxd

Similarity

API ID: ErrorLastconnectinet_addrsocket
String ID:
API String ID: 3701255441-0
Opcode ID: a31bfa980d8876b74dfae8c1ab0b197d40020d0747072c2448ac3dd3b39c2f0a
Instruction ID: a96c0f6fc4c366fe3b80700cd57ba19eb99283a031dbddec00619083f877eaf2
Opcode Fuzzy Hash: a31bfa980d8876b74dfae8c1ab0b197d40020d0747072c2448ac3dd3b39c2f0a
Instruction Fuzzy Hash: 412190312402149FCB10AF68CC89FBE77E9AF48711F148559F956AB2D2CFB8AC058B65

Function 00758420 Relevance: 7.6, APIs: 5, Instructions: 69COMMON

Download Yara Rule

APIs

IsWindow.USER32(00000000), ref: 00758441
GetForegroundWindow.USER32 ref: 00758458
GetDC.USER32(00000000), ref: 00758494
GetPixel.GDI32(00000000,?,00000003), ref: 007584A0
ReleaseDC.USER32(00000000,00000003), ref: 007584DB

Memory Dump Source

Source File: 00000000.00000002.1281263787.0000000000701000.00000020.00000001.01000000.00000003.sdmp, Offset: 00700000, based on PE: true

Associated: 00000000.00000002.1281243473.0000000000700000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1281360671.000000000078D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1281360671.00000000007AE000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1281496264.00000000007BA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1281529307.00000000007C4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1281529307.00000000007C7000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1281529307.00000000007D5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1281529307.00000000007D7000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_700000_OC & PL.jbxd

Similarity

API ID: Window$ForegroundPixelRelease
String ID:
API String ID: 4156661090-0
Opcode ID: 6f02c0e12a033cdfc1225164172407025e0199e6d13e854cfd2d15862f5eb946
Instruction ID: b448cb1448a25efa03aa51a0880c1d6b7d4de09787327c2e75017e3b873de986
Opcode Fuzzy Hash: 6f02c0e12a033cdfc1225164172407025e0199e6d13e854cfd2d15862f5eb946
Instruction Fuzzy Hash: E5218175A00204EFDB10EFA4C889AAEBBE5EF48341F14C479EC5997291DB78ED04CB60

Function 0071AF83 Relevance: 7.6, APIs: 5, Instructions: 67COMMON

Download Yara Rule

APIs

ExtCreatePen.GDI32(?,?,00000000,00000000,00000000,?,?,00000000), ref: 0071AFE3
SelectObject.GDI32(?,00000000), ref: 0071AFF2
BeginPath.GDI32(?), ref: 0071B009
SelectObject.GDI32(?,00000000), ref: 0071B033

Memory Dump Source

Source File: 00000000.00000002.1281263787.0000000000701000.00000020.00000001.01000000.00000003.sdmp, Offset: 00700000, based on PE: true

Associated: 00000000.00000002.1281243473.0000000000700000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1281360671.000000000078D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1281360671.00000000007AE000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1281496264.00000000007BA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1281529307.00000000007C4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1281529307.00000000007C7000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1281529307.00000000007D5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1281529307.00000000007D7000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_700000_OC & PL.jbxd

Similarity

API ID: ObjectSelect$BeginCreatePath
String ID:
API String ID: 3225163088-0
Opcode ID: a68d6153b815961adba44df6b91092f37e59ff9b0f0419ecf3de96a31bee19f6
Instruction ID: bcde855f4f3cacca7acda0450aab30c58769ae849a6d0298c1aec01459cb1f90
Opcode Fuzzy Hash: a68d6153b815961adba44df6b91092f37e59ff9b0f0419ecf3de96a31bee19f6
Instruction Fuzzy Hash: 53219070800209EFDB209F58EC48B9A7B68BB15365F64C22AE420A21E1D77D88958B54

Function 0072217F Relevance: 7.6, APIs: 5, Instructions: 61threadCOMMON

Download Yara Rule

APIs

__calloc_crt.LIBCMT ref: 007221A9
CreateThread.KERNEL32(?,?,007222DF,00000000,?,?), ref: 007221ED
GetLastError.KERNEL32 ref: 007221F7
_free.LIBCMT ref: 00722200
__dosmaperr.LIBCMT ref: 0072220B

Part of subcall function 00727C0E: __getptd_noexit.LIBCMT ref: 00727C0E

Memory Dump Source

Source File: 00000000.00000002.1281263787.0000000000701000.00000020.00000001.01000000.00000003.sdmp, Offset: 00700000, based on PE: true

Associated: 00000000.00000002.1281243473.0000000000700000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1281360671.000000000078D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1281360671.00000000007AE000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1281496264.00000000007BA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1281529307.00000000007C4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1281529307.00000000007C7000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1281529307.00000000007D5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1281529307.00000000007D7000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_700000_OC & PL.jbxd

Similarity

API ID: CreateErrorLastThread__calloc_crt__dosmaperr__getptd_noexit_free
String ID:
API String ID: 2664167353-0
Opcode ID: 18c585641fc544093ea3c8792517d9661e9d38020f68bfdf620fa14134d78d59
Instruction ID: 9cf44f1d4bf9926dcbe584c70a592a9694e64f99fb8c0f18363ba949a9a3c820
Opcode Fuzzy Hash: 18c585641fc544093ea3c8792517d9661e9d38020f68bfdf620fa14134d78d59
Instruction Fuzzy Hash: AF11E572204366EF9B25AF65BD45D6B37A8FF01770B100029F91486192EB7AD85287A0

Function 0073ABBB Relevance: 7.5, APIs: 5, Instructions: 48memoryCOMMON

Download Yara Rule

APIs

GetUserObjectSecurity.USER32(?,?,?,00000000,?), ref: 0073ABD7
GetLastError.KERNEL32(?,0073A69F,?,?,?), ref: 0073ABE1
GetProcessHeap.KERNEL32(00000008,?,?,0073A69F,?,?,?), ref: 0073ABF0
HeapAlloc.KERNEL32(00000000,?,0073A69F,?,?,?), ref: 0073ABF7
GetUserObjectSecurity.USER32(?,?,00000000,?,?), ref: 0073AC0E

Memory Dump Source

Source File: 00000000.00000002.1281263787.0000000000701000.00000020.00000001.01000000.00000003.sdmp, Offset: 00700000, based on PE: true

Associated: 00000000.00000002.1281243473.0000000000700000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1281360671.000000000078D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1281360671.00000000007AE000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1281496264.00000000007BA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1281529307.00000000007C4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1281529307.00000000007C7000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1281529307.00000000007D5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1281529307.00000000007D7000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_700000_OC & PL.jbxd

Similarity

API ID: HeapObjectSecurityUser$AllocErrorLastProcess
String ID:
API String ID: 842720411-0
Opcode ID: 11a06ced6bb25d66b28588893c956e155c820dbee6e653c2a87851bf139aa121
Instruction ID: 3481b463353b46bf7c35c8cbe22a79bc82d96c42bd7129c16b3ed7013d70898d
Opcode Fuzzy Hash: 11a06ced6bb25d66b28588893c956e155c820dbee6e653c2a87851bf139aa121
Instruction Fuzzy Hash: 46016D70640208BFEB205FA5DC49D6B3BADFF89354B204429F445C3290D6758C40CB74

Function 00747A58 Relevance: 7.5, APIs: 5, Instructions: 47sleepCOMMON

Download Yara Rule

APIs

QueryPerformanceCounter.KERNEL32(?,00000000,?,?,?,?,?,?,?,?,?), ref: 00747A74
QueryPerformanceFrequency.KERNEL32(?,?,?,?,?,?,?,?,?,?), ref: 00747A82
Sleep.KERNEL32(00000000,?,?,?,?,?,?,?,?,?), ref: 00747A8A
QueryPerformanceCounter.KERNEL32(?,?,?,?,?,?,?,?,?,?), ref: 00747A94
Sleep.KERNEL32(?,00000000,?,?,?,?,?,?,?,?,?), ref: 00747AD0

Memory Dump Source

Source File: 00000000.00000002.1281263787.0000000000701000.00000020.00000001.01000000.00000003.sdmp, Offset: 00700000, based on PE: true

Associated: 00000000.00000002.1281243473.0000000000700000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1281360671.000000000078D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1281360671.00000000007AE000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1281496264.00000000007BA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1281529307.00000000007C4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1281529307.00000000007C7000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1281529307.00000000007D5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1281529307.00000000007D7000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_700000_OC & PL.jbxd

Similarity

API ID: PerformanceQuery$CounterSleep$Frequency
String ID:
API String ID: 2833360925-0
Opcode ID: fb53f7b1e5f255cff25ef0c73aa08eda9366a79aa4577b1fc5fffe472ba6c95d
Instruction ID: 3f753f1ecaae2e919f9892042da7b795184d90d1590316bea6e7c6cf0780c8a4
Opcode Fuzzy Hash: fb53f7b1e5f255cff25ef0c73aa08eda9366a79aa4577b1fc5fffe472ba6c95d
Instruction Fuzzy Hash: FE015731E0461DEBCF14AFA9DC88ADDBB78FF08751F118445E502B2290DB389A50C7A5

Function 00739ABF Relevance: 7.5, APIs: 5, Instructions: 47stringCOMMON

Download Yara Rule

APIs

CLSIDFromProgID.OLE32 ref: 00739ADC
ProgIDFromCLSID.OLE32(?,00000000), ref: 00739AF7
lstrcmpiW.KERNEL32(?,00000000), ref: 00739B05
CoTaskMemFree.OLE32(00000000,?,00000000), ref: 00739B15
CLSIDFromString.OLE32(?,?), ref: 00739B21

Memory Dump Source

Source File: 00000000.00000002.1281263787.0000000000701000.00000020.00000001.01000000.00000003.sdmp, Offset: 00700000, based on PE: true

Associated: 00000000.00000002.1281243473.0000000000700000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1281360671.000000000078D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1281360671.00000000007AE000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1281496264.00000000007BA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1281529307.00000000007C4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1281529307.00000000007C7000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1281529307.00000000007D5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1281529307.00000000007D7000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_700000_OC & PL.jbxd

Similarity

API ID: From$Prog$FreeStringTasklstrcmpi
String ID:
API String ID: 3897988419-0
Opcode ID: 40db59cadfb31fd43ebf511ca771efe45fb8f1c7702029723b1404b2748cbdfe
Instruction ID: fec1c813767af866ccd4843f0789bf9824f15b28b9321c4bd8a2867feba15758
Opcode Fuzzy Hash: 40db59cadfb31fd43ebf511ca771efe45fb8f1c7702029723b1404b2748cbdfe
Instruction Fuzzy Hash: 4A01A2B6600208FFEB204F58EC44B9ABBFDEF44362F248024FA05D2251D7B8DD009BA0

Function 0073AA62 Relevance: 7.5, APIs: 5, Instructions: 45memoryCOMMON

Download Yara Rule

APIs

GetTokenInformation.ADVAPI32(?,00000002,?,00000000,?), ref: 0073AA79
GetLastError.KERNEL32(?,00000002,?,00000000,?), ref: 0073AA83
GetProcessHeap.KERNEL32(00000008,?,?,00000002,?,00000000,?), ref: 0073AA92
HeapAlloc.KERNEL32(00000000,?,00000002,?,00000000,?), ref: 0073AA99
GetTokenInformation.ADVAPI32(?,00000002,00000000,?,?,?,00000002,?,00000000,?), ref: 0073AAAF

Memory Dump Source

Source File: 00000000.00000002.1281263787.0000000000701000.00000020.00000001.01000000.00000003.sdmp, Offset: 00700000, based on PE: true

Associated: 00000000.00000002.1281243473.0000000000700000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1281360671.000000000078D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1281360671.00000000007AE000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1281496264.00000000007BA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1281529307.00000000007C4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1281529307.00000000007C7000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1281529307.00000000007D5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1281529307.00000000007D7000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_700000_OC & PL.jbxd

Similarity

API ID: HeapInformationToken$AllocErrorLastProcess
String ID:
API String ID: 44706859-0
Opcode ID: a1f5869b04d9a017eb893fae183ad994899259bee13edace0341d93ad0945f76
Instruction ID: 4b62e0e5c5b194dfc3d0d4311110209f48b800d3d8eb71393257cd50e2039bd4
Opcode Fuzzy Hash: a1f5869b04d9a017eb893fae183ad994899259bee13edace0341d93ad0945f76
Instruction Fuzzy Hash: BDF03C72240304BFEB215FA4AC8DE673BACFF49754F208419F941C6191DA699C41CB61

Function 0073AAC3 Relevance: 7.5, APIs: 5, Instructions: 45memoryCOMMON

Download Yara Rule

APIs

GetTokenInformation.ADVAPI32(?,00000003(TokenIntegrityLevel),?,00000000,?), ref: 0073AADA
GetLastError.KERNEL32(?,TokenIntegrityLevel,?,00000000,?), ref: 0073AAE4
GetProcessHeap.KERNEL32(00000008,?,?,TokenIntegrityLevel,?,00000000,?), ref: 0073AAF3
HeapAlloc.KERNEL32(00000000,?,TokenIntegrityLevel,?,00000000,?), ref: 0073AAFA
GetTokenInformation.ADVAPI32(?,00000003(TokenIntegrityLevel),00000000,?,?,?,TokenIntegrityLevel,?,00000000,?), ref: 0073AB10

Memory Dump Source

Source File: 00000000.00000002.1281263787.0000000000701000.00000020.00000001.01000000.00000003.sdmp, Offset: 00700000, based on PE: true

Associated: 00000000.00000002.1281243473.0000000000700000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1281360671.000000000078D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1281360671.00000000007AE000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1281496264.00000000007BA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1281529307.00000000007C4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1281529307.00000000007C7000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1281529307.00000000007D5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1281529307.00000000007D7000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_700000_OC & PL.jbxd

Similarity

API ID: HeapInformationToken$AllocErrorLastProcess
String ID:
API String ID: 44706859-0
Opcode ID: afe933582396c31ce72e111d4558bf32704bc00539e63d4171469cd6607780ed
Instruction ID: 8c47b81b9ebbf5f98f1b086d55d40c766574600357629ad9bddf0fbff9e1dc7d
Opcode Fuzzy Hash: afe933582396c31ce72e111d4558bf32704bc00539e63d4171469cd6607780ed
Instruction Fuzzy Hash: 02F06271240208BFEB210FA4EC89E777B6EFF45754F204129F941C7190DB699C01CB61

Function 0073EC80 Relevance: 7.5, APIs: 5, Instructions: 40windowtimeCOMMON

Download Yara Rule

APIs

GetDlgItem.USER32(?,000003E9), ref: 0073EC94
GetWindowTextW.USER32(00000000,?,00000100), ref: 0073ECAB
MessageBeep.USER32(00000000), ref: 0073ECC3
KillTimer.USER32(?,0000040A), ref: 0073ECDF
EndDialog.USER32(?,00000001), ref: 0073ECF9

Memory Dump Source

Source File: 00000000.00000002.1281263787.0000000000701000.00000020.00000001.01000000.00000003.sdmp, Offset: 00700000, based on PE: true

Associated: 00000000.00000002.1281243473.0000000000700000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1281360671.000000000078D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1281360671.00000000007AE000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1281496264.00000000007BA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1281529307.00000000007C4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1281529307.00000000007C7000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1281529307.00000000007D5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1281529307.00000000007D7000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_700000_OC & PL.jbxd

Similarity

API ID: BeepDialogItemKillMessageTextTimerWindow
String ID:
API String ID: 3741023627-0
Opcode ID: 3834574bf4df5725fa660f4ca99b8f69e6cf30ff4f833860fda1970503530c01
Instruction ID: 8d8fb6eec6ae65756b608ab292ee6f35698dc0186bed1548f3c59b67382d0acd
Opcode Fuzzy Hash: 3834574bf4df5725fa660f4ca99b8f69e6cf30ff4f833860fda1970503530c01
Instruction Fuzzy Hash: 1E018130540704ABFB345B50DE5EB9A77B8FF00705F005559B582B14E2DBF8AE95CB54

Function 0071B0AB Relevance: 7.5, APIs: 5, Instructions: 29COMMON

Download Yara Rule

APIs

EndPath.GDI32(?), ref: 0071B0BA
StrokeAndFillPath.GDI32(?,?,0077E680,00000000,?,?,?), ref: 0071B0D6
SelectObject.GDI32(?,00000000), ref: 0071B0E9
DeleteObject.GDI32 ref: 0071B0FC
StrokePath.GDI32(?), ref: 0071B117

Memory Dump Source

Source File: 00000000.00000002.1281263787.0000000000701000.00000020.00000001.01000000.00000003.sdmp, Offset: 00700000, based on PE: true

Associated: 00000000.00000002.1281243473.0000000000700000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1281360671.000000000078D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1281360671.00000000007AE000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1281496264.00000000007BA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1281529307.00000000007C4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1281529307.00000000007C7000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1281529307.00000000007D5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1281529307.00000000007D7000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_700000_OC & PL.jbxd

Similarity

API ID: Path$ObjectStroke$DeleteFillSelect
String ID:
API String ID: 2625713937-0
Opcode ID: 7470ef36fa4fef7658d9a841422be94a623112273ac5ffebd97d69ee60d6dbe0
Instruction ID: f424651c9dfdd69d9a677e3b6c5473e340b22331f2eb78084c32b4caca32abda
Opcode Fuzzy Hash: 7470ef36fa4fef7658d9a841422be94a623112273ac5ffebd97d69ee60d6dbe0
Instruction Fuzzy Hash: 98F0C930040248EFDB21AF69EC0DB953B65AB12366F58C329E465950F2CB3D89A5DF58

Function 0074F23D Relevance: 7.3, APIs: 3, Strings: 1, Instructions: 277comCOMMON

Download Yara Rule

APIs

CoInitialize.OLE32(00000000), ref: 0074F2DA
CoCreateInstance.OLE32(0078DA7C,00000000,00000001,0078D8EC,?), ref: 0074F2F2
CoUninitialize.OLE32 ref: 0074F555

Strings

.lnk, xrefs: 0074F28B, 0074F290, 0074F29E

Memory Dump Source

Source File: 00000000.00000002.1281263787.0000000000701000.00000020.00000001.01000000.00000003.sdmp, Offset: 00700000, based on PE: true

Associated: 00000000.00000002.1281243473.0000000000700000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1281360671.000000000078D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1281360671.00000000007AE000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1281496264.00000000007BA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1281529307.00000000007C4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1281529307.00000000007C7000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1281529307.00000000007D5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1281529307.00000000007D7000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_700000_OC & PL.jbxd

Similarity

API ID: CreateInitializeInstanceUninitialize
String ID: .lnk
API String ID: 948891078-24824748
Opcode ID: 05f3e6a1d59effa60eed7715b83b880d7833de5809dfb55fa13d973ecdc24db1
Instruction ID: 4459496c2578867f06e7cf619fcff169c4fdc1177c5b1b2eabbb73b826d5692f
Opcode Fuzzy Hash: 05f3e6a1d59effa60eed7715b83b880d7833de5809dfb55fa13d973ecdc24db1
Instruction Fuzzy Hash: 5AA13CB1104201EFD301EF64C895DABB7E8EF98314F004A5DF555971D2EB74EA49CBA2

Function 0074E7DD Relevance: 7.3, APIs: 3, Strings: 1, Instructions: 261comCOMMON

Download Yara Rule

APIs

Part of subcall function 0070660F: GetFullPathNameW.KERNEL32(?,00007FFF,?,00000000,?,?,007053B1,?,?,007061FF,?,00000000,00000001,00000000), ref: 0070662F

CoInitialize.OLE32(00000000), ref: 0074E85D
CoCreateInstance.OLE32(0078DA7C,00000000,00000001,0078D8EC,?), ref: 0074E876
CoUninitialize.OLE32 ref: 0074E893

Part of subcall function 0070936C: __swprintf.LIBCMT ref: 007093AB
Part of subcall function 0070936C: __itow.LIBCMT ref: 007093DF

Strings

.lnk, xrefs: 0074E83B, 0074E84D

Memory Dump Source

Source File: 00000000.00000002.1281263787.0000000000701000.00000020.00000001.01000000.00000003.sdmp, Offset: 00700000, based on PE: true

Associated: 00000000.00000002.1281243473.0000000000700000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1281360671.000000000078D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1281360671.00000000007AE000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1281496264.00000000007BA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1281529307.00000000007C4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1281529307.00000000007C7000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1281529307.00000000007D5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1281529307.00000000007D7000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_700000_OC & PL.jbxd

Similarity

API ID: CreateFullInitializeInstanceNamePathUninitialize__itow__swprintf
String ID: .lnk
API String ID: 2126378814-24824748
Opcode ID: 8e9458d1b52ccee55da54f71a901c5797f86e52e9d75f67733ecd4eccebbfe12
Instruction ID: eb6eacd5d92660d84379747489b9ea5eda233a1da96e9fbe2116d821b1a64178
Opcode Fuzzy Hash: 8e9458d1b52ccee55da54f71a901c5797f86e52e9d75f67733ecd4eccebbfe12
Instruction Fuzzy Hash: 6DA14775604301DFCB14EF14C488D6ABBE5BF89320F158A48F9959B3A2CB39EC45CB92

Function 0072325D Relevance: 7.2, APIs: 3, Strings: 1, Instructions: 180COMMON

Download Yara Rule

APIs

__startOneArgErrorHandling.LIBCMT ref: 007232ED

Part of subcall function 0072E0D0: __87except.LIBCMT ref: 0072E10B

Strings

pow, xrefs: 007232C5, 007232E2

Memory Dump Source

Source File: 00000000.00000002.1281263787.0000000000701000.00000020.00000001.01000000.00000003.sdmp, Offset: 00700000, based on PE: true

Associated: 00000000.00000002.1281243473.0000000000700000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1281360671.000000000078D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1281360671.00000000007AE000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1281496264.00000000007BA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1281529307.00000000007C4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1281529307.00000000007C7000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1281529307.00000000007D5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1281529307.00000000007D7000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_700000_OC & PL.jbxd

Similarity

API ID: ErrorHandling__87except__start
String ID: pow
API String ID: 2905807303-2276729525
Opcode ID: f4e8654cc72b1cbec7b498797a24a6c57e034d9644575317f24a3e792da28af4
Instruction ID: 0bb9f29a5344a422b3cd1ef62311436ad9b54fb3fda1accdbccaddd8070c91af
Opcode Fuzzy Hash: f4e8654cc72b1cbec7b498797a24a6c57e034d9644575317f24a3e792da28af4
Instruction Fuzzy Hash: B9515A31A08225D6CB15B714F94577A2BD8FB40720F308D69F4D6821EAEF3C8ED99646

Function 00744606 Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 122COMMON

Download Yara Rule

APIs

CharUpperBuffW.USER32(0000000C,00000016,00000016,00000000,00000000,?,00000000,0079DC50,?,0000000F,0000000C,00000016,0079DC50,?), ref: 00744645

Part of subcall function 0070936C: __swprintf.LIBCMT ref: 007093AB
Part of subcall function 0070936C: __itow.LIBCMT ref: 007093DF

CharUpperBuffW.USER32(?,?,00000000,?), ref: 007446C5

Strings

THIS, xrefs: 00744703
REMOVE, xrefs: 00744676

Memory Dump Source

Source File: 00000000.00000002.1281263787.0000000000701000.00000020.00000001.01000000.00000003.sdmp, Offset: 00700000, based on PE: true

Associated: 00000000.00000002.1281243473.0000000000700000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1281360671.000000000078D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1281360671.00000000007AE000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1281496264.00000000007BA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1281529307.00000000007C4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1281529307.00000000007C7000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1281529307.00000000007D5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1281529307.00000000007D7000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_700000_OC & PL.jbxd

Similarity

API ID: BuffCharUpper$__itow__swprintf
String ID: REMOVE$THIS
API String ID: 3797816924-776492005
Opcode ID: 52186cb926940cc197ff4c5b4d8c48d708a5f754975e48d88f7a9e0f9bbab4de
Instruction ID: 6562591d66e1fd9d50833d53cdb4518167ab5cb5a0d6b54e9e2b7abb9e0cadb3
Opcode Fuzzy Hash: 52186cb926940cc197ff4c5b4d8c48d708a5f754975e48d88f7a9e0f9bbab4de
Instruction Fuzzy Hash: E8418074A00219DFCF01DFA4C885AAEB7F5FF49304F148069E916AB292DB38DD46DB50

Function 0073C189 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 121windowCOMMON

Download Yara Rule

APIs

Part of subcall function 0074430B: WriteProcessMemory.KERNEL32(?,?,?,00000000,00000000,00000000,?,0073BC08,?,?,00000034,00000800,?,00000034), ref: 00744335

SendMessageW.USER32(?,00001104,00000000,00000000), ref: 0073C1D3

Part of subcall function 007442D6: ReadProcessMemory.KERNEL32(?,?,?,00000000,00000000,00000000,?,0073BC37,?,?,00000800,?,00001073,00000000,?,?), ref: 00744300

Part of subcall function 0074422F: GetWindowThreadProcessId.USER32(?,?), ref: 0074425A
Part of subcall function 0074422F: OpenProcess.KERNEL32(00000438,00000000,?,?,?,0073BBCC,00000034,?,?,00001004,00000000,00000000), ref: 0074426A
Part of subcall function 0074422F: VirtualAllocEx.KERNEL32(00000000,00000000,?,00001000,00000004,?,?,0073BBCC,00000034,?,?,00001004,00000000,00000000), ref: 00744280

SendMessageW.USER32(?,00001111,00000000,00000000), ref: 0073C240
SendMessageW.USER32(?,00001111,00000000,00000000), ref: 0073C28D

Strings

@, xrefs: 0073C2A5

Memory Dump Source

Source File: 00000000.00000002.1281263787.0000000000701000.00000020.00000001.01000000.00000003.sdmp, Offset: 00700000, based on PE: true

Associated: 00000000.00000002.1281243473.0000000000700000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1281360671.000000000078D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1281360671.00000000007AE000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1281496264.00000000007BA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1281529307.00000000007C4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1281529307.00000000007C7000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1281529307.00000000007D5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1281529307.00000000007D7000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_700000_OC & PL.jbxd

Similarity

API ID: Process$MessageSend$Memory$AllocOpenReadThreadVirtualWindowWrite
String ID: @
API String ID: 4150878124-2766056989
Opcode ID: b2d247867c1d3b1369049c2e4f1a12e69e1cef0ec811c6be2411ee3893a22af9
Instruction ID: ec7de97b8e96741b4c7fdb4f128028e36dcc024eecf91b60da088faeb575e0a8
Opcode Fuzzy Hash: b2d247867c1d3b1369049c2e4f1a12e69e1cef0ec811c6be2411ee3893a22af9
Instruction Fuzzy Hash: BB416672A00218AEDB11DFA4CC85AEEB7B8BB09700F008095FA55B7181DB75AE85DB60

Function 0076A63F Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 110COMMON

Download Yara Rule

APIs

SetWindowPos.USER32(00000000,00000000,00000000,00000000,00000000,00000000,00000013,?,?,SysTreeView32,0079DC00,00000000,?,?,?,?), ref: 0076A6D8
GetWindowLongW.USER32 ref: 0076A6F5
SetWindowLongW.USER32(?,000000F0,00000000), ref: 0076A705

Strings

SysTreeView32, xrefs: 0076A6AA

Memory Dump Source

Source File: 00000000.00000002.1281263787.0000000000701000.00000020.00000001.01000000.00000003.sdmp, Offset: 00700000, based on PE: true

Associated: 00000000.00000002.1281243473.0000000000700000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1281360671.000000000078D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1281360671.00000000007AE000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1281496264.00000000007BA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1281529307.00000000007C4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1281529307.00000000007C7000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1281529307.00000000007D5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1281529307.00000000007D7000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_700000_OC & PL.jbxd

Similarity

API ID: Window$Long
String ID: SysTreeView32
API String ID: 847901565-1698111956
Opcode ID: 00ccecd27cf1028138dce663806ecc318ca5509f4eb07f531efe399777d8ba50
Instruction ID: 11be86b9baafdd2f2a4f16501ee370556b5c8bc2c8a47a39963519fe752bf237
Opcode Fuzzy Hash: 00ccecd27cf1028138dce663806ecc318ca5509f4eb07f531efe399777d8ba50
Instruction Fuzzy Hash: E531AE31240205BFDB218E38CC45BEA77A9EB49324F244729F876A21E1C738AC509B54

Function 00755180 Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 96networkCOMMON

Download Yara Rule

APIs

_memset.LIBCMT ref: 00755190
InternetCrackUrlW.WININET(?,00000000,00000000,?), ref: 007551C6

Strings

|, xrefs: 007551B5
Du, xrefs: 0075522E

Memory Dump Source

Source File: 00000000.00000002.1281263787.0000000000701000.00000020.00000001.01000000.00000003.sdmp, Offset: 00700000, based on PE: true

Associated: 00000000.00000002.1281243473.0000000000700000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1281360671.000000000078D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1281360671.00000000007AE000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1281496264.00000000007BA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1281529307.00000000007C4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1281529307.00000000007C7000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1281529307.00000000007D5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1281529307.00000000007D7000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_700000_OC & PL.jbxd

Similarity

API ID: CrackInternet_memset
String ID: |$Du
API String ID: 1413715105-3169865266
Opcode ID: c3be8246f41037e465c69f8e1813437e87bf0812807d64fd1f52262e2f58ca5b
Instruction ID: bc98a65ef3788545bac62eec9d36b1b843bf2c3a9b5b82b56ece0f886fca2ce9
Opcode Fuzzy Hash: c3be8246f41037e465c69f8e1813437e87bf0812807d64fd1f52262e2f58ca5b
Instruction Fuzzy Hash: BC311971800119EBCF01AFE4CD85AEE7FB9FF14700F100115E815A6166DA75A956CBA0

Function 0076A0D6 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 89windowCOMMON

Download Yara Rule

APIs

SendMessageW.USER32(00000000,00001009,00000000,?), ref: 0076A15E
SetWindowPos.USER32(?,00000000,?,?,?,?,00000004), ref: 0076A172
SendMessageW.USER32(?,00001002,00000000,?), ref: 0076A196

Strings

SysMonthCal32, xrefs: 0076A129

Memory Dump Source

Source File: 00000000.00000002.1281263787.0000000000701000.00000020.00000001.01000000.00000003.sdmp, Offset: 00700000, based on PE: true

Associated: 00000000.00000002.1281243473.0000000000700000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1281360671.000000000078D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1281360671.00000000007AE000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1281496264.00000000007BA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1281529307.00000000007C4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1281529307.00000000007C7000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1281529307.00000000007D5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1281529307.00000000007D7000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_700000_OC & PL.jbxd

Similarity

API ID: MessageSend$Window
String ID: SysMonthCal32
API String ID: 2326795674-1439706946
Opcode ID: 84508028d4ed65bf1721ae1afb98b160b60b3bd0a990c1027c02b0c5f01f80ce
Instruction ID: abfcdfcc92d3412d36d5e39caf64ba9179e74d389c9591ef81940e971d867cac
Opcode Fuzzy Hash: 84508028d4ed65bf1721ae1afb98b160b60b3bd0a990c1027c02b0c5f01f80ce
Instruction Fuzzy Hash: 48219C32510218BBDF258F94CC46FEA3B79EF49714F110214FE567B1D0D6B9AC508BA0

Function 0076A88A Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 88windowCOMMON

Download Yara Rule

APIs

SendMessageW.USER32(00000000,00000469,?,00000000), ref: 0076A941
SendMessageW.USER32(00000000,00000465,00000000,80017FFF), ref: 0076A94F
DestroyWindow.USER32(00000000,00000000,?,?,?,00000000,msctls_updown32,00000000,00000000,00000000,00000000,00000000,00000000,?,?,00000000), ref: 0076A956

Strings

msctls_updown32, xrefs: 0076A8BB

Memory Dump Source

Source File: 00000000.00000002.1281263787.0000000000701000.00000020.00000001.01000000.00000003.sdmp, Offset: 00700000, based on PE: true

Associated: 00000000.00000002.1281243473.0000000000700000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1281360671.000000000078D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1281360671.00000000007AE000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1281496264.00000000007BA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1281529307.00000000007C4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1281529307.00000000007C7000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1281529307.00000000007D5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1281529307.00000000007D7000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_700000_OC & PL.jbxd

Similarity

API ID: MessageSend$DestroyWindow
String ID: msctls_updown32
API String ID: 4014797782-2298589950
Opcode ID: b36c6586b7cc082348ae7fcfc65dc650c43c8560481bdc8aec703b117037cdc3
Instruction ID: 665028a08851b2cc03e9879c1cceb337509bcd32f93fbad20446de5456c557b7
Opcode Fuzzy Hash: b36c6586b7cc082348ae7fcfc65dc650c43c8560481bdc8aec703b117037cdc3
Instruction Fuzzy Hash: CE21B0B5200209BFDB10DF18CC81DA737ADEF5A3A4B150059FA05AB3A2CB38FC118B61

Function 007699A5 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 84windowCOMMON

Download Yara Rule

APIs

SendMessageW.USER32(00000000,00000180,00000000,?), ref: 00769A30
SendMessageW.USER32(?,00000186,00000000,00000000), ref: 00769A40
MoveWindow.USER32(?,?,?,?,?,00000000,?,?,Listbox,00000000,00000000,?,?,?,?,?), ref: 00769A65

Strings

Listbox, xrefs: 007699FD

Memory Dump Source

Source File: 00000000.00000002.1281263787.0000000000701000.00000020.00000001.01000000.00000003.sdmp, Offset: 00700000, based on PE: true

Associated: 00000000.00000002.1281243473.0000000000700000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1281360671.000000000078D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1281360671.00000000007AE000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1281496264.00000000007BA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1281529307.00000000007C4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1281529307.00000000007C7000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1281529307.00000000007D5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1281529307.00000000007D7000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_700000_OC & PL.jbxd

Similarity

API ID: MessageSend$MoveWindow
String ID: Listbox
API String ID: 3315199576-2633736733
Opcode ID: ba0a05e74bc54b405b89d20242f458e8679f0344560978be50b9ac8d99ab4258
Instruction ID: e58adc879aefa7e07cc89764233d7b0736e094fc9663acfa921db06dd3f02d6d
Opcode Fuzzy Hash: ba0a05e74bc54b405b89d20242f458e8679f0344560978be50b9ac8d99ab4258
Instruction Fuzzy Hash: 8921C532650218BFDF218F54CC85FBB3BAEEF89760F118129FA4597190C679AC51C7A0

Function 0076A409 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 66windowCOMMON

Download Yara Rule

APIs

SendMessageW.USER32(00000000,00000405,00000000,00000000), ref: 0076A46D
SendMessageW.USER32(?,00000406,00000000,00640000), ref: 0076A482
SendMessageW.USER32(?,00000414,0000000A,00000000), ref: 0076A48F

Strings

msctls_trackbar32, xrefs: 0076A444

Memory Dump Source

Source File: 00000000.00000002.1281263787.0000000000701000.00000020.00000001.01000000.00000003.sdmp, Offset: 00700000, based on PE: true

Associated: 00000000.00000002.1281243473.0000000000700000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1281360671.000000000078D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1281360671.00000000007AE000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1281496264.00000000007BA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1281529307.00000000007C4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1281529307.00000000007C7000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1281529307.00000000007D5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1281529307.00000000007D7000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_700000_OC & PL.jbxd

Similarity

API ID: MessageSend
String ID: msctls_trackbar32
API String ID: 3850602802-1010561917
Opcode ID: 4b2b671c34008ac9d4e96c1e9e607d0249b3760255f88e6d8fb7d6fbadb753e0
Instruction ID: e1dc54447bedff2c0ff17f56e8c9ea3f2ddcb2d0cce87a14ce1dbadb5ed1a6d6
Opcode Fuzzy Hash: 4b2b671c34008ac9d4e96c1e9e607d0249b3760255f88e6d8fb7d6fbadb753e0
Instruction Fuzzy Hash: C111E771240248BEEF205F68CC49FEB3B69EF89754F114118FE46A60D1DABAE811DB24

Function 00722287 Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 24libraryloaderCOMMONLIBRARYCODE

Download Yara Rule

APIs

LoadLibraryExW.KERNEL32(combase.dll,00000000,00000800,RoInitialize,00722350,?), ref: 007222A1
GetProcAddress.KERNEL32(00000000), ref: 007222A8

Strings

RoInitialize, xrefs: 00722290
combase.dll, xrefs: 0072229C

Memory Dump Source

Source File: 00000000.00000002.1281263787.0000000000701000.00000020.00000001.01000000.00000003.sdmp, Offset: 00700000, based on PE: true

Associated: 00000000.00000002.1281243473.0000000000700000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1281360671.000000000078D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1281360671.00000000007AE000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1281496264.00000000007BA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1281529307.00000000007C4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1281529307.00000000007C7000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1281529307.00000000007D5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1281529307.00000000007D7000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_700000_OC & PL.jbxd

Similarity

API ID: AddressLibraryLoadProc
String ID: RoInitialize$combase.dll
API String ID: 2574300362-340411864
Opcode ID: b58ffbeabd817f0c650fedc0e9157ea59533cf27c4161d06c156b1eca56364be
Instruction ID: ab1f05e1ead0a75faa07fff3bb574947ace096c898dc23b38b24e87fcf5de737
Opcode Fuzzy Hash: b58ffbeabd817f0c650fedc0e9157ea59533cf27c4161d06c156b1eca56364be
Instruction Fuzzy Hash: 2BE07570AD4309FBDA706B60AD89F5977A5BB04B06F65C128B102D50E0DBBD8845CB9D

Function 0072235C Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 19libraryloaderCOMMONLIBRARYCODE

Download Yara Rule

APIs

LoadLibraryExW.KERNEL32(combase.dll,00000000,00000800,RoUninitialize,00722276), ref: 00722376
GetProcAddress.KERNEL32(00000000), ref: 0072237D

Strings

RoUninitialize, xrefs: 00722365
combase.dll, xrefs: 00722371

Memory Dump Source

Source File: 00000000.00000002.1281263787.0000000000701000.00000020.00000001.01000000.00000003.sdmp, Offset: 00700000, based on PE: true

Associated: 00000000.00000002.1281243473.0000000000700000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1281360671.000000000078D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1281360671.00000000007AE000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1281496264.00000000007BA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1281529307.00000000007C4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1281529307.00000000007C7000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1281529307.00000000007D5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1281529307.00000000007D7000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_700000_OC & PL.jbxd

Similarity

API ID: AddressLibraryLoadProc
String ID: RoUninitialize$combase.dll
API String ID: 2574300362-2819208100
Opcode ID: b04bd37efb49954647062ac9d3a68816a1fb330a32572fd5fe7620b12b54c840
Instruction ID: d3d8bc8cc9c30382f71219630479918cb287b4f36959784a6371b0c91fffdef4
Opcode Fuzzy Hash: b04bd37efb49954647062ac9d3a68816a1fb330a32572fd5fe7620b12b54c840
Instruction Fuzzy Hash: A2E092B0584308FFDA30AFA1AD0DF087B65B700702F258428F109920F1EBBC98008B99

Function 0077AC59 Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 17timeCOMMON

Download Yara Rule

APIs

GetLocalTime.KERNEL32(?), ref: 0077AC60
__swprintf.LIBCMT ref: 0077AC94

Strings

WIN_XPe, xrefs: 0077ACD3
%.3d, xrefs: 0077AC6E

Memory Dump Source

Source File: 00000000.00000002.1281263787.0000000000701000.00000020.00000001.01000000.00000003.sdmp, Offset: 00700000, based on PE: true

Associated: 00000000.00000002.1281243473.0000000000700000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1281360671.000000000078D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1281360671.00000000007AE000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1281496264.00000000007BA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1281529307.00000000007C4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1281529307.00000000007C7000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1281529307.00000000007D5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1281529307.00000000007D7000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_700000_OC & PL.jbxd

Similarity

API ID: LocalTime__swprintf
String ID: %.3d$WIN_XPe
API String ID: 2070861257-2409531811
Opcode ID: 8fa57b2ecd95228740f76cf0feee4a7f81215ac196f7fdd75f3f946bbee96411
Instruction ID: 9c43cbae58649b149d8feb8efda8ec200d9917f4410aea5f6d00c7dbd6365f1e
Opcode Fuzzy Hash: 8fa57b2ecd95228740f76cf0feee4a7f81215ac196f7fdd75f3f946bbee96411
Instruction Fuzzy Hash: 63E0ECB1804628FBDF2297509D09DFD737CA784781F508092B90AA1144D63D9B94AB26

Function 00762205 Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 15libraryloaderCOMMON

Download Yara Rule

APIs

LoadLibraryA.KERNEL32(kernel32.dll,?,007621FB,?,007623EF), ref: 00762213
GetProcAddress.KERNEL32(00000000,GetProcessId), ref: 00762225

Strings

kernel32.dll, xrefs: 0076220E
GetProcessId, xrefs: 0076221F

Memory Dump Source

Source File: 00000000.00000002.1281263787.0000000000701000.00000020.00000001.01000000.00000003.sdmp, Offset: 00700000, based on PE: true

Associated: 00000000.00000002.1281243473.0000000000700000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1281360671.000000000078D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1281360671.00000000007AE000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1281496264.00000000007BA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1281529307.00000000007C4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1281529307.00000000007C7000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1281529307.00000000007D5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1281529307.00000000007D7000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_700000_OC & PL.jbxd

Similarity

API ID: AddressLibraryLoadProc
String ID: GetProcessId$kernel32.dll
API String ID: 2574300362-399901964
Opcode ID: c431019a21fc940ce849de1a717a62662099a9c26d0a30aa6426176fa9e7d2da
Instruction ID: 066570a921d43df620c2e20f192e5da7966f4be3cb1125a7c5e0bf6a18519ace
Opcode Fuzzy Hash: c431019a21fc940ce849de1a717a62662099a9c26d0a30aa6426176fa9e7d2da
Instruction Fuzzy Hash: 99D05E74841B169FC7315B31A80C64177E5AF04700B128419AC42A2191D678D8818760

Function 007042F6 Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 15libraryloaderCOMMON

Download Yara Rule

APIs

LoadLibraryA.KERNEL32(kernel32.dll,00000000,007042EC,?,007042AA,?), ref: 00704304
GetProcAddress.KERNEL32(00000000,Wow64RevertWow64FsRedirection), ref: 00704316

Strings

kernel32.dll, xrefs: 007042FF
Wow64RevertWow64FsRedirection, xrefs: 00704310

Memory Dump Source

Source File: 00000000.00000002.1281263787.0000000000701000.00000020.00000001.01000000.00000003.sdmp, Offset: 00700000, based on PE: true

Associated: 00000000.00000002.1281243473.0000000000700000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1281360671.000000000078D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1281360671.00000000007AE000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1281496264.00000000007BA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1281529307.00000000007C4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1281529307.00000000007C7000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1281529307.00000000007D5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1281529307.00000000007D7000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_700000_OC & PL.jbxd

Similarity

API ID: AddressLibraryLoadProc
String ID: Wow64RevertWow64FsRedirection$kernel32.dll
API String ID: 2574300362-1355242751
Opcode ID: 54f766f030a326f7ba6b91f999a5923ea873a72bf2689a81650eab6f6ad52d0b
Instruction ID: e7d3b192486f1f062b45e13411c9efd28be5e383345c0bbd5be1ec3e204b2e09
Opcode Fuzzy Hash: 54f766f030a326f7ba6b91f999a5923ea873a72bf2689a81650eab6f6ad52d0b
Instruction Fuzzy Hash: 29D05EB0840712AEC7205B21A80CA41B7E4AF04701B118419A541E22A0D6B8D8808710

Function 0070434B Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 15libraryloaderCOMMON

Download Yara Rule

APIs

LoadLibraryA.KERNEL32(kernel32.dll,007041BB,00704341,?,0070422F,?,007041BB,?,?,?,?,007039FE,?,00000001), ref: 00704359
GetProcAddress.KERNEL32(00000000,Wow64DisableWow64FsRedirection), ref: 0070436B

Strings

Wow64DisableWow64FsRedirection, xrefs: 00704365
kernel32.dll, xrefs: 00704354

Memory Dump Source

Source File: 00000000.00000002.1281263787.0000000000701000.00000020.00000001.01000000.00000003.sdmp, Offset: 00700000, based on PE: true

Associated: 00000000.00000002.1281243473.0000000000700000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1281360671.000000000078D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1281360671.00000000007AE000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1281496264.00000000007BA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1281529307.00000000007C4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1281529307.00000000007C7000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1281529307.00000000007D5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1281529307.00000000007D7000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_700000_OC & PL.jbxd

Similarity

API ID: AddressLibraryLoadProc
String ID: Wow64DisableWow64FsRedirection$kernel32.dll
API String ID: 2574300362-3689287502
Opcode ID: 88f1a0c62dfb2936402852b93e8b3ae6c0a390ceffc3e64e953e6689d101b4b8
Instruction ID: bb73b1f7b14e3ce319b986ebd3f800e0f0dcabc5af36c9c0e40752aaad06f426
Opcode Fuzzy Hash: 88f1a0c62dfb2936402852b93e8b3ae6c0a390ceffc3e64e953e6689d101b4b8
Instruction Fuzzy Hash: FCD05EB0840712AED7309B31A80C641B7D4AF11715B118519E481E2190D7B8E8808710

Function 00740564 Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 15libraryloaderCOMMON

Download Yara Rule

APIs

LoadLibraryA.KERNEL32(oleaut32.dll,00000000,0074052F,?,007406D7), ref: 00740572
GetProcAddress.KERNEL32(00000000,UnRegisterTypeLibForUser), ref: 00740584

Strings

oleaut32.dll, xrefs: 0074056D
UnRegisterTypeLibForUser, xrefs: 0074057E

Memory Dump Source

Source File: 00000000.00000002.1281263787.0000000000701000.00000020.00000001.01000000.00000003.sdmp, Offset: 00700000, based on PE: true

Associated: 00000000.00000002.1281243473.0000000000700000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1281360671.000000000078D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1281360671.00000000007AE000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1281496264.00000000007BA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1281529307.00000000007C4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1281529307.00000000007C7000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1281529307.00000000007D5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1281529307.00000000007D7000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_700000_OC & PL.jbxd

Similarity

API ID: AddressLibraryLoadProc
String ID: UnRegisterTypeLibForUser$oleaut32.dll
API String ID: 2574300362-1587604923
Opcode ID: d501baf70a3a826576e1763bb52e794a99668a5b684e8cd7a607777b92332e38
Instruction ID: 9da2335913c3e9d6ccd0dd4c6797aeb010ce33a34ccb1d3f3134fa46542d3975
Opcode Fuzzy Hash: d501baf70a3a826576e1763bb52e794a99668a5b684e8cd7a607777b92332e38
Instruction Fuzzy Hash: 13D05E718403129EC7206F20A80CF52B7E4AF04700B218519E94192190D778C8908B60

Function 00740539 Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 15libraryloaderCOMMON

Download Yara Rule

APIs

LoadLibraryA.KERNEL32(oleaut32.dll,?,0074051D,?,007405FE), ref: 00740547
GetProcAddress.KERNEL32(00000000,RegisterTypeLibForUser), ref: 00740559

Strings

oleaut32.dll, xrefs: 00740542
RegisterTypeLibForUser, xrefs: 00740553

Memory Dump Source

Source File: 00000000.00000002.1281263787.0000000000701000.00000020.00000001.01000000.00000003.sdmp, Offset: 00700000, based on PE: true

Associated: 00000000.00000002.1281243473.0000000000700000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1281360671.000000000078D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1281360671.00000000007AE000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1281496264.00000000007BA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1281529307.00000000007C4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1281529307.00000000007C7000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1281529307.00000000007D5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1281529307.00000000007D7000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_700000_OC & PL.jbxd

Similarity

API ID: AddressLibraryLoadProc
String ID: RegisterTypeLibForUser$oleaut32.dll
API String ID: 2574300362-1071820185
Opcode ID: 7d47edbf105a0d2c6655b91f1b5e0d3bccf9fecaa8a5b1db70cc7dbb82f2ce7e
Instruction ID: dc407f3b7c365cc901a716527e9251f16a89f398bf77dab01c59132e355eb844
Opcode Fuzzy Hash: 7d47edbf105a0d2c6655b91f1b5e0d3bccf9fecaa8a5b1db70cc7dbb82f2ce7e
Instruction Fuzzy Hash: A1D0A7748407129FC7309F20F80CB51B7E4EF00701B21C81DE44AD2191D77CCC808B50

Function 0075ECC8 Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 15libraryloaderCOMMON

Download Yara Rule

APIs

LoadLibraryA.KERNEL32(kernel32.dll,?,0075ECBE,?,0075EBBB), ref: 0075ECD6
GetProcAddress.KERNEL32(00000000,GetSystemWow64DirectoryW), ref: 0075ECE8

Strings

GetSystemWow64DirectoryW, xrefs: 0075ECE2
kernel32.dll, xrefs: 0075ECD1

Memory Dump Source

Source File: 00000000.00000002.1281263787.0000000000701000.00000020.00000001.01000000.00000003.sdmp, Offset: 00700000, based on PE: true

Associated: 00000000.00000002.1281243473.0000000000700000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1281360671.000000000078D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1281360671.00000000007AE000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1281496264.00000000007BA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1281529307.00000000007C4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1281529307.00000000007C7000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1281529307.00000000007D5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1281529307.00000000007D7000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_700000_OC & PL.jbxd

Similarity

API ID: AddressLibraryLoadProc
String ID: GetSystemWow64DirectoryW$kernel32.dll
API String ID: 2574300362-1816364905
Opcode ID: fa8cccf989581d28cbeb0dc610e9e890929743048e5b7687028102ee29962a07
Instruction ID: cab85567124f60f11fd42fd6cfdcfcdcb046025a8abc9a0ba0add039516bc1b0
Opcode Fuzzy Hash: fa8cccf989581d28cbeb0dc610e9e890929743048e5b7687028102ee29962a07
Instruction Fuzzy Hash: 60D05E70840723AECB245B61A84CB8277E4AF00701B118419AC5592191DAB8C8858B20

Function 0075BADD Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 15libraryloaderCOMMON

Download Yara Rule

APIs

LoadLibraryA.KERNEL32(kernel32.dll,00000000,0075BAD3,00000001,0075B6EE,?,0079DC00), ref: 0075BAEB
GetProcAddress.KERNEL32(00000000,GetModuleHandleExW), ref: 0075BAFD

Strings

GetModuleHandleExW, xrefs: 0075BAF7
kernel32.dll, xrefs: 0075BAE6

Memory Dump Source

Source File: 00000000.00000002.1281263787.0000000000701000.00000020.00000001.01000000.00000003.sdmp, Offset: 00700000, based on PE: true

Associated: 00000000.00000002.1281243473.0000000000700000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1281360671.000000000078D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1281360671.00000000007AE000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1281496264.00000000007BA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1281529307.00000000007C4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1281529307.00000000007C7000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1281529307.00000000007D5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1281529307.00000000007D7000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_700000_OC & PL.jbxd

Similarity

API ID: AddressLibraryLoadProc
String ID: GetModuleHandleExW$kernel32.dll
API String ID: 2574300362-199464113
Opcode ID: fced99cb305fbea8ee7875a3efa67fe52bb15ccaeca41472908ec0e74811b993
Instruction ID: 8b953d6c69223f2a15d33e24fd83906dc59d57f7e934aae2b4823d545eb6223c
Opcode Fuzzy Hash: fced99cb305fbea8ee7875a3efa67fe52bb15ccaeca41472908ec0e74811b993
Instruction Fuzzy Hash: 08D05EB0C407169EC7306F22A84CFA177D4AF00701B118419E84392190D7F8C884C714

Function 00763BDB Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 15libraryloaderCOMMON

Download Yara Rule

APIs

LoadLibraryA.KERNEL32(advapi32.dll,?,00763BD1,?,00763E06), ref: 00763BE9
GetProcAddress.KERNEL32(00000000,RegDeleteKeyExW), ref: 00763BFB

Strings

RegDeleteKeyExW, xrefs: 00763BF5
advapi32.dll, xrefs: 00763BE4

Memory Dump Source

Source File: 00000000.00000002.1281263787.0000000000701000.00000020.00000001.01000000.00000003.sdmp, Offset: 00700000, based on PE: true

Associated: 00000000.00000002.1281243473.0000000000700000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1281360671.000000000078D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1281360671.00000000007AE000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1281496264.00000000007BA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1281529307.00000000007C4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1281529307.00000000007C7000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1281529307.00000000007D5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1281529307.00000000007D7000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_700000_OC & PL.jbxd

Similarity

API ID: AddressLibraryLoadProc
String ID: RegDeleteKeyExW$advapi32.dll
API String ID: 2574300362-4033151799
Opcode ID: a8956e56dc5fc61f40fd9f464ce2c02979c99c42c5833afc3db738d42ebbb91f
Instruction ID: f759fe8e51048551d968d74b34b78ee61aa8bd411ca9bb9b54dabc4d4bbe09b7
Opcode Fuzzy Hash: a8956e56dc5fc61f40fd9f464ce2c02979c99c42c5833afc3db738d42ebbb91f
Instruction Fuzzy Hash: 31D05EB08407169AC7205B60A808642BBA4AF15718B218419E846A2190E7B8C880CB20

Function 00739B30 Relevance: 6.3, APIs: 4, Instructions: 306COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1281263787.0000000000701000.00000020.00000001.01000000.00000003.sdmp, Offset: 00700000, based on PE: true

Associated: 00000000.00000002.1281243473.0000000000700000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1281360671.000000000078D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1281360671.00000000007AE000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1281496264.00000000007BA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1281529307.00000000007C4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1281529307.00000000007C7000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1281529307.00000000007D5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1281529307.00000000007D7000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_700000_OC & PL.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ffca9b9485745a591e17e0c102ebb1ff5d8dbee0f85ef0bef07c698561a9e030
Instruction ID: fda052de393902ca6e60f8722910deaaf2be6c5fe6c9666210bd5d629bc80f6d
Opcode Fuzzy Hash: ffca9b9485745a591e17e0c102ebb1ff5d8dbee0f85ef0bef07c698561a9e030
Instruction Fuzzy Hash: AAC15275A00219EFEB14DFA4C884EAEB7B5FF48710F104598EA05EB252D774EE41DBA0

Function 0075AA84 Relevance: 6.3, APIs: 4, Instructions: 268COMMON

Download Yara Rule

APIs

CoInitialize.OLE32(00000000), ref: 0075AAB4
CoUninitialize.OLE32 ref: 0075AABF

Part of subcall function 00740213: CoCreateInstance.OLE32(?,00000000,00000005,?,?,?,?,?,?,?,?,?,?,?), ref: 0074027B

VariantInit.OLEAUT32(?), ref: 0075AACA
VariantClear.OLEAUT32(?), ref: 0075AD9D

Memory Dump Source

Source File: 00000000.00000002.1281263787.0000000000701000.00000020.00000001.01000000.00000003.sdmp, Offset: 00700000, based on PE: true

Associated: 00000000.00000002.1281243473.0000000000700000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1281360671.000000000078D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1281360671.00000000007AE000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1281496264.00000000007BA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1281529307.00000000007C4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1281529307.00000000007C7000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1281529307.00000000007D5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1281529307.00000000007D7000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_700000_OC & PL.jbxd

Similarity

API ID: Variant$ClearCreateInitInitializeInstanceUninitialize
String ID:
API String ID: 780911581-0
Opcode ID: 4bbc8d749422f460b0d41a28f277bab0f145056906f3a84bd8169f47a886a221
Instruction ID: 8414c63e3bf665dd3b0b11c182bdaab01518fe8a220ffc12d03251ecdc4e97c8
Opcode Fuzzy Hash: 4bbc8d749422f460b0d41a28f277bab0f145056906f3a84bd8169f47a886a221
Instruction Fuzzy Hash: 20A18A75204701EFCB10EF14C485B5AB7E5BF88311F148659FA969B3A2CB78ED44CB86

Function 007391CC Relevance: 6.2, APIs: 4, Instructions: 201memoryCOMMON

Download Yara Rule

APIs

VariantInit.OLEAUT32(?), ref: 007391DD
SysAllocString.OLEAUT32(?), ref: 00739286
VariantCopy.OLEAUT32 ref: 007392B5
VariantClear.OLEAUT32(?), ref: 007392DC

Memory Dump Source

Source File: 00000000.00000002.1281263787.0000000000701000.00000020.00000001.01000000.00000003.sdmp, Offset: 00700000, based on PE: true

Associated: 00000000.00000002.1281243473.0000000000700000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1281360671.000000000078D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1281360671.00000000007AE000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1281496264.00000000007BA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1281529307.00000000007C4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1281529307.00000000007C7000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1281529307.00000000007D5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1281529307.00000000007D7000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_700000_OC & PL.jbxd

Similarity

API ID: Variant$AllocClearCopyInitString
String ID:
API String ID: 2808897238-0
Opcode ID: 6aaeb86aed936a69c628c0eff97c332047e672741a2b985aafd69d4662a39600
Instruction ID: f113bf43fc8504d669b89cdffab2b4b5ea919693601cd57f41ca4db89981a5a5
Opcode Fuzzy Hash: 6aaeb86aed936a69c628c0eff97c332047e672741a2b985aafd69d4662a39600
Instruction Fuzzy Hash: 0D518570644706DBEB24AF69D495A6EB3E5EF45310F20881FE786D72D3EBBC98808705

Function 0076C4D7 Relevance: 6.1, APIs: 4, Instructions: 137COMMON

Download Yara Rule

APIs

GetWindowRect.USER32(00D76A50,?), ref: 0076C544
ScreenToClient.USER32(?,00000002), ref: 0076C574
MoveWindow.USER32(00000002,?,?,?,000000FF,00000001,?,00000002,?,?,?,00000002,?,?), ref: 0076C5DA

Memory Dump Source

Source File: 00000000.00000002.1281263787.0000000000701000.00000020.00000001.01000000.00000003.sdmp, Offset: 00700000, based on PE: true

Associated: 00000000.00000002.1281243473.0000000000700000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1281360671.000000000078D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1281360671.00000000007AE000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1281496264.00000000007BA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1281529307.00000000007C4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1281529307.00000000007C7000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1281529307.00000000007D5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1281529307.00000000007D7000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_700000_OC & PL.jbxd

Similarity

API ID: Window$ClientMoveRectScreen
String ID:
API String ID: 3880355969-0
Opcode ID: 81c3afd3fb223e4f04b25d9c402a4112a831759daea70f6df1b43ef41d1e077c
Instruction ID: e94e6adff085427e5c06864bb66c6eabc98238aecb47bcbaa33706d8ae7de830
Opcode Fuzzy Hash: 81c3afd3fb223e4f04b25d9c402a4112a831759daea70f6df1b43ef41d1e077c
Instruction Fuzzy Hash: 0D515F75A00204EFCF21DF68C8809BE7BB5EB55320F208259F9969B291D738ED51CB94

Function 0073C410 Relevance: 6.1, APIs: 4, Instructions: 130windowCOMMON

Download Yara Rule

APIs

SendMessageW.USER32(?,0000110A,00000004,00000000), ref: 0073C462
__itow.LIBCMT ref: 0073C49C

Part of subcall function 0073C6E8: SendMessageW.USER32(?,0000113E,00000000,00000000), ref: 0073C753

SendMessageW.USER32(?,0000110A,00000001,?), ref: 0073C505
__itow.LIBCMT ref: 0073C55A

Memory Dump Source

Source File: 00000000.00000002.1281263787.0000000000701000.00000020.00000001.01000000.00000003.sdmp, Offset: 00700000, based on PE: true

Associated: 00000000.00000002.1281243473.0000000000700000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1281360671.000000000078D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1281360671.00000000007AE000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1281496264.00000000007BA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1281529307.00000000007C4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1281529307.00000000007C7000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1281529307.00000000007D5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1281529307.00000000007D7000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_700000_OC & PL.jbxd

Similarity

API ID: MessageSend$__itow
String ID:
API String ID: 3379773720-0
Opcode ID: 9b7becf5ef7ce1f47c62499d2f3d04c459290de03df565652219769a11e81118
Instruction ID: 48f3fbe02e3bcc0f330cb9dfd60fde5ad327cb3e2e1ba5d3cba818652a2ef1fd
Opcode Fuzzy Hash: 9b7becf5ef7ce1f47c62499d2f3d04c459290de03df565652219769a11e81118
Instruction Fuzzy Hash: D2419571600208EBEF22DF54C85AFEE7BB9AF49700F100159FA05B71C2DB789A558BA1

Function 0074390C Relevance: 6.1, APIs: 4, Instructions: 112keyboardwindowCOMMON

Download Yara Rule

APIs

GetKeyboardState.USER32(?,00000000,?,00000001), ref: 00743966
SetKeyboardState.USER32(00000080,?,00000001), ref: 00743982
PostMessageW.USER32(00000000,00000102,?,00000001), ref: 007439EF
SendInput.USER32(00000001,?,0000001C,00000000,?,00000001), ref: 00743A4D

Memory Dump Source

Source File: 00000000.00000002.1281263787.0000000000701000.00000020.00000001.01000000.00000003.sdmp, Offset: 00700000, based on PE: true

Associated: 00000000.00000002.1281243473.0000000000700000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1281360671.000000000078D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1281360671.00000000007AE000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1281496264.00000000007BA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1281529307.00000000007C4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1281529307.00000000007C7000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1281529307.00000000007D5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1281529307.00000000007D7000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_700000_OC & PL.jbxd

Similarity

API ID: KeyboardState$InputMessagePostSend
String ID:
API String ID: 432972143-0
Opcode ID: 9e27b27f61c08f734430f962834a984a9d01d07081a3844dc5e0929aae782d9e
Instruction ID: f04e65e87a12ec68a6edd1b4c26ea5c5edba0940cb5c45151247df4966112c38
Opcode Fuzzy Hash: 9e27b27f61c08f734430f962834a984a9d01d07081a3844dc5e0929aae782d9e
Instruction Fuzzy Hash: 30416870F44248AEEF308B64C80ABFDBBB9AB49314F04415AF4C9922C1C7BC9E95D765

Function 0074E698 Relevance: 6.1, APIs: 4, Instructions: 110fileCOMMON

Download Yara Rule

APIs

CreateHardLinkW.KERNEL32(00000002,?,00000000), ref: 0074E742
GetLastError.KERNEL32(?,00000000), ref: 0074E768
DeleteFileW.KERNEL32(00000002,?,00000000), ref: 0074E78D
CreateHardLinkW.KERNEL32(00000002,?,00000000,?,00000000), ref: 0074E7B9

Memory Dump Source

Source File: 00000000.00000002.1281263787.0000000000701000.00000020.00000001.01000000.00000003.sdmp, Offset: 00700000, based on PE: true

Associated: 00000000.00000002.1281243473.0000000000700000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1281360671.000000000078D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1281360671.00000000007AE000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1281496264.00000000007BA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1281529307.00000000007C4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1281529307.00000000007C7000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1281529307.00000000007D5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1281529307.00000000007D7000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_700000_OC & PL.jbxd

Similarity

API ID: CreateHardLink$DeleteErrorFileLast
String ID:
API String ID: 3321077145-0
Opcode ID: 3ca1dfb7686220be5466e7c1dcad7294aab1e28096d49801f359e9c725893828
Instruction ID: 83aea990418f87a6110f9be7a966f6166fd1272f16f2a15b2e2e408a9dd4b077
Opcode Fuzzy Hash: 3ca1dfb7686220be5466e7c1dcad7294aab1e28096d49801f359e9c725893828
Instruction Fuzzy Hash: 64413839200610DFCF11EF14C448A5DBBE5BF59720B19C088EA86AB3A2CB38FC40CB91

Function 0076B544 Relevance: 6.1, APIs: 4, Instructions: 108COMMON

Download Yara Rule

APIs

InvalidateRect.USER32(?,00000000,00000001,?,?,?), ref: 0076B5D1

Memory Dump Source

Source File: 00000000.00000002.1281263787.0000000000701000.00000020.00000001.01000000.00000003.sdmp, Offset: 00700000, based on PE: true

Associated: 00000000.00000002.1281243473.0000000000700000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1281360671.000000000078D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1281360671.00000000007AE000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1281496264.00000000007BA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1281529307.00000000007C4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1281529307.00000000007C7000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1281529307.00000000007D5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1281529307.00000000007D7000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_700000_OC & PL.jbxd

Similarity

API ID: InvalidateRect
String ID:
API String ID: 634782764-0
Opcode ID: cc2eea508e28e3d77c876210500891e32287032eaea8bf2a3c6bc13b5d681010
Instruction ID: 4bca67c6e3490c206abc9b03f3e2578a5ab5ae4f9bc437c91a0e267e4efdf12a
Opcode Fuzzy Hash: cc2eea508e28e3d77c876210500891e32287032eaea8bf2a3c6bc13b5d681010
Instruction Fuzzy Hash: 6531AD74641208EBEB308F18CC89FE87765AB07350F648115FE53E62E2D73CA9E09B56

Function 0076D7DE Relevance: 6.1, APIs: 4, Instructions: 105windowCOMMON

Download Yara Rule

APIs

ClientToScreen.USER32(?,?), ref: 0076D807
GetWindowRect.USER32(?,?), ref: 0076D87D
PtInRect.USER32(?,?,0076ED5A), ref: 0076D88D
MessageBeep.USER32(00000000), ref: 0076D8FE

Memory Dump Source

Source File: 00000000.00000002.1281263787.0000000000701000.00000020.00000001.01000000.00000003.sdmp, Offset: 00700000, based on PE: true

Associated: 00000000.00000002.1281243473.0000000000700000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1281360671.000000000078D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1281360671.00000000007AE000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1281496264.00000000007BA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1281529307.00000000007C4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1281529307.00000000007C7000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1281529307.00000000007D5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1281529307.00000000007D7000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_700000_OC & PL.jbxd

Similarity

API ID: Rect$BeepClientMessageScreenWindow
String ID:
API String ID: 1352109105-0
Opcode ID: 0c8664cc59732823c116beab2f0ff2ae878293f05f129b5047089e9b5591a8df
Instruction ID: 4ba16256d9c88eced12013be3e0278986a7eefbcb412d582d7db02f07cc787b1
Opcode Fuzzy Hash: 0c8664cc59732823c116beab2f0ff2ae878293f05f129b5047089e9b5591a8df
Instruction Fuzzy Hash: 68418970F1021ADFCB21DF58C888EA97BB5FB49354F1881A9E8169B2A1D738ED41CF40

Function 00743A61 Relevance: 6.1, APIs: 4, Instructions: 104keyboardwindowCOMMON

Download Yara Rule

APIs

GetKeyboardState.USER32(?,75A4C0D0,?,00008000), ref: 00743AB8
SetKeyboardState.USER32(00000080,?,00008000), ref: 00743AD4
PostMessageW.USER32(00000000,00000101,00000000,?), ref: 00743B34
SendInput.USER32(00000001,?,0000001C,75A4C0D0,?,00008000), ref: 00743B92

Memory Dump Source

Source File: 00000000.00000002.1281263787.0000000000701000.00000020.00000001.01000000.00000003.sdmp, Offset: 00700000, based on PE: true

Associated: 00000000.00000002.1281243473.0000000000700000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1281360671.000000000078D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1281360671.00000000007AE000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1281496264.00000000007BA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1281529307.00000000007C4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1281529307.00000000007C7000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1281529307.00000000007D5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1281529307.00000000007D7000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_700000_OC & PL.jbxd

Similarity

API ID: KeyboardState$InputMessagePostSend
String ID:
API String ID: 432972143-0
Opcode ID: 18a3db6a6299fe756fee3634d9812a0a8910d97ce4abcb7927d948dc29379146
Instruction ID: 7e674b2be08678a0f7e73015d98de208102ea5f9b66c1fafa9a70c416efe59e9
Opcode Fuzzy Hash: 18a3db6a6299fe756fee3634d9812a0a8910d97ce4abcb7927d948dc29379146
Instruction Fuzzy Hash: C13102B0A40258EEEF318B64881DBFE7BA9DB55310F04025AF489932D2C77C8F55DB65

Function 00734004 Relevance: 6.1, APIs: 4, Instructions: 96COMMONLIBRARYCODE

Download Yara Rule

APIs

_LocaleUpdate::_LocaleUpdate.LIBCMT ref: 00734038
__isleadbyte_l.LIBCMT ref: 00734066
MultiByteToWideChar.KERNEL32(00000080,00000009,00000002,00000001,?,00000000,?,00000000,?,?,?), ref: 00734094
MultiByteToWideChar.KERNEL32(00000080,00000009,00000002,00000001,?,00000000,?,00000000,?,?,?), ref: 007340CA

Memory Dump Source

Source File: 00000000.00000002.1281263787.0000000000701000.00000020.00000001.01000000.00000003.sdmp, Offset: 00700000, based on PE: true

Associated: 00000000.00000002.1281243473.0000000000700000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1281360671.000000000078D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1281360671.00000000007AE000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1281496264.00000000007BA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1281529307.00000000007C4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1281529307.00000000007C7000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1281529307.00000000007D5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1281529307.00000000007D7000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_700000_OC & PL.jbxd

Similarity

API ID: ByteCharLocaleMultiWide$UpdateUpdate::___isleadbyte_l
String ID:
API String ID: 3058430110-0
Opcode ID: 40325ee040d450f76eccd2898e39f91b00de49083714ea26afa78c3984192ace
Instruction ID: e8b8c301dd5435250ccdb103791bcabd983d805ff7af412c4253d161016c67c2
Opcode Fuzzy Hash: 40325ee040d450f76eccd2898e39f91b00de49083714ea26afa78c3984192ace
Instruction Fuzzy Hash: 2131C43170421AEFEB2D9F74C844B7A7BA5FF41310F1584A8E665871A2E739EC90D790

Function 0076F1D7 Relevance: 6.1, APIs: 4, Instructions: 80windowCOMMON

Download Yara Rule

APIs

Part of subcall function 0071B34E: GetWindowLongW.USER32(?,000000EB), ref: 0071B35F

GetCursorPos.USER32(?), ref: 0076F211
TrackPopupMenuEx.USER32(?,00000000,?,?,?,00000000,?,0077E4C0,?,?,?,?,?), ref: 0076F226
GetCursorPos.USER32(?), ref: 0076F270
DefDlgProcW.USER32(?,0000007B,?,?,?,?,?,?,?,?,?,?,0077E4C0,?,?,?), ref: 0076F2A6

Memory Dump Source

Source File: 00000000.00000002.1281263787.0000000000701000.00000020.00000001.01000000.00000003.sdmp, Offset: 00700000, based on PE: true

Associated: 00000000.00000002.1281243473.0000000000700000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1281360671.000000000078D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1281360671.00000000007AE000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1281496264.00000000007BA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1281529307.00000000007C4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1281529307.00000000007C7000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1281529307.00000000007D5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1281529307.00000000007D7000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_700000_OC & PL.jbxd

Similarity

API ID: Cursor$LongMenuPopupProcTrackWindow
String ID:
API String ID: 2864067406-0
Opcode ID: e673ffbbb6f7878dfadb0790f8c792fc011601ef58b2c7f1cd3b1537d7b5110c
Instruction ID: 8fbe474f51da6a7ff29c1943be2bcd9ef52dc68fa702804a0bd7226d5cf70507
Opcode Fuzzy Hash: e673ffbbb6f7878dfadb0790f8c792fc011601ef58b2c7f1cd3b1537d7b5110c
Instruction Fuzzy Hash: CB219E39500018EFCB258F95E868EEE7BB5FB0A710F148069F906572A2D7389D60DF60

Function 0075431C Relevance: 6.1, APIs: 4, Instructions: 78networkCOMMON

Download Yara Rule

APIs

InternetConnectW.WININET(?,?,?,?,?,?,00000000,00000000), ref: 00754358

Part of subcall function 007543E2: InternetOpenUrlW.WININET(?,?,00000000,00000000,?,00000000), ref: 00754401
Part of subcall function 007543E2: InternetCloseHandle.WININET(00000000), ref: 0075449E

Memory Dump Source

Source File: 00000000.00000002.1281263787.0000000000701000.00000020.00000001.01000000.00000003.sdmp, Offset: 00700000, based on PE: true

Associated: 00000000.00000002.1281243473.0000000000700000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1281360671.000000000078D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1281360671.00000000007AE000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1281496264.00000000007BA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1281529307.00000000007C4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1281529307.00000000007C7000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1281529307.00000000007D5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1281529307.00000000007D7000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_700000_OC & PL.jbxd

Similarity

API ID: Internet$CloseConnectHandleOpen
String ID:
API String ID: 1463438336-0
Opcode ID: 4d2e6319ee6d61654220bad26a4b7739af9601b5550f5c5b4ca1a82adb4f2de3
Instruction ID: 8063ab52d6cecd1fcce692ade5fb38e3f7b033c15e676616f715b89bd06fd698
Opcode Fuzzy Hash: 4d2e6319ee6d61654220bad26a4b7739af9601b5550f5c5b4ca1a82adb4f2de3
Instruction Fuzzy Hash: 0D21F331200605BFEB219F60DC04FFBB7A9FF4471AF10401AFE15A76A0DBB998699794

Function 00758A7F Relevance: 6.1, APIs: 4, Instructions: 69networkCOMMON

Download Yara Rule

APIs

select.WSOCK32(00000000,00000001,00000000,00000000,?), ref: 00758AE0
__WSAFDIsSet.WSOCK32(00000000,00000001), ref: 00758AF2
accept.WSOCK32(00000000,00000000,00000000), ref: 00758AFF
WSAGetLastError.WSOCK32(00000000), ref: 00758B16

Memory Dump Source

Source File: 00000000.00000002.1281263787.0000000000701000.00000020.00000001.01000000.00000003.sdmp, Offset: 00700000, based on PE: true

Associated: 00000000.00000002.1281243473.0000000000700000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1281360671.000000000078D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1281360671.00000000007AE000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1281496264.00000000007BA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1281529307.00000000007C4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1281529307.00000000007C7000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1281529307.00000000007D5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1281529307.00000000007D7000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_700000_OC & PL.jbxd

Similarity

API ID: ErrorLastacceptselect
String ID:
API String ID: 385091864-0
Opcode ID: 1fdf169602210e2e899da635940da1a298c66db9b26a4b0b161734ee446e2395
Instruction ID: a24464e499496d9b3790bd22d799c4096a16cd17fd19f3d2bf02a477fe3390c4
Opcode Fuzzy Hash: 1fdf169602210e2e899da635940da1a298c66db9b26a4b0b161734ee446e2395
Instruction Fuzzy Hash: 37219672A001249FC7619F68C889ADE7BECEF49310F108169F849E7291DB789E458F94

Function 00768A37 Relevance: 6.1, APIs: 4, Instructions: 69COMMON

Download Yara Rule

APIs

GetWindowLongW.USER32(?,000000EC), ref: 00768AA6
SetWindowLongW.USER32(?,000000EC,00000000), ref: 00768AC0
SetWindowLongW.USER32(?,000000EC,00000000), ref: 00768ACE
SetLayeredWindowAttributes.USER32(?,00000000,?,00000002), ref: 00768ADC

Memory Dump Source

Source File: 00000000.00000002.1281263787.0000000000701000.00000020.00000001.01000000.00000003.sdmp, Offset: 00700000, based on PE: true

Associated: 00000000.00000002.1281243473.0000000000700000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1281360671.000000000078D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1281360671.00000000007AE000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1281496264.00000000007BA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1281529307.00000000007C4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1281529307.00000000007C7000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1281529307.00000000007D5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1281529307.00000000007D7000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_700000_OC & PL.jbxd

Similarity

API ID: Window$Long$AttributesLayered
String ID:
API String ID: 2169480361-0
Opcode ID: 94572885ceca37ca829e1f178f6e346b72a42483e5a0b2c10b54086b1ff833cf
Instruction ID: c1d7baf82cea4798e6a000d4f9e0da01d5c19e930d1220c21e2f13f9a7f5d3a4
Opcode Fuzzy Hash: 94572885ceca37ca829e1f178f6e346b72a42483e5a0b2c10b54086b1ff833cf
Instruction Fuzzy Hash: 86118E31345111AFDB54AB58CC09FBA7799BF85320F24821AFD1AC72E2DB78AC018B95

Function 00740AA6 Relevance: 6.1, APIs: 3, Strings: 1, Instructions: 68stringCOMMON

Download Yara Rule

APIs

Part of subcall function 00741E68: lstrlenW.KERNEL32(?,00000002,?,?,000000EF,?,00740ABB,?,?,?,0074187A,00000000,000000EF,00000119,?,?), ref: 00741E77
Part of subcall function 00741E68: lstrcpyW.KERNEL32(00000000,?,?,00740ABB,?,?,?,0074187A,00000000,000000EF,00000119,?,?,00000000), ref: 00741E9D
Part of subcall function 00741E68: lstrcmpiW.KERNEL32(00000000,?,00740ABB,?,?,?,0074187A,00000000,000000EF,00000119,?,?), ref: 00741ECE

lstrlenW.KERNEL32(?,00000002,?,?,?,?,0074187A,00000000,000000EF,00000119,?,?,00000000), ref: 00740AD4
lstrcpyW.KERNEL32(00000000,?,?,0074187A,00000000,000000EF,00000119,?,?,00000000), ref: 00740AFA
lstrcmpiW.KERNEL32(00000002,cdecl,?,0074187A,00000000,000000EF,00000119,?,?,00000000), ref: 00740B2E

Strings

cdecl, xrefs: 00740B25

Memory Dump Source

Source File: 00000000.00000002.1281263787.0000000000701000.00000020.00000001.01000000.00000003.sdmp, Offset: 00700000, based on PE: true

Associated: 00000000.00000002.1281243473.0000000000700000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1281360671.000000000078D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1281360671.00000000007AE000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1281496264.00000000007BA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1281529307.00000000007C4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1281529307.00000000007C7000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1281529307.00000000007D5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1281529307.00000000007D7000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_700000_OC & PL.jbxd

Similarity

API ID: lstrcmpilstrcpylstrlen
String ID: cdecl
API String ID: 4031866154-3896280584
Opcode ID: 6a2052c60dc90454f42a80ff7a0bbe676781927c01905dfa58efa6c944f1d5d6
Instruction ID: b916d0840c5342a4e8be6876583232e58dd20bfcd42360b03cf9f595b80bd8af
Opcode Fuzzy Hash: 6a2052c60dc90454f42a80ff7a0bbe676781927c01905dfa58efa6c944f1d5d6
Instruction Fuzzy Hash: 7111B17A200305EFDB25AF24DC49E7A77A9FF45354B90802AE906CB290EB799851C7E4

Function 00732F96 Relevance: 6.1, APIs: 4, Instructions: 67COMMONLIBRARYCODE

Download Yara Rule

APIs

_free.LIBCMT ref: 00732FB5

Part of subcall function 0072395C: __FF_MSGBANNER.LIBCMT ref: 00723973
Part of subcall function 0072395C: __NMSG_WRITE.LIBCMT ref: 0072397A
Part of subcall function 0072395C: RtlAllocateHeap.NTDLL(00D50000,00000000,00000001,00000001,00000000,?,?,0071F507,?,0000000E), ref: 0072399F

Memory Dump Source

Source File: 00000000.00000002.1281263787.0000000000701000.00000020.00000001.01000000.00000003.sdmp, Offset: 00700000, based on PE: true

Associated: 00000000.00000002.1281243473.0000000000700000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1281360671.000000000078D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1281360671.00000000007AE000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1281496264.00000000007BA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1281529307.00000000007C4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1281529307.00000000007C7000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1281529307.00000000007D5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1281529307.00000000007D7000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_700000_OC & PL.jbxd

Similarity

API ID: AllocateHeap_free
String ID:
API String ID: 614378929-0
Opcode ID: 7996b4b35f4475e0deff32fb65760ee6e1ee2e5459f67b56e3f700fa1789e4ef
Instruction ID: 67cf24f27db1fc57abd7ddc6d39f200b36c67eb871195fd245ab3c0649f81c94
Opcode Fuzzy Hash: 7996b4b35f4475e0deff32fb65760ee6e1ee2e5459f67b56e3f700fa1789e4ef
Instruction Fuzzy Hash: 6C11CA31549222EBEB353B70BC09A693B98BF14360F208925F849DA153DB3CCD80D7A5

Function 0074058F Relevance: 6.1, APIs: 4, Instructions: 64registryCOMMON

Download Yara Rule

APIs

GetModuleFileNameW.KERNEL32(?,?,00000104,00000000,00000000), ref: 007405AC
LoadTypeLibEx.OLEAUT32(?,00000002,?), ref: 007405C7
RegisterTypeLib.OLEAUT32(?,?,00000000), ref: 007405DD
FreeLibrary.KERNEL32(?), ref: 00740632

Memory Dump Source

Source File: 00000000.00000002.1281263787.0000000000701000.00000020.00000001.01000000.00000003.sdmp, Offset: 00700000, based on PE: true

Associated: 00000000.00000002.1281243473.0000000000700000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1281360671.000000000078D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1281360671.00000000007AE000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1281496264.00000000007BA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1281529307.00000000007C4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1281529307.00000000007C7000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1281529307.00000000007D5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1281529307.00000000007D7000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_700000_OC & PL.jbxd

Similarity

API ID: Type$FileFreeLibraryLoadModuleNameRegister
String ID:
API String ID: 3137044355-0
Opcode ID: c3278f6dc4d20b8779a59afbbfc6978f9816e2f04c6edca2f2b7bd2638beca52
Instruction ID: 1fb8b385d9ff91a0eb3676645ad51d88928fb39b1ed968840919d7940202ba36
Opcode Fuzzy Hash: c3278f6dc4d20b8779a59afbbfc6978f9816e2f04c6edca2f2b7bd2638beca52
Instruction Fuzzy Hash: D121BE71980208EFDB209FA4DC88ADABBB8EF40300F11846DE61792050D77CEA54DF96

Function 00746713 Relevance: 6.1, APIs: 4, Instructions: 64fileCOMMON

Download Yara Rule

APIs

CreateFileW.KERNEL32(?,C0000000,00000003,00000000,00000003,00000080,00000000), ref: 00746733
_memset.LIBCMT ref: 00746754
DeviceIoControl.KERNEL32(00000000,0004D02C,?,00000200,?,00000200,?,00000000), ref: 007467A6
CloseHandle.KERNEL32(00000000), ref: 007467AF

Memory Dump Source

Source File: 00000000.00000002.1281263787.0000000000701000.00000020.00000001.01000000.00000003.sdmp, Offset: 00700000, based on PE: true

Associated: 00000000.00000002.1281243473.0000000000700000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1281360671.000000000078D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1281360671.00000000007AE000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1281496264.00000000007BA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1281529307.00000000007C4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1281529307.00000000007C7000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1281529307.00000000007D5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1281529307.00000000007D7000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_700000_OC & PL.jbxd

Similarity

API ID: CloseControlCreateDeviceFileHandle_memset
String ID:
API String ID: 1157408455-0
Opcode ID: 64bfd5ee9f3be4fe374117b2f2f4a8da2b43f8a8c26709a1216a8df855f17b7f
Instruction ID: 132387c03b48ce6a5fe5566c267de6508ab2cbd7e964455773c46a925a498070
Opcode Fuzzy Hash: 64bfd5ee9f3be4fe374117b2f2f4a8da2b43f8a8c26709a1216a8df855f17b7f
Instruction Fuzzy Hash: 90110A71941228BAE73067A5AC4DFABBBBCEF45724F10419AF504E71D0D3744E808BB9

Function 0073B1CC Relevance: 6.1, APIs: 4, Instructions: 63memoryCOMMON

Download Yara Rule

APIs

Part of subcall function 0073AA62: GetTokenInformation.ADVAPI32(?,00000002,?,00000000,?), ref: 0073AA79
Part of subcall function 0073AA62: GetLastError.KERNEL32(?,00000002,?,00000000,?), ref: 0073AA83
Part of subcall function 0073AA62: GetProcessHeap.KERNEL32(00000008,?,?,00000002,?,00000000,?), ref: 0073AA92
Part of subcall function 0073AA62: HeapAlloc.KERNEL32(00000000,?,00000002,?,00000000,?), ref: 0073AA99
Part of subcall function 0073AA62: GetTokenInformation.ADVAPI32(?,00000002,00000000,?,?,?,00000002,?,00000000,?), ref: 0073AAAF

GetLengthSid.ADVAPI32(?,00000000,0073ADE4,?,?), ref: 0073B21B
GetProcessHeap.KERNEL32(00000008,00000000), ref: 0073B227
HeapAlloc.KERNEL32(00000000), ref: 0073B22E
CopySid.ADVAPI32(?,00000000,?), ref: 0073B247

Memory Dump Source

Source File: 00000000.00000002.1281263787.0000000000701000.00000020.00000001.01000000.00000003.sdmp, Offset: 00700000, based on PE: true

Associated: 00000000.00000002.1281243473.0000000000700000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1281360671.000000000078D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1281360671.00000000007AE000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1281496264.00000000007BA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1281529307.00000000007C4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1281529307.00000000007C7000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1281529307.00000000007D5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1281529307.00000000007D7000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_700000_OC & PL.jbxd

Similarity

API ID: Heap$AllocInformationProcessToken$CopyErrorLastLength
String ID:
API String ID: 4217664535-0
Opcode ID: 2c265262f89663e6fd53d263872d318c969fb9da7f6b4797c6104de1bc1a7c9f
Instruction ID: 6b92953952b201b307817460d4123e2106d12b112c0780ee9d6765f77230e919
Opcode Fuzzy Hash: 2c265262f89663e6fd53d263872d318c969fb9da7f6b4797c6104de1bc1a7c9f
Instruction Fuzzy Hash: 07113DB1A00205EFEB149F94DC85AAFB7A9FF85314F14812EEA4297252D739AE44DB10

Function 0073B478 Relevance: 6.1, APIs: 4, Instructions: 58windowCOMMON

Download Yara Rule

APIs

SendMessageW.USER32(?,000000B0,?,?), ref: 0073B498
SendMessageW.USER32(?,000000C9,?,00000000), ref: 0073B4AA
SendMessageW.USER32(?,000000C9,?,00000000), ref: 0073B4C0
SendMessageW.USER32(?,000000C9,?,00000000), ref: 0073B4DB

Memory Dump Source

Source File: 00000000.00000002.1281263787.0000000000701000.00000020.00000001.01000000.00000003.sdmp, Offset: 00700000, based on PE: true

Associated: 00000000.00000002.1281243473.0000000000700000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1281360671.000000000078D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1281360671.00000000007AE000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1281496264.00000000007BA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1281529307.00000000007C4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1281529307.00000000007C7000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1281529307.00000000007D5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1281529307.00000000007D7000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_700000_OC & PL.jbxd

Similarity

API ID: MessageSend
String ID:
API String ID: 3850602802-0
Opcode ID: e36e0f44b35426a8487bbb379707b768f0ba7ef82d4b4bf38fdedfd2cb422c3c
Instruction ID: fc165ea568b5219971d4be9142a1f25f65c2a9a38baa001b95f857eb5ff54b15
Opcode Fuzzy Hash: e36e0f44b35426a8487bbb379707b768f0ba7ef82d4b4bf38fdedfd2cb422c3c
Instruction Fuzzy Hash: D7115A7A900218FFEB11DFA8C985E9DBBB4FB08700F204091E604B7291D771AE10DB94

Function 0071B55D Relevance: 6.1, APIs: 4, Instructions: 56COMMON

Download Yara Rule

APIs

Part of subcall function 0071B34E: GetWindowLongW.USER32(?,000000EB), ref: 0071B35F

DefDlgProcW.USER32(?,00000020,?,00000000), ref: 0071B5A5
GetClientRect.USER32(?,?), ref: 0077E69A
GetCursorPos.USER32(?), ref: 0077E6A4
ScreenToClient.USER32(?,?), ref: 0077E6AF

Memory Dump Source

Source File: 00000000.00000002.1281263787.0000000000701000.00000020.00000001.01000000.00000003.sdmp, Offset: 00700000, based on PE: true

Associated: 00000000.00000002.1281243473.0000000000700000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1281360671.000000000078D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1281360671.00000000007AE000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1281496264.00000000007BA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1281529307.00000000007C4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1281529307.00000000007C7000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1281529307.00000000007D5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1281529307.00000000007D7000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_700000_OC & PL.jbxd

Similarity

API ID: Client$CursorLongProcRectScreenWindow
String ID:
API String ID: 4127811313-0
Opcode ID: 1404bc280a87808afe17f6d46917652f1f0bf8bb8dd7c5dce38e1a0bfb22d10f
Instruction ID: bbf39562e351f978ca395731ed107d9bacf287b6fe2d58e094dabea5f9fe522b
Opcode Fuzzy Hash: 1404bc280a87808afe17f6d46917652f1f0bf8bb8dd7c5dce38e1a0bfb22d10f
Instruction Fuzzy Hash: 72110A31900029FBDF10DFA8DC499EE77B9EB09304F504499E911E7181D738AAA1CBA5

Function 0074732B Relevance: 6.1, APIs: 4, Instructions: 55synchronizationthreadwindowCOMMON

Download Yara Rule

APIs

GetCurrentThreadId.KERNEL32 ref: 00747352
MessageBoxW.USER32(?,?,?,?), ref: 00747385
WaitForSingleObject.KERNEL32(00000000,000000FF,?,?,?,?), ref: 0074739B
CloseHandle.KERNEL32(00000000,?,?,?,?), ref: 007473A2

Memory Dump Source

Source File: 00000000.00000002.1281263787.0000000000701000.00000020.00000001.01000000.00000003.sdmp, Offset: 00700000, based on PE: true

Associated: 00000000.00000002.1281243473.0000000000700000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1281360671.000000000078D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1281360671.00000000007AE000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1281496264.00000000007BA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1281529307.00000000007C4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1281529307.00000000007C7000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1281529307.00000000007D5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1281529307.00000000007D7000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_700000_OC & PL.jbxd

Similarity

API ID: CloseCurrentHandleMessageObjectSingleThreadWait
String ID:
API String ID: 2880819207-0
Opcode ID: 83b7c1d6a9aeb8778fdec00693a199f0e13637a13ea86704cb2d4eb43cd8930c
Instruction ID: bcdece5771ecb54ee43a5b2ccb753e51b36e500589fb8df235fe475eb172f41d
Opcode Fuzzy Hash: 83b7c1d6a9aeb8778fdec00693a199f0e13637a13ea86704cb2d4eb43cd8930c
Instruction Fuzzy Hash: D1110472A04258BFCB059FACDC09E9E7BADAB49310F14C319F821D32A1D778CD009BA4

Function 0071D17C Relevance: 6.1, APIs: 4, Instructions: 53windowCOMMON

Download Yara Rule

APIs

CreateWindowExW.USER32(?,?,?,?,?,?,?,?,?,?,00000000,00000096), ref: 0071D1BA
GetStockObject.GDI32(00000011), ref: 0071D1CE
SendMessageW.USER32(00000000,00000030,00000000), ref: 0071D1D8

Memory Dump Source

Source File: 00000000.00000002.1281263787.0000000000701000.00000020.00000001.01000000.00000003.sdmp, Offset: 00700000, based on PE: true

Associated: 00000000.00000002.1281243473.0000000000700000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1281360671.000000000078D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1281360671.00000000007AE000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1281496264.00000000007BA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1281529307.00000000007C4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1281529307.00000000007C7000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1281529307.00000000007D5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1281529307.00000000007D7000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_700000_OC & PL.jbxd

Similarity

API ID: CreateMessageObjectSendStockWindow
String ID:
API String ID: 3970641297-0
Opcode ID: c5e5ca731ef056bbd7503dcea0d28f4e4bfb11dfbe735522de0ab0ba36886243
Instruction ID: 5854d4a2aa6513cb5986eae7ec3b3f386a3add5f7380f813493a81f51fe6c73a
Opcode Fuzzy Hash: c5e5ca731ef056bbd7503dcea0d28f4e4bfb11dfbe735522de0ab0ba36886243
Instruction Fuzzy Hash: B711AD7250150DBFEF224F949C54EEABB6AFF083A4F168115FA0452090C739DCA0AFA0

Function 00734DF2 Relevance: 6.0, APIs: 4, Instructions: 48COMMONLIBRARYCODE

Download Yara Rule

APIs

__cftof_l.LIBCMT ref: 00734E16

Part of subcall function 007354F5: __fltout2.LIBCMT ref: 0073551E

__cftog_l.LIBCMT ref: 00734E3C
__cftoe_l.LIBCMT ref: 00734E6E

Memory Dump Source

Source File: 00000000.00000002.1281263787.0000000000701000.00000020.00000001.01000000.00000003.sdmp, Offset: 00700000, based on PE: true

Associated: 00000000.00000002.1281243473.0000000000700000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1281360671.000000000078D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1281360671.00000000007AE000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1281496264.00000000007BA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1281529307.00000000007C4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1281529307.00000000007C7000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1281529307.00000000007D5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1281529307.00000000007D7000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_700000_OC & PL.jbxd

Similarity

API ID: __cftoe_l__cftof_l__cftog_l__fltout2
String ID:
API String ID: 3016257755-0
Opcode ID: 3c6a35542a271610c24967ae1addb0a5128256cd46e27c9700edfec13bdc5c5a
Instruction ID: 7906ffdba962f5d95291a11ff31227cca0e116a4d224c1dbb8b2cba607d6a58a
Opcode Fuzzy Hash: 3c6a35542a271610c24967ae1addb0a5128256cd46e27c9700edfec13bdc5c5a
Instruction Fuzzy Hash: 10014C7204014EFBDF1A5E94DC058EE3F23BB18355F588455FE1859132D33AEAB1AB81

Function 00727452 Relevance: 6.0, APIs: 4, Instructions: 47COMMONLIBRARYCODE

Download Yara Rule

APIs

Part of subcall function 00727A0D: __getptd_noexit.LIBCMT ref: 00727A0E

__lock.LIBCMT ref: 0072748F
InterlockedDecrement.KERNEL32(?), ref: 007274AC
_free.LIBCMT ref: 007274BF
InterlockedIncrement.KERNEL32(00D647A0), ref: 007274D7

Memory Dump Source

Source File: 00000000.00000002.1281263787.0000000000701000.00000020.00000001.01000000.00000003.sdmp, Offset: 00700000, based on PE: true

Associated: 00000000.00000002.1281243473.0000000000700000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1281360671.000000000078D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1281360671.00000000007AE000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1281496264.00000000007BA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1281529307.00000000007C4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1281529307.00000000007C7000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1281529307.00000000007D5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1281529307.00000000007D7000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_700000_OC & PL.jbxd

Similarity

API ID: Interlocked$DecrementIncrement__getptd_noexit__lock_free
String ID:
API String ID: 2704283638-0
Opcode ID: e473e193eed6afc498a89edba8e1bf3e34421b268dda1e094c9dbfb5d5805e80
Instruction ID: f70a409b27a9d7ecd46d0ee453881435a00ba360fcef0e298e10a59db4ef3f8f
Opcode Fuzzy Hash: e473e193eed6afc498a89edba8e1bf3e34421b268dda1e094c9dbfb5d5805e80
Instruction Fuzzy Hash: 8E018032909671FBC72ABF65BA0AB5DBB60BF04710F148109F81467690CB3C6941CFD6

Function 0076EA6A Relevance: 6.0, APIs: 4, Instructions: 31COMMON

Download Yara Rule

APIs

Part of subcall function 0071AF83: ExtCreatePen.GDI32(?,?,00000000,00000000,00000000,?,?,00000000), ref: 0071AFE3
Part of subcall function 0071AF83: SelectObject.GDI32(?,00000000), ref: 0071AFF2
Part of subcall function 0071AF83: BeginPath.GDI32(?), ref: 0071B009
Part of subcall function 0071AF83: SelectObject.GDI32(?,00000000), ref: 0071B033

MoveToEx.GDI32(00000000,00000000,?,00000000), ref: 0076EA8E
LineTo.GDI32(00000000,?,?), ref: 0076EA9B
EndPath.GDI32(00000000), ref: 0076EAAB
StrokePath.GDI32(00000000), ref: 0076EAB9

Memory Dump Source

Source File: 00000000.00000002.1281263787.0000000000701000.00000020.00000001.01000000.00000003.sdmp, Offset: 00700000, based on PE: true

Associated: 00000000.00000002.1281243473.0000000000700000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1281360671.000000000078D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1281360671.00000000007AE000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1281496264.00000000007BA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1281529307.00000000007C4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1281529307.00000000007C7000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1281529307.00000000007D5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1281529307.00000000007D7000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_700000_OC & PL.jbxd

Similarity

API ID: Path$ObjectSelect$BeginCreateLineMoveStroke
String ID:
API String ID: 1539411459-0
Opcode ID: be29bdcf1ab91e764efb477a2255346de39005bac534bbf0bd654b12bdb03f94
Instruction ID: bcac0d99a140cad85118740517b3a0205fcf7cf18c9e6b0d66e0d57454db0128
Opcode Fuzzy Hash: be29bdcf1ab91e764efb477a2255346de39005bac534bbf0bd654b12bdb03f94
Instruction Fuzzy Hash: 7BF05E31045259BBDB22AF94AC0EFCA3F1AAF06311F14C201FE11650E1877D9952DBA9

Function 0073C82D Relevance: 6.0, APIs: 4, Instructions: 30threadwindowtimeCOMMON

Download Yara Rule

APIs

SendMessageTimeoutW.USER32(?,00000000,00000000,00000000,00000002,00001388,00000001), ref: 0073C84A
GetWindowThreadProcessId.USER32(?,00000000), ref: 0073C85D
GetCurrentThreadId.KERNEL32 ref: 0073C864
AttachThreadInput.USER32(00000000), ref: 0073C86B

Memory Dump Source

Source File: 00000000.00000002.1281263787.0000000000701000.00000020.00000001.01000000.00000003.sdmp, Offset: 00700000, based on PE: true

Associated: 00000000.00000002.1281243473.0000000000700000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1281360671.000000000078D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1281360671.00000000007AE000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1281496264.00000000007BA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1281529307.00000000007C4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1281529307.00000000007C7000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1281529307.00000000007D5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1281529307.00000000007D7000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_700000_OC & PL.jbxd

Similarity

API ID: Thread$AttachCurrentInputMessageProcessSendTimeoutWindow
String ID:
API String ID: 2710830443-0
Opcode ID: 4b4dfa6a206bdcf431a98dd9fac1b2b55d5e9b25d30069cbcf60e44a18fa24e8
Instruction ID: f86160720e5cf8bbbba391951afd2c13e206d9bbc9e57c95d5050c9c819e30ea
Opcode Fuzzy Hash: 4b4dfa6a206bdcf431a98dd9fac1b2b55d5e9b25d30069cbcf60e44a18fa24e8
Instruction Fuzzy Hash: 9BE0657158122C76EB211BA1DC0DEDB7F1CEF057A1F00C011B60D94491D679C981C7E0

Function 0073B0CD Relevance: 6.0, APIs: 4, Instructions: 23threadCOMMON

Download Yara Rule

APIs

GetCurrentThread.KERNEL32 ref: 0073B0D6
OpenThreadToken.ADVAPI32(00000000,?,?,?,0073AC9D), ref: 0073B0DD
GetCurrentProcess.KERNEL32(00000028,?,?,?,?,0073AC9D), ref: 0073B0EA
OpenProcessToken.ADVAPI32(00000000,?,?,?,0073AC9D), ref: 0073B0F1

Memory Dump Source

Source File: 00000000.00000002.1281263787.0000000000701000.00000020.00000001.01000000.00000003.sdmp, Offset: 00700000, based on PE: true

Associated: 00000000.00000002.1281243473.0000000000700000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1281360671.000000000078D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1281360671.00000000007AE000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1281496264.00000000007BA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1281529307.00000000007C4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1281529307.00000000007C7000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1281529307.00000000007D5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1281529307.00000000007D7000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_700000_OC & PL.jbxd

Similarity

API ID: CurrentOpenProcessThreadToken
String ID:
API String ID: 3974789173-0
Opcode ID: fc8c40a47775231fd003518cb96665fc37a5749b9d79a90b962ee1f2b8c6c6e2
Instruction ID: 6839642176dc8c401849942816458e97256d64689ccde553d2cdd1f4553d536a
Opcode Fuzzy Hash: fc8c40a47775231fd003518cb96665fc37a5749b9d79a90b962ee1f2b8c6c6e2
Instruction Fuzzy Hash: 74E04F32A412119BE7302FB15D0CB873BA9AF55795F21C818A341D6080DA6C98018765

Function 0071B47D Relevance: 6.0, APIs: 4, Instructions: 22COMMON

Download Yara Rule

APIs

GetSysColor.USER32(00000008), ref: 0071B496
SetTextColor.GDI32(?,000000FF), ref: 0071B4A0
SetBkMode.GDI32(?,00000001), ref: 0071B4B5
GetStockObject.GDI32(00000005), ref: 0071B4BD
GetWindowDC.USER32(?,00000000), ref: 0077DE2B
GetPixel.GDI32(00000000,00000000,00000000), ref: 0077DE38
GetPixel.GDI32(00000000,?,00000000), ref: 0077DE51
GetPixel.GDI32(00000000,00000000,?), ref: 0077DE6A
GetPixel.GDI32(00000000,?,?), ref: 0077DE8A
ReleaseDC.USER32(?,00000000), ref: 0077DE95

Memory Dump Source

Source File: 00000000.00000002.1281263787.0000000000701000.00000020.00000001.01000000.00000003.sdmp, Offset: 00700000, based on PE: true

Associated: 00000000.00000002.1281243473.0000000000700000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1281360671.000000000078D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1281360671.00000000007AE000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1281496264.00000000007BA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1281529307.00000000007C4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1281529307.00000000007C7000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1281529307.00000000007D5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1281529307.00000000007D7000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_700000_OC & PL.jbxd

Similarity

API ID: Pixel$Color$ModeObjectReleaseStockTextWindow
String ID:
API String ID: 1946975507-0
Opcode ID: 1cd96da5db48c41df1d1198acca234dbe3ce54ed298cadd066f14628372f090c
Instruction ID: cec86293da62d8a0162382db65b0c219f9f71b73fe408e668d03ee8b67740a9d
Opcode Fuzzy Hash: 1cd96da5db48c41df1d1198acca234dbe3ce54ed298cadd066f14628372f090c
Instruction Fuzzy Hash: 5FE06D31540244AADF316B68EC0DBD83B22AF51335F24C226FA69580E1D3B94D80CB11

Function 0073B2D4 Relevance: 6.0, APIs: 4, Instructions: 20synchronizationCOMMON

Download Yara Rule

APIs

WaitForSingleObject.KERNEL32(?,000000FF), ref: 0073B2DF
UnloadUserProfile.USERENV(?,?), ref: 0073B2EB
CloseHandle.KERNEL32(?), ref: 0073B2F4
CloseHandle.KERNEL32(?), ref: 0073B2FC

Part of subcall function 0073AB24: GetProcessHeap.KERNEL32(00000000,?,0073A848), ref: 0073AB2B
Part of subcall function 0073AB24: HeapFree.KERNEL32(00000000), ref: 0073AB32

Memory Dump Source

Source File: 00000000.00000002.1281263787.0000000000701000.00000020.00000001.01000000.00000003.sdmp, Offset: 00700000, based on PE: true

Associated: 00000000.00000002.1281243473.0000000000700000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1281360671.000000000078D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1281360671.00000000007AE000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1281496264.00000000007BA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1281529307.00000000007C4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1281529307.00000000007C7000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1281529307.00000000007D5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1281529307.00000000007D7000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_700000_OC & PL.jbxd

Similarity

API ID: CloseHandleHeap$FreeObjectProcessProfileSingleUnloadUserWait
String ID:
API String ID: 146765662-0
Opcode ID: be395656791c2ddb18b0632788db6a6c94584f6e79968bcbd1ba8a3e48be75ef
Instruction ID: 282bf7d9e5854014023eadd2ef3cc0f206619c264ee8878f741b73b49aefa723
Opcode Fuzzy Hash: be395656791c2ddb18b0632788db6a6c94584f6e79968bcbd1ba8a3e48be75ef
Instruction Fuzzy Hash: 43E0B63A144005FBDB112BA5EC08859FBA6FF98321720C221F625819B1CB3AAC71EB95

Function 0077B29A Relevance: 6.0, APIs: 4, Instructions: 20COMMON

Download Yara Rule

APIs

GetDesktopWindow.USER32 ref: 0077B29A
GetDC.USER32(00000000), ref: 0077B2A4
GetDeviceCaps.GDI32(00000000,0000000C), ref: 0077B2C3
ReleaseDC.USER32 ref: 0077B2E2

Memory Dump Source

Source File: 00000000.00000002.1281263787.0000000000701000.00000020.00000001.01000000.00000003.sdmp, Offset: 00700000, based on PE: true

Associated: 00000000.00000002.1281243473.0000000000700000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1281360671.000000000078D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1281360671.00000000007AE000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1281496264.00000000007BA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1281529307.00000000007C4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1281529307.00000000007C7000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1281529307.00000000007D5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1281529307.00000000007D7000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_700000_OC & PL.jbxd

Similarity

API ID: CapsDesktopDeviceReleaseWindow
String ID:
API String ID: 2889604237-0
Opcode ID: e31c53e7c422db6b45468500a1a0df71d46e4d9ec05ac90b72f1177685ccf3cc
Instruction ID: 7a41b85de161b7f33a935a5cbd4c5f290a2d629ff3261e83bd7198110f58efc0
Opcode Fuzzy Hash: e31c53e7c422db6b45468500a1a0df71d46e4d9ec05ac90b72f1177685ccf3cc
Instruction Fuzzy Hash: B8E01AB1240208EFDB106F70884CA6D7BA9FB4C390F21C805F95A87291EA7C9C418B54

Function 0077B2AE Relevance: 6.0, APIs: 4, Instructions: 19COMMON

Download Yara Rule

APIs

GetDesktopWindow.USER32 ref: 0077B2AE
GetDC.USER32(00000000), ref: 0077B2B8
GetDeviceCaps.GDI32(00000000,0000000C), ref: 0077B2C3
ReleaseDC.USER32 ref: 0077B2E2

Memory Dump Source

Source File: 00000000.00000002.1281263787.0000000000701000.00000020.00000001.01000000.00000003.sdmp, Offset: 00700000, based on PE: true

Associated: 00000000.00000002.1281243473.0000000000700000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1281360671.000000000078D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1281360671.00000000007AE000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1281496264.00000000007BA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1281529307.00000000007C4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1281529307.00000000007C7000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1281529307.00000000007D5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1281529307.00000000007D7000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_700000_OC & PL.jbxd

Similarity

API ID: CapsDesktopDeviceReleaseWindow
String ID:
API String ID: 2889604237-0
Opcode ID: 0648ea13e3be674b4eea23530d777d22196441cb22a68314c6cfddf97a4e3829
Instruction ID: 4f920464d1071710ee66ad6b86a7062128f990d3cc38034347684f95ba54c773
Opcode Fuzzy Hash: 0648ea13e3be674b4eea23530d777d22196441cb22a68314c6cfddf97a4e3829
Instruction Fuzzy Hash: CEE04FB1640204EFDB106F70C84C56D7BA9FB4C390F21C405F95A87291EB7C9C418F54

Function 0073DCDF Relevance: 5.5, APIs: 1, Strings: 2, Instructions: 240comCOMMON

Download Yara Rule

APIs

OleSetContainedObject.OLE32(?,00000001), ref: 0073DEAA

Strings

Container, xrefs: 0073DE29
AutoIt3GUI, xrefs: 0073DE22

Memory Dump Source

Source File: 00000000.00000002.1281263787.0000000000701000.00000020.00000001.01000000.00000003.sdmp, Offset: 00700000, based on PE: true

Associated: 00000000.00000002.1281243473.0000000000700000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1281360671.000000000078D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1281360671.00000000007AE000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1281496264.00000000007BA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1281529307.00000000007C4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1281529307.00000000007C7000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1281529307.00000000007D5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1281529307.00000000007D7000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_700000_OC & PL.jbxd

Similarity

API ID: ContainedObject
String ID: AutoIt3GUI$Container
API String ID: 3565006973-3941886329
Opcode ID: 55740c0f3b7f90301fef1d35550f1d0fd732e357b05c4026642b4f2e47c821b1
Instruction ID: 8d712f489db2b4b90492a218468398e2c22dd26e9678a689eb7f283cd6755826
Opcode Fuzzy Hash: 55740c0f3b7f90301fef1d35550f1d0fd732e357b05c4026642b4f2e47c821b1
Instruction Fuzzy Hash: 6B9139706006019FEB24DF64D888F6ABBB5BF49710F10856DF85ACB292DB78ED41CB50

Function 0074290D Relevance: 5.4, APIs: 1, Strings: 2, Instructions: 147COMMON

Download Yara Rule

APIs

_wcscpy.LIBCMT ref: 00742A72

Strings

I/w, xrefs: 0074297F
I/w, xrefs: 007429FC, 00742A64, 00742A12

Memory Dump Source

Source File: 00000000.00000002.1281263787.0000000000701000.00000020.00000001.01000000.00000003.sdmp, Offset: 00700000, based on PE: true

Associated: 00000000.00000002.1281243473.0000000000700000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1281360671.000000000078D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1281360671.00000000007AE000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1281496264.00000000007BA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1281529307.00000000007C4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1281529307.00000000007C7000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1281529307.00000000007D5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1281529307.00000000007D7000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_700000_OC & PL.jbxd

Similarity

API ID: _wcscpy
String ID: I/w$I/w
API String ID: 3048848545-2106668604
Opcode ID: 88dfdb524e9d45900ed7a20722aa58de949687d2b7979f4fca71de7ff0cb1198
Instruction ID: efac9ee06a3dc7b16a63ff1a965583cb8de807ddb000ff86083167e3a16ef51c
Opcode Fuzzy Hash: 88dfdb524e9d45900ed7a20722aa58de949687d2b7979f4fca71de7ff0cb1198
Instruction Fuzzy Hash: 5B419335A00216EACF25EF94D4415FDB7B0EF48310F94905AFD81A7192DB386EA3D764

Function 0074C56D Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 137COMMON

Download Yara Rule

APIs

Part of subcall function 007044ED: __fread_nolock.LIBCMT ref: 0070450B

_wcscmp.LIBCMT ref: 0074C65D
_wcscmp.LIBCMT ref: 0074C670

Strings

FILE, xrefs: 0074C5A5

Memory Dump Source

Source File: 00000000.00000002.1281263787.0000000000701000.00000020.00000001.01000000.00000003.sdmp, Offset: 00700000, based on PE: true

Associated: 00000000.00000002.1281243473.0000000000700000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1281360671.000000000078D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1281360671.00000000007AE000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1281496264.00000000007BA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1281529307.00000000007C4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1281529307.00000000007C7000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1281529307.00000000007D5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1281529307.00000000007D7000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_700000_OC & PL.jbxd

Similarity

API ID: _wcscmp$__fread_nolock
String ID: FILE
API String ID: 4029003684-3121273764
Opcode ID: 862610438b0b00d8c9b5a207c06d5e066d1263ca344123ef3ef70e04a75c26be
Instruction ID: 0a0888a7b58608b1658fb9704f8411b18a8c963f3f497b2b5a6e47198d771a80
Opcode Fuzzy Hash: 862610438b0b00d8c9b5a207c06d5e066d1263ca344123ef3ef70e04a75c26be
Instruction Fuzzy Hash: 1041D472A0021AFBDF219AA4DC45FEF77F9AF49714F014069F605EB181D7789A04CB61

Function 0076A76A Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 96windowCOMMON

Download Yara Rule

APIs

SendMessageW.USER32(?,00001132,00000000,?), ref: 0076A85A
SendMessageW.USER32(?,00001105,00000000,00000000), ref: 0076A86F

Strings

', xrefs: 0076A7C3

Memory Dump Source

Source File: 00000000.00000002.1281263787.0000000000701000.00000020.00000001.01000000.00000003.sdmp, Offset: 00700000, based on PE: true

Associated: 00000000.00000002.1281243473.0000000000700000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1281360671.000000000078D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1281360671.00000000007AE000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1281496264.00000000007BA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1281529307.00000000007C4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1281529307.00000000007C7000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1281529307.00000000007D5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1281529307.00000000007D7000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_700000_OC & PL.jbxd

Similarity

API ID: MessageSend
String ID: '
API String ID: 3850602802-1997036262
Opcode ID: 166c9abb6b73c1d3f43302ebb2d0a8835720c276ccf876cdaabfd4595e7b4ece
Instruction ID: 99902361a5467f70d5356344c1d874c7b8e7d30efe04670760cf1d9c8fffd364
Opcode Fuzzy Hash: 166c9abb6b73c1d3f43302ebb2d0a8835720c276ccf876cdaabfd4595e7b4ece
Instruction Fuzzy Hash: C341E774E0130AAFDB14CFA8C881BDABBB9FB09310F14416AED05AB381D774A941DF91

Function 0076975A Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 95COMMON

Download Yara Rule

APIs

DestroyWindow.USER32(?,?,?,?), ref: 0076980E
MoveWindow.USER32(?,?,?,?,?,00000001,?,?,?), ref: 0076984A

Strings

static, xrefs: 007697AA

Memory Dump Source

Source File: 00000000.00000002.1281263787.0000000000701000.00000020.00000001.01000000.00000003.sdmp, Offset: 00700000, based on PE: true

Associated: 00000000.00000002.1281243473.0000000000700000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1281360671.000000000078D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1281360671.00000000007AE000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1281496264.00000000007BA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1281529307.00000000007C4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1281529307.00000000007C7000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1281529307.00000000007D5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1281529307.00000000007D7000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_700000_OC & PL.jbxd

Similarity

API ID: Window$DestroyMove
String ID: static
API String ID: 2139405536-2160076837
Opcode ID: de6ec320619f1284f6ef849c5c472fd4c19769d1798da18849f683d63defe4ff
Instruction ID: 8ab30aff5bc2a915180456bef4e6a7b38156442419822ea4d44b63bd2ba8bb66
Opcode Fuzzy Hash: de6ec320619f1284f6ef849c5c472fd4c19769d1798da18849f683d63defe4ff
Instruction Fuzzy Hash: CF31AF71110605AEEB119F38CC80BFB73ADFF99764F508619F9AAC7190DA39AC81C764

Function 00745157 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 87windowCOMMON

Download Yara Rule

APIs

_memset.LIBCMT ref: 007451C6
GetMenuItemInfoW.USER32(?,?,00000000,00000030), ref: 00745201

Strings

0, xrefs: 007451BF

Memory Dump Source

Source File: 00000000.00000002.1281263787.0000000000701000.00000020.00000001.01000000.00000003.sdmp, Offset: 00700000, based on PE: true

Associated: 00000000.00000002.1281243473.0000000000700000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1281360671.000000000078D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1281360671.00000000007AE000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1281496264.00000000007BA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1281529307.00000000007C4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1281529307.00000000007C7000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1281529307.00000000007D5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1281529307.00000000007D7000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_700000_OC & PL.jbxd

Similarity

API ID: InfoItemMenu_memset
String ID: 0
API String ID: 2223754486-4108050209
Opcode ID: c45efbfb9584676e9dcf1c6be711787c892e56f4a33c407345dab615fed6573e
Instruction ID: 6482e318a7d5d9a9aa35b1ec02c73afbf9f6ff00c5f2e8368e32aa6444bb674b
Opcode Fuzzy Hash: c45efbfb9584676e9dcf1c6be711787c892e56f4a33c407345dab615fed6573e
Instruction Fuzzy Hash: A931D871600708EBEB24CF99D845B9EBBF5FF45350F14402EE985A61A2D7F89A44CB50

Function 0075658B Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 83COMMON

Download Yara Rule

APIs

__snwprintf.LIBCMT ref: 00756608

Strings

AUTOITCALLVARIABLE%d, xrefs: 007565FA
, $, xrefs: 00756648

Memory Dump Source

Source File: 00000000.00000002.1281263787.0000000000701000.00000020.00000001.01000000.00000003.sdmp, Offset: 00700000, based on PE: true

Associated: 00000000.00000002.1281243473.0000000000700000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1281360671.000000000078D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1281360671.00000000007AE000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1281496264.00000000007BA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1281529307.00000000007C4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1281529307.00000000007C7000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1281529307.00000000007D5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1281529307.00000000007D7000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_700000_OC & PL.jbxd

Similarity

API ID: __snwprintf
String ID: , $$AUTOITCALLVARIABLE%d
API String ID: 2391506597-2584243854
Opcode ID: 1a79a0af2f0c02f3d251a26606ce68322395e919ba37c264d0d2bf2ee03ef744
Instruction ID: c4408784e7cf0571a50a1a230964303c751437dc9e4578d671580070acbf2c9b
Opcode Fuzzy Hash: 1a79a0af2f0c02f3d251a26606ce68322395e919ba37c264d0d2bf2ee03ef744
Instruction Fuzzy Hash: 50216F71A00218EFCF14EFA4C886EEE77B4AF45740F400559F405AB182DB78EE49CBA1

Function 007693CF Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 72windowCOMMON

Download Yara Rule

APIs

SendMessageW.USER32(00000000,00000143,00000000,?), ref: 0076945C
SendMessageW.USER32(?,0000014E,00000000,00000000), ref: 00769467

Strings

Combobox, xrefs: 00769429

Memory Dump Source

Source File: 00000000.00000002.1281263787.0000000000701000.00000020.00000001.01000000.00000003.sdmp, Offset: 00700000, based on PE: true

Associated: 00000000.00000002.1281243473.0000000000700000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1281360671.000000000078D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1281360671.00000000007AE000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1281496264.00000000007BA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1281529307.00000000007C4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1281529307.00000000007C7000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1281529307.00000000007D5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1281529307.00000000007D7000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_700000_OC & PL.jbxd

Similarity

API ID: MessageSend
String ID: Combobox
API String ID: 3850602802-2096851135
Opcode ID: dca77ff8160e0e28762feaf1e86515406698d15f2eab6dcb7526d67d46070936
Instruction ID: bdf1fc6542e7ee341dc2ae42faa9ecb0fbdf7faf1d9712812991275bb3dbaf90
Opcode Fuzzy Hash: dca77ff8160e0e28762feaf1e86515406698d15f2eab6dcb7526d67d46070936
Instruction Fuzzy Hash: A61186B1310648AFEF219F54DC80EBB3B6EEB483A4F104125FE16972D0DA79DC529760

Function 0076DA42 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 71COMMON

Download Yara Rule

APIs

Part of subcall function 0071B34E: GetWindowLongW.USER32(?,000000EB), ref: 0071B35F

GetActiveWindow.USER32 ref: 0076DA7B
EnumChildWindows.USER32(?,0076D75F,00000000), ref: 0076DAF5

Strings

T1u, xrefs: 0076DAFB

Memory Dump Source

Source File: 00000000.00000002.1281263787.0000000000701000.00000020.00000001.01000000.00000003.sdmp, Offset: 00700000, based on PE: true

Associated: 00000000.00000002.1281243473.0000000000700000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1281360671.000000000078D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1281360671.00000000007AE000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1281496264.00000000007BA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1281529307.00000000007C4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1281529307.00000000007C7000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1281529307.00000000007D5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1281529307.00000000007D7000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_700000_OC & PL.jbxd

Similarity

API ID: Window$ActiveChildEnumLongWindows
String ID: T1u
API String ID: 3814560230-1925635455
Opcode ID: 547a6e875ccde6c5758ed8fa326d240b9411057286a879989f01e107a5a33098
Instruction ID: ea8002d9ba9c35a5bd1c6044375da15adc0f553ff0e4f6e4a2dc0e387d609e94
Opcode Fuzzy Hash: 547a6e875ccde6c5758ed8fa326d240b9411057286a879989f01e107a5a33098
Instruction Fuzzy Hash: F4216975614200DFC724DF68D850AA673E5EB4A320F65422DF86A973E1DB38AC50CB64

Function 007698FE Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 67COMMON

Download Yara Rule

APIs

Part of subcall function 0071D17C: CreateWindowExW.USER32(?,?,?,?,?,?,?,?,?,?,00000000,00000096), ref: 0071D1BA
Part of subcall function 0071D17C: GetStockObject.GDI32(00000011), ref: 0071D1CE
Part of subcall function 0071D17C: SendMessageW.USER32(00000000,00000030,00000000), ref: 0071D1D8

GetWindowRect.USER32(00000000,?), ref: 00769968
GetSysColor.USER32(00000012), ref: 00769982

Strings

static, xrefs: 00769945

Memory Dump Source

Source File: 00000000.00000002.1281263787.0000000000701000.00000020.00000001.01000000.00000003.sdmp, Offset: 00700000, based on PE: true

Associated: 00000000.00000002.1281243473.0000000000700000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1281360671.000000000078D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1281360671.00000000007AE000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1281496264.00000000007BA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1281529307.00000000007C4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1281529307.00000000007C7000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1281529307.00000000007D5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1281529307.00000000007D7000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_700000_OC & PL.jbxd

Similarity

API ID: Window$ColorCreateMessageObjectRectSendStock
String ID: static
API String ID: 1983116058-2160076837
Opcode ID: 86ef731ade4af2d0df30b4b8985bb536cbb44b71ae428577552c2242bf970e53
Instruction ID: 56c369ef844d66b4c4f21847acaf4c3731ff17d29d6149e4c59165ce4a82415f
Opcode Fuzzy Hash: 86ef731ade4af2d0df30b4b8985bb536cbb44b71ae428577552c2242bf970e53
Instruction Fuzzy Hash: 73112972510209AFDB14DFB8CC45AFA7BA8FB48354F054629FE56E2150E738E850DB60

Function 00769617 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 64windowCOMMON

Download Yara Rule

APIs

GetWindowTextLengthW.USER32(00000000), ref: 00769699
SendMessageW.USER32(?,000000B1,00000000,00000000), ref: 007696A8

Strings

edit, xrefs: 0076967D

Memory Dump Source

Source File: 00000000.00000002.1281263787.0000000000701000.00000020.00000001.01000000.00000003.sdmp, Offset: 00700000, based on PE: true

Associated: 00000000.00000002.1281243473.0000000000700000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1281360671.000000000078D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1281360671.00000000007AE000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1281496264.00000000007BA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1281529307.00000000007C4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1281529307.00000000007C7000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1281529307.00000000007D5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1281529307.00000000007D7000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_700000_OC & PL.jbxd

Similarity

API ID: LengthMessageSendTextWindow
String ID: edit
API String ID: 2978978980-2167791130
Opcode ID: 79cfae9bad67f1b71df62ace00f1ffa5d6673f28ef13430338e3f85e5847f0a8
Instruction ID: 707dcd08136ff05e7f1045d8ec16014599e48a74f7cd5cccdff0eed2d88e36f8
Opcode Fuzzy Hash: 79cfae9bad67f1b71df62ace00f1ffa5d6673f28ef13430338e3f85e5847f0a8
Instruction Fuzzy Hash: 5B116A71100208AAEF205F64DC44EEB3B6EEB053B8F604314FE66931E0C739DC50AB64

Function 00745262 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 62windowCOMMON

Download Yara Rule

APIs

_memset.LIBCMT ref: 007452D5
GetMenuItemInfoW.USER32(00000030,?,00000000,00000030), ref: 007452F4

Strings

0, xrefs: 007452CE

Memory Dump Source

Source File: 00000000.00000002.1281263787.0000000000701000.00000020.00000001.01000000.00000003.sdmp, Offset: 00700000, based on PE: true

Associated: 00000000.00000002.1281243473.0000000000700000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1281360671.000000000078D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1281360671.00000000007AE000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1281496264.00000000007BA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1281529307.00000000007C4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1281529307.00000000007C7000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1281529307.00000000007D5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1281529307.00000000007D7000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_700000_OC & PL.jbxd

Similarity

API ID: InfoItemMenu_memset
String ID: 0
API String ID: 2223754486-4108050209
Opcode ID: f0e8cc17b3d0085cd8c98a74cf0b6fc7f0a072a2c5679227bd5ef7d1c946d9c1
Instruction ID: b245ad875a6bcd1d2b41787b416e43b2228befcbaa61027947d678202fa1a5c6
Opcode Fuzzy Hash: f0e8cc17b3d0085cd8c98a74cf0b6fc7f0a072a2c5679227bd5ef7d1c946d9c1
Instruction Fuzzy Hash: AE110472901614EBDB20DF98DD04FAD77B8AB06B54F140026E901F7296D3B8ED04C7A0

Function 00754D9F Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 61networkCOMMON

Download Yara Rule

APIs

InternetOpenW.WININET(?,00000000,00000000,00000000,00000000), ref: 00754DF5
InternetSetOptionW.WININET(00000000,00000032,?,00000008), ref: 00754E1E

Strings

<local>, xrefs: 00754DE6

Memory Dump Source

Source File: 00000000.00000002.1281263787.0000000000701000.00000020.00000001.01000000.00000003.sdmp, Offset: 00700000, based on PE: true

Associated: 00000000.00000002.1281243473.0000000000700000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1281360671.000000000078D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1281360671.00000000007AE000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1281496264.00000000007BA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1281529307.00000000007C4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1281529307.00000000007C7000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1281529307.00000000007D5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1281529307.00000000007D7000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_700000_OC & PL.jbxd

Similarity

API ID: Internet$OpenOption
String ID: <local>
API String ID: 942729171-4266983199
Opcode ID: 18bb2a757a0978c38a4862ee62844cf8b3257e354482a630093989a60dec7bd0
Instruction ID: 7aa36b17c5bba9b9f7a716a3b05195b3f8a8fd9db603924692f085b263084052
Opcode Fuzzy Hash: 18bb2a757a0978c38a4862ee62844cf8b3257e354482a630093989a60dec7bd0
Instruction Fuzzy Hash: 52119E70601321BADB258B51CC89EFBFBA8FB0675AF10822AFA0556140D2B85989D6E0

Function 0072A70C Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 59COMMONLIBRARYCODE

Download Yara Rule

APIs

IsProcessorFeaturePresent.KERNEL32(00000017), ref: 007337A7
___raise_securityfailure.LIBCMT ref: 0073388E

Strings

(|, xrefs: 00733889

Memory Dump Source

Source File: 00000000.00000002.1281263787.0000000000701000.00000020.00000001.01000000.00000003.sdmp, Offset: 00700000, based on PE: true

Associated: 00000000.00000002.1281243473.0000000000700000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1281360671.000000000078D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1281360671.00000000007AE000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1281496264.00000000007BA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1281529307.00000000007C4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1281529307.00000000007C7000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1281529307.00000000007D5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1281529307.00000000007D7000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_700000_OC & PL.jbxd

Similarity

API ID: FeaturePresentProcessor___raise_securityfailure
String ID: (|
API String ID: 3761405300-620924176
Opcode ID: bc4fd04a163deca5ca9868d5724351508d4834e428bc877e19a4dc6bbfc96e82
Instruction ID: 5443793a9f08222c6141ca3edf4811af61564a500c9bb3934319de799574e7c2
Opcode Fuzzy Hash: bc4fd04a163deca5ca9868d5724351508d4834e428bc877e19a4dc6bbfc96e82
Instruction Fuzzy Hash: 9121E2B5680204DAE710EF65F985E403BB4BB48314F10D86EE5058A3A1E3FCA980CBCD

Function 0075A82C Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 52networkCOMMON

Download Yara Rule

APIs

inet_addr.WSOCK32(00000000,00000000,?,?,?,00000000), ref: 0075A84E
htons.WSOCK32(00000000,?,00000000), ref: 0075A88B

Strings

255.255.255.255, xrefs: 0075A866

Memory Dump Source

Source File: 00000000.00000002.1281263787.0000000000701000.00000020.00000001.01000000.00000003.sdmp, Offset: 00700000, based on PE: true

Associated: 00000000.00000002.1281243473.0000000000700000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1281360671.000000000078D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1281360671.00000000007AE000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1281496264.00000000007BA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1281529307.00000000007C4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1281529307.00000000007C7000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1281529307.00000000007D5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1281529307.00000000007D7000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_700000_OC & PL.jbxd

Similarity

API ID: htonsinet_addr
String ID: 255.255.255.255
API String ID: 3832099526-2422070025
Opcode ID: c584da58dcd78a16085f95cedd760abb16dfb4f6ec89c3d1dffa1b024930471b
Instruction ID: 6e6b1f2428350b80712cbabec9f2231bb97bb75b257c007eee9c7c11c22e8919
Opcode Fuzzy Hash: c584da58dcd78a16085f95cedd760abb16dfb4f6ec89c3d1dffa1b024930471b
Instruction Fuzzy Hash: BD01D675200304BBCB229F68D84AFE9B364EF44711F108676F9159B2D1D7B9F8098756

Function 00706430 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 51COMMON

Download Yara Rule

APIs

GetFullPathNameW.KERNEL32(?,00007FFF,?,?,?,00703DEE,007C1148,?,?,?,?,?,00703AA3,?), ref: 00706471
_wcscat.LIBCMT ref: 00775DDB

Strings

, xrefs: 0070648B

Memory Dump Source

Source File: 00000000.00000002.1281263787.0000000000701000.00000020.00000001.01000000.00000003.sdmp, Offset: 00700000, based on PE: true

Associated: 00000000.00000002.1281243473.0000000000700000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1281360671.000000000078D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1281360671.00000000007AE000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1281496264.00000000007BA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1281529307.00000000007C4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1281529307.00000000007C7000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1281529307.00000000007D5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1281529307.00000000007D7000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_700000_OC & PL.jbxd

Similarity

API ID: FullNamePath_wcscat
String ID:
API String ID: 2109976907-1891724858
Opcode ID: 0dce6614d35885ede8ca0f3486868f4edc44e429378a8bba25d375caa65b9e04
Instruction ID: 5197904ed5d31fe095ac3a91b8682fa80793f1cdbccafcd3324f8fc5cbcb6fac
Opcode Fuzzy Hash: 0dce6614d35885ede8ca0f3486868f4edc44e429378a8bba25d375caa65b9e04
Instruction Fuzzy Hash: 2F118E75604109EACB40EBA4C955ECD73F8EF09350B108279B549D32C1DA789B988B61

Function 0073B781 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 51windowCOMMON

Download Yara Rule

APIs

SendMessageW.USER32(?,000001A2,000000FF,?), ref: 0073B7EF

Strings

ListBox, xrefs: 0073B7B9
ComboBox, xrefs: 0073B78B

Memory Dump Source

Source File: 00000000.00000002.1281263787.0000000000701000.00000020.00000001.01000000.00000003.sdmp, Offset: 00700000, based on PE: true

Associated: 00000000.00000002.1281243473.0000000000700000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1281360671.000000000078D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1281360671.00000000007AE000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1281496264.00000000007BA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1281529307.00000000007C4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1281529307.00000000007C7000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1281529307.00000000007D5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1281529307.00000000007D7000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_700000_OC & PL.jbxd

Similarity

API ID: MessageSend
String ID: ComboBox$ListBox
API String ID: 3850602802-1403004172
Opcode ID: d4db3950f548fd9e10f82ef28d8f8c6d6bd50c3e39f8bfeb78bbefb7c3ebb32d
Instruction ID: 288f638bd0caf6973ffedf0558ea614a72d240755fc3d19103db7a04a0923f5d
Opcode Fuzzy Hash: d4db3950f548fd9e10f82ef28d8f8c6d6bd50c3e39f8bfeb78bbefb7c3ebb32d
Instruction Fuzzy Hash: B601F1B1641118EBDB05EBA4CC569FE33A9AF45350B000719F862A32D3EB7858188790

Function 0073B67D Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 49windowCOMMON

Download Yara Rule

APIs

SendMessageW.USER32(?,00000180,00000000,?), ref: 0073B6EB

Strings

ListBox, xrefs: 0073B6B5
ComboBox, xrefs: 0073B687

Memory Dump Source

Source File: 00000000.00000002.1281263787.0000000000701000.00000020.00000001.01000000.00000003.sdmp, Offset: 00700000, based on PE: true

Associated: 00000000.00000002.1281243473.0000000000700000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1281360671.000000000078D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1281360671.00000000007AE000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1281496264.00000000007BA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1281529307.00000000007C4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1281529307.00000000007C7000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1281529307.00000000007D5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1281529307.00000000007D7000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_700000_OC & PL.jbxd

Similarity

API ID: MessageSend
String ID: ComboBox$ListBox
API String ID: 3850602802-1403004172
Opcode ID: a5fb8b17271341b3c2723ed23953c7aa0f203a2b8e0b3e96aad007b8942bc790
Instruction ID: 013070f3d182f83d898a55b9993ee17c751f2d5a2a7862e06bf95f2f89c708f9
Opcode Fuzzy Hash: a5fb8b17271341b3c2723ed23953c7aa0f203a2b8e0b3e96aad007b8942bc790
Instruction Fuzzy Hash: 8A014FB1641108EBDB15EBA4D967BFE73A89B05344F100219B902A32D3EB585E1897A5

Function 0073B700 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 48windowCOMMON

Download Yara Rule

APIs

SendMessageW.USER32(?,00000182,?,00000000), ref: 0073B76C

Strings

ListBox, xrefs: 0073B738
ComboBox, xrefs: 0073B70A

Memory Dump Source

Source File: 00000000.00000002.1281263787.0000000000701000.00000020.00000001.01000000.00000003.sdmp, Offset: 00700000, based on PE: true

Associated: 00000000.00000002.1281243473.0000000000700000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1281360671.000000000078D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1281360671.00000000007AE000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1281496264.00000000007BA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1281529307.00000000007C4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1281529307.00000000007C7000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1281529307.00000000007D5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1281529307.00000000007D7000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_700000_OC & PL.jbxd

Similarity

API ID: MessageSend
String ID: ComboBox$ListBox
API String ID: 3850602802-1403004172
Opcode ID: 3b3eded85db790844518cf3716da4fb552cce0bc2f395400d1ceb9999aa202b1
Instruction ID: eeb30b884d2b9b233af550af120eecff9e389f1ae57fab6e54e280862a60fef9
Opcode Fuzzy Hash: 3b3eded85db790844518cf3716da4fb552cce0bc2f395400d1ceb9999aa202b1
Instruction Fuzzy Hash: 6601ADB1641108EBEB11EBA4D917FFE73AC9B05340F10021AB902B32D3EB6C5E1987B5

Function 00724D7C Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 45COMMON

Download Yara Rule

APIs

__calloc_crt.LIBCMT ref: 00724D9E
__calloc_crt.LIBCMT ref: 00724DB7

Strings

"|, xrefs: 00724DCE

Memory Dump Source

Source File: 00000000.00000002.1281263787.0000000000701000.00000020.00000001.01000000.00000003.sdmp, Offset: 00700000, based on PE: true

Associated: 00000000.00000002.1281243473.0000000000700000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1281360671.000000000078D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1281360671.00000000007AE000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1281496264.00000000007BA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1281529307.00000000007C4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1281529307.00000000007C7000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1281529307.00000000007D5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1281529307.00000000007D7000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_700000_OC & PL.jbxd

Similarity

API ID: __calloc_crt
String ID: "|
API String ID: 3494438863-439414699
Opcode ID: d569e48fa876b0e2d4ed8c341241b4dfcecdf40c8b494c7576db91dc3059796a
Instruction ID: 0519ceb89a61b4cf185848ce57ec68f165ab707b9dca320e048f7fed4228a7e4
Opcode Fuzzy Hash: d569e48fa876b0e2d4ed8c341241b4dfcecdf40c8b494c7576db91dc3059796a
Instruction Fuzzy Hash: F0F0C8713097219AF7249B19BC41FA667D4F704720F11852FF701CA196EB3CC98246D8

Function 00704024 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 38COMMON

Download Yara Rule

APIs

LoadImageW.USER32(00700000,00000063,00000001,00000010,00000010,00000000), ref: 00704048
EnumResourceNamesW.KERNEL32(00000000,0000000E,007467E9,00000063,00000000,75A50280,?,?,00703EE1,?,?,000000FF), ref: 007741B3

Strings

>p, xrefs: 00704028

Memory Dump Source

Source File: 00000000.00000002.1281263787.0000000000701000.00000020.00000001.01000000.00000003.sdmp, Offset: 00700000, based on PE: true

Associated: 00000000.00000002.1281243473.0000000000700000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1281360671.000000000078D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1281360671.00000000007AE000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1281496264.00000000007BA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1281529307.00000000007C4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1281529307.00000000007C7000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1281529307.00000000007D5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1281529307.00000000007D7000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_700000_OC & PL.jbxd

Similarity

API ID: EnumImageLoadNamesResource
String ID: >p
API String ID: 1578290342-4126277341
Opcode ID: 33068e89519c3a2bad960a42b0d268e39e9ff80d8ffe135e72c6a01a116416ae
Instruction ID: cf4418bbd4b8f0060f6cc8e7173f5bef251afd7b617f8025804a18c97162a1cd
Opcode Fuzzy Hash: 33068e89519c3a2bad960a42b0d268e39e9ff80d8ffe135e72c6a01a116416ae
Instruction Fuzzy Hash: 91F06271640314B7D6205B15EC46F923B99A746BB5F50811AF714A61D1D3FCD4D08798

Function 00747744 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 28COMMON

Download Yara Rule

APIs

GetClassNameW.USER32(?,?,00000100), ref: 00747762
_wcscmp.LIBCMT ref: 00747774

Strings

#32770, xrefs: 0074776E

Memory Dump Source

Source File: 00000000.00000002.1281263787.0000000000701000.00000020.00000001.01000000.00000003.sdmp, Offset: 00700000, based on PE: true

Associated: 00000000.00000002.1281243473.0000000000700000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1281360671.000000000078D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1281360671.00000000007AE000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1281496264.00000000007BA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1281529307.00000000007C4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1281529307.00000000007C7000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1281529307.00000000007D5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1281529307.00000000007D7000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_700000_OC & PL.jbxd

Similarity

API ID: ClassName_wcscmp
String ID: #32770
API String ID: 2292705959-463685578
Opcode ID: f8006b92fe9fd722389f4a36bbf7e4abfa0bd0e26275409c9c8d4b2a1b1dd1a7
Instruction ID: 954cadd4393ac407a9a18e3b4a8aa543ad3accfce9bca7de26ecb7f7c79e4d2f
Opcode Fuzzy Hash: f8006b92fe9fd722389f4a36bbf7e4abfa0bd0e26275409c9c8d4b2a1b1dd1a7
Instruction Fuzzy Hash: A6E0927760422867D720AAA6AC09EC7FBACAB51764F01405AF905D3081E778AA4187D4

Function 0073A631 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 22windowCOMMON

Download Yara Rule

APIs

MessageBoxW.USER32(00000000,Error allocating memory.,AutoIt,00000010), ref: 0073A63F

Part of subcall function 007213F1: _doexit.LIBCMT ref: 007213FB

Strings

AutoIt, xrefs: 0073A633
Error allocating memory., xrefs: 0073A638

Memory Dump Source

Source File: 00000000.00000002.1281263787.0000000000701000.00000020.00000001.01000000.00000003.sdmp, Offset: 00700000, based on PE: true

Associated: 00000000.00000002.1281243473.0000000000700000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1281360671.000000000078D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1281360671.00000000007AE000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1281496264.00000000007BA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1281529307.00000000007C4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1281529307.00000000007C7000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1281529307.00000000007D5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1281529307.00000000007D7000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_700000_OC & PL.jbxd

Similarity

API ID: Message_doexit
String ID: AutoIt$Error allocating memory.
API String ID: 1993061046-4017498283
Opcode ID: cde0494d7862c286ee28558b53478b45daf9d5afe2a1ceedf6d35d5f0adffcca
Instruction ID: 65a7e78ae7814315756a08e0795e89459fe4dc11ef8469dfe4ed44fbc6b51831
Opcode Fuzzy Hash: cde0494d7862c286ee28558b53478b45daf9d5afe2a1ceedf6d35d5f0adffcca
Instruction Fuzzy Hash: DAD02B313C4328B3D320369C3C1FFC576488B14B91F144011FB0C950D349DE998002D9

Function 0077AE86 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 21COMMON

Download Yara Rule

APIs

GetSystemDirectoryW.KERNEL32(?), ref: 0077ACC0
FreeLibrary.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,?,00000104), ref: 0077AEBD

Strings

WIN_XPe, xrefs: 0077ACD3

Memory Dump Source

Source File: 00000000.00000002.1281263787.0000000000701000.00000020.00000001.01000000.00000003.sdmp, Offset: 00700000, based on PE: true

Associated: 00000000.00000002.1281243473.0000000000700000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1281360671.000000000078D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1281360671.00000000007AE000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1281496264.00000000007BA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1281529307.00000000007C4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1281529307.00000000007C7000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1281529307.00000000007D5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1281529307.00000000007D7000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_700000_OC & PL.jbxd

Similarity

API ID: DirectoryFreeLibrarySystem
String ID: WIN_XPe
API String ID: 510247158-3257408948
Opcode ID: c9d6d5ab3ac2e02f6e6027071d41ee24b5def497f59c575d829b1f556bf67ff8
Instruction ID: 5b27c3f8d9ff2b28071a61de2eaa0b3e46a0f146b450a7dfd90f256a0d6ffb60
Opcode Fuzzy Hash: c9d6d5ab3ac2e02f6e6027071d41ee24b5def497f59c575d829b1f556bf67ff8
Instruction Fuzzy Hash: 8FE06570C00209FFDF16DBA4D9449ECB7B8AB88341F14D085E046B2160CB785E84DF36

Function 007686CC Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 15windowCOMMON

Download Yara Rule

APIs

FindWindowW.USER32(Shell_TrayWnd,00000000), ref: 007686E2
PostMessageW.USER32(00000000), ref: 007686E9

Part of subcall function 00747A58: Sleep.KERNEL32(?,00000000,?,?,?,?,?,?,?,?,?), ref: 00747AD0

Strings

Shell_TrayWnd, xrefs: 007686DB

Memory Dump Source

Source File: 00000000.00000002.1281263787.0000000000701000.00000020.00000001.01000000.00000003.sdmp, Offset: 00700000, based on PE: true

Associated: 00000000.00000002.1281243473.0000000000700000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1281360671.000000000078D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1281360671.00000000007AE000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1281496264.00000000007BA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1281529307.00000000007C4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1281529307.00000000007C7000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1281529307.00000000007D5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1281529307.00000000007D7000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_700000_OC & PL.jbxd

Similarity

API ID: FindMessagePostSleepWindow
String ID: Shell_TrayWnd
API String ID: 529655941-2988720461
Opcode ID: 472514b22fd9aeec2a31fb30d0133042197d54e2d2e28d3b66d49077eff30a2e
Instruction ID: 8d4947ad72964ec8be7d0b7dc3f5dcca622bba01465d25fdebeab68939eab62a
Opcode Fuzzy Hash: 472514b22fd9aeec2a31fb30d0133042197d54e2d2e28d3b66d49077eff30a2e
Instruction Fuzzy Hash: 37D0C9713C5328ABE27867709C0BFC66B189B04B21F614915B645AA1D0CAA8AD50C769

Function 00768698 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 15windowCOMMON

Download Yara Rule

APIs

FindWindowW.USER32(Shell_TrayWnd,00000000), ref: 007686A2
PostMessageW.USER32(00000000,00000111,00000197,00000000), ref: 007686B5

Part of subcall function 00747A58: Sleep.KERNEL32(?,00000000,?,?,?,?,?,?,?,?,?), ref: 00747AD0

Strings

Shell_TrayWnd, xrefs: 0076869B

Memory Dump Source

Source File: 00000000.00000002.1281263787.0000000000701000.00000020.00000001.01000000.00000003.sdmp, Offset: 00700000, based on PE: true

Associated: 00000000.00000002.1281243473.0000000000700000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1281360671.000000000078D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1281360671.00000000007AE000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1281496264.00000000007BA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1281529307.00000000007C4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1281529307.00000000007C7000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1281529307.00000000007D5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1281529307.00000000007D7000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_700000_OC & PL.jbxd

Similarity

API ID: FindMessagePostSleepWindow
String ID: Shell_TrayWnd
API String ID: 529655941-2988720461
Opcode ID: 613a149d28e319aa606c4a58e36b9488c1985c2eef04fff3481bf3d327cb7f11
Instruction ID: d3d7a4dfb51c44641e3ade1110940f01154cea40e109173685ed75b89dcb3ada
Opcode Fuzzy Hash: 613a149d28e319aa606c4a58e36b9488c1985c2eef04fff3481bf3d327cb7f11
Instruction Fuzzy Hash: F8D0C971384328A7E27867709C0BFD66B189B04B21F214915B649AA1D0CAA8AD50C768

Description:	Adversaries may obtain and abuse credentials of existing accounts as a means of gaining Initial Access, Persistence, Privilege Escalation, or Defense Evasion. Compromised credentials may be used to bypass access controls placed on various resources on systems within the network and may even be used for persistent access to remote systems and externally available services, such as VPNs, Outlook Web Access, network devices, and remote desktop.Compromised credentials may also grant an adversary increased privilege to specific systems or access to restricted areas of the network. Adversaries may choose not to use malware or tools in conjunction with the legitimate access those credentials provide to make it harder to detect their presence.
Tactics:	Defense Evasion, Initial Access, Persistence, Privilege Escalation
Data Sources:	Logon Session: Logon Session Creation, Logon Session: Logon Session Metadata, User Account: User Account Authentication
Platforms:	Azure AD, Containers, Google Workspace, IaaS, Linux, macOS, Network, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse Windows Management Instrumentation (WMI) to execute malicious commands and payloads. WMI is an administration feature that provides a uniform environment to access Windows system components. The WMI service enables both local and remote access, though the latter is facilitated by Remote Services such as Distributed Component Object Model (DCOM) and Windows Remote Management (WinRM).Remote WMI over DCOM operates using port 135, whereas WMI over WinRM operates over port 5985 when using HTTP and 5986 for HTTPS.
Tactics:	Execution
Data Sources:	Command: Command Execution, Network Traffic: Network Connection Creation, Process: Process Creation, WMI: WMI Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may interact with the native OS application programming interface (API) to execute behaviors. Native APIs provide a controlled means of calling low-level OS services within the kernel, such as those involving hardware/devices, memory, and processes.These native APIs are leveraged by the OS during system boot (when other system components are not yet initialized) as well as carrying out tasks and requests during routine operations.
Tactics:	Execution
Data Sources:	Module: Module Load, Process: OS API Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may execute their own malicious payloads by side-loading DLLs. Similar to DLL Search Order Hijacking , side-loading involves hijacking which DLL a program loads. But rather than just planting the DLL within the search order of a program then waiting for the victim application to be invoked, adversaries may directly side-load their payloads by planting then invoking a legitimate application that executes their payload(s).
Tactics:	Defense Evasion, Persistence, Privilege Escalation
Data Sources:	File: File Creation, File: File Modification, Module: Module Load, Process: Process Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may exploit software vulnerabilities in an attempt to elevate privileges. Exploitation of a software vulnerability occurs when an adversary takes advantage of a programming error in a program, service, or within the operating system software or kernel itself to execute adversary-controlled code. Security constructs such as permission levels will often hinder access to information and use of certain techniques, so adversaries will likely need to perform privilege escalation to include use of software exploitation to circumvent those restrictions.
Tactics:	Privilege Escalation
Data Sources:	Driver: Driver Load, Process: Process Creation
Platforms:	Containers, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may modify access tokens to operate under a different user or system security context to perform actions and bypass access controls. Windows uses access tokens to determine the ownership of a running process. A user can manipulate access tokens to make a running process appear as though it is the child of a different process or belongs to someone other than the user that started the process. When this occurs, the process also takes on the security context associated with the new token.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	Active Directory: Active Directory Object Modification, Command: Command Execution, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, User Account: User Account Metadata
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	File: File Metadata, File: File Modification, Module: Module Load, Process: OS API Execution, Process: Process Access, Process: Process Metadata, Process: Process Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may modify and/or disable security tools to avoid possible detection of their malware/tools and activities. This may take many forms, such as killing security software processes or services, modifying / deleting Registry keys or configuration files so that tools do not operate properly, or other methods to interfere with security tools scanning or reporting information. Adversaries may also disable updates to prevent the latest security patches from reaching tools on victim systems.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, Driver: Driver Load, Process: Process Creation, Process: Process Termination, Sensor Health: Host Status, Service: Service Metadata, Windows Registry: Windows Registry Key Deletion, Windows Registry: Windows Registry Key Modification
Platforms:	Containers, IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use Obfuscated Files or Information to hide artifacts of an intrusion from analysis. They may require separate mechanisms to decode or deobfuscate that information depending on how they intend to use it. Methods for doing that include built-in functionality of malware or by using utilities present on the system.
Tactics:	Defense Evasion
Data Sources:	File: File Modification, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit. This is common behavior that can be used across different platforms and the network to evade defenses.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Creation, File: File Metadata, Module: Module Load, Process: OS API Execution, Process: Process Creation, Script: Script Execution, WMI: WMI Creation, Windows Registry: Windows Registry Key Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to manipulate features of their artifacts to make them appear legitimate or benign to users and/or security tools. Masquerading occurs when the name or location of an object, legitimate or malicious, is manipulated or abused for the sake of evading defenses and observation. This may include manipulating file metadata, tricking users into misidentifying the file type, and giving legitimate task or service names.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Metadata, File: File Modification, Image: Image Metadata, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, Scheduled Job: Scheduled Job Metadata, Scheduled Job: Scheduled Job Modification, Service: Service Creation, Service: Service Metadata
Platforms:	Containers, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ various means to detect and avoid virtualization and analysis environments. This may include changing behaviors based on the results of checks for the presence of artifacts indicative of a virtual machine environment (VME) or sandbox. If the adversary detects a VME, they may alter their malware to disengage from the victim or conceal the core functions of the implant. They may also search for VME artifacts before dropping secondary or additional payloads. Adversaries may use the information learned from [Virtualization/Sandbox Evasion](https://attack.mitre.org/techniques/T1497) during automated discovery to shape follow-on behaviors.
Tactics:	Defense Evasion, Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to dump credentials to obtain account login and credential material, normally in the form of a hash or a clear text password, from the operating system and software. Credentials can then be used to perform Lateral Movement and access restricted information.
Tactics:	Credential Access
Data Sources:	Active Directory: Active Directory Object Access, Command: Command Execution, File: File Access, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow, Process: OS API Execution, Process: Process Access, Process: Process Creation, Windows Registry: Windows Registry Key Access
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use methods of capturing user input to obtain credentials or collect information. During normal system usage, users often provide credentials to various different locations, such as login pages/portals or system dialog boxes. Input capture mechanisms may be transparent to the user (e.g. Credential API Hooking ) or rely on deceiving the user into providing input into what they believe to be a genuine service (e.g. Web Portal Capture ).
Tactics:	Collection, Credential Access
Data Sources:	Driver: Driver Load, File: File Modification, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, Windows Registry: Windows Registry Key Modification
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may search the Registry on compromised systems for insecurely stored credentials. The Windows Registry stores configuration information that can be used by the system or other programs. Adversaries may query the Registry looking for credentials and passwords that have been stored for use by other programs or services. Sometimes these credentials are used for automatic logons.
Tactics:	Credential Access
Data Sources:	Command: Command Execution, Process: Process Creation, Windows Registry: Windows Registry Key Access
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	An adversary may gather the system time and/or time zone from a local or remote system. The system time is set and stored by the Windows Time Service within a domain to maintain time synchronization between systems and services in an enterprise network.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of valid accounts, usernames, or email addresses on a system or within a compromised environment. This information can help adversaries determine which accounts exist, which can aid in follow-on behavior such as brute-forcing, spear-phishing attacks, or account takeovers (e.g., Valid Accounts ).
Tactics:	Discovery
Data Sources:	Command: Command Execution, File: File Access, Process: Process Creation
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may enumerate files and directories or may search in specific locations of a host or network share for certain information within a file system. Adversaries may use the information from File and Directory Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get information about running processes on a system. Information obtained could be used to gain an understanding of common software/applications running on systems within the network. Adversaries may use the information from Process Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report OC & PL.exe

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Threat Intel

Malware Configuration

Threatname: Agenttesla

Yara Signatures

Memory Dumps

Unpacked PEs

Sigma Signatures

System Summary

Suricata Signatures

Joe Sandbox Signatures

AV Detection

Compliance

Spreading

Networking

Key, Mouse, Clipboard, Microphone and Screen Capturing

System Summary

Data Obfuscation

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

Anti Debugging

HIPS / PFW / Operating System Protection Evasion

Language, Device and Operating System Detection

Stealing of Sensitive Information

Remote Access Functionality

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

General Information

Warnings

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

C:\Users\user\AppData\Local\Temp\aut1756.tmp

C:\Users\user\AppData\Local\Temp\immortaliser

Static File Info

General

File Icon

Static PE Info

General

Entrypoint Preview

Rich Headers

Data Directories

Sections

Resources

Imports

Possible Origin

Network Behavior

Network Port Distribution

Windows Analysis Report
OC & PL.exe

Function 0072B043 Relevance: 21.5, APIs: 14, Instructions: 537
COMMONLIBRARYCODE

Function 00703D19 Relevance: 19.4, APIs: 8, Strings: 3, Instructions: 151
windowCOMMON

Function 0071DDC0 Relevance: 10.7, APIs: 7, Instructions: 175
COMMON

Function 0070406B Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 61
COMMON

Function 0074FA0C Relevance: 26.5, APIs: 13, Strings: 2, Instructions: 238
COMMON

Function 00703F53 Relevance: 19.3, APIs: 7, Strings: 4, Instructions: 53
windowregistryCOMMON

Function 0074BFA4 Relevance: 18.3, APIs: 12, Instructions: 316
fileCOMMON

Function 00703742 Relevance: 15.9, APIs: 8, Strings: 1, Instructions: 151
windowtimeregistryCOMMON

Function 00703E6E Relevance: 15.8, APIs: 6, Strings: 3, Instructions: 66
windowregistryCOMMON

Function 0072ACB3 Relevance: 15.2, APIs: 10, Instructions: 219
COMMON

Function 00F554F0 Relevance: 10.7, APIs: 7, Instructions: 239
fileCOMMON

Function 007049FB Relevance: 10.6, APIs: 4, Strings: 2, Instructions: 73
registryCOMMON

Function 007036B8 Relevance: 10.5, APIs: 4, Strings: 2, Instructions: 44
COMMON

Function 00F55260 Relevance: 8.9, APIs: 4, Strings: 1, Instructions: 164
fileCOMMON

Description:	Adversaries may attempt to identify the primary user, currently logged in user, set of users that commonly uses a system, or whether a user is actively using the system. They may do this, for example, by retrieving account usernames or by using OS Credential Dumping . The information may be collected in a number of different ways using other Discovery techniques, because user and username details are prevalent throughout a system and include running process ownership, file/directory ownership, session information, and system logs. Adversaries may use the information from [System Owner/User Discovery](https://attack.mitre.org/techniques/T1033) during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Active Directory: Active Directory Object Access, Command: Command Execution, File: File Access, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow, Process: OS API Execution, Process: Process Access, Process: Process Creation, Windows Registry: Windows Registry Key Access
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may compress and/or encrypt data that is collected prior to exfiltration. Compressing the data can help to obfuscate the collected data and minimize the amount of data sent over the network. Encryption can be used to hide information that is being exfiltrated from detection or make exfiltration less conspicuous upon inspection by a defender.
Tactics:	Collection
Data Sources:	Command: Command Execution, File: File Creation, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may search local system sources, such as file systems and configuration files or local databases, to find files of interest and sensitive data prior to Exfiltration.
Tactics:	Collection
Data Sources:	Command: Command Execution, File: File Access, Process: OS API Execution, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may target user email to collect sensitive information. Emails may contain sensitive data, including trade secrets or personal information, that can prove valuable to adversaries. Adversaries can collect or forward email from mail servers or clients.
Tactics:	Collection
Data Sources:	Application Log: Application Log Content, Command: Command Execution, File: File Access, Logon Session: Logon Session Creation, Network Traffic: Network Connection Creation
Platforms:	Google Workspace, Linux, macOS, Office 365, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may collect data stored in the clipboard from users copying information within or between applications.
Tactics:	Collection
Data Sources:	Command: Command Execution, Process: OS API Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may transfer tools or other files from an external system into a compromised environment. Tools or files may be copied from an external adversary-controlled system to the victim network through the command and control channel or through alternate protocols such as ftp . Once present, adversaries may also transfer/spread tools between victim devices within a compromised environment (i.e. Lateral Tool Transfer ).
Tactics:	Command and Control
Data Sources:	Command: Command Execution, File: File Creation, Network Traffic: Network Connection Creation, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ a known encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Despite the use of a secure algorithm, these implementations may be vulnerable to reverse engineering if secret keys are encoded and/or generated within malware samples/configuration files.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using a protocol and port pairing that are typically not associated. For example, HTTPS over port 8088or port 587as opposed to the traditional port 443. Adversaries may make changes to the standard port used by a protocol to bypass filtering or muddle analysis/parsing of network data.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use an OSI non-application layer protocol for communication between host and C2 server or among infected hosts within a network. The list of possible protocols is extensive.Specific examples include use of network layer protocols, such as the Internet Control Message Protocol (ICMP), transport layer protocols, such as the User Datagram Protocol (UDP), session layer protocols, such as Socket Secure (SOCKS), as well as redirected/tunneled protocols, such as Serial over LAN (SOL).
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using OSI application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre